diff options
| author | Eric Paris <[email protected]> | 2009-03-05 18:40:35 +0000 |
|---|---|---|
| committer | James Morris <[email protected]> | 2009-03-05 21:50:18 +0000 |
| commit | 6a25b27d602aac24f3c642722377ba5d778417ec (patch) | |
| tree | ba334617326c65ccd98e7f4733c75fa0ac2ae5ca /security/selinux/hooks.c | |
| parent | smack: fixes for unlabeled host support (diff) | |
| download | kernel-6a25b27d602aac24f3c642722377ba5d778417ec.tar.gz kernel-6a25b27d602aac24f3c642722377ba5d778417ec.zip | |
SELinux: open perm for sock files
When I did open permissions I didn't think any sockets would have an open.
Turns out AF_UNIX sockets can have an open when they are bound to the
filesystem namespace. This patch adds a new SOCK_FILE__OPEN permission.
It's safe to add this as the open perms are already predicated on
capabilities and capabilities means we have unknown perm handling so
systems should be as backwards compatible as the policy wants them to
be.
https://bugzilla.redhat.com/show_bug.cgi?id=475224
Signed-off-by: Eric Paris <[email protected]>
Acked-by: Stephen Smalley <[email protected]>
Signed-off-by: James Morris <[email protected]>
Diffstat (limited to 'security/selinux/hooks.c')
| -rw-r--r-- | security/selinux/hooks.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c index 309648c573d8..cd3307a26d11 100644 --- a/security/selinux/hooks.c +++ b/security/selinux/hooks.c @@ -1838,6 +1838,8 @@ static inline u32 open_file_to_av(struct file *file) av |= FIFO_FILE__OPEN; else if (S_ISDIR(mode)) av |= DIR__OPEN; + else if (S_ISSOCK(mode)) + av |= SOCK_FILE__OPEN; else printk(KERN_ERR "SELinux: WARNING: inside %s with " "unknown mode:%o\n", __func__, mode); |