github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-11-07 06:17:02 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

apparmor: fix check SCTP bind, and connect permission checks

Browse Source 
SCTP mediation of bind is not being checked correctly because bind
permission needs to be checked in the sctp_bind_connect() hook.

Require for bind permissions when CTP_SET_PEER_PRIMARY_ADDR, and
SCTP_SOCKOPT_BINDX_ADD are asked for.

The peer initialized ASCONF cases (SCTP_PARAM_ADD_IP and
SCTP_PARAM_SET_PRIMARY) are processed in softirq context and are not
mediated atm. SCTP_PRIMATEY_ADDR, and SCTP_SET_PEER_PRIMARY_ADDR only
select among address already in the association.

Fixes: 56974a6fcf ("apparmor: add base infastructure for socket mediation")
Signed-off-by: John Johansen <john.johansen@canonical.com>
This commit is contained in:
John Johansen 2026-10-29 09:03:55 -07:00
parent 2f764c08bb
commit 7a82f9a064
1 changed files with 5 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
security/apparmor/lsm.c
View File

@ -1410,6 +1410,11 @@ static int apparmor_sctp_bind_connect(struct sock *sk, int optname,
struct sockaddr *address, int addrlen) struct sockaddr *address, int addrlen)
{ {
switch (optname) { switch (optname) {
/* Bind checks */
case SCTP_SET_PEER_PRIMARY_ADDR:
case SCTP_SOCKOPT_BINDX_ADD:
return aa_sk_perm(OP_BIND, AA_MAY_BIND, sk);
/* Connect checks */
case SCTP_SOCKOPT_CONNECTX: case SCTP_SOCKOPT_CONNECTX:
case SCTP_SENDMSG_CONNECT: case SCTP_SENDMSG_CONNECT:
return aa_sk_perm(OP_CONNECT, AA_MAY_CONNECT, sk); return aa_sk_perm(OP_CONNECT, AA_MAY_CONNECT, sk);