[PATCH] labeled-ipsec-policy: Cleanup

[PATCH] labeled-ipsec-policy: Cleanup

[Venkat Yekkirala]

This modifies the mls constraint for polmatch in the association class.
Specifically:

- polmatch need no longer make an exception for unlabeled_t
  since a flow will now always match SPD rules with no contexts (per
  the IPSec leak fix patch upstreamed a few weeks back), as
  opposed to needing polmatch access to unlabeled_t.

Signed-off-by: Venkat Yekkirala <vyekkirala@TrustedCS.com>
---

--- serefpolicy-2.3.18.vanilla/policy/mls	2006-11-10 14:27:52.000000000 -0600
+++ serefpolicy-2.3.18/policy/mls	2006-11-10 14:29:43.000000000 -0600
@@ -614,7 +614,6 @@ mlsconstrain association { sendto }
 	 ( t2 == unlabeled_t ));
 
 mlsconstrain association { polmatch }
-	((( l1 dom l2 ) and ( h1 domby h2 )) or
-	 ( t2 == unlabeled_t ));
+	(( l1 dom l2 ) and ( h1 domby h2 ));
 
 ') dnl end enable_mls

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: [PATCH] labeled-ipsec-policy: Cleanup

[Christopher J. PeBenito]

On Fri, 2006-11-10 at 16:36 -0600, Venkat Yekkirala wrote:
> This modifies the mls constraint for polmatch in the association class.
> Specifically:
> 
> - polmatch need no longer make an exception for unlabeled_t
>   since a flow will now always match SPD rules with no contexts (per
>   the IPSec leak fix patch upstreamed a few weeks back), as
>   opposed to needing polmatch access to unlabeled_t.
> 
> Signed-off-by: Venkat Yekkirala <vyekkirala@TrustedCS.com>

Merged.

-- 
Chris PeBenito
Tresys Technology, LLC
(410) 290-1411 x150


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.