On Jul 28, 2023 =?UTF-8?q?Christian=20G=C3=B6ttsche?= <cgzones@xxxxxxxxxxxxxx> wrote:
>
> Security classes have only up to 32 permissions, hence using an u16 is
> sufficient (while improving padding in struct selinux_mapping).
>
> Also use a fixed sized cast in a bit shift to avoid (well defined)
> overflows on architectures where sizeof(unsigned int) != sizeof(u32)
> resulting in no bits set.
>
> Signed-off-by: Christian Göttsche <cgzones@xxxxxxxxxxxxxx>
> ---
> v2:
> update commit description:
> - mention struct selinux_mapping in the padding argument
> (currently between the first and second member there are 2 bytes
> padding)
> - mention overflow in the cast argument and the result of setting
> no bits due to it
> ---
> security/selinux/ss/services.c | 6 +++---
> security/selinux/ss/services.h | 2 +-
> 2 files changed, 4 insertions(+), 4 deletions(-)
This looks good, I would just like to request one small change
(see below).
> diff --git a/security/selinux/ss/services.c b/security/selinux/ss/services.c
> index 2c5be06fbada..cf4b87ec4a0e 100644
> --- a/security/selinux/ss/services.c
> +++ b/security/selinux/ss/services.c
> @@ -97,7 +97,6 @@ static int selinux_set_mapping(struct policydb *pol,
> struct selinux_map *out_map)
> {
> u16 i, j;
> - unsigned k;
> bool print_unknown_handle = false;
>
> /* Find number of classes in the input mapping */
> @@ -117,6 +116,7 @@ static int selinux_set_mapping(struct policydb *pol,
> while (map[j].name) {
> const struct security_class_mapping *p_in = map + (j++);
> struct selinux_mapping *p_out = out_map->mapping + j;
> + u16 k;
>
> /* An empty class string skips ahead */
> if (!strcmp(p_in->name, "")) {
> @@ -202,7 +202,7 @@ static void map_decision(struct selinux_map *map,
> {
> if (tclass < map->size) {
> struct selinux_mapping *mapping = &map->mapping[tclass];
> - unsigned int i, n = mapping->num_perms;
> + u16 i, n = mapping->num_perms;
> u32 result;
>
> for (i = 0, result = 0; i < n; i++) {
> @@ -230,7 +230,7 @@ static void map_decision(struct selinux_map *map,
> * should audit that denial
> */
> for (; i < (sizeof(u32)*8); i++)
> - result |= 1<<i;
> + result |= 1<<((u32)i);
Given that the for-loop bounds the value of 'i' to a maximum of 32
(31 within the valid portion of the loop), this cast seems
unnecessary and potentially problematic in the future. Please drop
this casting.
> avd->auditdeny = result;
> }
> }
--
paul-moore.com
