Re: [PATCH] smack lsm bug fixes

[Casey Schaufler]

On 2/20/2014 2:15 AM, Pankaj Kumar wrote:
> From: Pankaj Kumar <pankaj.k2@xxxxxxxxxxx>
>
> 1. In order to remove any SMACK extended attribute from a file, a user
> should have CAP_MAC_ADMIN capability. But any user without this
> capability is able to remove SMACK64MMAP security attribute. This error
> has been corrected by a modification in smack_inode_removexattr hook.
>
> 2. While setting extended attribute in smack_inode_setsecurity hook,
> '-EACCES' error is returned if extended attribute size or value is not
> correct. This is wrong error rather this is invalid extended attribute
> case. Corrected error '-EINVAL' shall be returned.
>
> Signed-off-by: Pankaj Kumar <pankaj.k2@xxxxxxxxxxx>
> Signed-off-by: Himanshu Shukla <himanshu.sh@xxxxxxxxxxx>

Acked-by: Casey Schaufler <casey@xxxxxxxxxxxxxxxx>

Applied to git://git.gitorious.org/smack-next/kernel.git smack-for-3.16

> ---
>  security/smack/smack_lsm.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c
> index 14f52be..e1b1650 100644
> --- a/security/smack/smack_lsm.c
> +++ b/security/smack/smack_lsm.c
> @@ -938,7 +938,7 @@ static int smack_inode_removexattr(struct dentry
> *dentry, const char *name)
>          strcmp(name, XATTR_NAME_SMACKIPOUT) == 0 ||
>          strcmp(name, XATTR_NAME_SMACKEXEC) == 0 ||
>          strcmp(name, XATTR_NAME_SMACKTRANSMUTE) == 0 ||
> -        strcmp(name, XATTR_NAME_SMACKMMAP)) {
> +        strcmp(name, XATTR_NAME_SMACKMMAP) == 0) {
>          if (!smack_privileged(CAP_MAC_ADMIN))
>              rc = -EPERM;
>      } else
> @@ -2076,7 +2076,7 @@ static int smack_inode_setsecurity(struct inode
> *inode, const char *name,
>      int rc = 0;
>
>      if (value == NULL || size > SMK_LONGLABEL || size == 0)
> -        return -EACCES;
> +        return -EINVAL;
>
>      skp = smk_import_entry(value, size);
>      if (skp == NULL)

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/