SELinux: Socket retains creator role and MLS attribute
authorHarry Ciao <qingtao.cao@windriver.com>
Wed, 2 Mar 2011 05:32:33 +0000 (13:32 +0800)
committerEric Paris <eparis@redhat.com>
Thu, 3 Mar 2011 20:19:43 +0000 (15:19 -0500)
commit6f5317e730505d5cbc851c435a2dfe3d5a21d343
tree02088cf519a00db5c6fbdb2cc8776402413eb662
parent4bc6c2d5d8386800fde23a8e78cd4f04a0ade0ad
SELinux: Socket retains creator role and MLS attribute

The socket SID would be computed on creation and no longer inherit
its creator's SID by default. Socket may have a different type but
needs to retain the creator's role and MLS attribute in order not
to break labeled networking and network access control.

The kernel value for a class would be used to determine if the class
if one of socket classes. If security_compute_sid is called from
userspace the policy value for a class would be mapped to the relevant
kernel value first.

Signed-off-by: Harry Ciao <qingtao.cao@windriver.com>
Signed-off-by: Eric Paris <eparis@redhat.com>
Acked-by: Stephen Smalley <sds@tycho.nsa.gov>
security/selinux/ss/mls.c
security/selinux/ss/mls.h
security/selinux/ss/services.c