Commit Graph

1583 Commits

Author SHA1 Message Date
Chris PeBenito
9b45c60308 This patch adds a polmatch avperm to arbitrate flow/state's access to
a xfrm policy. It also defines MLS policy for association { sendto,
recvfrom, polmatch }.

NOTE: When an inbound packet is not using an IPSec SA, a check is performed
between the socket label and the unlabeled sid (SYSTEM_HIGH MLS label). For
MLS purposes however, the target of the check should be the MLS label taken
from the node sid (or secmark in the new secmark world). This would present
a severe performance overhead (to make a new sid based on the unlabeled sid
with the MLS taken from the node sid or secmark and then using this sid as
the target). Pending reconciliation of the netlabel, ipsec and iptables contexts,
I have chosen to currently make an exception for unlabeled_t SAs if TE policy
allowed it. A similar problem exists for the outbound case and it has been similarly
handled in the policy below (by making an exception for unlabeled_t).

I am submitting the below limited patch pending a comprehensive patch from
Joy Latten at IBM (latten@austin.ibm.com).

I am not sure if I needed to manually do a "make tolib" in the flask subdir
and submit the results as well. Please let me know if I needed to.

Signed-off-by: Venkat Yekkirala <vyekkirala@TrustedCS.com>
2006-09-01 17:06:53 +00:00
Chris PeBenito
eac818f040 patch from dan Thu, 31 Aug 2006 15:16:30 -0400 2006-09-01 15:52:05 +00:00
Chris PeBenito
c634db20c6 fix makefile style so internal variables are lowercase 2006-08-31 17:28:35 +00:00
Chris PeBenito
a5e2133bc8 patch from dan Wed, 23 Aug 2006 14:03:49 -0400 2006-08-29 02:41:00 +00:00
Chris PeBenito
ce6bf7cc23 more testing fixes 2006-08-28 02:46:20 +00:00
Chris PeBenito
e539a49638 This patch enables to use xattr on jffs2 filesystem.
The jffs2 filesystem is a filesystem for memory technology
devices (MTD), and xattr supporting on jffs2 is neccesary
to use SELinux with a small diskless PDA and so on.
This facility is queued for kernel 2.6.18 now, so I hope
to merge this small patch into the refpolicy repository.

Example of xattr/jffs2: SELinux on OpenZaurus :D
  http://www.kaigai.gr.jp/pub/sezaurus.jpg

