The patch titled Smack: check for SMACK xattr validity in smack_inode_setxattr has been added to the -mm tree. Its filename is smack-check-for-smack-xattr-validity-in-smack_inode_setxattr.patch Before you just go and hit "reply", please: a) Consider who else should be cc'ed b) Prefer to cc a suitable mailing list as well c) Ideally: find the original patch on the mailing list and do a reply-to-all to that, adding suitable additional cc's *** Remember to use Documentation/SubmitChecklist when testing your code *** See http://userweb.kernel.org/~akpm/stuff/added-to-mm.txt to find out what to do about this The current -mm tree may be found at http://userweb.kernel.org/~akpm/mmotm/ ------------------------------------------------------ Subject: Smack: check for SMACK xattr validity in smack_inode_setxattr From: Etienne Basset <etienne.basset@xxxxxxxxxxxxxx> Move checks for SMACK xattr validity from smack_inode_post_setxattr (which cannot return an error to the user) to smack_inode_setxattr (which can return an error). Signed-off-by: Etienne Basset <etienne.basset@xxxxxxxxxxxxxx> Acked-by: Casey Schaufler <casey@xxxxxxxxxxxxxxxx> Cc: James Morris <jmorris@xxxxxxxxx> Signed-off-by: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx> --- security/smack/smack_lsm.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff -puN security/smack/smack_lsm.c~smack-check-for-smack-xattr-validity-in-smack_inode_setxattr security/smack/smack_lsm.c --- a/security/smack/smack_lsm.c~smack-check-for-smack-xattr-validity-in-smack_inode_setxattr +++ a/security/smack/smack_lsm.c @@ -675,8 +675,12 @@ static int smack_inode_setxattr(struct d strcmp(name, XATTR_NAME_SMACKIPOUT) == 0) { if (!capable(CAP_MAC_ADMIN)) rc = -EPERM; - /* a label cannot be void and cannot begin with '-' */ - if (size == 0 || (size > 0 && ((char *)value)[0] == '-')) + /* + * check label validity here so import wont fail on + * post_setxattr + */ + if (size == 0 || size >= SMK_LABELLEN || + smk_import(value, size) == NULL) rc = -EINVAL; } else rc = cap_inode_setxattr(dentry, name, value, size, flags); @@ -713,9 +717,6 @@ static void smack_inode_post_setxattr(st if (strcmp(name, XATTR_NAME_SMACK)) return; - if (size >= SMK_LABELLEN) - return; - isp = dentry->d_inode->i_security; /* _ Patches currently in -mm which might be from etienne.basset@xxxxxxxxxxxxxx are linux-next.patch smack-check-for-smack-xattr-validity-in-smack_inode_setxattr.patch -- To unsubscribe from this list: send the line "unsubscribe mm-commits" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html