mirrors/linux
2
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2026-07-16 17:57:38 -04:00
Code Issues Packages Projects Releases Wiki Activity

net: Restrict SO_PASS{CRED,PIDFD,SEC} to AF_{UNIX,NETLINK,BLUETOOTH}.

Browse Source 
SCM_CREDENTIALS and SCM_SECURITY can be recv()ed by calling
scm_recv() or scm_recv_unix(), and SCM_PIDFD is only used by
scm_recv_unix().

scm_recv() is called from AF_NETLINK and AF_BLUETOOTH.

scm_recv_unix() is literally called from AF_UNIX.

Let's restrict SO_PASSCRED and SO_PASSSEC to such sockets and
SO_PASSPIDFD to AF_UNIX only.

Later, SOCK_PASS{CRED,PIDFD,SEC} will be moved to struct sock
and united with another field.

Signed-off-by: Kuniyuki Iwashima <kuniyu@amazon.com>
Reviewed-by: Willem de Bruijn <willemb@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
Kuniyuki Iwashima
2025-05-19 13:57:56 -07:00
committed by David S. Miller
parent ae4f2f59e1
commit 7d8d93fdde
2 changed files with 31 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
include/net/sock.h
View File

@@ -2773,9 +2773,14 @@ static inline bool sk_is_udp(const struct sock *sk)
sk->sk_protocol == IPPROTO_UDP;
}
static inline bool sk_is_unix(const struct sock *sk)
{
return sk->sk_family == AF_UNIX;
}
static inline bool sk_is_stream_unix(const struct sock *sk)
{
return sk->sk_family == AF_UNIX && sk->sk_type == SOCK_STREAM;
return sk_is_unix(sk) && sk->sk_type == SOCK_STREAM;
}
static inline bool sk_is_vsock(const struct sock *sk)
@@ -2783,6 +2788,13 @@ static inline bool sk_is_vsock(const struct sock *sk)
return sk->sk_family == AF_VSOCK;
}
static inline bool sk_may_scm_recv(const struct sock *sk)
{
return (IS_ENABLED(CONFIG_UNIX) && sk->sk_family == AF_UNIX) ||
sk->sk_family == AF_NETLINK ||
(IS_ENABLED(CONFIG_BT) && sk->sk_family == AF_BLUETOOTH);
}
/**
* sk_eat_skb - Release a skb if it is no longer needed
* @sk: socket to eat this skb from