From patchwork Tue Mar 8 18:58:09 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: =?utf-8?q?Christian_G=C3=B6ttsche?= X-Patchwork-Id: 12774218 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 27BF1C433F5 for ; Tue, 8 Mar 2022 18:58:21 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1349119AbiCHS7Q (ORCPT ); Tue, 8 Mar 2022 13:59:16 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:37024 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S237719AbiCHS7Q (ORCPT ); Tue, 8 Mar 2022 13:59:16 -0500 Received: from mail-ej1-x62f.google.com (mail-ej1-x62f.google.com [IPv6:2a00:1450:4864:20::62f]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 14C53E0C4 for ; Tue, 8 Mar 2022 10:58:19 -0800 (PST) Received: by mail-ej1-x62f.google.com with SMTP id p15so41363145ejc.7 for ; Tue, 08 Mar 2022 10:58:19 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=googlemail.com; s=20210112; h=from:to:subject:date:message-id:mime-version :content-transfer-encoding; bh=GO179EgjLM05oz7aaodTSZQayy2QhT8H7jL0opjf51w=; b=X23jrLpsvEimr4DdbHJbE08LDdZWDkpWjr5JmaU2eFtx+QODLJ3+7cBCXVL30mqWmE v2Ha5oazv9HNFRx2inTvp/qp4fy9UcF693W1Cb5dHx3kEiXxgTy6D4e8Dtr73OQeoDXy q1FW7O3F5wtmnWZBufrQ/w4/dXmv+/zbXv94ohx2S5n0xcowBTNc0qSz42HgOyCQwN67 YQiMVWS54oauCwqa+MwZYhrRMuYuTKUVl5uQaveef4A2RCRX7GUCBrexIaBmnIXaerwS 99fZFXRDPLuBjtXVPNwynA4CGqgVnjOpr6OCyF9ELJLAeUmI4gKaRJaaaqjLSJaAoQVh F1uQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:from:to:subject:date:message-id:mime-version :content-transfer-encoding; bh=GO179EgjLM05oz7aaodTSZQayy2QhT8H7jL0opjf51w=; b=OJQjMwVt0KqecrFjQy8CsP3h94XbFNTtTMDM6VNxhHa6Rqx9BxaWDoq1WBOdDr4VsJ 5oi+amyiJo5N7NYRbdUwO+pdamsnRAtb5xk3LkaVsEVO9MdiNQqLonF4gfoZExEKxoYm GSkyHoHgQSh9e8o4i0RhobcJ3/q5xI/3OGBQ6yxQo3lloXfkoaxI3xQ4X1Vb2vQoC7SD Id8kIeNEhJxuGgTC5eHyO7jx29BTwLqP+NMpI96AJ/CnjKmZa/j5YNGQqpp7o483gQg1 M1isq7pQP7IB43TJHQj8rfhyPo8WqZXybNOrzlumJQENECR8gN6jfKl8lQLlG+FgJmZp 7Syg== X-Gm-Message-State: AOAM533n3ucVFsRjJ83/j9WUT6Kuuk8UK+IuuxzTfqiHwPUxcx3wcmVs BLdotLLZEd4wp+SHjSGkrVlfIwoEASPYkA== X-Google-Smtp-Source: ABdhPJzkPF9sWfLw9v/jwm2kqa2bdaVKRnPcX5GJsBSiYjUqSwii6BqYk75okOTFte7zpu1/CNdDVQ== X-Received: by 2002:a17:906:bc9b:b0:6da:9f90:a56a with SMTP id lv27-20020a170906bc9b00b006da9f90a56amr14814081ejb.575.1646765897473; Tue, 08 Mar 2022 10:58:17 -0800 (PST) Received: from debianHome.localdomain (dynamic-077-006-252-105.77.6.pool.telefonica.de. [77.6.252.105]) by smtp.gmail.com with ESMTPSA id s21-20020a170906961500b006daac87ddb0sm5408063ejx.140.2022.03.08.10.58.16 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 08 Mar 2022 10:58:17 -0800 (PST) From: =?utf-8?q?Christian_G=C3=B6ttsche?