Chris PeBenito 01723ac2ce libsepol: Add always_check_network policy capability ... Currently the packet class in SELinux is not checked if there are no SECMARK rules in the security or mangle netfilter tables. Similarly, the peer class is not checked if there is no NetLabel or labeled IPSEC. Some systems prefer that these classes are always checked, for example, to protect the system should the netfilter rules fail to load or if the nefilter rules were maliciously flushed. Add the always_check_network policy capability which, when enabled, treats these mechanisms as enabled, even if there are no labeling rules. Signed-off-by: Chris PeBenito <cpebenito@tresys.com> Signed-off-by: Eric Paris <eparis@redhat.com>		2012-09-12 14:30:24 -04:00
checkpolicy	checkpolicy: check return code on ebitmap_set_bit	2012-09-12 14:30:20 -04:00
libselinux	libselinux: booleans: initialize pointer to silence coveriety	2012-09-12 14:30:22 -04:00
libsemanage	libsemanage: do boolean name substitution	2012-09-12 13:17:30 -04:00
libsepol	libsepol: Add always_check_network policy capability	2012-09-12 14:30:24 -04:00
policycoreutils	policycoreutils: sandbox: Make sure Xephyr never listens on tcp ports	2012-09-12 14:30:22 -04:00
scripts	release script	2009-03-12 01:23:32 -04:00
sepolgen	sepolgen: Allow returning of bastard matches	2012-09-12 12:16:19 -04:00
.gitignore	.gitignore: More files to ignore	2011-09-16 11:54:04 -04:00
Makefile	libselinux: additional makefile support for rubywrap	2012-06-28 11:21:16 -04:00