Messages in this thread | | | Subject | Re: [PATCH 2/3] Security: Implement disablenetwork semantics. (v4) | From | Tetsuo Handa <> | Date | Sun, 27 Dec 2009 10:20:10 +0900 |
| |
Michael Stone wrote: > +int disablenetwork_security_socket_sendmsg(struct socket * sock, > + struct msghdr * msg, int size) > +{ > + if (sock->sk->sk_family != PF_UNIX && > + current->network && > + (msg->msg_name != NULL || msg->msg_namelen != 0)) > + return -EPERM; > + return 0; > +}
I think we should accept msg->msg_name != NULL || msg->msg_namelen != 0 if the socket is connection oriented protocols (e.g. TCP).
struct sockaddr_in addr = { ... }; int fd = socket(PF_INET, SOCK_STREAM, 0); connect(fd, (struct sockadr *) &addr, sizeof(addr)); prctl( ... ); sendmsg(fd, (struct sockadr *) &addr, sizeof(addr));
| |