Re: [RFC v2 00/10] snet: Security for NETwork syscalls

Samir Bellabes wrote:

Tetsuo Handa [off-list ref] writes:

quoted

Regarding [RFC v2 02/10] Revert "lsm: Remove the socket_post_accept() hook"

@@ -1538,6 +1538,8 @@ SYSCALL_DEFINE4(accept4, int, fd, struct sockaddr __user *, upeer_sockaddr,
 	fd_install(newfd, newfile);
 	err = newfd;
 
+	security_socket_post_accept(sock, newsock);
+
 out_put:
 	fput_light(sock->file, fput_needed);
 out:

Please move security_socket_post_accept() to before fd_install().
Otherwise, other threads which share fd tables can use
security-informations-not-yet-updated accept()ed sockets.

Tetsuo, what about this patch ?

Looks OK to me. Thanks.