From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mx0a-0031df01.pphosted.com (mx0a-0031df01.pphosted.com [205.220.168.131]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 7E4FE33C1A9 for ; Wed, 18 Feb 2026 09:17:26 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=205.220.168.131 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1771406248; cv=none; b=jQq9ExrHFqxNgGgqCIARfyda9eOlYWZzWvWMEpDqzxTTVHVQCkasd8iQEezP/fFrAZWRBZFrQ7PDVmilKF+P9D+kJaYDxVkZKX/GnEmEpp65iTWDFD3tjW8WQ1Fnd71lWNWaERDHDIBYE2C2QvVosbnUXudcqft+QpEmGjyeNLw= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1771406248; c=relaxed/simple; bh=XnA4ayKORW1q6ZfELcTB5jOWEzzvzBRZU+q5rkTqF4M=; h=Message-ID:Date:MIME-Version:Subject:To:Cc:References:From: In-Reply-To:Content-Type; b=FEbRWUHUkCyWzWrXhjs1fO+HlXbOBYhvTeI+tbJKC5Q/fXbwGObv/dU9aGyL+UHt1eC17SPivO5gjauelOZ3xFnyUaNdAr2PBtYeTxhlgReX/DxP2P5hgKcDNeZmo7Pmp7KjuB/yk2A89h1o5Lq1x39fsNlpm0M7cI7Kj83BHV8= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com; spf=pass smtp.mailfrom=oss.qualcomm.com; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b=KEHBZCmo; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b=fZSi3poq; arc=none smtp.client-ip=205.220.168.131 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b="KEHBZCmo"; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b="fZSi3poq" Received: from pps.filterd (m0279863.ppops.net [127.0.0.1]) by mx0a-0031df01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 61I5JwBr421076 for ; Wed, 18 Feb 2026 09:17:25 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=qualcomm.com; h= cc:content-transfer-encoding:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to; s=qcppdkim1; bh= BerodE9udH0yTvTl3i3zzvMFVQxy5GnH2IbIXbjYmqU=; b=KEHBZCmo2A8FVxq5 I9m+x7IUSl8fwuMsuFN2X9xadr95fm5rgMLB1Pg9ydZg/LpKBiWmTu5HS+ILHoKZ vjUn+4Dh9nm10+krDfSs4vhKsDqh9zmRtkZXDuyZiBEdchNd0BVXE6zB7FiPDawP EOEYV+Q5U2GS8vtNQHc98EdHoo1IhaqY0qRz2N7WY4iTAm7GTG4lptExwsIGeVCD 6M3SzDnml2e+HWmaB35g3X05EhYZUQcfopPtkpCX1JUrT4itRLKnyu6GVcpyOZqO GVYt/jrrB7XBOfIi8/IJ22xB1YehUCda9BybXA+sfoQ15W53zhS6imfG6FMrFJyS vhJarg== Received: from mail-pl1-f199.google.com (mail-pl1-f199.google.com [209.85.214.199]) by mx0a-0031df01.pphosted.com (PPS) with ESMTPS id 4cd76e0hpj-1 (version=TLSv1.3 cipher=TLS_AES_128_GCM_SHA256 bits=128 verify=NOT) for ; Wed, 18 Feb 2026 09:17:25 +0000 (GMT) Received: by mail-pl1-f199.google.com with SMTP id d9443c01a7336-2ad147cdf07so46320275ad.2 for ; Wed, 18 Feb 2026 01:17:25 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oss.qualcomm.com; s=google; t=1771406245; x=1772011045; darn=vger.kernel.org; h=content-transfer-encoding:in-reply-to:from:content-language :references:cc:to:subject:user-agent:mime-version:date:message-id :from:to:cc:subject:date:message-id:reply-to; bh=BerodE9udH0yTvTl3i3zzvMFVQxy5GnH2IbIXbjYmqU=; b=fZSi3poqf/uUMTHZ/VNCCxUQb1QS99/uoF+JET27AmBRmkKf7Yh0bytyeFK1A6kB+c Rz9fcp2aGXb67ld5gFlx+/tG+0yZNsWvGI/kjaFVEfsW0yzEObuclcD26eQTHnu2eHf9 6BApgrXQR4rspxSZE52DCiQF8lJTEbX8wM8FWKt8mHyUN5EhgC2pbM+/VH12Oqq1H/5S HMfzTx4r/Hu/HMXgrjdEr1T/T+oqe+Wq0poOz7KqvHoi8NFCTyGMgsRJkx8Ee7NXibsU MjVrZSXKFS+anSQvo5JGBrP6J2AacqAuhjCs0i3Y7B2IWWfY1Rz05eQvLg/Za5lpjq/L 8Qmg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1771406245; x=1772011045; h=content-transfer-encoding:in-reply-to:from:content-language :references:cc:to:subject:user-agent:mime-version:date:message-id :x-gm-gg:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=BerodE9udH0yTvTl3i3zzvMFVQxy5GnH2IbIXbjYmqU=; b=qspSA6GKRawgmNBysaEsRl3n+PVdUBn4eUD5Wqn/KuE2gSn1+g3ZlOFvFBEvfD7A+Z QxmKyTVakljgQp9N01pCCBdTph5kgKwMeG2K08nnqb2djng+1iHszpgQFgM5MIRsjTjm 3wQ0q2HfHzd9w/DrByqBCVQt/YEBslL1eLNr3za0uDVnSHZ0N22xiQv3dDf6I8079FEm YIJOtkuhuiY0Q5V101UbAKsl2njUBpUcRCeFpsrcAlSj8PO4VAiqUmeNzvGjxFdoxGoT UxSXwQPj2+zR5H/57ciAoNg8ctjrfOoYeW3O7dz1UQg0tI6wPAqugkBSmjOe7itMoVXM BOYw== X-Forwarded-Encrypted: i=1; AJvYcCUp9gEfm8oUJ127U8bNDEjqZJggiEMAu6vsBtCxG/ydG6kv0fAjlKsEIp4YfgAgmibmW0WV3u/lIo6nKQE=@vger.kernel.org X-Gm-Message-State: AOJu0Yw3Qt16sEUdSbMquSQMdCwINcjfHPoA9DUa0MYgxwS8T/wyZ4bm iixq50dgPs+l+dhyliCrgr+sD/GsQBnmYc2HklikHyV4kNz0Y5Mndlc9QFKtlDWTHyVbjg8rFCu YTrKUo36CrGBq4VXKlr31zi8aE0FFhdTuSv5F0xfhXXl4eIksHdwMJGMYDfJ0YCXbsYh3c48y7u s= X-Gm-Gg: AZuq6aLJ5Q2ItbjOecXiBudoy6f76qRyItwo3NLKuyGvsmjuwnRBtOigzCODGsZqFph Y4/qoX+3ExrsVs5ZiRqIirOngsIvPzTtm5FvQJyix4lfoRRkIu10DbfMzngCTnVHLSkC0X9c3qY RidWgQm/tHi0purdXsovPyp3hNtydsr1WPw47500+cUjWwMDc9pQHXc87UhSEm9fgHdPyI49KZi hisupLiN4ubSMBj8J+cybT+vI27dTFxoVCVUNUkR7Ifh6BRbbBABi1qOr3xLNnYBHr+Meyubauf uBOnpmzDm14s7fU1o8H+IuEHxZXS4FQ7GR+HXZYRpe1OkUIwfv0/wOW51qD6SnYYEJ7dEqK1Qbq vESFS/FwTC9UCSfzRMALNWnkAOpeTL9ksIsKmllQFnCta2e586LvSkeY= X-Received: by 2002:a17:903:41c3:b0:2a9:4c2:e51 with SMTP id d9443c01a7336-2ad17543e89mr154207905ad.55.1771406244539; Wed, 18 Feb 2026 01:17:24 -0800 (PST) X-Received: by 2002:a17:903:41c3:b0:2a9:4c2:e51 with SMTP id d9443c01a7336-2ad17543e89mr154207595ad.55.1771406244019; Wed, 18 Feb 2026 01:17:24 -0800 (PST) Received: from [10.92.201.171] ([202.46.23.19]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2ad1a9d5c3esm133417595ad.47.2026.02.18.01.17.18 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Wed, 18 Feb 2026 01:17:23 -0800 (PST) Message-ID: Date: Wed, 18 Feb 2026 14:47:17 +0530 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [PATCH] net: qrtr: Expand control port access to root To: Stephen Smalley , Manivannan Sadhasivam Cc: Jakub Kicinski , Paul Moore , Ondrej Mosnacek , selinux@vger.kernel.org, "David S. Miller" , Eric Dumazet , Paolo Abeni , Simon Horman , linux-arm-msm@vger.kernel.org, netdev@vger.kernel.org, linux-kernel@vger.kernel.org, bjorn.andersson@oss.qualcomm.com, chris.lew@oss.qualcomm.com, Deepak Kumar Singh , rsiddoji@oss.qualcomm.com, quic_sasikuma@quicinc.com References: <20260205-qrtr-control-port-access-permission-v1-1-e900039e92d5@oss.qualcomm.com> <20260206183657.0477e50a@kernel.org> <5b2fm4nbceqdmeu532vsr26il7jroli2sh6azcwirzm43b32da@grqzpgmmdvyp> Content-Language: en-US From: Vishnu Santhosh In-Reply-To: Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 8bit X-Authority-Analysis: v=2.4 cv=OKsqHCaB c=1 sm=1 tr=0 ts=699583a5 cx=c_pps a=JL+w9abYAAE89/QcEU+0QA==:117 a=j4ogTh8yFefVWWEFDRgCtg==:17 a=IkcTkHD0fZMA:10 a=HzLeVaNsDn8A:10 a=s4-Qcg_JpJYA:10 a=VkNPw1HP01LnGYTKEx00:22 a=Mpw57Om8IfrbqaoTuvik:22 a=GgsMoib0sEa3-_RKJdDe:22 a=VwQbUJbxAAAA:8 a=9YfBhDUXH9MDG8CxehwA:9 a=3ZKOabzyN94A:10 a=QEXdDO2ut3YA:10 a=324X-CrmTo6CU4MGRt3R:22 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwMjE4MDA4MSBTYWx0ZWRfX8qdYW7egw3wN 1D7NFu6RdbgtJJm1zdlGSoQQdu8pjPiQzeABPXrF+UWajzaply67L06ggwdylTiv/74hyTQ+0W5 3Od9jp7GH2yyhxYV6MS96e/nRbUKamCuW6JjZdXgfGcHkP35YLnbIVg7qzizlwdq8TBiW9z4dq0 tZy3wVflWtGNuYsac9KvrzDI0GWkvnjrXR+ys9wOzvh/i5T7EsiK/18gsivqO39zHkBH2Dk5yKf 6DIbRBg8SO4XUYJPitmerZnv4THqXAMntPZ+jgpSoV91g7jD3YO2ObyAtwXTS7bBJWD30vZjj6/ N9iLlsLjaXkPYPe/BS3C/T/RvGQdNv/hmDqoEvXkosq2nMURPO6eQCc7fjkxZn0yM2HRULfnPXl