Re: [PATCH v2] libsepol: fix validation of user declarations in non-base modules

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On Thu, Jun 9, 2022 at 4:27 AM Christian Göttsche
<cgzones@xxxxxxxxxxxxxx> wrote:
>
> Users may be declared in non-base modules, which do not get expanded,
> leaving the `struct user_datum` members `exp_range` and `exp_dfltlevel`
> empty.
> Skip validation of the expanded range and level for non-base module
> polices.
>
> Reported-by: bauen1 <j2468h@xxxxxxxxx>
> Signed-off-by: Christian Göttsche <cgzones@xxxxxxxxxxxxxx>
> ---
> v2:
>    - update commit description and fix typos

Sorry, I didn't see this patch before I applied the first one.
Jim

> ---
>  libsepol/src/policydb_validate.c | 12 ++++++------
>  1 file changed, 6 insertions(+), 6 deletions(-)
>
> diff --git a/libsepol/src/policydb_validate.c b/libsepol/src/policydb_validate.c
> index da18282b..99d4eb7f 100644
> --- a/libsepol/src/policydb_validate.c
> +++ b/libsepol/src/policydb_validate.c
> @@ -18,7 +18,7 @@ typedef struct validate {
>  typedef struct map_arg {
>         validate_t *flavors;
>         sepol_handle_t *handle;
> -       int mls;
> +       policydb_t *policy;
>  } map_arg_t;
>
>  static int create_gap_ebitmap(char **val_to_name, uint32_t nprim, ebitmap_t *gaps)
> @@ -571,7 +571,7 @@ static int validate_mls_range(mls_range_t *range, validate_t *sens, validate_t *
>         return -1;
>  }
>
> -static int validate_user_datum(sepol_handle_t *handle, user_datum_t *user, validate_t flavors[], int mls)
> +static int validate_user_datum(sepol_handle_t *handle, user_datum_t *user, validate_t flavors[], policydb_t *p)
>  {
>         if (validate_value(user->s.value, &flavors[SYM_USERS]))
>                 goto bad;
> @@ -581,9 +581,9 @@ static int validate_user_datum(sepol_handle_t *handle, user_datum_t *user, valid
>                 goto bad;
>         if (validate_mls_semantic_level(&user->dfltlevel, &flavors[SYM_LEVELS], &flavors[SYM_CATS]))
>                 goto bad;
> -       if (mls && validate_mls_range(&user->exp_range, &flavors[SYM_LEVELS], &flavors[SYM_CATS]))
> +       if (p->mls && p->policy_type != POLICY_MOD && validate_mls_range(&user->exp_range, &flavors[SYM_LEVELS], &flavors[SYM_CATS]))
>                 goto bad;
> -       if (mls && validate_mls_level(&user->exp_dfltlevel, &flavors[SYM_LEVELS], &flavors[SYM_CATS]))
> +       if (p->mls && p->policy_type != POLICY_MOD && validate_mls_level(&user->exp_dfltlevel, &flavors[SYM_LEVELS], &flavors[SYM_CATS]))
>                 goto bad;
>         if (user->bounds && validate_value(user->bounds, &flavors[SYM_USERS]))
>                 goto bad;
> @@ -599,7 +599,7 @@ static int validate_user_datum_wrapper(__attribute__((unused)) hashtab_key_t k,
>  {
>         map_arg_t *margs = args;
>
> -       return validate_user_datum(margs->handle, d, margs->flavors, margs->mls);
> +       return validate_user_datum(margs->handle, d, margs->flavors, margs->policy);
>  }
>
>  static int validate_bool_datum(sepol_handle_t *handle, cond_bool_datum_t *boolean, validate_t flavors[])
> @@ -689,7 +689,7 @@ static int validate_datum(__attribute__ ((unused))hashtab_key_t k, hashtab_datum
>
>  static int validate_datum_array_entries(sepol_handle_t *handle, policydb_t *p, validate_t flavors[])
>  {
> -       map_arg_t margs = { flavors, handle, p->mls };
> +       map_arg_t margs = { flavors, handle, p };
>
>         if (hashtab_map(p->p_commons.table, validate_common_datum_wrapper, &margs))
>                 goto bad;
> --
> 2.36.1
>




[Index of Archives]     [Selinux Refpolicy]     [Linux SGX]     [Fedora Users]     [Fedora Desktop]     [Yosemite Photos]     [Yosemite Camping]     [Yosemite Campsites]     [KDE Users]     [Gnome Users]

  Powered by Linux