• Casey Schaufler's avatar
    Smack: File receive for sockets · 79be0935
    Casey Schaufler authored
    The existing file receive hook checks for access on
    the file inode even for UDS. This is not right, as
    the inode is not used by Smack to make access checks
    for sockets. This change checks for an appropriate
    access relationship between the receiving (current)
    process and the socket. If the process can't write
    to the socket's send label or the socket's receive
    label can't write to the process fail.
    
    This will allow the legitimate cases, where the
    socket sender and socket receiver can freely communicate.
    Only strangly set socket labels should cause a problem.
    Signed-off-by: default avatarCasey Schaufler <casey@schaufler-ca.com>
    79be0935
smack_lsm.c 115 KB