From: Milan Broz Subject: [PATCH] crypto: properly label AF_ALG socket Date: Tue, 29 Jul 2014 20:41:09 +0200 Message-ID: <1406659269-8346-1-git-send-email-gmazyland@gmail.com> References: <20140728150958.23156.75132.stgit@localhost> Cc: selinux@tycho.nsa.gov, pmoore@redhat.com, Milan Broz , stable@vger.kernel.org To: linux-crypto@vger.kernel.org Return-path: In-Reply-To: <20140728150958.23156.75132.stgit@localhost> Sender: stable-owner@vger.kernel.org List-Id: linux-crypto.vger.kernel.org Th AF_ALG socket was missing a security label (e.g. SELinux) which means that socket was in "unlabeled" state. This was recently demonstrated in the cryptsetup package (cryptsetup v1.6.5 and later.) See https://bugzilla.redhat.com/show_bug.cgi?id=1115120 This patch clones the sock's label from the parent sock and resolves the issue (similar to AF_BLUETOOTH protocol family). Cc: stable@vger.kernel.org Signed-off-by: Milan Broz --- crypto/af_alg.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/crypto/af_alg.c b/crypto/af_alg.c index 966f893..6a3ad80 100644 --- a/crypto/af_alg.c +++ b/crypto/af_alg.c @@ -21,6 +21,7 @@ #include #include #include +#include struct alg_type_list { const struct af_alg_type *type; @@ -243,6 +244,7 @@ int af_alg_accept(struct sock *sk, struct socket *newsock) sock_init_data(newsock, sk2); sock_graft(sk2, newsock); + security_sk_clone(sk, sk2); err = type->accept(ask->private, sk2); if (err) { -- 2.0.1