From: Roy.Li <rongqing.li@xxxxxxxxxxxxx> The element sk_security of struct sock represents the socket security context ID, which is inheriting from the process when creates this socket on most of the time. but when SELinux type_transition rule is applied to socket, or application sets /proc/xxx/attr/createsock, the socket security context would be different from the creating process. on this condition, the "netstat -Z" will return wrong value, since "netstat -Z" only returns the process security context as socket process security. Export the raw sock's security context to proc, so that "netstat -Z" could be fixed by reading procfs. Signed-off-by: Roy.Li <rongqing.li@xxxxxxxxxxxxx> --- net/ipv4/raw.c | 7 +++++-- 1 files changed, 5 insertions(+), 2 deletions(-) diff --git a/net/ipv4/raw.c b/net/ipv4/raw.c index 1457acb..79c17e5 100644 --- a/net/ipv4/raw.c +++ b/net/ipv4/raw.c @@ -979,12 +979,15 @@ static void raw_sock_seq_show(struct seq_file *seq, struct sock *sp, int i) srcp = inet->inet_num; seq_printf(seq, "%4d: %08X:%04X %08X:%04X" - " %02X %08X:%08X %02X:%08lX %08X %5d %8d %lu %d %pK %d\n", + " %02X %08X:%08X %02X:%08lX %08X %5d %8d %lu %d %pK %d", i, src, srcp, dest, destp, sp->sk_state, sk_wmem_alloc_get(sp), sk_rmem_alloc_get(sp), 0, 0L, 0, sock_i_uid(sp), 0, sock_i_ino(sp), atomic_read(&sp->sk_refcnt), sp, atomic_read(&sp->sk_drops)); + + sock_write_secctx(sp, seq); + seq_putc(seq, '\n'); } static int raw_seq_show(struct seq_file *seq, void *v) @@ -992,7 +995,7 @@ static int raw_seq_show(struct seq_file *seq, void *v) if (v == SEQ_START_TOKEN) seq_printf(seq, " sl local_address rem_address st tx_queue " "rx_queue tr tm->when retrnsmt uid timeout " - "inode ref pointer drops\n"); + "inode ref pointer drops seclabel\n"); else raw_sock_seq_show(seq, v, raw_seq_private(seq)->bucket); return 0; -- 1.7.1 -- This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to majordomo@xxxxxxxxxxxxx with the words "unsubscribe selinux" without quotes as the message.
