* [PATCH] selinux: skip bounded transition processing if the policy isn't loaded
@ 2017-12-06 16:02 Paul Moore
2017-12-06 23:51 ` James Morris
0 siblings, 1 reply; 3+ messages in thread
From: Paul Moore @ 2017-12-06 16:02 UTC (permalink / raw)
To: selinux, sds
From: Paul Moore <paul@paul-moore.com>
We can't do anything reasonable in security_bounded_transition() if we
don't have a policy loaded, and in fact we could run into problems
with some of the code inside expecting a policy. Fix these problems
like we do many others in security/selinux/ss/services.c by checking
to see if the policy is loaded (ss_initialized) and returning quickly
if it isn't.
Reported-by: syzbot <syzkaller-bugs@googlegroups.com>
Signed-off-by: Paul Moore <paul@paul-moore.com>
Acked-by: Stephen Smalley <sds@tycho.nsa.gov>
---
security/selinux/ss/services.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/security/selinux/ss/services.c b/security/selinux/ss/services.c
index d05496deb229..8900ea5cbabf 100644
--- a/security/selinux/ss/services.c
+++ b/security/selinux/ss/services.c
@@ -867,6 +867,9 @@ int security_bounded_transition(u32 old_sid, u32 new_sid)
int index;
int rc;
+ if (!ss_initialized)
+ return 0;
+
read_lock(&policy_rwlock);
rc = -EINVAL;
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH] selinux: skip bounded transition processing if the policy isn't loaded
2017-12-06 16:02 [PATCH] selinux: skip bounded transition processing if the policy isn't loaded Paul Moore
@ 2017-12-06 23:51 ` James Morris
2017-12-07 16:01 ` Paul Moore
0 siblings, 1 reply; 3+ messages in thread
From: James Morris @ 2017-12-06 23:51 UTC (permalink / raw)
To: Paul Moore; +Cc: selinux, sds
On Wed, 6 Dec 2017, Paul Moore wrote:
> From: Paul Moore <paul@paul-moore.com>
>
> We can't do anything reasonable in security_bounded_transition() if we
> don't have a policy loaded, and in fact we could run into problems
> with some of the code inside expecting a policy. Fix these problems
> like we do many others in security/selinux/ss/services.c by checking
> to see if the policy is loaded (ss_initialized) and returning quickly
> if it isn't.
>
> Reported-by: syzbot <syzkaller-bugs@googlegroups.com>
> Signed-off-by: Paul Moore <paul@paul-moore.com>
> Acked-by: Stephen Smalley <sds@tycho.nsa.gov>
Reviewed-by: James Morris <james.l.morris@oracle.com>
--
James Morris
<james.l.morris@oracle.com>
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH] selinux: skip bounded transition processing if the policy isn't loaded
2017-12-06 23:51 ` James Morris
@ 2017-12-07 16:01 ` Paul Moore
0 siblings, 0 replies; 3+ messages in thread
From: Paul Moore @ 2017-12-07 16:01 UTC (permalink / raw)
To: James Morris; +Cc: Paul Moore, Stephen Smalley, selinux
On Wed, Dec 6, 2017 at 6:51 PM, James Morris <james.l.morris@oracle.com> wrote:
> On Wed, 6 Dec 2017, Paul Moore wrote:
>
>> From: Paul Moore <paul@paul-moore.com>
>>
>> We can't do anything reasonable in security_bounded_transition() if we
>> don't have a policy loaded, and in fact we could run into problems
>> with some of the code inside expecting a policy. Fix these problems
>> like we do many others in security/selinux/ss/services.c by checking
>> to see if the policy is loaded (ss_initialized) and returning quickly
>> if it isn't.
>>
>> Reported-by: syzbot <syzkaller-bugs@googlegroups.com>
>> Signed-off-by: Paul Moore <paul@paul-moore.com>
>> Acked-by: Stephen Smalley <sds@tycho.nsa.gov>
>
>
> Reviewed-by: James Morris <james.l.morris@oracle.com>
Thanks. I just merged the patch to selinux/next.
--
paul moore
www.paul-moore.com
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2017-12-07 16:10 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2017-12-06 16:02 [PATCH] selinux: skip bounded transition processing if the policy isn't loaded Paul Moore
2017-12-06 23:51 ` James Morris
2017-12-07 16:01 ` Paul Moore
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.