)]}'
{
  "log": [
    {
      "commit": "910949a66839ff5f59fede5b7cb68ecf1453e22c",
      "tree": "6842924dba1c4af0397d06aa4b6363e8c26c220e",
      "parents": [
        "0de085bb474f64e4fdb2f1ff3268590792648c7b"
      ],
      "author": {
        "name": "Venkat Yekkirala",
        "email": "vyekkirala@trustedcs.com",
        "time": "Tue Jul 24 09:53:23 2007 -0500"
      },
      "committer": {
        "name": "James Morris",
        "email": "jmorris@namei.org",
        "time": "Wed Jul 25 12:49:41 2007 -0400"
      },
      "message": "SELinux: null-terminate context string in selinux_xfrm_sec_ctx_alloc\n\nxfrm_audit_log() expects the context string to be null-terminated\nwhich currently doesn\u0027t happen with user-supplied contexts.\n\nSigned-off-by: Venkat Yekkirala \u003cvyekkirala@TrustedCS.com\u003e\nAcked-by:  Stephen Smalley \u003csds@tycho.nsa.gov\u003e\nSigned-off-by: James Morris \u003cjmorris@namei.org\u003e\n"
    },
    {
      "commit": "3de4bab5b9f8848a0c16a4b1ffe0452f0d670237",
      "tree": "f65c12b53bf2ad02645ea31522f67e7318019498",
      "parents": [
        "9f2ad66509b182b399a5b03de487f45bde623524"
      ],
      "author": {
        "name": "Paul Moore",
        "email": "paul.moore@hp.com",
        "time": "Fri Nov 17 17:38:54 2006 -0500"
      },
      "committer": {
        "name": "David S. Miller",
        "email": "davem@sunset.davemloft.net",
        "time": "Sat Dec 02 21:24:14 2006 -0800"
      },
      "message": "SELinux: peer secid consolidation for external network labeling\n\nNow that labeled IPsec makes use of the peer_sid field in the\nsk_security_struct we can remove a lot of the special cases between labeled\nIPsec and NetLabel.  In addition, create a new function,\nsecurity_skb_extlbl_sid(), which we can use in several places to get the\nsecurity context of the packet\u0027s external label which allows us to further\nsimplify the code in a few places.\n\nSigned-off-by: Paul Moore \u003cpaul.moore@hp.com\u003e\nSigned-off-by: James Morris \u003cjmorris@namei.org\u003e\n"
    },
    {
      "commit": "67f83cbf081a70426ff667e8d14f94e13ed3bdca",
      "tree": "776a40733eacb9071478f865e6791daa3f6fd602",
      "parents": [
        "6b877699c6f1efede4545bcecc367786a472eedb"
      ],
      "author": {
        "name": "Venkat Yekkirala",
        "email": "vyekkirala@trustedcs.com",
        "time": "Wed Nov 08 17:04:26 2006 -0600"
      },
      "committer": {
        "name": "David S. Miller",
        "email": "davem@sunset.davemloft.net",
        "time": "Sat Dec 02 21:21:34 2006 -0800"
      },
      "message": "SELinux: Fix SA selection semantics\n\nFix the selection of an SA for an outgoing packet to be at the same\ncontext as the originating socket/flow. This eliminates the SELinux\npolicy\u0027s ability to use/sendto SAs with contexts other than the socket\u0027s.\n\nWith this patch applied, the SELinux policy will require one or more of the\nfollowing for a socket to be able to communicate with/without SAs:\n\n1. To enable a socket to communicate without using labeled-IPSec SAs:\n\nallow socket_t unlabeled_t:association { sendto recvfrom }\n\n2. To enable a socket to communicate with labeled-IPSec SAs:\n\nallow socket_t self:association { sendto };\nallow socket_t peer_sa_t:association { recvfrom };\n\nSigned-off-by: Venkat Yekkirala \u003cvyekkirala@TrustedCS.com\u003e\nSigned-off-by: James Morris \u003cjmorris@namei.org\u003e\n"
    },
    {
      "commit": "6b877699c6f1efede4545bcecc367786a472eedb",
      "tree": "c0a60dc90578fa9f16d4496e2700bc285eab47c0",
      "parents": [
        "c1a856c9640c9ff3d70bbd8214b6a0974609eef8"
      ],
      "author": {
        "name": "Venkat Yekkirala",
        "email": "vyekkirala@trustedcs.com",
        "time": "Wed Nov 08 17:04:09 2006 -0600"
      },
      "committer": {
        "name": "David S. Miller",
        "email": "davem@sunset.davemloft.net",
        "time": "Sat Dec 02 21:21:33 2006 -0800"
      },
