[lkml]   [2008]   [Jul]   [7]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
    Patch in this message
    Subject[PATCH 13/20] SELinux: fix off by 1 reference of class_to_string in context_struct_compute_av
    From: Eric Paris <>

    The class_to_string array is referenced by tclass. My code mistakenly
    was using tclass - 1. If the proceeding class is a userspace class
    rather than kernel class this may cause a denial/EINVAL even if unknown
    handling is set to allow. The bug shouldn't be allowing excess
    privileges since those are given based on the contents of another array
    which should be correctly referenced.

    At this point in time its pretty unlikely this is going to cause
    problems. The most recently added kernel classes which could be
    affected are association, dccp_socket, and peer. Its pretty unlikely
    any policy with handle_unknown=allow doesn't have association and
    dccp_socket undefined (they've been around longer than unknown handling)
    and peer is conditionalized on a policy cap which should only be defined
    if that class exists in policy.

    Signed-off-by: Eric Paris <>
    Acked-by: Stephen Smalley <>
    Signed-off-by: James Morris <>
    security/selinux/ss/services.c | 2 +-
    1 files changed, 1 insertions(+), 1 deletions(-)

    diff --git a/security/selinux/ss/services.c b/security/selinux/ss/services.c
    index d06df33..f26a8ca 100644
    --- a/security/selinux/ss/services.c
    +++ b/security/selinux/ss/services.c
    @@ -325,7 +325,7 @@ static int context_struct_compute_av(struct context *scontext,
    goto inval_class;
    if (unlikely(tclass > policydb.p_classes.nprim))
    if (tclass > kdefs->cts_len ||
    - !kdefs->class_to_string[tclass - 1] ||
    + !kdefs->class_to_string[tclass] ||
    goto inval_class;


     \ /
      Last update: 2008-07-07 18:55    [W:0.019 / U:8.280 seconds]
    ©2003-2017 Jasper Spaans. hosted at Digital OceanAdvertise on this site