On Fri, Dec 13, 2024 at 11:40 AM Mikhail Ivanov <ivanov.mikhail1@xxxxxxxxxxxxxxxxxxx> wrote: > > On 12/13/2024 6:46 PM, Stephen Smalley wrote: > > On Fri, Dec 13, 2024 at 5:57 AM Mikhail Ivanov > > <ivanov.mikhail1@xxxxxxxxxxxxxxxxxxx> wrote: > >> > >> On 12/12/2024 8:50 PM, Mickaël Salaün wrote: > >>> This looks good be there are other places using sk->sk_family that > >>> should also be fixed. > >> > >> Thanks for checking this! > >> > >> For selinux this should be enough, I haven't found any other places > >> where sk->sk_family could be read from an IPv6 socket without locking. > >> > >> I also would like to prepare such fix for other LSMs (apparmor, smack, > >> tomoyo) (in separate patches). > > > > I'm wondering about the implications for SELinux beyond just > > sk->sk_family access, e.g. SELinux maps the (family, type, protocol) > > triple to a security class at socket creation time via > > socket_type_to_security_class() and caches the security class in the > > inode_security_struct and sk_security_struct for later use. > > IPv6 and IPv4 TCP sockets are mapped to the same SECCLASS_TCP_SOCKET > security class. AFAICS there is no other places that can be affected by > the IPV6_ADDFORM transformation. Great, thank you for checking!
