• David Herrmann's avatar
    security: add hook for socketpair() · aae7cfcb
    David Herrmann authored
    Right now the LSM labels for socketpairs are always uninitialized,
    since there is no security hook for the socketpair() syscall. This
    patch adds the required hooks so LSMs can properly label socketpairs.
    This allows SO_PEERSEC to return useful information on those sockets.
    
    Note that the behavior of socketpair() can be emulated by creating a
    listener socket, connecting to it, and then discarding the initial
    listener socket. With this workaround, SO_PEERSEC would return the
    caller's security context. However, with socketpair(), the uninitialized
    context is returned unconditionally. This is unexpected and makes
    socketpair() less useful in situations where the security context is
    crucial to the application.
    
    With the new socketpair-hook this disparity can be solved by making
    socketpair() return the expected security context.
    Acked-by: default avatarSerge Hallyn <serge@hallyn.com>
    Signed-off-by: default avatarTom Gundersen <teg@jklm.no>
    Signed-off-by: default avatarDavid Herrmann <dh.herrmann@gmail.com>
    Signed-off-by: default avatarJames Morris <james.morris@microsoft.com>
    aae7cfcb
security.c 44.7 KB