linux.git/tools/include/uapi/asm-generic/socket.h, branch v6.18.21

af_unix: Introduce SO_PASSRIGHTS.

2025-05-23T09:24:18+00:00

As long as recvmsg() or recvmmsg() is used with cmsg, it is not
possible to avoid receiving file descriptors via SCM_RIGHTS.

This behaviour has occasionally been flagged as problematic, as
it can be (ab)used to trigger DoS during close(), for example, by
passing a FUSE-controlled fd or a hung NFS fd.

For instance, as noted on the uAPI Group page [0], an untrusted peer
could send a file descriptor pointing to a hung NFS mount and then
close it.  Once the receiver calls recvmsg() with msg_control, the
descriptor is automatically installed, and then the responsibility
for the final close() now falls on the receiver, which may result
in blocking the process for a long time.

Regarding this, systemd calls cmsg_close_all() [1] after each
recvmsg() to close() unwanted file descriptors sent via SCM_RIGHTS.

However, this cannot work around the issue at all, because the final
fput() may still occur on the receiver's side once sendmsg() with
SCM_RIGHTS succeeds.  Also, even filtering by LSM at recvmsg() does
not work for the same reason.

Thus, we need a better way to refuse SCM_RIGHTS at sendmsg().

Let's introduce SO_PASSRIGHTS to disable SCM_RIGHTS.

Note that this option is enabled by default for backward
compatibility.

Link: https://uapi-group.org/kernel-features/#disabling-reception-of-scm_rights-for-af_unix-sockets #[0]
Link: https://github.com/systemd/systemd/blob/v257.5/src/basic/fd-util.c#L612-L628 #[1]
Signed-off-by: Kuniyuki Iwashima 
Reviewed-by: Willem de Bruijn 
Signed-off-by: David S. Miller

tools headers: Sync uapi/asm-generic/socket.h with the kernel sources

2025-03-20T14:14:46+00:00

This also fixes a wrong definitions for SCM_TS_OPT_ID & SO_RCVPRIORITY.

Accidentally found while working on another patchset.

Cc: linux-kernel@vger.kernel.org
Cc: netdev@vger.kernel.org
Cc: Eric Dumazet 
Cc: Jakub Kicinski 
Cc: Vadim Fedorenko 
Cc: Willem de Bruijn 
Cc: Jason Xing 
Cc: Anna Emese Nyiri 
Cc: Kuniyuki Iwashima 
Cc: Paolo Abeni 
Fixes: a89568e9be75 ("selftests: txtimestamp: add SCM_TS_OPT_ID test")
Fixes: e45469e594b2 ("sock: Introduce SO_RCVPRIORITY socket option")
Link: https://lore.kernel.org/netdev/20250314195257.34854-1-kuniyu@amazon.com/
Reviewed-by: Kuniyuki Iwashima 
Signed-off-by: Alexander Mikhalitsyn 
Reviewed-by: Willem de Bruijn 
Reviewed-by: Jason Xing 
Link: https://patch.msgid.link/20250314214155.16046-1-aleksandr.mikhalitsyn@canonical.com
Signed-off-by: Paolo Abeni

sock: Introduce SO_RCVPRIORITY socket option

2024-12-17T02:16:44+00:00

Add new socket option, SO_RCVPRIORITY, to include SO_PRIORITY in the
ancillary data returned by recvmsg().
This is analogous to the existing support for SO_RCVMARK,
as implemented in commit 6fd1d51cfa253 ("net: SO_RCVMARK socket option
for SO_MARK with recvmsg()").

Reviewed-by: Willem de Bruijn 
Suggested-by: Ferenc Fejes 
Signed-off-by: Anna Emese Nyiri 
Link: https://patch.msgid.link/20241213084457.45120-5-annaemesenyiri@gmail.com
Signed-off-by: Jakub Kicinski

selftests: txtimestamp: add SCM_TS_OPT_ID test

2024-10-04T18:52:20+00:00

Extend txtimestamp test to run with fixed tskey using
SCM_TS_OPT_ID control message for all types of sockets.

