linux-kernel - Re: selinux: support IPPROTO_SMC in socket_type_to_security

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAEjxPJ6gznARkD_jTZUhXJmQ5zvdrwxJOiSC0YQoZekNe76Nug@mail.gmail.com>
Date: Fri, 16 Aug 2024 07:21:42 -0400
From: Stephen Smalley <stephen.smalley.work@...il.com>
To: Jeongjun Park <aha310510@...il.com>
Cc: paul@...l-moore.com, linux-kernel@...r.kernel.org, omosnace@...hat.com, 
	selinux@...r.kernel.org
Subject: Re: selinux: support IPPROTO_SMC in socket_type_to_security_class()

On Thu, Aug 15, 2024 at 11:57 PM Jeongjun Park <aha310510@...il.com> wrote:
>
> Paul Moore wrote:
> >
> > On Thu, Aug 15, 2024 at 4:32 AM Jeongjun Park <aha310510@...il.com> wrote:
> > >
> > > IPPROTO_SMC feature has been added to net/smc. It is now possible to
> > > create smc sockets in the following way:
> > >
> > >   /* create v4 smc sock */
> > >   v4 = socket(AF_INET, SOCK_STREAM, IPPROTO_SMC);
> > >
> > >   /* create v6 smc sock */
> > >   v6 = socket(AF_INET6, SOCK_STREAM, IPPROTO_SMC);
> > >
> > > Therefore, we need to add code to support IPPROTO_SMC in
> > > socket_type_to_security_class().
> > >
> > > Signed-off-by: Jeongjun Park <aha310510@...il.com>
> > > ---
> > >  security/selinux/hooks.c | 2 ++
> > >  1 file changed, 2 insertions(+)
> >
> > I'm a little concerned that the small patch below might not be all
> > that is needed to properly support SMC in SELinux.  Can you explain
> > what testing you've done with SMC on a SELinux system?
>
> I don't have much knowledge about smc, so I can't tested everything, but
> I created a socket, performed setsockopt, and tested two sockets
> communicating with each other. When I tested it, performing smc-related
> functions worked well without any major problems.
>
> And after analyzing it myself, I didn't see any additional patches needed
> to support IPPROTO_SMC in selinux other than this patch. So you don't
> have to worry.

Note that Jeongjun is not introducing SELinux support for SMC sockets
for the first time here; he is just updating the already existing
support to correctly map the new IPPROTO_SMC to the already existing
SECCLASS_SMC_SOCKET. We were already handling such sockets created via
socket(AF_SMC, ...); what changed was that they added support for
creating them via socket(AF_INET, SOCK_STREAM, IPPROTO_SMC) too.