From: David Woodhouse <dwmw2@infradead.org>
Date: Fri, 29 Sep 2006 22:50:25 +0000 (-0700)
Subject: [PATCH] MLSXFRM: fix mis-labelling of child sockets
X-Git-Url: http://git.lede-project.org./?a=commitdiff_plain;h=2148ccc437a9eac9f0d4b3c27cb1e41f6a48194c;p=openwrt%2Fstaging%2Fblogic.git

[PATCH] MLSXFRM: fix mis-labelling of child sockets

Accepted connections of types other than AF_INET, AF_INET6, AF_UNIX won't
have an appropriate label derived from the peer, so don't use it.

Signed-off-by: David Woodhouse <dwmw2@infradead.org>
Acked-by: Stephen Smalley <sds@tycho.nsa.gov>
Acked-by: James Morris <jmorris@namei.org>
Acked-by: Paul Moore <paul.moore@hp.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
---

diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index cac0273ec447..e9969a2fc846 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -3619,7 +3619,9 @@ static void selinux_sock_graft(struct sock* sk, struct socket *parent)
 	struct inode_security_struct *isec = SOCK_INODE(parent)->i_security;
 	struct sk_security_struct *sksec = sk->sk_security;
 
-	isec->sid = sksec->sid;
+	if (sk->sk_family == PF_INET || sk->sk_family == PF_INET6 ||
+	    sk->sk_family == PF_UNIX)
+		isec->sid = sksec->sid;
 
 	selinux_netlbl_sock_graft(sk, parent);
 }