linux/security/selinux
James Morris 4e5ab4cb85 [SECMARK]: Add new packet controls to SELinux
Add new per-packet access controls to SELinux, replacing the old
packet controls.

Packets are labeled with the iptables SECMARK and CONNSECMARK targets,
then security policy for the packets is enforced with these controls.

To allow for a smooth transition to the new controls, the old code is
still present, but not active by default.  To restore previous
behavior, the old controls may be activated at runtime by writing a
'1' to /selinux/compat_net, and also via the kernel boot parameter
selinux_compat_net.  Switching between the network control models
requires the security load_policy permission.  The old controls will
probably eventually be removed and any continued use is discouraged.

With this patch, the new secmark controls for SElinux are disabled by
default, so existing behavior is entirely preserved, and the user is
not affected at all.

It also provides a config option to enable the secmark controls by
default (which can always be overridden at boot and runtime).  It is
also noted in the kconfig help that the user will need updated
userspace if enabling secmark controls for SELinux and that they'll
probably need the SECMARK and CONNMARK targets, and conntrack protocol
helpers, although such decisions are beyond the scope of kernel
configuration.

Signed-off-by: James Morris <jmorris@namei.org>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2006-06-17 21:30:05 -07:00
..
include [SECMARK]: Add new packet controls to SELinux 2006-06-17 21:30:05 -07:00
ss [PATCH] selinux: check for failed kmalloc in security_sid_to_context() 2006-05-15 11:20:54 -07:00
avc.c [PATCH] support for context based audit filtering 2006-05-01 06:06:24 -04:00
exports.c [SECMARK]: Add SELinux exports 2006-06-17 21:29:55 -07:00
hooks.c [SECMARK]: Add new packet controls to SELinux 2006-06-17 21:30:05 -07:00
Kconfig [SECMARK]: Add new packet controls to SELinux 2006-06-17 21:30:05 -07:00
Makefile [PATCH] support for context based audit filtering 2006-05-01 06:06:24 -04:00
netif.c [PATCH] SELinux: convert to kzalloc 2005-10-30 17:37:11 -08:00
netlink.c [NETLINK]: Add "groups" argument to netlink_kernel_create 2005-08-29 16:01:11 -07:00
nlmsgtab.c Merge branch 'audit.b3' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/audit-current 2006-03-25 09:24:53 -08:00
selinuxfs.c [SECMARK]: Add new packet controls to SELinux 2006-06-17 21:30:05 -07:00
xfrm.c [SECMARK]: Add new packet controls to SELinux 2006-06-17 21:30:05 -07:00