Hello,

On 2015년 04월 17일 00:35, Casey Schaufler wrote:

On 4/16/2015 6:40 AM, Seung-Woo Kim wrote:

...

The dma-buf fd from anon_inode can be shared across processes, but there is no way to set security permission for the fd. So this patch fix just to ignore private inode from security_file_receive.

Signed-off-by: Seung-Woo Kim sw0312.kim@samsung.com

If security like smack is enabled, the dmabuf fd can not be shared between processes via unix domain socket. I am not familiar with security, so I am not sure that this kind of patch can be acceptable.

If an IS_PRIVATE() check is appropriate, it should be in smack_file_receive(), not security_file_receive(). Why are you looking at file->f_path.dentry->d_inode? That's not used in the Smack access check. You'd want file->f_inode if anything.

Naked-by: Casey Schaufler casey@schaufler-ca.com

Ok, I will try to do it from smack side. Also checking about file->f_inode.

Thanks and Regards, - Seung-Woo Kim

...

Is there other option to share dmabuf fd via socket with security check?

Best Regards,

• Seung-Woo Kim

---

security/security.c | 3 +++ 1 files changed, 3 insertions(+), 0 deletions(-)

diff --git a/security/security.c b/security/security.c index 730ac65..c57354c 100644 --- a/security/security.c +++ b/security/security.c @@ -810,6 +810,9 @@ int security_file_send_sigiotask(struct task_struct *tsk, int security_file_receive(struct file *file) {

• if (unlikely(IS_PRIVATE(file->f_path.dentry->d_inode)))

• return 0;
  

  return security_ops->file_receive(file);

}