[PATCH] nvme-tcp: fix selinux denied when calling sock_sendmsg

[Christoph Hellwig]

[note: your mail was mangled html, I'm trying to extract the answer]

On Fri, Mar 21, 2025 at 10:49:34AM +0800, 邵培杰 wrote:
> Sure. But on the target side, it's a bit different.
> All socket operations are done in the workqueue with domain kernel_t,
> the kernel_t can access other labels, so I think there's no issue.

Indeed.

> By
> the way, switching to sock_create_kern() could skip selinux avc
> permission check and might give a very small performance boost.

It also helps to avoid copy and paste bugs..

> I'll send an optimization patch later.

Thanks!