Reviewed-by: Jason Xing 
Reviewed-by: Willem de Bruijn 
Signed-off-by: Vadim Fedorenko 
Link: https://patch.msgid.link/20241001125716.2832769-4-vadfed@meta.com
Signed-off-by: Jakub Kicinski

net: core: add getsockopt SO_PEERPIDFD

2023-06-12T09:45:50+00:00

Add SO_PEERPIDFD which allows to get pidfd of peer socket holder pidfd.
This thing is direct analog of SO_PEERCRED which allows to get plain PID.

Cc: "David S. Miller" 
Cc: Eric Dumazet 
Cc: Jakub Kicinski 
Cc: Paolo Abeni 
Cc: Leon Romanovsky 
Cc: David Ahern 
Cc: Arnd Bergmann 
Cc: Kees Cook 
Cc: Christian Brauner 
Cc: Kuniyuki Iwashima 
Cc: Lennart Poettering 
Cc: Luca Boccassi 
Cc: Daniel Borkmann 
Cc: Stanislav Fomichev 
Cc: bpf@vger.kernel.org
Cc: linux-kernel@vger.kernel.org
Cc: netdev@vger.kernel.org
Cc: linux-arch@vger.kernel.org
Reviewed-by: Christian Brauner 
Acked-by: Stanislav Fomichev 
Tested-by: Luca Boccassi 
Signed-off-by: Alexander Mikhalitsyn 
Reviewed-by: Eric Dumazet 
Signed-off-by: David S. Miller

scm: add SO_PASSPIDFD and SCM_PIDFD

2023-06-12T09:45:49+00:00

Implement SCM_PIDFD, a new type of CMSG type analogical to SCM_CREDENTIALS,
but it contains pidfd instead of plain pid, which allows programmers not
to care about PID reuse problem.

We mask SO_PASSPIDFD feature if CONFIG_UNIX is not builtin because
it depends on a pidfd_prepare() API which is not exported to the kernel
modules.

Idea comes from UAPI kernel group:
https://uapi-group.org/kernel-features/

Big thanks to Christian Brauner and Lennart Poettering for productive
discussions about this.

Cc: "David S. Miller" 
Cc: Eric Dumazet 
Cc: Jakub Kicinski 
Cc: Paolo Abeni 
Cc: Leon Romanovsky 
Cc: David Ahern 
Cc: Arnd Bergmann 
Cc: Kees Cook 
Cc: Christian Brauner 
Cc: Kuniyuki Iwashima 
Cc: Lennart Poettering 
Cc: Luca Boccassi 
Cc: linux-kernel@vger.kernel.org
Cc: netdev@vger.kernel.org
Cc: linux-arch@vger.kernel.org
Tested-by: Luca Boccassi 
Reviewed-by: Kuniyuki Iwashima 
Reviewed-by: Christian Brauner 
Signed-off-by: Alexander Mikhalitsyn 
Reviewed-by: Eric Dumazet 
Signed-off-by: David S. Miller

net: SO_RCVMARK socket option for SO_MARK with recvmsg()

2022-04-28T20:08:15+00:00

Adding a new socket option, SO_RCVMARK, to indicate that SO_MARK
should be included in the ancillary data returned by recvmsg().

Renamed the sock_recv_ts_and_drops() function to sock_recv_cmsgs().

Signed-off-by: Erin MacNeil 
Reviewed-by: Eric Dumazet 
Reviewed-by: David Ahern 
Acked-by: Marc Kleine-Budde 
Link: https://lore.kernel.org/r/20220427200259.2564-1-lnx.erin@gmail.com
Signed-off-by: Jakub Kicinski

bpf: Sync asm-generic/socket.h to tools/

2019-06-14T23:21:45+00:00

SO_DETACH_REUSEPORT_BPF is needed for the test in the next patch.
It is defined in the socket.h.

Signed-off-by: Martin KaFai Lau 
Reviewed-by: Stanislav Fomichev 
Signed-off-by: Daniel Borkmann