      "message": "SELinux: Return correct context for SO_PEERSEC\n\nFix SO_PEERSEC for tcp sockets to return the security context of\nthe peer (as represented by the SA from the peer) as opposed to the\nSA used by the local/source socket.\n\nSigned-off-by: Venkat Yekkirala \u003cvyekkirala@TrustedCS.com\u003e\nSigned-off-by: James Morris \u003cjmorris@namei.org\u003e\n"
    },
    {
      "commit": "c1a856c9640c9ff3d70bbd8214b6a0974609eef8",
      "tree": "76166bf784edd968ffac8c3dcc607d73580c509a",
      "parents": [
        "e8db8c99100750ade5a9b4072b9469cab718a5b7"
      ],
      "author": {
        "name": "Venkat Yekkirala",
        "email": "vyekkirala@trustedcs.com",
        "time": "Wed Nov 08 17:03:44 2006 -0600"
      },
      "committer": {
        "name": "David S. Miller",
        "email": "davem@sunset.davemloft.net",
        "time": "Sat Dec 02 21:21:31 2006 -0800"
      },
      "message": "SELinux: Various xfrm labeling fixes\n\nSince the upstreaming of the mlsxfrm modification a few months back,\ntesting has resulted in the identification of the following issues/bugs that\nare resolved in this patch set.\n\n1. Fix the security context used in the IKE negotiation to be the context\n   of the socket as opposed to the context of the SPD rule.\n\n2. Fix SO_PEERSEC for tcp sockets to return the security context of\n   the peer as opposed to the source.\n\n3. Fix the selection of an SA for an outgoing packet to be at the same\n   context as the originating socket/flow.\n\nThe following would be the result of applying this patchset:\n\n- SO_PEERSEC will now correctly return the peer\u0027s context.\n\n- IKE deamons will receive the context of the source socket/flow\n  as opposed to the SPD rule\u0027s context so that the negotiated SA\n  will be at the same context as the source socket/flow.\n\n- The SELinux policy will require one or more of the\n  following for a socket to be able to communicate with/without SAs:\n\n  1. To enable a socket to communicate without using labeled-IPSec SAs:\n\n     allow socket_t unlabeled_t:association { sendto recvfrom }\n\n  2. To enable a socket to communicate with labeled-IPSec SAs:\n\n     allow socket_t self:association { sendto };\n     allow socket_t peer_sa_t:association { recvfrom };\n\nThis Patch: Pass correct security context to IKE for use in negotiation\n\nFix the security context passed to IKE for use in negotiation to be the\ncontext of the socket as opposed to the context of the SPD rule so that\nthe SA carries the label of the originating socket/flow.\n\nSigned-off-by: Venkat Yekkirala \u003cvyekkirala@TrustedCS.com\u003e\nSigned-off-by: James Morris \u003cjmorris@namei.org\u003e\n"
    },
    {
      "commit": "5b368e61c2bcb2666bb66e2acf1d6d85ba6f474d",
      "tree": "293f595f737540a546ba186ba1f054389aa95f6f",
      "parents": [
        "134b0fc544ba062498451611cb6f3e4454221b3d"
      ],
      "author": {
        "name": "Venkat Yekkirala",
        "email": "vyekkirala@trustedcs.com",
        "time": "Thu Oct 05 15:42:18 2006 -0500"
      },
      "committer": {
        "name": "David S. Miller",
        "email": "davem@sunset.davemloft.net",
        "time": "Wed Oct 11 23:59:37 2006 -0700"
      },
      "message": "IPsec: correct semantics for SELinux policy matching\n\nCurrently when an IPSec policy rule doesn\u0027t specify a security\ncontext, it is assumed to be \"unlabeled\" by SELinux, and so\nthe IPSec policy rule fails to match to a flow that it would\notherwise match to, unless one has explicitly added an SELinux\npolicy rule allowing the flow to \"polmatch\" to the \"unlabeled\"\nIPSec policy rules. In the absence of such an explicitly added\nSELinux policy rule, the IPSec policy rule fails to match and\nso the packet(s) flow in clear text without the otherwise applicable\nxfrm(s) applied.\n\nThe above SELinux behavior violates the SELinux security notion of\n\"deny by default\" which should actually translate to \"encrypt by\ndefault\" in the above case.