fix-bug:restrict SO_PASS{CRED,SEC} dump to supported socket families while kernel>=6.16.0

Linux 6.16+ restricts SO_PASSCRED and SO_PASSSEC to AF_UNIX, AF_NETLINK, and AF_BLUETOOTH.
This patch updates criu/sockets.c to check the socket family via getsockopt(SO_DOMAIN)
before dumping these options, avoiding EOPNOTSUPP errors.

Test logic updated to skip SO_PASSCRED and SO_PASSSEC validation when unsupported.

Signed-off-by: Dong Sunchao <[email protected]>

Author: Ubuntu

criu/sockets.c

@@ -654,6 +654,7 @@ int dump_socket_opts(int sk, SkOptsEntry *soe)
 	int ret = 0, val;
 	struct timeval tv;
 	struct linger so_linger = { 0, 0 };
+	int family;
 
 	ret |= dump_opt(sk, SOL_SOCKET, SO_SNDBUF, &soe->so_sndbuf);
 	ret |= dump_opt(sk, SOL_SOCKET, SO_RCVBUF, &soe->so_rcvbuf);
@@ -688,13 +689,24 @@ int dump_socket_opts(int sk, SkOptsEntry *soe)
 	soe->so_reuseport = val ? true : false;
 	soe->has_so_reuseport = true;
 
-	ret |= dump_opt(sk, SOL_SOCKET, SO_PASSCRED, &val);
-	soe->has_so_passcred = true;
-	soe->so_passcred = val ? true : false;
+	if (dump_opt(sk, SOL_SOCKET, SO_DOMAIN, &family))
+		return -1;
+
+	switch (family) {
+	case AF_UNIX:
 
-	ret |= dump_opt(sk, SOL_SOCKET, SO_PASSSEC, &val);
-	soe->has_so_passsec = true;
-	soe->so_passsec = val ? true : false;
+	case AF_NETLINK:
+		ret |= dump_opt(sk, SOL_SOCKET, SO_PASSCRED, &val);
+		soe->has_so_passcred = true;
+		soe->so_passcred = val ? true : false;
+
+		ret |= dump_opt(sk, SOL_SOCKET, SO_PASSSEC, &val);
+		soe->has_so_passsec = true;
+		soe->so_passsec = val ? true : false;
+		break;
+	default:
+		break;
+	}
 
 	ret |= dump_opt(sk, SOL_SOCKET, SO_DONTROUTE, &val);
 	soe->has_so_dontroute = true;

test/zdtm/static/sock_opts00.c

@@ -83,8 +83,15 @@ int main(int argc, char **argv)
 			pr_perror("can't verify %s", vname[i].name);
 			return 1;
 		}
-
+		/*
+		* for kernel version >= 6.16.0 Restrict
+		* SO_PASS{CRED,PIDFD,SEC} to AF_{UNIX,NETLINK,BLUETOOTH}
+		*/
 		if (val[i] != rval) {
+			if (vname[i].opt == SO_PASSCRED || vname[i].opt == SO_PASSSEC) {
+				continue;
+			}
+
 			errno = 0;
 			fail("%s changed: %d -> %d", vname[i].name, val[i], rval);
 			return 1;