| Message ID | 201712041944.HAI56745.HOFQFtJSOVMOFL@I-love.SAKURA.ne.jp (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
Tetsuo Handa wrote: > James Morris wrote: > > On Sun, 3 Dec 2017, Tetsuo Handa wrote: > > > > > Tetsuo Handa wrote: > > > > which will allow strcmp() to trigger out of bound read when "size" is > > > > larger than strlen(initial_sid_to_string[i]). > > > > > > Oops. "smaller" than. > > > > > > > > > > > Thus, I guess the simplest fix is to use strncmp() instead of strcmp(). > > > > > > Can somebody test below patch? (My CentOS 7 environment does not support > > > enabling SELinux in linux.git . Userspace tool is too old to support?) > > > > You mean enabling KASAN? Yep, you need gcc 4.9.2 or better. Recent > > Fedora has it. > > I was not able to find "SELinux: Initializing." line for some reason, and > it turned out that I just forgot to run "make install". ;-) > > I tested using debug printk() and init for built-in initramfs shown below. > It is strange that KASAN does not trigger upon strcmp()ing > initial_sid_to_string[1]. But anyway, my patch fixes this problem. Sorry for noise. It was just initial_sid_to_string[10] which compared the second byte. Thus, nothing is strange. -- To unsubscribe from this list: send the line "unsubscribe linux-security-module" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
--- a/security/selinux/hooks.c +++ b/security/selinux/hooks.c @@ -5973,6 +5973,7 @@ static int selinux_setprocattr(const char *name, void *value, size_t size) PROCESS__SETCURRENT, NULL); else error = -EINVAL; + printk("setprocattr %s=%d size=%lu\n", name, error, size); if (error) return error; diff --git a/security/selinux/ss/services.c b/security/selinux/ss/services.c index 33cfe5d..fbf0ade 100644 --- a/security/selinux/ss/services.c +++ b/security/selinux/ss/services.c @@ -1417,6 +1417,7 @@ static int security_context_to_sid_core(const char *scontext, u32 scontext_len, int i; for (i = 1; i < SECINITSID_NUM; i++) { + printk("Comparing with %s\n", initial_sid_to_string[i]); if (!strcmp(initial_sid_to_string[i], scontext)) { *sid = i; return 0;