Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1759820Ab2HIWF2 (ORCPT ); Thu, 9 Aug 2012 18:05:28 -0400 Received: from mail-we0-f174.google.com ([74.125.82.174]:34282 "EHLO mail-we0-f174.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752525Ab2HIWF0 (ORCPT ); Thu, 9 Aug 2012 18:05:26 -0400 Subject: Re: [PATCH] ipv4: tcp: security_sk_alloc() needed for unicast_sock From: Eric Dumazet To: Casey Schaufler Cc: Eric Paris , Paul Moore , David Miller , John Stultz , "Serge E. Hallyn" , lkml , James Morris , selinux@tycho.nsa.gov, john.johansen@canonical.com, LSM , netdev In-Reply-To: <5024313F.1010404@schaufler-ca.com> References: <50215A7E.8000701@linaro.org> <1344462889.28967.328.camel@edumazet-glaptop> <5022FD9A.4020603@schaufler-ca.com> <1695034.0lrQgQPOMT@sifl> <1344523833.28967.996.camel@edumazet-glaptop> <1344547743.31104.582.camel@edumazet-glaptop> <5024313F.1010404@schaufler-ca.com> Content-Type: text/plain; charset="UTF-8" Date: Fri, 10 Aug 2012 00:05:20 +0200 Message-ID: <1344549920.31104.701.camel@edumazet-glaptop> Mime-Version: 1.0 X-Mailer: Evolution 2.28.3 Content-Transfer-Encoding: 7bit Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1470 Lines: 39 On Thu, 2012-08-09 at 14:53 -0700, Casey Schaufler wrote: > On 8/9/2012 2:29 PM, Eric Dumazet wrote: > > smack_sk_alloc_security() uses smk_of_current() : What can be the > > meaning of smk_of_current() in the context of 'kernel' sockets... > > Yes, and all of it's callers - to date - have had an appropriate > value of current. It is using the API in the way it is supposed to. > It is assuming a properly formed socket. You want to give it a > cobbled together partial socket structure without task context. > Your predecessor did not have this problem. My predecessor ? You mean before the patch ? tcp socket was preallocated by at kernel boot time. What is the 'user' owning this socket ? You guys focus on an implementation detail of TCP stack. You should never use this fake socket. I repeat : There are no true socket for these control packets. If you want them, then you'll have to add fields in timewait socket. I can decide to rewrite the whole thing just building a TCP packet on its own, and send it without any fake socket. Some guy 15 years ago tried to reuse some high level functions, able to build super packets and use sophisticated tricks, while we only want so send a 40 or 60 bytes packet. -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/