Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 99f59ed0 authored by Paul Moore's avatar Paul Moore Committed by David S. Miller
Browse files

[NetLabel]: Correctly initialize the NetLabel fields. 



Fix a problem where the NetLabel specific fields of the sk_security_struct
structure were not being initialized early enough in some cases.

Signed-off-by: default avatarPaul Moore <paul.moore@hp.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent fc747e82

security/selinux/hooks.c

+6 −0
Original line number Diff line number Diff line
@@ -281,6 +281,8 @@ static int sk_alloc_security(struct sock *sk, int family, gfp_t priority) 
	ssec->sid = SECINITSID_UNLABELED;

	sk->sk_security = ssec;



	selinux_netlbl_sk_security_init(ssec, family);



	return 0;

}
@@ -3585,6 +3587,8 @@ static void selinux_sk_clone_security(const struct sock *sk, struct sock *newsk) 


	newssec->sid = ssec->sid;

	newssec->peer_sid = ssec->peer_sid;



	selinux_netlbl_sk_clone_security(ssec, newssec);

}



static void selinux_sk_getsecid(struct sock *sk, u32 *secid)
@@ -3648,6 +3652,8 @@ static void selinux_inet_csk_clone(struct sock *newsk, 
	   new socket in sync, but we don't have the isec available yet.

	   So we will wait until sock_graft to do it, by which

	   time it will have been created and available. */



	selinux_netlbl_sk_security_init(newsksec, req->rsk_ops->family);

}



static void selinux_req_classify_flow(const struct request_sock *req,

security/selinux/include/selinux_netlabel.h

+18 −0
Original line number Diff line number Diff line
@@ -39,6 +39,10 @@ int selinux_netlbl_sock_rcv_skb(struct sk_security_struct *sksec, 
				struct avc_audit_data *ad);

u32 selinux_netlbl_socket_getpeersec_stream(struct socket *sock);

u32 selinux_netlbl_socket_getpeersec_dgram(struct sk_buff *skb);

void selinux_netlbl_sk_security_init(struct sk_security_struct *ssec,

				     int family);

void selinux_netlbl_sk_clone_security(struct sk_security_struct *ssec,

				      struct sk_security_struct *newssec);



int __selinux_netlbl_inode_permission(struct inode *inode, int mask);

/**
@@ -115,6 +119,20 @@ static inline u32 selinux_netlbl_socket_getpeersec_dgram(struct sk_buff *skb) 
	return SECSID_NULL;

}



static inline void selinux_netlbl_sk_security_init(

	                                       struct sk_security_struct *ssec,

					       int family)

{

	return;

}



static inline void selinux_netlbl_sk_clone_security(

	                                   struct sk_security_struct *ssec,

					   struct sk_security_struct *newssec)

{

	return;

}



static inline int selinux_netlbl_inode_permission(struct inode *inode,

						  int mask)

{

security/selinux/ss/services.c

+43 −2
Original line number Diff line number Diff line
@@ -2422,6 +2422,45 @@ static int selinux_netlbl_socket_setsid(struct socket *sock, u32 sid) 
	return rc;

}



/**

 * selinux_netlbl_sk_security_init - Setup the NetLabel fields

 * @ssec: the sk_security_struct

 * @family: the socket family

 *

 * Description:

 * Called when a new sk_security_struct is allocated to initialize the NetLabel

 * fields.

 *

 */

void selinux_netlbl_sk_security_init(struct sk_security_struct *ssec,

				     int family)

{

        if (family == PF_INET)

		ssec->nlbl_state = NLBL_REQUIRE;

	else

		ssec->nlbl_state = NLBL_UNSET;

}



/**

 * selinux_netlbl_sk_clone_security - Copy the NetLabel fields

 * @ssec: the original sk_security_struct

 * @newssec: the cloned sk_security_struct

 *

 * Description:

 * Clone the NetLabel specific sk_security_struct fields from @ssec to

 * @newssec.

 *

 */

void selinux_netlbl_sk_clone_security(struct sk_security_struct *ssec,

				      struct sk_security_struct *newssec)

{

	newssec->sclass = ssec->sclass;

	if (ssec->nlbl_state != NLBL_UNSET)

		newssec->nlbl_state = NLBL_REQUIRE;

	else

		newssec->nlbl_state = NLBL_UNSET;

}



/**

 * selinux_netlbl_socket_post_create - Label a socket using NetLabel

 * @sock: the socket to label
@@ -2440,10 +2479,11 @@ int selinux_netlbl_socket_post_create(struct socket *sock, 
	struct inode_security_struct *isec = SOCK_INODE(sock)->i_security;

	struct sk_security_struct *sksec = sock->sk->sk_security;



	sksec->sclass = isec->sclass;



	if (sock_family != PF_INET)

		return 0;



	sksec->sclass = isec->sclass;

	sksec->nlbl_state = NLBL_REQUIRE;

	return selinux_netlbl_socket_setsid(sock, sid);

}
@@ -2463,12 +2503,13 @@ void selinux_netlbl_sock_graft(struct sock *sk, struct socket *sock) 
	struct inode_security_struct *isec = SOCK_INODE(sock)->i_security;

	struct sk_security_struct *sksec = sk->sk_security;



	sksec->sclass = isec->sclass;



	if (sk->sk_family != PF_INET)

		return;



	sksec->nlbl_state = NLBL_REQUIRE;

	sksec->peer_sid = sksec->sid;

	sksec->sclass = isec->sclass;



	/* Try to set the NetLabel on the socket to save time later, if we fail

	 * here we will pick up the pieces in later calls to