Hello,
On 2015년 04월 17일 00:35, Casey Schaufler wrote:
On 4/16/2015 6:40 AM, Seung-Woo Kim wrote:
The dma-buf fd from anon_inode can be shared across processes, but there is no way to set security permission for the fd. So this patch fix just to ignore private inode from security_file_receive.
Signed-off-by: Seung-Woo Kim sw0312.kim@samsung.com
If security like smack is enabled, the dmabuf fd can not be shared between processes via unix domain socket. I am not familiar with security, so I am not sure that this kind of patch can be acceptable.
If an IS_PRIVATE() check is appropriate, it should be in smack_file_receive(), not security_file_receive(). Why are you looking at file->f_path.dentry->d_inode? That's not used in the Smack access check. You'd want file->f_inode if anything.
Naked-by: Casey Schaufler casey@schaufler-ca.com
Ok, I will try to do it from smack side. Also checking about file->f_inode.
Thanks and Regards, - Seung-Woo Kim
Is there other option to share dmabuf fd via socket with security check?
Best Regards,
- Seung-Woo Kim
security/security.c | 3 +++ 1 files changed, 3 insertions(+), 0 deletions(-)
diff --git a/security/security.c b/security/security.c index 730ac65..c57354c 100644 --- a/security/security.c +++ b/security/security.c @@ -810,6 +810,9 @@ int security_file_send_sigiotask(struct task_struct *tsk, int security_file_receive(struct file *file) {
- if (unlikely(IS_PRIVATE(file->f_path.dentry->d_inode)))
return 0;}