On Fri, Sep 25, 2026 at 12:40 PM Jérémy Jean <[email protected]> wrote: > > SCTP can start an association through sendmsg() or CONNECTX. These paths > call the SCTP-specific sctp_bind_connect hook instead of the normal socket > connect hook, but AppArmor does not register it. As a result, a profile can > deny connect and allow send or setopt, yet a task can still create an SCTP > association. > > Register the SCTP hook. Ask for connect permission when SENDMSG_CONNECT > or CONNECTX creates an association. > > Fixes: 56974a6fcfef ("apparmor: add base infastructure for socket mediation") > Assisted-by: LLM > Signed-off-by: Jérémy Jean <[email protected]> > --- > security/apparmor/lsm.c | 14 ++++++++++++++ > 1 file changed, 14 insertions(+) > > diff --git a/security/apparmor/lsm.c b/security/apparmor/lsm.c > index d502ad0ac26f..dba078c73abc 100644 > --- a/security/apparmor/lsm.c > +++ b/security/apparmor/lsm.c > @@ -15,6 +15,7 @@ > #include <linux/mount.h> > #include <linux/namei.h> > #include <linux/ptrace.h> > +#include <linux/sctp.h> > #include <linux/ctype.h> > #include <linux/sysctl.h> > #include <linux/sysfs.h> > @@ -1405,6 +1406,18 @@ static int apparmor_socket_connect(struct socket *sock, > return aa_sk_perm(OP_CONNECT, AA_MAY_CONNECT, sock->sk); > } > > +static int apparmor_sctp_bind_connect(struct sock *sk, int optname, > + struct sockaddr *address, int addrlen) > +{ > + switch (optname) { > + case SCTP_SOCKOPT_CONNECTX: > + case SCTP_SENDMSG_CONNECT: > + return aa_sk_perm(OP_CONNECT, AA_MAY_CONNECT, sk); > + } > + > + return 0; > +} > + > static int apparmor_socket_listen(struct socket *sock, int backlog) > { > AA_BUG(!sock); > @@ -1823,6 +1836,7 @@ static struct security_hook_list apparmor_hooks[] > __ro_after_init = { > LSM_HOOK_INIT(socket_getsockopt, apparmor_socket_getsockopt), > LSM_HOOK_INIT(socket_setsockopt, apparmor_socket_setsockopt), > LSM_HOOK_INIT(socket_shutdown, apparmor_socket_shutdown), > + LSM_HOOK_INIT(sctp_bind_connect, apparmor_sctp_bind_connect), > #ifdef CONFIG_NETWORK_SECMARK > LSM_HOOK_INIT(socket_sock_rcv_skb, apparmor_socket_sock_rcv_skb), > #endif > -- > 2.47.3 > >
Could you also add a regression test to the upstream userspace repo (https://gitlab.com/apparmor/apparmor, tests/regression/apparmor) to exercise mediation of SCTP connections?
