lkml.org 
[lkml]   [2014]   [Jan]   [13]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 3.11 087/208] selinux: fix broken peer recv check
    Date
    3.11.10.3 -stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Chad Hanson <chanson@trustedcs.com>

    commit 46d01d63221c3508421dd72ff9c879f61053cffc upstream.

    Fix a broken networking check. Return an error if peer recv fails. If
    secmark is active and the packet recv succeeds the peer recv error is
    ignored.

    Signed-off-by: Chad Hanson <chanson@trustedcs.com>
    Signed-off-by: Paul Moore <pmoore@redhat.com>
    Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
    ---
    security/selinux/hooks.c | 4 +++-
    1 file changed, 3 insertions(+), 1 deletion(-)

    diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
    index cba582c..122b956 100644
    --- a/security/selinux/hooks.c
    +++ b/security/selinux/hooks.c
    @@ -4303,8 +4303,10 @@ static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
    }
    err = avc_has_perm(sk_sid, peer_sid, SECCLASS_PEER,
    PEER__RECV, &ad);
    - if (err)
    + if (err) {
    selinux_netlbl_err(skb, err, 0);
    + return err;
    + }
    }

    if (secmark_active) {
    --
    1.8.3.2


    \
     
     \ /
      Last update: 2014-01-13 19:41    [W:4.313 / U:0.292 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site