Re: [PATCH v3] selinux: suppress warning flood for retired DCCP netlink messages

On Jul  9, 2026 Yafang Shao <[email protected]> wrote:
> 
> When deploying linux-6.18.y stable kernel to production servers, we
> observed kernel dmesg being flooded with SELinux warnings when running
> `ss -l`:
> 
>   SELinux: unrecognized netlink message: protocol=4 nlmsg_type=19 \
>     sclass=netlink_tcpdiag_socket pid=188945 comm=ss
> 
> The root cause is that DCCP support was retired in
> commit 2a63dd0edf38 ("net: Retire DCCP socket."). Consequently,
> DCCPDIAG_GETSOCK was removed from nlmsg_tcpdiag_perms. This causes
> nlmsg_perm() to return -EINVAL, triggering the SELinux warning for every
> `ss -l` invocation [0].
> 
> Use pr_warn_once() for the retired DCCPDIAG_GETSOCK to prevent message
> flooding.
> 
> Link: https://github.com/iproute2/iproute2/blob/main/misc/ss.c#L3901 [0]
> Fixes: 2a63dd0edf38 ("net: Retire DCCP socket.")
> Suggested-by: Paul Moore <[email protected]>
> Signed-off-by: Yafang Shao <[email protected]>
> Cc: Kuniyuki Iwashima <[email protected]>
> Cc: Stephen Smalley <[email protected]>
> Acked-by: Stephen Smalley <[email protected]>
> ---
>  security/selinux/hooks.c | 18 ++++++++++++------
>  1 file changed, 12 insertions(+), 6 deletions(-)
> 
> v2->v3: check also the sclass (sashiko-bot, Stephen)
> v1->v2: use pr_warn_once for the removed DCCPDIAG_GETSOCK (Paul)

Merged into selinux/dev, thanks!

--
paul-moore.com