From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp-fw-52003.amazon.com (smtp-fw-52003.amazon.com [52.119.213.152]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id D3DEB288502 for ; Thu, 15 May 2025 22:52:03 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=52.119.213.152 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1747349525; cv=none; b=LpFxjgFjs1nfXpN/cBygf0KavEO2f+3As+m9O35yFtTsHkq/apej1e0LDUFLdUpLfUi8wh86GxlIsNInsGrbWkC/QxvsRIX0dJtKbY1p6N58APgUcJtYALnvrCK78J/Y4AhSP6AxpEDN3rrkml33xCC4pRpONIEtJR8O+p1UXxw= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1747349525; c=relaxed/simple; bh=WfOYeIgKhhw1mGs9tugt3QGwIaA5wsi82JPT2dT1Kxg=; h=From:To:CC:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=CJsTR5p2rOfdlrRXJjRtf00t4exMbdr7mr35anDuXONG70yui/hD3pJMTND6JfVVu9X2Ux+GMfZBfh8On3xcUpDYEkzdV8vkioQbdk261hAeSDoU9iR1uvKfRcgf0WyvvarLkrH1OAIOKbwC26ow7z3/uI2LX4wBiJbIMMMWJ5Y= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=amazon.com; spf=pass smtp.mailfrom=amazon.co.jp; dkim=pass (2048-bit key) header.d=amazon.com header.i=@amazon.com header.b=aI6cwGtd; arc=none smtp.client-ip=52.119.213.152 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=amazon.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=amazon.co.jp Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=amazon.com header.i=@amazon.com header.b="aI6cwGtd" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=amazon.com; i=@amazon.com; q=dns/txt; s=amazoncorp2; t=1747349524; x=1778885524; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=lX84mVYng7du5C+evun9nBld517z2lM4zi2vzi/i7P8=; b=aI6cwGtdeoUN7arzXF4GD2fD4M4/z3ck5BGLIcgFMLYMzicNS/lGOpRV ouLbjozYJEIJl2b85bjrWOOMLJ3xnNcth5mgijkrpCealejwWSOUQI2Yj di9EsoamC9WsJDosVKFa1UVYZrio5qP21WKpkDbeg1tDb5RtqH7GynXpX iuV244UC/I9T4ACMC1iwY0zM1x33zS8dSNOvwZCdIHzb67ChoFBAmCwea E65IttGD/vG0yZy0GQ2cAeBZ3/FqOeq2LDbwtu4IHLqXswKsMTsY/tLTg nOFjF4uEhZDyJPMZYoBkA/BNPsXG3EaZBH4TphD2pEtT9SojZS8CwzAB+ A==; X-IronPort-AV: E=Sophos;i="6.15,292,1739836800"; d="scan'208";a="93703267" Received: from iad12-co-svc-p1-lb1-vlan3.amazon.com (HELO smtpout.prod.us-west-2.prod.farcaster.email.amazon.dev) ([10.43.8.6]) by smtp-border-fw-52003.iad7.amazon.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 15 May 2025 22:52:01 +0000 Received: from EX19MTAUWC001.ant.amazon.com [10.0.21.151:25111] by smtpin.naws.us-west-2.prod.farcaster.email.amazon.dev [10.0.26.241:2525] with esmtp (Farcaster) id e148f1ff-c750-4dd7-9216-c5034ca52bbd; Thu, 15 May 2025 22:52:00 +0000 (UTC) X-Farcaster-Flow-ID: e148f1ff-c750-4dd7-9216-c5034ca52bbd Received: from EX19D004ANA001.ant.amazon.com (10.37.240.138) by EX19MTAUWC001.ant.amazon.com (10.250.64.174) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA) id 15.2.1544.14; Thu, 15 May 2025 22:51:59 +0000 Received: from 6c7e67bfbae3.amazon.com (10.187.170.35) by EX19D004ANA001.ant.amazon.com (10.37.240.138) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA) id 15.2.1544.14; Thu, 15 May 2025 22:51:56 +0000 From: Kuniyuki Iwashima To: "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Willem de Bruijn CC: Simon Horman , Christian Brauner , Kuniyuki Iwashima , Kuniyuki Iwashima , Subject: [PATCH v4 net-next 5/9] net: Restrict SO_PASS{CRED,PIDFD,SEC} to AF_{UNIX,NETLINK,BLUETOOTH}. Date: Thu, 15 May 2025 15:49:13 -0700 Message-ID: <20250515224946.6931-6-kuniyu@amazon.com> X-Mailer: