netdev - Re: [PATCH] selinux: map RTM_DELNSID to nlmsg

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <266861ab-cc0d-4a7c-9804-6bf4670868b1@6wind.com>
Date: Thu, 9 Jan 2025 10:24:53 +0100
From: Nicolas Dichtel <nicolas.dichtel@...nd.com>
To: Thiébaud Weksteen <tweek@...gle.com>,
 Paul Moore <paul@...l-moore.com>
Cc: "David S . Miller" <davem@...emloft.net>, selinux@...r.kernel.org,
 netdev <netdev@...r.kernel.org>
Subject: Re: [PATCH] selinux: map RTM_DELNSID to nlmsg_write

Le 09/01/2025 à 00:15, Thiébaud Weksteen a écrit :
> The mapping for RTM_DELNSID was added in commit 387f989a60db
> ("selinux/nlmsg: add RTM_GETNSID"). While this message type is not
> expected from userspace, other RTM_DEL* types are mapped to the more
> restrictive nlmsg_write permission. Move RTM_DELNSID to nlmsg_write in
> case the implementation is changed in the future.
Frankly, I don't think this will ever change. It's not a problem of implementing
the delete command, it's conceptually no sense.

I don't see why the DEL should be restricted in any way.


Regards,
Nicolas

> 
> Fixes: 387f989a60db ("selinux/nlmsg: add RTM_GETNSID")
> Signed-off-by: Thiébaud Weksteen <tweek@...gle.com>
> ---
>  security/selinux/nlmsgtab.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/security/selinux/nlmsgtab.c b/security/selinux/nlmsgtab.c
> index 3a95986b134f..f97e75301018 100644
> --- a/security/selinux/nlmsgtab.c
> +++ b/security/selinux/nlmsgtab.c
> @@ -71,7 +71,7 @@ static const struct nlmsg_perm nlmsg_route_perms[] = {
>  	{ RTM_DELMDB, NETLINK_ROUTE_SOCKET__NLMSG_WRITE },
>  	{ RTM_GETMDB, NETLINK_ROUTE_SOCKET__NLMSG_READ },
>  	{ RTM_NEWNSID, NETLINK_ROUTE_SOCKET__NLMSG_WRITE },
> -	{ RTM_DELNSID, NETLINK_ROUTE_SOCKET__NLMSG_READ },
> +	{ RTM_DELNSID, NETLINK_ROUTE_SOCKET__NLMSG_WRITE },
>  	{ RTM_GETNSID, NETLINK_ROUTE_SOCKET__NLMSG_READ },
>  	{ RTM_NEWSTATS, NETLINK_ROUTE_SOCKET__NLMSG_READ },
>  	{ RTM_GETSTATS, NETLINK_ROUTE_SOCKET__NLMSG_READ },