From: Stephen Smalley <sds@tycho.nsa.gov>
Date: Fri, 10 Jul 2015 21:19:57 +0000 (-0400)
Subject: selinux: initialize sock security class to default value
X-Git-Url: https://git.stricted.de/?a=commitdiff_plain;h=5dee25d08eac01472904b0ab32ce35edee5c0518;p=GitHub%2FLineageOS%2FG12%2Fandroid_kernel_amlogic_linux-4.9.git

selinux: initialize sock security class to default value

Initialize the security class of sock security structures
to the generic socket class.  This is similar to what is
already done in inode_alloc_security for files.  Generally
the sclass field will later by set by socket_post_create
or sk_clone or sock_graft, but for protocol implementations
that fail to call any of these for newly accepted sockets,
we want some sane default that will yield a legitimate
avc denied message with non-garbage values for class and
permission.

Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
Signed-off-by: Paul Moore <pmoore@redhat.com>
---

diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index 4de09f0227b4..ef310f82717d 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -4559,6 +4559,7 @@ static int selinux_sk_alloc_security(struct sock *sk, int family, gfp_t priority
 
 	sksec->peer_sid = SECINITSID_UNLABELED;
 	sksec->sid = SECINITSID_UNLABELED;
+	sksec->sclass = SECCLASS_SOCKET;
 	selinux_netlbl_sk_security_reset(sksec);
 	sk->sk_security = sksec;