1. 25 Feb, 2009 3 commits
  2. 24 Feb, 2009 11 commits
  3. 23 Feb, 2009 24 commits
  4. 22 Feb, 2009 2 commits
    • Paul Moore's avatar
      selinux: Fix the NetLabel glue code for setsockopt() · 09c50b4a
      Paul Moore authored
      At some point we (okay, I) managed to break the ability for users to use the
      setsockopt() syscall to set IPv4 options when NetLabel was not active on the
      socket in question.  The problem was noticed by someone trying to use the
      "-R" (record route) option of ping:
      
       # ping -R 10.0.0.1
       ping: record route: No message of desired type
      
      The solution is relatively simple, we catch the unlabeled socket case and
      clear the error code, allowing the operation to succeed.  Please note that we
      still deny users the ability to override IPv4 options on socket's which have
      NetLabel labeling active; this is done to ensure the labeling remains intact.
      Signed-off-by: default avatarPaul Moore <paul.moore@hp.com>
      Signed-off-by: default avatarJames Morris <jmorris@namei.org>
      09c50b4a
    • Paul Moore's avatar
      cipso: Fix documentation comment · 586c2500
      Paul Moore authored
      The CIPSO protocol engine incorrectly stated that the FIPS-188 specification
      could be found in the kernel's Documentation directory.  This patch corrects
      that by removing the comment and directing users to the FIPS-188 documented
      hosted online.  For the sake of completeness I've also included a link to the
      CIPSO draft specification on the NetLabel website.
      
      Thanks to Randy Dunlap for spotting the error and letting me know.
      Signed-off-by: default avatarPaul Moore <paul.moore@hp.com>
      Signed-off-by: default avatarJames Morris <jmorris@namei.org>
      586c2500