PERFORCE change 113430 for review

[Todd Miller]

http://perforce.freebsd.org/chv.cgi?CH=113430

Change 113430 by millert at millert_macbook on 2007/01/22 20:22:07

	Allow the kernel to send TCP packets that didn't
	originate from userland.

Affected files ...

.. //depot/projects/trustedbsd/sedarwin8/policies/sedarwin/refpolicy/policy/modules/kernel/corenetwork.if.in#4 edit
.. //depot/projects/trustedbsd/sedarwin8/policies/sedarwin/refpolicy/policy/modules/kernel/corenetwork.te.in#5 edit

Differences ...

==== //depot/projects/trustedbsd/sedarwin8/policies/sedarwin/refpolicy/policy/modules/kernel/corenetwork.if.in#4 (text+ko) ====

@@ -180,6 +180,24 @@
 
 ########################################
 ## <summary>
+##	Send TCP network traffic on all interfaces.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	The type of the process performing this action.
+##	</summary>
+## </param>
+#
+interface(`corenet_tcp_send_all_if',`
+	gen_require(`
+		attribute netif_type;
+	')
+
+	allow $1 netif_type:netif { tcp_send };
+')
+
+########################################
+## <summary>
 ##	Send and receive TCP network traffic on all interfaces.
 ## </summary>
 ## <param name="domain">

==== //depot/projects/trustedbsd/sedarwin8/policies/sedarwin/refpolicy/policy/modules/kernel/corenetwork.te.in#5 (text+ko) ====

@@ -188,8 +188,10 @@
 type netif_t, netif_type;
 sid netif gen_context(system_u:object_r:netif_t,s0 - mls_systemhigh)
 
-# Allow in-kernel transmission for ICMP replies and the like
+# Allow in-kernel transmission for ICMP replies and TCP connections
+# without a user socket associated with them.
 corenet_raw_send_all_if(netif_t)
+corenet_tcp_send_all_if(netif_t)
 
 build_option(`enable_mls',`
 network_interface(lo, lo,s0 - mls_systemhigh)