lkml.org 
[lkml]   [2009]   [Feb]   [17]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
Date
From
Subject[PATCH] SMACK netfilter smacklabel socket match
hello,


i was playing with smack, trying to do funny things
Alas, when I use a 'labelled process' and try to access internet, packet are dropped sooner or later (because of ip options)

I tried to
echo 0.0.0.0/0 @ > /smack/netlabel
with no success...


looking at security/smack/smack_lsm.c:smack_host_label
the following lines

bestmask.s_addr = 0;
...
if ((miap->s_addr | bestmask.s_addr) == bestmask.s_addr)
continue;

if the dest we try to reach match the 0.0.0.0/0, this condition will be true (either because we have a better match or because, well (miap->s_addr | bestmask.s_addr) == bestmask.s_addr == 0

So let the 0.0.0.0/0 a chance!

I realize this patch is a little ugly, a cleaner way would be to insert struct smk_netlbladdr sorted from longest to smallest mask and break the loop as soon as we have a match...
regards,
Etienne



Signed-off-by: Etienne <etienne.basset@numericable.fr>
------
diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c
index 0278bc0..9d2576d 100644
--- a/security/smack/smack_lsm.c
+++ b/security/smack/smack_lsm.c
@@ -1540,7 +1540,7 @@ static char *smack_host_label(struct sockaddr_in *sip)
* If the list entry mask is less specific than the best
* already found this entry is uninteresting.
*/
- if ((miap->s_addr | bestmask.s_addr) == bestmask.s_addr)
+ if ( ((miap->s_addr | bestmask.s_addr) == bestmask.s_addr) && (miap->s_addr | bestmask.s_addr) != 0 )
continue;
/*
* This is better than any entry found so far.

\
 
 \ /
  Last update: 2009-02-18 12:23    [W:0.210 / U:1.428 seconds]
©2003-2017 Jasper Spaans. hosted at Digital OceanAdvertise on this site