From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751685AbcKAQKx (ORCPT ); Tue, 1 Nov 2016 12:10:53 -0400 Received: from nm20-vm3.bullet.mail.ne1.yahoo.com ([98.138.91.150]:52032 "EHLO nm20-vm3.bullet.mail.ne1.yahoo.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750928AbcKAQKw (ORCPT ); Tue, 1 Nov 2016 12:10:52 -0400 X-Yahoo-Newman-Id: 962799.12450.bm@smtp109.mail.ne1.yahoo.com X-Yahoo-Newman-Property: ymail-3 X-YMail-OSG: 54vCp2IVM1mmaFpniPXPkxy5ur9lE_wTQP5p6DV4xf0kjuS u4cXuweP4bRDzU79GURrVmjPG8Sb5zq6cOUCZA1Xfm4Hy5UIxEMWGMTp16_q at9maOqZQgxqTeGf6AqeGtBARQJB1UUMZ9MI0NwLfO5WeFxMNp6p2Y5s7NGj O02QZBazrWso2ikHo6Q5BEBRyd_30vxO8qO8vr6vQIfzA_KwEBgREmTC_OYF u.WbXePCGETA9eQZgt1ebOIiFwz0e9HCtMo.yM_E82_.QNlIw3Zr7IQ23QdL 3yNZDgNyfoX7m6Rutp3tv0idumkI0.S4HKqDx6uVABvwoe.xfZLnT7CLcjaD uI0eZUfJRi6uB5m8i7TEkMP1SUpDwjZSfJzKcf3PCzYPB_6tmiPzj27QmAIr Q8VFsHtgwbQGlb36zeYJrakNqXLyxSxrc_obYvCITcaHBr6eNftf90Dl8La9 6JiE5Awsv0YHPZJLcjw_q3IYS5OObP05gzJh6A7CTc93b3LJYnsX.WPQMI7D Ff9bbLV_1X2pCLj9ghu_ytfMcqaHvAk1OZh66qJtgWgQfqYJfYIkkrEYhPMG vqPxt90Iq596B5L6v X-Yahoo-SMTP: OIJXglSswBDfgLtXluJ6wiAYv6_cnw-- Subject: Re: Problem with setxattr on sockfs with Smack after 971df15bd54ad46e907046ff33750a137b2f0096 To: Andreas Gruenbacher , Al Viro References: Cc: LKLM , LSM From: Casey Schaufler Message-ID: Date: Tue, 1 Nov 2016 09:10:49 -0700 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:45.0) Gecko/20100101 Thunderbird/45.4.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 7bit Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On 10/31/2016 2:55 PM, Casey Schaufler wrote: > Smack has always used extended attributes to identify > the security information used to make access control > decisions on packet delivery. The two attributes > security.SMACK64_IPIN and security.SMACK64_IPOUT > contain the label used for inbound and outbound > checks respectively. A process with CAP_MAC_ADMIN can > change these values using fsetxattr() to allow a > privileged service to communicate more openly than > is allowed under the strict Smack policy. > > After the xattr rework the fsetxattr() call still > sets the Smack attribute correctly, because the > smack_inode_setxattr() hook is still getting called, > but it returns EOPNOTSUPP. I believe that this is > either a result of the attribute name being unknown > to sockfs (as mentioned in the commit message) or > one of the other changes made in the process of the > xattr rework. I haven't finished the bisect yet, > but I'm reasonably certain the issue arises here. The final results from bisect say that the problem hit in 6c6ef9f26e598fb977f60935e109cd5b266c941a - xattr: stop calling {get,set,remove}xattr inode operations > > Should I add the Smack attributes to the list of > attributes sockfs acknowledges? Is there a better > approach? > > Thank you. > > -- > To unsubscribe from this list: send the line "unsubscribe linux-security-module" in > the body of a message to majordomo@vger.kernel.org > More majordomo info at http://vger.kernel.org/majordomo-info.html >