From 334c85569b8adeaa820c0f2fab3c8f0a9dc8b92e Mon Sep 17 00:00:00 2001 From: Venkat Yekkirala Date: Mon, 15 Jan 2007 16:38:45 -0800 Subject: [SELINUX]: increment flow cache genid Currently, old flow cache entries remain valid even after a reload of SELinux policy. This patch increments the flow cache generation id on policy (re)loads so that flow cache entries are revalidated as needed. Thanks to Herbet Xu for pointing this out. See: http://marc.theaimsgroup.com/?l=linux-netdev&m=116841378704536&w=2 There's also a general issue as well as a solution proposed by David Miller for when flow_cache_genid wraps. I might be submitting a separate patch for that later. I request that this be applied to 2.6.20 since it's a security relevant fix. Signed-off-by: Venkat Yekkirala Signed-off-by: David S. Miller --- security/selinux/ss/services.c | 3 +++ 1 file changed, 3 insertions(+) (limited to 'security') diff --git a/security/selinux/ss/services.c b/security/selinux/ss/services.c index 3eb1fa9f0de..ff0393317f3 100644 --- a/security/selinux/ss/services.c +++ b/security/selinux/ss/services.c @@ -1299,6 +1299,7 @@ int security_load_policy(void *data, size_t len) avc_ss_reset(seqno); selnl_notify_policyload(seqno); selinux_netlbl_cache_invalidate(); + atomic_inc(&flow_cache_genid); return 0; } @@ -1354,6 +1355,7 @@ int security_load_policy(void *data, size_t len) avc_ss_reset(seqno); selnl_notify_policyload(seqno); selinux_netlbl_cache_invalidate(); + atomic_inc(&flow_cache_genid); return 0; @@ -1853,6 +1855,7 @@ out: if (!rc) { avc_ss_reset(seqno); selnl_notify_policyload(seqno); + atomic_inc(&flow_cache_genid); } return rc; } -- cgit v1.2.3 From 342a0cff0ad5fba6b591cfa37db3c65c4d9913f8 Mon Sep 17 00:00:00 2001 From: Venkat Yekkirala Date: Fri, 26 Jan 2007 19:03:48 -0800 Subject: [SELINUX]: Fix 2.6.20-rc6 build when no xfrm This patch is an incremental fix to the flow_cache_genid patch for selinux that breaks the build of 2.6.20-rc6 when xfrm is not configured. Signed-off-by: Venkat Yekkirala Signed-off-by: David S. Miller --- security/selinux/include/xfrm.h | 9 +++++++++ security/selinux/ss/services.c | 6 +++--- 2 files changed, 12 insertions(+), 3 deletions(-) (limited to 'security') diff --git a/security/selinux/include/xfrm.h b/security/selinux/include/xfrm.h index 161eb571c82..31929e39f5c 100644 --- a/security/selinux/include/xfrm.h +++ b/security/selinux/include/xfrm.h @@ -37,6 +37,11 @@ int selinux_xfrm_sock_rcv_skb(u32 sid, struct sk_buff *skb, int selinux_xfrm_postroute_last(u32 isec_sid, struct sk_buff *skb, struct avc_audit_data *ad, u8 proto); int selinux_xfrm_decode_session(struct sk_buff *skb, u32 *sid, int ckall); + +static inline void selinux_xfrm_notify_policyload(void) +{ + atomic_inc(&flow_cache_genid); +} #else static inline int selinux_xfrm_sock_rcv_skb(u32 isec_sid, struct sk_buff *skb, struct avc_audit_data *ad) @@ -55,6 +60,10 @@ static inline int selinux_xfrm_decode_session(struct sk_buff *skb, u32 *sid, int *sid = SECSID_NULL; return 0; } + +static inline void selinux_xfrm_notify_policyload(void) +{ +} #endif static inline void selinux_skb_xfrm_sid(struct sk_buff *skb, u32 *sid) diff --git a/security/selinux/ss/services.c b/security/selinux/ss/services.c index ff0393317f3..ca9154dc5d8 100644 --- a/security/selinux/ss/services.c +++ b/security/selinux/ss/services.c @@ -1299,7 +1299,7 @@ int security_load_policy(void *data, size_t len) avc_ss_reset(seqno); selnl_notify_policyload(seqno); selinux_netlbl_cache_invalidate(); - atomic_inc(&flow_cache_genid); + selinux_xfrm_notify_policyload(); return 0; } @@ -1355,7 +1355,7 @@ int security_load_policy(void *data, size_t len) avc_ss_reset(seqno); selnl_notify_policyload(seqno); selinux_netlbl_cache_invalidate(); - atomic_inc(&flow_cache_genid); + selinux_xfrm_notify_policyload(); return 0; @@ -1855,7 +1855,7 @@ out: if (!rc) { avc_ss_reset(seqno); selnl_notify_policyload(seqno); - atomic_inc(&flow_cache_genid); + selinux_xfrm_notify_policyload(); } return rc; } -- cgit v1.2.3