Re: [PATCH] selinux: add AF_UNSPEC and INADDR_ANY checks to selinux_socket_bind()

2018-05-10 Thread Paul Moore
On Thu, May 10, 2018 at 5:28 AM, Alexey Kodanev wrote: > On 10.05.2018 01:02, Paul Moore wrote: > ... >> I just had a better look at this and I believe that Alexey and Stephen >> are right: this is the best option. My apologies for the noise >> earlier. However, while looking at the code I think

Re: [PATCH] selinux: add AF_UNSPEC and INADDR_ANY checks to selinux_socket_bind()

2018-05-10 Thread Alexey Kodanev
On 10.05.2018 01:02, Paul Moore wrote: ... > I just had a better look at this and I believe that Alexey and Stephen > are right: this is the best option. My apologies for the noise > earlier. However, while looking at the code I think there are some > additional necessary changes: > > * In the c

Re: [PATCH] selinux: add AF_UNSPEC and INADDR_ANY checks to selinux_socket_bind()

2018-05-09 Thread Paul Moore
On Wed, May 9, 2018 at 11:34 AM, Paul Moore wrote: > On Wed, May 9, 2018 at 11:11 AM, Stephen Smalley wrote: >> On 05/09/2018 11:01 AM, Paul Moore wrote: >>> On Wed, May 9, 2018 at 8:37 AM, Stephen Smalley wrote: On 05/08/2018 08:25 PM, Paul Moore wrote: > On Tue, May 8, 2018 at 2:40 PM

Re: [PATCH] selinux: add AF_UNSPEC and INADDR_ANY checks to selinux_socket_bind()

2018-05-09 Thread Paul Moore
On Wed, May 9, 2018 at 11:11 AM, Stephen Smalley wrote: > On 05/09/2018 11:01 AM, Paul Moore wrote: >> On Wed, May 9, 2018 at 8:37 AM, Stephen Smalley wrote: >>> On 05/08/2018 08:25 PM, Paul Moore wrote: On Tue, May 8, 2018 at 2:40 PM, Stephen Smalley wrote: > On 05/08/2018 01:05 PM, Pa

Re: [PATCH] selinux: add AF_UNSPEC and INADDR_ANY checks to selinux_socket_bind()

2018-05-09 Thread Stephen Smalley
On 05/09/2018 11:01 AM, Paul Moore wrote: > On Wed, May 9, 2018 at 8:37 AM, Stephen Smalley wrote: >> On 05/08/2018 08:25 PM, Paul Moore wrote: >>> On Tue, May 8, 2018 at 2:40 PM, Stephen Smalley wrote: On 05/08/2018 01:05 PM, Paul Moore wrote: > On Tue, May 8, 2018 at 10:05 AM, Alexey K

Re: [PATCH] selinux: add AF_UNSPEC and INADDR_ANY checks to selinux_socket_bind()

2018-05-09 Thread Paul Moore
On Wed, May 9, 2018 at 8:37 AM, Stephen Smalley wrote: > On 05/08/2018 08:25 PM, Paul Moore wrote: >> On Tue, May 8, 2018 at 2:40 PM, Stephen Smalley wrote: >>> On 05/08/2018 01:05 PM, Paul Moore wrote: On Tue, May 8, 2018 at 10:05 AM, Alexey Kodanev wrote: > Commit d452930fd3b9 ("

Re: [PATCH] selinux: add AF_UNSPEC and INADDR_ANY checks to selinux_socket_bind()

2018-05-09 Thread Stephen Smalley
On 05/08/2018 08:25 PM, Paul Moore wrote: > On Tue, May 8, 2018 at 2:40 PM, Stephen Smalley wrote: >> On 05/08/2018 01:05 PM, Paul Moore wrote: >>> On Tue, May 8, 2018 at 10:05 AM, Alexey Kodanev >>> wrote: Commit d452930fd3b9 ("selinux: Add SCTP support") breaks compatibility with the

Re: [PATCH] selinux: add AF_UNSPEC and INADDR_ANY checks to selinux_socket_bind()

2018-05-08 Thread Paul Moore
On Tue, May 8, 2018 at 2:40 PM, Stephen Smalley wrote: > On 05/08/2018 01:05 PM, Paul Moore wrote: >> On Tue, May 8, 2018 at 10:05 AM, Alexey Kodanev >> wrote: >>> Commit d452930fd3b9 ("selinux: Add SCTP support") breaks compatibility >>> with the old programs that can pass sockaddr_in with AF_UN

Re: [PATCH] selinux: add AF_UNSPEC and INADDR_ANY checks to selinux_socket_bind()

2018-05-08 Thread Stephen Smalley
On 05/08/2018 01:05 PM, Paul Moore wrote: > On Tue, May 8, 2018 at 10:05 AM, Alexey Kodanev > wrote: >> Commit d452930fd3b9 ("selinux: Add SCTP support") breaks compatibility >> with the old programs that can pass sockaddr_in with AF_UNSPEC and >> INADDR_ANY to bind(). As a result, bind() returns

Re: [PATCH] selinux: add AF_UNSPEC and INADDR_ANY checks to selinux_socket_bind()

2018-05-08 Thread Paul Moore
On Tue, May 8, 2018 at 10:05 AM, Alexey Kodanev wrote: > Commit d452930fd3b9 ("selinux: Add SCTP support") breaks compatibility > with the old programs that can pass sockaddr_in with AF_UNSPEC and > INADDR_ANY to bind(). As a result, bind() returns EAFNOSUPPORT error. > It was found with LTP/asapi

[PATCH] selinux: add AF_UNSPEC and INADDR_ANY checks to selinux_socket_bind()

2018-05-08 Thread Alexey Kodanev
Commit d452930fd3b9 ("selinux: Add SCTP support") breaks compatibility with the old programs that can pass sockaddr_in with AF_UNSPEC and INADDR_ANY to bind(). As a result, bind() returns EAFNOSUPPORT error. It was found with LTP/asapi_01 test. Similar to commit 29c486df6a20 ("net: ipv4: relax AF_