Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1512930

Problem with setxattr on sockfs with Smack after 971df15bd54ad46e907046ff33750a137b2f0096

Show all headers | View raw

Smack has always used extended attributes to identify
the security information used to make access control
decisions on packet delivery. The two attributes
security.SMACK64_IPIN and security.SMACK64_IPOUT
contain the label used for inbound and outbound
checks respectively. A process with CAP_MAC_ADMIN can
change these values using fsetxattr() to allow a
privileged service to communicate more openly than
is allowed under the strict Smack policy.

After the xattr rework the fsetxattr() call still
sets the Smack attribute correctly, because the
smack_inode_setxattr() hook is still getting called,
but it returns EOPNOTSUPP. I believe that this is
either a result of the attribute name being unknown
to sockfs (as mentioned in the commit message) or
one of the other changes made in the process of the
xattr rework. I haven't finished the bisect yet,
but I'm reasonably certain the issue arises here.

Should I add the Smack attributes to the list of
attributes sockfs acknowledges? Is there a better
approach?

Thank you.

Back to linux.kernel | Previous | Next — Next in thread | Find similar | Unroll thread

Thread

Problem with setxattr on sockfs with Smack after  971df15bd54ad46e907046ff33750a137b2f0096 Casey Schaufler <casey@schaufler-ca.com> - 2016-10-31 23:00 +0100
  Re: Problem with setxattr on sockfs with Smack after  971df15bd54ad46e907046ff33750a137b2f0096 Casey Schaufler <casey@schaufler-ca.com> - 2016-11-01 17:20 +0100
    [PATCH] Re: Problem with setxattr on sockfs with Smack after 971df15bd54ad46e907046ff33750a137b2f0096 Andreas Gruenbacher <agruenba@redhat.com> - 2016-11-02 20:40 +0100
      Re: [PATCH] Re: Problem with setxattr on sockfs with Smack after  971df15bd54ad46e907046ff33750a137b2f0096 Casey Schaufler <casey@schaufler-ca.com> - 2016-11-02 21:10 +0100
        [PATCH] xattr: Fix setting security xattrs on sockfs Andreas Gruenbacher <agruenba@redhat.com> - 2016-11-03 14:50 +0100
          Re: [PATCH] xattr: Fix setting security xattrs on sockfs Casey Schaufler <casey@schaufler-ca.com> - 2016-11-03 17:00 +0100
            Re: [PATCH] xattr: Fix setting security xattrs on sockfs Andreas Gruenbacher <agruenba@redhat.com> - 2016-11-03 17:10 +0100
              Re: [PATCH] xattr: Fix setting security xattrs on sockfs Casey Schaufler <casey@schaufler-ca.com> - 2016-11-03 17:30 +0100

csiph-web