* [PATCH] Revert "selinux: fix the default socket labeling in sock_graft()"
@ 2014-07-28 15:09 Paul Moore
2014-07-29 18:41 ` Milan Broz
0 siblings, 1 reply; 6+ messages in thread
From: Paul Moore @ 2014-07-28 15:09 UTC (permalink / raw)
To: selinux
This reverts commit 4da6daf4d3df5a977e4623963f141a627fd2efce.
Unfortunately, the commit in question caused problems with Bluetooth
devices, specifically it caused them to get caught in the newly
created BUG_ON() check. The AF_ALG problem still exists, but will be
addressed in a future patch.
Cc: stable@vger.kernel.org
Signed-off-by: Paul Moore <pmoore@redhat.com>
---
include/linux/security.h | 5 +----
security/selinux/hooks.c | 13 ++-----------
2 files changed, 3 insertions(+), 15 deletions(-)
diff --git a/include/linux/security.h b/include/linux/security.h
index 794be73..6478ce3 100644
--- a/include/linux/security.h
+++ b/include/linux/security.h
@@ -987,10 +987,7 @@ static inline void security_free_mnt_opts(struct security_mnt_opts *opts)
* Retrieve the LSM-specific secid for the sock to enable caching of network
* authorizations.
* @sock_graft:
- * This hook is called in response to a newly created sock struct being
- * grafted onto an existing socket and allows the security module to
- * perform whatever security attribute management is necessary for both
- * the sock and socket.
+ * Sets the socket's isec sid to the sock's sid.
* @inet_conn_request:
* Sets the openreq's sid to socket's sid with MLS portion taken from peer sid.
* @inet_csk_clone:
diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index b3a6754..336f0a0 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -4499,18 +4499,9 @@ static void selinux_sock_graft(struct sock *sk, struct socket *parent)
struct inode_security_struct *isec = SOCK_INODE(parent)->i_security;
struct sk_security_struct *sksec = sk->sk_security;
- switch (sk->sk_family) {
- case PF_INET:
- case PF_INET6:
- case PF_UNIX:
+ if (sk->sk_family == PF_INET || sk->sk_family == PF_INET6 ||
+ sk->sk_family == PF_UNIX)
isec->sid = sksec->sid;
- break;
- default:
- /* by default there is no special labeling mechanism for the
- * sksec label so inherit the label from the parent socket */
- BUG_ON(sksec->sid != SECINITSID_UNLABELED);
- sksec->sid = isec->sid;
- }
sksec->sclass = isec->sclass;
}
^ permalink raw reply related [flat|nested] 6+ messages in thread* [PATCH] crypto: properly label AF_ALG socket
2014-07-28 15:09 [PATCH] Revert "selinux: fix the default socket labeling in sock_graft()" Paul Moore
@ 2014-07-29 18:41 ` Milan Broz
0 siblings, 0 replies; 6+ messages in thread
From: Milan Broz @ 2014-07-29 18:41 UTC (permalink / raw)
To: linux-crypto; +Cc: selinux, pmoore, Milan Broz, stable
Th AF_ALG socket was missing a security label (e.g. SELinux)
which means that socket was in "unlabeled" state.
This was recently demonstrated in the cryptsetup package
(cryptsetup v1.6.5 and later.)
See https://bugzilla.redhat.com/show_bug.cgi?id=1115120
This patch clones the sock's label from the parent sock
and resolves the issue (similar to AF_BLUETOOTH protocol family).
Cc: stable@vger.kernel.org
Signed-off-by: Milan Broz <gmazyland@gmail.com>
---
crypto/af_alg.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/crypto/af_alg.c b/crypto/af_alg.c
index 966f893..6a3ad80 100644
--- a/crypto/af_alg.c
+++ b/crypto/af_alg.c
@@ -21,6 +21,7 @@
#include <linux/module.h>
#include <linux/net.h>
#include <linux/rwsem.h>
+#include <linux/security.h>
struct alg_type_list {
const struct af_alg_type *type;
@@ -243,6 +244,7 @@ int af_alg_accept(struct sock *sk, struct socket *newsock)
sock_init_data(newsock, sk2);
sock_graft(sk2, newsock);
+ security_sk_clone(sk, sk2);
err = type->accept(ask->private, sk2);
if (err) {
--
2.0.1
^ permalink raw reply related [flat|nested] 6+ messages in thread* [PATCH] crypto: properly label AF_ALG socket
@ 2014-07-29 18:41 ` Milan Broz
0 siblings, 0 replies; 6+ messages in thread
From: Milan Broz @ 2014-07-29 18:41 UTC (permalink / raw)
To: linux-crypto; +Cc: stable, Milan Broz, selinux
Th AF_ALG socket was missing a security label (e.g. SELinux)
which means that socket was in "unlabeled" state.
This was recently demonstrated in the cryptsetup package
(cryptsetup v1.6.5 and later.)
See https://bugzilla.redhat.com/show_bug.cgi?id=1115120
This patch clones the sock's label from the parent sock
and resolves the issue (similar to AF_BLUETOOTH protocol family).
