leandrof/linux
1
0
Fork 0
forked from Minki/linux
Code Issues Pull Requests Packages Projects Releases Wiki Activity

bluetooth: Properly clone LSM attributes to newly created child connections

Browse Source 
The Bluetooth stack has internal connection handlers for all of the various
Bluetooth protocols, and unfortunately, they are currently lacking the LSM
hooks found in the core network stack's connection handlers.  I say
unfortunately, because this can cause problems for users who have have an
LSM enabled and are using certain Bluetooth devices.  See one problem
report below:

 * http://bugzilla.redhat.com/show_bug.cgi?id=741703

In order to keep things simple at this point in time, this patch fixes the
problem by cloning the parent socket's LSM attributes to the newly created
child socket.  If we decide we need a more elaborate LSM marking mechanism
for Bluetooth (I somewhat doubt this) we can always revisit this decision
in the future.

Reported-by: James M. Cape <jcape@ignore-your.tv>
Signed-off-by: Paul Moore <pmoore@redhat.com>
Acked-by: James Morris <jmorris@namei.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
Paul Moore 2011-10-07 09:40:59 +00:00 committed by David S. Miller
parent 835acf5da2
commit 6230c9b4f8
4 changed files with 12 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
net/bluetooth/l2cap_sock.c
View File

@ -26,6 +26,8 @@
/* Bluetooth L2CAP sockets. */ /* Bluetooth L2CAP sockets. */
#include <linux/security.h>
#include <net/bluetooth/bluetooth.h> #include <net/bluetooth/bluetooth.h>
#include <net/bluetooth/hci_core.h> #include <net/bluetooth/hci_core.h>
#include <net/bluetooth/l2cap.h> #include <net/bluetooth/l2cap.h>
@ -933,6 +935,8 @@ static void l2cap_sock_init(struct sock *sk, struct sock *parent)
chan->force_reliable = pchan->force_reliable; chan->force_reliable = pchan->force_reliable;
chan->flushable = pchan->flushable; chan->flushable = pchan->flushable;
chan->force_active = pchan->force_active; chan->force_active = pchan->force_active;
security_sk_clone(parent, sk);
} else { } else {
switch (sk->sk_type) { switch (sk->sk_type) {

3
net/bluetooth/rfcomm/sock.c
View File

@ -42,6 +42,7 @@
#include <linux/device.h> #include <linux/device.h>
#include <linux/debugfs.h> #include <linux/debugfs.h>
#include <linux/seq_file.h> #include <linux/seq_file.h>
#include <linux/security.h>
#include <net/sock.h> #include <net/sock.h>
#include <asm/system.h> #include <asm/system.h>
@ -264,6 +265,8 @@ static void rfcomm_sock_init(struct sock *sk, struct sock *parent)
pi->sec_level = rfcomm_pi(parent)->sec_level; pi->sec_level = rfcomm_pi(parent)->sec_level;
pi->role_switch = rfcomm_pi(parent)->role_switch; pi->role_switch = rfcomm_pi(parent)->role_switch;
security_sk_clone(parent, sk);
} else { } else {
pi->dlc->defer_setup = 0; pi->dlc->defer_setup = 0;

5
net/bluetooth/sco.c
View File

@ -41,6 +41,7 @@
#include <linux/debugfs.h> #include <linux/debugfs.h>
#include <linux/seq_file.h> #include <linux/seq_file.h>
#include <linux/list.h> #include <linux/list.h>
#include <linux/security.h>
#include <net/sock.h> #include <net/sock.h>
#include <asm/system.h> #include <asm/system.h>
@ -403,8 +404,10 @@ static void sco_sock_init(struct sock *sk, struct sock *parent)
{ {
BT_DBG("sk %p", sk); BT_DBG("sk %p", sk);
if (parent) if (parent) {
sk->sk_type = parent->sk_type; sk->sk_type = parent->sk_type;
security_sk_clone(parent, sk);
}
} }
static struct proto sco_proto = { static struct proto sco_proto = {

1
security/security.c
View File

@ -1097,6 +1097,7 @@ void security_sk_clone(const struct sock *sk, struct sock *newsk)
{ {
security_ops->sk_clone_security(sk, newsk); security_ops->sk_clone_security(sk, newsk);
} }
EXPORT_SYMBOL(security_sk_clone);
void security_sk_classify_flow(struct sock *sk, struct flowi *fl) void security_sk_classify_flow(struct sock *sk, struct flowi *fl)
{ {