selinux: Fix SCTP error inconsistency in selinux_socket_bind()

Check sk->sk_protocol instead of security class to recognize SCTP socket.
SCTP socket is initialized with SECCLASS_SOCKET class if policy does not
support EXTSOCKCLASS capability. In this case bind(2) hook wrongfully
return EAFNOSUPPORT instead of EINVAL.

The inconsistency was detected with help of Landlock tests:
https://lore.kernel.org/all/b58680ca-81b2-7222-7287-0ac7f4227c3c@huawei-partners.com/

Fixes: 0f8db8cc73df ("selinux: add AF_UNSPEC and INADDR_ANY checks to selinux_socket_bind()")
Signed-off-by: Mikhail Ivanov <ivanov.mikhail1@huawei-partners.com>
Signed-off-by: Paul Moore <paul@paul-moore.com>

diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index 2afc45f355a4a81c9007fdd8a70103f34da6e98e..5e5f3398f39d0c5fb05fb5d68615dc907c263a4a 100644 (file)
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -4835,7 +4835,7 @@ out:
        return err;
 err_af:
        /* Note that SCTP services expect -EINVAL, others -EAFNOSUPPORT. */
-       if (sksec->sclass == SECCLASS_SCTP_SOCKET)
+       if (sk->sk_protocol == IPPROTO_SCTP)
                return -EINVAL;
        return -EAFNOSUPPORT;
 }