leandrof/linux
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

netlabel: Prevent setsockopt() from changing the hop-by-hop option.

Browse Source 
If a socket has a netlabel in place then don't let setsockopt() alter
the socket's IPv6 hop-by-hop option.  This is in the same spirit as
the existing check for IPv4.

Signed-off-by: Huw Davies <huw@codeweavers.com>
Signed-off-by: Paul Moore <paul@paul-moore.com>
This commit is contained in:
Huw Davies 2016-06-27 15:05:27 -04:00 committed by Paul Moore
parent ceba1832b1
commit 1f440c99d3
1 changed files with 16 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
security/selinux/netlabel.c
View File

@ -409,6 +409,21 @@ int selinux_netlbl_sock_rcv_skb(struct sk_security_struct *sksec,
return rc; return rc;
} }
/**
* selinux_netlbl_option - Is this a NetLabel option
* @level: the socket level or protocol
* @optname: the socket option name
*
* Description:
* Returns true if @level and @optname refer to a NetLabel option.
* Helper for selinux_netlbl_socket_setsockopt().
*/
static inline int selinux_netlbl_option(int level, int optname)
{
return (level == IPPROTO_IP && optname == IP_OPTIONS) ||
(level == IPPROTO_IPV6 && optname == IPV6_HOPOPTS);
}
/** /**
* selinux_netlbl_socket_setsockopt - Do not allow users to remove a NetLabel * selinux_netlbl_socket_setsockopt - Do not allow users to remove a NetLabel
* @sock: the socket * @sock: the socket
@ -431,7 +446,7 @@ int selinux_netlbl_socket_setsockopt(struct socket *sock,
struct sk_security_struct *sksec = sk->sk_security; struct sk_security_struct *sksec = sk->sk_security;
struct netlbl_lsm_secattr secattr; struct netlbl_lsm_secattr secattr;
if (level == IPPROTO_IP && optname == IP_OPTIONS && if (selinux_netlbl_option(level, optname) &&
(sksec->nlbl_state == NLBL_LABELED || (sksec->nlbl_state == NLBL_LABELED ||
sksec->nlbl_state == NLBL_CONNLABELED)) { sksec->nlbl_state == NLBL_CONNLABELED)) {
netlbl_secattr_init(&secattr); netlbl_secattr_init(&secattr);