* [MLSXFRM] Fix mis-labelling of child sockets
@ 2006-09-29 21:18 David Woodhouse
2006-09-29 21:38 ` James Morris
0 siblings, 1 reply; 3+ messages in thread
From: David Woodhouse @ 2006-09-29 21:18 UTC (permalink / raw)
To: torvalds, akpm
Cc: netdev, Stephen Smalley, Paul Moore, James Morris,
Venkat Yekkirala, Eric Paris
Accepted connections of types other than AF_INET, AF_INET6, AF_UNIX
won't have an appropriate label derived from the peer, so don't use it.
Signed-off-by: David Woodhouse <dwmw2@infradead.org>
Acked-by: Stephen Smalley <sds@tycho.nsa.gov>
--- linux-2.6.18.ppc/security/selinux/hooks.c~ 2006-09-28 14:37:20.000000000 +0100
+++ linux-2.6.18.ppc/security/selinux/hooks.c 2006-09-29 19:00:25.000000000 +0100
@@ -3604,7 +3604,9 @@ void selinux_sock_graft(struct sock* sk,
struct inode_security_struct *isec = SOCK_INODE(parent)->i_security;
struct sk_security_struct *sksec = sk->sk_security;
- isec->sid = sksec->sid;
+ if (sk->sk_family == PF_INET || sk->sk_family == PF_INET6 ||
+ sk->sk_family == PF_UNIX)
+ isec->sid = sksec->sid;
selinux_netlbl_sock_graft(sk, parent);
}
--
dwmw2
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [MLSXFRM] Fix mis-labelling of child sockets
2006-09-29 21:18 [MLSXFRM] Fix mis-labelling of child sockets David Woodhouse
@ 2006-09-29 21:38 ` James Morris
2006-09-29 22:29 ` Paul Moore
0 siblings, 1 reply; 3+ messages in thread
From: James Morris @ 2006-09-29 21:38 UTC (permalink / raw)
To: David Woodhouse
Cc: torvalds, akpm, netdev, Stephen Smalley, Paul Moore, James Morris,
Venkat Yekkirala, Eric Paris
On Fri, 29 Sep 2006, David Woodhouse wrote:
> Accepted connections of types other than AF_INET, AF_INET6, AF_UNIX
> won't have an appropriate label derived from the peer, so don't use it.
>
> Signed-off-by: David Woodhouse <dwmw2@infradead.org>
> Acked-by: Stephen Smalley <sds@tycho.nsa.gov>
Acked-by: James Morris <jmorris@namei.org>
Please apply as a bugfix.
--
James Morris
<jmorris@namei.org>
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [MLSXFRM] Fix mis-labelling of child sockets
2006-09-29 21:38 ` James Morris
@ 2006-09-29 22:29 ` Paul Moore
0 siblings, 0 replies; 3+ messages in thread
From: Paul Moore @ 2006-09-29 22:29 UTC (permalink / raw)
To: David Woodhouse
Cc: James Morris, torvalds, akpm, netdev, Stephen Smalley,
James Morris, Venkat Yekkirala, Eric Paris
James Morris wrote:
> On Fri, 29 Sep 2006, David Woodhouse wrote:
>
>
>>Accepted connections of types other than AF_INET, AF_INET6, AF_UNIX
>>won't have an appropriate label derived from the peer, so don't use it.
>>
>>Signed-off-by: David Woodhouse <dwmw2@infradead.org>
>>Acked-by: Stephen Smalley <sds@tycho.nsa.gov>
>
>
> Acked-by: James Morris <jmorris@namei.org>
>
>
> Please apply as a bugfix.
>
Sorry for the late response.
Acked-by: Paul Moore <paul.moore@hp.com>
--
paul moore
linux security @ hp
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2006-09-29 22:29 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2006-09-29 21:18 [MLSXFRM] Fix mis-labelling of child sockets David Woodhouse
2006-09-29 21:38 ` James Morris
2006-09-29 22:29 ` Paul Moore
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).