On Thu, Aug 15, 2024 at 11:57 PM Jeongjun Park <aha310510@xxxxxxxxx> wrote: > > Paul Moore wrote: > > > > On Thu, Aug 15, 2024 at 4:32 AM Jeongjun Park <aha310510@xxxxxxxxx> wrote: > > > > > > IPPROTO_SMC feature has been added to net/smc. It is now possible to > > > create smc sockets in the following way: > > > > > > /* create v4 smc sock */ > > > v4 = socket(AF_INET, SOCK_STREAM, IPPROTO_SMC); > > > > > > /* create v6 smc sock */ > > > v6 = socket(AF_INET6, SOCK_STREAM, IPPROTO_SMC); > > > > > > Therefore, we need to add code to support IPPROTO_SMC in > > > socket_type_to_security_class(). > > > > > > Signed-off-by: Jeongjun Park <aha310510@xxxxxxxxx> > > > --- > > > security/selinux/hooks.c | 2 ++ > > > 1 file changed, 2 insertions(+) > > > > I'm a little concerned that the small patch below might not be all > > that is needed to properly support SMC in SELinux. Can you explain > > what testing you've done with SMC on a SELinux system? > > I don't have much knowledge about smc, so I can't tested everything, but > I created a socket, performed setsockopt, and tested two sockets > communicating with each other. When I tested it, performing smc-related > functions worked well without any major problems. > > And after analyzing it myself, I didn't see any additional patches needed > to support IPPROTO_SMC in selinux other than this patch. So you don't > have to worry. Note that Jeongjun is not introducing SELinux support for SMC sockets for the first time here; he is just updating the already existing support to correctly map the new IPPROTO_SMC to the already existing SECCLASS_SMC_SOCKET. We were already handling such sockets created via socket(AF_SMC, ...); what changed was that they added support for creating them via socket(AF_INET, SOCK_STREAM, IPPROTO_SMC) too.
