From: Justin Suess <utilityemal77@gmail•com>
To: Tingmao Wang <m@maowtm•org>
Cc: gnoack3000@gmail•com, gnoack@google•com, horms@kernel•org,
jmorris@namei•org, kuniyu@google•com,
linux-security-module@vger•kernel.org, mic@digikod•net,
netdev@vger•kernel.org, paul@paul-moore•com, serge@hallyn•com
Subject: Re: [RFC PATCH 0/1] lsm: Add hook unix_path_connect
Date: Thu, 1 Jan 2026 18:40:49 -0500 [thread overview]
Message-ID: <714c39e3-61fa-449c-b4ab-bdb41a35fc40@gmail.com> (raw)
In-Reply-To: <b992df90-92da-48bd-91d1-051af9670d07@maowtm.org>
On 1/1/26 18:11, Tingmao Wang wrote:
> On 1/1/26 19:45, Justin Suess wrote:
>> [...]
>> diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
>> index 55cdebfa0da0..397687e2d87f 100644
>> --- a/net/unix/af_unix.c
>> +++ b/net/unix/af_unix.c
>> @@ -1226,6 +1226,18 @@ static struct sock *unix_find_bsd(struct
>> sockaddr_un *sunaddr, int addr_len,
>> if (!S_ISSOCK(inode->i_mode))
>> goto path_put;
>>
>> + /*
>> + * We call the hook because we know that the inode is a socket
>> + * and we hold a valid reference to it via the path.
>> + * We intentionally forgo the ability to restrict SOCK_COREDUMP.
>> + */
>> + if (!(flags & SOCK_COREDUMP)) {
>> + err = security_unix_path_connect(&path);
>> + if (err)
>> + goto path_put;
>> + err = -ECONNREFUSED;
> I'm not sure if this is a good suggestion, but I think it might be cleaner
> to move this `err = -ECONNREFUSED;` out of the if, and do it
> unconditionally above the `sk = unix_find_socket_byinode(inode);` below?
> To me that makes the intention for resetting err clear (it is to ensure
> that a NULL return from unix_find_socket_byinode causes us to return
> -ECONNREFUSED).
>
I'll do that. That does make it more clear.
I suspect resetting the error accidentally was what caused the syzbot to rightfully complain.
diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
index 55cdebfa0da0..2e0300121ab5 100644
--- a/net/unix/af_unix.c
+++ b/net/unix/af_unix.c
@@ -1226,6 +1226,18 @@ static struct sock *unix_find_bsd(struct sockaddr_un *sunaddr, int addr_len,
if (!S_ISSOCK(inode->i_mode))
goto path_put;
+ /*
+ * We call the hook because we know that the inode is a socket
+ * and we hold a valid reference to it via the path.
+ * We intentionally forgo the ability to restrict SOCK_COREDUMP.
+ */
+ if (!(flags & SOCK_COREDUMP)) {
+ err = security_unix_path_connect(&path);
+ if (err)
+ goto path_put;
+ }
+ err = -ECONNREFUSED;
+
sk = unix_find_socket_byinode(inode);
if (!sk)
goto path_put;
next prev parent reply other threads:[~2026-01-01 23:40 UTC|newest]
Thread overview: 20+ messages / expand[flat|nested] mbox.gz Atom feed top
2025-12-31 21:33 [RFC PATCH 0/1] lsm: Add hook unix_path_connect Justin Suess
2025-12-31 21:33 ` [RFC PATCH 1/1] " Justin Suess
2026-01-01 12:13 ` Günther Noack
2026-01-01 19:45 ` [RFC PATCH 0/1] " Justin Suess
2026-01-01 23:11 ` Tingmao Wang
2026-01-01 23:40 ` Justin Suess [this message]
2026-01-07 21:43 ` Paul Moore
2026-01-01 9:46 ` [syzbot ci] " syzbot ci
2026-01-01 11:56 ` [RFC PATCH 0/1] " Günther Noack
2026-01-05 7:46 ` Kuniyuki Iwashima
2026-01-05 11:04 ` Günther Noack
2026-01-05 16:04 ` Justin Suess
2026-01-07 7:33 ` Kuniyuki Iwashima
2026-01-07 12:19 ` Justin Suess
2026-01-07 16:57 ` Günther Noack
2026-01-07 12:49 ` Günther Noack
2026-01-08 10:17 ` Kuniyuki Iwashima
2026-01-08 18:42 ` Mickaël Salaün
2026-01-08 21:30 ` Günther Noack
2026-01-07 21:54 ` Paul Moore
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=714c39e3-61fa-449c-b4ab-bdb41a35fc40@gmail.com \
--to=utilityemal77@gmail$(echo .)com \
--cc=gnoack3000@gmail$(echo .)com \
--cc=gnoack@google$(echo .)com \
--cc=horms@kernel$(echo .)org \
--cc=jmorris@namei$(echo .)org \
--cc=kuniyu@google$(echo .)com \
--cc=linux-security-module@vger$(echo .)kernel.org \
--cc=m@maowtm$(echo .)org \
--cc=mic@digikod$(echo .)net \
--cc=netdev@vger$(echo .)kernel.org \
--cc=paul@paul-moore$(echo .)com \
--cc=serge@hallyn$(echo .)com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox