Unfortunately we don't correctly handle the labeling or control of TCP
SYN-ACK packets correctly due largely to the nature of how the TCP
handshake is handled with respect to the "mini" request_sock versus
the "full" sock. These two patches correct these problems by adding
some special handling for sockets that send packets while in the TCP
listening state (the only time they do this is when accepting the
initial SYN/handshake packets).
---
Paul Moore (2):
selinux: handle TCP SYN-ACK packets correctly in selinux_ip_output()
selinux: handle TCP SYN-ACK packets correctly in selinux_ip_postroute()
security/selinux/hooks.c | 93 ++++++++++++++++++++++++++++++++++++++--------
1 file changed, 76 insertions(+), 17 deletions(-)
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@xxxxxxxxxxxxx with
the words "unsubscribe selinux" without quotes as the message.
