From 66c7d5365a7812f530d15962fd3640db5a2d4b15 Mon Sep 17 00:00:00 2001 From: Michael Tuexen Date: Thu, 26 Sep 2024 08:06:24 +0200 Subject: [PATCH] MAC: improve handling of listening sockets so_peerlabel can only be used when the socket is not listening. Reviewed by: markj Sponsored by: Netflix, Inc. Differential Revision: https://reviews.freebsd.org/D46755 (cherry picked from commit 2fb778fab893b4a8a86ecfa20acf2e23bb2cdae8) --- sys/kern/uipc_socket.c | 5 +++++ sys/security/mac/mac_internal.h | 1 + sys/security/mac/mac_socket.c | 19 +++++++++++++------ 3 files changed, 19 insertions(+), 6 deletions(-) diff --git a/sys/kern/uipc_socket.c b/sys/kern/uipc_socket.c index a038939399e3..4621339c4429 100644 --- a/sys/kern/uipc_socket.c +++ b/sys/kern/uipc_socket.c @@ -155,6 +155,7 @@ #include #include +#include #include @@ -1466,6 +1467,10 @@ solisten_proto(struct socket *so, int backlog) sbrcv_timeo = so->so_rcv.sb_timeo; sbsnd_timeo = so->so_snd.sb_timeo; +#ifdef MAC + mac_socketpeer_label_free(so->so_peerlabel); +#endif + sbdestroy(so, SO_SND); sbdestroy(so, SO_RCV); diff --git a/sys/security/mac/mac_internal.h b/sys/security/mac/mac_internal.h index d1ee1af09c0b..4b2be98b4e03 100644 --- a/sys/security/mac/mac_internal.h +++ b/sys/security/mac/mac_internal.h @@ -242,6 +242,7 @@ struct label *mac_pipe_label_alloc(void); void mac_pipe_label_free(struct label *label); struct label *mac_socket_label_alloc(int flag); void mac_socket_label_free(struct label *label); +void mac_socketpeer_label_free(struct label *label); struct label *mac_vnode_label_alloc(void); void mac_vnode_label_free(struct label *label); diff --git a/sys/security/mac/mac_socket.c b/sys/security/mac/mac_socket.c index be1363024657..910cab493d6b 100644 --- a/sys/security/mac/mac_socket.c +++ b/sys/security/mac/mac_socket.c @@ -170,7 +170,7 @@ mac_socket_label_free(struct label *label) mac_labelzone_free(label); } -static void +void mac_socketpeer_label_free(struct label *label) { @@ -185,8 +185,10 @@ mac_socket_destroy(struct socket *so) if (so->so_label != NULL) { mac_socket_label_free(so->so_label); so->so_label = NULL; - mac_socketpeer_label_free(so->so_peerlabel); - so->so_peerlabel = NULL; + if (!SOLISTENING(so)) { + mac_socketpeer_label_free(so->so_peerlabel); + so->so_peerlabel = NULL; + } } } @@ -616,10 +618,15 @@ mac_getsockopt_peerlabel(struct ucred *cred, struct socket *so, buffer = malloc(mac->m_buflen, M_MACTEMP, M_WAITOK | M_ZERO); intlabel = mac_socket_label_alloc(M_WAITOK); SOCK_LOCK(so); - mac_socket_copy_label(so->so_peerlabel, intlabel); + if (SOLISTENING(so)) + error = EINVAL; + else + mac_socket_copy_label(so->so_peerlabel, intlabel); SOCK_UNLOCK(so); - error = mac_socketpeer_externalize_label(intlabel, elements, buffer, - mac->m_buflen); + if (error == 0) { + error = mac_socketpeer_externalize_label(intlabel, elements, buffer, + mac->m_buflen); + } mac_socket_label_free(intlabel); if (error == 0) error = copyout(buffer, mac->m_string, strlen(buffer)+1);