)]}'
{
  "commit": "2ea04e5a3d579032632c72584ea67b623321064c",
  "tree": "ea2d1ac04a2559bc55aa2dde512e99d9e8f16862",
  "parents": [
    "1c5d9d1527ceb57e66001fba3d84c766d89baf2e"
  ],
  "author": {
    "name": "Paul Moore",
    "email": "pmoore@redhat.com",
    "time": "Wed Dec 04 16:10:51 2013 -0500"
  },
  "committer": {
    "name": "Greg Kroah-Hartman",
    "email": "gregkh@linuxfoundation.org",
    "time": "Fri Dec 20 07:34:20 2013 -0800"
  },
  "message": "selinux: handle TCP SYN-ACK packets correctly in selinux_ip_postroute()\n\ncommit 446b802437f285de68ffb8d6fac3c44c3cab5b04 upstream.\n\nIn selinux_ip_postroute() we perform access checks based on the\npacket\u0027s security label.  For locally generated traffic we get the\npacket\u0027s security label from the associated socket; this works in all\ncases except for TCP SYN-ACK packets.  In the case of SYN-ACK packet\u0027s\nthe correct security label is stored in the connection\u0027s request_sock,\nnot the server\u0027s socket.  Unfortunately, at the point in time when\nselinux_ip_postroute() is called we can\u0027t query the request_sock\ndirectly, we need to recreate the label using the same logic that\noriginally labeled the associated request_sock.\n\nSee the inline comments for more explanation.\n\nReported-by: Janak Desai \u003cJanak.Desai@gtri.gatech.edu\u003e\nTested-by: Janak Desai \u003cJanak.Desai@gtri.gatech.edu\u003e\nSigned-off-by: Paul Moore \u003cpmoore@redhat.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "4e7c02e3c3cde0f0d532238784f2a5e5ea77ce68",
      "old_mode": 33188,
      "old_path": "security/selinux/hooks.c",
      "new_id": "d32db4140aa0438ed90b7a69743ebc38bdd1449c",
      "new_mode": 33188,
      "new_path": "security/selinux/hooks.c"
    }
  ]
}