Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1761397AbXHVNst (ORCPT ); Wed, 22 Aug 2007 09:48:49 -0400 Received: (majordomo@vger.kernel.org) by vger.kernel.org id S1756918AbXHVNsm (ORCPT ); Wed, 22 Aug 2007 09:48:42 -0400 Received: from zombie.ncsc.mil ([144.51.88.131]:41142 "EHLO jazzdrum.ncsc.mil" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1756869AbXHVNsl (ORCPT ); Wed, 22 Aug 2007 09:48:41 -0400 Subject: Re: [2.6.20.17 review 00/58] 2.6.20.17 -stable review From: Stephen Smalley To: James Morris Cc: Michal Piotrowski , Willy Tarreau , linux-kernel@vger.kernel.org, stable@kernel.org In-Reply-To: <1187789765.1451.310.camel@moss-spartans.epoch.ncsc.mil> References: <20070822083844.%N@1wt.eu> <6bffcb0e0708220410u4ab3978eq18786ac186e88c7d@mail.gmail.com> <1187789765.1451.310.camel@moss-spartans.epoch.ncsc.mil> Content-Type: text/plain Organization: National Security Agency Date: Wed, 22 Aug 2007 09:42:54 -0400 Message-Id: <1187790174.1451.315.camel@moss-spartans.epoch.ncsc.mil> Mime-Version: 1.0 X-Mailer: Evolution 2.10.3 (2.10.3-2.fc7) Content-Transfer-Encoding: 7bit Sender: linux-kernel-owner@vger.kernel.org X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1408 Lines: 35 On Wed, 2007-08-22 at 09:36 -0400, Stephen Smalley wrote: > On Wed, 2007-08-22 at 06:23 -0700, James Morris wrote: > > On Wed, 22 Aug 2007, Michal Piotrowski wrote: > > > > > I got a problem with SELinux > > > http://www.stardust.webpages.pl/files/tbf/bitis-gabonica/2.6.20.17-rc1/console.log > > > http://www.stardust.webpages.pl/files/tbf/bitis-gabonica/2.6.20.17-rc1/stable-config > > > > Please set > > CONFIG_SECURITY_SELINUX_ENABLE_SECMARK_DEFAULT=n > > > > You don't have complete policy for the new network controls, which are not > > enabled by default and not integreated fully into distros yet. > > Still, that denial shouldn't be against kernel_t unless he has iptables > SECMARK rules that assign that value. > > It's the change to the skb allocator - no longer clears up through > truesize and thus secmark is garbage initially. That would apply to > mainline too. Oops, never mind - tail still follows secmark, so that shouldn't matter. So I'm not sure why we are getting a bad value for secmark here - should be initialized to zero and never modified unless there is an iptables secmark rule. -- Stephen Smalley National Security Agency - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/