Smack: bidirectional UDS connect check

Smack IPC policy requires that the sender have write access
to the receiver. UDS streams don't do per-packet checks. The
only check is done at connect time. The existing code checks
if the connecting process can write to the other, but not the
other way around. This change adds a check that the other end
can write to the connecting process.

Targeted for git://git.gitorious.org/smack-next/kernel.git

Change-Id: Ibecf37e5644f66885acc02ae0ee96f8009a0b5fa
Signed-off-by: Casey Schuafler <casey@schaufler-ca.com>
[Backport from mainline to 3.10]
Signed-off-by: Seung-Woo Kim <sw0312.kim@samsung.com>

diff --git a/security/smack/smack.h b/security/smack/smack.h
index 2eb4255..3cb24f5 100644 (file)
--- a/security/smack/smack.h
+++ b/security/smack/smack.h
@@ -80,8 +80,8 @@ struct superblock_smack {
 
 struct socket_smack {
        struct smack_known      *smk_out;       /* outbound label */
-       char                    *smk_in;        /* inbound label */
-       char                    *smk_packet;    /* TCP peer label */
+       struct smack_known      *smk_in;        /* inbound label */
+       struct smack_known      *smk_packet;    /* TCP peer label */
 };
 
 /*
@@ -134,7 +134,7 @@ struct smk_port_label {
        struct list_head        list;
        struct sock             *smk_sock;      /* socket initialized on */
        unsigned short          smk_port;       /* the port number */
-       char                    *smk_in;        /* incoming label */
+       struct smack_known      *smk_in;        /* inbound label */
        struct smack_known      *smk_out;       /* outgoing label */
 };
 

diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c
index 33a5bb1..0dab4d7 100644 (file)
--- a/security/smack/smack_lsm.c
+++ b/security/smack/smack_lsm.c
@@ -1298,7 +1298,7 @@ static int smack_inode_getsecurity(const struct inode *inode,
        ssp = sock->sk->sk_security;
 
        if (strcmp(name, XATTR_SMACK_IPIN) == 0)
-               isp = ssp->smk_in;
+               isp = ssp->smk_in->smk_known;
        else if (strcmp(name, XATTR_SMACK_IPOUT) == 0)
                isp = ssp->smk_out->smk_known;
        else
@@ -2087,7 +2087,7 @@ static int smack_sk_alloc_security(struct sock *sk, int family, gfp_t gfp_flags)
        if (ssp == NULL)
                return -ENOMEM;
 
-       ssp->smk_in = skp->smk_known;
+       ssp->smk_in = skp;
        ssp->smk_out = skp;
        ssp->smk_packet = NULL;
 
@@ -2329,7 +2329,7 @@ static int smk_ipv6_port_check(struct sock *sk, struct sockaddr_in6 *address,
 
        if (act == SMK_RECEIVING) {
                skp = smack_net_ambient;
-               object = ssp->smk_in;
+               object = ssp->smk_in->smk_known;
        } else {
                skp = ssp->smk_out;
                object = smack_net_ambient->smk_known;
@@ -2359,9 +2359,9 @@ static int smk_ipv6_port_check(struct sock *sk, struct sockaddr_in6 *address,
        list_for_each_entry(spp, &smk_ipv6_port_list, list) {
                if (spp->smk_port != port)
                        continue;
-               object = spp->smk_in;
+               object = spp->smk_in->smk_known;
                if (act == SMK_CONNECTING)
-                       ssp->smk_packet = spp->smk_out->smk_known;
+                       ssp->smk_packet = spp->smk_out;
                break;
        }
 
@@ -2427,7 +2427,7 @@ static int smack_inode_setsecurity(struct inode *inode, const char *name,
        ssp = sock->sk->sk_security;
 
        if (strcmp(name, XATTR_SMACK_IPIN) == 0)
-               ssp->smk_in = skp->smk_known;
+               ssp->smk_in = skp;
        else if (strcmp(name, XATTR_SMACK_IPOUT) == 0) {
                ssp->smk_out = skp;
                if (sock->sk->sk_family == PF_INET) {
@@ -2471,7 +2471,7 @@ static int smack_socket_post_create(struct socket *sock, int family,
         */
        if (unlikely(current->flags & PF_KTHREAD)) {
                ssp = sock->sk->sk_security;
-               ssp->smk_in = smack_known_web.smk_known;
+               ssp->smk_in = &smack_known_web;
        }
        if (family != PF_INET)
                return 0;
@@ -3322,33 +3322,39 @@ static int smack_unix_stream_connect(struct sock *sock,
                                     struct sock *other, struct sock *newsk)
 {
        struct smack_known *skp;
+       struct smack_known *okp;
        struct socket_smack *ssp = sock->sk_security;
        struct socket_smack *osp = other->sk_security;
        struct socket_smack *nsp = newsk->sk_security;
        struct smk_audit_info ad;
        int rc = 0;
-
 #ifdef CONFIG_AUDIT
        struct lsm_network_audit net;
-
-       smk_ad_init_net(&ad, __func__, LSM_AUDIT_DATA_NET, &net);
-       smk_ad_setfield_u_net_sk(&ad, other);
 #endif
 
