[RFC PATCH 0/2] net: af_unix: Useful handling of LSM denials on SCM_RIGHTS

[Jori Koolstra]

Right now if some LSM such as Smack denies an AF_UNIX socket peer to
receive an SCM_RIGHTS fd the SCM_RIGHTS fd array will be cut short at
that point, and MSG_CTRUNC is set on return of recvmsg(). This is
highly problematic behaviour, because it leaves the receiver
wondering what happened. As per man page MSG_CTRUNC is supposed to
indicate that the control buffer was sized too short, but suddenly
a permission error might result in the exact same flag being set.
Moreover, the receiver has no chance to determine how many fds got
originally sent and how many were suppressed.[1]

Add two MSG_* flags:
 - MSG_RIGHTS_DENIAL is set whenever any file is rejected by the LSM
   during recvmsg(2) of SCM_RIGHTS fds.
 - If MSG_RIGHTS_FILTER is passed as a flag to recvmsg(), the SCM_RIGHTS
   fd array is always passed in its full original size. However, any
   files rejected by the LSM are replaced in this array with -EPERM
   instead of an assigned fd, while keeping the original order. If the
   flag is not set, the original truncate behavior is used.

I am putting this out for RFC for two reasons:

1) The MSG_* space is quite limited. We can do without MSG_RIGHTS_DENIAL 
   if needed.
2) Does userspace ever do anything else than bail out if MSG_CTRUNC is
   found set? If not, we could maybe also get rid of MSG_RIGHTS_FILTER
   and just make this the default behavior.

[1]: https://github.com/uapi-group/kernel-features#useful-handling-of-lsm-denials-on-scm_rights

Jori Koolstra (2):
  net: af_unix: Useful handling of LSM denials on SCM_RIGHTS
  selftest: Add tests for useful handling of LSM denials on SCM_RIGHTS

 fs/file.c                                     |  21 +-
 include/linux/file.h                          |   4 +-
 include/linux/socket.h                        |   3 +
 include/net/scm.h                             |   8 +-
 io_uring/openclose.c                          |   2 +-
 kernel/pid.c                                  |   2 +-
 kernel/seccomp.c                              |   2 +-
 net/compat.c                                  |   7 +-
 net/core/scm.c                                |  11 +-
 .../net/af_unix/lsm_blocking/helper.h         |  37 ++++
 .../net/af_unix/lsm_blocking/receiver.c       | 187 ++++++++++++++++++
 .../net/af_unix/lsm_blocking/sender.c         | 126 ++++++++++++
 .../lsm_blocking/test_scm_rights_smack.sh     | 172 ++++++++++++++++
 13 files changed, 563 insertions(+), 19 deletions(-)
 create mode 100644 tools/testing/selftests/net/af_unix/lsm_blocking/helper.h
 create mode 100644 tools/testing/selftests/net/af_unix/lsm_blocking/receiver.c
 create mode 100644 tools/testing/selftests/net/af_unix/lsm_blocking/sender.c
 create mode 100644 tools/testing/selftests/net/af_unix/lsm_blocking/test_scm_rights_smack.sh

-- 
2.54.0