Socketpair

[tfjmp]

One of the two socket pair is not connected. Neither through socket_create nor socker_pair_create.

Expectation is for the second socket to be connected too.

Looking at CamFlow's code it is hard to understand why it is not the case: https://github.com/CamFlow/camflow-dev/blob/dev/security/provenance/hooks.c#L1796 https://github.com/CamFlow/camflow-dev/blob/dev/security/provenance/hooks.c#L1820

Look at socketpair implementation and understand how security_socketpair is being called.