Smack: File receive for sockets
authorCasey Schaufler <casey@schaufler-ca.com>
Mon, 7 Dec 2015 22:34:32 +0000 (14:34 -0800)
committerSooyoung Ha <yoosah.ha@samsung.com>
Tue, 23 Feb 2016 09:28:07 +0000 (18:28 +0900)
commit19fbfae69af474ccf8a123773d2ec0d819f0cdf2
tree138d312a896e4810f19d089fe7a3e8b05921aa4b
parent70a62da16e03919332d650e9f7e235773393af2a
Smack: File receive for sockets

The existing file receive hook checks for access on
the file inode even for UDS. This is not right, as
the inode is not used by Smack to make access checks
for sockets. This change checks for an appropriate
access relationship between the receiving (current)
process and the socket. If the process can't write
to the socket's send label or the socket's receive
label can't write to the process fail.

This will allow the legitimate cases, where the
socket sender and socket receiver can freely communicate.
Only strangly set socket labels should cause a problem.

Change-Id: Id37df53243264ac843f9c6693ba99aba9779f05e
Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
[backport to 3.10 from smack-next commit 79be093500791cc25cc31bcaec5a4db62e21497b]
Signed-off-by: Seung-Woo Kim <sw0312.kim@samsung.com>
(cherry picked from commit 4306b30a4c4c787144fb7ff71ffe44799c9386dd)
Signed-off-by: Sooyoung Ha <yoosah.ha@samsung.com>
security/smack/smack_lsm.c