From ede19ea0c47fb23f3fc779833d1e57cf76f3371e Mon Sep 17 00:00:00 2001 From: Yannick GICQUEL Date: Mon, 19 Oct 2015 15:57:07 +0200 Subject: kernel: smack security backport from kernel 4 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Here is the backport of all patches relating to smack support on kernel side. For more details, see file: meta-rcar-gen2/recipes-kernel/linux/linux-renesas/smack/README Please note that patches are applied only if "smack" is in the ditro features. Here are the 2 lines to add in the local.conf OVERRIDES .= ":smack" DISTRO_FEATURES_append = " smack" Change-Id: I147a3532aec531f977d6ec34c576261835711f1e Signed-off-by: Yannick GICQUEL Signed-off-by: José Bollo --- .../smack/0054-Smack-secmark-connections.patch | 50 ++++++++++++++++++++++ 1 file changed, 50 insertions(+) create mode 100644 meta-rcar-gen2/recipes-kernel/linux/linux-renesas/smack/0054-Smack-secmark-connections.patch (limited to 'meta-rcar-gen2/recipes-kernel/linux/linux-renesas/smack/0054-Smack-secmark-connections.patch') diff --git a/meta-rcar-gen2/recipes-kernel/linux/linux-renesas/smack/0054-Smack-secmark-connections.patch b/meta-rcar-gen2/recipes-kernel/linux/linux-renesas/smack/0054-Smack-secmark-connections.patch new file mode 100644 index 0000000..e64ff9e --- /dev/null +++ b/meta-rcar-gen2/recipes-kernel/linux/linux-renesas/smack/0054-Smack-secmark-connections.patch @@ -0,0 +1,50 @@ +From 6a5bed53d2a016b6dfe09abcaabd0278f06838f4 Mon Sep 17 00:00:00 2001 +From: Casey Schaufler +Date: Wed, 11 Feb 2015 12:52:32 -0800 +Subject: [PATCH 54/54] Smack: secmark connections + +If the secmark is available us it on connection as +well as packet delivery. + +Signed-off-by: Casey Schaufler +--- + security/smack/smack_lsm.c | 16 ++++++++++++++++ + 1 file changed, 16 insertions(+) + +diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c +index 05ffb24..895fe5c 100644 +--- a/security/smack/smack_lsm.c ++++ b/security/smack/smack_lsm.c +@@ -3819,6 +3819,18 @@ static int smack_inet_conn_request(struct sock *sk, struct sk_buff *skb, + } + #endif /* CONFIG_IPV6 */ + ++#ifdef CONFIG_SECURITY_SMACK_NETFILTER ++ /* ++ * If there is a secmark use it rather than the CIPSO label. ++ * If there is no secmark fall back to CIPSO. ++ * The secmark is assumed to reflect policy better. ++ */ ++ if (skb && skb->secmark != 0) { ++ skp = smack_from_secid(skb->secmark); ++ goto access_check; ++ } ++#endif /* CONFIG_SECURITY_SMACK_NETFILTER */ ++ + netlbl_secattr_init(&secattr); + rc = netlbl_skbuff_getattr(skb, family, &secattr); + if (rc == 0) +@@ -3827,6 +3839,10 @@ static int smack_inet_conn_request(struct sock *sk, struct sk_buff *skb, + skp = &smack_known_huh; + netlbl_secattr_destroy(&secattr); + ++#ifdef CONFIG_SECURITY_SMACK_NETFILTER ++access_check: ++#endif ++ + #ifdef CONFIG_AUDIT + smk_ad_init_net(&ad, __func__, LSM_AUDIT_DATA_NET, &net); + ad.a.u.net->family = family; +-- +2.1.4 + -- cgit 1.2.3-korg