\n\nThis was first reported by Evgeniy Polyakov and the way James Morris\nwas seeing the problem was when connecting via IPsec to a\nconfined service on an SELinux box (vsftpd), which did not have the\nappropriate SELinux policy permissions to send packets via IPsec.\n\nWith this patch applied, SELinux \"polmatching\" of flows Vs. IPSec\npolicy rules will only come into play when there\u0027s a explicit context\nspecified for the IPSec policy rule (which also means there\u0027s corresponding\nSELinux policy allowing appropriate domains/flows to polmatch to this context).\n\nSecondly, when a security module is loaded (in this case, SELinux), the\nsecurity_xfrm_policy_lookup() hook can return errors other than access denied,\nsuch as -EINVAL.  We were not handling that correctly, and in fact\ninverting the return logic and propagating a false \"ok\" back up to\nxfrm_lookup(), which then allowed packets to pass as if they were not\nassociated with an xfrm policy.\n\nThe solution for this is to first ensure that errno values are\ncorrectly propagated all the way back up through the various call chains\nfrom security_xfrm_policy_lookup(), and handled correctly.\n\nThen, flow_cache_lookup() is modified, so that if the policy resolver\nfails (typically a permission denied via the security module), the flow\ncache entry is killed rather than having a null policy assigned (which\nindicates that the packet can pass freely).  This also forces any future\nlookups for the same flow to consult the security module (e.g. SELinux)\nfor current security policy (rather than, say, caching the error on the\nflow cache entry).\n\nThis patch: Fix the selinux side of things.\n\nThis makes sure SELinux polmatching of flow contexts to IPSec policy\nrules comes into play only when an explicit context is associated\nwith the IPSec policy rule.\n\nAlso, this no longer defaults the context of a socket policy to\nthe context of the socket since the \"no explicit context\" case\nis now handled properly.\n\nSigned-off-by: Venkat Yekkirala \u003cvyekkirala@TrustedCS.com\u003e\nSigned-off-by: James Morris \u003cjmorris@namei.org\u003e\n"
    },
    {
      "commit": "4237c75c0a35535d7f9f2bfeeb4b4df1e068a0bf",
      "tree": "02adcb6fe6c346a8b99cf161ba5233ed1e572727",
      "parents": [
        "cb969f072b6d67770b559617f14e767f47e77ece"
      ],
      "author": {
        "name": "Venkat Yekkirala",
        "email": "vyekkirala@TrustedCS.com",
        "time": "Mon Jul 24 23:32:50 2006 -0700"
      },
      "committer": {
        "name": "David S. Miller",
        "email": "davem@sunset.davemloft.net",
        "time": "Fri Sep 22 14:53:29 2006 -0700"
      },
      "message": "[MLSXFRM]: Auto-labeling of child sockets\n\nThis automatically labels the TCP, Unix stream, and dccp child sockets\nas well as openreqs to be at the same MLS level as the peer. This will\nresult in the selection of appropriately labeled IPSec Security\nAssociations.\n\nThis also uses the sock\u0027s sid (as opposed to the isec sid) in SELinux\nenforcement of secmark in rcv_skb and postroute_last hooks.\n\nSigned-off-by: Venkat Yekkirala \u003cvyekkirala@TrustedCS.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n"
    },
    {
      "commit": "cb969f072b6d67770b559617f14e767f47e77ece",
      "tree": "4112eb0182e8b3e28b42aebaa40ca25454fc6b76",
      "parents": [
        "beb8d13bed80f8388f1a9a107d07ddd342e627e8"
      ],
      "author": {
        "name": "Venkat Yekkirala",
        "email": "vyekkirala@TrustedCS.com",
        "time": "Mon Jul 24 23:32:20 2006 -0700"
      },
      "committer": {
        "name": "David S. Miller",
        "email": "davem@sunset.davemloft.net",
        "time": "Fri Sep 22 14:53:28 2006 -0700"
      },
      "message": "[MLSXFRM]: Default labeling of socket specific IPSec policies\n\nThis defaults the label of socket-specific IPSec policies to be the\nsame as the socket they are set on.\n\nSigned-off-by: Venkat Yekkirala \u003cvyekkirala@TrustedCS.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n"
    },
    {
      "commit": "beb8d13bed80f8388f1a9a107d07ddd342e627e8",
      "tree": "19d5763b9b3b8ff3969997565e5ec0edd6e4bd33",
      "parents": [
        "4e2ba18eae7f370c7c3ed96eaca747cc9b39f917"
      ],
      "author": {
        "name": "Venkat Yekkirala",
        "email": "vyekkirala@TrustedCS.com",
        "time": "Fri Aug 04 23:12:42 2006 -0700"
      },
      "committer": {
        "name": "David S. Miller",
        "email": "davem@sunset.davemloft.net",
        "time": "Fri Sep 22 14:53:27 2006 -0700"
      },
      "message": "[MLSXFRM]: Add flow labeling\n\nThis labels the flows that could utilize IPSec xfrms at the points the\nflows are defined so that IPSec policy and SAs at the right label can\nbe used.\n\nThe following protos are currently not handled, but they should\ncontinue to be able to use single-labeled IPSec like they currently\ndo.\n\nipmr\nip_gre\nipip\nigmp\nsit\nsctp\nip6_tunnel (IPv6 over IPv6 tunnel device)\ndecnet\n\nSigned-off-by: Venkat Yekkirala \u003cvyekkirala@TrustedCS.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n"
    },
    {
      "commit": "e0d1caa7b0d5f02e4f34aa09c695d04251310c6c",
      "tree": "bf023c17abf6813f2694ebf5fafff82edd6a1023",
      "parents": [
        "b6340fcd761acf9249b3acbc95c4dc555d9beb07"
      ],
      "author": {
        "name": "Venkat Yekkirala",
        "email": "vyekkirala@TrustedCS.com",
        "time": "Mon Jul 24 23:29:07 2006 -0700"
      },
      "committer": {
        "name": "David S. Miller",
        "email": "davem@sunset.davemloft.net",
        "time": "Fri Sep 22 14:53:24 2006 -0700"
      },
      "message": "[MLSXFRM]: Flow based matching of xfrm policy and state\n\nThis implements a seemless mechanism for xfrm policy selection and\nstate matching based on the flow sid. This also includes the necessary\nSELinux enforcement pieces.\n\nSigned-off-by: Venkat Yekkirala \u003cvyekkirala@TrustedCS.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n"
    },
    {
      "commit": "6ab3d5624e172c553004ecc862bfeac16d9d68b7",
      "tree": "6d98881fe91fd9583c109208d5c27131b93fa248",
      "parents": [
        "e02169b682bc448ccdc819dc8639ed34a23cedd8"
      ],
      "author": {
        "name": "Jörn Engel",
        "email": "joern@wohnheim.fh-wedel.de",
        "time": "Fri Jun 30 19:25:36 2006 +0200"
      },
      "committer": {
        "name": "Adrian Bunk",
        "email": "bunk@stusta.de",
        "time": "Fri Jun 30 19:25:36 2006 +0200"
      },
      "message": "Remove obsolete #include \u003clinux/config.h\u003e\n\nSigned-off-by: Jörn Engel \u003cjoern@wohnheim.fh-wedel.de\u003e\nSigned-off-by: Adrian Bunk \u003cbunk@stusta.de\u003e\n"
    },
    {
      "commit": "4e5ab4cb85683cf77b507ba0c4d48871e1562305",
      "tree": "aef7ba8b6050fcaccbaf0d05f8e5ba860a143eaf",
      "parents": [
        "100468e9c05c10fb6872751c1af523b996d6afa9"
      ],
      "author": {
        "name": "James Morris",
        "email": "jmorris@namei.org",
        "time": "Fri Jun 09 00:33:33 2006 -0700"
      },
      "committer": {
        "name": "David S. Miller",
        "email": "davem@sunset.davemloft.net",
        "time": "Sat Jun 17 21:30:05 2006 -0700"
      },
      "message": "[SECMARK]: Add new packet controls to SELinux\n\nAdd new per-packet access controls to SELinux, replacing the old\npacket controls.\n\nPackets are labeled with the iptables SECMARK and CONNSECMARK targets,\nthen security policy for the packets is enforced with these controls.\n\nTo allow for a smooth transition to the new controls, the old code is\nstill present, but not active by default.  To restore previous\nbehavior, the old controls may be activated at runtime by writing a\n\u00271\u0027 to /selinux/compat_net, and also via the kernel boot parameter\nselinux_compat_net.  Switching between the network control models\nrequires the security load_policy permission.  The old controls will\nprobably eventually be removed and any continued use is discouraged.\n\nWith this patch, the new secmark controls for SElinux are disabled by\ndefault, so existing behavior is entirely preserved, and the user is\nnot affected at all.