Commit 195da3ff authored by Konstantin Andreev's avatar Konstantin Andreev Committed by Casey Schaufler
Browse files

smack: fix bug: SMACK64TRANSMUTE set on non-directory 

When a new file system object is created
and the conditions for label transmutation are met,
the SMACK64TRANSMUTE extended attribute is set
on the object regardless of its type:
file, pipe, socket, symlink, or directory.

However,
SMACK64TRANSMUTE may only be set on directories.

This bug is a combined effect of the commits [1] and [2]
which both transfer functionality
from smack_d_instantiate() to smack_inode_init_security(),
but only in part.

Commit [1] set blank  SMACK64TRANSMUTE on improper object types.
Commit [2] set "TRUE" SMACK64TRANSMUTE on improper object types.

[1] 2023-06-10,
Fixes: baed456a ("smack: Set the SMACK64TRANSMUTE xattr in smack_inode_init_security()")
Link: https://lore.kernel.org/linux-security-module/20230610075738.3273764-3-roberto.sassu@huaweicloud.com/

[2] 2023-11-16,
Fixes: e63d86b8 ("smack: Initialize the in-memory inode in smack_inode_init_security()")
Link: https://lore.kernel.org/linux-security-module/20231116090125.187209-5-roberto.sassu@huaweicloud.com/



Signed-off-by: default avatarKonstantin Andreev <andreev@swemel.ru>
Signed-off-by: default avatarCasey Schaufler <casey@schaufler-ca.com>
parent 635a01da

security/smack/smack_lsm.c

+14 −12
Original line number Diff line number Diff line
@@ -1027,6 +1027,7 @@ static int smack_inode_init_security(struct inode *inode, struct inode *dir, 
		if (!trans_cred)

			issp->smk_inode = dsp;



		if (S_ISDIR(inode->i_mode)) {

			issp->smk_flags |= SMK_INODE_TRANSMUTE;

			xattr_transmute = lsm_get_xattr_slot(xattrs,

							     xattr_count);
@@ -1041,6 +1042,7 @@ static int smack_inode_init_security(struct inode *inode, struct inode *dir, 
				xattr_transmute->name = XATTR_SMACK_TRANSMUTE;

			}

		}

	}



	issp->smk_flags |= SMK_INODE_INSTANT;