From 6ba4ad7bf7475bb7d4fdf2374d921e0ef7be7f8f Mon Sep 17 00:00:00 2001 From: Casey Schaufler Date: Fri, 13 May 2016 16:47:26 +0900 Subject: [PATCH] Smack: secmark connections If the secmark is available us it on connection as well as packet delivery. Change-Id: I9015304ef62ab9a32c8e7740c5d70bd8842da7eb --- security/smack/smack_lsm.c | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c index 3d9f1b69782a..5c4bda37baa3 100644 --- a/security/smack/smack_lsm.c +++ b/security/smack/smack_lsm.c @@ -3926,6 +3926,18 @@ static int smack_inet_conn_request(struct sock *sk, struct sk_buff *skb, } #endif /* CONFIG_IPV6 */ +#ifdef CONFIG_SECURITY_SMACK_NETFILTER + /* + * If there is a secmark use it rather than the CIPSO label. + * If there is no secmark fall back to CIPSO. + * The secmark is assumed to reflect policy better. + */ + if (skb && skb->secmark != 0) { + skp = smack_from_secid(skb->secmark); + goto access_check; + } +#endif /* CONFIG_SECURITY_SMACK_NETFILTER */ + netlbl_secattr_init(&secattr); rc = netlbl_skbuff_getattr(skb, family, &secattr); if (rc == 0) @@ -3934,6 +3946,10 @@ static int smack_inet_conn_request(struct sock *sk, struct sk_buff *skb, skp = &smack_known_huh; netlbl_secattr_destroy(&secattr); +#ifdef CONFIG_SECURITY_SMACK_NETFILTER +access_check: +#endif + #ifdef CONFIG_AUDIT smk_ad_init_net(&ad, __func__, LSM_AUDIT_DATA_NET, &net); ad.a.u.net->family = family; -- 2.34.1