\n\nIt also provides a config option to enable the secmark controls by\ndefault (which can always be overridden at boot and runtime).  It is\nalso noted in the kconfig help that the user will need updated\nuserspace if enabling secmark controls for SELinux and that they\u0027ll\nprobably need the SECMARK and CONNMARK targets, and conntrack protocol\nhelpers, although such decisions are beyond the scope of kernel\nconfiguration.\n\nSigned-off-by: James Morris \u003cjmorris@namei.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@osdl.org\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n"
    },
    {
      "commit": "c8c05a8eec6f1258f6d5cb71a44ee5dc1e989b63",
      "tree": "b4a04dd9e2b940cb5b2911fb67fbe49c5f8b3fbf",
      "parents": [
        "cec6f7f39c3db7d9f6091bf2f8fc8d520f372719"
      ],
      "author": {
        "name": "Catherine Zhang",
        "email": "cxzhang@watson.ibm.com",
        "time": "Thu Jun 08 23:39:49 2006 -0700"
      },
      "committer": {
        "name": "David S. Miller",
        "email": "davem@sunset.davemloft.net",
        "time": "Sat Jun 17 21:29:45 2006 -0700"
      },
      "message": "[LSM-IPsec]: SELinux Authorize\n\nThis patch contains a fix for the previous patch that adds security\ncontexts to IPsec policies and security associations.  In the previous\npatch, no authorization (besides the check for write permissions to\nSAD and SPD) is required to delete IPsec policies and security\nassocations with security contexts.  Thus a user authorized to change\nSAD and SPD can bypass the IPsec policy authorization by simply\ndeleteing policies with security contexts.  To fix this security hole,\nan additional authorization check is added for removing security\npolicies and security associations with security contexts.\n\nNote that if no security context is supplied on add or present on\npolicy to be deleted, the SELinux module allows the change\nunconditionally.  The hook is called on deletion when no context is\npresent, which we may want to change.  At present, I left it up to the\nmodule.\n\nLSM changes:\n\nThe patch adds two new LSM hooks: xfrm_policy_delete and\nxfrm_state_delete.  The new hooks are necessary to authorize deletion\nof IPsec policies that have security contexts.  The existing hooks\nxfrm_policy_free and xfrm_state_free lack the context to do the\nauthorization, so I decided to split authorization of deletion and\nmemory management of security data, as is typical in the LSM\ninterface.\n\nUse:\n\nThe new delete hooks are checked when xfrm_policy or xfrm_state are\ndeleted by either the xfrm_user interface (xfrm_get_policy,\nxfrm_del_sa) or the pfkey interface (pfkey_spddelete, pfkey_delete).\n\nSELinux changes:\n\nThe new policy_delete and state_delete functions are added.\n\nSigned-off-by: Catherine Zhang \u003ccxzhang@watson.ibm.com\u003e\nSigned-off-by: Trent Jaeger \u003ctjaeger@cse.psu.edu\u003e\nAcked-by: James Morris \u003cjmorris@namei.org\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n"
    },
    {
      "commit": "67644726317a8274be4a3d0ef85b9ccebaa90304",
      "tree": "c2bcf873d19d1b18d65e4f5d6d5c3cd613e9cb13",
      "parents": [
        "66004a6ca23f2a2408b32cbe27fda0389fb8f9dc"
      ],
      "author": {
        "name": "Dave Jones",
        "email": "davej@redhat.com",
        "time": "Sun Apr 02 23:34:19 2006 -0700"
      },
      "committer": {
        "name": "Linus Torvalds",
        "email": "torvalds@g5.osdl.org",
        "time": "Sun Apr 09 12:35:53 2006 -0700"
      },
      "message": "[SELINUX] Fix build after ipsec decap state changes.\n\n    security/selinux/xfrm.c: In function \u0027selinux_socket_getpeer_dgram\u0027:\n    security/selinux/xfrm.c:284: error: \u0027struct sec_path\u0027 has no member named \u0027x\u0027\n    security/selinux/xfrm.c: In function \u0027selinux_xfrm_sock_rcv_skb\u0027:\n    security/selinux/xfrm.c:317: error: \u0027struct sec_path\u0027 has no member named \u0027x\u0027\n\nSigned-off-by: Dave Jones \u003cdavej@redhat.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@osdl.org\u003e\n"
