[PATCH v2 1/2] landlock: fix TCP Fast Open connection bypass

[Mickaël Salaün]

Thanks, applied!

On Wed, Jul 01, 2026 at 11:46:27PM +0200, Matthieu Buffet wrote:
> The documentation of the socket_connect() LSM hook states that it
> controls connecting a socket to a remote address. It has not been the
> case since the addition of TCP Fast Open (RFC 7413) support, which allows
> opening a TCP connection (thus, setting a socket's destination address)
> via the MSG_FASTOPEN flag passed to sendto()/sendmsg()/sendmmsg(). The
> problem then got duplicated into MPTCP.
> 
> Landlock did not take it into account when its TCP support was added,
> leaving a bypass of TCP connect policy.
> 
> Ideally a call to the LSM hook would be added in the fastopen code path,
> in order to fix this generically. But connect() hooks are designed to run
> with the socket locked, unlike sendmsg() hooks.
> 
> Closes: https://github.com/landlock-lsm/linux/issues/41
> Fixes: fff69fb03dde ("landlock: Support network rules with TCP bind and connect")
> Signed-off-by: Matthieu Buffet <matthieu at buffet.re>
> ---
>  security/landlock/net.c | 8 ++++++++
>  1 file changed, 8 insertions(+)
> 
> diff --git a/security/landlock/net.c b/security/landlock/net.c
> index cbff59ec3aba..46c17116fcf4 100644
> --- a/security/landlock/net.c
> +++ b/security/landlock/net.c
> @@ -351,6 +351,14 @@ static int hook_socket_sendmsg(struct socket *const sock,
>  	access_mask_t access_request;
>  	int ret = 0;
>  
> +	if ((msg->msg_flags & MSG_FASTOPEN) && address && sk_is_tcp(sock->sk)) {
> +		ret = current_check_access_socket(
> +			sock, address, addrlen, LANDLOCK_ACCESS_NET_CONNECT_TCP,
> +			true);
> +		if (ret != 0)
> +			return ret;
> +	}
> +
>  	if (sk_is_udp(sock->sk))
>  		access_request = LANDLOCK_ACCESS_NET_CONNECT_SEND_UDP;
>  	else
> -- 
> 2.47.3
> 
>