Cc: stable@vger.kernel.org
Signed-off-by: Milan Broz <gmazyland@gmail.com>
---
crypto/af_alg.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/crypto/af_alg.c b/crypto/af_alg.c
index 966f893..6a3ad80 100644
--- a/crypto/af_alg.c
+++ b/crypto/af_alg.c
@@ -21,6 +21,7 @@
#include <linux/module.h>
#include <linux/net.h>
#include <linux/rwsem.h>
+#include <linux/security.h>
struct alg_type_list {
const struct af_alg_type *type;
@@ -243,6 +244,7 @@ int af_alg_accept(struct sock *sk, struct socket *newsock)
sock_init_data(newsock, sk2);
sock_graft(sk2, newsock);
+ security_sk_clone(sk, sk2);
err = type->accept(ask->private, sk2);
if (err) {
--
2.0.1
^ permalink raw reply related [flat|nested] 6+ messages in thread* Re: [PATCH] crypto: properly label AF_ALG socket
2014-07-29 18:41 ` Milan Broz
(?)
@ 2014-07-30 15:01 ` Paul Moore
-1 siblings, 0 replies; 6+ messages in thread
From: Paul Moore @ 2014-07-30 15:01 UTC (permalink / raw)
To: Milan Broz, linux-crypto, Herbert Xu; +Cc: selinux
On Tuesday, July 29, 2014 08:41:09 PM Milan Broz wrote:
> Th AF_ALG socket was missing a security label (e.g. SELinux)
> which means that socket was in "unlabeled" state.
>
> This was recently demonstrated in the cryptsetup package
> (cryptsetup v1.6.5 and later.)
> See https://bugzilla.redhat.com/show_bug.cgi?id=1115120
>
> This patch clones the sock's label from the parent sock
> and resolves the issue (similar to AF_BLUETOOTH protocol family).
>
> Cc: stable@vger.kernel.org
> Signed-off-by: Milan Broz <gmazyland@gmail.com>
> ---
> crypto/af_alg.c | 2 ++
> 1 file changed, 2 insertions(+)
Thanks Milan, this patch looks good to me. Crypto folks, assuming no
objections, could you try to push this patch this week so it hits 3.16 proper
(assuming no more -rc releases)? Without this patch the latest versions of
cryptsetup could fail on a SELinux system leaving the system unable to boot
with SELinux in enforcing mode.
Acked-by: Paul Moore <paul@paul-moore.com>
> diff --git a/crypto/af_alg.c b/crypto/af_alg.c
> index 966f893..6a3ad80 100644
> --- a/crypto/af_alg.c
> +++ b/crypto/af_alg.c
> @@ -21,6 +21,7 @@
> #include <linux/module.h>
> #include <linux/net.h>
> #include <linux/rwsem.h>
> +#include <linux/security.h>
>
> struct alg_type_list {
> const struct af_alg_type *type;
> @@ -243,6 +244,7 @@ int af_alg_accept(struct sock *sk, struct socket
> *newsock)
>
> sock_init_data(newsock, sk2);
> sock_graft(sk2, newsock);
> + security_sk_clone(sk, sk2);
>
> err = type->accept(ask->private, sk2);
> if (err) {
--
paul moore
www.paul-moore.com
^ permalink raw reply [flat|nested] 6+ messages in thread* Re: [PATCH] crypto: properly label AF_ALG socket
2014-07-29 18:41 ` Milan Broz
@ 2014-07-31 13:55 ` Herbert Xu
-1 siblings, 0 replies; 6+ messages in thread
From: Herbert Xu @ 2014-07-31 13:55 UTC (permalink / raw)
To: Milan Broz; +Cc: linux-crypto, selinux, pmoore, stable
On Tue, Jul 29, 2014 at 06:41:09PM +0000, Milan Broz wrote:
> Th AF_ALG socket was missing a security label (e.g. SELinux)
> which means that socket was in "unlabeled" state.
>
> This was recently demonstrated in the cryptsetup package
> (cryptsetup v1.6.5 and later.)
> See https://bugzilla.redhat.com/show_bug.cgi?id=1115120
>
> This patch clones the sock's label from the parent sock
> and resolves the issue (similar to AF_BLUETOOTH protocol family).
>
> Cc: stable@vger.kernel.org
> Signed-off-by: Milan Broz <gmazyland@gmail.com>
Applied to crypto. Thanks.
--
Email: Herbert Xu <herbert@gondor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2014-07-31 13:56 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2014-07-28 15:09 [PATCH] Revert "selinux: fix the default socket labeling in sock_graft()" Paul Moore
2014-07-29 18:41 ` [PATCH] crypto: properly label AF_ALG socket Milan Broz
2014-07-29 18:41 ` Milan Broz
2014-07-30 15:01 ` Paul Moore
2014-07-31 13:55 ` Herbert Xu
2014-07-31 13:55 ` Herbert Xu
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.