]> git.karo-electronics.de Git - karo-tx-linux.git/commit
selinux: add a skb_owned_by() hook
authorEric Dumazet <edumazet@google.com>
Mon, 8 Apr 2013 17:58:11 +0000 (17:58 +0000)
committerDavid S. Miller <davem@davemloft.net>
Tue, 9 Apr 2013 17:23:11 +0000 (13:23 -0400)
commitca10b9e9a8ca7342ee07065289cbe74ac128c169
tree33842f41a127f9da904ddd5d61839590e986e420
parentc802d759623acbd6e1ee9fbdabae89159a513913
selinux: add a skb_owned_by() hook

Commit 90ba9b1986b5ac (tcp: tcp_make_synack() can use alloc_skb())
broke certain SELinux/NetLabel configurations by no longer correctly
assigning the sock to the outgoing SYNACK packet.

Cost of atomic operations on the LISTEN socket is quite big,
and we would like it to happen only if really needed.

This patch introduces a new security_ops->skb_owned_by() method,
that is a void operation unless selinux is active.

Reported-by: Miroslav Vadkerti <mvadkert@redhat.com>
Diagnosed-by: Paul Moore <pmoore@redhat.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: "David S. Miller" <davem@davemloft.net>
Cc: linux-security-module@vger.kernel.org
Acked-by: James Morris <james.l.morris@oracle.com>
Tested-by: Paul Moore <pmoore@redhat.com>
Acked-by: Paul Moore <pmoore@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
include/linux/security.h
net/ipv4/tcp_output.c
security/capability.c
security/security.c
security/selinux/hooks.c