* [PATCH nf-next] netfilter: nf_tables: rise cap on SELinux secmark context
@ 2024-06-03 18:16 Pablo Neira Ayuso
2024-06-26 11:31 ` Pablo Neira Ayuso
0 siblings, 1 reply; 3+ messages in thread
From: Pablo Neira Ayuso @ 2024-06-03 18:16 UTC (permalink / raw)
To: netfilter-devel
secmark context is artificially limited 256 bytes, rise it to 4Kbytes.
Fixes: fb961945457f ("netfilter: nf_tables: add SECMARK support")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
include/uapi/linux/netfilter/nf_tables.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/include/uapi/linux/netfilter/nf_tables.h b/include/uapi/linux/netfilter/nf_tables.h
index aa4094ca2444..639894ed1b97 100644
--- a/include/uapi/linux/netfilter/nf_tables.h
+++ b/include/uapi/linux/netfilter/nf_tables.h
@@ -1376,7 +1376,7 @@ enum nft_secmark_attributes {
#define NFTA_SECMARK_MAX (__NFTA_SECMARK_MAX - 1)
/* Max security context length */
-#define NFT_SECMARK_CTX_MAXLEN 256
+#define NFT_SECMARK_CTX_MAXLEN 4096
/**
* enum nft_reject_types - nf_tables reject expression reject types
--
2.30.2
^ permalink raw reply related [flat|nested] 3+ messages in thread* Re: [PATCH nf-next] netfilter: nf_tables: rise cap on SELinux secmark context
2024-06-03 18:16 [PATCH nf-next] netfilter: nf_tables: rise cap on SELinux secmark context Pablo Neira Ayuso
@ 2024-06-26 11:31 ` Pablo Neira Ayuso
2024-06-26 15:45 ` Paul Moore
0 siblings, 1 reply; 3+ messages in thread
From: Pablo Neira Ayuso @ 2024-06-26 11:31 UTC (permalink / raw)
To: netfilter-devel; +Cc: rgb, paul
Enqueued to nf-next to address:
https://bugzilla.netfilter.org/show_bug.cgi?id=1749
On Mon, Jun 03, 2024 at 08:16:59PM +0200, Pablo Neira Ayuso wrote:
> secmark context is artificially limited 256 bytes, rise it to 4Kbytes.
>
> Fixes: fb961945457f ("netfilter: nf_tables: add SECMARK support")
> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
> ---
> include/uapi/linux/netfilter/nf_tables.h | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/include/uapi/linux/netfilter/nf_tables.h b/include/uapi/linux/netfilter/nf_tables.h
> index aa4094ca2444..639894ed1b97 100644
> --- a/include/uapi/linux/netfilter/nf_tables.h
> +++ b/include/uapi/linux/netfilter/nf_tables.h
> @@ -1376,7 +1376,7 @@ enum nft_secmark_attributes {
> #define NFTA_SECMARK_MAX (__NFTA_SECMARK_MAX - 1)
>
> /* Max security context length */
> -#define NFT_SECMARK_CTX_MAXLEN 256
> +#define NFT_SECMARK_CTX_MAXLEN 4096
>
> /**
> * enum nft_reject_types - nf_tables reject expression reject types
> --
> 2.30.2
>
>
^ permalink raw reply [flat|nested] 3+ messages in thread* Re: [PATCH nf-next] netfilter: nf_tables: rise cap on SELinux secmark context
2024-06-26 11:31 ` Pablo Neira Ayuso
@ 2024-06-26 15:45 ` Paul Moore
0 siblings, 0 replies; 3+ messages in thread
From: Paul Moore @ 2024-06-26 15:45 UTC (permalink / raw)
To: Pablo Neira Ayuso; +Cc: netfilter-devel, rgb, Joe Nall
On Wed, Jun 26, 2024 at 7:31 AM Pablo Neira Ayuso <pablo@netfilter.org> wrote:
>
> Enqueued to nf-next to address:
>
> https://bugzilla.netfilter.org/show_bug.cgi?id=1749
Thanks Pablo!
> On Mon, Jun 03, 2024 at 08:16:59PM +0200, Pablo Neira Ayuso wrote:
> > secmark context is artificially limited 256 bytes, rise it to 4Kbytes.
> >
> > Fixes: fb961945457f ("netfilter: nf_tables: add SECMARK support")
> > Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
> > ---
> > include/uapi/linux/netfilter/nf_tables.h | 2 +-
> > 1 file changed, 1 insertion(+), 1 deletion(-)
> >
> > diff --git a/include/uapi/linux/netfilter/nf_tables.h b/include/uapi/linux/netfilter/nf_tables.h
> > index aa4094ca2444..639894ed1b97 100644
> > --- a/include/uapi/linux/netfilter/nf_tables.h
> > +++ b/include/uapi/linux/netfilter/nf_tables.h
> > @@ -1376,7 +1376,7 @@ enum nft_secmark_attributes {
> > #define NFTA_SECMARK_MAX (__NFTA_SECMARK_MAX - 1)
> >
> > /* Max security context length */
> > -#define NFT_SECMARK_CTX_MAXLEN 256
> > +#define NFT_SECMARK_CTX_MAXLEN 4096
> >
> > /**
> > * enum nft_reject_types - nf_tables reject expression reject types
> > --
> > 2.30.2
--
paul-moore.com
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2024-06-26 15:46 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2024-06-03 18:16 [PATCH nf-next] netfilter: nf_tables: rise cap on SELinux secmark context Pablo Neira Ayuso
2024-06-26 11:31 ` Pablo Neira Ayuso
2024-06-26 15:45 ` Paul Moore
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).