summaryrefslogtreecommitdiff
path: root/security/security.c
diff options
context:
space:
mode:
authorEric Dumazet <edumazet@google.com>2013-04-08 21:58:11 +0400
committerDavid S. Miller <davem@davemloft.net>2013-04-09 21:23:11 +0400
commitca10b9e9a8ca7342ee07065289cbe74ac128c169 (patch)
tree33842f41a127f9da904ddd5d61839590e986e420 /security/security.c
parentc802d759623acbd6e1ee9fbdabae89159a513913 (diff)
downloadlinux-ca10b9e9a8ca7342ee07065289cbe74ac128c169.tar.xz
selinux: add a skb_owned_by() hook
Commit 90ba9b1986b5ac (tcp: tcp_make_synack() can use alloc_skb()) broke certain SELinux/NetLabel configurations by no longer correctly assigning the sock to the outgoing SYNACK packet. Cost of atomic operations on the LISTEN socket is quite big, and we would like it to happen only if really needed. This patch introduces a new security_ops->skb_owned_by() method, that is a void operation unless selinux is active. Reported-by: Miroslav Vadkerti <mvadkert@redhat.com> Diagnosed-by: Paul Moore <pmoore@redhat.com> Signed-off-by: Eric Dumazet <edumazet@google.com> Cc: "David S. Miller" <davem@davemloft.net> Cc: linux-security-module@vger.kernel.org Acked-by: James Morris <james.l.morris@oracle.com> Tested-by: Paul Moore <pmoore@redhat.com> Acked-by: Paul Moore <pmoore@redhat.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'security/security.c')
-rw-r--r--security/security.c5
1 files changed, 5 insertions, 0 deletions
diff --git a/security/security.c b/security/security.c
index 7b88c6aeaed4..03f248b84e9f 100644
--- a/security/security.c
+++ b/security/security.c
@@ -1290,6 +1290,11 @@ int security_tun_dev_open(void *security)
}
EXPORT_SYMBOL(security_tun_dev_open);
+void security_skb_owned_by(struct sk_buff *skb, struct sock *sk)
+{
+ security_ops->skb_owned_by(skb, sk);
+}
+
#endif /* CONFIG_SECURITY_NETWORK */
#ifdef CONFIG_SECURITY_NETWORK_XFRM