• Paul Moore's avatar
    [NetLabel]: protect the CIPSOv4 socket option from setsockopt() · f8687afe
    Paul Moore authored
    This patch makes two changes to protect applications from either removing or
    tampering with the CIPSOv4 IP option on a socket.  The first is the requirement
    that applications have the CAP_NET_RAW capability to set an IPOPT_CIPSO option
    on a socket; this prevents untrusted applications from setting their own
    CIPSOv4 security attributes on the packets they send.  The second change is to
    SELinux and it prevents applications from setting any IPv4 options when there
    is an IPOPT_CIPSO option already present on the socket; this prevents
    applications from removing CIPSOv4 security attributes from the packets they
    send.
    Signed-off-by: default avatarPaul Moore <paul.moore@hp.com>
    Signed-off-by: default avatarJames Morris <jmorris@namei.org>
    Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    f8687afe
ip_options.c 15 KB