| Message ID | 20240614194500.631810-1-jwcart2@gmail.com (mailing list archive) |
|---|---|
| State | Accepted |
| Commit | 1efc12146624 |
| Delegated to: | Petr Lautrbach |
| Headers | show |
| Series | libsepol: Do not reject all type rules in conditionals when validating | expand |
On Fri, 14 Jun 2024 at 21:45, James Carter <jwcart2@gmail.com> wrote: > > Commit 1c91bc84 ("libsepol: reject self flag in type rules in old > policies") actually rejects all type rules in conditionals in modular > policies prior to version 21 (MOD_POLICYDB_VERSION_SELF_TYPETRANS). > > The problem is because of fall-through in a switch statement when > the avrule flags are 0. Instead, break rather than fall-through when > avrule flags are 0. Thanks for spotting this. I'am probably going to look to enhance the downgrade unit test for the next validate updates... Reviewed-by: Christian Göttsche <cgzones@googlemail.com> > --- > libsepol/src/policydb_validate.c | 1 + > 1 file changed, 1 insertion(+) > > diff --git a/libsepol/src/policydb_validate.c b/libsepol/src/policydb_validate.c > index 9746f562..2043e437 100644 > --- a/libsepol/src/policydb_validate.c > +++ b/libsepol/src/policydb_validate.c > @@ -1076,6 +1076,7 @@ static int validate_avrules(sepol_handle_t *handle, const avrule_t *avrule, int > > switch(avrule->flags) { > case 0: > + break; > case RULE_SELF: > if (p->policyvers != POLICY_KERN && > p->policyvers < MOD_POLICYDB_VERSION_SELF_TYPETRANS && > -- > 2.45.2 >
Christian Göttsche <cgzones@googlemail.com> writes: > On Fri, 14 Jun 2024 at 21:45, James Carter <jwcart2@gmail.com> wrote: >> >> Commit 1c91bc84 ("libsepol: reject self flag in type rules in old >> policies") actually rejects all type rules in conditionals in modular >> policies prior to version 21 (MOD_POLICYDB_VERSION_SELF_TYPETRANS). >> >> The problem is because of fall-through in a switch statement when >> the avrule flags are 0. Instead, break rather than fall-through when >> avrule flags are 0. > > Thanks for spotting this. > I'am probably going to look to enhance the downgrade unit test for the > next validate updates... > > Reviewed-by: Christian Göttsche <cgzones@googlemail.com> Acked-by: Petr Lautrbach <lautrbach@redhat.com> > >> --- >> libsepol/src/policydb_validate.c | 1 + >> 1 file changed, 1 insertion(+) >> >> diff --git a/libsepol/src/policydb_validate.c b/libsepol/src/policydb_validate.c >> index 9746f562..2043e437 100644 >> --- a/libsepol/src/policydb_validate.c >> +++ b/libsepol/src/policydb_validate.c >> @@ -1076,6 +1076,7 @@ static int validate_avrules(sepol_handle_t *handle, const avrule_t *avrule, int >> >> switch(avrule->flags) { >> case 0: >> + break; >> case RULE_SELF: >> if (p->policyvers != POLICY_KERN && >> p->policyvers < MOD_POLICYDB_VERSION_SELF_TYPETRANS && >> -- >> 2.45.2 >>
On Mon, Jun 17, 2024 at 5:10 AM Petr Lautrbach <lautrbach@redhat.com> wrote: > > Christian Göttsche <cgzones@googlemail.com> writes: > > > On Fri, 14 Jun 2024 at 21:45, James Carter <jwcart2@gmail.com> wrote: > >> > >> Commit 1c91bc84 ("libsepol: reject self flag in type rules in old > >> policies") actually rejects all type rules in conditionals in modular > >> policies prior to version 21 (MOD_POLICYDB_VERSION_SELF_TYPETRANS). > >> > >> The problem is because of fall-through in a switch statement when > >> the avrule flags are 0. Instead, break rather than fall-through when > >> avrule flags are 0. > > > > Thanks for spotting this. > > I'am probably going to look to enhance the downgrade unit test for the > > next validate updates... > > > > Reviewed-by: Christian Göttsche <cgzones@googlemail.com> > > Acked-by: Petr Lautrbach <lautrbach@redhat.com> > This has been merged. Thanks, Jim > > > > > >> --- > >> libsepol/src/policydb_validate.c | 1 + > >> 1 file changed, 1 insertion(+) > >> > >> diff --git a/libsepol/src/policydb_validate.c b/libsepol/src/policydb_validate.c > >> index 9746f562..2043e437 100644 > >> --- a/libsepol/src/policydb_validate.c > >> +++ b/libsepol/src/policydb_validate.c > >> @@ -1076,6 +1076,7 @@ static int validate_avrules(sepol_handle_t *handle, const avrule_t *avrule, int > >> > >> switch(avrule->flags) { > >> case 0: > >> + break; > >> case RULE_SELF: > >> if (p->policyvers != POLICY_KERN && > >> p->policyvers < MOD_POLICYDB_VERSION_SELF_TYPETRANS && > >> -- > >> 2.45.2 > >> >
diff --git a/libsepol/src/policydb_validate.c b/libsepol/src/policydb_validate.c index 9746f562..2043e437 100644 --- a/libsepol/src/policydb_validate.c +++ b/libsepol/src/policydb_validate.c @@ -1076,6 +1076,7 @@ static int validate_avrules(sepol_handle_t *handle, const avrule_t *avrule, int switch(avrule->flags) { case 0: + break; case RULE_SELF: if (p->policyvers != POLICY_KERN && p->policyvers < MOD_POLICYDB_VERSION_SELF_TYPETRANS &&
Commit 1c91bc84 ("libsepol: reject self flag in type rules in old policies") actually rejects all type rules in conditionals in modular policies prior to version 21 (MOD_POLICYDB_VERSION_SELF_TYPETRANS). The problem is because of fall-through in a switch statement when the avrule flags are 0. Instead, break rather than fall-through when avrule flags are 0. --- libsepol/src/policydb_validate.c | 1 + 1 file changed, 1 insertion(+)