Re: [PATCH] tcp: assign the sock correctly to an outgoing SYNACK packet

David Miller
2013-04-08T21:14:33Z

From: Paul Moore <pmoore@redhat.com>
Date: Mon, 08 Apr 2013 17:09:32 -0400

> On Monday, April 08, 2013 01:55:01 PM Eric Dumazet wrote:
>> At least my patch clearly _shows_ the security requirement, instead of
>> relying on a side effect of a previous sock_wmalloc()
>
> I don't see it as a side effect, and as far as demonstration, I think the
> SELinux network access controls in their entirety shows the security
> requirement. If we want to make the security requirements even more explicit
> in the networking stack, let's add a security blob to the sk_buff and allow
> some proper LSM hooks.

You don't get it.

Without LSM there is no need to use sock_wmalloc() or to have a socket
context attacked to the SYN/ACK packet at all.

Therefore, the need should be explicit (Eric's approach), rather than
implicit (what you seem to be after).