mirrors/linux
2
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2026-07-16 16:48:38 -04:00
Code Issues Packages Projects Releases Wiki Activity

selinux: check connect-related permissions on TCP Fast Open

Browse Source 
Similar to Landlock, SELinux was not updated when TCP Fast Open
support was introduced to ensure connect-related permissions are
checked when using TCP Fast Open. Update its socket_sendmsg() hook to
call selinux_socket_connect() when MSG_FASTOPEN is passed.

Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/linux-security-module/20260616201615.275032-1-hexlabsecurity@proton.me/
Link: https://lore.kernel.org/linux-security-module/20260617180526.15627-2-matthieu@buffet.re/
Reported-by: Bryam Vargas <hexlabsecurity@proton.me>
Reported-by: Matthieu Buffet <matthieu@buffet.re>
Reported-by: Mikhail Ivanov <ivanov.mikhail1@huawei-partners.com>
Signed-off-by: Stephen Smalley <stephen.smalley.work@gmail.com>
Tested-by: Bryam Vargas <hexlabsecurity@proton.me>
Signed-off-by: Paul Moore <paul@paul-moore.com>
This commit is contained in:
Stephen Smalley
2026-06-18 13:55:14 -04:00
committed by Paul Moore
parent dc59e4fea9
commit 44c74d27d1
1 changed files with 18 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

19
security/selinux/hooks.c
View File

@@ -5262,7 +5262,24 @@ static int selinux_socket_accept(struct socket *sock, struct socket *newsock)
static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg,
int size)
{
return sock_has_perm(sock->sk, SOCKET__WRITE);
int rc;
struct sockaddr *const addr = msg->msg_name;
const int addrlen = msg->msg_namelen;
rc = sock_has_perm(sock->sk, SOCKET__WRITE);
if (rc)
return rc;
if (addr && (msg->msg_flags & MSG_FASTOPEN) &&
(sk_is_tcp(sock->sk) ||
(sk_is_inet(sock->sk) && sock->sk->sk_type == SOCK_STREAM &&
sock->sk->sk_protocol == IPPROTO_MPTCP))) {
rc = selinux_socket_connect(sock, addr, addrlen);
if (rc)
return rc;
}
return 0;
}
static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg,