From: James Morris This patch fixes a bug where the return value for a permission call is not checked. The bug was introduced when I added some code in the following changeset: Code was added after this line: err = avc_has_perm(isec->sid, node_sid, SECCLASS_NODE, node_perm, NULL, &ad); without adding an explicit check of 'err', which was previously returned from the function rather than being checked. i.e. it would drop through to: out: return err; } With the new code added, err can (and typically would) be overwritten with a successful value, causing the permission check to not deny permission if needed. The intended denial would have been logged. The patch below fixes this problem. --- 25-akpm/security/selinux/hooks.c | 2 ++ 1 files changed, 2 insertions(+) diff -puN security/selinux/hooks.c~selinux-permission-retval-fix security/selinux/hooks.c --- 25/security/selinux/hooks.c~selinux-permission-retval-fix Thu Mar 25 14:20:07 2004 +++ 25-akpm/security/selinux/hooks.c Thu Mar 25 14:20:07 2004 @@ -3040,6 +3040,8 @@ static int selinux_socket_sock_rcv_skb(s goto out; err = avc_has_perm(isec->sid, node_sid, SECCLASS_NODE, node_perm, NULL, &ad); + if (err) + goto out; if (recv_perm) { u32 port_sid; _