From 7a82f9a06459ff1c37b5e97b204430442cc076e3 Mon Sep 17 00:00:00 2001 From: John Johansen Date: Thu, 29 Oct 2026 09:03:55 -0700 Subject: [PATCH] apparmor: fix check SCTP bind, and connect permission checks SCTP mediation of bind is not being checked correctly because bind permission needs to be checked in the sctp_bind_connect() hook. Require for bind permissions when CTP_SET_PEER_PRIMARY_ADDR, and SCTP_SOCKOPT_BINDX_ADD are asked for. The peer initialized ASCONF cases (SCTP_PARAM_ADD_IP and SCTP_PARAM_SET_PRIMARY) are processed in softirq context and are not mediated atm. SCTP_PRIMATEY_ADDR, and SCTP_SET_PEER_PRIMARY_ADDR only select among address already in the association. Fixes: 56974a6fcfef ("apparmor: add base infastructure for socket mediation") Signed-off-by: John Johansen --- security/apparmor/lsm.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/security/apparmor/lsm.c b/security/apparmor/lsm.c index dba078c73abc..de6633e238f3 100644 --- a/security/apparmor/lsm.c +++ b/security/apparmor/lsm.c @@ -1410,6 +1410,11 @@ static int apparmor_sctp_bind_connect(struct sock *sk, int optname, struct sockaddr *address, int addrlen) { switch (optname) { + /* Bind checks */ + case SCTP_SET_PEER_PRIMARY_ADDR: + case SCTP_SOCKOPT_BINDX_ADD: + return aa_sk_perm(OP_BIND, AA_MAY_BIND, sk); + /* Connect checks */ case SCTP_SOCKOPT_CONNECTX: case SCTP_SENDMSG_CONNECT: return aa_sk_perm(OP_CONNECT, AA_MAY_CONNECT, sk);