lkml.org 
[lkml]   [2003]   [Aug]   [14]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
Subject[PATCH] SELinux check behavior value
From
Date
This patch against 2.6.0-test3-bk fixes a bug in the SELinux module
by adding a check of the filesystem labeling behavior value
obtained from the policy.

security/selinux/hooks.c | 12 +++++++++---
security/selinux/ss/policydb.c | 2 ++
2 files changed, 11 insertions(+), 3 deletions(-)

Index: linux-2.6/security/selinux/ss/policydb.c
diff -u linux-2.6/security/selinux/ss/policydb.c:1.1.1.1 linux-2.6/security/selinux/ss/policydb.c:1.23
--- linux-2.6/security/selinux/ss/policydb.c:1.1.1.1 Tue Aug 12 09:05:06 2003
+++ linux-2.6/security/selinux/ss/policydb.c Wed Aug 13 09:57:03 2003
@@ -1301,6 +1301,8 @@
if (!buf)
goto bad;
c->v.behavior = le32_to_cpu(buf[0]);
+ if (c->v.behavior > SECURITY_FS_USE_NONE)
+ goto bad;
len = le32_to_cpu(buf[1]);
buf = next_entry(fp, len);
if (!buf)
Index: linux-2.6/security/selinux/hooks.c
diff -u linux-2.6/security/selinux/hooks.c:1.66 linux-2.6/security/selinux/hooks.c:1.67
--- linux-2.6/security/selinux/hooks.c:1.66 Thu Jul 17 07:33:31 2003
+++ linux-2.6/security/selinux/hooks.c Tue Aug 12 14:29:53 2003
@@ -313,9 +313,15 @@

sbsec->initialized = 1;

- printk(KERN_INFO "SELinux: initialized (dev %s, type %s), %s\n",
- sb->s_id, sb->s_type->name,
- labeling_behaviors[sbsec->behavior-1]);
+ if (sbsec->behavior > ARRAY_SIZE(labeling_behaviors)) {
+ printk(KERN_INFO "SELinux: initialized (dev %s, type %s), unknown behavior\n",
+ sb->s_id, sb->s_type->name);
+ }
+ else {
+ printk(KERN_INFO "SELinux: initialized (dev %s, type %s), %s\n",
+ sb->s_id, sb->s_type->name,
+ labeling_behaviors[sbsec->behavior-1]);
+ }

/* Initialize the root inode. */
rc = inode_doinit_with_dentry(sb->s_root->d_inode, sb->s_root);


--
Stephen Smalley <sds@epoch.ncsc.mil>
National Security Agency

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2005-03-22 13:47    [W:0.038 / U:4.644 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site