tree 23063e82de8f7b7506d795919d7d4c13725e74a0
parent 9a4c8546f3e7c893888bccc2b3416d6214f2664a
author Casey Schaufler <casey@schaufler-ca.com> 1203117865 -0800
committer Linus Torvalds <torvalds@woody.linux-foundation.org> 1203436260 -0800

Smack: unlabeled outgoing ambient packets

Smack uses CIPSO labeling, but allows for unlabeled packets by
specifying an "ambient" label that is applied to incoming unlabeled
packets.

Because the other end of the connection may dislike IP options, and ssh
is one know application that behaves thus, it is prudent to respond in
kind.

This patch changes the network labeling behavior such that an outgoing
packet that would be given a CIPSO label that matches the ambient label
is left unlabeled.  An "unlbl" domain is added and the netlabel
defaulting mechanism invoked rather than assuming that everything is
CIPSO.  Locking has been added around changes to the ambient label as
the mechanisms used to do so are more involved.

Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
Acked-by: Paul Moore <paul.moore@hp.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>