conntrack: export lsm context rather than internal secid via netlink
authorEric Paris <eparis@redhat.com>
Wed, 13 Oct 2010 20:24:54 +0000 (16:24 -0400)
committerJames Morris <jmorris@namei.org>
Wed, 20 Oct 2010 23:12:51 +0000 (10:12 +1100)
commit1cc63249adfa957b34ca51effdee90ff8261d63f
treee5cf71ae9a2c43ca13b1820551df2aebbbd0d757
parentd5630b9d276bd389299ffea620b7c340ab19bcf5
conntrack: export lsm context rather than internal secid via netlink

The conntrack code can export the internal secid to userspace.  These are
dynamic, can change on lsm changes, and have no meaning in userspace.  We
should instead be sending lsm contexts to userspace instead.  This patch sends
the secctx (rather than secid) to userspace over the netlink socket.  We use a
new field CTA_SECCTX and stop using the the old CTA_SECMARK field since it did
not send particularly useful information.

Signed-off-by: Eric Paris <eparis@redhat.com>
Reviewed-by: Paul Moore <paul.moore@hp.com>
Acked-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: James Morris <jmorris@namei.org>
include/linux/netfilter/nfnetlink_conntrack.h
net/netfilter/nf_conntrack_netlink.c