lk/linux-kernel-test
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

selinux: Set the peer label correctly on connected UNIX domain sockets

Browse Source 
Correct a problem where we weren't setting the peer label correctly on
the client end of a pair of connected UNIX sockets.

Signed-off-by: Paul Moore <paul.moore@hp.com>
Acked-by: Eric Paris <eparis@redhat.com>
Signed-off-by: James Morris <jmorris@namei.org>
This commit is contained in:
Paul Moore
2010-04-22 14:46:18 -04:00
committed by James Morris
parent e79acf0ef4
commit 4d1e24514d
1 changed files with 14 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files

30
security/selinux/hooks.c
View File

@@ -3980,34 +3980,32 @@ static int selinux_socket_unix_stream_connect(struct socket *sock,
struct socket *other, struct socket *other,
struct sock *newsk) struct sock *newsk)
{ {
struct sk_security_struct *sksec; struct sk_security_struct *sksec_sock = sock->sk->sk_security;
struct inode_security_struct *isec; struct sk_security_struct *sksec_other = other->sk->sk_security;
struct inode_security_struct *other_isec; struct sk_security_struct *sksec_new = newsk->sk_security;
struct common_audit_data ad; struct common_audit_data ad;
int err; int err;
isec = SOCK_INODE(sock)->i_security;
other_isec = SOCK_INODE(other)->i_security;
COMMON_AUDIT_DATA_INIT(&ad, NET); COMMON_AUDIT_DATA_INIT(&ad, NET);
ad.u.net.sk = other->sk; ad.u.net.sk = other->sk;
err = avc_has_perm(isec->sid, other_isec->sid, err = avc_has_perm(sksec_sock->sid, sksec_other->sid,
isec->sclass, sksec_other->sclass,
UNIX_STREAM_SOCKET__CONNECTTO, &ad); UNIX_STREAM_SOCKET__CONNECTTO, &ad);
if (err) if (err)
return err; return err;
/* connecting socket */
sksec = sock->sk->sk_security;
sksec->peer_sid = other_isec->sid;
/* server child socket */ /* server child socket */
sksec = newsk->sk_security; sksec_new->peer_sid = sksec_sock->sid;
sksec->peer_sid = isec->sid; err = security_sid_mls_copy(sksec_other->sid, sksec_sock->sid,
err = security_sid_mls_copy(other_isec->sid, sksec->peer_sid, &sksec->sid); &sksec_new->sid);
if (err)
return err;
return err; /* connecting socket */
sksec_sock->peer_sid = sksec_new->sid;
return 0;
} }
static int selinux_socket_unix_may_send(struct socket *sock, static int selinux_socket_unix_may_send(struct socket *sock,