Ok, while working on the double SA stuff, I could not help but notice
that we do not check for authorization before flushing SAs and policies
from the SAD and SPD, respectively.
Before I post this patch upstream, I wanted to send it on this list to
make sure my thinking is correct and that we should call selinux hooks
before flushing the SPD and SAD. Enclosed patch is against upstream
kernel but this also needs to be included in lspp kernel. I have
compiled and tested the fix. But let me know if it looks ok or not or
if I may have missed something. I sure hope this is the last of the
deletes.
I'll open a bug once I get the go ahead.
Regards,
Joy
diff -urpN linux-2.6.20.orig/net/xfrm/xfrm_policy.c
linux-2.6.20/net/xfrm/xfrm_policy.c
--- linux-2.6.20.orig/net/xfrm/xfrm_policy.c 2007-03-21
14:25:51.000000000 -0500
+++ linux-2.6.20/net/xfrm/xfrm_policy.c 2007-03-21 14:30:59.000000000
-0500
@@ -829,6 +829,8 @@ void xfrm_policy_flush(u8 type, struct x
&xfrm_policy_inexact[dir], bydst) {
if (pol->type != type)
continue;
+ if (security_xfrm_policy_delete(pol))
+ continue;
hlist_del(&pol->bydst);
hlist_del(&pol->byidx);
write_unlock_bh(&xfrm_policy_lock);
@@ -850,6 +852,8 @@ void xfrm_policy_flush(u8 type, struct x
bydst) {
if (pol->type != type)
continue;
+ if (security_xfrm_policy_delete(pol))
+ continue;
hlist_del(&pol->bydst);
hlist_del(&pol->byidx);
write_unlock_bh(&xfrm_policy_lock);
diff -urpN linux-2.6.20.orig/net/xfrm/xfrm_state.c
linux-2.6.20/net/xfrm/xfrm_state.c
--- linux-2.6.20.orig/net/xfrm/xfrm_state.c 2007-03-21
14:25:51.000000000 -0500
+++ linux-2.6.20/net/xfrm/xfrm_state.c 2007-03-21 14:27:48.000000000
-0500
@@ -400,7 +400,8 @@ void xfrm_state_flush(u8 proto, struct x
restart:
hlist_for_each_entry(x, entry, xfrm_state_bydst+i, bydst) {
if (!xfrm_state_kern(x) &&
- xfrm_id_proto_match(x->id.proto, proto)) {
+ xfrm_id_proto_match(x->id.proto, proto) &&
+ !security_xfrm_state_delete(x)) {
xfrm_state_hold(x);
spin_unlock_bh(&xfrm_state_lock);
--
redhat-lspp mailing list
[email protected]
https://www.redhat.com/mailman/listinfo/redhat-lspp
