LKML Archive on lore.kernel.org
help / color / mirror / Atom feed
* [PATCH BUGFIX -rc4] Smack: Respect 'unlabeled' netlabel mode
@ 2008-05-30 23:36 Ahmed S. Darwish
  2008-05-30 23:10 ` Casey Schaufler
  2008-05-30 23:57 ` [PATCH BUGFIX -v2 " Ahmed S. Darwish
  0 siblings, 2 replies; 10+ messages in thread
From: Ahmed S. Darwish @ 2008-05-30 23:36 UTC (permalink / raw)
  To: Casey Schaufler, Paul Moore
  Cc: linux-security-module, LKML, netdev, Andrew Morton

Hi all,

In case of Smack 'unlabeled' netlabel option, Smack passes a _zero_
initialized 'secattr' to label a packet/sock. This causes an 
[unfound domain label error]/-ENOENT by netlbl_sock_setattr().
Above Netlabel failure leads to Smack socket hooks failure causing 
an always-on socket() -EPERM error.

Such packets should have a netlabel domain agreed with netlabel to 
represent unlabeled packets. Fortunately Smack net ambient label 
packets are agreed with netlabel to be treated as unlabeled packets. 

Treat all packets coming out from a 'unlabeled' Smack system as
coming from the smack net ambient label.

Signed-off-by: Ahmed S. Darwish <darwish.07@gmail.com>
---

diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c
index b5c8f92..03735f4 100644
--- a/security/smack/smack_lsm.c
+++ b/security/smack/smack_lsm.c
@@ -1292,6 +1292,8 @@ static void smack_to_secattr(char *smack, struct netlbl_lsm_secattr *nlsp)
 		}
 		break;
 	default:
+		nlsp->domain = kstrdup(smack_net_ambient, GFP_ATOMIC);
+		nlsp->flags = NETLBL_SECATTR_DOMAIN;
 		break;
 	}
 }

-- 

"Better to light a candle, than curse the darkness"

Ahmed S. Darwish
Homepage: http://darwish.07.googlepages.com
Blog: http://darwish-07.blogspot.com


^ permalink raw reply	[flat|nested] 10+ messages in thread

end of thread, other threads:[~2008-05-31 13:09 UTC | newest]

Thread overview: 10+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2008-05-30 23:36 [PATCH BUGFIX -rc4] Smack: Respect 'unlabeled' netlabel mode Ahmed S. Darwish
2008-05-30 23:10 ` Casey Schaufler
2008-05-31  0:58   ` Ahmed S. Darwish
2008-05-31  0:37     ` Casey Schaufler
2008-05-31 13:08     ` Paul Moore
2008-05-30 23:57 ` [PATCH BUGFIX -v2 " Ahmed S. Darwish
2008-05-30 23:10   ` Tetsuo Handa
2008-05-30 23:25   ` Andrew Morton
2008-05-31  1:12     ` Ahmed S. Darwish
2008-05-30 23:45   ` Casey Schaufler

This is a public inbox, see mirroring instructions
on how to clone and mirror all data and code used for this inbox