From mboxrd@z Thu Jan 1 00:00:00 1970 From: Alexey Kodanev Subject: [PATCH] selinux: add AF_UNSPEC and INADDR_ANY checks to selinux_socket_bind() Date: Tue, 8 May 2018 17:05:03 +0300 Message-ID: <1525788303-23244-1-git-send-email-alexey.kodanev@oracle.com> Cc: Richard Haines , Paul Moore , Stephen Smalley , Eric Paris , linux-security-module@vger.kernel.org, netdev , Alexey Kodanev To: selinux@tycho.nsa.gov Return-path: Received: from aserp2120.oracle.com ([141.146.126.78]:54024 "EHLO aserp2120.oracle.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752497AbeEHN4a (ORCPT ); Tue, 8 May 2018 09:56:30 -0400 Sender: netdev-owner@vger.kernel.org List-ID: Commit d452930fd3b9 ("selinux: Add SCTP support") breaks compatibility with the old programs that can pass sockaddr_in with AF_UNSPEC and INADDR_ANY to bind(). As a result, bind() returns EAFNOSUPPORT error. It was found with LTP/asapi_01 test. Similar to commit 29c486df6a20 ("net: ipv4: relax AF_INET check in bind()"), which relaxed AF_INET check for compatibility, add AF_UNSPEC case to AF_INET and make sure that the address is INADDR_ANY. Also, in the end of selinux_socket_bind(), instead of adding AF_UNSPEC to 'address->sa_family == AF_INET', verify AF_INET6 first. Fixes: d452930fd3b9 ("selinux: Add SCTP support") Signed-off-by: Alexey Kodanev --- security/selinux/hooks.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c index 4cafe6a..649a3be 100644 --- a/security/selinux/hooks.c +++ b/security/selinux/hooks.c @@ -4602,10 +4602,16 @@ static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, in * sk->sk_family = PF_INET6 with addr->sa_family = AF_INET. */ switch (address->sa_family) { + case AF_UNSPEC: case AF_INET: if (addrlen < sizeof(struct sockaddr_in)) return -EINVAL; addr4 = (struct sockaddr_in *)address; + + if (address->sa_family == AF_UNSPEC && + addr4->sin_addr.s_addr != htonl(INADDR_ANY)) + return -EAFNOSUPPORT; + snum = ntohs(addr4->sin_port); addrp = (char *)&addr4->sin_addr.s_addr; break; @@ -4681,10 +4687,10 @@ static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, in ad.u.net->sport = htons(snum); ad.u.net->family = family; - if (address->sa_family == AF_INET) - ad.u.net->v4info.saddr = addr4->sin_addr.s_addr; - else + if (address->sa_family == AF_INET6) ad.u.net->v6info.saddr = addr6->sin6_addr; + else + ad.u.net->v4info.saddr = addr4->sin_addr.s_addr; err = avc_has_perm(&selinux_state, sksec->sid, sid, -- 1.8.3.1