[NetLabel]: correct improper handling of non-NetLabel peer contexts

Fix a problem where NetLabel would always set the value of 
sk_security_struct->peer_sid in selinux_netlbl_sock_graft() to the context of
the socket, causing problems when users would query the context of the
connection.  This patch fixes this so that the value in
sk_security_struct->peer_sid is only set when the connection is NetLabel based,
otherwise the value is untouched.

Signed-off-by: Paul Moore <paul.moore@hp.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

2 files changed, 15 insertions, 0 deletions

diff --git a/include/net/cipso_ipv4.h b/include/net/cipso_ipv4.h
index 59406e0dc5b2..6718452a5cd0 100644
--- a/include/net/cipso_ipv4.h
+++ b/include/net/cipso_ipv4.h
@@ -205,6 +205,7 @@ void cipso_v4_error(struct sk_buff *skb, int error, u32 gateway);
 int cipso_v4_socket_setattr(const struct socket *sock,
                             const struct cipso_v4_doi *doi_def,
                             const struct netlbl_lsm_secattr *secattr);
+int cipso_v4_sock_getattr(struct sock *sk, struct netlbl_lsm_secattr *secattr);
 int cipso_v4_socket_getattr(const struct socket *sock,
                             struct netlbl_lsm_secattr *secattr);
 int cipso_v4_skbuff_getattr(const struct sk_buff *skb,
@@ -225,6 +226,12 @@ static inline int cipso_v4_socket_setattr(const struct socket *sock,
         return -ENOSYS;
 }
 
+static inline int cipso_v4_sock_getattr(struct sock *sk,
+                                        struct netlbl_lsm_secattr *secattr)
+{
+        return -ENOSYS;
+}
+
 static inline int cipso_v4_socket_getattr(const struct socket *sock,
                                           struct netlbl_lsm_secattr *secattr)
 {
diff --git a/include/net/netlabel.h b/include/net/netlabel.h
index dd5780b36919..bf7b564e3540 100644
--- a/include/net/netlabel.h
+++ b/include/net/netlabel.h
@@ -238,6 +238,8 @@ static inline void netlbl_secattr_free(struct netlbl_lsm_secattr *secattr,
 #ifdef CONFIG_NETLABEL
 int netlbl_socket_setattr(const struct socket *sock,
                           const struct netlbl_lsm_secattr *secattr);
+int netlbl_sock_getattr(struct sock *sk,
+                        struct netlbl_lsm_secattr *secattr);
 int netlbl_socket_getattr(const struct socket *sock,
                           struct netlbl_lsm_secattr *secattr);
 int netlbl_skbuff_getattr(const struct sk_buff *skb,
@@ -250,6 +252,12 @@ static inline int netlbl_socket_setattr(const struct socket *sock,
         return -ENOSYS;
 }
 
+static inline int netlbl_sock_getattr(struct sock *sk,
+                                      struct netlbl_lsm_secattr *secattr)
+{
+        return -ENOSYS;
+}
+
 static inline int netlbl_socket_getattr(const struct socket *sock,
                                         struct netlbl_lsm_secattr *secattr)
 {