    },
    {
      "commit": "2c7946a7bf45ae86736ab3b43d0085e43947945c",
      "tree": "b956f301033ebaefe8d2701b257edfd947f537f3",
      "parents": [
        "be33690d8fcf40377f16193c463681170eb6b295"
      ],
      "author": {
        "name": "Catherine Zhang",
        "email": "cxzhang@watson.ibm.com",
        "time": "Mon Mar 20 22:41:23 2006 -0800"
      },
      "committer": {
        "name": "David S. Miller",
        "email": "davem@davemloft.net",
        "time": "Mon Mar 20 22:41:23 2006 -0800"
      },
      "message": "[SECURITY]: TCP/UDP getpeersec\n\nThis patch implements an application of the LSM-IPSec networking\ncontrols whereby an application can determine the label of the\nsecurity association its TCP or UDP sockets are currently connected to\nvia getsockopt and the auxiliary data mechanism of recvmsg.\n\nPatch purpose:\n\nThis patch enables a security-aware application to retrieve the\nsecurity context of an IPSec security association a particular TCP or\nUDP socket is using.  The application can then use this security\ncontext to determine the security context for processing on behalf of\nthe peer at the other end of this connection.  In the case of UDP, the\nsecurity context is for each individual packet.  An example\napplication is the inetd daemon, which could be modified to start\ndaemons running at security contexts dependent on the remote client.\n\nPatch design approach:\n\n- Design for TCP\nThe patch enables the SELinux LSM to set the peer security context for\na socket based on the security context of the IPSec security\nassociation.  The application may retrieve this context using\ngetsockopt.  When called, the kernel determines if the socket is a\nconnected (TCP_ESTABLISHED) TCP socket and, if so, uses the dst_entry\ncache on the socket to retrieve the security associations.  If a\nsecurity association has a security context, the context string is\nreturned, as for UNIX domain sockets.\n\n- Design for UDP\nUnlike TCP, UDP is connectionless.  This requires a somewhat different\nAPI to retrieve the peer security context.  With TCP, the peer\nsecurity context stays the same throughout the connection, thus it can\nbe retrieved at any time between when the connection is established\nand when it is torn down.  With UDP, each read/write can have\ndifferent peer and thus the security context might change every time.\nAs a result the security context retrieval must be done TOGETHER with\nthe packet retrieval.\n\nThe solution is to build upon the existing Unix domain socket API for\nretrieving user credentials.  Linux offers the API for obtaining user\ncredentials via ancillary messages (i.e., out of band/control messages\nthat are bundled together with a normal message).\n\nPatch implementation details:\n\n- Implementation for TCP\nThe security context can be retrieved by applications using getsockopt\nwith the existing SO_PEERSEC flag.  As an example (ignoring error\nchecking):\n\ngetsockopt(sockfd, SOL_SOCKET, SO_PEERSEC, optbuf, \u0026optlen);\nprintf(\"Socket peer context is: %s\\n\", optbuf);\n\nThe SELinux function, selinux_socket_getpeersec, is extended to check\nfor labeled security associations for connected (TCP_ESTABLISHED \u003d\u003d\nsk-\u003esk_state) TCP sockets only.  If so, the socket has a dst_cache of\nstruct dst_entry values that may refer to security associations.  If\nthese have security associations with security contexts, the security\ncontext is returned.\n\ngetsockopt returns a buffer that contains a security context string or\nthe buffer is unmodified.\n\n- Implementation for UDP\nTo retrieve the security context, the application first indicates to\nthe kernel such desire by setting the IP_PASSSEC option via\ngetsockopt.  Then the application retrieves the security context using\nthe auxiliary data mechanism.