| commit | 1f1aaf82825865a50cef0b4722607abb12aeee52 | [log] [tgz] |
|---|---|---|
| author | Eric Paris <eparis@redhat.com> | Tue Nov 16 11:52:57 2010 +0000 |
| committer | David S. Miller <davem@davemloft.net> | Wed Nov 17 10:54:35 2010 -0800 |
| tree | 9ab2495097fa2944404ab41bfb3038de374f5626 | |
| parent | ee58681195bf243bafc44ca53f3c24429d096cce [diff] |
SELinux: return -ECONNREFUSED from ip_postroute to signal fatal error The SELinux netfilter hooks just return NF_DROP if they drop a packet. We want to signal that a drop in this hook is a permanant fatal error and is not transient. If we do this the error will be passed back up the stack in some places and applications will get a faster interaction that something went wrong. Signed-off-by: Eric Paris <eparis@redhat.com> Signed-off-by: David S. Miller <davem@davemloft.net>