From: Mikhail Ivanov Date: Tue, 12 Nov 2024 14:52:03 +0000 (+0800) Subject: selinux: Fix SCTP error inconsistency in selinux_socket_bind() X-Git-Tag: v6.14-rc1~165^2~10 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=034294fbfdf0ded4f931f9503d2ca5bbf8b9aebd;p=thirdparty%2Fkernel%2Flinux.git selinux: Fix SCTP error inconsistency in selinux_socket_bind() Check sk->sk_protocol instead of security class to recognize SCTP socket. SCTP socket is initialized with SECCLASS_SOCKET class if policy does not support EXTSOCKCLASS capability. In this case bind(2) hook wrongfully return EAFNOSUPPORT instead of EINVAL. The inconsistency was detected with help of Landlock tests: https://lore.kernel.org/all/b58680ca-81b2-7222-7287-0ac7f4227c3c@huawei-partners.com/ Fixes: 0f8db8cc73df ("selinux: add AF_UNSPEC and INADDR_ANY checks to selinux_socket_bind()") Signed-off-by: Mikhail Ivanov Signed-off-by: Paul Moore --- diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c index 2afc45f355a4a..5e5f3398f39d0 100644 --- a/security/selinux/hooks.c +++ b/security/selinux/hooks.c @@ -4835,7 +4835,7 @@ out: return err; err_af: /* Note that SCTP services expect -EINVAL, others -EAFNOSUPPORT. */ - if (sksec->sclass == SECCLASS_SCTP_SOCKET) + if (sk->sk_protocol == IPPROTO_SCTP) return -EINVAL; return -EAFNOSUPPORT; }