lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <53486272.6020901@schaufler-ca.com>
Date:	Fri, 11 Apr 2014 14:45:22 -0700
From:	Casey Schaufler <casey@...aufler-ca.com>
To:	Pankaj Kumar <pankaj13lvs3@...il.com>,
	linux-kernel@...r.kernel.org, linux-security-module@...r.kernel.org
CC:	pankaj.k2@...sung.com
Subject: Re: [PATCH] smack lsm bug fixes

On 2/20/2014 2:15 AM, Pankaj Kumar wrote:
> From: Pankaj Kumar <pankaj.k2@...sung.com>
>
> 1. In order to remove any SMACK extended attribute from a file, a user
> should have CAP_MAC_ADMIN capability. But any user without this
> capability is able to remove SMACK64MMAP security attribute. This error
> has been corrected by a modification in smack_inode_removexattr hook.
>
> 2. While setting extended attribute in smack_inode_setsecurity hook,
> '-EACCES' error is returned if extended attribute size or value is not
> correct. This is wrong error rather this is invalid extended attribute
> case. Corrected error '-EINVAL' shall be returned.
>
> Signed-off-by: Pankaj Kumar <pankaj.k2@...sung.com>
> Signed-off-by: Himanshu Shukla <himanshu.sh@...sung.com>

Acked-by: Casey Schaufler <casey@...aufler-ca.com>

Applied to git://git.gitorious.org/smack-next/kernel.git smack-for-3.16

> ---
>  security/smack/smack_lsm.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c
> index 14f52be..e1b1650 100644
> --- a/security/smack/smack_lsm.c
> +++ b/security/smack/smack_lsm.c
> @@ -938,7 +938,7 @@ static int smack_inode_removexattr(struct dentry
> *dentry, const char *name)
>          strcmp(name, XATTR_NAME_SMACKIPOUT) == 0 ||
>          strcmp(name, XATTR_NAME_SMACKEXEC) == 0 ||
>          strcmp(name, XATTR_NAME_SMACKTRANSMUTE) == 0 ||
> -        strcmp(name, XATTR_NAME_SMACKMMAP)) {
> +        strcmp(name, XATTR_NAME_SMACKMMAP) == 0) {
>          if (!smack_privileged(CAP_MAC_ADMIN))
>              rc = -EPERM;
>      } else
> @@ -2076,7 +2076,7 @@ static int smack_inode_setsecurity(struct inode
> *inode, const char *name,
>      int rc = 0;
>
>      if (value == NULL || size > SMK_LONGLABEL || size == 0)
> -        return -EACCES;
> +        return -EINVAL;
>
>      skp = smk_import_entry(value, size);
>      if (skp == NULL)

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