\n\nAn example server application for UDP should look like this:\n\ntoggle \u003d 1;\ntoggle_len \u003d sizeof(toggle);\n\nsetsockopt(sockfd, SOL_IP, IP_PASSSEC, \u0026toggle, \u0026toggle_len);\nrecvmsg(sockfd, \u0026msg_hdr, 0);\nif (msg_hdr.msg_controllen \u003e sizeof(struct cmsghdr)) {\n    cmsg_hdr \u003d CMSG_FIRSTHDR(\u0026msg_hdr);\n    if (cmsg_hdr-\u003ecmsg_len \u003c\u003d CMSG_LEN(sizeof(scontext)) \u0026\u0026\n        cmsg_hdr-\u003ecmsg_level \u003d\u003d SOL_IP \u0026\u0026\n        cmsg_hdr-\u003ecmsg_type \u003d\u003d SCM_SECURITY) {\n        memcpy(\u0026scontext, CMSG_DATA(cmsg_hdr), sizeof(scontext));\n    }\n}\n\nip_setsockopt is enhanced with a new socket option IP_PASSSEC to allow\na server socket to receive security context of the peer.  A new\nancillary message type SCM_SECURITY.\n\nWhen the packet is received we get the security context from the\nsec_path pointer which is contained in the sk_buff, and copy it to the\nancillary message space.  An additional LSM hook,\nselinux_socket_getpeersec_udp, is defined to retrieve the security\ncontext from the SELinux space.  The existing function,\nselinux_socket_getpeersec does not suit our purpose, because the\nsecurity context is copied directly to user space, rather than to\nkernel space.\n\nTesting:\n\nWe have tested the patch by setting up TCP and UDP connections between\napplications on two machines using the IPSec policies that result in\nlabeled security associations being built.  For TCP, we can then\nextract the peer security context using getsockopt on either end.  For\nUDP, the receiving end can retrieve the security context using the\nauxiliary data mechanism of recvmsg.\n\nSigned-off-by: Catherine Zhang \u003ccxzhang@watson.ibm.com\u003e\nAcked-by: James Morris \u003cjmorris@namei.org\u003e\nAcked-by: Herbert Xu \u003cherbert@gondor.apana.org.au\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n"
    },
    {
      "commit": "ee2e6841b934d76cb944a3390bbea84da777d4fa",
      "tree": "839c2a904647d220d5188e942240b22a24403990",
      "parents": [
        "aa0e4e4aea8d9e0a559a884336d728f0263063e0"
      ],
      "author": {
        "name": "Luiz Capitulino",
        "email": "lcapitulino@mandriva.com.br",
        "time": "Fri Jan 06 22:59:43 2006 -0800"
      },
      "committer": {
        "name": "David S. Miller",
        "email": "davem@sunset.davemloft.net",
        "time": "Sat Jan 07 12:57:27 2006 -0800"
      },
      "message": "[XFRM]: Fix sparse warning.\n\nsecurity/selinux/xfrm.c:155:10: warning: Using plain integer as NULL pointer\n\nSigned-off-by: Luiz Capitulino \u003clcapitulino@mandriva.com.br\u003e\nSigned-off-by: Andrew Morton \u003cakpm@osdl.org\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n"
    },
    {
      "commit": "5f8ac64b15172c7ced7d7990eb28342092bc751b",
      "tree": "63046817c9a6e8db513379337f01289c045a5d63",
      "parents": [
        "69549ddd2f894c4cead50ee2b60cc02990c389ad"
      ],
      "author": {
        "name": "Trent Jaeger",
        "email": "tjaeger@cse.psu.edu",
        "time": "Fri Jan 06 13:22:39 2006 -0800"
      },
      "committer": {
        "name": "David S. Miller",
        "email": "davem@davemloft.net",
        "time": "Fri Jan 06 13:22:39 2006 -0800"
      },
      "message": "[LSM-IPSec]: Corrections to LSM-IPSec Nethooks\n\nThis patch contains two corrections to the LSM-IPsec Nethooks patches\npreviously applied.  \n\n(1) free a security context on a failed insert via xfrm_user \ninterface in xfrm_add_policy.  Memory leak.\n\n(2) change the authorization of the allocation of a security context\nin a xfrm_policy or xfrm_state from both relabelfrom and relabelto \nto setcontext.\n\nSigned-off-by: Trent Jaeger \u003ctjaeger@cse.psu.edu\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n"
    },
    {
      "commit": "d28d1e080132f28ab773291f10ad6acca4c8bba2",
      "tree": "4cc6abef076393bc4c9f0d4e4c9952b78c04d3ee",
      "parents": [
        "df71837d5024e2524cd51c93621e558aa7dd9f3f"
      ],
      "author": {
        "name": "Trent Jaeger",
