linux/security/selinux
Fan Du ca925cf153 flowcache: Make flow cache name space aware
Inserting a entry into flowcache, or flushing flowcache should be based
on per net scope. The reason to do so is flushing operation from fat
netns crammed with flow entries will also making the slim netns with only
a few flow cache entries go away in original implementation.

Since flowcache is tightly coupled with IPsec, so it would be easier to
put flow cache global parameters into xfrm namespace part. And one last
thing needs to do is bumping flow cache genid, and flush flow cache should
also be made in per net style.

Signed-off-by: Fan Du <fan.du@windriver.com>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
2014-02-12 07:02:11 +01:00
..
include flowcache: Make flow cache name space aware 2014-02-12 07:02:11 +01:00
ss Merge branch 'stable-3.14' of git://git.infradead.org/users/pcmoore/selinux into for-linus 2014-02-10 11:48:21 +11:00
.gitignore SELinux: add .gitignore files for dynamic classes 2009-10-24 09:42:27 +08:00
avc.c selinux: remove 'flags' parameter from avc_audit() 2013-10-04 14:13:25 -07:00
exports.c selinux: sparse fix: include selinux.h in exports.c 2011-09-09 16:56:32 -07:00
hooks.c Linux 3.13 2014-02-05 10:39:48 -05:00
Kconfig selinux: Deprecate and schedule the removal of the the compat_net functionality 2008-12-31 12:54:11 -05:00
Makefile selinux: change to new flag variable 2010-10-21 10:12:40 +11:00
netif.c net: pass info struct via netdevice notifier 2013-05-28 13:11:01 -07:00
netlabel.c selinux: ensure that the cached NetLabel secattr matches the desired SID 2013-12-04 16:08:17 -05:00
netlink.c selinux: replace obsolete NLMSG_* with type safe nlmsg_* 2013-03-28 14:25:49 -04:00
netnode.c selinux: fix problems in netnode when BUG() is compiled out 2013-07-25 13:03:27 -04:00
netport.c SELinux: avc: remove the useless fields in avc_add_callback 2012-04-09 12:23:44 -04:00
nlmsgtab.c selinux: add SOCK_DIAG_BY_FAMILY to the list of netlink message types 2014-02-05 12:20:48 -05:00
selinuxfs.c Add SELinux policy capability for always checking packet and peer classes. 2013-07-25 13:03:38 -04:00
xfrm.c selinux: look for IPsec labels on both inbound and outbound packets 2013-12-12 17:21:31 -05:00