Repository files (latest commit first)

Filename	Latest commit message	Latest commit date
Konstantin Andreev 99d862c931 smack: recognize ipv4 CIPSO w/o categories ... [ Upstream commit a158a937d864d0034fea14913c1f09c6d5f574b8 ] If SMACK label has CIPSO representation w/o categories, e.g.: | # cat /smack/cipso2 | foo 10 | @ 250/2 | ... then SMACK does not recognize such CIPSO in input ipv4 packets and substitues '*' label instead. Audit records may look like | lsm=SMACK fn=smack_socket_sock_rcv_skb action=denied | subject="*" object="_" requested=w pid=0 comm="swapper/1" ... This happens in two steps: 1) security/smack/smackfs.c`smk_set_cipso does not clear NETLBL_SECATTR_MLS_CAT from (struct smack_known *)skp->smk_netlabel.flags on assigning CIPSO w/o categories: | rcu_assign_pointer(skp->smk_netlabel.attr.mls.cat, ncats.attr.mls.cat); | skp->smk_netlabel.attr.mls.lvl = ncats.attr.mls.lvl; 2) security/smack/smack_lsm.c`smack_from_secattr can not match skp->smk_netlabel with input packet's struct netlbl_lsm_secattr *sap because sap->flags have not NETLBL_SECATTR_MLS_CAT (what is correct) but skp->smk_netlabel.flags have (what is incorrect): | if ((sap->flags & NETLBL_SECATTR_MLS_CAT) == 0) { | if ((skp->smk_netlabel.flags & | NETLBL_SECATTR_MLS_CAT) == 0) | found = 1; | break; | } This commit sets/clears NETLBL_SECATTR_MLS_CAT in skp->smk_netlabel.flags according to the presense of CIPSO categories. The update of smk_netlabel is not atomic, so input packets processing still may be incorrect during short time while update proceeds. Signed-off-by: Konstantin Andreev <andreev@swemel.ru> Signed-off-by: Casey Schaufler <casey@schaufler-ca.com> Signed-off-by: Sasha Levin <sashal@kernel.org>		2025-06-04 14:32:33 +02:00
..
apparmor	apparmor: fix 'Do simple duplicate message elimination'	2024-12-14 19:44:34 +01:00
integrity	ima: Fix use-after-free on a dentry's dname.name	2025-03-13 12:43:19 +01:00
keys	security/keys: fix slab-out-of-bounds in key_task_permission	2024-11-17 14:58:50 +01:00
loadpin
lockdown
safesetid
selinux	selinux: ignore unknown extended permissions	2025-01-09 13:23:33 +01:00
smack	smack: recognize ipv4 CIPSO w/o categories	2025-06-04 14:32:33 +02:00
tomoyo	tomoyo: don't emit warning in tomoyo_write_control()	2025-03-13 12:43:03 +01:00
yama
commoncap.c
device_cgroup.c
inode.c
Kconfig	proc: add config & param to block forcing mem writes	2024-11-08 16:20:38 +01:00
Kconfig.hardening
lsm_audit.c
Makefile
min_addr.c
security.c	lsm: new security_file_ioctl_compat() hook	2024-02-23 08:25:15 +01:00