• Vishal Goel's avatar
    Smack: Fix the issue of permission denied error in ipv6 hook · 9d44c973
    Vishal Goel authored
    Permission denied error comes when 2 IPv6 servers are running and client
    tries to connect one of them. Scenario is that both servers are using same
    IP and port but different protocols(Udp and tcp). They are using different
    SMACK64IPIN labels.Tcp server is using "test" and udp server is using
    "test-in". When we try to run tcp client with SMACK64IPOUT label as "test",
    then connection denied error comes. It should not happen since both tcp
    server and client labels are same.This happens because there is no check
    for protocol in smk_ipv6_port_label() function while searching for the
    earlier port entry. It checks whether there is an existing port entry on
    the basis of port only. So it updates the earlier port entry in the list.
    Due to which smack label gets changed for earlier entry in the
    "smk_ipv6_port_list" list and permission denied error comes.
    
    Now a check is added for socket type also.Now if 2 processes use same
    port  but different protocols (tcp or udp), then 2 different port entries
    will be  added in the list. Similarly while checking smack access in
    smk_ipv6_port_check() function,  port entry is searched on the basis of
    both port and protocol.
    Signed-off-by: default avatarVishal Goel <vishal.goel@samsung.com>
    Signed-off-by: default avatarHimanshu Shukla <Himanshu.sh@samsung.com>
    Signed-off-by: default avatarCasey Schaufler <casey@schaufler-ca.com>
    9d44c973
smack_lsm.c 116 KB