Attachment 922040 Details for Bug 1115120 – Properly label AF_ALG socket

[patch] Properly label AF_ALG socket

0001-crypto-properly-label-AF_ALG-socket.patch (text/plain), 1.23 KB, created by Milan Broz on 2014-07-29 06:52:39 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Milan Broz

Created: 2014-07-29 06:52:39 UTC

Size: 1.23 KB

patch

obsolete

>From 0d62dd705802b13cd550a1420ad2132a16583d69 Mon Sep 17 00:00:00 2001
>From: Milan Broz <gmazyland@gmail.com>
>Date: Tue, 29 Jul 2014 08:38:11 +0200
>Subject: [PATCH] crypto: properly label AF_ALG socket
>
>Th AF_ALG socket was missing a security label (e.g. SELinux)
>which means that socket was in "unlabeled" state.
>
>This was recently demonstrated in the cryptsetup package
>(cryptsetup v1.6.5 and later.)
>See https://bugzilla.redhat.com/show_bug.cgi?id=1115120
>
>This patch clones the sock's label from the parent sock
>and resolves the issue (similar to AF_BLUETOOTH protocol family).
>
>Cc: stable@vger.kernel.org
>Signed-off-by: Milan Broz <gmazyland@gmail.com>
>---
> crypto/af_alg.c | 2 ++
> 1 file changed, 2 insertions(+)
>
>diff --git a/crypto/af_alg.c b/crypto/af_alg.c
>index 966f893..6a3ad80 100644
>--- a/crypto/af_alg.c
>+++ b/crypto/af_alg.c
>@@ -21,6 +21,7 @@
> #include <linux/module.h>
> #include <linux/net.h>
> #include <linux/rwsem.h>
>+#include <linux/security.h>
> 
> struct alg_type_list {
> 	const struct af_alg_type *type;
>@@ -243,6 +244,7 @@ int af_alg_accept(struct sock *sk, struct socket *newsock)
> 
> 	sock_init_data(newsock, sk2);
> 	sock_graft(sk2, newsock);
>+	security_sk_clone(sk, sk2);
> 
> 	err = type->accept(ask->private, sk2);
> 	if (err) {
>-- 
>2.0.1
>

Actions: View | Diff

Attachments on bug 1115120: 913791 | 913918 | 913920 | 916950 | 921748 | 922040