diff options
| author |   Eric Paris <eparis@redhat.com> | 2010-10-13 16:24:54 -0400 |
|---|---|---|
| committer |   James Morris <jmorris@namei.org> | 2010-10-21 10:12:51 +1100 |
| commit | 1cc63249adfa957b34ca51effdee90ff8261d63f (patch) | |
| tree | e5cf71ae9a2c43ca13b1820551df2aebbbd0d757 /include/linux/netfilter | |
| parent | security: secid_to_secctx returns len when data is NULL (diff) | |
| download | linux-dev-1cc63249adfa957b34ca51effdee90ff8261d63f.tar.xz linux-dev-1cc63249adfa957b34ca51effdee90ff8261d63f.zip | |
conntrack: export lsm context rather than internal secid via netlink
The conntrack code can export the internal secid to userspace. These are
dynamic, can change on lsm changes, and have no meaning in userspace. We
should instead be sending lsm contexts to userspace instead. This patch sends
the secctx (rather than secid) to userspace over the netlink socket. We use a
new field CTA_SECCTX and stop using the the old CTA_SECMARK field since it did
not send particularly useful information.
Signed-off-by: Eric Paris <eparis@redhat.com>
Reviewed-by: Paul Moore <paul.moore@hp.com>
Acked-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: James Morris <jmorris@namei.org>
Diffstat (limited to 'include/linux/netfilter')
| -rw-r--r-- | include/linux/netfilter/nfnetlink_conntrack.h | 10 |
1 files changed, 9 insertions, 1 deletions
diff --git a/include/linux/netfilter/nfnetlink_conntrack.h b/include/linux/netfilter/nfnetlink_conntrack.h index 9ed534c991b9..70cd0603911c 100644 --- a/include/linux/netfilter/nfnetlink_conntrack.h +++ b/include/linux/netfilter/nfnetlink_conntrack.h @@ -39,8 +39,9 @@ enum ctattr_type { CTA_TUPLE_MASTER, CTA_NAT_SEQ_ADJ_ORIG, CTA_NAT_SEQ_ADJ_REPLY, - CTA_SECMARK, + CTA_SECMARK, /* obsolete */ CTA_ZONE, + CTA_SECCTX, __CTA_MAX }; #define CTA_MAX (__CTA_MAX - 1) @@ -172,4 +173,11 @@ enum ctattr_help { }; #define CTA_HELP_MAX (__CTA_HELP_MAX - 1) +enum ctattr_secctx { + CTA_SECCTX_UNSPEC, + CTA_SECCTX_NAME, + __CTA_SECCTX_MAX +}; +#define CTA_SECCTX_MAX (__CTA_SECCTX_MAX - 1) + #endif /* _IPCONNTRACK_NETLINK_H */ |