Re: [PATCH v2] selinux: suppress warning flood for retired DCCP netlink messages

On Tue, Jul 7, 2026 at 3:10 AM Stephen Smalley
<[email protected]> wrote:
>
> On Thu, Jul 2, 2026 at 10:30 PM Yafang Shao <[email protected]> wrote:
> >
> > When deploying linux-6.18.y stable kernel to production servers, we
> > observed kernel dmesg being flooded with SELinux warnings when running
> > `ss`:
> >
> >   SELinux: unrecognized netlink message: protocol=4 nlmsg_type=19 \
> >     sclass=netlink_tcpdiag_socket pid=188945 comm=ss
> >
> > The root cause is that DCCP support was retired in
> > commit 2a63dd0edf38 ("net: Retire DCCP socket."). Consequently,
> > DCCPDIAG_GETSOCK was removed from nlmsg_tcpdiag_perms. This causes
> > nlmsg_perm() to return -EINVAL, triggering the SELinux warning for every
> > `ss -d` invocation [0].
> >
> > Use pr_warn_once() for the retired DCCPDIAG_GETSOCK to prevent message
> > flooding.
> >
> > Link: https://github.com/iproute2/iproute2/blob/main/misc/ss.c#L3901 [0]
> > Fixes: 2a63dd0edf38 ("net: Retire DCCP socket.")
> > Suggested-by: Paul Moore <[email protected]>
> > Signed-off-by: Yafang Shao <[email protected]>
> > Cc: Kuniyuki Iwashima <[email protected]>
> > ---
> >  security/selinux/hooks.c | 17 +++++++++++------
> >  1 file changed, 11 insertions(+), 6 deletions(-)
> >
> > diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
> > index 1a713d96206f..9541cb674d61 100644
> > --- a/security/selinux/hooks.c
> > +++ b/security/selinux/hooks.c
> > @@ -94,6 +94,7 @@
> >  #include <linux/io_uring/cmd.h>
> >  #include <uapi/linux/lsm.h>
> >  #include <linux/memfd.h>
> > +#include <uapi/linux/inet_diag.h>
> >
> >  #include "initcalls.h"
> >  #include "avc.h"
> > @@ -6272,12 +6273,16 @@ static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb)
> >                                 return rc;
> >                 } else if (rc == -EINVAL) {
> >                         /* -EINVAL is a missing msg/perm mapping */
> > -                       pr_warn_ratelimited("SELinux: unrecognized netlink"
> > -                               " message: protocol=%hu nlmsg_type=%hu sclass=%s"
> > -                               " pid=%d comm=%s\n",
> > -                               sk->sk_protocol, nlh->nlmsg_type,
> > -                               secclass_map[sclass - 1].name,
> > -                               task_pid_nr(current), current->comm);
> > +                       if (nlh->nlmsg_type == DCCPDIAG_GETSOCK)
>
> sashiko noted that checking DCCPDIAG_GETSOCK above without first
> checking the protocol family or security class might trigger this
> message on a different protocol family instead [1]
>
> [1] https://lore.kernel.org/selinux/[email protected]/

I will update it.
Thanks for the information.

-- 
Regards
Yafang