linux-kernel - Re: selinux: support IPPROTO_SMC in socket_type_to_security

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAEjxPJ6nZY-RV2V0b5mqnUA4fKa09RhKp2SX7io9oO6XhZsacA@mail.gmail.com>
Date: Fri, 16 Aug 2024 07:42:11 -0400
From: Stephen Smalley <stephen.smalley.work@...il.com>
To: Jeongjun Park <aha310510@...il.com>
Cc: paul@...l-moore.com, linux-kernel@...r.kernel.org, omosnace@...hat.com, 
	selinux@...r.kernel.org
Subject: Re: selinux: support IPPROTO_SMC in socket_type_to_security_class()

On Fri, Aug 16, 2024 at 7:21 AM Stephen Smalley
<stephen.smalley.work@...il.com> wrote:
>
> On Thu, Aug 15, 2024 at 11:57 PM Jeongjun Park <aha310510@...il.com> wrote:
> >
> > Paul Moore wrote:
> > >
> > > On Thu, Aug 15, 2024 at 4:32 AM Jeongjun Park <aha310510@...il.com> wrote:
> > > >
> > > > IPPROTO_SMC feature has been added to net/smc. It is now possible to
> > > > create smc sockets in the following way:
> > > >
> > > >   /* create v4 smc sock */
> > > >   v4 = socket(AF_INET, SOCK_STREAM, IPPROTO_SMC);
> > > >
> > > >   /* create v6 smc sock */
> > > >   v6 = socket(AF_INET6, SOCK_STREAM, IPPROTO_SMC);
> > > >
> > > > Therefore, we need to add code to support IPPROTO_SMC in
> > > > socket_type_to_security_class().
> > > >
> > > > Signed-off-by: Jeongjun Park <aha310510@...il.com>
> > > > ---
> > > >  security/selinux/hooks.c | 2 ++
> > > >  1 file changed, 2 insertions(+)
> > >
> > > I'm a little concerned that the small patch below might not be all
> > > that is needed to properly support SMC in SELinux.  Can you explain
> > > what testing you've done with SMC on a SELinux system?
> >
> > I don't have much knowledge about smc, so I can't tested everything, but
> > I created a socket, performed setsockopt, and tested two sockets
> > communicating with each other. When I tested it, performing smc-related
> > functions worked well without any major problems.
> >
> > And after analyzing it myself, I didn't see any additional patches needed
> > to support IPPROTO_SMC in selinux other than this patch. So you don't
> > have to worry.
>
> Note that Jeongjun is not introducing SELinux support for SMC sockets
> for the first time here; he is just updating the already existing
> support to correctly map the new IPPROTO_SMC to the already existing
> SECCLASS_SMC_SOCKET. We were already handling such sockets created via
> socket(AF_SMC, ...); what changed was that they added support for
> creating them via socket(AF_INET, SOCK_STREAM, IPPROTO_SMC) too.

Also, the extent of the support is limited to just the socket layer
checks, but this is not a change and is no different than many of the
other AF_* families besides the small number that have been more
specifically instrumented for SELinux.