Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 5e9ab593 authored by Pankaj Kumar's avatar Pankaj Kumar Committed by Casey Schaufler
Browse files

bugfix patch for SMACK 



1. In order to remove any SMACK extended attribute from a file, a user
should have CAP_MAC_ADMIN capability. But user without having this
capability is able to remove SMACK64MMAP security attribute.

2. While validating size and value of smack extended attribute in
smack_inode_setsecurity hook, wrong error code is returned.

Signed-off-by: default avatarPankaj Kumar <pamkaj.k2@samsung.com>
Signed-off-by: default avatarHimanshu Shukla <himanshu.sh@samsung.com>
parent 66867818

security/smack/smack_lsm.c

+2 −2
Original line number Diff line number Diff line
@@ -1018,7 +1018,7 @@ static int smack_inode_removexattr(struct dentry *dentry, const char *name) 
	    strcmp(name, XATTR_NAME_SMACKIPOUT) == 0 ||

	    strcmp(name, XATTR_NAME_SMACKEXEC) == 0 ||

	    strcmp(name, XATTR_NAME_SMACKTRANSMUTE) == 0 ||

	    strcmp(name, XATTR_NAME_SMACKMMAP)) {

	    strcmp(name, XATTR_NAME_SMACKMMAP) == 0) {

		if (!smack_privileged(CAP_MAC_ADMIN))

			rc = -EPERM;

	} else
@@ -2156,7 +2156,7 @@ static int smack_inode_setsecurity(struct inode *inode, const char *name, 
	int rc = 0;



	if (value == NULL || size > SMK_LONGLABEL || size == 0)

		return -EACCES;

		return -EINVAL;



	skp = smk_import_entry(value, size);

	if (skp == NULL)