[lkml]   [2009]   [Feb]   [17]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
Patch in this message
Subject[PATCH] SMACK netfilter smacklabel socket match

i was playing with smack, trying to do funny things
Alas, when I use a 'labelled process' and try to access internet, packet are dropped sooner or later (because of ip options)

I tried to
echo @ > /smack/netlabel
with no success...

looking at security/smack/smack_lsm.c:smack_host_label
the following lines

bestmask.s_addr = 0;
if ((miap->s_addr | bestmask.s_addr) == bestmask.s_addr)

if the dest we try to reach match the, this condition will be true (either because we have a better match or because, well (miap->s_addr | bestmask.s_addr) == bestmask.s_addr == 0

So let the a chance!

I realize this patch is a little ugly, a cleaner way would be to insert struct smk_netlbladdr sorted from longest to smallest mask and break the loop as soon as we have a match...

Signed-off-by: Etienne <>
diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c
index 0278bc0..9d2576d 100644
--- a/security/smack/smack_lsm.c
+++ b/security/smack/smack_lsm.c
@@ -1540,7 +1540,7 @@ static char *smack_host_label(struct sockaddr_in *sip)
* If the list entry mask is less specific than the best
* already found this entry is uninteresting.
- if ((miap->s_addr | bestmask.s_addr) == bestmask.s_addr)
+ if ( ((miap->s_addr | bestmask.s_addr) == bestmask.s_addr) && (miap->s_addr | bestmask.s_addr) != 0 )
* This is better than any entry found so far.

 \ /
  Last update: 2009-02-18 12:23    [W:0.078 / U:6.108 seconds]
©2003-2018 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site