On Thu, Apr 30, 2020 at 7:43 PM Linus Torvalds
[off-list ref] wrote:

On Thu, Apr 30, 2020 at 2:24 PM Paul Moore [off-list ref] wrote:

quoted

Two more SELinux patches to fix problems in the v5.7-rcX releases.
Wei Yongjun's patch fixes a return code in an error path, and my patch
fixes a problem where we were not correctly applying access controls
to all of the netlink messages in the netlink_send LSM hook.

Side note: could we plan on (not for 5.7, but future) moving the "for
each message" part of that patch into the generic security layer (ie
security_netlink_send()), so that if/when other security subsystems
start doing that netlink thing, they won't have to duplicate that
code?

Obviously the "for each message" thing should only be done if there is
any security  hook at all..

Right now selinux is the only one that does this, so there's no
duplication of effort, but it seems a mistake to do this at the
low-level security level.

Or is there some fundamental reason why a security hook would want to
look at a single skb rather than the individual messages?

Off the top of my head I can't think of why a LSM would want to look
only at the skb instead of the individual netlink messages.  I suppose
if that ever becomes an issue we could always pass the skb to the hook
along with the nlmsghdr, and the LSM would just need to deal with
being called multiple times for the same skb.  Another option might be
to give the LSM the option of registering one of two hooks for the
netlink_send hook; one type of hook would behave the same as the hook
does now, the other type would be called once for each message in the
skb.  Although this second option seems like a lot of extra complexity
for a questionable advantage, especially since only SELinux is using
the hook at the moment and we can easily change the hook without
breaking things.

It's also worth mentioning that we've always tried to keep the hook
layer (the stuff in security/security.c) relatively thin, but that's a
battle we've been slowly losing over time.  Moving the skb/nlmsghdr
processing into security_netlink_send() seems reasonable given some of
the other hooks.

Regardless, I'll work on something for an upcoming merge window, stay tuned.

-- 
paul moore
www.paul-moore.com