Currently, kernel would set MSG_CTRUNC flag if msg_control buffer
wasn't provided and SO_PASSCRED was set or if there was pending SCM_RIGHTS.
For some reason we have no corresponding check for SO_PASSSEC.
In the recvmsg(2) doc we have:
MSG_CTRUNC
indicates that some control data was discarded due to lack
of space in the buffer for ancillary data.
So, we need to set MSG_CTRUNC flag for all types of SCM.
This change can break applications those don't check MSG_CTRUNC flag.
Cc: "David S. Miller" <[email protected]>
Cc: Eric Dumazet <[email protected]>
Cc: Jakub Kicinski <[email protected]>
Cc: Paolo Abeni <[email protected]>
Cc: Leon Romanovsky <[email protected]>
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Alexander Mikhalitsyn <[email protected]>
v2:
- commit message was rewritten according to Eric's suggestion
---
include/net/scm.h | 13 ++++++++++++-
1 file changed, 12 insertions(+), 1 deletion(-)
diff --git a/include/net/scm.h b/include/net/scm.h
index 1ce365f4c256..585adc1346bd 100644
--- a/include/net/scm.h
+++ b/include/net/scm.h
@@ -105,16 +105,27 @@ static inline void scm_passec(struct socket *sock, struct msghdr *msg, struct sc
}
}
}
+
+static inline bool scm_has_secdata(struct socket *sock)
+{
+ return test_bit(SOCK_PASSSEC, &sock->flags);
+}
#else
static inline void scm_passec(struct socket *sock, struct msghdr *msg, struct scm_cookie *scm)
{ }
+
+static inline bool scm_has_secdata(struct socket *sock)
+{
+ return false;
+}
#endif /* CONFIG_SECURITY_NETWORK */
static __inline__ void scm_recv(struct socket *sock, struct msghdr *msg,
struct scm_cookie *scm, int flags)
{
if (!msg->msg_control) {
- if (test_bit(SOCK_PASSCRED, &sock->flags) || scm->fp)
+ if (test_bit(SOCK_PASSCRED, &sock->flags) || scm->fp ||
+ scm_has_secdata(sock))
msg->msg_flags |= MSG_CTRUNC;
scm_destroy(scm);
return;
--
2.34.1
+CC security subsystem folks
On Mon, Mar 13, 2023 at 12:32 PM Alexander Mikhalitsyn
<[email protected]> wrote:
>
> Currently, kernel would set MSG_CTRUNC flag if msg_control buffer
> wasn't provided and SO_PASSCRED was set or if there was pending SCM_RIGHTS.
>
> For some reason we have no corresponding check for SO_PASSSEC.
>
> In the recvmsg(2) doc we have:
> MSG_CTRUNC
> indicates that some control data was discarded due to lack
> of space in the buffer for ancillary data.
>
> So, we need to set MSG_CTRUNC flag for all types of SCM.
>
> This change can break applications those don't check MSG_CTRUNC flag.
>
> Cc: "David S. Miller" <[email protected]>
> Cc: Eric Dumazet <[email protected]>
> Cc: Jakub Kicinski <[email protected]>
> Cc: Paolo Abeni <[email protected]>
> Cc: Leon Romanovsky <[email protected]>
> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
> Signed-off-by: Alexander Mikhalitsyn <[email protected]>
>
> v2:
> - commit message was rewritten according to Eric's suggestion
> ---
> include/net/scm.h | 13 ++++++++++++-
> 1 file changed, 12 insertions(+), 1 deletion(-)
>
> diff --git a/include/net/scm.h b/include/net/scm.h
> index 1ce365f4c256..585adc1346bd 100644
> --- a/include/net/scm.h
> +++ b/include/net/scm.h
> @@ -105,16 +105,27 @@ static inline void scm_passec(struct socket *sock, struct msghdr *msg, struct sc
> }
> }
> }
> +
> +static inline bool scm_has_secdata(struct socket *sock)
> +{
> + return test_bit(SOCK_PASSSEC, &sock->flags);
> +}
> #else
> static inline void scm_passec(struct socket *sock, struct msghdr *msg, struct scm_cookie *scm)
> { }
> +
> +static inline bool scm_has_secdata(struct socket *sock)
> +{
> + return false;
> +}
> #endif /* CONFIG_SECURITY_NETWORK */
>
> static __inline__ void scm_recv(struct socket *sock, struct msghdr *msg,
> struct scm_cookie *scm, int flags)
> {
> if (!msg->msg_control) {
> - if (test_bit(SOCK_PASSCRED, &sock->flags) || scm->fp)
> + if (test_bit(SOCK_PASSCRED, &sock->flags) || scm->fp ||
> + scm_has_secdata(sock))
> msg->msg_flags |= MSG_CTRUNC;
> scm_destroy(scm);
> return;
> --
> 2.34.1
>
On Mon, Mar 13, 2023 at 7:40 AM Aleksandr Mikhalitsyn
<[email protected]> wrote:
>
> +CC security subsystem folks
>
> On Mon, Mar 13, 2023 at 12:32 PM Alexander Mikhalitsyn
> <[email protected]> wrote:
> >
> > Currently, kernel would set MSG_CTRUNC flag if msg_control buffer
> > wasn't provided and SO_PASSCRED was set or if there was pending SCM_RIGHTS.
