Re: [PATCH v3] nfnetlink_queue: add security context information

[Florian Westphal <fw@strlen.de>]

Roman Kubiak <r.kubiak@samsung.com> wrote:
> Fixes applied (i'm not sure how i should use the mask parameter to check if NFQA_CFG_F_SECCTX is set
> on the userspace side both the mask and the flag are the same value when i looked at how uid/gid
> are set, maybe this could be done better?)

[..]

> @@ -1142,7 +1170,12 @@ nfqnl_recv_config(struct sock *ctnl, struct sk_buff *skb,
>  			ret = -EOPNOTSUPP;
>  			goto err_out_unlock;
>  		}
> -
> +#if !IS_ENABLED(CONFIG_NETWORK_SECMARK)
> +		if (flags == NFQA_CFG_F_SECCTX) {
> +			ret = -EOPNOTSUPP;
> +			goto err_out_unlock;
> +		}
> +#endif
>  		spin_lock_bh(&queue->lock);
>  		queue->flags &= ~mask;
>  		queue->flags |= flags & mask;

Based on last two lines it appears the test should be something like

if (flags & mask & NFQA_CFG_F_SECCTX)
	return -EOPNOTSUPP;

[ seems intent is to allow unsetting some flag(s) via
  flags = SOME_FEAT_I_WANT;
  mask = SOME_FEAT_I_WANT|SOME_FEAT_I_WANT_TO_SWITCH_OFF; ]