Paul Moore f8687afefc [NetLabel]: protect the CIPSOv4 socket option from setsockopt() ... This patch makes two changes to protect applications from either removing or tampering with the CIPSOv4 IP option on a socket. The first is the requirement that applications have the CAP_NET_RAW capability to set an IPOPT_CIPSO option on a socket; this prevents untrusted applications from setting their own CIPSOv4 security attributes on the packets they send. The second change is to SELinux and it prevents applications from setting any IPv4 options when there is an IPOPT_CIPSO option already present on the socket; this prevents applications from removing CIPSOv4 security attributes from the packets they send. Signed-off-by: Paul Moore <paul.moore@hp.com> Signed-off-by: James Morris <jmorris@namei.org> Signed-off-by: David S. Miller <davem@davemloft.net>		2006-10-30 15:24:49 -08:00
..
av_inherit.h	[SELINUX]: add security class for appletalk sockets	2006-06-17 21:29:51 -07:00
av_perm_to_string.h	[MLSXFRM]: Granular IPSec associations for use in MLS environments	2006-09-22 14:53:20 -07:00
av_permissions.h	[MLSXFRM]: Granular IPSec associations for use in MLS environments	2006-09-22 14:53:20 -07:00
avc_ss.h
avc.h
class_to_string.h	[PATCH] selinux: add hooks for key subsystem	2006-06-22 15:05:55 -07:00
common_perm_to_string.h
conditional.h
flask.h	[PATCH] selinux: add hooks for key subsystem	2006-06-22 15:05:55 -07:00
initial_sid_to_string.h
netif.h
objsec.h	[PATCH] SELinux: convert sbsec semaphore to a mutex	2006-09-26 08:48:53 -07:00
security.h	[PATCH] selinux: add support for range transitions on object classes	2006-09-26 08:48:52 -07:00
selinux_netlabel.h	[NetLabel]: protect the CIPSOv4 socket option from setsockopt()	2006-10-30 15:24:49 -08:00
xfrm.h	IPsec: correct semantics for SELinux policy matching	2006-10-11 23:59:37 -07:00