On Fri, May 12, 2023 at 5:32 AM Christian Göttsche
<cgzones@xxxxxxxxxxxxxx> wrote:
>
> Ensure various object context entries have a name, since they are
> duplicated via strdup(3), and the order for ports and memory regions is
> valid.
>
> Signed-off-by: Christian Göttsche <cgzones@xxxxxxxxxxxxxx>
For these five patches:
Acked-by: James Carter <jwcart2@xxxxxxxxx>
> ---
> libsepol/src/policydb_validate.c | 30 ++++++++++++++++++++++++++++++
> 1 file changed, 30 insertions(+)
>
> diff --git a/libsepol/src/policydb_validate.c b/libsepol/src/policydb_validate.c
> index 301aa200..e0d290ff 100644
> --- a/libsepol/src/policydb_validate.c
> +++ b/libsepol/src/policydb_validate.c
> @@ -1149,6 +1149,8 @@ static int validate_ocontexts(sepol_handle_t *handle, const policydb_t *p, valid
> case OCON_NETIF:
> if (validate_context(&octx->context[1], flavors, p->mls))
> goto bad;
> + if (!octx->u.name)
> + goto bad;
> break;
> case OCON_PORT:
> if (octx->u.port.low_port > octx->u.port.high_port)
> @@ -1163,6 +1165,34 @@ static int validate_ocontexts(sepol_handle_t *handle, const policydb_t *p, valid
> default:
> goto bad;
> }
> + if (!octx->u.name)
> + goto bad;
> + break;
> + case OCON_IBPKEY:
> + if (octx->u.ibpkey.low_pkey > octx->u.ibpkey.high_pkey)
> + goto bad;
> + break;
> + case OCON_IBENDPORT:
> + if (!octx->u.ibendport.dev_name)
> + goto bad;
> + break;
> + }
> + } else if (p->target_platform == SEPOL_TARGET_XEN) {
> + switch(i) {
> + case OCON_XEN_IOPORT:
> + if (octx->u.ioport.low_ioport > octx->u.ioport.high_ioport)
> + goto bad;
> + break;
> + case OCON_XEN_IOMEM:
> + if (octx->u.iomem.low_iomem > octx->u.iomem.high_iomem)
> + goto bad;
> + if (p->policyvers < POLICYDB_VERSION_XEN_DEVICETREE && octx->u.iomem.high_iomem > 0xFFFFFFFFULL)
> + goto bad;
> + break;
> + case OCON_XEN_DEVICETREE:
> + if (!octx->u.name)
> + goto bad;
> + break;
> }
> }
> }
> --
> 2.40.1
>
