From: Paul Moore Date: Mon, 25 Sep 2006 22:53:13 +0000 (-0700) Subject: [NetLabel]: change the SELinux permissions X-Git-Url: http://git.lede-project.org./?a=commitdiff_plain;h=df2115c3134d0d1a18c1f37f5192394e7f64d1e0;p=openwrt%2Fstaging%2Fblogic.git [NetLabel]: change the SELinux permissions Change NetLabel to use the 'recvfrom' socket permission and the SECINITSID_NETMSG SELinux SID as the NetLabel base SID for incoming packets. This patch effectively makes the old, and currently unused, SELinux NETMSG permissions NetLabel permissions. Signed-of-by: Paul Moore Signed-off-by: David S. Miller --- diff --git a/security/selinux/ss/services.c b/security/selinux/ss/services.c index d67f7e658529..22ed17c17718 100644 --- a/security/selinux/ss/services.c +++ b/security/selinux/ss/services.c @@ -2611,7 +2611,7 @@ int selinux_netlbl_sock_rcv_skb(struct sk_security_struct *sksec, u32 netlbl_sid; u32 recv_perm; - rc = selinux_netlbl_skbuff_getsid(skb, sksec->sid, &netlbl_sid); + rc = selinux_netlbl_skbuff_getsid(skb, SECINITSID_NETMSG, &netlbl_sid); if (rc != 0) return rc; @@ -2620,13 +2620,13 @@ int selinux_netlbl_sock_rcv_skb(struct sk_security_struct *sksec, switch (sksec->sclass) { case SECCLASS_UDP_SOCKET: - recv_perm = UDP_SOCKET__RECV_MSG; + recv_perm = UDP_SOCKET__RECVFROM; break; case SECCLASS_TCP_SOCKET: - recv_perm = TCP_SOCKET__RECV_MSG; + recv_perm = TCP_SOCKET__RECVFROM; break; default: - recv_perm = RAWIP_SOCKET__RECV_MSG; + recv_perm = RAWIP_SOCKET__RECVFROM; } rc = avc_has_perm(sksec->sid,