        "email": "tjaeger@cse.psu.edu",
        "time": "Tue Dec 13 23:12:40 2005 -0800"
      },
      "committer": {
        "name": "David S. Miller",
        "email": "davem@sunset.davemloft.net",
        "time": "Tue Jan 03 13:10:25 2006 -0800"
      },
      "message": "[LSM-IPSec]: Per-packet access control.\n\nThis patch series implements per packet access control via the\nextension of the Linux Security Modules (LSM) interface by hooks in\nthe XFRM and pfkey subsystems that leverage IPSec security\nassociations to label packets.  Extensions to the SELinux LSM are\nincluded that leverage the patch for this purpose.\n\nThis patch implements the changes necessary to the SELinux LSM to\ncreate, deallocate, and use security contexts for policies\n(xfrm_policy) and security associations (xfrm_state) that enable\ncontrol of a socket\u0027s ability to send and receive packets.\n\nPatch purpose:\n\nThe patch is designed to enable the SELinux LSM to implement access\ncontrol on individual packets based on the strongly authenticated\nIPSec security association.  Such access controls augment the existing\nones in SELinux based on network interface and IP address.  The former\nare very coarse-grained, and the latter can be spoofed.  By using\nIPSec, the SELinux can control access to remote hosts based on\ncryptographic keys generated using the IPSec mechanism.  This enables\naccess control on a per-machine basis or per-application if the remote\nmachine is running the same mechanism and trusted to enforce the\naccess control policy.\n\nPatch design approach:\n\nThe patch\u0027s main function is to authorize a socket\u0027s access to a IPSec\npolicy based on their security contexts.  Since the communication is\nimplemented by a security association, the patch ensures that the\nsecurity association\u0027s negotiated and used have the same security\ncontext.  The patch enables allocation and deallocation of such\nsecurity contexts for policies and security associations.  It also\nenables copying of the security context when policies are cloned.\nLastly, the patch ensures that packets that are sent without using a\nIPSec security assocation with a security context are allowed to be\nsent in that manner.\n\nA presentation available at\nwww.selinux-symposium.org/2005/presentations/session2/2-3-jaeger.pdf\nfrom the SELinux symposium describes the overall approach.\n\nPatch implementation details:\n\nThe function which authorizes a socket to perform a requested\noperation (send/receive) on a IPSec policy (xfrm_policy) is\nselinux_xfrm_policy_lookup.  The Netfilter and rcv_skb hooks ensure\nthat if a IPSec SA with a securit y association has not been used,\nthen the socket is allowed to send or receive the packet,\nrespectively.\n\nThe patch implements SELinux function for allocating security contexts\nwhen policies (xfrm_policy) are created via the pfkey or xfrm_user\ninterfaces via selinux_xfrm_policy_alloc.  When a security association\nis built, SELinux allocates the security context designated by the\nXFRM subsystem which is based on that of the authorized policy via\nselinux_xfrm_state_alloc.\n\nWhen a xfrm_policy is cloned, the security context of that policy, if\nany, is copied to the clone via selinux_xfrm_policy_clone.\n\nWhen a xfrm_policy or xfrm_state is freed, its security context, if\nany is also freed at selinux_xfrm_policy_free or\nselinux_xfrm_state_free.\n\nTesting:\n\nThe SELinux authorization function is tested using ipsec-tools.  We\ncreated policies and security associations with particular security\ncontexts and added SELinux access control policy entries to verify the\nauthorization decision.  We also made sure that packets for which no\nsecurity context was supplied (which either did or did not use\nsecurity associations) were authorized using an unlabelled context.\n\nSigned-off-by: Trent Jaeger \u003ctjaeger@cse.psu.edu\u003e\nSigned-off-by: Herbert Xu \u003cherbert@gondor.apana.org.au\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n"
    }
  ]
}