Re: [PATCH] selinux: Read sk->sk_family once in selinux_socket_bind()

On Fri, Dec 13, 2024 at 11:40 AM Mikhail Ivanov
[off-list ref] wrote:

On 12/13/2024 6:46 PM, Stephen Smalley wrote:

quoted

On Fri, Dec 13, 2024 at 5:57 AM Mikhail Ivanov
[off-list ref] wrote:

quoted

On 12/12/2024 8:50 PM, Mickaël Salaün wrote:

quoted

This looks good be there are other places using sk->sk_family that
should also be fixed.

Thanks for checking this!

For selinux this should be enough, I haven't found any other places
where sk->sk_family could be read from an IPv6 socket without locking.

I also would like to prepare such fix for other LSMs (apparmor, smack,
tomoyo) (in separate patches).

I'm wondering about the implications for SELinux beyond just
sk->sk_family access, e.g. SELinux maps the (family, type, protocol)
triple to a security class at socket creation time via
socket_type_to_security_class() and caches the security class in the
inode_security_struct and sk_security_struct for later use.

IPv6 and IPv4 TCP sockets are mapped to the same SECCLASS_TCP_SOCKET
security class. AFAICS there is no other places that can be affected by
the IPV6_ADDFORM transformation.

Great, thank you for checking!