Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1764690AbZCNBoj (ORCPT ); Fri, 13 Mar 2009 21:44:39 -0400 Received: (majordomo@vger.kernel.org) by vger.kernel.org id S1755028AbZCNBVM (ORCPT ); Fri, 13 Mar 2009 21:21:12 -0400 Received: from kroah.org ([198.145.64.141]:35458 "EHLO coco.kroah.org" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1754328AbZCNBUu (ORCPT ); Fri, 13 Mar 2009 21:20:50 -0400 X-Mailbox-Line: From gregkh@mini.kroah.org Fri Mar 13 18:10:41 2009 Message-Id: <20090314011041.327731579@mini.kroah.org> User-Agent: quilt/0.48-1 Date: Fri, 13 Mar 2009 18:10:44 -0700 From: Greg KH To: linux-kernel@vger.kernel.org, stable@kernel.org Cc: Justin Forbes , Zwane Mwaikambo , "Theodore Ts'o" , Randy Dunlap , Dave Jones , Chuck Wolber , Chris Wedgwood , Michael Krufky , Chuck Ebbert , Domenico Andreoli , Willy Tarreau , Rodrigo Rubira Branco , Jake Edge , Eugene Teo , torvalds@linux-foundation.org, akpm@linux-foundation.org, alan@lxorguk.ukuu.org.uk, Paul Moore , James Morris Subject: [patch 067/114] selinux: Fix the NetLabel glue code for setsockopt() References: <20090314010937.416083662@mini.kroah.org> Content-Disposition: inline; filename=selinux-fix-the-netlabel-glue-code-for-setsockopt.patch In-Reply-To: <20090314011649.GA26170@kroah.com> Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1748 Lines: 41 2.6.28-stable review patch. If anyone has any objections, please let us know. ------------------ From: Paul Moore commit 09c50b4a52c01a1f450b8eec819089e228655bfb upstream. At some point we (okay, I) managed to break the ability for users to use the setsockopt() syscall to set IPv4 options when NetLabel was not active on the socket in question. The problem was noticed by someone trying to use the "-R" (record route) option of ping: # ping -R 10.0.0.1 ping: record route: No message of desired type The solution is relatively simple, we catch the unlabeled socket case and clear the error code, allowing the operation to succeed. Please note that we still deny users the ability to override IPv4 options on socket's which have NetLabel labeling active; this is done to ensure the labeling remains intact. Signed-off-by: Paul Moore Signed-off-by: James Morris Cc: Chuck Ebbert Signed-off-by: Greg Kroah-Hartman --- security/selinux/netlabel.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) --- a/security/selinux/netlabel.c +++ b/security/selinux/netlabel.c @@ -491,8 +491,10 @@ int selinux_netlbl_socket_setsockopt(str lock_sock(sk); rc = netlbl_sock_getattr(sk, &secattr); release_sock(sk); - if (rc == 0 && secattr.flags != NETLBL_SECATTR_NONE) + if (rc == 0) rc = -EACCES; + else if (rc == -ENOMSG) + rc = 0; netlbl_secattr_destroy(&secattr); } -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/