6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mikhail Ivanov ivanov.mikhail1@huawei-partners.com
[ Upstream commit 854277e2cc8c75dc3c216c82e72523258fcf65b9 ]
Use sk_is_tcp() to check if socket is TCP in bind(2) and connect(2) hooks.
SMC, MPTCP, SCTP protocols are currently restricted by TCP access rights. The purpose of TCP access rights is to provide control over ports that can be used by userland to establish a TCP connection. Therefore, it is incorrect to deny bind(2) and connect(2) requests for a socket of another protocol.
However, SMC, MPTCP and RDS implementations use TCP internal sockets to establish communication or even to exchange packets over a TCP connection [1]. Landlock rules that configure bind(2) and connect(2) usage for TCP sockets should not cover requests for sockets of such protocols. These protocols have different set of security issues and security properties, therefore, it is necessary to provide the userland with the ability to distinguish between them (eg. [2]).
Control over TCP connection used by other protocols can be achieved with upcoming support of socket creation control [3].
[1] https://lore.kernel.org/all/62336067-18c2-3493-d0ec-6dd6a6d3a1b5@huawei-part... [2] https://lore.kernel.org/all/20241204.fahVio7eicim@digikod.net/ [3] https://lore.kernel.org/all/20240904104824.1844082-1-ivanov.mikhail1@huawei-...
Closes: https://github.com/landlock-lsm/linux/issues/40 Fixes: fff69fb03dde ("landlock: Support network rules with TCP bind and connect") Signed-off-by: Mikhail Ivanov ivanov.mikhail1@huawei-partners.com Link: https://lore.kernel.org/r/20250205093651.1424339-2-ivanov.mikhail1@huawei-pa... [mic: Format commit message to 72 columns] Signed-off-by: Mickaël Salaün mic@digikod.net Signed-off-by: Sasha Levin sashal@kernel.org --- security/landlock/net.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/security/landlock/net.c b/security/landlock/net.c index d5dcc4407a197..104b6c01fe503 100644 --- a/security/landlock/net.c +++ b/security/landlock/net.c @@ -63,8 +63,7 @@ static int current_check_access_socket(struct socket *const sock, if (WARN_ON_ONCE(dom->num_layers < 1)) return -EACCES;
- /* Checks if it's a (potential) TCP socket. */ - if (sock->type != SOCK_STREAM) + if (!sk_is_tcp(sock->sk)) return 0;
/* Checks for minimal header length to safely read sa_family. */