From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id D60EEC43217 for ; Tue, 15 Feb 2022 20:03:21 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S243970AbiBOUDa (ORCPT ); Tue, 15 Feb 2022 15:03:30 -0500 Received: from mxb-00190b01.gslb.pphosted.com ([23.128.96.19]:45806 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S243959AbiBOUD1 (ORCPT ); Tue, 15 Feb 2022 15:03:27 -0500 Received: from mail-ed1-x52b.google.com (mail-ed1-x52b.google.com [IPv6:2a00:1450:4864:20::52b]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 649F475608 for ; Tue, 15 Feb 2022 12:03:04 -0800 (PST) Received: by mail-ed1-x52b.google.com with SMTP id b13so233863edn.0 for ; Tue, 15 Feb 2022 12:03:04 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=paul-moore-com.20210112.gappssmtp.com; s=20210112; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=56tbQJVv90RABsQ0i0ptzrDmdvS83ZrjWE0KJ5/Juw8=; b=sFifZ3ibKjhu/WnpE7XgZp/C2bXZ7ift+MmeAVSa1hznUw6Wm07gSdft5d2fUe2Vn2 RjiRCYgEeTYyWMTxD06Z5LMTyKQZ5RluV4mRPZ8hVkTVElWuISequYHNfnVgs1JVpq+h xxaHe/Iv+2TTmvgqWPO0LZnQEBReR69V0AMuYUHxpEJAkG1St+MhQIgNHgZL37cOQaFq LwC5kUW7OHpEbm/5XIti6ajkRvwQWpQC5DoqvzT+ZOX325bSVD1WtjOMcq8+I+dZAQAv QXaY6x7vFTvffge/EC02QtULgmF6djGu6x5pF2BUtiqlB5PHHwiNmQmkGDrJbIl2VAHu 4iAw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=56tbQJVv90RABsQ0i0ptzrDmdvS83ZrjWE0KJ5/Juw8=; b=PxcNX98DDY1rugHMUS6wHbmLHxWWWNNuuIyfLmxvz9iTz7AihhqJMgH+Kt6uIBd/K7 dcwO4/tbq4vCWaK6YEQiG79WSPJxjiTOs5qFkpa8O3ceEXVObboC0CArVK8BzdqiSWaw DofZl5fw383pDrOyvdGmtCnk0aTWdK9lP9X+/DR0+b8VA7ipio2XTADmQTb5RC5DQqU5 OJ74c58d+lWlbKVTVlAdm9tbK7V82AWpQXd2NoCIC8J4KRFj+0gslWW7rAUr6lNKVwWo T+f0kfedJApTkLMwWnbrmSO1V7BukjiOspMJSq0JevsFJaf0U/H6PIHUOzgYAKhg/x/k dMfQ== X-Gm-Message-State: AOAM533SKUZNGuN1+y9Lfv/sykbUau7d3KNEKo7a3jd6okThPnJ8swlI KuIKnSRt2hKV4NDZUUZHgZvghuOE+5lX89tMPnunsyUztw== X-Google-Smtp-Source: ABdhPJwSh+Lbt7VtTxO+bjCuU4YBvFJI07pOtqxY+X5Ac/RcvpsJaiEfY8EBo10iskp6ziZLHDs9nkyLfRPbTaESgFg= X-Received: by 2002:a05:6402:35ca:: with SMTP id z10mr606628edc.43.1644955382916; Tue, 15 Feb 2022 12:03:02 -0800 (PST) MIME-Version: 1.0 References: <20220212175922.665442-1-omosnace@redhat.com> <20220212175922.665442-3-omosnace@redhat.com> <20220214165436.1f6a9987@kicinski-fedora-pc1c0hjn.dhcp.thefacebook.com> In-Reply-To: From: Paul Moore Date: Tue, 15 Feb 2022 15:02:51 -0500 Message-ID: Subject: Re: [PATCH net v3 2/2] security: implement sctp_assoc_established hook in selinux To: Xin Long Cc: Marcelo Ricardo Leitner , Jakub Kicinski , Ondrej Mosnacek , netdev , David Miller , SElinux list , Richard Haines , Vlad Yasevich , Neil Horman , "open list:SCTP PROTOCOL" , LSM List , LKML , Prashanth Prahlad Content-Type: text/plain; charset="UTF-8" Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org On Mon, Feb 14, 2022 at 11:13 PM Xin Long wrote: > Looks okay to me. > > The difference from the old one is that: with > selinux_sctp_process_new_assoc() called in > selinux_sctp_assoc_established(), the client sksec->peer_sid is using > the first asoc's peer_secid, instead of the latest asoc's peer_secid. > And not sure if it will cause any problems when doing the extra check > sksec->peer_sid != asoc->peer_secid for the latest asoc and *returns > err*. But I don't know about selinux, I guess there must be a reason > from selinux side. Generally speaking we don't want to change any SELinux socket labels once it has been created. While the peer_sid is a bit different, changing it after userspace has access to the socket could be problematic. In the case where the peer_sid differs between the two we have a permission check which allows policy to control this behavior which seems like the best option at this point. > I will ACK on patch 0/2. Thanks, I'm going to go ahead and merge these two patches into selinux/next right now. -- paul-moore.com