[PATCH] SMACK netfilter smacklabel socket match

etienne
2009-02-17T20:01:27Z

hello,

i was playing with smack, trying to do funny things
Alas, when I use a 'labelled process' and try to access internet, packet are dropped sooner or later (because of ip options)

I tried to
echo 0.0.0.0/0 @ > /smack/netlabel
with no success...

looking at security/smack/smack_lsm.c:smack_host_label
the following lines

bestmask.s_addr = 0;
...
if ((miap->s_addr | bestmask.s_addr) == bestmask.s_addr)
continue;

if the dest we try to reach match the 0.0.0.0/0, this condition will be true (either because we have a better match or because, well (miap->s_addr | bestmask.s_addr) == bestmask.s_addr == 0

So let the 0.0.0.0/0 a chance!

I realize this patch is a little ugly, a cleaner way would be to insert struct smk_netlbladdr sorted from longest to smallest mask and break the loop as soon as we have a match...
regards,
Etienne

Signed-off-by: Etienne <etienne.basset@numericable.fr>
------
diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c
index 0278bc0..9d2576d 100644
--- a/security/smack/smack_lsm.c
+++ b/security/smack/smack_lsm.c
@@ -1540,7 +1540,7 @@ static char *smack_host_label(struct sockaddr_in *sip)
* If the list entry mask is less specific than the best
* already found this entry is uninteresting.
*/
- if ((miap->s_addr | bestmask.s_addr) == bestmask.s_addr)
+ if ( ((miap->s_addr | bestmask.s_addr) == bestmask.s_addr) && (miap->s_addr | bestmask.s_addr) != 0 )
continue;
/*
* This is better than any entry found so far.