qiurui/Centos-kernel-stream-10
1
0
Fork 0
mirror of https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-10.git synced 2026-09-09 00:07:04 +08:00
Code Issues Packages Projects Releases Wiki Activity

Merge: SELinux TCP/MPTCP connect check bypass via TCP Fast Open

Browse Source 
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-10/-/merge_requests/3056

JIRA: https://redhat.atlassian.net/browse/RHEL-222799

Backported from tree(s): linux

```
selinux: check connect-related permissions on TCP Fast Open

Similar to Landlock, SELinux was not updated when TCP Fast Open
support was introduced to ensure connect-related permissions are
checked when using TCP Fast Open. Update its socket_sendmsg() hook to
call selinux_socket_connect() when MSG_FASTOPEN is passed.

Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/linux-security-module/20260616201615.275032-1-hexlabsecurity@proton.me/
Link: https://lore.kernel.org/linux-security-module/20260617180526.15627-2-matthieu@buffet.re/
Reported-by: Bryam Vargas <hexlabsecurity@proton.me>
Reported-by: Matthieu Buffet <matthieu@buffet.re>
Reported-by: Mikhail Ivanov <ivanov.mikhail1@huawei-partners.com>
Signed-off-by: Stephen Smalley <stephen.smalley.work@gmail.com>
Tested-by: Bryam Vargas <hexlabsecurity@proton.me>
Signed-off-by: Paul Moore <paul@paul-moore.com>
(cherry picked from commit 44c74d27d1b9aaa99fa8a83640c1223575262b80)

```

Signed-off-by: CKI Backport Bot <cki-ci-bot+cki-gitlab-backport-bot@redhat.com>
[^footer]: Created 2026-08-03 08:12 UTC by backporter - [KWF FAQ](https://red.ht/kernel_workflow_doc) - [Slack #team-kernel-workflow](https://redhat-internal.slack.com/archives/C04LRUPMJQ5) - [Source](https://gitlab.com/cki-project/kernel-workflow/-/blob/main/webhook/utils/backporter.py) - [Documentation](https://gitlab.com/cki-project/kernel-workflow/-/blob/main/docs/README.backporter.md) - [Report an issue](https://redhat.atlassian.net/secure/CreateIssueDetails!init.jspa?pid=11779&issuetype=10016&priority=10001&summary=backporter+webhook+issue&components=66291) [^footer]

Approved-by: Ondrej Mosnáček <omosnacek@gmail.com>
Approved-by: Ricardo Robaina <rrobaina@redhat.com>
Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com>

Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com>
This commit is contained in:
CKI KWF Bot
2026-08-11 13:38:13 +00:00
parent 678cacd4fd c62dff7d61
commit 8664709d12
1 changed files with 18 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
security/selinux/hooks.c
+18 -1
View File
@@ -5055,7 +5055,24 @@ static int selinux_socket_accept(struct socket *sock, struct socket *newsock)
static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg, static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg,
int size) int size)
{ {
return sock_has_perm(sock->sk, SOCKET__WRITE); int rc;
struct sockaddr *const addr = msg->msg_name;
const int addrlen = msg->msg_namelen;
rc = sock_has_perm(sock->sk, SOCKET__WRITE);
if (rc)
return rc;
if (addr && (msg->msg_flags & MSG_FASTOPEN) &&
(sk_is_tcp(sock->sk) ||
(sk_is_inet(sock->sk) && sock->sk->sk_type == SOCK_STREAM &&
sock->sk->sk_protocol == IPPROTO_MPTCP))) {
rc = selinux_socket_connect(sock, addr, addrlen);
if (rc)
return rc;
}
return 0;
} }
static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg, static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg,