summaryrefslogtreecommitdiffstats
path: root/meta-rcar-gen2/recipes-kernel/linux/linux-renesas/smack/0054-Smack-secmark-connections.patch
diff options
context:
space:
mode:
authorYannick GICQUEL <yannick.gicquel@iot.bzh>2015-10-19 15:57:07 +0200
committerGerrit Code Review <gerrit@172.30.200.200>2015-11-06 15:23:36 +0000
commitede19ea0c47fb23f3fc779833d1e57cf76f3371e (patch)
tree47d6fae2283c54def1871aaf2a73828ac68b1b34 /meta-rcar-gen2/recipes-kernel/linux/linux-renesas/smack/0054-Smack-secmark-connections.patch
parent1cd8ab18abca96e4ee108f80225058d875b28347 (diff)
kernel: smack security backport from kernel 4
Here is the backport of all patches relating to smack support on kernel side. For more details, see file: meta-rcar-gen2/recipes-kernel/linux/linux-renesas/smack/README Please note that patches are applied only if "smack" is in the ditro features. Here are the 2 lines to add in the local.conf OVERRIDES .= ":smack" DISTRO_FEATURES_append = " smack" Change-Id: I147a3532aec531f977d6ec34c576261835711f1e Signed-off-by: Yannick GICQUEL <yannick.gicquel@iot.bzh> Signed-off-by: José Bollo <jose.bollo@iot.bzh>
Diffstat (limited to 'meta-rcar-gen2/recipes-kernel/linux/linux-renesas/smack/0054-Smack-secmark-connections.patch')
-rw-r--r--meta-rcar-gen2/recipes-kernel/linux/linux-renesas/smack/0054-Smack-secmark-connections.patch50
1 files changed, 50 insertions, 0 deletions
diff --git a/meta-rcar-gen2/recipes-kernel/linux/linux-renesas/smack/0054-Smack-secmark-connections.patch b/meta-rcar-gen2/recipes-kernel/linux/linux-renesas/smack/0054-Smack-secmark-connections.patch
new file mode 100644
index 0000000..e64ff9e
--- /dev/null
+++ b/meta-rcar-gen2/recipes-kernel/linux/linux-renesas/smack/0054-Smack-secmark-connections.patch
@@ -0,0 +1,50 @@
+From 6a5bed53d2a016b6dfe09abcaabd0278f06838f4 Mon Sep 17 00:00:00 2001
+From: Casey Schaufler <casey@schaufler-ca.com>
+Date: Wed, 11 Feb 2015 12:52:32 -0800
+Subject: [PATCH 54/54] Smack: secmark connections
+
+If the secmark is available us it on connection as
+well as packet delivery.
+
+Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
+---
+ security/smack/smack_lsm.c | 16 ++++++++++++++++
+ 1 file changed, 16 insertions(+)
+
+diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c
+index 05ffb24..895fe5c 100644
+--- a/security/smack/smack_lsm.c
++++ b/security/smack/smack_lsm.c
+@@ -3819,6 +3819,18 @@ static int smack_inet_conn_request(struct sock *sk, struct sk_buff *skb,
+ }
+ #endif /* CONFIG_IPV6 */
+
++#ifdef CONFIG_SECURITY_SMACK_NETFILTER
++ /*
++ * If there is a secmark use it rather than the CIPSO label.
++ * If there is no secmark fall back to CIPSO.
++ * The secmark is assumed to reflect policy better.
++ */
++ if (skb && skb->secmark != 0) {
++ skp = smack_from_secid(skb->secmark);
++ goto access_check;
++ }
++#endif /* CONFIG_SECURITY_SMACK_NETFILTER */
++
+ netlbl_secattr_init(&secattr);
+ rc = netlbl_skbuff_getattr(skb, family, &secattr);
+ if (rc == 0)
+@@ -3827,6 +3839,10 @@ static int smack_inet_conn_request(struct sock *sk, struct sk_buff *skb,
+ skp = &smack_known_huh;
+ netlbl_secattr_destroy(&secattr);
+
++#ifdef CONFIG_SECURITY_SMACK_NETFILTER
++access_check:
++#endif
++
+ #ifdef CONFIG_AUDIT
+ smk_ad_init_net(&ad, __func__, LSM_AUDIT_DATA_NET, &net);
+ ad.a.u.net->family = family;
+--
+2.1.4
+