From patchwork Fri May 4 14:28:21 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: David Herrmann X-Patchwork-Id: 908788 X-Patchwork-Delegate: davem@davemloft.net Return-Path: X-Original-To: patchwork-incoming-netdev@ozlabs.org Delivered-To: patchwork-incoming-netdev@ozlabs.org Authentication-Results: ozlabs.org; spf=none (mailfrom) smtp.mailfrom=vger.kernel.org (client-ip=209.132.180.67; helo=vger.kernel.org; envelope-from=netdev-owner@vger.kernel.org; receiver=) Authentication-Results: ozlabs.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: ozlabs.org; dkim=pass (2048-bit key; unprotected) header.d=gmail.com header.i=@gmail.com header.b="ngqrTpJz"; dkim-atps=neutral Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 40cvZy1NVjz9s1d for ; Sat, 5 May 2018 00:31:22 +1000 (AEST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751554AbeEDObI (ORCPT ); Fri, 4 May 2018 10:31:08 -0400 Received: from mail-wr0-f196.google.com ([209.85.128.196]:38687 "EHLO mail-wr0-f196.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751654AbeEDO3p (ORCPT ); Fri, 4 May 2018 10:29:45 -0400 Received: by mail-wr0-f196.google.com with SMTP id 94-v6so19991994wrf.5; Fri, 04 May 2018 07:29:44 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=CyFjPGpYpKX9A3IoTWn4xrYYFdzZEbZHORcOnNY4DZw=; b=ngqrTpJzoXn1pS/LZwDOYzvXuzxk3oWBKbG3H8IfJ5H2IXW4fHVKev3e8ncd0Lb8Z/ rBLUFw+RcR1ckVXyguGAjsYgh2p9ffv607OsdjMjJHlPwNfuUVeMCKvikpd9NOp9s+H5 o4Ukg1T0iIT0Oq6NkMVf8js3eciBhwwMqfPxNXS1NXU0PziWWmvR+0r9jOeomWisakrI uMpgE0IF+MD2HGHOiK3JjKIB4IbNzqkRzoccQGxRgKs2Vt0J7D9r3pH6uLomlun8UTID Z6qQTrn2lDo+LzCjXHZyfuocm8KLI1TypKxQfgr2S96rLZ2sMJD7q4EW2YtCwe/rtTUV 7Vaw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references; bh=CyFjPGpYpKX9A3IoTWn4xrYYFdzZEbZHORcOnNY4DZw=; b=BQK+Qp5Z3uDGy8eyUPVEHgZ6mlXs+U0tJUsuCW0Lfh4Nzp7sLMXx5uSseYhoS/o9p0 qnuWtcrc/2DUKzf8gFgiyJwbJvkwHqP4jefWGx2V8Sw2zsrnXDixhrTuXb02UlpnM6gY Hv/hxw71fj74x+tRXk2zRlUB4DiNtRIjyhLFzuuC5A0yGxNZXmyIHtJ5ADizk+usmt4A 3Dm7I0nz89OK0CfSJwU3z3AP59gejjWu7FjiLIbnjKmBDnPGqoOit4Wj9n3v9VX+JqQr dkzN6Ga+ZIyA4NYhaFTIhAHhqc/RPKe/E1n0glL8wWYK9NZd3b77Nk9q9UXkkm0vG0py 0fZg== X-Gm-Message-State: ALQs6tA9oGyKYdIgk4WGj+OuBvhDWseMQNuIiFyvP2xYTVCK+Pm556+r WEPBlvBgaxuHAP1NR3jS4lfr2g== X-Google-Smtp-Source: AB8JxZq3D00P3eUDIwlZI0xLA1vGYM5x7KihME3mQJuNiwHsRCU2kxsMEPS9dlRZ1VcnfZCVhL0epA== X-Received: by 2002:adf:e287:: with SMTP id v7-v6mr5045662wri.54.1525444183281; Fri, 04 May 2018 07:29:43 -0700 (PDT) Received: from david-x1.fritz.box (p200300C2A3D634001758913C97055056.dip0.t-ipconnect.de. [2003:c2:a3d6:3400:1758:913c:9705:5056]) by smtp.gmail.com with ESMTPSA id h8-v6sm1474907wmc.16.2018.05.04.07.29.42 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Fri, 04 May 2018 07:29:42 -0700 (PDT) From: David Herrmann To: linux-kernel@vger.kernel.org Cc: James Morris , Paul Moore , teg@jklm.no, Stephen Smalley , selinux@tycho.nsa.gov, linux-security-module@vger.kernel.org, Eric Paris , serge@hallyn.com, Casey Schaufler , davem@davemloft.net, netdev@vger.kernel.org, David Herrmann Subject: [PATCH v2 3/4] selinux: provide socketpair callback Date: Fri, 4 May 2018 16:28:21 +0200 Message-Id: <20180504142822.15233-4-dh.herrmann@gmail.com> X-Mailer: git-send-email 2.17.0 In-Reply-To: <20180504142822.15233-1-dh.herrmann@gmail.com> References: <20180504142822.15233-1-dh.herrmann@gmail.com> Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org Make sure to implement the new socketpair callback so the SO_PEERSEC call on socketpair(2)s will return correct information. Acked-by: Serge Hallyn Acked-by: Stephen Smalley Signed-off-by: Tom Gundersen Signed-off-by: David Herrmann --- security/selinux/hooks.c | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c index 4cafe6a19167..02ebd1585eaf 100644 --- a/security/selinux/hooks.c +++ b/security/selinux/hooks.c @@ -4569,6 +4569,18 @@ static int selinux_socket_post_create(struct socket *sock, int family, return err; } +static int selinux_socket_socketpair(struct socket *socka, + struct socket *sockb) +{ + struct sk_security_struct *sksec_a = socka->sk->sk_security; + struct sk_security_struct *sksec_b = sockb->sk->sk_security; + + sksec_a->peer_sid = sksec_b->sid; + sksec_b->peer_sid = sksec_a->sid; + + return 0; +} + /* Range of port numbers used to automatically bind. Need to determine whether we should perform a name_bind permission check between the socket and the port number. */ @@ -6999,6 +7011,7 @@ static struct security_hook_list selinux_hooks[] __lsm_ro_after_init = { LSM_HOOK_INIT(socket_create, selinux_socket_create), LSM_HOOK_INIT(socket_post_create, selinux_socket_post_create), + LSM_HOOK_INIT(socket_socketpair, selinux_socket_socketpair), LSM_HOOK_INIT(socket_bind, selinux_socket_bind), LSM_HOOK_INIT(socket_connect, selinux_socket_connect), LSM_HOOK_INIT(socket_listen, selinux_socket_listen),