From: Casey Schaufler <casey@schaufler-ca.com>
Date: Fri, 13 May 2016 07:47:26 +0000 (+0900)
Subject: Smack: secmark connections
X-Git-Tag: submit/tizen/20160607.132125^2~3^2~2
X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=refs%2Fchanges%2F41%2F69441%2F2;p=sdk%2Femulator%2Femulator-kernel.git

Smack: secmark connections

If the secmark is available us it on connection as
well as packet delivery.

Change-Id: I9015304ef62ab9a32c8e7740c5d70bd8842da7eb
---

diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c
index 3d9f1b69782a..5c4bda37baa3 100644
--- a/security/smack/smack_lsm.c
+++ b/security/smack/smack_lsm.c
@@ -3926,6 +3926,18 @@ static int smack_inet_conn_request(struct sock *sk, struct sk_buff *skb,
 	}
 #endif /* CONFIG_IPV6 */
 
+#ifdef CONFIG_SECURITY_SMACK_NETFILTER
+	/*
+	 * If there is a secmark use it rather than the CIPSO label.
+	 * If there is no secmark fall back to CIPSO.
+	 * The secmark is assumed to reflect policy better.
+	 */
+	if (skb && skb->secmark != 0) {
+		skp = smack_from_secid(skb->secmark);
+		goto access_check;
+	}
+#endif /* CONFIG_SECURITY_SMACK_NETFILTER */
+
 	netlbl_secattr_init(&secattr);
 	rc = netlbl_skbuff_getattr(skb, family, &secattr);
 	if (rc == 0)
@@ -3934,6 +3946,10 @@ static int smack_inet_conn_request(struct sock *sk, struct sk_buff *skb,
 		skp = &smack_known_huh;
 	netlbl_secattr_destroy(&secattr);
 
+#ifdef CONFIG_SECURITY_SMACK_NETFILTER
+access_check:
+#endif
+
 #ifdef CONFIG_AUDIT
 	smk_ad_init_net(&ad, __func__, LSM_AUDIT_DATA_NET, &net);
 	ad.a.u.net->family = family;