[PATCH v2 bpf-next 0/4] af_unix: Allow BPF LSM to filter SCM_RIGHTS at sendmsg().

[Kuniyuki Iwashima]

From: Kuniyuki Iwashima <kuniyu at google.com>

Since commit 77cbe1a6d873 ("af_unix: Introduce SO_PASSRIGHTS."),
we can disable SCM_RIGHTS per socket, but it's not flexible.

This series allows us to implement more fine-grained filtering for
SCM_RIGHTS with BPF LSM.


Changes:
  v2: Remove SCM_RIGHTS fd scrubbing functionality

  v1: https://lore.kernel.org/bpf/20250505215802.48449-1-kuniyu@amazon.com/


Kuniyuki Iwashima (4):
  af_unix: Don't pass struct socket to security_unix_may_send().
  af_unix: Call security_unix_may_send() in sendmsg() for all socket
    types
  af_unix: Pass skb to security_unix_may_send().
  selftest: bpf: Add test for BPF LSM on unix_may_send().

 include/linux/lsm_hook_defs.h                 |   3 +-
 include/linux/security.h                      |   7 +-
 net/unix/af_unix.c                            |  32 ++--
 security/landlock/task.c                      |  16 +-
 security/security.c                           |   5 +-
 security/selinux/hooks.c                      |  14 +-
 security/smack/smack_lsm.c                    |  12 +-
 .../bpf/prog_tests/lsm_unix_may_send.c        | 168 ++++++++++++++++++
 .../selftests/bpf/progs/lsm_unix_may_send.c   |  83 +++++++++
 9 files changed, 309 insertions(+), 31 deletions(-)
 create mode 100644 tools/testing/selftests/bpf/prog_tests/lsm_unix_may_send.c
 create mode 100644 tools/testing/selftests/bpf/progs/lsm_unix_may_send.c

-- 
2.49.0