selinux: Fix SCTP error inconsistency in selinux_socket_bind()
authorMikhail Ivanov <ivanov.mikhail1@huawei-partners.com>
Tue, 12 Nov 2024 14:52:03 +0000 (22:52 +0800)
committerPaul Moore <paul@paul-moore.com>
Wed, 11 Dec 2024 19:57:47 +0000 (14:57 -0500)
commit034294fbfdf0ded4f931f9503d2ca5bbf8b9aebd
tree9a443dec1607ebe064a83bd3335b8efe13a34995
parentc75c7945cd49c05404b00358108084a175a5fb29
selinux: Fix SCTP error inconsistency in selinux_socket_bind()

Check sk->sk_protocol instead of security class to recognize SCTP socket.
SCTP socket is initialized with SECCLASS_SOCKET class if policy does not
support EXTSOCKCLASS capability. In this case bind(2) hook wrongfully
return EAFNOSUPPORT instead of EINVAL.

The inconsistency was detected with help of Landlock tests:
https://lore.kernel.org/all/b58680ca-81b2-7222-7287-0ac7f4227c3c@huawei-partners.com/

Fixes: 0f8db8cc73df ("selinux: add AF_UNSPEC and INADDR_ANY checks to selinux_socket_bind()")
Signed-off-by: Mikhail Ivanov <ivanov.mikhail1@huawei-partners.com>
Signed-off-by: Paul Moore <paul@paul-moore.com>
security/selinux/hooks.c