• Vishal Goel's avatar
    Smack: Fix the issue of wrong SMACK label update in socket bind fail case · 0c96d1f5
    Vishal Goel authored
    Fix the issue of wrong SMACK label (SMACK64IPIN) update when a second bind
    call is made to same IP address & port, but with different SMACK label
    (SMACK64IPIN) by second instance of server. In this case server returns
    with "Bind:Address already in use" error but before returning, SMACK label
    is updated in SMACK port-label mapping list inside smack_socket_bind() hook
    
    To fix this issue a new check has been added in smk_ipv6_port_label()
    function before updating the existing port entry. It checks whether the
    socket for matching port entry is closed or not. If it is closed then it
    means port is not bound and it is safe to update the existing port entry
    else return if port is still getting used. For checking whether socket is
    closed or not, one more field "smk_can_reuse" has been added in the
    "smk_port_label" structure. This field will be set to '1' in
    "smack_sk_free_security()" function which is called to free the socket
    security blob when the socket is being closed. In this function, port entry
    is searched in the SMACK port-label mapping list for the closing socket.
    If entry is found then "smk_can_reuse" field is set to '1'.Initially
    "smk_can_reuse" field is set to '0' in smk_ipv6_port_label() function after
    creating a new entry in the list which indicates that socket is in use.
    Signed-off-by: default avatarVishal Goel <vishal.goel@samsung.com>
    Signed-off-by: default avatarHimanshu Shukla <himanshu.sh@samsung.com>
    Signed-off-by: default avatarCasey Schaufler <casey@schaufler-ca.com>
    0c96d1f5
smack_lsm.c 116 KB