Re: [PATCH net-next v7 0/4] net: af_unix: useful handling of LSM denials on SCM_RIGHTS

[Jori Koolstra]

My "smart" email provider blocker me from sending more email. Since I am in South Korea
that is apparently suspicious. Now patch 4 is missing. I'll try to rectify that. Is there
any sane email provider that any of you use?

Thanks,
Jori.

> Op 13-08-2026 12:28 EDT schreef Jori Koolstra <jkoolstra@xxxxxxxxx>:
> 
>  
> Right now if some LSM denies an AF_UNIX socket peer to receive a
> SCM_RIGHTS fd, the SCM_RIGHTS fd array will be cut short at
> that point, and MSG_CTRUNC is set on return of recvmsg(2). This is
> highly problematic behaviour, because it leaves the receiver
> wondering what happened. As per man page MSG_CTRUNC is supposed to
> indicate that the control buffer was sized too short, but suddenly
> a permission error might result in the exact same flag being set.
> Moreover, the receiver has no chance to determine how many fds got
> originally sent and how many were suppressed.[1]
> 
> Add a SO_RIGHTS_NOTRUNC option to UNIX sockets to enable more useful
> handling of LSM denials when receiving SCM_RIGHTS messages: instead of
> truncating the message at the first blocked fd, keep every fd slot
> and store the LSM errno in the blocked slot. This option is inherited
> by the accept()-ed socket when set on the listen() socket.
> 
> [1]: https://github.com/uapi-group/kernel-features#useful-handling-of-lsm-denials-on-scm_rights
> 
> Changes:
> v7:
>   - block first selftests did not check other slots
>   - READ_ONCE() for scm_rights_notrunc field
> v6:
>   - Let accept()-ed sockets inherit the SO_RIGHTS_NOTRUNC option from
>     the listen() socket, so that you don't need to set it for every
>     child. 
> v5:
>   - Enable SO_RIGHTS_NOTRUNC on all AF_UNIX socket types.
>   - Added required BPF CONFIG_ options to
>     tools/testing/selftests/net/af_unix/config.
> v4: https://lore.kernel.org/netdev/20260705123826.3818443-1-jkoolstra@xxxxxxxxx/
>   - Removed the __receive_fd() helper and moved logic into
>     scm_recv_one_fd() directly (suggested by Brauner).
>   - Moved selftest from Smack to BPF (LLM assisted).
>   - Add arch specific socket option values for SO_RIGHTS_NOTRUNC.
>   - Undo patch that replaced copy_from_sockptr() with
>     copy_safe_from_sockptr().
> v3:
>   - Separated net and vfs changes.
>   - Use kselftest_harness.h and system() to call the test script.
> v2: https://lore.kernel.org/netdev/20260616143020.3458085-2-jkoolstra@xxxxxxxxx/
>   - Reimplemented as a UNIX socket option instead of a per recvmsg(2) flag.
> v1: https://lore.kernel.org/netdev/20260428175125.2705296-1-jkoolstra@xxxxxxxxx/
> 
> *** BLURB HERE ***
> 
> Jori Koolstra (4):
>   net: af_unix: enable custom setsockopt for all socket types
>   net: scm: move scm_detach_fds() from common path to scm_recv_unix()
>   net: af_unix: useful handling of LSM denials on SCM_RIGHTS
>   selftest: Add tests for useful handling of LSM denials on SCM_RIGHTS
> 
>  arch/alpha/include/uapi/asm/socket.h          |   2 +
>  arch/mips/include/uapi/asm/socket.h           |   2 +
>  arch/parisc/include/uapi/asm/socket.h         |   2 +
>  arch/sparc/include/uapi/asm/socket.h          |   2 +
>  include/net/af_unix.h                         |   1 +
>  include/net/scm.h                             |  13 +-
>  include/uapi/asm-generic/socket.h             |   2 +
>  net/compat.c                                  |   4 +-
>  net/core/scm.c                                |  40 ++-
>  net/unix/af_unix.c                            |  22 +-
>  .../testing/selftests/net/af_unix/.gitignore  |   2 +
>  tools/testing/selftests/net/af_unix/Makefile  |   8 +
>  tools/testing/selftests/net/af_unix/config    |   7 +
>  .../net/af_unix/scm_rights_denial_lsm.bpf.c   |  36 +++
>  .../net/af_unix/scm_rights_denial_lsm.c       | 292 ++++++++++++++++++
>  15 files changed, 413 insertions(+), 22 deletions(-)
>  create mode 100644 tools/testing/selftests/net/af_unix/scm_rights_denial_lsm.bpf.c
>  create mode 100644 tools/testing/selftests/net/af_unix/scm_rights_denial_lsm.c
> 
> 
> base-commit: 3205699d79f262412c1be7fc1c04066610d3cd52
> -- 
> 2.55.0