Re: [PATCH] selinux: use socket SID for SCTP bind/connect permission checks in softirq

[Paul Moore]

On Wed, Jul 15, 2026 at 1:45 PM Tristan Madani <tristmd@xxxxxxxxx> wrote:
>
> __selinux_socket_bind() and selinux_socket_connect_helper() call
> sock_has_perm() which uses current_sid() as the AVC subject.  When
> selinux_sctp_bind_connect() is invoked from the ASCONF softirq path
> (sctp_process_asconf), current is whichever process was interrupted,
> so the permission check uses an unrelated subject SID.
>
> Thread an explicit caller SID through __selinux_socket_bind() and
> selinux_socket_connect_helper().  The process-context wrappers
> (selinux_socket_bind, selinux_socket_connect) pass current_sid(), and
> selinux_sctp_bind_connect() passes the socket own SID (sksec->sid),
> consistent with other softirq-context hooks such as
> selinux_socket_sock_rcv_skb() and selinux_sctp_assoc_request().
>
> Factor out __sock_has_perm() with an explicit subject SID parameter
> so that sock_has_perm() remains unchanged for all other callers.
>
> Fixes: d452930fd3b9 ("selinux: Add SCTP support")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Tristan Madani <tristan@xxxxxxxxxxxxxxxxxxx>
> ---
>  security/selinux/hooks.c | 27 +++++++++++++++++----------
>  1 file changed, 17 insertions(+), 10 deletions(-)

Based on an off-list discussion with Tristan, I believe we will see a
revised v2 of this patchset.

-- 
paul-moore.com