On Mon, Jun 17, 2024 at 5:10 AM Petr Lautrbach <lautrbach@xxxxxxxxxx> wrote:
>
> Christian Göttsche <cgzones@xxxxxxxxxxxxxx> writes:
>
> > On Fri, 14 Jun 2024 at 21:45, James Carter <jwcart2@xxxxxxxxx> wrote:
> >>
> >> Commit 1c91bc84 ("libsepol: reject self flag in type rules in old
> >> policies") actually rejects all type rules in conditionals in modular
> >> policies prior to version 21 (MOD_POLICYDB_VERSION_SELF_TYPETRANS).
> >>
> >> The problem is because of fall-through in a switch statement when
> >> the avrule flags are 0. Instead, break rather than fall-through when
> >> avrule flags are 0.
> >
> > Thanks for spotting this.
> > I'am probably going to look to enhance the downgrade unit test for the
> > next validate updates...
> >
> > Reviewed-by: Christian Göttsche <cgzones@xxxxxxxxxxxxxx>
>
> Acked-by: Petr Lautrbach <lautrbach@xxxxxxxxxx>
>
This has been merged.
Thanks,
Jim
>
>
> >
> >> ---
> >> libsepol/src/policydb_validate.c | 1 +
> >> 1 file changed, 1 insertion(+)
> >>
> >> diff --git a/libsepol/src/policydb_validate.c b/libsepol/src/policydb_validate.c
> >> index 9746f562..2043e437 100644
> >> --- a/libsepol/src/policydb_validate.c
> >> +++ b/libsepol/src/policydb_validate.c
> >> @@ -1076,6 +1076,7 @@ static int validate_avrules(sepol_handle_t *handle, const avrule_t *avrule, int
> >>
> >> switch(avrule->flags) {
> >> case 0:
> >> + break;
> >> case RULE_SELF:
> >> if (p->policyvers != POLICY_KERN &&
> >> p->policyvers < MOD_POLICYDB_VERSION_SELF_TYPETRANS &&
> >> --
> >> 2.45.2
> >>
>