Thanks,
--
KaiGai Kohei <kaigai@kaigai.gr.jp>
2006-08-25 13:28:57 +00:00
Chris PeBenito
de222824e9 fix gentoo /opt contexts 2006-08-25 13:26:21 +00:00
Chris PeBenito
98de871cee more strict testing fixes 2006-08-23 19:36:04 +00:00
Chris PeBenito
d15dd5a739 more testing fixes 2006-08-23 03:47:39 +00:00
Chris PeBenito
5b4ff3a104 fix ordering bug 2006-08-22 19:56:59 +00:00
Chris PeBenito
3ef029db7c add nscd_socket_use() to auth_use_nsswitch() since it caches nss lookups. 2006-08-22 19:37:56 +00:00
Chris PeBenito
2ed690dd9b fix typo in sxid 2006-08-21 13:35:51 +00:00
Chris PeBenito
e9b9e45214 testing fixes 2006-08-18 18:20:22 +00:00
Chris PeBenito
4bc6e32e28 fix for netfilter_contexts 2006-08-18 14:01:48 +00:00
Chris PeBenito
e50a55b9a4 clear executable bits 2006-08-17 20:42:38 +00:00
Chris PeBenito
ba1a545fb3 cleanup in authlogin 2006-08-17 15:35:14 +00:00
Chris PeBenito
3573908f1c fix cron_system_entry() rules 2006-08-16 13:52:18 +00:00
Chris PeBenito
33c7e6b4e8 remove dead selopt rules 2006-08-15 20:00:58 +00:00
Chris PeBenito
bd56da4aa5 clean up constraints 2006-08-15 15:30:08 +00:00
Chris PeBenito
cfd5c5e157 add variable for install, and do other helper pgm cleanup 2006-08-08 21:56:45 +00:00
Chris PeBenito
497da0953c ps/ptrace dontaudit cleanup 2006-08-08 17:49:03 +00:00
Chris PeBenito
eb8a2639b4 fix target deps for nc 2006-08-07 17:35:30 +00:00
Chris PeBenito
f5d1d0f7b3 missed changelog entry for nc 2006-08-07 17:25:46 +00:00
Chris PeBenito
5a7c06fdd1 add support for netfilter_contexts 2006-08-07 17:25:09 +00:00
Chris PeBenito
4846dc8ad4 patch from Stefan for mrtg daemon operation. 2006-08-07 17:14:00 +00:00
Chris PeBenito
80f928e24b display warning if using loadkeys_domtrans() in targeted 2006-08-03 18:02:28 +00:00
Chris PeBenito
9d3a3f84ad add missing entry for dan's last patch 2006-08-02 19:56:32 +00:00
Chris PeBenito
85476e94d8 fix up mtrr interfaces. missing the file class on a few interfaces, and read and write cannot be split. 2006-08-01 14:43:10 +00:00
Chris PeBenito
4b3b46d7ef add authlogin interface to abstract common login program perms 2006-07-31 22:26:59 +00:00
Chris PeBenito
46551033aa patch from dan Wed, 26 Jul 2006 14:42:46 -0400 2006-07-28 15:13:58 +00:00
Chris PeBenito
81aa67fcc0 more ssh agent fixes 2006-07-26 21:16:45 +00:00
Chris PeBenito
528811e040 clean up most of the remaining ssh TODO 2006-07-26 20:34:09 +00:00
Chris PeBenito
79f5f5e8fd add gdm Xsession fc 2006-07-26 20:33:23 +00:00
Chris PeBenito
d617143ba4 remove deprecated mount_send_nfs_client_request() from stunnel 2006-07-25 22:28:47 +00:00
Chris PeBenito
ea3c1f508a add helpers for printing warning and error messages 2006-07-25 17:27:00 +00:00
Chris PeBenito
8b9ebd3769 some cleanup in the kernel layer 2006-07-25 15:23:13 +00:00
Chris PeBenito
19ebf01d6a patch to fix escaping of . in file contexts from james athey 2006-07-24 15:43:57 +00:00
Chris PeBenito
d822675850 add access to keys for unconfined 2006-07-14 13:11:42 +00:00
Chris PeBenito
da9bbc655a fix up audit message perms now that audit_write denials are being audited by the kernel. 2006-07-13 17:22:08 +00:00
Chris PeBenito
133000c286 remove setbool auditallow, except for distro_rhel4. 2006-07-13 14:22:21 +00:00
Chris PeBenito
2defa77f39 remove extra level of directory 2006-07-12 20:33:09 +00:00
Chris PeBenito
17de1b790b remove extra level of directory 2006-07-12 20:32:27 +00:00
Chris PeBenito
b6a9bc3555 missing tcp connect for http cache 2006-07-12 13:17:24 +00:00
Chris PeBenito
85311bfffc add 3rd party interface for transition out of unconfined 2006-07-10 13:31:28 +00:00
Chris PeBenito
3aab4a8398 add audit_write and a little style cleanup. 2006-07-07 14:51:08 +00:00
Chris PeBenito
385e624407 move non-policy dirs out of trunk 2006-07-06 17:35:17 +00:00
Chris PeBenito
0950eeb6c5 change to use validate target for module linking 2006-07-06 17:16:21 +00:00
Chris PeBenito
1f6524ae60 more TODO cleanup 2006-07-06 17:00:29 +00:00
Chris PeBenito
29943b3b27 add vgetty log fc 2006-07-06 14:52:04 +00:00
Chris PeBenito
f35fed5eef a few TODO fixes, and deprecate mount_send_nfs_client_request(). 2006-07-05 19:15:23 +00:00