> >
> > For some reason we have no corresponding check for SO_PASSSEC.
> >
> > In the recvmsg(2) doc we have:
> > MSG_CTRUNC
> > indicates that some control data was discarded due to lack
> > of space in the buffer for ancillary data.
> >
> > So, we need to set MSG_CTRUNC flag for all types of SCM.
> >
> > This change can break applications those don't check MSG_CTRUNC flag.
Unless I'm missing something I don't think this will actually result
in a userspace visible change as put_cmsg() already has a number of
checks which set the MSG_CTRUNC flag if necessary (including if no
control buffer is passed, e.g. msg_control == NULL).
Regardless, it looks fine to me.
Acked-by: Paul Moore <[email protected]>
> > Cc: "David S. Miller" <[email protected]>
> > Cc: Eric Dumazet <[email protected]>
> > Cc: Jakub Kicinski <[email protected]>
> > Cc: Paolo Abeni <[email protected]>
> > Cc: Leon Romanovsky <[email protected]>
> > Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
> > Signed-off-by: Alexander Mikhalitsyn <[email protected]>
> >
> > v2:
> > - commit message was rewritten according to Eric's suggestion
> > ---
> > include/net/scm.h | 13 ++++++++++++-
> > 1 file changed, 12 insertions(+), 1 deletion(-)
> >
> > diff --git a/include/net/scm.h b/include/net/scm.h
> > index 1ce365f4c256..585adc1346bd 100644
> > --- a/include/net/scm.h
> > +++ b/include/net/scm.h
> > @@ -105,16 +105,27 @@ static inline void scm_passec(struct socket *sock, struct msghdr *msg, struct sc
> > }
> > }
> > }
> > +
> > +static inline bool scm_has_secdata(struct socket *sock)
> > +{
> > + return test_bit(SOCK_PASSSEC, &sock->flags);
> > +}
> > #else
> > static inline void scm_passec(struct socket *sock, struct msghdr *msg, struct scm_cookie *scm)
> > { }
> > +
> > +static inline bool scm_has_secdata(struct socket *sock)
> > +{
> > + return false;
> > +}
> > #endif /* CONFIG_SECURITY_NETWORK */
> >
> > static __inline__ void scm_recv(struct socket *sock, struct msghdr *msg,
> > struct scm_cookie *scm, int flags)
> > {
> > if (!msg->msg_control) {
> > - if (test_bit(SOCK_PASSCRED, &sock->flags) || scm->fp)
> > + if (test_bit(SOCK_PASSCRED, &sock->flags) || scm->fp ||
> > + scm_has_secdata(sock))
> > msg->msg_flags |= MSG_CTRUNC;
> > scm_destroy(scm);
> > return;
> > --
> > 2.34.1
--
paul-moore.com
On Mon, Mar 13, 2023 at 9:43 PM Paul Moore <[email protected]> wrote:
>
> On Mon, Mar 13, 2023 at 7:40 AM Aleksandr Mikhalitsyn
> <[email protected]> wrote:
> >
> > +CC security subsystem folks
> >
> > On Mon, Mar 13, 2023 at 12:32 PM Alexander Mikhalitsyn
> > <[email protected]> wrote:
> > >
> > > Currently, kernel would set MSG_CTRUNC flag if msg_control buffer
> > > wasn't provided and SO_PASSCRED was set or if there was pending SCM_RIGHTS.
