aboutsummaryrefslogtreecommitdiffstats
path: root/security/selinux
diff options
context:
space:
mode:
authorPaul Moore <paul.moore@hp.com>2009-02-20 16:33:02 -0500
committerJames Morris <jmorris@namei.org>2009-02-22 18:05:55 -0500
commit09c50b4a52c01a1f450b8eec819089e228655bfb (patch)
treed97bcaf9544e58a8a6bc6aeb40ca9793411d3e79 /security/selinux
parent586c25003707067f074043d80fb2071671c58db0 (diff)
selinux: Fix the NetLabel glue code for setsockopt()
At some point we (okay, I) managed to break the ability for users to use the setsockopt() syscall to set IPv4 options when NetLabel was not active on the socket in question. The problem was noticed by someone trying to use the "-R" (record route) option of ping: # ping -R 10.0.0.1 ping: record route: No message of desired type The solution is relatively simple, we catch the unlabeled socket case and clear the error code, allowing the operation to succeed. Please note that we still deny users the ability to override IPv4 options on socket's which have NetLabel labeling active; this is done to ensure the labeling remains intact. Signed-off-by: Paul Moore <paul.moore@hp.com> Signed-off-by: James Morris <jmorris@namei.org>
Diffstat (limited to 'security/selinux')
-rw-r--r--security/selinux/netlabel.c4
1 files changed, 3 insertions, 1 deletions
diff --git a/security/selinux/netlabel.c b/security/selinux/netlabel.c
index f58701a7b728..3f4b26647386 100644
--- a/security/selinux/netlabel.c
+++ b/security/selinux/netlabel.c
@@ -490,8 +490,10 @@ int selinux_netlbl_socket_setsockopt(struct socket *sock,
490 lock_sock(sk); 490 lock_sock(sk);
491 rc = netlbl_sock_getattr(sk, &secattr); 491 rc = netlbl_sock_getattr(sk, &secattr);
492 release_sock(sk); 492 release_sock(sk);
493 if (rc == 0 && secattr.flags != NETLBL_SECATTR_NONE) 493 if (rc == 0)
494 rc = -EACCES; 494 rc = -EACCES;
495 else if (rc == -ENOMSG)
496 rc = 0;
495 netlbl_secattr_destroy(&secattr); 497 netlbl_secattr_destroy(&secattr);
496 } 498 }
497 499