SELinux: Return correct context for SO_PEERSEC

Fix SO_PEERSEC for tcp sockets to return the security context of
the peer (as represented by the SA from the peer) as opposed to the
SA used by the local/source socket.

Signed-off-by: Venkat Yekkirala <vyekkirala@TrustedCS.com>
Signed-off-by: James Morris <jmorris@namei.org>

2 files changed, 16 insertions, 1 deletions

diff --git a/include/linux/security.h b/include/linux/security.h
index a509329a669b..84cebcdb3f83 100644
--- a/include/linux/security.h
+++ b/include/linux/security.h
@@ -826,6 +826,8 @@ struct request_sock;
  *      Sets the openreq's sid to socket's sid with MLS portion taken from peer sid.
  * @inet_csk_clone:
  *      Sets the new child socket's sid to the openreq sid.
+ * @inet_conn_established:
+ *     Sets the connection's peersid to the secmark on skb.
  * @req_classify_flow:
  *      Sets the flow's sid to the openreq sid.
  *
@@ -1368,6 +1370,7 @@ struct security_operations {
         int (*inet_conn_request)(struct sock *sk, struct sk_buff *skb,
                                         struct request_sock *req);
         void (*inet_csk_clone)(struct sock *newsk, const struct request_sock *req);
+        void (*inet_conn_established)(struct sock *sk, struct sk_buff *skb);
         void (*req_classify_flow)(const struct request_sock *req, struct flowi *fl);
 #endif  /* CONFIG_SECURITY_NETWORK */
 
@@ -2961,9 +2964,15 @@ static inline void security_inet_csk_clone(struct sock *newsk,
 {
         security_ops->inet_csk_clone(newsk, req);
 }
+
+static inline void security_inet_conn_established(struct sock *sk,
+                        struct sk_buff *skb)
+{
+        security_ops->inet_conn_established(sk, skb);
+}
 #else   /* CONFIG_SECURITY_NETWORK */
 static inline int security_unix_stream_connect(struct socket * sock,
-                                               struct socket * other, 
+                                               struct socket * other,
                                                struct sock * newsk)
 {
         return 0;
@@ -3110,6 +3119,11 @@ static inline void security_inet_csk_clone(struct sock *newsk,
                         const struct request_sock *req)
 {
 }
+
+static inline void security_inet_conn_established(struct sock *sk,
+                        struct sk_buff *skb)
+{
+}
 #endif  /* CONFIG_SECURITY_NETWORK */
 
 #ifdef CONFIG_SECURITY_NETWORK_XFRM
diff --git a/include/net/request_sock.h b/include/net/request_sock.h
index 8e165ca16bd8..f743a941a4f2 100644
--- a/include/net/request_sock.h
+++ b/include/net/request_sock.h
@@ -54,6 +54,7 @@ struct request_sock {
         struct request_sock_ops         *rsk_ops;
         struct sock                     *sk;
         u32                             secid;
+        u32                             peer_secid;
 };
 
 static inline struct request_sock *reqsk_alloc(struct request_sock_ops *ops)