Smack: File receive for sockets 99/55799/2 accepted/tizen/mobile/20151230.114529 submit/tizen/20151230.013941
authorCasey Schaufler <casey@schaufler-ca.com>
Mon, 7 Dec 2015 22:34:32 +0000 (14:34 -0800)
committerSeung-Woo Kim <sw0312.kim@samsung.com>
Wed, 30 Dec 2015 00:59:07 +0000 (09:59 +0900)
commitc18f29598546c122d28944dd9da8f2723eb65369
tree789c0837db4a5120ab9fde0a47b61b50a09cae66
parent334fab2f4f11feba0c321095a0abcfe0e85820c0
Smack: File receive for sockets

The existing file receive hook checks for access on
the file inode even for UDS. This is not right, as
the inode is not used by Smack to make access checks
for sockets. This change checks for an appropriate
access relationship between the receiving (current)
process and the socket. If the process can't write
to the socket's send label or the socket's receive
label can't write to the process fail.

This will allow the legitimate cases, where the
socket sender and socket receiver can freely communicate.
Only strangly set socket labels should cause a problem.

Change-Id: Id37df53243264ac843f9c6693ba99aba9779f05e
Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
[backport to 3.10 from smack-next commit 79be093500791cc25cc31bcaec5a4db62e21497b]
Signed-off-by: Seung-Woo Kim <sw0312.kim@samsung.com>
security/smack/smack_lsm.c