        if (!smack_privileged(CAP_MAC_OVERRIDE)) {
                skp = ssp->smk_out;
-
-               rc = smk_access(skp, osp->smk_in, MAY_WRITE, &ad);
-               rc = smk_bu_note("UDS connect", skp, osp->smk_in,
+               okp = osp->smk_out;
+#ifdef CONFIG_AUDIT
+               smk_ad_init_net(&ad, __func__, LSM_AUDIT_DATA_NET, &net);
+               smk_ad_setfield_u_net_sk(&ad, other);
+#endif
+               rc = smk_access(skp, okp->smk_known, MAY_WRITE, &ad);
+               rc = smk_bu_note("UDS connect", skp, okp->smk_known,
                                        MAY_WRITE, rc);
+               if (rc == 0) {
+                       rc = smk_access(okp, okp->smk_known, MAY_WRITE, NULL);
+                       rc = smk_bu_note("UDS connect", okp, okp->smk_known,
+                                               MAY_WRITE, rc);
+               }
        }
 
        /*
         * Cross reference the peer labels for SO_PEERSEC.
         */
        if (rc == 0) {
-               nsp->smk_packet = ssp->smk_out->smk_known;
-               ssp->smk_packet = osp->smk_out->smk_known;
+               nsp->smk_packet = ssp->smk_out;
+               ssp->smk_packet = osp->smk_out;
        }
 
        return rc;
@@ -3382,8 +3388,8 @@ static int smack_unix_may_send(struct socket *sock, struct socket *other)
 
        skp = ssp->smk_out;
 
-       rc = smk_access(skp, osp->smk_in, MAY_WRITE, &ad);
-       rc = smk_bu_note("UDS send", skp, osp->smk_in,
+       rc = smk_access(skp, osp->smk_in->smk_known, MAY_WRITE, &ad);
+       rc = smk_bu_note("UDS send", skp, osp->smk_in->smk_known,
                                MAY_WRITE, rc);
        return rc;
 }
@@ -3480,7 +3486,7 @@ static struct smack_known *smack_from_secattr(struct netlbl_lsm_secattr *sap,
                if (found)
                        return skp;
 
-               if (ssp != NULL && ssp->smk_in == smack_known_star.smk_known)
+               if (ssp != NULL && ssp->smk_in == &smack_known_star)
                        return &smack_known_web;
                return &smack_known_star;
        }
@@ -3600,8 +3606,8 @@ static int smack_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
                 * for networking.
                 */
 
-               rc = smk_access(skp, ssp->smk_in, MAY_WRITE, &ad);
-               rc = smk_bu_note("IPv4 delivery", skp, ssp->smk_in,
+               rc = smk_access(skp, ssp->smk_in->smk_known, MAY_WRITE, &ad);
+               rc = smk_bu_note("IPv4 delivery", skp, ssp->smk_in->smk_known,
                                        MAY_WRITE, rc);
 
                if (rc != 0)
@@ -3638,7 +3644,7 @@ static int smack_socket_getpeersec_stream(struct socket *sock,
 
        ssp = sock->sk->sk_security;
        if (ssp->smk_packet != NULL) {
-               rcp = ssp->smk_packet;
+               rcp = ssp->smk_packet->smk_known;
                slen = strlen(rcp) + 1;
        }
 
@@ -3723,7 +3729,7 @@ static void smack_sock_graft(struct sock *sk, struct socket *parent)
                return;
 
        ssp = sk->sk_security;
-       ssp->smk_in = skp->smk_known;
+       ssp->smk_in = skp;
        ssp->smk_out = skp;
        /* cssp->smk_packet is already set in smack_inet_csk_clone() */
 }
@@ -3784,8 +3790,8 @@ static int smack_inet_conn_request(struct sock *sk, struct sk_buff *skb,
         * here. Read access is not required.
         */
 
-       rc = smk_access(skp, ssp->smk_in, MAY_WRITE, &ad);
-       rc = smk_bu_note("IPv4 connect", skp, ssp->smk_in,
+       rc = smk_access(skp, ssp->smk_in->smk_known, MAY_WRITE, &ad);
+       rc = smk_bu_note("IPv4 connect", skp, ssp->smk_in->smk_known,
                                MAY_WRITE, rc);
        if (rc != 0)
                return rc;
@@ -3830,7 +3836,7 @@ static void smack_inet_csk_clone(struct sock *sk,
 
        if (req->peer_secid != 0) {
                skp = smack_from_secid(req->peer_secid);
-               ssp->smk_packet = skp->smk_known;
+               ssp->smk_packet = skp;
        } else
                ssp->smk_packet = NULL;
 }