| Message ID | 20230512093001.49208-1-cgzones@googlemail.com (mailing list archive) |
|---|---|
| State | Accepted |
| Commit | 45a4fc77e171 |
| Delegated to: | Petr Lautrbach |
| Headers | show |
| Series | [1/5] libsepol: validate some object contexts | expand |
On Fri, May 12, 2023 at 5:32 AM Christian Göttsche <cgzones@googlemail.com> wrote: > > Ensure various object context entries have a name, since they are > duplicated via strdup(3), and the order for ports and memory regions is > valid. > > Signed-off-by: Christian Göttsche <cgzones@googlemail.com> For these five patches: Acked-by: James Carter <jwcart2@gmail.com> > --- > libsepol/src/policydb_validate.c | 30 ++++++++++++++++++++++++++++++ > 1 file changed, 30 insertions(+) > > diff --git a/libsepol/src/policydb_validate.c b/libsepol/src/policydb_validate.c > index 301aa200..e0d290ff 100644 > --- a/libsepol/src/policydb_validate.c > +++ b/libsepol/src/policydb_validate.c > @@ -1149,6 +1149,8 @@ static int validate_ocontexts(sepol_handle_t *handle, const policydb_t *p, valid > case OCON_NETIF: > if (validate_context(&octx->context[1], flavors, p->mls)) > goto bad; > + if (!octx->u.name) > + goto bad; > break; > case OCON_PORT: > if (octx->u.port.low_port > octx->u.port.high_port) > @@ -1163,6 +1165,34 @@ static int validate_ocontexts(sepol_handle_t *handle, const policydb_t *p, valid > default: > goto bad; > } > + if (!octx->u.name) > + goto bad; > + break; > + case OCON_IBPKEY: > + if (octx->u.ibpkey.low_pkey > octx->u.ibpkey.high_pkey) > + goto bad; > + break; > + case OCON_IBENDPORT: > + if (!octx->u.ibendport.dev_name) > + goto bad; > + break; > + } > + } else if (p->target_platform == SEPOL_TARGET_XEN) { > + switch(i) { > + case OCON_XEN_IOPORT: > + if (octx->u.ioport.low_ioport > octx->u.ioport.high_ioport) > + goto bad; > + break; > + case OCON_XEN_IOMEM: > + if (octx->u.iomem.low_iomem > octx->u.iomem.high_iomem) > + goto bad; > + if (p->policyvers < POLICYDB_VERSION_XEN_DEVICETREE && octx->u.iomem.high_iomem > 0xFFFFFFFFULL) > + goto bad; > + break; > + case OCON_XEN_DEVICETREE: > + if (!octx->u.name) > + goto bad; > + break; > } > } > } > -- > 2.40.1 >
On Thu, May 25, 2023 at 4:36 PM James Carter <jwcart2@gmail.com> wrote: > > On Fri, May 12, 2023 at 5:32 AM Christian Göttsche > <cgzones@googlemail.com> wrote: > > > > Ensure various object context entries have a name, since they are > > duplicated via strdup(3), and the order for ports and memory regions is > > valid. > > > > Signed-off-by: Christian Göttsche <cgzones@googlemail.com> > > For these five patches: > Acked-by: James Carter <jwcart2@gmail.com> > These five patches have been merged. Thanks, Jim > > --- > > libsepol/src/policydb_validate.c | 30 ++++++++++++++++++++++++++++++ > > 1 file changed, 30 insertions(+) > > > > diff --git a/libsepol/src/policydb_validate.c b/libsepol/src/policydb_validate.c > > index 301aa200..e0d290ff 100644 > > --- a/libsepol/src/policydb_validate.c > > +++ b/libsepol/src/policydb_validate.c > > @@ -1149,6 +1149,8 @@ static int validate_ocontexts(sepol_handle_t *handle, const policydb_t *p, valid > > case OCON_NETIF: > > if (validate_context(&octx->context[1], flavors, p->mls)) > > goto bad; > > + if (!octx->u.name) > > + goto bad; > > break; > > case OCON_PORT: > > if (octx->u.port.low_port > octx->u.port.high_port) > > @@ -1163,6 +1165,34 @@ static int validate_ocontexts(sepol_handle_t *handle, const policydb_t *p, valid > > default: > > goto bad; > > } > > + if (!octx->u.name) > > + goto bad; > > + break; > > + case OCON_IBPKEY: > > + if (octx->u.ibpkey.low_pkey > octx->u.ibpkey.high_pkey) > > + goto bad; > > + break; > > + case OCON_IBENDPORT: > > + if (!octx->u.ibendport.dev_name) > > + goto bad; > > + break; > > + } > > + } else if (p->target_platform == SEPOL_TARGET_XEN) { > > + switch(i) { > > + case OCON_XEN_IOPORT: > > + if (octx->u.ioport.low_ioport > octx->u.ioport.high_ioport) > > + goto bad; > > + break; > > + case OCON_XEN_IOMEM: > > + if (octx->u.iomem.low_iomem > octx->u.iomem.high_iomem) > > + goto bad; > > + if (p->policyvers < POLICYDB_VERSION_XEN_DEVICETREE && octx->u.iomem.high_iomem > 0xFFFFFFFFULL) > > + goto bad; > > + break; > > + case OCON_XEN_DEVICETREE: > > + if (!octx->u.name) > > + goto bad; > > + break; > > } > > } > > } > > -- > > 2.40.1 > >
diff --git a/libsepol/src/policydb_validate.c b/libsepol/src/policydb_validate.c index 301aa200..e0d290ff 100644 --- a/libsepol/src/policydb_validate.c +++ b/libsepol/src/policydb_validate.c @@ -1149,6 +1149,8 @@ static int validate_ocontexts(sepol_handle_t *handle, const policydb_t *p, valid case OCON_NETIF: if (validate_context(&octx->context[1], flavors, p->mls)) goto bad; + if (!octx->u.name) + goto bad; break; case OCON_PORT: if (octx->u.port.low_port > octx->u.port.high_port) @@ -1163,6 +1165,34 @@ static int validate_ocontexts(sepol_handle_t *handle, const policydb_t *p, valid default: goto bad; } + if (!octx->u.name) + goto bad; + break; + case OCON_IBPKEY: + if (octx->u.ibpkey.low_pkey > octx->u.ibpkey.high_pkey) + goto bad; + break; + case OCON_IBENDPORT: + if (!octx->u.ibendport.dev_name) + goto bad; + break; + } + } else if (p->target_platform == SEPOL_TARGET_XEN) { + switch(i) { + case OCON_XEN_IOPORT: + if (octx->u.ioport.low_ioport > octx->u.ioport.high_ioport) + goto bad; + break; + case OCON_XEN_IOMEM: + if (octx->u.iomem.low_iomem > octx->u.iomem.high_iomem) + goto bad; + if (p->policyvers < POLICYDB_VERSION_XEN_DEVICETREE && octx->u.iomem.high_iomem > 0xFFFFFFFFULL) + goto bad; + break; + case OCON_XEN_DEVICETREE: + if (!octx->u.name) + goto bad; + break; } } }
Ensure various object context entries have a name, since they are duplicated via strdup(3), and the order for ports and memory regions is valid. Signed-off-by: Christian Göttsche <cgzones@googlemail.com> --- libsepol/src/policydb_validate.c | 30 ++++++++++++++++++++++++++++++ 1 file changed, 30 insertions(+)