diff options
| author | Kuniyuki Iwashima <kuniyu@amazon.com> | 2023-10-30 13:10:41 -0700 |
|---|---|---|
| committer | Paolo Abeni <pabeni@redhat.com> | 2023-11-02 12:55:42 +0100 |
| commit | fa2df45af13091f76b89adb84a28f13818d5d631 (patch) | |
| tree | a9e382d7a49d843f00c0902e89990e860bd37a43 /net/ipv6 | |
| parent | a1602d749097386ec9e8e411a16a9c37ff6cd5fc (diff) | |
dccp: Call security_inet_conn_request() after setting IPv4 addresses.
Initially, commit 4237c75c0a35 ("[MLSXFRM]: Auto-labeling of child
sockets") introduced security_inet_conn_request() in some functions
where reqsk is allocated. The hook is added just after the allocation,
so reqsk's IPv4 remote address was not initialised then.
However, SELinux/Smack started to read it in netlbl_req_setattr()
after the cited commits.
This bug was partially fixed by commit 284904aa7946 ("lsm: Relocate
the IPv4 security_inet_conn_request() hooks").
This patch fixes the last bug in DCCPv4.
Fixes: 389fb800ac8b ("netlabel: Label incoming TCP connections correctly in SELinux")
Fixes: 07feee8f812f ("netlabel: Cleanup the Smack/NetLabel code to fix incoming TCP connections")
Signed-off-by: Kuniyuki Iwashima <kuniyu@amazon.com>
Acked-by: Paul Moore <paul@paul-moore.com>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Diffstat (limited to 'net/ipv6')
0 files changed, 0 insertions, 0 deletions