diff mbox series

libsepol: validate empty common classes in scope indices

Message ID 20231211145544.125635-1-cgzones@googlemail.com (mailing list archive)
State Accepted
Commit e54bedce8026
Headers show
Series libsepol: validate empty common classes in scope indices | expand

Commit Message

Christian Göttsche Dec. 11, 2023, 2:55 p.m. UTC 
Validate no common classes inside scope indices are defined.

Reported-by: oss-fuzz (issue 64849)
Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
---
This probably also resolves issue 64854, which I could not reproduce
locally.

Supersedes https://patchwork.kernel.org/project/selinux/patch/20231208151831.48343-1-cgzones@googlemail.com/
---
 libsepol/src/policydb_validate.c | 2 ++
 1 file changed, 2 insertions(+)

Comments

James Carter Dec. 11, 2023, 6:48 p.m. UTC | #1 
On Mon, Dec 11, 2023 at 9:55 AM Christian Göttsche
<cgzones@googlemail.com> wrote:
>
> Validate no common classes inside scope indices are defined.
>
> Reported-by: oss-fuzz (issue 64849)
> Signed-off-by: Christian Göttsche <cgzones@googlemail.com>

Acked-by: James Carter <jwcart2@gmail.com>

> ---
> This probably also resolves issue 64854, which I could not reproduce
> locally.
>
> Supersedes https://patchwork.kernel.org/project/selinux/patch/20231208151831.48343-1-cgzones@googlemail.com/
> ---
>  libsepol/src/policydb_validate.c | 2 ++
>  1 file changed, 2 insertions(+)
>
> diff --git a/libsepol/src/policydb_validate.c b/libsepol/src/policydb_validate.c
> index bd8e9f8f..d86f885e 100644
> --- a/libsepol/src/policydb_validate.c
> +++ b/libsepol/src/policydb_validate.c
> @@ -1344,6 +1344,8 @@ bad:
>
>  static int validate_scope_index(sepol_handle_t *handle, const scope_index_t *scope_index, validate_t flavors[])
>  {
> +       if (!ebitmap_is_empty(&scope_index->scope[SYM_COMMONS]))
> +               goto bad;
>         if (validate_ebitmap(&scope_index->p_classes_scope, &flavors[SYM_CLASSES]))
>                 goto bad;
>         if (validate_ebitmap(&scope_index->p_roles_scope, &flavors[SYM_ROLES]))
> --
> 2.43.0
>
>
James Carter Dec. 12, 2023, 4:44 p.m. UTC | #2 
On Mon, Dec 11, 2023 at 1:48 PM James Carter <jwcart2@gmail.com> wrote:
>
> On Mon, Dec 11, 2023 at 9:55 AM Christian Göttsche
> <cgzones@googlemail.com> wrote:
> >
> > Validate no common classes inside scope indices are defined.
> >
> > Reported-by: oss-fuzz (issue 64849)
> > Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
>
> Acked-by: James Carter <jwcart2@gmail.com>
>

Merged.
Thanks,
Jim

> > ---
> > This probably also resolves issue 64854, which I could not reproduce
> > locally.
> >
> > Supersedes https://patchwork.kernel.org/project/selinux/patch/20231208151831.48343-1-cgzones@googlemail.com/
> > ---
> >  libsepol/src/policydb_validate.c | 2 ++
> >  1 file changed, 2 insertions(+)
> >
> > diff --git a/libsepol/src/policydb_validate.c b/libsepol/src/policydb_validate.c
> > index bd8e9f8f..d86f885e 100644
> > --- a/libsepol/src/policydb_validate.c
> > +++ b/libsepol/src/policydb_validate.c
> > @@ -1344,6 +1344,8 @@ bad:
> >
> >  static int validate_scope_index(sepol_handle_t *handle, const scope_index_t *scope_index, validate_t flavors[])
> >  {
> > +       if (!ebitmap_is_empty(&scope_index->scope[SYM_COMMONS]))
> > +               goto bad;
> >         if (validate_ebitmap(&scope_index->p_classes_scope, &flavors[SYM_CLASSES]))
> >                 goto bad;
> >         if (validate_ebitmap(&scope_index->p_roles_scope, &flavors[SYM_ROLES]))
> > --
> > 2.43.0
> >
> >
diff mbox series

Patch

diff --git a/libsepol/src/policydb_validate.c b/libsepol/src/policydb_validate.c
index bd8e9f8f..d86f885e 100644
--- a/libsepol/src/policydb_validate.c
+++ b/libsepol/src/policydb_validate.c
@@ -1344,6 +1344,8 @@  bad:
 
 static int validate_scope_index(sepol_handle_t *handle, const scope_index_t *scope_index, validate_t flavors[])
 {
+	if (!ebitmap_is_empty(&scope_index->scope[SYM_COMMONS]))
+		goto bad;
 	if (validate_ebitmap(&scope_index->p_classes_scope, &flavors[SYM_CLASSES]))
 		goto bad;
 	if (validate_ebitmap(&scope_index->p_roles_scope, &flavors[SYM_ROLES]))