github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-11-07 06:17:02 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

apparmor: check connect permission for SCTP

Browse Source 
SCTP can start an association through sendmsg() or CONNECTX. These paths
call the SCTP-specific sctp_bind_connect hook instead of the normal socket
connect hook, but AppArmor does not register it. As a result, a profile can
deny connect and allow send or setopt, yet a task can still create an SCTP
association.

Register the SCTP hook. Ask for connect permission when SENDMSG_CONNECT
or CONNECTX creates an association.

Fixes: 56974a6fcf ("apparmor: add base infastructure for socket mediation")
Assisted-by: LLM
Signed-off-by: Jérémy Jean <Jeremy.Jean@oss.cyber.gouv.fr>
Signed-off-by: John Johansen <john.johansen@canonical.com>
This commit is contained in:
Jérémy Jean 2026-09-25 20:54:48 +00:00 committed by John Johansen
parent f292873ceb
commit 2f764c08bb
1 changed files with 14 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
security/apparmor/lsm.c
View File

@ -15,6 +15,7 @@
#include <linux/mount.h>
#include <linux/namei.h>
#include <linux/ptrace.h>
#include <linux/sctp.h>
#include <linux/ctype.h>
#include <linux/sysctl.h>
#include <linux/sysfs.h>
@ -1405,6 +1406,18 @@ static int apparmor_socket_connect(struct socket *sock,
return aa_sk_perm(OP_CONNECT, AA_MAY_CONNECT, sock->sk);
}
static int apparmor_sctp_bind_connect(struct sock *sk, int optname,
struct sockaddr *address, int addrlen)
{
switch (optname) {
case SCTP_SOCKOPT_CONNECTX:
case SCTP_SENDMSG_CONNECT:
return aa_sk_perm(OP_CONNECT, AA_MAY_CONNECT, sk);
}
return 0;
}
static int apparmor_socket_listen(struct socket *sock, int backlog)
{
AA_BUG(!sock);
@ -1823,6 +1836,7 @@ static struct security_hook_list apparmor_hooks[] __ro_after_init = {
LSM_HOOK_INIT(socket_getsockopt, apparmor_socket_getsockopt),
LSM_HOOK_INIT(socket_setsockopt, apparmor_socket_setsockopt),
LSM_HOOK_INIT(socket_shutdown, apparmor_socket_shutdown),
LSM_HOOK_INIT(sctp_bind_connect, apparmor_sctp_bind_connect),
#ifdef CONFIG_NETWORK_SECMARK
LSM_HOOK_INIT(socket_sock_rcv_skb, apparmor_socket_sock_rcv_skb),
#endif