linux-kernel - Re: [PATCH] smack lsm bug fixes

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <53486272.6020901@schaufler-ca.com>
Date:	Fri, 11 Apr 2014 14:45:22 -0700
From:	Casey Schaufler <casey@...aufler-ca.com>
To:	Pankaj Kumar <pankaj13lvs3@...il.com>,
	linux-kernel@...r.kernel.org, linux-security-module@...r.kernel.org
CC:	pankaj.k2@...sung.com
Subject: Re: [PATCH] smack lsm bug fixes

On 2/20/2014 2:15 AM, Pankaj Kumar wrote:
> From: Pankaj Kumar <pankaj.k2@...sung.com>
>
> 1. In order to remove any SMACK extended attribute from a file, a user
> should have CAP_MAC_ADMIN capability. But any user without this
> capability is able to remove SMACK64MMAP security attribute. This error
> has been corrected by a modification in smack_inode_removexattr hook.
>
> 2. While setting extended attribute in smack_inode_setsecurity hook,
> '-EACCES' error is returned if extended attribute size or value is not
> correct. This is wrong error rather this is invalid extended attribute
> case. Corrected error '-EINVAL' shall be returned.
>
> Signed-off-by: Pankaj Kumar <pankaj.k2@...sung.com>
> Signed-off-by: Himanshu Shukla <himanshu.sh@...sung.com>

Acked-by: Casey Schaufler <casey@...aufler-ca.com>

Applied to git://git.gitorious.org/smack-next/kernel.git smack-for-3.16

> ---
>  security/smack/smack_lsm.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c
> index 14f52be..e1b1650 100644
> --- a/security/smack/smack_lsm.c
> +++ b/security/smack/smack_lsm.c
> @@ -938,7 +938,7 @@ static int smack_inode_removexattr(struct dentry
> *dentry, const char *name)
>          strcmp(name, XATTR_NAME_SMACKIPOUT) == 0 ||
>          strcmp(name, XATTR_NAME_SMACKEXEC) == 0 ||
>          strcmp(name, XATTR_NAME_SMACKTRANSMUTE) == 0 ||
> -        strcmp(name, XATTR_NAME_SMACKMMAP)) {
> +        strcmp(name, XATTR_NAME_SMACKMMAP) == 0) {
>          if (!smack_privileged(CAP_MAC_ADMIN))
>              rc = -EPERM;
>      } else
> @@ -2076,7 +2076,7 @@ static int smack_inode_setsecurity(struct inode
> *inode, const char *name,
>      int rc = 0;
>
>      if (value == NULL || size > SMK_LONGLABEL || size == 0)
> -        return -EACCES;
> +        return -EINVAL;
>
>      skp = smk_import_entry(value, size);
>      if (skp == NULL)

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/