* [PATCH] label_file.h: actually use the results of compat_validate
@ 2016-11-18 21:58 Nick Kralevich
2016-11-21 14:27 ` Stephen Smalley
0 siblings, 1 reply; 2+ messages in thread
From: Nick Kralevich @ 2016-11-18 21:58 UTC (permalink / raw)
To: selinux
process_line called compat_validate, but never actually looked at the
return value. When an invalid entry is found, a warning is printed, but
since the upper layers of the code don't see the error, validation
appears to succeed.
Steps to reproduce on Android:
1) Edit system/sepolicy/private/file_contexts and create an entry with
an invalid label.
2) Recompile Android, which executes out/host/linux-x86/bin/checkfc to
check if file_contexts is valid.
Expected: Compile failure.
Actual: Compile succeeds with warnings.
Change-Id: I20fa18c7b11b5ffdd243c3274bedc4518431e1fb
---
libselinux/src/label_file.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/libselinux/src/label_file.h b/libselinux/src/label_file.h
index 00c0a5c..4ac64d5 100644
--- a/libselinux/src/label_file.h
+++ b/libselinux/src/label_file.h
@@ -467,7 +467,7 @@ static inline int process_line(struct selabel_handle *rec,
spec_hasMetaChars(&spec_arr[nspec]);
if (strcmp(context, "<<none>>") && rec->validating)
- compat_validate(rec, &spec_arr[nspec].lr, path, lineno);
+ return compat_validate(rec, &spec_arr[nspec].lr, path, lineno);
return 0;
}
--
2.8.0.rc3.226.g39d4020
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH] label_file.h: actually use the results of compat_validate
2016-11-18 21:58 [PATCH] label_file.h: actually use the results of compat_validate Nick Kralevich
@ 2016-11-21 14:27 ` Stephen Smalley
0 siblings, 0 replies; 2+ messages in thread
From: Stephen Smalley @ 2016-11-21 14:27 UTC (permalink / raw)
To: Nick Kralevich, selinux
On 11/18/2016 04:58 PM, Nick Kralevich wrote:
> process_line called compat_validate, but never actually looked at the
> return value. When an invalid entry is found, a warning is printed, but
> since the upper layers of the code don't see the error, validation
> appears to succeed.
>
> Steps to reproduce on Android:
>
> 1) Edit system/sepolicy/private/file_contexts and create an entry with
> an invalid label.
> 2) Recompile Android, which executes out/host/linux-x86/bin/checkfc to
> check if file_contexts is valid.
>
> Expected: Compile failure.
> Actual: Compile succeeds with warnings.
Thanks, applied.
>
> Change-Id: I20fa18c7b11b5ffdd243c3274bedc4518431e1fb
> ---
> libselinux/src/label_file.h | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/libselinux/src/label_file.h b/libselinux/src/label_file.h
> index 00c0a5c..4ac64d5 100644
> --- a/libselinux/src/label_file.h
> +++ b/libselinux/src/label_file.h
> @@ -467,7 +467,7 @@ static inline int process_line(struct selabel_handle *rec,
> spec_hasMetaChars(&spec_arr[nspec]);
>
> if (strcmp(context, "<<none>>") && rec->validating)
> - compat_validate(rec, &spec_arr[nspec].lr, path, lineno);
> + return compat_validate(rec, &spec_arr[nspec].lr, path, lineno);
>
> return 0;
> }
>
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2016-11-21 14:27 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2016-11-18 21:58 [PATCH] label_file.h: actually use the results of compat_validate Nick Kralevich
2016-11-21 14:27 ` Stephen Smalley
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.