Thread (35 messages) 35 messages, 8 authors, 2011-08-04

Re: [PATCH] net: Fix security_socket_sendmsg() bypass problem.

From: Anton Blanchard <hidden>
Date: 2011-07-25 12:20:10

Hi,
quoted
(I noticed samba.org address in the Cc list).
That's because Anton Blanchard is author of sendmmsg() system call.
Ignore the From address - I wasn't adding sendmmsg with samba in mind.
quoted
When I saw recvmmsg()/sendmmsg() here, my first thought was an
authoritative DNS server which can read several requests at a
time and answer them all at once too - this way it all will go
to different addresses.
I don't know what application wants sendmmsg(). Since users can send
up to UIO_MAXIOV (= 1024) "struct iovec" blocks using sendmsg(), they
will use sendmsg() rather than sendmmsg() if the destination address
are the same.
But if an application needs to maintain packet boundaries, then sendmsg
isn't going to help is it?
 
Therefore, I guess users will use sendmmsg() for sending to multiple
different destination addresses. If so, optimization based on
destination address will do more harm than benefit; simply passing
nosec flag down to LSM modules (so that SELinux will skip
sock_has_perm() call and SMACK will not skip smack_netlabel_send()
call) will be sufficient for 3.0.x stable release.

Anton, how do you want to use sendmmsg()?
I was using it for packet generation, using raw sockets.

Anton
Keyboard shortcuts
hback out one level
jnext message in thread
kprevious message in thread
ldrill in
Escclose help / fold thread tree
?toggle this help