On Mon, Nov 6, 2023 at 10:33 AM James Carter <jwcart2@xxxxxxxxx> wrote:
>
> On Fri, Nov 3, 2023 at 2:27 PM Christian Göttsche
> <cgzones@xxxxxxxxxxxxxx> wrote:
> >
> > Kernel policies with unsupported policy capabilities enabled can
> > currently be parsed, since they result just in a bit set inside an
> > ebitmap. Writing such a loaded policy into the traditional language or
> > CIL will fail however, since the unsupported policy capabilities can not
> > be converted into a name.
> >
> > Reject kernel policies with invalid policy capabilities.
> >
> > Reported-by: oss-fuzz (issue 60573)
> >
> > Signed-off-by: Christian Göttsche <cgzones@xxxxxxxxxxxxxx>
>
> Acked-by: James Carter <jwcart2@xxxxxxxxx>
>
Merged.
Thanks,
Jim
> > ---
> > Alternative to ("libsepol: ignore writing invalid polcaps in fuzzer"):
> > https://patchwork.kernel.org/project/selinux/patch/20231101163852.177983-1-cgzones@xxxxxxxxxxxxxx/
> > Signed-off-by: Christian Göttsche <cgzones@xxxxxxxxxxxxxx>
> > ---
> > libsepol/src/policydb_validate.c | 21 +++++++++++++++++++++
> > 1 file changed, 21 insertions(+)
> >
> > diff --git a/libsepol/src/policydb_validate.c b/libsepol/src/policydb_validate.c
> > index 892a0ffd..1acaa74f 100644
> > --- a/libsepol/src/policydb_validate.c
> > +++ b/libsepol/src/policydb_validate.c
> > @@ -1,6 +1,7 @@
> >
> > #include <sepol/policydb/conditional.h>
> > #include <sepol/policydb/ebitmap.h>
> > +#include <sepol/policydb/polcaps.h>
> > #include <sepol/policydb/policydb.h>
> > #include <sepol/policydb/services.h>
> >
> > @@ -1522,6 +1523,23 @@ bad:
> > return -1;
> > }
> >
> > +static int validate_policycaps(sepol_handle_t *handle, const policydb_t *p)
> > +{
> > + ebitmap_node_t *node;
> > + uint32_t i;
> > +
> > + ebitmap_for_each_positive_bit(&p->policycaps, node, i) {
> > + if (!sepol_polcap_getname(i))
> > + goto bad;
> > + }
> > +
> > + return 0;
> > +
> > +bad:
> > + ERR(handle, "Invalid policy capability");
> > + return -1;
> > +}
> > +
> > static void validate_array_destroy(validate_t flavors[])
> > {
> > unsigned int i;
> > @@ -1544,6 +1562,9 @@ int policydb_validate(sepol_handle_t *handle, const policydb_t *p)
> > if (validate_properties(handle, p))
> > goto bad;
> >
> > + if (validate_policycaps(handle, p))
> > + goto bad;
> > +
> > if (p->policy_type == POLICY_KERN) {
> > if (validate_avtab(handle, &p->te_avtab, p, flavors))
> > goto bad;
> > --
> > 2.42.0
> >
