selinux: check connect-related permissions on TCP Fast Open

Similar to Landlock, SELinux was not updated when TCP Fast Open
support was introduced to ensure connect-related permissions are
checked when using TCP Fast Open. Update its socket_sendmsg() hook to
call selinux_socket_connect() when MSG_FASTOPEN is passed.

Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/linux-security-module/20260616201615.275032-1-hexlabsecurity@proton.me/
Link: https://lore.kernel.org/linux-security-module/20260617180526.15627-2-matthieu@buffet.re/
Reported-by: Bryam Vargas <hexlabsecurity@proton.me>
Reported-by: Matthieu Buffet <matthieu@buffet.re>
Reported-by: Mikhail Ivanov <ivanov.mikhail1@huawei-partners.com>
Signed-off-by: Stephen Smalley <stephen.smalley.work@gmail.com>
Tested-by: Bryam Vargas <hexlabsecurity@proton.me>
Signed-off-by: Paul Moore <paul@paul-moore.com>

diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index 1a713d96206f59b547af72ea5fa1f0c2055f84c4..c4677ce8939983a5273892b938eb9600a2025853 100644 (file)
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -5262,7 +5262,24 @@ static int selinux_socket_accept(struct socket *sock, struct socket *newsock)
 static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg,
                                  int size)
 {
-       return sock_has_perm(sock->sk, SOCKET__WRITE);
+       int rc;
+       struct sockaddr *const addr = msg->msg_name;
+       const int addrlen = msg->msg_namelen;
+
+       rc = sock_has_perm(sock->sk, SOCKET__WRITE);
+       if (rc)
+               return rc;
+
+       if (addr && (msg->msg_flags & MSG_FASTOPEN) &&
+           (sk_is_tcp(sock->sk) ||
+            (sk_is_inet(sock->sk) && sock->sk->sk_type == SOCK_STREAM &&
+             sock->sk->sk_protocol == IPPROTO_MPTCP))) {
+               rc = selinux_socket_connect(sock, addr, addrlen);
+               if (rc)
+                       return rc;
+       }
+
+       return 0;
 }
 
 static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg,