mirror of
https://github.com/torvalds/linux
synced 2024-11-05 18:23:50 +00:00
cbe0d6e879
While SELinux largely ignores namespaces, for good reason, there are
some places where it needs to at least be aware of namespaces in order
to function correctly. Network namespaces are one example. Basic
awareness of network namespaces are necessary in order to match a
network interface's index number to an actual network device.
This patch corrects a problem with network interfaces added to a
non-init namespace, and can be reproduced with the following commands:
[NOTE: the NetLabel configuration is here only to active the dynamic
networking controls ]
# netlabelctl unlbl add default address:0.0.0.0/0 \
label:system_u:object_r:unlabeled_t:s0
# netlabelctl unlbl add default address:::/0 \
label:system_u:object_r:unlabeled_t:s0
# netlabelctl cipsov4 add pass doi:100 tags:1
# netlabelctl map add domain:lspp_test_netlabel_t \
protocol:cipsov4,100
# ip link add type veth
# ip netns add myns
# ip link set veth1 netns myns
# ip a add dev veth0 10.250.13.100/24
# ip netns exec myns ip a add dev veth1 10.250.13.101/24
# ip l set veth0 up
# ip netns exec myns ip l set veth1 up
# ping -c 1 10.250.13.101
# ip netns exec myns ping -c 1 10.250.13.100
Reported-by: Jiri Jaburek <jjaburek@redhat.com>
Signed-off-by: Paul Moore <pmoore@redhat.com>
27 lines
802 B
C
27 lines
802 B
C
/*
|
|
* Network interface table.
|
|
*
|
|
* Network interfaces (devices) do not have a security field, so we
|
|
* maintain a table associating each interface with a SID.
|
|
*
|
|
* Author: James Morris <jmorris@redhat.com>
|
|
*
|
|
* Copyright (C) 2003 Red Hat, Inc., James Morris <jmorris@redhat.com>
|
|
* Copyright (C) 2007 Hewlett-Packard Development Company, L.P.
|
|
* Paul Moore <paul@paul-moore.com>
|
|
*
|
|
* This program is free software; you can redistribute it and/or modify
|
|
* it under the terms of the GNU General Public License version 2,
|
|
* as published by the Free Software Foundation.
|
|
*/
|
|
#ifndef _SELINUX_NETIF_H_
|
|
#define _SELINUX_NETIF_H_
|
|
|
|
#include <net/net_namespace.h>
|
|
|
|
void sel_netif_flush(void);
|
|
|
|
int sel_netif_sid(struct net *ns, int ifindex, u32 *sid);
|
|
|
|
#endif /* _SELINUX_NETIF_H_ */
|
|
|