linux/security/selinux/include
Paul Moore cbe0d6e879 selinux: make the netif cache namespace aware
While SELinux largely ignores namespaces, for good reason, there are
some places where it needs to at least be aware of namespaces in order
to function correctly.  Network namespaces are one example.  Basic
awareness of network namespaces are necessary in order to match a
network interface's index number to an actual network device.

This patch corrects a problem with network interfaces added to a
non-init namespace, and can be reproduced with the following commands:

 [NOTE: the NetLabel configuration is here only to active the dynamic
        networking controls ]

 # netlabelctl unlbl add default address:0.0.0.0/0 \
   label:system_u:object_r:unlabeled_t:s0
 # netlabelctl unlbl add default address:::/0 \
   label:system_u:object_r:unlabeled_t:s0
 # netlabelctl cipsov4 add pass doi:100 tags:1
 # netlabelctl map add domain:lspp_test_netlabel_t \
   protocol:cipsov4,100

 # ip link add type veth
 # ip netns add myns
 # ip link set veth1 netns myns
 # ip a add dev veth0 10.250.13.100/24
 # ip netns exec myns ip a add dev veth1 10.250.13.101/24
 # ip l set veth0 up
 # ip netns exec myns ip l set veth1 up

 # ping -c 1 10.250.13.101
 # ip netns exec myns ping -c 1 10.250.13.100

Reported-by: Jiri Jaburek <jjaburek@redhat.com>
Signed-off-by: Paul Moore <pmoore@redhat.com>
2014-09-10 17:09:57 -04:00
..
audit.h SELinux: keep the code clean formating and syntax 2008-07-14 15:01:36 +10:00
avc_ss.h selinux: sparse fix: fix several warnings in the security server code 2011-09-09 16:56:32 -07:00
avc.h selinux: Report permissive mode in avc: denied messages. 2014-06-03 14:21:48 -05:00
classmap.h audit: add netlink audit protocol bind to check capabilities on multicast join 2014-04-22 21:42:27 -04:00
conditional.h Linux-2.6.12-rc2 2005-04-16 15:20:36 -07:00
initial_sid_to_string.h selinux: const strings in tables 2010-03-08 09:33:53 +11:00
netif.h selinux: make the netif cache namespace aware 2014-09-10 17:09:57 -04:00
netlabel.h doc: Update the email address for Paul Moore in various source files 2011-08-01 17:58:33 -07:00
netnode.h selinux: reduce the number of calls to synchronize_net() when flushing caches 2014-06-26 14:33:56 -04:00
netport.h selinux: reduce the number of calls to synchronize_net() when flushing caches 2014-06-26 14:33:56 -04:00
objsec.h selinux: make the netif cache namespace aware 2014-09-10 17:09:57 -04:00
security.h security: Used macros from compiler.h instead of __attribute__((...)) 2014-06-18 16:59:34 -04:00
xfrm.h Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net 2014-03-25 20:29:20 -04:00