On Tue, Sep 8, 2020 at 9:46 AM Stephen Smalley <stephen.smalley.work@xxxxxxxxx> wrote: > > On Fri, Sep 4, 2020 at 8:49 AM Stephen Smalley > <stephen.smalley.work@xxxxxxxxx> wrote: > > > > On Thu, Sep 3, 2020 at 2:19 PM James Carter <jwcart2@xxxxxxxxx> wrote: > > > > > > CIL was not correctly determining the depth of constraint expressions > > > which prevented it from giving an error when the max depth was exceeded. > > > This allowed invalid policy binaries with constraint expressions exceeding > > > the max depth to be created. > > > > > > Correctly calculate the depth of constraint expressions when building > > > the AST and give an error when the max depth is exceeded. > > > > > > Reported-by: Jonathan Hettwer <j2468h@xxxxxxxxx> > > > Signed-off-by: James Carter <jwcart2@xxxxxxxxx> > > > > The fix for conditional boolean expression depth checking can be a > > separate patch. For this one, > > > > Acked-by: Stephen Smalley <stephen.smalley.work@xxxxxxxxx> > > Actually, this breaks selinux-testsuite. Will have to look into why. > /usr/sbin/semodule -i test_policy/test_policy.pp test_mlsconstrain.cil > test_overlay_defaultrange.cil test_add_levels.cil test_glblub.cil > Max depth of 4 exceeded for constraint expression > Bad expression tree for constraint > Bad constrain declaration at > /var/lib/selinux/targeted/tmp/modules/100/base/cil:919 Here is the failing cil module: $ cat policy/test_mlsconstrain.cil (mlsconstrain (peer (recv)) (or (dom l1 l2) (and (neq t1 mcs_constrained_type) (neq t2 mcs_constrained_type)))) (mlsconstrain (packet (recv)) (or (dom l1 l2) (and (neq t1 mcs_constrained_type) (neq t2 mcs_constrained_type)))) Maybe an off-by-one in your depth checking?
