Re: [REGRESSION] af_unix: Introduce SO_PASSRIGHTS - break OpenGL

[Kuniyuki Iwashima <kuniyu@google.com>]

From: brian.scott.sampson@gmail.com
Date: Wed, 17 Sep 2025 15:25:07 -0500
> > Thanks for testing the painful scenario.
> > 
> > Could you apply this on top of the previous diff and give it
> > another shot ?
> > 
> > I think the application hit a race similar to one in 43fb2b30eea7.
> Just tested again with latest mainline, but no change. Once suspended,
> keyboard becomes inactive and no longer accepts any input, so no way to
> switch to tty to view dmesg. The only way to move forward after
> suspending is holding down power to hard shutdown, then power back on.
> I tried enabling persistence in the systemd journal, then checking
> journalctl -k -b -1, but nothing is recorded from dmesg after the
> suspend.

Thank you for your patience.

I assumed SO_PASSCRED was the problem, but I missed
SO_PASSCRED was also inherited durint accept().

Could you apply this on top of the previous changes ?

Also, could you tell what desktop manager and distro
you are using ?  If this attempt fails, I'll try to
reproduce with the same version on my desktop.

---8<---
diff --git a/include/net/sock.h b/include/net/sock.h
index 211084602e01..b61d4fdb7fc4 100644
--- a/include/net/sock.h
+++ b/include/net/sock.h
@@ -541,7 +541,8 @@ struct sock {
 				sk_scm_rights : 1,
 				sk_scm_embryo_cred: 1,
 				sk_scm_parent_cred: 1,
-				sk_scm_unused : 2;
+				sk_scm_parent_sec: 1,
+				sk_scm_unused : 1;
 		};
 	};
 	u8			sk_clockid;
diff --git a/net/core/scm.c b/net/core/scm.c
index e603bf5400e0..359d56d454b4 100644
--- a/net/core/scm.c
+++ b/net/core/scm.c
@@ -435,7 +435,8 @@ static void scm_passec(struct sock *sk, struct msghdr *msg, struct scm_cookie *s
 	struct lsm_context ctx;
 	int err;
 
-	if (sk->sk_scm_security) {
+	if (sk->sk_scm_security || sk->sk_scm_parent_sec) {
+		WARN_ON_ONCE(!sk->sk_scm_security);
 		err = security_secid_to_secctx(scm->secid, &ctx);
 
 		if (err >= 0) {
@@ -449,7 +450,7 @@ static void scm_passec(struct sock *sk, struct msghdr *msg, struct scm_cookie *s
 
 static bool scm_has_secdata(struct sock *sk)
 {
-	return sk->sk_scm_security;
+	return sk->sk_scm_security || sk->sk_scm_parent_sec;
 }
 #else
 static void scm_passec(struct sock *sk, struct msghdr *msg, struct scm_cookie *scm)
diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
index b6ff7ad0443a..a35082269990 100644
--- a/net/unix/af_unix.c
+++ b/net/unix/af_unix.c
@@ -1899,6 +1899,7 @@ static int unix_accept(struct socket *sock, struct socket *newsock,
 	unix_update_edges(unix_sk(tsk));
 	newsock->state = SS_CONNECTED;
 	tsk->sk_scm_parent_cred = sk->sk_scm_credentials;
+	tsk->sk_scm_parent_sec = sk->sk_scm_security;
 	sock_graft(tsk, newsock);
 	unix_state_unlock(tsk);
 	return 0;
---8<---