Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1760234AbXHVNmQ (ORCPT ); Wed, 22 Aug 2007 09:42:16 -0400 Received: (majordomo@vger.kernel.org) by vger.kernel.org id S1755825AbXHVNmG (ORCPT ); Wed, 22 Aug 2007 09:42:06 -0400 Received: from mummy.ncsc.mil ([144.51.88.129]:57428 "EHLO jazzhorn.ncsc.mil" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1755759AbXHVNmF (ORCPT ); Wed, 22 Aug 2007 09:42:05 -0400 Subject: Re: [2.6.20.17 review 00/58] 2.6.20.17 -stable review From: Stephen Smalley To: James Morris Cc: Michal Piotrowski , Willy Tarreau , linux-kernel@vger.kernel.org, stable@kernel.org In-Reply-To: References: <20070822083844.%N@1wt.eu> <6bffcb0e0708220410u4ab3978eq18786ac186e88c7d@mail.gmail.com> Content-Type: text/plain Organization: National Security Agency Date: Wed, 22 Aug 2007 09:36:05 -0400 Message-Id: <1187789765.1451.310.camel@moss-spartans.epoch.ncsc.mil> Mime-Version: 1.0 X-Mailer: Evolution 2.10.3 (2.10.3-2.fc7) Content-Transfer-Encoding: 7bit Sender: linux-kernel-owner@vger.kernel.org X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1081 Lines: 29 On Wed, 2007-08-22 at 06:23 -0700, James Morris wrote: > On Wed, 22 Aug 2007, Michal Piotrowski wrote: > > > I got a problem with SELinux > > http://www.stardust.webpages.pl/files/tbf/bitis-gabonica/2.6.20.17-rc1/console.log > > http://www.stardust.webpages.pl/files/tbf/bitis-gabonica/2.6.20.17-rc1/stable-config > > Please set > CONFIG_SECURITY_SELINUX_ENABLE_SECMARK_DEFAULT=n > > You don't have complete policy for the new network controls, which are not > enabled by default and not integreated fully into distros yet. Still, that denial shouldn't be against kernel_t unless he has iptables SECMARK rules that assign that value. It's the change to the skb allocator - no longer clears up through truesize and thus secmark is garbage initially. That would apply to mainline too. -- Stephen Smalley National Security Agency - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/