path: root/security
diff options
authorPaul Moore <>2021-11-12 12:07:02 -0500
committerPaul Moore <>2021-11-12 12:07:02 -0500
commit32a370abf12f82c8383e430c21365f5355d8b288 (patch)
tree9e2ea4b4164568b851aa13661b221cd4b321d937 /security
parent5833291ab6de9c3e2374336b51c814e515e8f3a5 (diff)
net,lsm,selinux: revert the security_sctp_assoc_established() hook
This patch reverts two prior patches, e7310c94024c ("security: implement sctp_assoc_established hook in selinux") and 7c2ef0240e6a ("security: add sctp_assoc_established hook"), which create the security_sctp_assoc_established() LSM hook and provide a SELinux implementation. Unfortunately these two patches were merged without proper review (the Reviewed-by and Tested-by tags from Richard Haines were for previous revisions of these patches that were significantly different) and there are outstanding objections from the SELinux maintainers regarding these patches. Work is currently ongoing to correct the problems identified in the reverted patches, as well as others that have come up during review, but it is unclear at this point in time when that work will be ready for inclusion in the mainline kernel. In the interest of not keeping objectionable code in the kernel for multiple weeks, and potentially a kernel release, we are reverting the two problematic patches. Signed-off-by: Paul Moore <>
Diffstat (limited to 'security')
2 files changed, 1 insertions, 20 deletions
diff --git a/security/security.c b/security/security.c
index 779a9edea0a0..c88167a414b4 100644
--- a/security/security.c
+++ b/security/security.c
@@ -2388,13 +2388,6 @@ void security_sctp_sk_clone(struct sctp_association *asoc, struct sock *sk,
-void security_sctp_assoc_established(struct sctp_association *asoc,
- struct sk_buff *skb)
- call_void_hook(sctp_assoc_established, asoc, skb);
diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index 5e5215fe2e83..62d30c0a30c2 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -5502,8 +5502,7 @@ static void selinux_sctp_sk_clone(struct sctp_association *asoc, struct sock *sk
if (!selinux_policycap_extsockclass())
return selinux_sk_clone_security(sk, newsk);
- if (asoc->secid != SECSID_WILD)
- newsksec->sid = asoc->secid;
+ newsksec->sid = asoc->secid;
newsksec->peer_sid = asoc->peer_secid;
newsksec->sclass = sksec->sclass;
selinux_netlbl_sctp_sk_clone(sk, newsk);
@@ -5559,16 +5558,6 @@ static void selinux_inet_conn_established(struct sock *sk, struct sk_buff *skb)
selinux_skb_peerlbl_sid(skb, family, &sksec->peer_sid);
-static void selinux_sctp_assoc_established(struct sctp_association *asoc,
- struct sk_buff *skb)
- struct sk_security_struct *sksec = asoc->>sk_security;
- selinux_inet_conn_established(asoc->, skb);
- asoc->peer_secid = sksec->peer_sid;
- asoc->secid = SECSID_WILD;
static int selinux_secmark_relabel_packet(u32 sid)
const struct task_security_struct *__tsec;
@@ -7239,7 +7228,6 @@ static struct security_hook_list selinux_hooks[] __lsm_ro_after_init = {
LSM_HOOK_INIT(sctp_assoc_request, selinux_sctp_assoc_request),
LSM_HOOK_INIT(sctp_sk_clone, selinux_sctp_sk_clone),
LSM_HOOK_INIT(sctp_bind_connect, selinux_sctp_bind_connect),
- LSM_HOOK_INIT(sctp_assoc_established, selinux_sctp_assoc_established),
LSM_HOOK_INIT(inet_conn_request, selinux_inet_conn_request),
LSM_HOOK_INIT(inet_csk_clone, selinux_inet_csk_clone),
LSM_HOOK_INIT(inet_conn_established, selinux_inet_conn_established),