On Thu, Apr 30, 2020 at 2:24 PM Paul Moore <paul@xxxxxxxxxxxxxx> wrote:
>
> Two more SELinux patches to fix problems in the v5.7-rcX releases.
> Wei Yongjun's patch fixes a return code in an error path, and my patch
> fixes a problem where we were not correctly applying access controls
> to all of the netlink messages in the netlink_send LSM hook.
Side note: could we plan on (not for 5.7, but future) moving the "for
each message" part of that patch into the generic security layer (ie
security_netlink_send()), so that if/when other security subsystems
start doing that netlink thing, they won't have to duplicate that
code?
Obviously the "for each message" thing should only be done if there is
any security hook at all..
Right now selinux is the only one that does this, so there's no
duplication of effort, but it seems a mistake to do this at the
low-level security level.
Or is there some fundamental reason why a security hook would want to
look at a single skb rather than the individual messages?
Linus
