[prev in list] [next in list] [prev in thread] [next in thread] 

List:       selinux
Subject:    Re: [PATCH v2] selinux: fix the default socket labeling in sock_graft()
From:       Paul Moore <pmoore () redhat ! com>
Date:       2014-07-16 2:22:48
Message-ID: 2249358.85v8CiTYWS () sifl
[Download RAW message or body]

On Tuesday, July 15, 2014 06:30:19 AM Milan Broz wrote:
> On 07/14/2014 03:36 PM, Paul Moore wrote:
> > The sock_graft() hook has special handling for AF_INET, AF_INET, and
> > AF_UNIX sockets as those address families have special hooks which
> > label the sock before it is attached its associated socket.
> > Unfortunately, the sock_graft() hook was missing a default approach
> > to labeling sockets which meant that any other address family which
> > made use of connections or the accept() syscall would find the
> > returned socket to be in an "unlabeled" state.  This was recently
> > demonstrated by the kcrypto/AF_ALG subsystem and the newly released
> > cryptsetup package (cryptsetup v1.6.5 and later).
> > 
> > This patch preserves the special handling in selinux_sock_graft(),
> > but adds a default behavior - setting the sock's label equal to the
> > associated socket - which resolves the problem with AF_ALG and
> > presumably any other address family which makes use of accept().
> > 
> > Cc: stable@vger.kernel.org
> > Signed-off-by: Paul Moore <pmoore@redhat.com>
> 
> I tested v2 patch for the cryptsetup use case (ALG_IF crypto subsystem)
> and it fixes the problem in enforcing mode.
> 
> So, if you wish, add
> Tested-by: Milan Broz <gmazyland@gmail.com>

Thanks for your help, since there have been no further comments I'll add your 
"Tested-by" and push this upstream.

-- 
paul moore
security and virtualization @ redhat

_______________________________________________
Selinux mailing list
Selinux@tycho.nsa.gov
To unsubscribe, send email to Selinux-leave@tycho.nsa.gov.
To get help, send an email containing "help" to Selinux-request@tycho.nsa.gov.
[prev in list] [next in list] [prev in thread] [next in thread]