The patch titled
smack: respect 'unlabeled' netlabel mode
has been removed from the -mm tree. Its filename was
smack-respect-unlabeled-netlabel-mode.patch
This patch was dropped because it was nacked
The current -mm tree may be found at http://userweb.kernel.org/~akpm/mmotm/
------------------------------------------------------
Subject: smack: respect 'unlabeled' netlabel mode
From: "Ahmed S. Darwish" <darwish.07@xxxxxxxxx>
In case of Smack 'unlabeled' netlabel option, Smack passes a _zero_
initialized 'secattr' to label a packet/sock. This causes an [unfound
domain label error]/-ENOENT by netlbl_sock_setattr(). Above Netlabel
failure leads to Smack socket hooks failure causing an always-on socket()
-EPERM error.
Such packets should have a netlabel domain agreed with netlabel to
represent unlabeled packets. Fortunately Smack net ambient label packets
are agreed with netlabel to be treated as unlabeled packets.
Treat all packets coming out from a 'unlabeled' Smack system as coming
from the smack net ambient label.
Signed-off-by: Ahmed S. Darwish <darwish.07@xxxxxxxxx>
Cc: Casey Schaufler <casey@xxxxxxxxxxxxxxxx>
Cc: Paul Moore <paul.moore@xxxxxx>
Signed-off-by: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx>
---
security/smack/smack_lsm.c | 2 ++
1 file changed, 2 insertions(+)
diff -puN security/smack/smack_lsm.c~smack-respect-unlabeled-netlabel-mode security/smack/smack_lsm.c
--- a/security/smack/smack_lsm.c~smack-respect-unlabeled-netlabel-mode
+++ a/security/smack/smack_lsm.c
@@ -1293,6 +1293,8 @@ static void smack_to_secattr(char *smack
}
break;
default:
+ nlsp->domain = kstrdup(smack_net_ambient, GFP_ATOMIC);
+ nlsp->flags = NETLBL_SECATTR_DOMAIN;
break;
}
}
_
Patches currently in -mm which might be from darwish.07@xxxxxxxxx are
linux-next.patch
smack-respect-unlabeled-netlabel-mode.patch
--
To unsubscribe from this list: send the line "unsubscribe mm-commits" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
