[gentoo-commits] proj/hardened-refpolicy:master commit in: policy/modules/kernel/

["Sven Vermeulen" <sven.vermeulen@siphos.be>]

commit:     8c4542aad827ced701d681c1985bd0ddfe15d86f
Author:     Chris PeBenito <cpebenito <AT> tresys <DOT> com>
AuthorDate: Thu May  9 12:46:33 2013 +0000
Commit:     Sven Vermeulen <sven.vermeulen <AT> siphos <DOT> be>
CommitDate: Thu May 16 09:01:47 2013 +0000
URL:        http://git.overlays.gentoo.org/gitweb/?p=proj/hardened-refpolicy.git;a=commit;h=8c4542aa

Remove general unlabeled packet usage.

Back when the SECMARK implementation was new, the packet class was always
checked.  Because of that, unlabeled_t packet rules proliferated refpolicy
since the common case was to have no SECMARK rules.  Since then, the kernel
has been modified to only enforce the packet class if there are SECMARK
rules.  Remove the unlabeled_t packet rules, since users of SECMARK will
likely want no unlabeled_t packet rules, and the common case users will
have no impact since the packet class isn't enforced on their systems.

To have partial SECMARK confinement, the following rule applies:

allow { domain -type_i_want_to_constrain_t } unlabeled_t:packet { send recv };

It seems like over-allowing, but if you have no SECMARK rules, it's the equivalent of:

allow * unlabeled_t:packet { send recv };

Signed-off-by: Chris PeBenito <cpebenito <AT> tresys.com>

---
 policy/modules/kernel/kernel.if |    3 ---
 policy/modules/kernel/kernel.te |    2 +-
 2 files changed, 1 insertions(+), 4 deletions(-)

diff --git a/policy/modules/kernel/kernel.if b/policy/modules/kernel/kernel.if
index ee01f48..54f1b0b 100644
--- a/policy/modules/kernel/kernel.if
+++ b/policy/modules/kernel/kernel.if
@@ -2648,9 +2648,6 @@ interface(`kernel_sendrecv_unlabeled_association',`
 	')
 
 	allow $1 unlabeled_t:association { sendto recvfrom };
-
-	# temporary hack until labeling on packets is supported
-	allow $1 unlabeled_t:packet { send recv };
 ')
 
 ########################################

diff --git a/policy/modules/kernel/kernel.te b/policy/modules/kernel/kernel.te
index 397a25e..dd7648a 100644
--- a/policy/modules/kernel/kernel.te
+++ b/policy/modules/kernel/kernel.te
@@ -1,4 +1,4 @@
-policy_module(kernel, 1.17.0)
+policy_module(kernel, 1.17.1)
 
 ########################################
 #