From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from lists.gentoo.org (pigeon.gentoo.org [208.92.234.80]) by finch.gentoo.org (Postfix) with ESMTP id DCA1D1381F3 for ; Thu, 16 May 2013 09:06:45 +0000 (UTC) Received: from pigeon.gentoo.org (localhost [127.0.0.1]) by pigeon.gentoo.org (Postfix) with SMTP id 9E408E083C; Thu, 16 May 2013 09:06:42 +0000 (UTC) Received: from smtp.gentoo.org (smtp.gentoo.org [140.211.166.183]) (using TLSv1 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by pigeon.gentoo.org (Postfix) with ESMTPS id 1874AE083C for ; Thu, 16 May 2013 09:06:41 +0000 (UTC) Received: from hornbill.gentoo.org (hornbill.gentoo.org [94.100.119.163]) (using TLSv1 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by smtp.gentoo.org (Postfix) with ESMTPS id E21E533E05B for ; Thu, 16 May 2013 09:06:40 +0000 (UTC) Received: from localhost.localdomain (localhost [127.0.0.1]) by hornbill.gentoo.org (Postfix) with ESMTP id 840D3E5308 for ; Thu, 16 May 2013 09:06:39 +0000 (UTC) From: "Sven Vermeulen" To: gentoo-commits@lists.gentoo.org Content-Transfer-Encoding: 8bit Content-type: text/plain; charset=UTF-8 Reply-To: gentoo-dev@lists.gentoo.org, "Sven Vermeulen" Message-ID: <1368694907.8c4542aad827ced701d681c1985bd0ddfe15d86f.SwifT@gentoo> Subject: [gentoo-commits] proj/hardened-refpolicy:master commit in: policy/modules/kernel/ X-VCS-Repository: proj/hardened-refpolicy X-VCS-Files: policy/modules/kernel/kernel.if policy/modules/kernel/kernel.te X-VCS-Directories: policy/modules/kernel/ X-VCS-Committer: SwifT X-VCS-Committer-Name: Sven Vermeulen X-VCS-Revision: 8c4542aad827ced701d681c1985bd0ddfe15d86f X-VCS-Branch: master Date: Thu, 16 May 2013 09:06:39 +0000 (UTC) Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-Id: Gentoo Linux mail X-BeenThere: gentoo-commits@lists.gentoo.org X-Archives-Salt: 5a703011-b3dc-4737-9e35-79a77e3415f8 X-Archives-Hash: 1ed289595d200d4f44c987cc3f32b9b8 commit: 8c4542aad827ced701d681c1985bd0ddfe15d86f Author: Chris PeBenito tresys com> AuthorDate: Thu May 9 12:46:33 2013 +0000 Commit: Sven Vermeulen siphos be> CommitDate: Thu May 16 09:01:47 2013 +0000 URL: http://git.overlays.gentoo.org/gitweb/?p=proj/hardened-refpolicy.git;a=commit;h=8c4542aa Remove general unlabeled packet usage. Back when the SECMARK implementation was new, the packet class was always checked. Because of that, unlabeled_t packet rules proliferated refpolicy since the common case was to have no SECMARK rules. Since then, the kernel has been modified to only enforce the packet class if there are SECMARK rules. Remove the unlabeled_t packet rules, since users of SECMARK will likely want no unlabeled_t packet rules, and the common case users will have no impact since the packet class isn't enforced on their systems. To have partial SECMARK confinement, the following rule applies: allow { domain -type_i_want_to_constrain_t } unlabeled_t:packet { send recv }; It seems like over-allowing, but if you have no SECMARK rules, it's the equivalent of: allow * unlabeled_t:packet { send recv }; Signed-off-by: Chris PeBenito tresys.com> --- policy/modules/kernel/kernel.if | 3 --- policy/modules/kernel/kernel.te | 2 +- 2 files changed, 1 insertions(+), 4 deletions(-) diff --git a/policy/modules/kernel/kernel.if b/policy/modules/kernel/kernel.if index ee01f48..54f1b0b 100644 --- a/policy/modules/kernel/kernel.if +++ b/policy/modules/kernel/kernel.if @@ -2648,9 +2648,6 @@ interface(`kernel_sendrecv_unlabeled_association',` ') allow $1 unlabeled_t:association { sendto recvfrom }; - - # temporary hack until labeling on packets is supported - allow $1 unlabeled_t:packet { send recv }; ') ######################################## diff --git a/policy/modules/kernel/kernel.te b/policy/modules/kernel/kernel.te index 397a25e..dd7648a 100644 --- a/policy/modules/kernel/kernel.te +++ b/policy/modules/kernel/kernel.te @@ -1,4 +1,4 @@ -policy_module(kernel, 1.17.0) +policy_module(kernel, 1.17.1) ######################################## #