Le 09/01/2025 à 00:15, Thiébaud Weksteen a écrit :
> The mapping for RTM_DELNSID was added in commit 387f989a60db
> ("selinux/nlmsg: add RTM_GETNSID"). While this message type is not
> expected from userspace, other RTM_DEL* types are mapped to the more
> restrictive nlmsg_write permission. Move RTM_DELNSID to nlmsg_write in
> case the implementation is changed in the future.
Frankly, I don't think this will ever change. It's not a problem of implementing
the delete command, it's conceptually no sense.
I don't see why the DEL should be restricted in any way.
Regards,
Nicolas
>
> Fixes: 387f989a60db ("selinux/nlmsg: add RTM_GETNSID")
> Signed-off-by: Thiébaud Weksteen <tweek@xxxxxxxxxx>
> ---
> security/selinux/nlmsgtab.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/security/selinux/nlmsgtab.c b/security/selinux/nlmsgtab.c
> index 3a95986b134f..f97e75301018 100644
> --- a/security/selinux/nlmsgtab.c
> +++ b/security/selinux/nlmsgtab.c
> @@ -71,7 +71,7 @@ static const struct nlmsg_perm nlmsg_route_perms[] = {
> { RTM_DELMDB, NETLINK_ROUTE_SOCKET__NLMSG_WRITE },
> { RTM_GETMDB, NETLINK_ROUTE_SOCKET__NLMSG_READ },
> { RTM_NEWNSID, NETLINK_ROUTE_SOCKET__NLMSG_WRITE },
> - { RTM_DELNSID, NETLINK_ROUTE_SOCKET__NLMSG_READ },
> + { RTM_DELNSID, NETLINK_ROUTE_SOCKET__NLMSG_WRITE },
> { RTM_GETNSID, NETLINK_ROUTE_SOCKET__NLMSG_READ },
> { RTM_NEWSTATS, NETLINK_ROUTE_SOCKET__NLMSG_READ },
> { RTM_GETSTATS, NETLINK_ROUTE_SOCKET__NLMSG_READ },
