@@ -4602,10 +4602,16 @@ static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, in
* sk->sk_family = PF_INET6 with addr->sa_family = AF_INET.
*/
switch (address->sa_family) {
+ case AF_UNSPEC:
case AF_INET:
if (addrlen < sizeof(struct sockaddr_in))
return -EINVAL;
addr4 = (struct sockaddr_in *)address;
+
+ if (address->sa_family == AF_UNSPEC &&
+ addr4->sin_addr.s_addr != htonl(INADDR_ANY))
+ return -EAFNOSUPPORT;
+
snum = ntohs(addr4->sin_port);
addrp = (char *)&addr4->sin_addr.s_addr;
break;
@@ -4681,10 +4687,10 @@ static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, in
ad.u.net->sport = htons(snum);
ad.u.net->family = family;
- if (address->sa_family == AF_INET)
- ad.u.net->v4info.saddr = addr4->sin_addr.s_addr;
- else
+ if (address->sa_family == AF_INET6)
ad.u.net->v6info.saddr = addr6->sin6_addr;
+ else
+ ad.u.net->v4info.saddr = addr4->sin_addr.s_addr;
err = avc_has_perm(&selinux_state,
sksec->sid, sid,
Commit d452930fd3b9 ("selinux: Add SCTP support") breaks compatibility with the old programs that can pass sockaddr_in with AF_UNSPEC and INADDR_ANY to bind(). As a result, bind() returns EAFNOSUPPORT error. It was found with LTP/asapi_01 test. Similar to commit 29c486df6a20 ("net: ipv4: relax AF_INET check in bind()"), which relaxed AF_INET check for compatibility, add AF_UNSPEC case to AF_INET and make sure that the address is INADDR_ANY. Also, in the end of selinux_socket_bind(), instead of adding AF_UNSPEC to 'address->sa_family == AF_INET', verify AF_INET6 first. Fixes: d452930fd3b9 ("selinux: Add SCTP support") Signed-off-by: Alexey Kodanev <alexey.kodanev@oracle.com> --- security/selinux/hooks.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-)