diff options
| author | Paolo Abeni <pabeni@redhat.com> | 2023-04-20 20:17:14 +0300 |
|---|---|---|
| committer | Paul Moore <paul@paul-moore.com> | 2023-05-18 20:11:10 +0300 |
| commit | 85c3222dddc6697dc7513623983a2ba748ba710e (patch) | |
| tree | 818980ab9317efd310646f88716eb67be87f818c /security/selinux/netlabel.c | |
| parent | e3d9387f002612093dbeaa272f7930ce5108033f (diff) | |
| download | linux-85c3222dddc6697dc7513623983a2ba748ba710e.tar.xz | |
selinux: Implement mptcp_add_subflow hook
Newly added subflows should inherit the LSM label from the associated
MPTCP socket regardless of the current context.
This patch implements the above copying sid and class from the MPTCP
socket context, deleting the existing subflow label, if any, and then
re-creating the correct one.
The new helper reuses the selinux_netlbl_sk_security_free() function,
and the latter can end-up being called multiple times with the same
argument; we additionally need to make it idempotent.
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Acked-by: Matthieu Baerts <matthieu.baerts@tessares.net>
Signed-off-by: Matthieu Baerts <matthieu.baerts@tessares.net>
Signed-off-by: Paul Moore <paul@paul-moore.com>
Diffstat (limited to 'security/selinux/netlabel.c')
| -rw-r--r-- | security/selinux/netlabel.c | 8 |
1 files changed, 6 insertions, 2 deletions
diff --git a/security/selinux/netlabel.c b/security/selinux/netlabel.c index 767c670d33ea..528f5186e912 100644 --- a/security/selinux/netlabel.c +++ b/security/selinux/netlabel.c @@ -154,8 +154,12 @@ void selinux_netlbl_err(struct sk_buff *skb, u16 family, int error, int gateway) */ void selinux_netlbl_sk_security_free(struct sk_security_struct *sksec) { - if (sksec->nlbl_secattr != NULL) - netlbl_secattr_free(sksec->nlbl_secattr); + if (!sksec->nlbl_secattr) + return; + + netlbl_secattr_free(sksec->nlbl_secattr); + sksec->nlbl_secattr = NULL; + sksec->nlbl_state = NLBL_UNSET; } /** |