Bug 2054746 - Wrong IP address/port info appearing sometimes in AVCs for SCTP sockets
Summary: Wrong IP address/port info appearing sometimes in AVCs for SCTP sockets
Keywords:
Status: ASSIGNED
Alias: None
Product: Red Hat Enterprise Linux 8
Classification: Red Hat
Component: kernel
Version: 8.4
Hardware: All
OS: Linux
low
low
Target Milestone: rc
: ---
Assignee: Ondrej Mosnacek
QA Contact: Milos Malik
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2022-02-15 15:55 UTC by Ondrej Mosnacek
Modified: 2023-07-18 12:42 UTC (History)
0 users

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed:
Type: Bug
Target Upstream Version:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Issue Tracker RHELPLAN-112374 0 None None None 2022-02-15 16:06:07 UTC

Description Ondrej Mosnacek 2022-02-15 15:55:39 UTC 
Originally spotted in BZ 2054116. It seems when we get to dump_common_audit_data() via selinux_sctp_assoc_request(), we may get wrong srd/dst IP address/port info from the socket. Presumably these come from another previously set up association. SCTP peeloff might be also involved somehow.

Note to self: Perhaps trying to extract the info from sctp_assoc instead of sock might fix this. But it still isn't clear why the socket doesn't have info from the last packet. Possibly a race condition? Could this happen with other protocols?
Note You need to log in before you can comment on or make changes to this bug.