linux-kernel - Re: [PATCH RFC 4/6] selinux: improve network lookup failure warnings

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CAJ2a_DfvxT=49fDsXw1Rt3TMmQ6uzeDdRaqQj3zaJc+vpPPFWA@mail.gmail.com>
Date: Tue, 15 Apr 2025 16:28:25 +0200
From: Christian Göttsche <cgzones@...glemail.com>
To: Paul Moore <paul@...l-moore.com>
Cc: Christian Göttsche <cgoettsche@...tendoof.de>, 
	Stephen Smalley <stephen.smalley.work@...il.com>, Ondrej Mosnacek <omosnace@...hat.com>, 
	Thiébaud Weksteen <tweek@...gle.com>, 
	Bram Bonné <brambonne@...gle.com>, 
	Casey Schaufler <casey@...aufler-ca.com>, GUO Zihua <guozihua@...wei.com>, 
	Canfeng Guo <guocanfeng@...ontech.com>, selinux@...r.kernel.org, 
	linux-kernel@...r.kernel.org
Subject: Re: [PATCH RFC 4/6] selinux: improve network lookup failure warnings

On Fri, 11 Apr 2025 at 22:29, Paul Moore <paul@...l-moore.com> wrote:
>
> On Mar 18, 2025 =?UTF-8?q?Christian=20G=C3=B6ttsche?= <cgoettsche@...tendoof.de> wrote:
> >
> > Rate limit the warnings and include additional available information.
> >
> > Signed-off-by: Christian Göttsche <cgzones@...glemail.com>
> > ---
> >  security/selinux/netif.c   | 8 ++++----
> >  security/selinux/netnode.c | 4 ++--
> >  security/selinux/netport.c | 4 ++--
> >  3 files changed, 8 insertions(+), 8 deletions(-)
>
> How many of these messages were you seeing that rate limiting was a
> concern?  Also, what were you doing that was causing this?

I did not actually encounter any of these warnings, it just seemed
likely if they would ever get hit they would so repeatedly and clutter
the logs.

> > diff --git a/security/selinux/netif.c b/security/selinux/netif.c
> > index 43a0d3594b72..38fdba1e64bf 100644
> > --- a/security/selinux/netif.c
> > +++ b/security/selinux/netif.c
> > @@ -141,8 +141,8 @@ static int sel_netif_sid_slow(struct net *ns, int ifindex, u32 *sid)
> >
> >       dev = dev_get_by_index(ns, ifindex);
> >       if (unlikely(dev == NULL)) {
> > -             pr_warn("SELinux: failure in %s(), invalid network interface (%d)\n",
> > -                     __func__, ifindex);
> > +             pr_warn_ratelimited("SELinux: failure in %s(), invalid network interface (%d)\n",
> > +                                 __func__, ifindex);
> >               return -ENOENT;
> >       }
> >
> > @@ -169,8 +169,8 @@ static int sel_netif_sid_slow(struct net *ns, int ifindex, u32 *sid)
> >       spin_unlock_bh(&sel_netif_lock);
> >       dev_put(dev);
> >       if (unlikely(ret))
> > -             pr_warn("SELinux: failure in %s(), unable to determine network interface label (%d)\n",
> > -                     __func__, ifindex);
> > +             pr_warn_ratelimited("SELinux: failure in %s(), unable to determine network interface label (%d):  %d\n",
> > +                                 __func__, ifindex, ret);
> >       return ret;
> >  }
> >
> > diff --git a/security/selinux/netnode.c b/security/selinux/netnode.c
> > index 8bb456d80dd5..76cf531af110 100644
> > --- a/security/selinux/netnode.c
> > +++ b/security/selinux/netnode.c
> > @@ -228,8 +228,8 @@ static int sel_netnode_sid_slow(const void *addr, u16 family, u32 *sid)
> >
> >       spin_unlock_bh(&sel_netnode_lock);
> >       if (unlikely(ret))
> > -             pr_warn("SELinux: failure in %s(), unable to determine network node label\n",
> > -                     __func__);
> > +             pr_warn_ratelimited("SELinux: failure in %s(), unable to determine network node label (%d):  %d\n",
> > +                                 __func__, family, ret);
> >       return ret;
> >  }
> >
> > diff --git a/security/selinux/netport.c b/security/selinux/netport.c
> > index 7d2207384d40..dadf14984fb4 100644
> > --- a/security/selinux/netport.c
> > +++ b/security/selinux/netport.c
> > @@ -162,8 +162,8 @@ static int sel_netport_sid_slow(u8 protocol, u16 pnum, u32 *sid)
> >  out:
> >       spin_unlock_bh(&sel_netport_lock);
> >       if (unlikely(ret))
> > -             pr_warn("SELinux: failure in %s(), unable to determine network port label\n",
> > -                     __func__);
> > +             pr_warn_ratelimited("SELinux: failure in %s(), unable to determine network port label (%d:%d):  %d\n",
> > +                                 __func__, protocol, pnum, ret);
> >       return ret;
> >  }
> >
> > --
> > 2.49.0
>
> --
> paul-moore.com