From 2148ccc437a9eac9f0d4b3c27cb1e41f6a48194c Mon Sep 17 00:00:00 2001 From: David Woodhouse Date: Fri, 29 Sep 2006 15:50:25 -0700 Subject: [PATCH] MLSXFRM: fix mis-labelling of child sockets Accepted connections of types other than AF_INET, AF_INET6, AF_UNIX won't have an appropriate label derived from the peer, so don't use it. Signed-off-by: David Woodhouse Acked-by: Stephen Smalley Acked-by: James Morris Acked-by: Paul Moore Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds --- security/selinux/hooks.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) (limited to 'security') diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c index cac0273ec44..e9969a2fc84 100644 --- a/security/selinux/hooks.c +++ b/security/selinux/hooks.c @@ -3619,7 +3619,9 @@ static void selinux_sock_graft(struct sock* sk, struct socket *parent) struct inode_security_struct *isec = SOCK_INODE(parent)->i_security; struct sk_security_struct *sksec = sk->sk_security; - isec->sid = sksec->sid; + if (sk->sk_family == PF_INET || sk->sk_family == PF_INET6 || + sk->sk_family == PF_UNIX) + isec->sid = sksec->sid; selinux_netlbl_sock_graft(sk, parent); } -- cgit v1.2.3-70-g09d2