Received: by 2002:a05:6a11:4021:0:0:0:0 with SMTP id ky33csp448640pxb; Tue, 14 Sep 2021 00:52:01 -0700 (PDT) X-Google-Smtp-Source: ABdhPJx9SPEFrN4g1NDZYdvKrhuhaTyEetlKFqXfakc2Sdu16ntQ+oT3nCAJbg1pvqAx1H0MhEVp X-Received: by 2002:a05:6e02:504:: with SMTP id d4mr11497248ils.316.1631605921318; Tue, 14 Sep 2021 00:52:01 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1631605921; cv=none; d=google.com; s=arc-20160816; b=Vo38IBkILR8GAS8Z1u/L7ckDhU59YGsvWRV6hz6w+bkOHFRa9gGxjd+bZD2RkKd/L0 mhZIOpyaNV1iSKqUGyHQcNQd9NiPC7fWsqxKL86RtW8slK4bVfCT1t/928IdefbIWgU/ 6kkByEmfAS8bZLfxLaF/HN7zeQX8/Av/eOaY+3vhyiA0PDdQdspqvD24yJ1UcYrTMfnZ 3dtnYDGzsppMpF9g+2+zEaVa31/BHaz5jVZ1yEzwJ5UVDsBYFJXGu/sWvbEute9juxEZ Ipna7/2jbXtHXT5/0H2+zTlMNQm/Hg4hhxlAFn2LSjQbIyLxAFOnwxGFdinNVkH+6uL/ 6mPA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:content-language :in-reply-to:mime-version:user-agent:date:message-id:organization :from:references:cc:to:subject:reply-to:dkim-signature; bh=fQQsBMV/KZRW/W+H2x46A5MmwVr95aBTpydU/d7M2HU=; b=xjlljXV/aXtduxr3UTnW8RRqBWAkU7b2M/75qLQrK7w8iKCvFcNNHIX6eU7DJbdXnI nshOtvY75Eh4GFR77G++KnyfdlcqNuSC81sro+12nDkfNlCaIUqTsBJb9nfO2iLI7W+J lM2qDrWCmIL399ZatXY7u83XbojpP81/Zhu2vvZWqszBqLPTTVeVPyI7Dw2m6Xw4MdTv tCTKCMoPdp4/D80g5+cTBo0c2PhP/+oFc3+WcGxz/QUY3YW//ZkS9l6ByG1bIV50ncIL W2fOvIfHetUFNLHykfYbtxLoHNw+VR9WuyhgAIqwlsbpJy+mBFAkxcQ2AJ1mvrx6w6sJ Mdig== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@6wind.com header.s=google header.b=AAjpTdBA; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=6wind.com Return-Path: Received: from vger.kernel.org (vger.kernel.org. [23.128.96.18]) by mx.google.com with ESMTP id o13si10623303iow.110.2021.09.14.00.51.49; Tue, 14 Sep 2021 00:52:01 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18; Authentication-Results: mx.google.com; dkim=pass header.i=@6wind.com header.s=google header.b=AAjpTdBA; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=6wind.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231313AbhINHwW (ORCPT + 99 others); Tue, 14 Sep 2021 03:52:22 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:57414 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S231867AbhINHwH (ORCPT ); Tue, 14 Sep 2021 03:52:07 -0400 Received: from mail-wm1-x330.google.com (mail-wm1-x330.google.com [IPv6:2a00:1450:4864:20::330]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id AEAA9C061794 for ; Tue, 14 Sep 2021 00:50:12 -0700 (PDT) Received: by mail-wm1-x330.google.com with SMTP id g19-20020a1c9d13000000b003075062d4daso1782184wme.0 for ; Tue, 14 Sep 2021 00:50:12 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=6wind.com; s=google; h=reply-to:subject:to:cc:references:from:organization:message-id:date :user-agent:mime-version:in-reply-to:content-language :content-transfer-encoding; bh=fQQsBMV/KZRW/W+H2x46A5MmwVr95aBTpydU/d7M2HU=; b=AAjpTdBAhVY5A9abSR3cTV0Gdf/FJZyO4h7UFY9WJwTTbhzLUwas+aaaisHVDEj0k+ ENHa2/XA9Mh2s5Ju3ON8/Lr5RW6LWd3ohSieGKtfbUJ47Vc42IuhCmLZJUmoKwTBFKxb +bjPrKYIZkiMEdJdpuEkMzKp73uofCIQ3mFPnmebzxvzF7NnwHurzMaqZNWz8I5lslyt MwP9IP4i3ckQpDiU1NsEbEfrIfu+EHbyC4T7IFlehCsRhQlU+a42wNfzrSHEAoZ1ug1a Lgg3to8Ga84J1iDwwtOzDEq3E03H69BSe27MxiDm+iRzgoochO9W329XnnM2IUPaSk2/ 2hbg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:reply-to:subject:to:cc:references:from :organization:message-id:date:user-agent:mime-version:in-reply-to :content-language:content-transfer-encoding; bh=fQQsBMV/KZRW/W+H2x46A5MmwVr95aBTpydU/d7M2HU=; b=xLdJL6Lu8YGTKqlVnNmRwmIWPoTKJCJ91XDtivukIddUCFn6XdlE81vAttTchlCphs CljYemMfJWBcvg/GbA39y8UCtVsL0EmHOn3ci3HxRVl3qhClMA7D+tBo7L1jcrS4r22j C3heUhWoeLH12sS0ZUYnD0uP+coDxCkhMKEhi7KK/9rwX0ROYy/86R3nXX1FDNz0Xpd9 7HS3kUgS8sdiaOfmadITwENSfBKZfSsOjOTBVUfzA+2glSt5uJX6wcWPj9Fl311fFNd8 vWeKRcjNqy/WHQafvtESxF7p9ZCwhwE4SLfXyuTq0QvYy5AX6X3/21/D2sHUzjUzxYxQ 3F5g== X-Gm-Message-State: AOAM531JF7U1oMSPpMdM7MAhZ+W0kozHIQO/OVPIOSwVX2iGRWYByhee 4SwCaJUpfDpaHT8qG26MWSokaQ== X-Received: by 2002:a7b:ce06:: with SMTP id m6mr619819wmc.85.1631605811109; Tue, 14 Sep 2021 00:50:11 -0700 (PDT) Received: from [10.16.0.69] (host.78.145.23.62.rev.coltfrance.com. [62.23.145.78]) by smtp.gmail.com with ESMTPSA id r27sm9531178wrr.70.2021.09.14.00.50.10 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Tue, 14 Sep 2021 00:50:10 -0700 (PDT) Reply-To: nicolas.dichtel@6wind.com Subject: Re: [PATCH v2] include/uapi/linux/xfrm.h: Fix XFRM_MSG_MAPPING ABI breakage To: Eugene Syromiatnikov , Steffen Klassert , Herbert Xu , "David S. Miller" , Antony Antony , Christian Langrock Cc: selinux@vger.kernel.org, Paul Moore , Stephen Smalley , Eric Paris , netdev@vger.kernel.org, linux-kernel@vger.kernel.org, "Dmitry V. Levin" , linux-api@vger.kernel.org References: <20210912122234.GA22469@asgard.redhat.com> From: Nicolas Dichtel Organization: 6WIND Message-ID: <9ce148b0-7694-83f7-0d04-546e2cae9500@6wind.com> Date: Tue, 14 Sep 2021 09:50:10 +0200 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Thunderbird/78.13.0 MIME-Version: 1.0 In-Reply-To: <20210912122234.GA22469@asgard.redhat.com> Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: 8bit Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Le 12/09/2021 à 14:22, Eugene Syromiatnikov a écrit : > Commit 2d151d39073a ("xfrm: Add possibility to set the default to block > if we have no policy") broke ABI by changing the value of the XFRM_MSG_MAPPING > enum item, thus also evading the build-time check > in security/selinux/nlmsgtab.c:selinux_nlmsg_lookup for presence of proper > security permission checks in nlmsg_xfrm_perms. Fix it by placing > XFRM_MSG_SETDEFAULT/XFRM_MSG_GETDEFAULT to the end of the enum, right before > __XFRM_MSG_MAX, and updating the nlmsg_xfrm_perms accordingly. > > Fixes: 2d151d39073a ("xfrm: Add possibility to set the default to block if we have no policy") > References: https://lore.kernel.org/netdev/20210901151402.GA2557@altlinux.org/ > Signed-off-by: Eugene Syromiatnikov Acked-by: Nicolas Dichtel