diff mbox

disablenetwork (v5): Simplify the disablenetwork sendmsg hook.

Message ID 20100115081246.GA14426@heat
State RFC, archived
Delegated to: David Miller
Headers show

Commit Message

Michael Stone Jan. 15, 2010, 8:12 a.m. UTC 
The idea is that calls like

   sendto(fd, buffer, len, 0, NULL, 0);
   send(fd, buffer, len, 0)
   write(fd, buffer, len)

are all to be permitted but that calls like

   sendto(fd, buffer, len, 0, (struct sockadr *) &addr, sizeof(addr));

are to be rejected when the current task's network is disabled on the grounds
that the former calls must use previously connected sockets but that the latter
socket need not have been previously connected.

Signed-off-by: Michael Stone <michael@laptop.org>
---
  security/disablenetwork.c |    9 ++++-----
  1 files changed, 4 insertions(+), 5 deletions(-)
diff mbox

Patch

diff --git a/security/disablenetwork.c b/security/disablenetwork.c
index f45ddfc..27b88d7 100644
--- a/security/disablenetwork.c
+++ b/security/disablenetwork.c
@@ -56,11 +56,10 @@  int disablenetwork_security_socket_connect(struct socket * sock,
  int disablenetwork_security_socket_sendmsg(struct socket * sock,
  					   struct msghdr * msg, int size)
  {
-	if (sock->sk->sk_family != PF_UNIX &&
-		current->network &&
-		(msg->msg_name != NULL || msg->msg_namelen != 0))
-		return -EPERM;
-	return 0;
+	/* permit sockets which are PF_UNIX or connected; check others. */
+	if (sock->sk->sk_family == PF_UNIX || msg->msg_name == NULL)
+		return 0;
+	return maybe_allow();
  }
  
  int disablenetwork_security_ptrace_access_check(struct task_struct *child,