Commit 4152dc91 authored May 11, 2018 by Alexey Kodanev Committed by Paul Moore May 14, 2018

selinux: correctly handle sa_family cases in selinux_sctp_bind_connect()



Allow to pass the socket address structure with AF_UNSPEC family for
compatibility purposes. selinux_socket_bind() will further check it
for INADDR_ANY and selinux_socket_connect_helper() should return
EINVAL.

For a bad address family return EINVAL instead of AFNOSUPPORT error,
i.e. what is expected from SCTP protocol in such case.

Fixes: d452930f ("selinux: Add SCTP support")
Suggested-by: Paul Moore <paul@paul-moore.com>
Signed-off-by: Alexey Kodanev <alexey.kodanev@oracle.com>
Signed-off-by: Paul Moore <paul@paul-moore.com>

parent 88b7d370

security/selinux/hooks.c

+2 −1

Original line number	Diff line number	Diff line
		@@ -5269,6 +5269,7 @@ static int selinux_sctp_bind_connect(struct sock *sk, int optname,
		while (walk_size < addrlen) {
		addr = addr_buf;
		switch (addr->sa_family) {
		case AF_UNSPEC:
		case AF_INET:
		len = sizeof(struct sockaddr_in);
		break;
		@@ -5276,7 +5277,7 @@ static int selinux_sctp_bind_connect(struct sock *sk, int optname,
		len = sizeof(struct sockaddr_in6);
		break;
		default:
		return -EAFNOSUPPORT;
		return -EINVAL;
		}

		err = -EINVAL;

Admin message