# Re: \[PATCH v4 net-next 8/9\] af\_unix: Introduce SO\_PASSRIGHTS.

- From: Willem de Bruijn \<willemdebruijn.kernel@gmail.com\>
- Date: 2025-05-16 16:30:20 
- List: netdev
- Page: https://ratatoskr.run/netdev/2025/05/11327489
- Thread: https://ratatoskr.run/netdev/2025/05/11327390/t.md

```text
Kuniyuki Iwashima wrote:
> As long as recvmsg() or recvmmsg() is used with cmsg, it is not
> possible to avoid receiving file descriptors via SCM_RIGHTS.
> 
> This behaviour has occasionally been flagged as problematic, as
> it can be (ab)used to trigger DoS during close(), for example, by
> passing a FUSE-controlled fd or a hung NFS fd.
> 
> For instance, as noted on the uAPI Group page [0], an untrusted peer
> could send a file descriptor pointing to a hung NFS mount and then
> close it.  Once the receiver calls recvmsg() with msg_control, the
> descriptor is automatically installed, and then the responsibility
> for the final close() now falls on the receiver, which may result
> in blocking the process for a long time.
> 
> Regarding this, systemd calls cmsg_close_all() [1] after each
> recvmsg() to close() unwanted file descriptors sent via SCM_RIGHTS.
> 
> However, this cannot work around the issue at all, because the final
> fput() may still occur on the receiver's side once sendmsg() with
> SCM_RIGHTS succeeds.  Also, even filtering by LSM at recvmsg() does
> not work for the same reason.
> 
> Thus, we need a better way to refuse SCM_RIGHTS at sendmsg().
> 
> Let's introduce SO_PASSRIGHTS to disable SCM_RIGHTS.
> 
> Note that this option is enabled by default for backward
> compatibility.
> 
> Link: https://uapi-group.org/kernel-features/#disabling-reception-of-scm_rights-for-af_unix-sockets #[0]
> Link: https://github.com/systemd/systemd/blob/v257.5/src/basic/fd-util.c#L612-L628 #[1]
> Signed-off-by: Kuniyuki Iwashima <redacted>

Reviewed-by: Willem de Bruijn <willemb@google.com>
```