On Tue, 2006-06-27 at 03:16 -0400, James Morris wrote:
> On Tue, 27 Jun 2006, James Morris wrote:
>
> > I'll address that in a patch to follow. Could you please test these
> > updated patches? Thanks.
> >
>
>
> Below is a relative patch which only compiles this stuff into the core
> networking code when appropriate kernel config is selected.
>
> Please review.
>
>
> ---
>
> diff -purN -X dontdiff linux-2.6.p/include/net/scm.h
> linux-2.6.w/include/net/scm.h
> --- linux-2.6.p/include/net/scm.h 2006-06-27 02:26:02.000000000 -0400
> +++ linux-2.6.w/include/net/scm.h 2006-06-27 03:03:30.000000000 -0400
> @@ -19,7 +19,9 @@ struct scm_cookie
> {
> struct ucred creds; /* Skb credentials */
> struct scm_fp_list *fp; /* Passed files */
> +#ifdef CONFIG_SECURITY_NETWORK
> char *secdata; /* Security context */
What about saving the u32 seclen with the secdata, and using it later
rather than recomputing strlen(secdata)? That also avoids encoding an
assumption in the af_unix code about the content of the data (i.e.
NUL-terminated string), leaving that to the security module.
> +#endif
> unsigned long seq; /* Connection seqno */
> };
>
> @@ -49,6 +51,17 @@ static __inline__ int scm_send(struct so
> return __scm_send(sock, msg, scm);
> }
>
> +#ifdef CONFIG_SECURITY_NETWORK
> +static inline void scm_passec(struct socket *sock, struct msghdr *msg,
> struct scm_cookie *scm)
> +{
> + if (test_bit(SOCK_PASSSEC, &sock->flags) && scm->secdata != NULL)
> + put_cmsg(msg, SOL_SOCKET, SCM_SECURITY, strlen(scm->secdata)+1,
> scm->secdata);
> +}
It would be cleaner if we had a scm->seclen to use above.
> +#ifdef CONFIG_SECURITY_NETWORKING
> +static void unix_get_peersec_dgram(struct sk_buff *skb)
> +{
> + int tmp = 0;
> +
> + err = security_socket_getpeersec_dgram(skb, UNIXSEC(skb), &tmp);
tmp should actually be u32 not int (also wrong in the original patch),
and it seems odd to throw it away rather than saving it and using it for
the put_cmsg.
--
Stephen Smalley
National Security Agency
-
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to [EMAIL PROTECTED]
More majordomo info at http://vger.kernel.org/majordomo-info.html