= To: selinux@vger.kernel.org Subject: [PATCH 1/2] libsepol: reject xperm av rules in conditional statements Date: Tue, 8 Mar 2022 19:58:09 +0100 Message-Id: <20220308185811.72407-1-cgzones@googlemail.com> X-Mailer: git-send-email 2.35.1 MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: selinux@vger.kernel.org Extended permission and neverallow rules are not permitted in conditional statements. This causes issues on policy optimization where avtab_search() might return a non extended permission rule when searching for one. Found by oss-fuzz (#45327) Signed-off-by: Christian Göttsche Acked-by: James Carter --- libsepol/src/policydb_validate.c | 28 +++++++++++++++++----------- 1 file changed, 17 insertions(+), 11 deletions(-) diff --git a/libsepol/src/policydb_validate.c b/libsepol/src/policydb_validate.c index 735c7a33..72063351 100644 --- a/libsepol/src/policydb_validate.c +++ b/libsepol/src/policydb_validate.c @@ -658,7 +658,7 @@ bad: * Functions to validate a kernel policydb */ -static int validate_avtab_key(avtab_key_t *key, validate_t flavors[]) +static int validate_avtab_key(avtab_key_t *key, int conditional, validate_t flavors[]) { if (validate_value(key->source_type, &flavors[SYM_TYPES])) goto bad; @@ -670,13 +670,16 @@ static int validate_avtab_key(avtab_key_t *key, validate_t flavors[]) case AVTAB_ALLOWED: case AVTAB_AUDITALLOW: case AVTAB_AUDITDENY: - case AVTAB_XPERMS_ALLOWED: - case AVTAB_XPERMS_AUDITALLOW: - case AVTAB_XPERMS_DONTAUDIT: case AVTAB_TRANSITION: case AVTAB_MEMBER: case AVTAB_CHANGE: break; + case AVTAB_XPERMS_ALLOWED: + case AVTAB_XPERMS_AUDITALLOW: + case AVTAB_XPERMS_DONTAUDIT: + if (conditional) + goto bad; + break; default: goto bad; } @@ -691,7 +694,7 @@ static int validate_avtab_key_and_datum(avtab_key_t *k, avtab_datum_t *d, void * { validate_t *flavors = (validate_t *)args; - if (validate_avtab_key(k, flavors)) + if (validate_avtab_key(k, 0, flavors)) return -1; if ((k->specified & AVTAB_TYPE) && validate_value(d->data, &flavors[SYM_TYPES])) @@ -716,7 +719,7 @@ static int validate_cond_av_list(sepol_handle_t *handle, cond_av_list_t *cond_av for (; cond_av; cond_av = cond_av->next) { for (avtab_ptr = cond_av->node; avtab_ptr; avtab_ptr = avtab_ptr->next) { - if (validate_avtab_key(&avtab_ptr->key, flavors)) { + if (validate_avtab_key(&avtab_ptr->key, 1, flavors)) { ERR(handle, "Invalid cond av list"); return -1; } @@ -726,7 +729,7 @@ static int validate_cond_av_list(sepol_handle_t *handle, cond_av_list_t *cond_av return 0; } -static int validate_avrules(sepol_handle_t *handle, avrule_t *avrule, validate_t flavors[]) +static int validate_avrules(sepol_handle_t *handle, avrule_t *avrule, int conditional, validate_t flavors[]) { class_perm_node_t *class; @@ -746,14 +749,17 @@ static int validate_avrules(sepol_handle_t *handle, avrule_t *avrule, validate_t case AVRULE_AUDITALLOW: case AVRULE_AUDITDENY: case AVRULE_DONTAUDIT: - case AVRULE_NEVERALLOW: case AVRULE_TRANSITION: case AVRULE_MEMBER: case AVRULE_CHANGE: + break; + case AVRULE_NEVERALLOW: case AVRULE_XPERMS_ALLOWED: case AVRULE_XPERMS_AUDITALLOW: case AVRULE_XPERMS_DONTAUDIT: case AVRULE_XPERMS_NEVERALLOW: + if (conditional) + goto bad; break; default: goto bad; @@ -814,9 +820,9 @@ static int validate_cond_list(sepol_handle_t *handle, cond_list_t *cond, validat goto bad; if (validate_cond_av_list(handle, cond->false_list, flavors)) goto bad; - if (validate_avrules(handle, cond->avtrue_list, flavors)) + if (validate_avrules(handle, cond->avtrue_list, 1, flavors)) goto bad; - if (validate_avrules(handle, cond->avfalse_list, flavors)) + if (validate_avrules(handle, cond->avfalse_list, 1, flavors)) goto bad; if (validate_bool_id_array(handle, cond->bool_ids, cond->nbools, &flavors[SYM_BOOLS])) goto bad; @@ -1098,7 +1104,7 @@ static int validate_avrule_blocks(sepol_handle_t *handle, avrule_block_t *avrule for (decl = avrule_block->branch_list; decl != NULL; decl = decl->next) { if (validate_cond_list(handle, decl->cond_list, flavors)) goto bad; - if (validate_avrules(handle, decl->avrules, flavors)) + if (validate_avrules(handle, decl->avrules, 0, flavors)) goto bad; if (validate_role_trans_rules(handle, decl->role_tr_rules, flavors)) goto bad; From patchwork Tue Mar 8 18:58:10 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: =?utf-8?q?Christian_G=C3=B6ttsche?= X-Patchwork-Id: 12774219 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id DB973C433EF for ; Tue, 8 Mar 2022 18:58:21 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S237719AbiCHS7R (ORCPT ); Tue, 8 Mar 2022 13:59:17 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:37038 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1348996AbiCHS7Q (ORCPT ); Tue, 8 Mar 2022 13:59:16 -0500 Received: from mail-ej1-x62c.google.com (mail-ej1-x62c.google.com [IPv6:2a00:1450:4864:20::62c]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id B333A192B2 for ; Tue, 8 Mar 2022 10:58:19 -0800 (PST) Received: by mail-ej1-x62c.google.com with SMTP id qx21so41315184ejb.13 for ; Tue, 08 Mar 2022 10:58:19 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=googlemail.com; s=20210112; h=from:to:subject:date:message-id:in-reply-to:references:mime-version :content-transfer-encoding; bh=UsPowHRXWPrbqiMfxZGq34vKdDRvvQve4Vrpaw10rlM=; b=Q3pwNTIdkMBRgCZUWuL8uHSMHU5pQiyk5bmUEy/zD6DMEoEjGF33JqT7eubmm2z0YT SW4ROyCZMSqoi3sNS40MlXc4oaVZibVkerQOjRoWBDgZMlAtLMJsC+wPdsEEOPqriIzS 4z+HVVUj+57f09/pgCMB8BBSD/uEbhIeLuIPVNoZ3Pug4hVLPpMzxansCOGeTO0kGfWN qYev77WdcDrEcTPdJW7uw+W74fcLqy6rSca9E2Nx1uQ27Wjsvnl/2KvA7HPaaCKoHW3n 0ajziEX8zdxNRIfpSw5r2ZouHSuWibV9q2bwrkBAXeh6AymhBpM4BVGNQDH4oOq7Amz4 MLBw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:from:to:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=UsPowHRXWPrbqiMfxZGq34vKdDRvvQve4Vrpaw10rlM=; b=mZoBFm2DhodUiHyk7IMRPZhKUz7lWFQ7pczF2/NxURxwv64nIZo1U5p2lMt2FiQH4q NZfyFdHI82Kuv604AsI/CXovFTqBfIDooQdPn9XHjXVgWo/XorfXGvbBojIQvFPqQ3P8 EX+/qpxjLhDNweil7stGtjypbpxivSZ63yKSWe+hywein8kVzERb01YFJjUuREwaZcqd 8OWDwH0a8FuoRD+78XJuc1EK8bW6Di7kR9o/z+cCoaymRtHBlVhIGYVfWh1zlWkNqQjh QEsLzWwsmJSkNfr/ZNLOMumFCfGwcjSvBtaqNCZjE08Fgw9DGCg0ymxBz240HCyZjHG6 LTpg== X-Gm-Message-State: AOAM532eEw8RgfOlBvo9H2oTSYL/xY+LQt7dhC2KnqWQdA2M2XMVx0zJ PkKnrTqhCsn6Xyt2Vxo8BDyFF5vsb1g31g== X-Google-Smtp-Source: ABdhPJyB7Pi5eGyznrcIcvg03thTTwXmB7Th7G9EzvB6TGBuACshjIqnKN71MkKOZXndmZLqIiI35g== X-Received: by 2002:a17:907:72c5:b0:6da:e99e:226c with SMTP id du5-20020a17090772c500b006dae99e226cmr14915580ejc.515.1646765898184; Tue, 08 Mar 2022 10:58:18 -0800 (PST) Received: from debianHome.localdomain (dynamic-077-006-252-105.77.6.pool.telefonica.de. [77.6.252.105]) by smtp.gmail.com with ESMTPSA id s21-20020a170906961500b006daac87ddb0sm5408063ejx.140.2022.03.08.10.58.17 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 08 Mar 2022 10:58:17 -0800 (PST) From: =?utf-8?q?Christian_G=C3=B6ttsche?= To: selinux@vger.kernel.org Subject: [PATCH 2/2] libsepol: validate boolean datum arrays Date: Tue, 8 Mar 2022 19:58:10 +0100 Message-Id: <20220308185811.72407-2-cgzones@googlemail.com> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220308185811.72407-1-cgzones@googlemail.com> References: <20220308185811.72407-1-cgzones@googlemail.com> MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: selinux@vger.kernel.org Validate the boolean entries in the policy. Signed-off-by: Christian Göttsche --- libsepol/src/policydb_validate.c | 43 ++++++++++++++++++++++++++++++++ 1 file changed, 43 insertions(+) diff --git a/libsepol/src/policydb_validate.c b/libsepol/src/policydb_validate.c index 72063351..b51dd366 100644 --- a/libsepol/src/policydb_validate.c +++ b/libsepol/src/policydb_validate.c @@ -577,6 +577,41 @@ static int validate_user_datum_wrapper(__attribute__((unused)) hashtab_key_t k, return validate_user_datum(margs->handle, d, margs->flavors, margs->mls); } +static int validate_bool_datum(sepol_handle_t *handle, cond_bool_datum_t *boolean, validate_t flavors[]) +{ + if (validate_value(boolean->s.value, &flavors[SYM_BOOLS])) + goto bad; + + switch (boolean->state) { + case 0: + case 1: + break; + default: + goto bad; + } + + switch (boolean->flags) { + case 0: + case COND_BOOL_FLAGS_TUNABLE: + break; + default: + goto bad; + } + + return 0; + +bad: + ERR(handle, "Invalid bool datum"); + return -1; +} + +static int validate_bool_datum_wrapper(__attribute__((unused)) hashtab_key_t k, hashtab_datum_t d, void *args) +{ + map_arg_t *margs = args; + + return validate_bool_datum(margs->handle, d, margs->flavors); +} + static int validate_datum_array_gaps(sepol_handle_t *handle, policydb_t *p, validate_t flavors[]) { unsigned int i; @@ -607,6 +642,11 @@ static int validate_datum_array_gaps(sepol_handle_t *handle, policydb_t *p, vali goto bad; } + for (i = 0; i < p->p_bools.nprim; i++) { + if (bool_xnor(p->bool_val_to_struct[i], ebitmap_get_bit(&flavors[SYM_BOOLS].gaps, i))) + goto bad; + } + return 0; bad: @@ -647,6 +687,9 @@ static int validate_datum_array_entries(sepol_handle_t *handle, policydb_t *p, v if (hashtab_map(p->p_cats.table, validate_datum, &flavors[SYM_CATS])) goto bad; + if (hashtab_map(p->p_bools.table, validate_bool_datum_wrapper, &margs)) + goto bad; + return 0; bad: