diff options
| -rw-r--r-- | include/net/sock.h | 14 | ||||
| -rw-r--r-- | net/core/sock.c | 18 |
2 files changed, 31 insertions, 1 deletions
diff --git a/include/net/sock.h b/include/net/sock.h index 35ca6b13c6d2..483522377955 100644 --- a/include/net/sock.h +++ b/include/net/sock.h @@ -2773,9 +2773,14 @@ static inline bool sk_is_udp(const struct sock *sk) sk->sk_protocol == IPPROTO_UDP; } +static inline bool sk_is_unix(const struct sock *sk) +{ + return sk->sk_family == AF_UNIX; +} + static inline bool sk_is_stream_unix(const struct sock *sk) { - return sk->sk_family == AF_UNIX && sk->sk_type == SOCK_STREAM; + return sk_is_unix(sk) && sk->sk_type == SOCK_STREAM; } static inline bool sk_is_vsock(const struct sock *sk) @@ -2783,6 +2788,13 @@ static inline bool sk_is_vsock(const struct sock *sk) return sk->sk_family == AF_VSOCK; } +static inline bool sk_may_scm_recv(const struct sock *sk) +{ + return (IS_ENABLED(CONFIG_UNIX) && sk->sk_family == AF_UNIX) || + sk->sk_family == AF_NETLINK || + (IS_ENABLED(CONFIG_BT) && sk->sk_family == AF_BLUETOOTH); +} + /** * sk_eat_skb - Release a skb if it is no longer needed * @sk: socket to eat this skb from diff --git a/net/core/sock.c b/net/core/sock.c index d7d6d3a8efe5..fd5f9d3873c1 100644 --- a/net/core/sock.c +++ b/net/core/sock.c @@ -1221,12 +1221,21 @@ int sk_setsockopt(struct sock *sk, int level, int optname, } return -EPERM; case SO_PASSSEC: + if (!IS_ENABLED(CONFIG_SECURITY_NETWORK) || sk_may_scm_recv(sk)) + return -EOPNOTSUPP; + assign_bit(SOCK_PASSSEC, &sock->flags, valbool); return 0; case SO_PASSCRED: + if (!sk_may_scm_recv(sk)) + return -EOPNOTSUPP; + assign_bit(SOCK_PASSCRED, &sock->flags, valbool); return 0; case SO_PASSPIDFD: + if (!sk_is_unix(sk)) + return -EOPNOTSUPP; + assign_bit(SOCK_PASSPIDFD, &sock->flags, valbool); return 0; case SO_TYPE: @@ -1855,10 +1864,16 @@ int sk_getsockopt(struct sock *sk, int level, int optname, break; case SO_PASSCRED: + if (!sk_may_scm_recv(sk)) + return -EOPNOTSUPP; + v.val = !!test_bit(SOCK_PASSCRED, &sock->flags); break; case SO_PASSPIDFD: + if (!sk_is_unix(sk)) + return -EOPNOTSUPP; + v.val = !!test_bit(SOCK_PASSPIDFD, &sock->flags); break; @@ -1956,6 +1971,9 @@ int sk_getsockopt(struct sock *sk, int level, int optname, break; case SO_PASSSEC: + if (!IS_ENABLED(CONFIG_SECURITY_NETWORK) || !sk_may_scm_recv(sk)) + return -EOPNOTSUPP; + v.val = !!test_bit(SOCK_PASSSEC, &sock->flags); break; |