Re: [PATCH] selinux: use socket SID for SCTP bind/connect permission checks in softirq

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] SELinux MAC Bypass in SCTP socket operations
--

--- Patch [1]: [PATCH] selinux: use socket SID for SCTP bind/connect permission checks in softirq ---
commit 7061b960bc8b25549fb5d5ff1d249127732f8627
Author: Tristan Madani <[email protected]>

selinux: use socket SID for SCTP bind/connect permission checks in softirq

This commit passes an explicit caller SID through __selinux_socket_bind()
and selinux_socket_connect_helper(). It modifies selinux_sctp_bind_connect()
to unconditionally use the socket's SID to fix permission checks during
softirq processing.

> diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
> index 8d6ccbf16c2b4..fe91c9191f732 100644
> --- a/security/selinux/hooks.c
> +++ b/security/selinux/hooks.c

[ ... ]

> @@ -5766,14 +5773,14 @@ static int selinux_sctp_bind_connect(struct sock *sk, int optname,
>  		case SCTP_PRIMARY_ADDR:
>  		case SCTP_SET_PEER_PRIMARY_ADDR:
>  		case SCTP_SOCKOPT_BINDX_ADD:
> -			err = __selinux_socket_bind(sk, addr, len);
> +			err = __selinux_socket_bind(sk, sksec->sid, addr, len);

[Severity: High]
Does unconditionally passing sksec->sid bypass SELinux MAC policies for
process-context syscalls?

If a privileged process creates an SCTP socket and passes its file
descriptor to an unprivileged process, the unprivileged process can call
sctp_bindx() or sctp_connectx(). 

Because this check evaluates the socket's SID rather than the executing
task's SID, it appears the unprivileged process would be evaluated using
the permissions of the socket's creator.

>  			break;
>  		/* Connect checks */
>  		case SCTP_SOCKOPT_CONNECTX:
>  		case SCTP_PARAM_SET_PRIMARY:
>  		case SCTP_PARAM_ADD_IP:
>  		case SCTP_SENDMSG_CONNECT:
> -			err = selinux_socket_connect_helper(sk, addr, len);
> +			err = selinux_socket_connect_helper(sk, sksec->sid, addr, len);

[Severity: High]
Are these connect checks affected by the same permission bypass behavior
as the bind checks above?

It looks like syscalls such as sendmsg() and sctp_connectx() would also
bypass the permission check for the calling process by checking the
socket's SID instead.

>  			if (err)
>  				return err;
>

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/[email protected]?part=1