On Thu, Dec 8, 2016 at 2:42 PM, Stephen Smalley <sds@xxxxxxxxxxxxx> wrote: > Wanted to clarify one point and also mention a bug/deficiency of this > patch that I just realized: > > - Clarification: At present, the patch will map PF_INET, SOCK_DGRAM, > IPPROTO_ICMP to icmp_socket, but will continue to map PF_INET, SOCK_RAW, > IPPROTO_ICMP to rawip_socket. That's intentional, since the SOCK_DGRAM > IPPROTO_ICMP sockets were introduced to provide a more restricted form > of ICMP sockets that could be exposed to unprivileged users (based on a > sysctl), so distinguishing those in policy makes sense. But it could be > surprising. Yes, I have no problem with this behavior. > - Bug/deficiency: I hadn't noticed that there is a separate > IPPROTO_ICMPV6, so I'll need to modify this patch or post a follow-on > that ensure that we map SOCK_DGRAM,IPPROTO_ICMPV6 to icmp_socket too. Merged your follow-up patch. -- paul moore www.paul-moore.com _______________________________________________ Selinux mailing list Selinux@xxxxxxxxxxxxx To unsubscribe, send email to Selinux-leave@xxxxxxxxxxxxx. To get help, send an email containing "help" to Selinux-request@xxxxxxxxxxxxx.
