[PATCH v1 bpf-next 2/5] af_unix: Pass skb to security_unix_may_send().
Kuniyuki Iwashima
kuniyu at amazon.com
Mon May 5 21:56:47 UTC 2025
As long as recvmsg() or recvmmsg() is used with cmsg, it is not
possible to avoid receiving file descriptors via SCM_RIGHTS.
This behaviour has occasionally been flagged as problematic.
For instance, as noted on the uAPI Group page [0], an untrusted peer
could send a file descriptor pointing to a hung NFS mount and then
close it. Once the receiver calls recvmsg() with msg_control, the
descriptor is automatically installed, and then the responsibility
for the final close() now falls on the receiver, which may result
in blocking the process for a long time.
Let's pass the skb to security_unix_may_send() so that BPF LSM can
inspect it and selectively prevent such a sendmsg().
Note that only the LSM_HOOK() macro uses the __nullable suffix for
skb to inform the verifier that the skb could be NULL at connect().
Without it, I was able to load a bpf prog without NULL check
against skb.
Sample:
SEC("lsm/unix_may_send")
int BPF_PROG(unix_refuse_scm_rights,
struct socket *sock, struct socket *other, struct sk_buff *skb)
{
struct unix_skb_parms *cb;
if (!skb)
return 0;
cb = (struct unix_skb_parms *)skb->cb;
if (!cb->fp)
return 0;
return -EPERM;
}
Link: https://uapi-group.org/kernel-features/#disabling-reception-of-scm_rights-for-af_unix-sockets #[0]
Signed-off-by: Kuniyuki Iwashima <kuniyu at amazon.com>
---
I guess there is no generic version of raw_tp_null_args[] ?
---
include/linux/lsm_hook_defs.h | 3 ++-
include/linux/security.h | 5 +++--
net/unix/af_unix.c | 8 ++++----
security/landlock/task.c | 3 ++-
security/security.c | 5 +++--
security/selinux/hooks.c | 3 ++-
security/smack/smack_lsm.c | 3 ++-
7 files changed, 18 insertions(+), 12 deletions(-)
diff --git a/include/linux/lsm_hook_defs.h b/include/linux/lsm_hook_defs.h
index bf3bbac4e02a..762c7f2f7dee 100644
--- a/include/linux/lsm_hook_defs.h
+++ b/include/linux/lsm_hook_defs.h
@@ -318,7 +318,8 @@ LSM_HOOK(int, 0, watch_key, struct key *key)
#ifdef CONFIG_SECURITY_NETWORK
LSM_HOOK(int, 0, unix_stream_connect, struct sock *sock, struct sock *other,
struct sock *newsk)
-LSM_HOOK(int, 0, unix_may_send, struct socket *sock, struct socket *other)
+LSM_HOOK(int, 0, unix_may_send, struct socket *sock, struct socket *other,
+ struct sk_buff *skb__nullable)
LSM_HOOK(int, 0, socket_create, int family, int type, int protocol, int kern)
LSM_HOOK(int, 0, socket_post_create, struct socket *sock, int family, int type,
int protocol, int kern)
diff --git a/include/linux/security.h b/include/linux/security.h
index cc9b54d95d22..5de77accee80 100644
--- a/include/linux/security.h
+++ b/include/linux/security.h
@@ -1630,7 +1630,7 @@ static inline int security_watch_key(struct key *key)
#ifdef CONFIG_SECURITY_NETWORK
int security_unix_stream_connect(struct sock *sock, struct sock *other, struct sock *newsk);
-int security_unix_may_send(struct socket *sock, struct socket *other);
+int security_unix_may_send(struct socket *sock, struct socket *other, struct sk_buff *skb);
int security_socket_create(int family, int type, int protocol, int kern);
int security_socket_post_create(struct socket *sock, int family,
int type, int protocol, int kern);
@@ -1692,7 +1692,8 @@ static inline int security_unix_stream_connect(struct sock *sock,
}
static inline int security_unix_may_send(struct socket *sock,
- struct socket *other)
+ struct socket *other,
+ struct sk_buff *skb)
{
return 0;
}
diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
index 769db3f8f41b..692cce579c89 100644
--- a/net/unix/af_unix.c
+++ b/net/unix/af_unix.c
@@ -1447,7 +1447,7 @@ static int unix_dgram_connect(struct socket *sock, struct sockaddr *addr,
if (!unix_may_send(sk, other))
goto out_unlock;
- err = security_unix_may_send(sk->sk_socket, other->sk_socket);
+ err = security_unix_may_send(sk->sk_socket, other->sk_socket, NULL);
if (err)
goto out_unlock;
@@ -2101,7 +2101,7 @@ static int unix_dgram_sendmsg(struct socket *sock, struct msghdr *msg,
goto out_unlock;
}
- err = security_unix_may_send(sk->sk_socket, other->sk_socket);
+ err = security_unix_may_send(sk->sk_socket, other->sk_socket, skb);
if (err)
goto out_unlock;
@@ -2204,7 +2204,7 @@ static int queue_oob(struct socket *sock, struct msghdr *msg, struct sock *other
}
if (!fds_sent) {
- err = security_unix_may_send(sock, other->sk_socket);
+ err = security_unix_may_send(sock, other->sk_socket, skb);
if (err)
goto out_unlock;
}
@@ -2326,7 +2326,7 @@ static int unix_stream_sendmsg(struct socket *sock, struct msghdr *msg,
goto out_pipe_unlock;
if (!fds_sent) {
- err = security_unix_may_send(sock, other->sk_socket);
+ err = security_unix_may_send(sock, other->sk_socket, skb);
if (err) {
unix_state_unlock(other);
goto out_free;
diff --git a/security/landlock/task.c b/security/landlock/task.c
index f15e6b0c56f8..aeb712d3fa8f 100644
--- a/security/landlock/task.c
+++ b/security/landlock/task.c
@@ -295,7 +295,8 @@ static int hook_unix_stream_connect(struct sock *const sock,
}
static int hook_unix_may_send(struct socket *const sock,
- struct socket *const other)
+ struct socket *const other,
+ struct sk_buff *skb)
{
size_t handle_layer;
const struct landlock_cred_security *const subject =
diff --git a/security/security.c b/security/security.c
index fb57e8fddd91..875dbc7ba34f 100644
--- a/security/security.c
+++ b/security/security.c
@@ -4531,9 +4531,10 @@ EXPORT_SYMBOL(security_unix_stream_connect);
*
* Return: Returns 0 if permission is granted.
*/
-int security_unix_may_send(struct socket *sock, struct socket *other)
+int security_unix_may_send(struct socket *sock, struct socket *other,
+ struct sk_buff *skb)
{
- return call_int_hook(unix_may_send, sock, other);
+ return call_int_hook(unix_may_send, sock, other, skb);
}
EXPORT_SYMBOL(security_unix_may_send);
diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index 9fb4cd442ffd..fcf14fb76e7f 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -5099,7 +5099,8 @@ static int selinux_socket_unix_stream_connect(struct sock *sock,
}
static int selinux_socket_unix_may_send(struct socket *sock,
- struct socket *other)
+ struct socket *other,
+ struct sk_buff *skb)
{
struct sk_security_struct *ssec = selinux_sock(sock->sk);
struct sk_security_struct *osec = selinux_sock(other->sk);
diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c
index 00aa1e7513c1..33827f4c5c76 100644
--- a/security/smack/smack_lsm.c
+++ b/security/smack/smack_lsm.c
@@ -3890,7 +3890,8 @@ static int smack_unix_stream_connect(struct sock *sock,
* Return 0 if a subject with the smack of sock could access
* an object with the smack of other, otherwise an error code
*/
-static int smack_unix_may_send(struct socket *sock, struct socket *other)
+static int smack_unix_may_send(struct socket *sock, struct socket *other,
+ struct sk_buff *skb)
{
struct socket_smack *ssp = smack_sock(sock->sk);
struct socket_smack *osp = smack_sock(other->sk);
--
2.49.0
More information about the Linux-security-module-archive
mailing list