Bug 210032 - [labeled networking] correct netlabel secid for packets without a known label
Summary: [labeled networking] correct netlabel secid for packets without a known label
Keywords:
Status: CLOSED CURRENTRELEASE
Alias: None
Product: Red Hat Enterprise Linux 5
Classification: Red Hat
Component: kernel
Version: 5.0
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
: ---
Assignee: Eric Paris
QA Contact: Brian Brock
URL:
Whiteboard:
: 209555 (view as bug list)
Depends On:
Blocks: 208884
TreeView+ depends on / blocked
 
Reported: 2006-10-09 16:57 UTC by Eric Paris
Modified: 2007-11-30 22:07 UTC (History)
2 users (show)

Fixed In Version: 5.0.0
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2007-02-19 18:04:16 UTC
Target Upstream Version:
Embargoed:

Attachments (Terms of Use)

Description Eric Paris 2006-10-09 16:57:58 UTC 
Netlabel should be using SECSID_NULL for packets which have no known label.  Not
the explicit SECSID_UNLABELED
Comment 1 Don Zickus 2006-10-11 01:38:12 UTC 
in kernel-2.6.18-1.2725.el5
Comment 2 Eric Paris 2006-10-11 14:23:23 UTC 
*** Bug 209555 has been marked as a duplicate of this bug. ***
Comment 3 Paul Moore 2006-10-11 14:26:46 UTC 
I think something may have been lost in translation, NetLabel should be using
SECINITSID_UNLABELED not SECINITSID_NETMSG; at least this is what the patches
accepted for 2.6.19 change (as well as the patches for RHEL5 I believe, I just
wanted to clarify this BZ entry).
Comment 4 Jay Turner 2007-02-13 16:50:22 UTC 
Has someone verified the right thing is happening in the latest RHEL5 code? 
There's no patch attached to this bug and no testing results so I'm not really
sure where we stand.
Comment 5 Paul Moore 2007-02-15 17:44:22 UTC 
There is no way to determine from a running system if the patch is applied or 
not as both SECINITSID_UNLABELED and SECINITSID_NETMSG have the same SELinux 
context in all of the SELinux policies that are in RHEL5.  The kernel source 
must be verified to ensure the patch has been applied.

A pointer to the patch can be found in BZ 209555.
Comment 6 Jay Turner 2007-02-19 18:04:16 UTC 
Patch confirmed with 2.6.18-8.el5.
Note You need to log in before you can comment on or make changes to this bug.