linux-toradex.git/security/selinux/nlmsgtab.c, branch v3.12-rc2

bridge: update selinux perm table for RTM_NEWMDB and RTM_DELMDB

2012-12-16T01:14:38+00:00

Cc: Herbert Xu 
Cc: Stephen Hemminger 
Cc: "David S. Miller" 
Signed-off-by: Cong Wang 
Signed-off-by: David S. Miller

rtnetlink: add missing message types to selinux perm table

2012-12-10T19:09:01+00:00

Rebased on the latest net-next tree.

RTM_NEWNETCONF and RTM_GETNETCONF are missing in this table.

Cc: David S. Miller 
Signed-off-by: Cong Wang 
Signed-off-by: David S. Miller

bridge: export multicast database via netlink

2012-12-07T19:32:52+00:00

V5: fix two bugs pointed out by Thomas
    remove seq check for now, mark it as TODO

V4: remove some useless #include
    some coding style fix

V3: drop debugging printk's
    update selinux perm table as well

V2: drop patch 1/2, export ifindex directly
    Redesign netlink attributes
    Improve netlink seq check
    Handle IPv6 addr as well

This patch exports bridge multicast database via netlink
message type RTM_GETMDB. Similar to fdb, but currently bridge-specific.
We may need to support modify multicast database too (RTM_{ADD,DEL}MDB).

(Thanks to Thomas for patient reviews)

Cc: Herbert Xu 
Cc: Stephen Hemminger 
Cc: "David S. Miller" 
Cc: Thomas Graf 
Cc: Jesper Dangaard Brouer 
Signed-off-by: Cong Wang 
Acked-by: Thomas Graf 
Signed-off-by: David S. Miller

netfilter: remove ip_queue support

2012-05-08T18:25:42+00:00

This patch removes ip_queue support which was marked as obsolete
years ago. The nfnetlink_queue modules provides more advanced
user-space packet queueing mechanism.

This patch also removes capability code included in SELinux that
refers to ip_queue. Otherwise, we break compilation.

Several warning has been sent regarding this to the mailing list
in the past month without anyone rising the hand to stop this
with some strong argument.

Signed-off-by: Pablo Neira Ayuso

selinux: sparse fix: fix warnings in netlink code

2011-09-09T23:56:31+00:00

Fix sparse warnings in SELinux Netlink code.

Signed-off-by: James Morris

SELinux: define permissions for DCB netlink messages

2010-12-16T17:50:17+00:00

Commit 2f90b865 added two new netlink message types to the netlink route
socket.  SELinux has hooks to define if netlink messages are allowed to
be sent or received, but it did not know about these two new message
types.  By default we allow such actions so noone likely noticed.  This
patch adds the proper definitions and thus proper permissions
enforcement.

Signed-off-by: Eric Paris

Selinux: Remove unused headers skbuff.h in selinux/nlmsgtab.c

2010-03-03T21:51:06+00:00

skbuff.h is already included by netlink.h, so remove it.

Signed-off-by: Zhitong Wang 
Signed-off-by: James Morris

SELinux: define audit permissions for audit tree netlink messages

2009-06-02T21:44:53+00:00

Audit trees defined 2 new netlink messages but the netlink mapping tables for
selinux permissions were not set up.  This patch maps these 2 new operations
to AUDIT_WRITE.

Signed-off-by: Eric Paris 
Signed-off-by: James Morris

SELinux: new permission between tty audit and audit socket

2009-03-05T21:50:21+00:00

New selinux permission to separate the ability to turn on tty auditing from
the ability to set audit rules.

Signed-off-by: Eric Paris 
Acked-by:  Stephen Smalley 
Signed-off-by: James Morris

selinux: recognize netlink messages for 'ip addrlabel'

2008-11-05T23:08:36+00:00

In enforcing mode '/sbin/ip addrlabel' results in a SELinux error:
type=SELINUX_ERR msg=audit(1225698822.073:42): SELinux:  unrecognized
netlink message type=74 for sclass=43

The problem is missing RTM_*ADDRLABEL entries in SELinux's netlink
message types table.

Reported in https://bugzilla.redhat.com/show_bug.cgi?id=469423

Signed-off-by: Michal Schmidt 
Acked-by:  Stephen Smalley 
Signed-off-by: James Morris