On 4/16/2015 6:40 AM, Seung-Woo Kim wrote: > The dma-buf fd from anon_inode can be shared across processes, but > there is no way to set security permission for the fd. So this > patch fix just to ignore private inode from security_file_receive. > > Signed-off-by: Seung-Woo Kim <[email protected]> > --- > > If security like smack is enabled, the dmabuf fd can not be shared between > processes via unix domain socket. I am not familiar with security, so I am > not sure that this kind of patch can be acceptable.
If an IS_PRIVATE() check is appropriate, it should be in smack_file_receive(), not security_file_receive(). Why are you looking at file->f_path.dentry->d_inode? That's not used in the Smack access check. You'd want file->f_inode if anything. Naked-by: Casey Schaufler <[email protected]> > > Is there other option to share dmabuf fd via socket with security check? > > Best Regards, > - Seung-Woo Kim > > --- > security/security.c | 3 +++ > 1 files changed, 3 insertions(+), 0 deletions(-) > > diff --git a/security/security.c b/security/security.c > index 730ac65..c57354c 100644 > --- a/security/security.c > +++ b/security/security.c > @@ -810,6 +810,9 @@ int security_file_send_sigiotask(struct task_struct *tsk, > > int security_file_receive(struct file *file) > { > + > + if (unlikely(IS_PRIVATE(file->f_path.dentry->d_inode))) > + return 0; > return security_ops->file_receive(file); > } > -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to [email protected] More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
