crypto: af_alg - properly label AF_ALG socket

Th AF_ALG socket was missing a security label (e.g. SELinux) which means that socket was in "unlabeled" state. This was recently demonstrated in the cryptsetup package (cryptsetup v1.6.5 and later.) See https://bugzilla.redhat.com/show_bug.cgi?id=1115120 This patch clones the sock's label from the parent sock and resolves the issue (similar to AF_BLUETOOTH protocol family). Cc: [email protected] Signed-off-by: Milan Broz <[email protected]> Acked-by: Paul Moore <[email protected]> Signed-off-by: Herbert Xu <[email protected]>
powerwareeasyman · Jul 31, 2014 · 4c63f83 · 4c63f83
1 parent f3c400e
commit 4c63f83
Showing 1 changed file with 2 additions and 0 deletions.
diff --git a/crypto/af_alg.c b/crypto/af_alg.c
@@ -21,6 +21,7 @@
 #include <linux/module.h>
 #include <linux/net.h>
 #include <linux/rwsem.h>
+#include <linux/security.h>
 
 struct alg_type_list {
 	const struct af_alg_type *type;
@@ -243,6 +244,7 @@ int af_alg_accept(struct sock *sk, struct socket *newsock)
 
 	sock_init_data(newsock, sk2);
 	sock_graft(sk2, newsock);
+	security_sk_clone(sk, sk2);
 
 	err = type->accept(ask->private, sk2);
 	if (err) {