[PATCH 89/97] Netlabel: Return the labeling type on socket
From: Casey Schaufler <casey@schaufler-ca.com>
Date: 2019-02-28 22:44:37
Also in:
selinux
Subsystem:
networking [general], networking [labeled] (netlabel, labeled ipsec, secmark), selinux security module, the rest · Maintainers:
"David S. Miller", Eric Dumazet, Jakub Kicinski, Paolo Abeni, Paul Moore, Stephen Smalley, Linus Torvalds
Change netlbl_conn_setattr() to return the labeling type of the domain. This allows the labeling types to be compared when two LSMs want to determine how a socket should be used. Signed-off-by: Casey Schaufler <casey@schaufler-ca.com> --- net/netlabel/netlabel_kapi.c | 20 ++++++++++++-------- security/selinux/netlabel.c | 8 ++++++-- 2 files changed, 18 insertions(+), 10 deletions(-)
diff --git a/net/netlabel/netlabel_kapi.c b/net/netlabel/netlabel_kapi.c
index 61766da2cfac..2bd765290550 100644
--- a/net/netlabel/netlabel_kapi.c
+++ b/net/netlabel/netlabel_kapi.c@@ -1101,14 +1101,16 @@ int netlbl_sock_getattr(struct sock *sk, * Description: * Attach the correct label to the given connected socket using the security * attributes specified in @secattr. The caller is responsible for ensuring - * that @sk is locked. Returns zero on success, negative values on failure. + * that @sk is locked. Returns the NLTYPE on success, negative values on + * failure. * */ int netlbl_conn_setattr(struct sock *sk, struct sockaddr *addr, const struct netlbl_lsm_secattr *secattr) { - int ret_val; + int rc; + int ret_val = 0; struct sockaddr_in *addr4; #if IS_ENABLED(CONFIG_IPV6) struct sockaddr_in6 *addr6;
@@ -1125,16 +1127,17 @@ int netlbl_conn_setattr(struct sock *sk, ret_val = -ENOENT; goto conn_setattr_return; } + ret_val = entry->type; switch (entry->type) { case NETLBL_NLTYPE_CIPSOV4: - ret_val = cipso_v4_sock_setattr(sk, - entry->cipso, secattr); + rc = cipso_v4_sock_setattr(sk, entry->cipso, secattr); + if (rc < 0) + ret_val = rc; break; case NETLBL_NLTYPE_UNLABELED: /* just delete the protocols we support for right now * but we could remove other protocols if needed */ netlbl_sock_delattr(sk); - ret_val = 0; break; default: ret_val = -ENOENT;
@@ -1149,16 +1152,17 @@ int netlbl_conn_setattr(struct sock *sk, ret_val = -ENOENT; goto conn_setattr_return; } + ret_val = entry->type; switch (entry->type) { case NETLBL_NLTYPE_CALIPSO: - ret_val = calipso_sock_setattr(sk, - entry->calipso, secattr); + rc = calipso_sock_setattr(sk, entry->calipso, secattr); + if (rc < 0) + ret_val = rc; break; case NETLBL_NLTYPE_UNLABELED: /* just delete the protocols we support for right now * but we could remove other protocols if needed */ netlbl_sock_delattr(sk); - ret_val = 0; break; default: ret_val = -ENOENT;
diff --git a/security/selinux/netlabel.c b/security/selinux/netlabel.c
index 85156a0cdfc3..ca47c99f964a 100644
--- a/security/selinux/netlabel.c
+++ b/security/selinux/netlabel.c@@ -321,8 +321,10 @@ int selinux_netlbl_sctp_assoc_request(struct sctp_endpoint *ep, } rc = netlbl_conn_setattr(ep->base.sk, addr, &secattr); - if (rc == 0) + if (rc >= 0) { sksec->nlbl_state = NLBL_LABELED; + rc = 0; + } assoc_request_return: netlbl_secattr_destroy(&secattr);
@@ -576,8 +578,10 @@ static int selinux_netlbl_socket_connect_helper(struct sock *sk, return rc; } rc = netlbl_conn_setattr(sk, addr, secattr); - if (rc == 0) + if (rc >= 0) { sksec->nlbl_state = NLBL_CONNLABELED; + rc = 0; + } return rc; }
--
2.17.0