linux-kernel - Re: [TOMOYO 14/15](repost) LSM expansion for TOMOYO Linux.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <Xine.LNX.4.64.0710020653470.28698@us.intercode.com.au>
Date:	Tue, 2 Oct 2007 07:36:32 -0700 (PDT)
From:	James Morris <jmorris@...ei.org>
To:	Kentaro Takeda <takedakn@...data.co.jp>
cc:	linux-kernel@...r.kernel.org,
	linux-security-module@...r.kernel.org,
	Chris Wright <chrisw@...s-sol.org>,
	"David S. Miller" <davem@...emloft.net>
Subject: Re: [TOMOYO 14/15](repost) LSM expansion for TOMOYO Linux.

On Tue, 2 Oct 2007, Kentaro Takeda wrote:


> --- linux-2.6.orig/net/core/datagram.c	2007-10-02 11:11:51.000000000 +0900
> +++ linux-2.6/net/core/datagram.c	2007-10-02 11:26:23.000000000 +0900
> @@ -55,6 +55,7 @@
>  #include <net/checksum.h>
>  #include <net/sock.h>
>  #include <net/tcp_states.h>
> +#include <linux/security.h>
>  
>  /*
>   *	Is a socket 'connection oriented' ?
> @@ -178,6 +179,27 @@ struct sk_buff *skb_recv_datagram(struct
>  		} else
>  			skb = skb_dequeue(&sk->sk_receive_queue);
>  
> +		error = security_post_recv_datagram(sk, skb, flags);
> +		if (error) {
> +			unsigned long cpu_flags;
> +
> +			if (!(flags & MSG_PEEK))
> +				goto no_peek;
> +
> +			spin_lock_irqsave(&sk->sk_receive_queue.lock,
> +					  cpu_flags);
> +			if (skb == skb_peek(&sk->sk_receive_queue)) {
> +				__skb_unlink(skb,
> +					     &sk->sk_receive_queue);
> +				atomic_dec(&skb->users);
> +			}
> +			spin_unlock_irqrestore(&sk->sk_receive_queue.lock,
> +					       cpu_flags);
> +no_peek:
> +			skb_free_datagram(sk, skb);
> +			goto no_packet;
> +		}
> +
>  		if (skb)
>  			return skb;

I'm guessing you need this to determine the receiving process, rather than 
the socket (which is available via security_sock_rcv_skb()).

If so, is this to interactively determine from the user or admin whether 
the packet should be accepted/denied for the receiving process?


- James
-- 
James Morris
<jmorris@...ei.org>
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/