> > >
> > > For some reason we have no corresponding check for SO_PASSSEC.
> > >
> > > In the recvmsg(2) doc we have:
> > > MSG_CTRUNC
> > > indicates that some control data was discarded due to lack
> > > of space in the buffer for ancillary data.
> > >
> > > So, we need to set MSG_CTRUNC flag for all types of SCM.
> > >
> > > This change can break applications those don't check MSG_CTRUNC flag.
>
> Unless I'm missing something I don't think this will actually result
> in a userspace visible change as put_cmsg() already has a number of
> checks which set the MSG_CTRUNC flag if necessary (including if no
> control buffer is passed, e.g. msg_control == NULL).
Yes you are right. I found this check suspicious while working on
SCM_PIDFD (which is not yet submitted to LKML),
I think it is worth fixing that check anyway just for consistency reasons.
>
> Regardless, it looks fine to me.
>
> Acked-by: Paul Moore <[email protected]>
Thanks, Paul!
Regards,
Alex
>
> > > Cc: "David S. Miller" <[email protected]>
> > > Cc: Eric Dumazet <[email protected]>
> > > Cc: Jakub Kicinski <[email protected]>
> > > Cc: Paolo Abeni <[email protected]>
> > > Cc: Leon Romanovsky <[email protected]>
> > > Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
> > > Signed-off-by: Alexander Mikhalitsyn <[email protected]>
> > >
> > > v2:
> > > - commit message was rewritten according to Eric's suggestion
> > > ---
> > > include/net/scm.h | 13 ++++++++++++-
> > > 1 file changed, 12 insertions(+), 1 deletion(-)
> > >
> > > diff --git a/include/net/scm.h b/include/net/scm.h
> > > index 1ce365f4c256..585adc1346bd 100644
> > > --- a/include/net/scm.h
> > > +++ b/include/net/scm.h
> > > @@ -105,16 +105,27 @@ static inline void scm_passec(struct socket *sock, struct msghdr *msg, struct sc
> > > }
> > > }
> > > }
> > > +
> > > +static inline bool scm_has_secdata(struct socket *sock)
> > > +{
> > > + return test_bit(SOCK_PASSSEC, &sock->flags);
> > > +}
> > > #else
> > > static inline void scm_passec(struct socket *sock, struct msghdr *msg, struct scm_cookie *scm)
> > > { }
> > > +
> > > +static inline bool scm_has_secdata(struct socket *sock)
> > > +{
> > > + return false;
> > > +}
> > > #endif /* CONFIG_SECURITY_NETWORK */
> > >
> > > static __inline__ void scm_recv(struct socket *sock, struct msghdr *msg,
> > > struct scm_cookie *scm, int flags)
> > > {
> > > if (!msg->msg_control) {
> > > - if (test_bit(SOCK_PASSCRED, &sock->flags) || scm->fp)
> > > + if (test_bit(SOCK_PASSCRED, &sock->flags) || scm->fp ||
> > > + scm_has_secdata(sock))
> > > msg->msg_flags |= MSG_CTRUNC;
> > > scm_destroy(scm);
> > > return;
> > > --
> > > 2.34.1
>
> --
> paul-moore.com
Hello:
This patch was applied to netdev/net-next.git (main)
by David S. Miller <[email protected]>:
On Mon, 13 Mar 2023 12:32:11 +0100 you wrote:
> Currently, kernel would set MSG_CTRUNC flag if msg_control buffer
> wasn't provided and SO_PASSCRED was set or if there was pending SCM_RIGHTS.
>
> For some reason we have no corresponding check for SO_PASSSEC.
>
> In the recvmsg(2) doc we have:
> MSG_CTRUNC
> indicates that some control data was discarded due to lack
> of space in the buffer for ancillary data.
>
> [...]
Here is the summary with links:
- [net-next,v2] scm: fix MSG_CTRUNC setting condition for SO_PASSSEC
https://git.kernel.org/netdev/net-next/c/a02d83f9947d
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html