netdev - Re: [PATCH RFC] selinux: Fix SCTP error inconsistency in selinux_socket

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <e24e5b0c4ea0c0ed3547d6bc4f34f4fa@paul-moore.com>
Date: Wed, 11 Dec 2024 14:57:45 -0500
From: Paul Moore <paul@...l-moore.com>
To: Mikhail Ivanov <ivanov.mikhail1@...wei-partners.com>
Cc: <mic@...ikod.net>, <selinux@...r.kernel.org>, <stephen.smalley.work@...il.com>, <omosnace@...hat.com>, <linux-security-module@...r.kernel.org>, <netdev@...r.kernel.org>, <yusongping@...wei.com>, <artem.kuzin@...wei.com>, <konstantin.meskhidze@...wei.com>
Subject: Re: [PATCH RFC] selinux: Fix SCTP error inconsistency in  selinux_socket_bind()

On Nov 12, 2024 Mikhail Ivanov <ivanov.mikhail1@...wei-partners.com> wrote:
> 
> Check sk->sk_protocol instead of security class to recognize SCTP socket.
> SCTP socket is initialized with SECCLASS_SOCKET class if policy does not
> support EXTSOCKCLASS capability. In this case bind(2) hook wrongfully
> return EAFNOSUPPORT instead of EINVAL.
> 
> The inconsistency was detected with help of Landlock tests:
> https://lore.kernel.org/all/b58680ca-81b2-7222-7287-0ac7f4227c3c@huawei-partners.com/
> 
> Fixes: 0f8db8cc73df ("selinux: add AF_UNSPEC and INADDR_ANY checks to selinux_socket_bind()")
> Signed-off-by: Mikhail Ivanov <ivanov.mikhail1@...wei-partners.com>
> ---
>  security/selinux/hooks.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)

Looks good to me, merged into selinux/dev, thanks!

--
paul-moore.com