fix: restricted SO_PASS{CRED,PIDFD,SEC} to AF_{UNIX,NETLINK,BLUETOOTH}

Signed-off-by: root <[email protected]>

Author: root

criu/sockets.c

@@ -9,8 +9,6 @@
 #include <linux/filter.h>
 #include <string.h>
 #include <netinet/in.h>
-#include <linux/version.h>
-#include <sys/utsname.h>
 
 #include "int.h"
 #include "bitops.h"
@@ -33,7 +31,6 @@
 #include "fdstore.h"
 #include "cr_options.h"
 
-
 #undef LOG_PREFIX
 #define LOG_PREFIX "sockets: "
 
@@ -658,6 +655,7 @@ int dump_socket_opts(int sk, SkOptsEntry *soe)
 	int ret = 0, val;
 	struct timeval tv;
 	struct linger so_linger = { 0, 0 };
+	int family;
 
 	ret |= dump_opt(sk, SOL_SOCKET, SO_SNDBUF, &soe->so_sndbuf);
 	ret |= dump_opt(sk, SOL_SOCKET, SO_RCVBUF, &soe->so_rcvbuf);
@@ -692,28 +690,23 @@ int dump_socket_opts(int sk, SkOptsEntry *soe)
 	soe->so_reuseport = val ? true : false;
 	soe->has_so_reuseport = true;
 
-	/*
-	 * Restrict SO_PASS{CRED,PIDFD,SEC} to AF_{UNIX,NETLINK,BLUETOOTH} while
-	 * kernel >= 6.16.
-	 */
-
-
-	ret |= dump_opt(sk, SOL_SOCKET, SO_PASSCRED, &val);
-	soe->has_so_passcred = true;
-	soe->so_passcred = val ? true : false;
-
-	ret |= dump_opt(sk, SOL_SOCKET, SO_PASSSEC, &val);
-	soe->has_so_passsec = true;
-	soe->so_passsec = val ? true : false;
-
+	if (dump_opt(sk, SOL_SOCKET, SO_DOMAIN, &family))
+		return -1;
+	switch (family) {
+	case AF_UNIX:
 
-	ret |= dump_opt(sk, SOL_SOCKET, SO_PASSCRED, &val);
-	soe->has_so_passcred = true;
-	soe->so_passcred = val ? true : false;
+	case AF_NETLINK:
+		ret |= dump_opt(sk, SOL_SOCKET, SO_PASSCRED, &val);
+		soe->has_so_passcred = true;
+		soe->so_passcred = val ? true : false;
 
-	ret |= dump_opt(sk, SOL_SOCKET, SO_PASSSEC, &val);
-	soe->has_so_passsec = true;
-	soe->so_passsec = val ? true : false;
+		ret |= dump_opt(sk, SOL_SOCKET, SO_PASSSEC, &val);
+		soe->has_so_passsec = true;
+		soe->so_passsec = val ? true : false;
+		break;
+	default:
+		break;
+	}
 
 	ret |= dump_opt(sk, SOL_SOCKET, SO_DONTROUTE, &val);
 	soe->has_so_dontroute = true;