• Paul Moore's avatar
    selinux: Fix the NetLabel glue code for setsockopt() · 09c50b4a
    Paul Moore authored
    At some point we (okay, I) managed to break the ability for users to use the
    setsockopt() syscall to set IPv4 options when NetLabel was not active on the
    socket in question.  The problem was noticed by someone trying to use the
    "-R" (record route) option of ping:
    
     # ping -R 10.0.0.1
     ping: record route: No message of desired type
    
    The solution is relatively simple, we catch the unlabeled socket case and
    clear the error code, allowing the operation to succeed.  Please note that we
    still deny users the ability to override IPv4 options on socket's which have
    NetLabel labeling active; this is done to ensure the labeling remains intact.
    Signed-off-by: default avatarPaul Moore <paul.moore@hp.com>
    Signed-off-by: default avatarJames Morris <jmorris@namei.org>
    09c50b4a
netlabel.c 14.3 KB