iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

smack: unix sockets: fix accept()ed socket label

Browse Source 
When a process accept()s connection from a unix socket
(either stream or seqpacket)
it gets the socket with the label of the connecting process.

For example, if a connecting process has a label 'foo',
the accept()ed socket will also have 'in' and 'out' labels 'foo',
regardless of the label of the listener process.

This is because kernel creates unix child sockets
in the context of the connecting process.

I do not see any obvious way for the listener to abuse
alien labels coming with the new socket, but,
to be on the safe side, it's better fix new socket labels.

Signed-off-by: Konstantin Andreev <andreev@swemel.ru>
Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
This commit is contained in:
Konstantin Andreev 2024-06-17 01:44:30 +03:00 committed by Casey Schaufler
parent 2fe209d0ad
commit e86cac0acd
1 changed files with 9 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
security/smack/smack_lsm.c
View File

@ -3846,12 +3846,18 @@ static int smack_unix_stream_connect(struct sock *sock,
} }
} }
/*
* Cross reference the peer labels for SO_PEERSEC.
*/
if (rc == 0) { if (rc == 0) {
/*
* Cross reference the peer labels for SO_PEERSEC.
*/
nsp->smk_packet = ssp->smk_out; nsp->smk_packet = ssp->smk_out;
ssp->smk_packet = osp->smk_out; ssp->smk_packet = osp->smk_out;
/*
* new/child/established socket must inherit listening socket labels
*/
nsp->smk_out = osp->smk_out;
nsp->smk_in = osp->smk_in;
} }
return rc; return rc;