| Message ID | 20240506173110.220702-1-cgoettsche@seltendoof.de (mailing list archive) |
|---|---|
| State | Accepted |
| Commit | 1c91bc84e695 |
| Delegated to: | Petr Lautrbach |
| Headers | show |
| Series | [1/4] libsepol: reject self flag in type rules in old policies | expand |
On Mon, May 6, 2024 at 1:31 PM Christian Göttsche <cgoettsche@seltendoof.de> wrote: > > From: Christian Göttsche <cgzones@googlemail.com> > > The flag RULE_SELF in type rules is only supported in modular policies > since version 21 (MOD_POLICYDB_VERSION_SELF_TYPETRANS). > > Reported-by: oss-fuzz (issue 68731) > Signed-off-by: Christian Göttsche <cgzones@googlemail.com> For these four patches: Acked-by: James Carter <jwcart2@gmail.com> > --- > libsepol/src/policydb_validate.c | 14 +++++++++++++- > 1 file changed, 13 insertions(+), 1 deletion(-) > > diff --git a/libsepol/src/policydb_validate.c b/libsepol/src/policydb_validate.c > index e1623172..be3ebe5f 100644 > --- a/libsepol/src/policydb_validate.c > +++ b/libsepol/src/policydb_validate.c > @@ -1077,6 +1077,10 @@ static int validate_avrules(sepol_handle_t *handle, const avrule_t *avrule, int > switch(avrule->flags) { > case 0: > case RULE_SELF: > + if (p->policyvers != POLICY_KERN && > + p->policyvers < MOD_POLICYDB_VERSION_SELF_TYPETRANS && > + (avrule->specified & AVRULE_TYPE)) > + goto bad; > break; > case RULE_NOTSELF: > switch(avrule->specified) { > @@ -1503,8 +1507,16 @@ static int validate_filename_trans_rules(sepol_handle_t *handle, const filename_ > goto bad; > > /* currently only the RULE_SELF flag can be set */ > - if ((filename_trans->flags & ~RULE_SELF) != 0) > + switch (filename_trans->flags) { > + case 0: > + break; > + case RULE_SELF: > + if (p->policyvers != POLICY_KERN && p->policyvers < MOD_POLICYDB_VERSION_SELF_TYPETRANS) > + goto bad; > + break; > + default: > goto bad; > + } > } > > return 0; > -- > 2.43.0 > >
On Wed, May 8, 2024 at 2:50 PM James Carter <jwcart2@gmail.com> wrote: > > On Mon, May 6, 2024 at 1:31 PM Christian Göttsche > <cgoettsche@seltendoof.de> wrote: > > > > From: Christian Göttsche <cgzones@googlemail.com> > > > > The flag RULE_SELF in type rules is only supported in modular policies > > since version 21 (MOD_POLICYDB_VERSION_SELF_TYPETRANS). > > > > Reported-by: oss-fuzz (issue 68731) > > Signed-off-by: Christian Göttsche <cgzones@googlemail.com> > > For these four patches: > Acked-by: James Carter <jwcart2@gmail.com> > These four patches have been merged. Thanks, Jim > > --- > > libsepol/src/policydb_validate.c | 14 +++++++++++++- > > 1 file changed, 13 insertions(+), 1 deletion(-) > > > > diff --git a/libsepol/src/policydb_validate.c b/libsepol/src/policydb_validate.c > > index e1623172..be3ebe5f 100644 > > --- a/libsepol/src/policydb_validate.c > > +++ b/libsepol/src/policydb_validate.c > > @@ -1077,6 +1077,10 @@ static int validate_avrules(sepol_handle_t *handle, const avrule_t *avrule, int > > switch(avrule->flags) { > > case 0: > > case RULE_SELF: > > + if (p->policyvers != POLICY_KERN && > > + p->policyvers < MOD_POLICYDB_VERSION_SELF_TYPETRANS && > > + (avrule->specified & AVRULE_TYPE)) > > + goto bad; > > break; > > case RULE_NOTSELF: > > switch(avrule->specified) { > > @@ -1503,8 +1507,16 @@ static int validate_filename_trans_rules(sepol_handle_t *handle, const filename_ > > goto bad; > > > > /* currently only the RULE_SELF flag can be set */ > > - if ((filename_trans->flags & ~RULE_SELF) != 0) > > + switch (filename_trans->flags) { > > + case 0: > > + break; > > + case RULE_SELF: > > + if (p->policyvers != POLICY_KERN && p->policyvers < MOD_POLICYDB_VERSION_SELF_TYPETRANS) > > + goto bad; > > + break; > > + default: > > goto bad; > > + } > > } > > > > return 0; > > -- > > 2.43.0 > > > >
diff --git a/libsepol/src/policydb_validate.c b/libsepol/src/policydb_validate.c index e1623172..be3ebe5f 100644 --- a/libsepol/src/policydb_validate.c +++ b/libsepol/src/policydb_validate.c @@ -1077,6 +1077,10 @@ static int validate_avrules(sepol_handle_t *handle, const avrule_t *avrule, int switch(avrule->flags) { case 0: case RULE_SELF: + if (p->policyvers != POLICY_KERN && + p->policyvers < MOD_POLICYDB_VERSION_SELF_TYPETRANS && + (avrule->specified & AVRULE_TYPE)) + goto bad; break; case RULE_NOTSELF: switch(avrule->specified) { @@ -1503,8 +1507,16 @@ static int validate_filename_trans_rules(sepol_handle_t *handle, const filename_ goto bad; /* currently only the RULE_SELF flag can be set */ - if ((filename_trans->flags & ~RULE_SELF) != 0) + switch (filename_trans->flags) { + case 0: + break; + case RULE_SELF: + if (p->policyvers != POLICY_KERN && p->policyvers < MOD_POLICYDB_VERSION_SELF_TYPETRANS) + goto bad; + break; + default: goto bad; + } } return 0;