git-send-email 2.49.0 In-Reply-To: <20250515224946.6931-1-kuniyu@amazon.com> References: <20250515224946.6931-1-kuniyu@amazon.com> Precedence: bulk X-Mailing-List: netdev@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Content-Type: text/plain X-ClientProxiedBy: EX19D038UWB001.ant.amazon.com (10.13.139.148) To EX19D004ANA001.ant.amazon.com (10.37.240.138) SCM_CREDENTIALS and SCM_SECURITY can be recv()ed by calling scm_recv() or scm_recv_unix(), and SCM_PIDFD is only used by scm_recv_unix(). scm_recv() is called from AF_NETLINK and AF_BLUETOOTH. scm_recv_unix() is literally called from AF_UNIX. Let's restrict SO_PASSCRED and SO_PASSSEC to such sockets and SO_PASSPIDFD to AF_UNIX only. Later, SOCK_PASS{CRED,PIDFD,SEC} will be moved to struct sock and united with another field. Signed-off-by: Kuniyuki Iwashima Reviewed-by: Willem de Bruijn --- v3: * Return -EOPNOTSUPP in getsockopt() too * Add CONFIG_SECURITY_NETWORK check for SO_PASSSEC --- include/net/sock.h | 14 +++++++++++++- net/core/sock.c | 18 ++++++++++++++++++ 2 files changed, 31 insertions(+), 1 deletion(-) diff --git a/include/net/sock.h b/include/net/sock.h index 3e15d7105ad2..56fa558d24c0 100644 --- a/include/net/sock.h +++ b/include/net/sock.h @@ -2773,9 +2773,14 @@ static inline bool sk_is_udp(const struct sock *sk) sk->sk_protocol == IPPROTO_UDP; } +static inline bool sk_is_unix(const struct sock *sk) +{ + return sk->sk_family == AF_UNIX; +} + static inline bool sk_is_stream_unix(const struct sock *sk) { - return sk->sk_family == AF_UNIX && sk->sk_type == SOCK_STREAM; + return sk_is_unix(sk) && sk->sk_type == SOCK_STREAM; } static inline bool sk_is_vsock(const struct sock *sk) @@ -2783,6 +2788,13 @@ static inline bool sk_is_vsock(const struct sock *sk) return sk->sk_family == AF_VSOCK; } +static inline bool sk_may_scm_recv(const struct sock *sk) +{ + return (IS_ENABLED(CONFIG_UNIX) && sk->sk_family == AF_UNIX) || + sk->sk_family == AF_NETLINK || + (IS_ENABLED(CONFIG_BT) && sk->sk_family == AF_BLUETOOTH); +} + /** * sk_eat_skb - Release a skb if it is no longer needed * @sk: socket to eat this skb from diff --git a/net/core/sock.c b/net/core/sock.c index d7d6d3a8efe5..fd5f9d3873c1 100644 --- a/net/core/sock.c +++ b/net/core/sock.c @@ -1221,12 +1221,21 @@ int sk_setsockopt(struct sock *sk, int level, int optname, } return -EPERM; case SO_PASSSEC: + if (!IS_ENABLED(CONFIG_SECURITY_NETWORK) || sk_may_scm_recv(sk)) + return -EOPNOTSUPP; + assign_bit(SOCK_PASSSEC, &sock->flags, valbool); return 0; case SO_PASSCRED: + if (!sk_may_scm_recv(sk)) + return -EOPNOTSUPP; + assign_bit(SOCK_PASSCRED, &sock->flags, valbool); return 0; case SO_PASSPIDFD: + if (!sk_is_unix(sk)) + return -EOPNOTSUPP; + assign_bit(SOCK_PASSPIDFD, &sock->flags, valbool); return 0; case SO_TYPE: @@ -1855,10 +1864,16 @@ int sk_getsockopt(struct sock *sk, int level, int optname, break; case SO_PASSCRED: + if (!sk_may_scm_recv(sk)) + return -EOPNOTSUPP; + v.val = !!test_bit(SOCK_PASSCRED, &sock->flags); break; case SO_PASSPIDFD: + if (!sk_is_unix(sk)) + return -EOPNOTSUPP; + v.val = !!test_bit(SOCK_PASSPIDFD, &sock->flags); break; @@ -1956,6 +1971,9 @@ int sk_getsockopt(struct sock *sk, int level, int optname, break; case SO_PASSSEC: + if (!IS_ENABLED(CONFIG_SECURITY_NETWORK) || !sk_may_scm_recv(sk)) + return -EOPNOTSUPP; + v.val = !!test_bit(SOCK_PASSSEC, &sock->flags); break; -- 2.49.0