netdev - Re: [v3] skbuff: Do not scrub skb mark within the same name space

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <alpine.LRH.2.11.1504161700130.23392@namei.org>
Date:	Thu, 16 Apr 2015 17:02:15 +1000 (AEST)
From:	James Morris <jmorris@...ei.org>
To:	Herbert Xu <herbert@...dor.apana.org.au>
cc:	Nicolas Dichtel <nicolas.dichtel@...nd.com>,
	netdev@...r.kernel.org,
	"Eric W. Biederman" <ebiederm@...ssion.com>,
	linux-security-module@...r.kernel.org, Thomas Graf <tgraf@...g.ch>
Subject: Re: [v3] skbuff: Do not scrub skb mark within the same name space

On Thu, 16 Apr 2015, Herbert Xu wrote:

> On Wed, Apr 15, 2015 at 05:41:26PM +0200, Nicolas Dichtel wrote:
> > Le 15/04/2015 15:57, Herbert Xu a écrit :
> > >On Wed, Apr 15, 2015 at 06:22:29PM +0800, Herbert Xu wrote:
> > [snip]
> > >Subject: skbuff: Do not scrub skb mark within the same name space
> > >
> > >The commit ea23192e8e577dfc51e0f4fc5ca113af334edff9 ("tunnels:
> > Maybe add a Fixes tag?
> > Fixes: ea23192e8e57 ("tunnels: harmonize cleanup done on skb on rx path")
> > 
> > >harmonize cleanup done on skb on rx path") broke anyone trying to
> > >use netfilter marking across IPv4 tunnels.  While most of the
> > >fields that are cleared by skb_scrub_packet don't matter, the
> > >netfilter mark must be preserved.
> > >
> > >This patch rearranges skb_scurb_packet to preserve the mark field.
> > nit: s/scurb/scrub
> > 
> > Else it's fine for me.
> 
> Sure.
> 
> PS I used the wrong email for James the first time around.  So
> let me repeat the question here.  Should secmark be preserved
> or cleared across tunnels within the same name space? In fact,
> do our security models even support name spaces?

They don't support namespaces, and maintaining the label is critical for 
SELinux, at least, which mediates security for the system as a whole.


-- 
James Morris
<jmorris@...ei.org>