Skip to contentSkip to conversation

fix missing security_*() check in net/compat.c

PATCH Applied Mitchell Blank Jr 4 participants 4 messages Nov 30, 2004

Subsystems (2)
Networking Network drivers
lore
Share & tools
lore

Mitchell Blank Jr

author
#0 lore raw

PATCH 1/1 fix missing security_*() check in net/compat.c

While looking at the SCM passing code in net/core/scm.c I noticed that there's a 32-bit compat implementation of scm_detach_fds()'s called scm_detach_fds_compat() living in net/compat.c. While these two functions are mostly the same the latter does not include the call to the security_file_receive() hook which is almost certainly a bug.

My sparc64 test box isn't set up currently so this is not tested. Someone running a 64-bit kernel with CONFIG_COMPAT should verify that this at least compiles.

Signed-off-by Mitchell Blank Jr <[email protected]>

-Mitch

net/compat.c +4 -0
@@ -22,6 +22,7 @@
 #include <linux/filter.h>
 #include <linux/compat.h>
 #include <linux/netfilter_ipv4/ip_tables.h>
+#include <linux/security.h>
 
 #include <net/scm.h>
 #include <net/sock.h>

@@ -264,6 +265,9 @@
 
 	for (i = 0, cmfptr = (int __user *) CMSG_COMPAT_DATA(cm); i < fdmax; i++, cmfptr++) {
 		int new_fd;
+		err = security_file_receive(fp[i]);
+		if (err)
+			break;
 		err = get_unused_fd();
 		if (err < 0)
 			break;
#1 lore raw
Quoted 11 lines · Mitchell Blank Jr

While looking at the SCM passing code in net/core/scm.c I noticed that there's a 32-bit compat implementation of scm_detach_fds()'s called scm_detach_fds_compat() living in net/compat.c. While these two functions are mostly the same the latter does not include the call to the security_file_receive() hook which is almost certainly a bug.

My sparc64 test box isn't set up currently so this is not tested. Someone running a 64-bit kernel with CONFIG_COMPAT should verify that this at least compiles.

Signed-off-by Mitchell Blank Jr <[email protected]>

Looks correct to me.

Signed-off-by James Morris <[email protected]>
Signature · 2 lines
James Morris
<[email protected]>
#2 lore raw
Quoted 12 lines · * James Morris ([email protected]) wrote:
Quoted 10 lines · Mitchell Blank Jr

While looking at the SCM passing code in net/core/scm.c I noticed that there's a 32-bit compat implementation of scm_detach_fds()'s called scm_detach_fds_compat() living in net/compat.c. While these two functions are mostly the same the latter does not include the call to the security_file_receive() hook which is almost certainly a bug.

My sparc64 test box isn't set up currently so this is not tested. Someone running a 64-bit kernel with CONFIG_COMPAT should verify that this at least compiles.

Quoted 5 lines
Quoted 1 line
Signed-off-by Mitchell Blank Jr <[email protected]>

Looks correct to me.

Signed-off-by James Morris <[email protected]>

Yup, looks fine.

thanks,
-chris

Signature · 1 line
Linux Security Modules     http://lsm.immunix.org     http://lsm.bkbits.net
maintainer Applied
#3 lore raw
Quoted 13 lines · On Tue, 30 Nov 2004 09:06:34 -0800 Chris Wright <[email protected]> wrote:
Quoted 12 lines · * James Morris ([email protected]) wrote:
Quoted 10 lines · Mitchell Blank Jr

While looking at the SCM passing code in net/core/scm.c I noticed that there's a 32-bit compat implementation of scm_detach_fds()'s called scm_detach_fds_compat() living in net/compat.c. While these two functions are mostly the same the latter does not include the call to the security_file_receive() hook which is almost certainly a bug.

My sparc64 test box isn't set up currently so this is not tested. Someone running a 64-bit kernel with CONFIG_COMPAT should verify that this at least compiles.

Quoted 7 lines
Quoted 5 lines
Quoted 1 line
Signed-off-by Mitchell Blank Jr <[email protected]>

Looks correct to me.

Signed-off-by James Morris <[email protected]>

Yup, looks fine.

Applied, thanks everyone.