Re: io_uring MSG_RING SEND_FD skips file_receive LSM hook

On 5/21/26 12:02 AM, JUNYI LIU wrote:
> Hello,
> 
> I found that io_uring IORING_MSG_SEND_FD can install a registered file
> from a source ring into a target ring fixed-file table without
> invoking the security_file_receive() LSM hook used by classic fd
> receive paths.
> 
> I reproduced this in a disposable kernel lab with a BPF-LSM
> file_receive deny policy: SCM_RIGHTS receipt was blocked and
> incremented the file_receive counter, while MSG_RING SEND_FD installed
> the same file for a lower-privileged receiver and did not increment
> the counter.
> 
> The attached plain-text report includes the affected path, tested
> versions, observed result, claim boundary, and suggested fix
> direction. A tested reproducer is available if you would like me to
> send it.

There's nothing here. To pass a direct descriptor, you need control of
both rings in the first place, and the receving ring could just register
the descriptor in question itself in the first place. Zero capabilties
are added by MSG_SEND_FD that isn't already reachable by design.

Outside of that, the suggested "fix" doesn't even work correctly either,
if the goal was to prevent it.

> This report was prepared with AI assistance.

No kidding, if only some actual reasoning had been applied on top.

-- 
Jens Axboe