From: Etienne Basset Date: Thu, 16 Apr 2009 21:58:42 +0000 (+0200) Subject: Smack: check for SMACK xattr validity in smack_inode_setxattr X-Git-Url: http://git.lede-project.org./?a=commitdiff_plain;h=defc433ba3bc587826bb467ce0e63452deafa65d;p=openwrt%2Fstaging%2Fblogic.git Smack: check for SMACK xattr validity in smack_inode_setxattr the following patch moves checks for SMACK xattr validity from smack_inode_post_setxattr (which cannot return an error to the user) to smack_inode_setxattr (which can return an error). Signed-off-by: Etienne Basset Acked-by: Casey Schaufler Signed-off-by: James Morris --- diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c index 921514902eca..98b3195347ab 100644 --- a/security/smack/smack_lsm.c +++ b/security/smack/smack_lsm.c @@ -609,8 +609,12 @@ static int smack_inode_setxattr(struct dentry *dentry, const char *name, strcmp(name, XATTR_NAME_SMACKIPOUT) == 0) { if (!capable(CAP_MAC_ADMIN)) rc = -EPERM; - /* a label cannot be void and cannot begin with '-' */ - if (size == 0 || (size > 0 && ((char *)value)[0] == '-')) + /* + * check label validity here so import wont fail on + * post_setxattr + */ + if (size == 0 || size >= SMK_LABELLEN || + smk_import(value, size) == NULL) rc = -EINVAL; } else rc = cap_inode_setxattr(dentry, name, value, size, flags); @@ -644,9 +648,6 @@ static void smack_inode_post_setxattr(struct dentry *dentry, const char *name, if (strcmp(name, XATTR_NAME_SMACK)) return; - if (size >= SMK_LABELLEN) - return; - isp = dentry->d_inode->i_security; /*