zZ73CusWG74Baq/HgED77cdwjEodqbG2f2ccdG9z7gfUAu4vfHvcwRmfmQwZv0xKHSjfsimIuyZ 2rjvIIJccizFFsLGYIw== X-Proofpoint-GUID: 1ChzU1SUM_CSgn1N_SUTaonM2rKLx8hF X-Proofpoint-ORIG-GUID: 1ChzU1SUM_CSgn1N_SUTaonM2rKLx8hF X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1121,Hydra:6.1.51,FMLib:17.12.100.49 definitions=2026-02-18_01,2026-02-16_04,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 malwarescore=0 bulkscore=0 impostorscore=0 adultscore=0 suspectscore=0 clxscore=1015 spamscore=0 lowpriorityscore=0 phishscore=0 priorityscore=1501 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2601150000 definitions=main-2602180081 On 2/12/2026 12:07 AM, Stephen Smalley wrote: > On Wed, Feb 11, 2026 at 12:20 PM Manivannan Sadhasivam wrote: >> + SELinux folks >> >> On Fri, Feb 06, 2026 at 06:36:57PM -0800, Jakub Kicinski wrote: >>> On Thu, 05 Feb 2026 13:51:31 +0530 Vishnu Santhosh wrote: >>>> When qrtr is loaded as module, qrtr-ns runs from SELinux kmod_t >>>> domain. On targets using upstream SELinux policies, this domain >>>> does not receive CAP_NET_ADMIN, which prevents it from binding >>>> control port even though qrtr-ns is a trusted system component. >>>> >>>> Granting kmod_t the CAP_NET_ADMIN capability in policy is possible, >>>> but not desirable, as kmod_t is not expected to perform networking >>>> operations and widening its capability set is discouraged. >>>> >>>> To address this in a contained way within qrtr, extend the control >>>> port permission check to allow binding when either: >>>> >>>> - the process has CAP_NET_ADMIN, or >>>> - the process belongs to GLOBAL_ROOT_GID (root-equivalent tasks) >>>> >>>> This permits qrtr-ns to successfully bind its control port in >>>> kmod_t restricted environments without broadening SELinux capability >>>> assignments. >>> This really feels like a one-off hack, but it's far from my area >>> of expertise.. Could you get an ack or review tag from some kernel >>> maintainer working on security, capabilities or permissions? >> I'm also not too sure about the problem because it looks like kmod_t has almost >> near root privileges, but cannot do network administration. >> >> Maybe there is a valid reason for that? > On Fedora, kmod_t is an unconfined domain and is allowed all capabilities. > Upstream refpolicy likely hasn't encountered a need for net_admin > during module initialization previously and thus doesn't allow it just > as a matter of least privilege. > Since you referenced kmod_t, I assume this is just for Linux, not > Android (which has an entirely different policy). > I would fix this in policy rather than changing the kernel module code. Thanks for the detailed suggestion, Stephen. To address the QRTR NS initialization failure, I initially tested the following change in our downstream policy (modutils.te): allow kmod_t self:capability net_admin; Since the kmod_t domain is only used for module insertion via insmod/modprobe and does not perform networking operations, our SELinux team were initially hesitant to pick up this change. Based on that internal feedback, I made this change in QRTR NS. After your comment, it is clear that the correct resolution is to adjust the SELinux policy rather than modifying the kernel module. Our SELinux team (CC’d Ravi and Sasi) agreed to submit a separate patch to extend kmod_t with net_admin in the upstream refpolicy so that the module can initialize correctly without kernel driver changes.