Commit 2148ccc4 authored by David Woodhouse's avatar David Woodhouse Committed by Linus Torvalds

[PATCH] MLSXFRM: fix mis-labelling of child sockets

Accepted connections of types other than AF_INET, AF_INET6, AF_UNIX won't
have an appropriate label derived from the peer, so don't use it.
Signed-off-by: default avatarDavid Woodhouse <dwmw2@infradead.org>
Acked-by: default avatarStephen Smalley <sds@tycho.nsa.gov>
Acked-by: default avatarJames Morris <jmorris@namei.org>
Acked-by: default avatarPaul Moore <paul.moore@hp.com>
Signed-off-by: default avatarAndrew Morton <akpm@osdl.org>
Signed-off-by: default avatarLinus Torvalds <torvalds@osdl.org>
parent 9a69d1ae
...@@ -3619,7 +3619,9 @@ static void selinux_sock_graft(struct sock* sk, struct socket *parent) ...@@ -3619,7 +3619,9 @@ static void selinux_sock_graft(struct sock* sk, struct socket *parent)
struct inode_security_struct *isec = SOCK_INODE(parent)->i_security; struct inode_security_struct *isec = SOCK_INODE(parent)->i_security;
struct sk_security_struct *sksec = sk->sk_security; struct sk_security_struct *sksec = sk->sk_security;
isec->sid = sksec->sid; if (sk->sk_family == PF_INET || sk->sk_family == PF_INET6 ||
sk->sk_family == PF_UNIX)
isec->sid = sksec->sid;
selinux_netlbl_sock_graft(sk, parent); selinux_netlbl_sock_graft(sk, parent);
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment