On Thu, May 25, 2023 at 4:36 PM James Carter <jwcart2@xxxxxxxxx> wrote:
>
> On Fri, May 12, 2023 at 5:32 AM Christian Göttsche
> <cgzones@xxxxxxxxxxxxxx> wrote:
> >
> > Ensure various object context entries have a name, since they are
> > duplicated via strdup(3), and the order for ports and memory regions is
> > valid.
> >
> > Signed-off-by: Christian Göttsche <cgzones@xxxxxxxxxxxxxx>
>
> For these five patches:
> Acked-by: James Carter <jwcart2@xxxxxxxxx>
>
These five patches have been merged.
Thanks,
Jim
> > ---
> > libsepol/src/policydb_validate.c | 30 ++++++++++++++++++++++++++++++
> > 1 file changed, 30 insertions(+)
> >
> > diff --git a/libsepol/src/policydb_validate.c b/libsepol/src/policydb_validate.c
> > index 301aa200..e0d290ff 100644
> > --- a/libsepol/src/policydb_validate.c
> > +++ b/libsepol/src/policydb_validate.c
> > @@ -1149,6 +1149,8 @@ static int validate_ocontexts(sepol_handle_t *handle, const policydb_t *p, valid
> > case OCON_NETIF:
> > if (validate_context(&octx->context[1], flavors, p->mls))
> > goto bad;
> > + if (!octx->u.name)
> > + goto bad;
> > break;
> > case OCON_PORT:
> > if (octx->u.port.low_port > octx->u.port.high_port)
> > @@ -1163,6 +1165,34 @@ static int validate_ocontexts(sepol_handle_t *handle, const policydb_t *p, valid
> > default:
> > goto bad;
> > }
> > + if (!octx->u.name)
> > + goto bad;
> > + break;
> > + case OCON_IBPKEY:
> > + if (octx->u.ibpkey.low_pkey > octx->u.ibpkey.high_pkey)
> > + goto bad;
> > + break;
> > + case OCON_IBENDPORT:
> > + if (!octx->u.ibendport.dev_name)
> > + goto bad;
> > + break;
> > + }
> > + } else if (p->target_platform == SEPOL_TARGET_XEN) {
> > + switch(i) {
> > + case OCON_XEN_IOPORT:
> > + if (octx->u.ioport.low_ioport > octx->u.ioport.high_ioport)
> > + goto bad;
> > + break;
> > + case OCON_XEN_IOMEM:
> > + if (octx->u.iomem.low_iomem > octx->u.iomem.high_iomem)
> > + goto bad;
> > + if (p->policyvers < POLICYDB_VERSION_XEN_DEVICETREE && octx->u.iomem.high_iomem > 0xFFFFFFFFULL)
> > + goto bad;
> > + break;
> > + case OCON_XEN_DEVICETREE:
> > + if (!octx->u.name)
> > + goto bad;
> > + break;
> > }
> > }
> > }
> > --
> > 2.40.1
> >
