git: 6421a70e6238 - stable/13 - MAC: improve handling of listening sockets

[Michael Tuexen]

The branch stable/13 has been updated by tuexen:

URL: 
https://cgit.FreeBSD.org/src/commit/?id=6421a70e6238833fed219c756fbe0b914282ff7b

commit 6421a70e6238833fed219c756fbe0b914282ff7b
Author:     Michael Tuexen <tue...@freebsd.org>
AuthorDate: 2024-09-26 06:06:24 +0000
Commit:     Michael Tuexen <tue...@freebsd.org>
CommitDate: 2024-10-31 16:48:38 +0000

    MAC: improve handling of listening sockets
    
    so_peerlabel can only be used when the socket is not listening.
    
    Reviewed by:            markj
    Sponsored by:           Netflix, Inc.
    Differential Revision:  https://reviews.freebsd.org/D46755
    
    (cherry picked from commit 2fb778fab893b4a8a86ecfa20acf2e23bb2cdae8)
---
 sys/kern/uipc_socket.c          |  5 +++++
 sys/security/mac/mac_internal.h |  1 +
 sys/security/mac/mac_socket.c   | 19 +++++++++++++------
 3 files changed, 19 insertions(+), 6 deletions(-)

diff --git a/sys/kern/uipc_socket.c b/sys/kern/uipc_socket.c
index bcf0ad2ade2c..9cbc5c1f2f7a 100644
--- a/sys/kern/uipc_socket.c
+++ b/sys/kern/uipc_socket.c
@@ -151,6 +151,7 @@
 #include <net/vnet.h>
 
 #include <security/mac/mac_framework.h>
+#include <security/mac/mac_internal.h>
 
 #include <vm/uma.h>
 
@@ -936,6 +937,10 @@ solisten_proto(struct socket *so, int backlog)
        sbrcv_timeo = so->so_rcv.sb_timeo;
        sbsnd_timeo = so->so_snd.sb_timeo;
 
+#ifdef MAC
+       mac_socketpeer_label_free(so->so_peerlabel);
+#endif
+
        sbdestroy(&so->so_snd, so);
        sbdestroy(&so->so_rcv, so);
        sx_destroy(&so->so_snd.sb_sx);
diff --git a/sys/security/mac/mac_internal.h b/sys/security/mac/mac_internal.h
index d1ee1af09c0b..4b2be98b4e03 100644
--- a/sys/security/mac/mac_internal.h
+++ b/sys/security/mac/mac_internal.h
@@ -242,6 +242,7 @@ struct label        *mac_pipe_label_alloc(void);
 void            mac_pipe_label_free(struct label *label);
 struct label   *mac_socket_label_alloc(int flag);
 void            mac_socket_label_free(struct label *label);
+void            mac_socketpeer_label_free(struct label *label);
 struct label   *mac_vnode_label_alloc(void);
 void            mac_vnode_label_free(struct label *label);
 
diff --git a/sys/security/mac/mac_socket.c b/sys/security/mac/mac_socket.c
index c21f4e148076..da84f2e45fd5 100644
--- a/sys/security/mac/mac_socket.c
+++ b/sys/security/mac/mac_socket.c
@@ -170,7 +170,7 @@ mac_socket_label_free(struct label *label)
        mac_labelzone_free(label);
 }
 
-static void
+void
 mac_socketpeer_label_free(struct label *label)
 {
 
@@ -185,8 +185,10 @@ mac_socket_destroy(struct socket *so)
        if (so->so_label != NULL) {
                mac_socket_label_free(so->so_label);
                so->so_label = NULL;
-               mac_socketpeer_label_free(so->so_peerlabel);
-               so->so_peerlabel = NULL;
+               if (!SOLISTENING(so)) {
+                       mac_socketpeer_label_free(so->so_peerlabel);
+                       so->so_peerlabel = NULL;
+               }
        }
 }
 
@@ -616,10 +618,15 @@ mac_getsockopt_peerlabel(struct ucred *cred, struct 
socket *so,
        buffer = malloc(mac->m_buflen, M_MACTEMP, M_WAITOK | M_ZERO);
        intlabel = mac_socket_label_alloc(M_WAITOK);
        SOCK_LOCK(so);
-       mac_socket_copy_label(so->so_peerlabel, intlabel);
+       if (SOLISTENING(so))
+               error = EINVAL;
+       else
+               mac_socket_copy_label(so->so_peerlabel, intlabel);
        SOCK_UNLOCK(so);
-       error = mac_socketpeer_externalize_label(intlabel, elements, buffer,
-           mac->m_buflen);
+       if (error == 0) {
+               error = mac_socketpeer_externalize_label(intlabel, elements, 
buffer,
+                   mac->m_buflen);
+       }
        mac_socket_label_free(intlabel);
        if (error == 0)
                error = copyout(buffer, mac->m_string, strlen(buffer)+1);