selinux: fix broken peer recv check

Fix a broken networking check. Return an error if peer recv fails. If secmark is active and the packet recv succeeds the peer recv error is ignored. Signed-off-by: Chad Hanson <chanson@trustedcs.com> Signed-off-by: Paul Moore <pmoore@redhat.com>
git-mirror · Dec 11, 2013 · 598cdbc · 598cdbc
1 parent 5c6c268
commit 598cdbc
Showing 1 changed file with 3 additions and 1 deletion.
diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
@@ -4338,8 +4338,10 @@ static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
 		}
 		err = avc_has_perm(sk_sid, peer_sid, SECCLASS_PEER,
 				   PEER__RECV, &ad);
-		if (err)
+		if (err) {
 			selinux_netlbl_err(skb, err, 0);
+			return err;
+		}
 	}
 
 	if (secmark_active) {