tree d97bcaf9544e58a8a6bc6aeb40ca9793411d3e79
parent 586c25003707067f074043d80fb2071671c58db0
author Paul Moore <paul.moore@hp.com> 1235165582 -0500
committer James Morris <jmorris@namei.org> 1235343955 +1100

selinux: Fix the NetLabel glue code for setsockopt()

At some point we (okay, I) managed to break the ability for users to use the
setsockopt() syscall to set IPv4 options when NetLabel was not active on the
socket in question.  The problem was noticed by someone trying to use the
"-R" (record route) option of ping:

 # ping -R 10.0.0.1
 ping: record route: No message of desired type

The solution is relatively simple, we catch the unlabeled socket case and
clear the error code, allowing the operation to succeed.  Please note that we
still deny users the ability to override IPv4 options on socket's which have
NetLabel labeling active; this is done to ensure the labeling remains intact.

Signed-off-by: Paul Moore <paul.moore@hp.com>
Signed-off-by: James Morris <jmorris@namei.org>