)]}'
{
  "commit": "c1a856c9640c9ff3d70bbd8214b6a0974609eef8",
  "tree": "76166bf784edd968ffac8c3dcc607d73580c509a",
  "parents": [
    "e8db8c99100750ade5a9b4072b9469cab718a5b7"
  ],
  "author": {
    "name": "Venkat Yekkirala",
    "email": "vyekkirala@trustedcs.com",
    "time": "Wed Nov 08 17:03:44 2006 -0600"
  },
  "committer": {
    "name": "David S. Miller",
    "email": "davem@sunset.davemloft.net",
    "time": "Sat Dec 02 21:21:31 2006 -0800"
  },
  "message": "SELinux: Various xfrm labeling fixes\n\nSince the upstreaming of the mlsxfrm modification a few months back,\ntesting has resulted in the identification of the following issues/bugs that\nare resolved in this patch set.\n\n1. Fix the security context used in the IKE negotiation to be the context\n   of the socket as opposed to the context of the SPD rule.\n\n2. Fix SO_PEERSEC for tcp sockets to return the security context of\n   the peer as opposed to the source.\n\n3. Fix the selection of an SA for an outgoing packet to be at the same\n   context as the originating socket/flow.\n\nThe following would be the result of applying this patchset:\n\n- SO_PEERSEC will now correctly return the peer\u0027s context.\n\n- IKE deamons will receive the context of the source socket/flow\n  as opposed to the SPD rule\u0027s context so that the negotiated SA\n  will be at the same context as the source socket/flow.\n\n- The SELinux policy will require one or more of the\n  following for a socket to be able to communicate with/without SAs:\n\n  1. To enable a socket to communicate without using labeled-IPSec SAs:\n\n     allow socket_t unlabeled_t:association { sendto recvfrom }\n\n  2. To enable a socket to communicate with labeled-IPSec SAs:\n\n     allow socket_t self:association { sendto };\n     allow socket_t peer_sa_t:association { recvfrom };\n\nThis Patch: Pass correct security context to IKE for use in negotiation\n\nFix the security context passed to IKE for use in negotiation to be the\ncontext of the socket as opposed to the context of the SPD rule so that\nthe SA carries the label of the originating socket/flow.\n\nSigned-off-by: Venkat Yekkirala \u003cvyekkirala@TrustedCS.com\u003e\nSigned-off-by: James Morris \u003cjmorris@namei.org\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "b200b9856f32f2f585f6953994bd4ec54a524e9e",
      "old_mode": 33188,
      "old_path": "include/linux/security.h",
      "new_id": "a509329a669b165c52b8f8078ff9b862ea452e4f",
      "new_mode": 33188,
      "new_path": "include/linux/security.h"
    },
    {
      "type": "modify",
      "old_id": "43874c1e6e23999def36ff43b6918d806dcaf54b",
      "old_mode": 33188,
      "old_path": "security/dummy.c",
      "new_id": "838d8442cf3c260152950a220167ae4bc8690d9e",
      "new_mode": 33188,
      "new_path": "security/dummy.c"
    },
    {
      "type": "modify",
      "old_id": "526b28019acaa55ac0c7db6da9b7933fef8936c8",
      "old_mode": 33188,
      "old_path": "security/selinux/include/xfrm.h",
      "new_id": "8e329ddb5e37de8df1288a36ef7fb4fe43090942",
      "new_mode": 33188,
      "new_path": "security/selinux/include/xfrm.h"
    },
    {
      "type": "modify",
      "old_id": "675b995a67c3ec1836fd6d7034e1dbab8cc6a0a3",
      "old_mode": 33188,
      "old_path": "security/selinux/xfrm.c",
      "new_id": "4d5a043cdfa1244c32283b54925d0f1c05114510",
      "new_mode": 33188,
      "new_path": "security/selinux/xfrm.c"
    }
  ]
}