xiaomi-sm8450/android_kernel_xiaomi_sm8450
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

SELinux: Return correct context for SO_PEERSEC

Browse Source 
Fix SO_PEERSEC for tcp sockets to return the security context of
the peer (as represented by the SA from the peer) as opposed to the
SA used by the local/source socket.

Signed-off-by: Venkat Yekkirala <vyekkirala@TrustedCS.com>
Signed-off-by: James Morris <jmorris@namei.org>
This commit is contained in:
Venkat Yekkirala
2006-11-08 17:04:09 -06:00
committed by David S. Miller
parent c1a856c964
commit 6b877699c6
7 changed files with 50 additions and 48 deletions
Download Patch File Download Diff File Expand all files Collapse all files

40
security/selinux/xfrm.c
View File

@@ -184,7 +184,8 @@ int selinux_xfrm_flow_state_match(struct flowi *fl, struct xfrm_state *xfrm,
}
/*
* LSM hook implementation that determines the sid for the session.
* LSM hook implementation that checks and/or returns the xfrm sid for the
* incoming packet.
*/
int selinux_xfrm_decode_session(struct sk_buff *skb, u32 *sid, int ckall)
@@ -402,44 +403,9 @@ void selinux_xfrm_state_free(struct xfrm_state *x)
kfree(ctx);
}
/*
* SELinux internal function to retrieve the context of a connected
* (sk->sk_state == TCP_ESTABLISHED) TCP socket based on its security
* association used to connect to the remote socket.
*
* Retrieve via getsockopt SO_PEERSEC.
*/
u32 selinux_socket_getpeer_stream(struct sock *sk)
{
struct dst_entry *dst, *dst_test;
u32 peer_sid = SECSID_NULL;
if (sk->sk_state != TCP_ESTABLISHED)
goto out;
dst = sk_dst_get(sk);
if (!dst)
goto out;
for (dst_test = dst; dst_test != 0;
dst_test = dst_test->child) {
struct xfrm_state *x = dst_test->xfrm;
if (x && selinux_authorizable_xfrm(x)) {
struct xfrm_sec_ctx *ctx = x->security;
peer_sid = ctx->ctx_sid;
break;
}
}
dst_release(dst);
out:
return peer_sid;
}
/*
* SELinux internal function to retrieve the context of a UDP packet
* based on its security association used to connect to the remote socket.
* based on its security association.
*
* Retrieve via setsockopt IP_PASSSEC and recvmsg with control message
* type SCM_SECURITY.