[PATCH 27/58] NET: Remove scaffolding on secmarks
From: Casey Schaufler <casey@schaufler-ca.com>
Date: 2019-06-02 16:52:43
Also in:
selinux
Subsystem:
netfilter, networking [general], networking [labeled] (netlabel, labeled ipsec, secmark), the rest · Maintainers:
Pablo Neira Ayuso, Florian Westphal, "David S. Miller", Eric Dumazet, Jakub Kicinski, Paolo Abeni, Paul Moore, Linus Torvalds
Replace the lsm_export scaffolding in xt_SECMARK.c This raises an issue, in that Smack users have been using SECMARK_MODE_SEL, which is suppoed to be exclusively for SELinux. This is worked around in the code, but not fully addressed. Signed-off-by: Casey Schaufler <casey@schaufler-ca.com> --- net/netfilter/xt_SECMARK.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
diff --git a/net/netfilter/xt_SECMARK.c b/net/netfilter/xt_SECMARK.c
index 2def8d8898e6..9a2a97c200a2 100644
--- a/net/netfilter/xt_SECMARK.c
+++ b/net/netfilter/xt_SECMARK.c@@ -55,6 +55,7 @@ static int checkentry_lsm(struct xt_secmark_target_info *info) info->secctx[SECMARK_SECCTX_MAX - 1] = '\0'; info->secid = 0; + lsm_export_init(&le); err = security_secctx_to_secid(info->secctx, strlen(info->secctx), &le); if (err) { if (err == -EINVAL)
@@ -63,7 +64,12 @@ static int checkentry_lsm(struct xt_secmark_target_info *info) return err; } - lsm_export_secid(&le, &info->secid); + /* Smack is cheating, using SECMARK_MODE_SEL */ + if (le.selinux) + info->secid = le.selinux; + else + info->secid = le.smack; + if (!info->secid) { pr_info_ratelimited("unable to map security context \'%s\'\n", info->secctx);
--
2.19.1