From mboxrd@z Thu Jan 1 00:00:00 1970 From: James Morris Subject: Re: [PATCH] selinux: add a skb_owned_by() hook Date: Tue, 9 Apr 2013 17:38:07 +1000 (EST) Message-ID: References: <20130408154519.18177.57709.stgit@localhost> <3294227.D2rod7xgQB@sifl> <1365454501.3887.45.camel@edumazet-glaptop> <6182509.cOVcY8B4g7@sifl> <1365479891.3887.99.camel@edumazet-glaptop> Mime-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Cc: Paul Moore , David Miller , netdev@vger.kernel.org, mvadkert@redhat.com, linux-security-module@vger.kernel.org To: Eric Dumazet Return-path: In-Reply-To: <1365479891.3887.99.camel@edumazet-glaptop> Sender: linux-security-module-owner@vger.kernel.org List-Id: netdev.vger.kernel.org On Mon, 8 Apr 2013, Eric Dumazet wrote: > From: Eric Dumazet > > Commit 90ba9b1986b5ac (tcp: tcp_make_synack() can use alloc_skb()) > broke certain SELinux/NetLabel configurations by no longer correctly > assigning the sock to the outgoing SYNACK packet. > > Cost of atomic operations on the LISTEN socket is quite big, > and we would like it to happen only if really needed. > > This patch introduces a new security_ops->skb_owned_by() method, > that is a void operation unless selinux is active. > > Reported-by: Miroslav Vadkerti > Diagnosed-by: Paul Moore > Signed-off-by: Eric Dumazet > Cc: "David S. Miller" > Cc: linux-security-module@vger.kernel.org Acked-by: James Morris -- James Morris