[PATCH] apparmor: check connect permission for SCTP

[PATCH] apparmor: check connect permission for SCTP

[Jérémy Jean]

SCTP can start an association through sendmsg() or CONNECTX. These paths
call the SCTP-specific sctp_bind_connect hook instead of the normal socket
connect hook, but AppArmor does not register it. As a result, a profile can
deny connect and allow send or setopt, yet a task can still create an SCTP
association.

Register the SCTP hook. Ask for connect permission when SENDMSG_CONNECT
or CONNECTX creates an association.

Fixes: 56974a6fcfef ("apparmor: add base infastructure for socket mediation")
Assisted-by: LLM
Signed-off-by: Jérémy Jean <Jeremy.Jean@oss.cyber.gouv.fr>
---
 security/apparmor/lsm.c | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/security/apparmor/lsm.c b/security/apparmor/lsm.c
index d502ad0ac26f..dba078c73abc 100644
--- a/security/apparmor/lsm.c
+++ b/security/apparmor/lsm.c
@@ -15,6 +15,7 @@
 #include <linux/mount.h>
 #include <linux/namei.h>
 #include <linux/ptrace.h>
+#include <linux/sctp.h>
 #include <linux/ctype.h>
 #include <linux/sysctl.h>
 #include <linux/sysfs.h>
@@ -1405,6 +1406,18 @@ static int apparmor_socket_connect(struct socket *sock,
 	return aa_sk_perm(OP_CONNECT, AA_MAY_CONNECT, sock->sk);
 }
 
+static int apparmor_sctp_bind_connect(struct sock *sk, int optname,
+				      struct sockaddr *address, int addrlen)
+{
+	switch (optname) {
+	case SCTP_SOCKOPT_CONNECTX:
+	case SCTP_SENDMSG_CONNECT:
+		return aa_sk_perm(OP_CONNECT, AA_MAY_CONNECT, sk);
+	}
+
+	return 0;
+}
+
 static int apparmor_socket_listen(struct socket *sock, int backlog)
 {
 	AA_BUG(!sock);
@@ -1823,6 +1836,7 @@ static struct security_hook_list apparmor_hooks[] __ro_after_init = {
 	LSM_HOOK_INIT(socket_getsockopt, apparmor_socket_getsockopt),
 	LSM_HOOK_INIT(socket_setsockopt, apparmor_socket_setsockopt),
 	LSM_HOOK_INIT(socket_shutdown, apparmor_socket_shutdown),
+	LSM_HOOK_INIT(sctp_bind_connect, apparmor_sctp_bind_connect),
 #ifdef CONFIG_NETWORK_SECMARK
 	LSM_HOOK_INIT(socket_sock_rcv_skb, apparmor_socket_sock_rcv_skb),
 #endif
-- 
2.47.3

Re: [PATCH] apparmor: check connect permission for SCTP

[sashiko-bot]

> SCTP can start an association through sendmsg() or CONNECTX. These paths
> call the SCTP-specific sctp_bind_connect hook instead of the normal socket
> connect hook, but AppArmor does not register it. As a result, a profile can
> deny connect and allow send or setopt, yet a task can still create an SCTP
> association.
> 
> Register the SCTP hook. Ask for connect permission when SENDMSG_CONNECT
> or CONNECTX creates an association.
> 
> Fixes: 56974a6fcfef ("apparmor: add base infastructure for socket mediation")
> Assisted-by: LLM
> Signed-off-by: Jérémy Jean <Jeremy.Jean@oss.cyber.gouv.fr>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260925193842.1208132-3-Jeremy.Jean@oss.cyber.gouv.fr?part=1

Re: [PATCH] apparmor: check connect permission for SCTP

[Ryan Lee]

On Fri, Sep 25, 2026 at 12:40 PM Jérémy Jean
<Jeremy.Jean@oss.cyber.gouv.fr> wrote:
>
> SCTP can start an association through sendmsg() or CONNECTX. These paths
> call the SCTP-specific sctp_bind_connect hook instead of the normal socket
> connect hook, but AppArmor does not register it. As a result, a profile can
> deny connect and allow send or setopt, yet a task can still create an SCTP
> association.
>
> Register the SCTP hook. Ask for connect permission when SENDMSG_CONNECT
> or CONNECTX creates an association.
>
> Fixes: 56974a6fcfef ("apparmor: add base infastructure for socket mediation")
> Assisted-by: LLM
> Signed-off-by: Jérémy Jean <Jeremy.Jean@oss.cyber.gouv.fr>
> ---
>  security/apparmor/lsm.c | 14 ++++++++++++++
>  1 file changed, 14 insertions(+)
>
> diff --git a/security/apparmor/lsm.c b/security/apparmor/lsm.c
> index d502ad0ac26f..dba078c73abc 100644
> --- a/security/apparmor/lsm.c
> +++ b/security/apparmor/lsm.c
> @@ -15,6 +15,7 @@
>  #include <linux/mount.h>
>  #include <linux/namei.h>
>  #include <linux/ptrace.h>
> +#include <linux/sctp.h>
>  #include <linux/ctype.h>
>  #include <linux/sysctl.h>
>  #include <linux/sysfs.h>
> @@ -1405,6 +1406,18 @@ static int apparmor_socket_connect(struct socket *sock,
>         return aa_sk_perm(OP_CONNECT, AA_MAY_CONNECT, sock->sk);
>  }
>
> +static int apparmor_sctp_bind_connect(struct sock *sk, int optname,
> +                                     struct sockaddr *address, int addrlen)
> +{
> +       switch (optname) {
> +       case SCTP_SOCKOPT_CONNECTX:
> +       case SCTP_SENDMSG_CONNECT:
> +               return aa_sk_perm(OP_CONNECT, AA_MAY_CONNECT, sk);
> +       }
> +
> +       return 0;
> +}
> +
>  static int apparmor_socket_listen(struct socket *sock, int backlog)
>  {
>         AA_BUG(!sock);
> @@ -1823,6 +1836,7 @@ static struct security_hook_list apparmor_hooks[] __ro_after_init = {
>         LSM_HOOK_INIT(socket_getsockopt, apparmor_socket_getsockopt),
>         LSM_HOOK_INIT(socket_setsockopt, apparmor_socket_setsockopt),
>         LSM_HOOK_INIT(socket_shutdown, apparmor_socket_shutdown),
> +       LSM_HOOK_INIT(sctp_bind_connect, apparmor_sctp_bind_connect),
>  #ifdef CONFIG_NETWORK_SECMARK
>         LSM_HOOK_INIT(socket_sock_rcv_skb, apparmor_socket_sock_rcv_skb),
>  #endif
> --
> 2.47.3
>
>

Could you also add a regression test to the upstream userspace repo
(https://gitlab.com/apparmor/apparmor, tests/regression/apparmor) to
exercise mediation of SCTP connections?