diff options
| author | Jérémy Jean <Jeremy.Jean@oss.cyber.gouv.fr> | 2026-09-25 20:54:48 +0000 |
|---|---|---|
| committer | John Johansen <john.johansen@canonical.com> | 2026-10-29 08:30:53 -0700 |
| commit | 2f764c08bb191a8c8f4051926dba0d25d195f39b (patch) | |
| tree | c86e1ea96aa4e3f17b23e1c77fc526834ece0cec /security | |
| parent | f292873ceb4bd3a1a0f75f884361cd556e457692 (diff) | |
apparmor: check connect permission for SCTP
SCTP can start an association through sendmsg() or CONNECTX. These paths
call the SCTP-specific sctp_bind_connect hook instead of the normal socket
connect hook, but AppArmor does not register it. As a result, a profile can
deny connect and allow send or setopt, yet a task can still create an SCTP
association.
Register the SCTP hook. Ask for connect permission when SENDMSG_CONNECT
or CONNECTX creates an association.
Fixes: 56974a6fcfef ("apparmor: add base infastructure for socket mediation")
Assisted-by: LLM
Signed-off-by: Jérémy Jean <Jeremy.Jean@oss.cyber.gouv.fr>
Signed-off-by: John Johansen <john.johansen@canonical.com>
Diffstat (limited to 'security')
| -rw-r--r-- | security/apparmor/lsm.c | 14 |
1 files changed, 14 insertions, 0 deletions
diff --git a/security/apparmor/lsm.c b/security/apparmor/lsm.c index d502ad0ac26f..dba078c73abc 100644 --- a/security/apparmor/lsm.c +++ b/security/apparmor/lsm.c @@ -15,6 +15,7 @@ #include <linux/mount.h> #include <linux/namei.h> #include <linux/ptrace.h> +#include <linux/sctp.h> #include <linux/ctype.h> #include <linux/sysctl.h> #include <linux/sysfs.h> @@ -1405,6 +1406,18 @@ static int apparmor_socket_connect(struct socket *sock, return aa_sk_perm(OP_CONNECT, AA_MAY_CONNECT, sock->sk); } +static int apparmor_sctp_bind_connect(struct sock *sk, int optname, + struct sockaddr *address, int addrlen) +{ + switch (optname) { + case SCTP_SOCKOPT_CONNECTX: + case SCTP_SENDMSG_CONNECT: + return aa_sk_perm(OP_CONNECT, AA_MAY_CONNECT, sk); + } + + return 0; +} + static int apparmor_socket_listen(struct socket *sock, int backlog) { AA_BUG(!sock); @@ -1823,6 +1836,7 @@ static struct security_hook_list apparmor_hooks[] __ro_after_init = { LSM_HOOK_INIT(socket_getsockopt, apparmor_socket_getsockopt), LSM_HOOK_INIT(socket_setsockopt, apparmor_socket_setsockopt), LSM_HOOK_INIT(socket_shutdown, apparmor_socket_shutdown), + LSM_HOOK_INIT(sctp_bind_connect, apparmor_sctp_bind_connect), #ifdef CONFIG_NETWORK_SECMARK LSM_HOOK_INIT(socket_sock_rcv_skb, apparmor_socket_sock_rcv_skb), #endif |