selinux: skip bounded transition processing if the policy isn't loaded

Commit Message

Paul Moore Dec. 6, 2017, 4:02 p.m. UTC

From: Paul Moore <[e-mail]>

We can't do anything reasonable in security_bounded_transition() if we
don't have a policy loaded, and in fact we could run into problems
with some of the code inside expecting a policy.  Fix these problems
like we do many others in security/selinux/ss/services.c by checking
to see if the policy is loaded (ss_initialized) and returning quickly
if it isn't.

Reported-by: syzbot <[e-mail]>
Signed-off-by: Paul Moore <[e-mail]>
Acked-by: Stephen Smalley <[e-mail]>
---
 security/selinux/ss/services.c |    3 +++
 1 file changed, 3 insertions(+)

Comments

James Morris Dec. 6, 2017, 11:51 p.m. UTC | #1

On Wed, 6 Dec 2017, Paul Moore wrote:

> From: Paul Moore <[e-mail]>
> 
> We can't do anything reasonable in security_bounded_transition() if we
> don't have a policy loaded, and in fact we could run into problems
> with some of the code inside expecting a policy.  Fix these problems
> like we do many others in security/selinux/ss/services.c by checking
> to see if the policy is loaded (ss_initialized) and returning quickly
> if it isn't.
> 
> Reported-by: syzbot <[e-mail]>
> Signed-off-by: Paul Moore <[e-mail]>
> Acked-by: Stephen Smalley <[e-mail]>


Reviewed-by: James Morris <[e-mail]>

Paul Moore Dec. 7, 2017, 4:01 p.m. UTC | #2

On Wed, Dec 6, 2017 at 6:51 PM, James Morris <[e-mail]> wrote:
> On Wed, 6 Dec 2017, Paul Moore wrote:
>
>> From: Paul Moore <[e-mail]>
>>
>> We can't do anything reasonable in security_bounded_transition() if we
>> don't have a policy loaded, and in fact we could run into problems
>> with some of the code inside expecting a policy.  Fix these problems
>> like we do many others in security/selinux/ss/services.c by checking
>> to see if the policy is loaded (ss_initialized) and returning quickly
>> if it isn't.
>>
>> Reported-by: syzbot <[e-mail]>
>> Signed-off-by: Paul Moore <[e-mail]>
>> Acked-by: Stephen Smalley <[e-mail]>
>
>
> Reviewed-by: James Morris <[e-mail]>

Thanks.  I just merged the patch to selinux/next.

Patch

diff --git a/security/selinux/ss/services.c b/security/selinux/ss/services.c
index d05496deb229..8900ea5cbabf 100644
--- a/security/selinux/ss/services.c
+++ b/security/selinux/ss/services.c
@@ -867,6 +867,9 @@  int security_bounded_transition(u32 old_sid, u32 new_sid)
 	int index;
 	int rc;
 
+	if (!ss_initialized)
+		return 0;
+
 	read_lock(&policy_rwlock);
 
 	rc = -EINVAL;