I just looked briefly at the FreeSWAN KLIPS code, and I think the problem is being caused by the call to sock_queue_rcv_skb by the PF_KEY socket code. So the patch to tcp_ipv4.c is probably unnecessary. Just try the patch to hooks.c and see if it works for you. In that case, skipping the network access control checks in selinux_sock_rcv_skb is ok, because it is a kernel-daemon communication.

--

Stephen D. Smalley, NAI Labs
ssmalley@nai.com

--

You have received this message because you are subscribed to the selinux list. If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with the words "unsubscribe selinux" without quotes as the message. Received on Fri 24 Aug 2001 - 12:45:19 EDT