Paul Moore 4233a3cda8 selinux: make the netif cache namespace aware ... While SELinux largely ignores namespaces, for good reason, there are some places where it needs to at least be aware of namespaces in order to function correctly. Network namespaces are one example. Basic awareness of network namespaces are necessary in order to match a network interface's index number to an actual network device. This patch corrects a problem with network interfaces added to a non-init namespace, and can be reproduced with the following commands: [NOTE: the NetLabel configuration is here only to active the dynamic networking controls ] # netlabelctl unlbl add default address:0.0.0.0/0 \ label:system_u:object_r:unlabeled_t:s0 # netlabelctl unlbl add default address:::/0 \ label:system_u:object_r:unlabeled_t:s0 # netlabelctl cipsov4 add pass doi:100 tags:1 # netlabelctl map add domain:lspp_test_netlabel_t \ protocol:cipsov4,100 # ip link add type veth # ip netns add myns # ip link set veth1 netns myns # ip a add dev veth0 10.250.13.100/24 # ip netns exec myns ip a add dev veth1 10.250.13.101/24 # ip l set veth0 up # ip netns exec myns ip l set veth1 up # ping -c 1 10.250.13.101 # ip netns exec myns ping -c 1 10.250.13.100 Reported-by: Jiri Jaburek <jjaburek@redhat.com> Signed-off-by: Paul Moore <pmoore@redhat.com> Git-commit: 872ecde0211c30e7ef8cdf13ee0600bbb43fed75 Git-repo: https://android.googlesource.com/kernel/common.git [imaund@codeaurora.org: Resolved context conflicts] Signed-off-by: Ian Maund <imaund@codeaurora.org>		2015-03-19 15:00:08 -07:00
..
include	selinux: make the netif cache namespace aware	2015-03-19 15:00:08 -07:00
ss	SELinux: Update policy version to support constraints info	2015-03-19 15:00:03 -07:00
.gitignore
avc.c
exports.c
hooks.c	selinux: make the netif cache namespace aware	2015-03-19 15:00:08 -07:00
Kconfig
Makefile
netif.c	selinux: make the netif cache namespace aware	2015-03-19 15:00:08 -07:00
netlabel.c
netlink.c
netnode.c
netport.c
nlmsgtab.c
selinuxfs.c
xfrm.c