[lkml]   [2008]   [May]   [30]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
Patch in this message
Subject[PATCH BUGFIX -rc4] Smack: Respect 'unlabeled' netlabel mode
Hi all,

In case of Smack 'unlabeled' netlabel option, Smack passes a _zero_
initialized 'secattr' to label a packet/sock. This causes an
[unfound domain label error]/-ENOENT by netlbl_sock_setattr().
Above Netlabel failure leads to Smack socket hooks failure causing
an always-on socket() -EPERM error.

Such packets should have a netlabel domain agreed with netlabel to
represent unlabeled packets. Fortunately Smack net ambient label
packets are agreed with netlabel to be treated as unlabeled packets.

Treat all packets coming out from a 'unlabeled' Smack system as
coming from the smack net ambient label.

Signed-off-by: Ahmed S. Darwish <>

diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c
index b5c8f92..03735f4 100644
--- a/security/smack/smack_lsm.c
+++ b/security/smack/smack_lsm.c
@@ -1292,6 +1292,8 @@ static void smack_to_secattr(char *smack, struct netlbl_lsm_secattr *nlsp)
+ nlsp->domain = kstrdup(smack_net_ambient, GFP_ATOMIC);
+ nlsp->flags = NETLBL_SECATTR_DOMAIN;

"Better to light a candle, than curse the darkness"

Ahmed S. Darwish

 \ /
  Last update: 2008-05-31 00:43    [W:0.061 / U:2.128 seconds]
©2003-2018 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site