lkml.org 
[lkml]   [2008]   [May]   [30]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    Date
    Subject[PATCH BUGFIX -rc4] Smack: Respect 'unlabeled' netlabel mode
    From
    Hi all,

    In case of Smack 'unlabeled' netlabel option, Smack passes a _zero_
    initialized 'secattr' to label a packet/sock. This causes an
    [unfound domain label error]/-ENOENT by netlbl_sock_setattr().
    Above Netlabel failure leads to Smack socket hooks failure causing
    an always-on socket() -EPERM error.

    Such packets should have a netlabel domain agreed with netlabel to
    represent unlabeled packets. Fortunately Smack net ambient label
    packets are agreed with netlabel to be treated as unlabeled packets.

    Treat all packets coming out from a 'unlabeled' Smack system as
    coming from the smack net ambient label.

    Signed-off-by: Ahmed S. Darwish <darwish.07@gmail.com>
    ---

    diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c
    index b5c8f92..03735f4 100644
    --- a/security/smack/smack_lsm.c
    +++ b/security/smack/smack_lsm.c
    @@ -1292,6 +1292,8 @@ static void smack_to_secattr(char *smack, struct netlbl_lsm_secattr *nlsp)
    }
    break;
    default:
    + nlsp->domain = kstrdup(smack_net_ambient, GFP_ATOMIC);
    + nlsp->flags = NETLBL_SECATTR_DOMAIN;
    break;
    }
    }
    --

    "Better to light a candle, than curse the darkness"

    Ahmed S. Darwish
    Homepage: http://darwish.07.googlepages.com
    Blog: http://darwish-07.blogspot.com



    \
     
     \ /
      Last update: 2008-05-31 00:43    [W:0.023 / U:125.164 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site