Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux

selinux: Update SELinux SCTP documentation

Update SELinux-sctp.rst "SCTP Peer Labeling" section to reflect
how the association permission is validated.

Reported-by: Dominick Grift <dac.override@gmail.com>
Signed-off-by: Richard Haines <richard_c_haines@btinternet.com>
Signed-off-by: Paul Moore <paul@paul-moore.com>

authored by

Richard Haines and committed by
Paul Moore
d3cc2cd7 68741a8a

+6 -5
+6 -5
Documentation/security/SELinux-sctp.rst
··· 116 116 SCTP Peer Labeling 117 117 =================== 118 118 An SCTP socket will only have one peer label assigned to it. This will be 119 - assigned during the establishment of the first association. Once the peer 120 - label has been assigned, any new associations will have the ``association`` 121 - permission validated by checking the socket peer sid against the received 122 - packets peer sid to determine whether the association should be allowed or 123 - denied. 119 + assigned during the establishment of the first association. Any further 120 + associations on this socket will have their packet peer label compared to 121 + the sockets peer label, and only if they are different will the 122 + ``association`` permission be validated. This is validated by checking the 123 + socket peer sid against the received packets peer sid to determine whether 124 + the association should be allowed or denied. 124 125 125 126 NOTES: 126 127 1) If peer labeling is not enabled, then the peer context will always be