* [PATCH] netlabel: fix export of SELinux categories > 127
@ 2010-02-24 16:52 Joshua Roys
2010-02-24 23:52 ` Paul Moore
0 siblings, 1 reply; 4+ messages in thread
From: Joshua Roys @ 2010-02-24 16:52 UTC (permalink / raw)
To: selinux; +Cc: Joshua Roys
This fixes corrupted CIPSO packets when SELinux categories greater
than 127 are used. The bug occured on the second (and later) loops
through the while; the inner for loop through the ebitmap->maps array
used the same index as the NetLabel catmap->bitmap array, even though
the NetLabel bitmap is twice as long as the SELinux bitmap.
Signed-off-by: Joshua Roys <joshua.roys@gtri.gatech.edu>
---
security/selinux/ss/ebitmap.c | 2 +-
1 files changed, 1 insertions(+), 1 deletions(-)
diff --git a/security/selinux/ss/ebitmap.c b/security/selinux/ss/ebitmap.c
index 68c7348..04b6145 100644
--- a/security/selinux/ss/ebitmap.c
+++ b/security/selinux/ss/ebitmap.c
@@ -128,7 +128,7 @@ int ebitmap_netlbl_export(struct ebitmap *ebmap,
cmap_idx = delta / NETLBL_CATMAP_MAPSIZE;
cmap_sft = delta % NETLBL_CATMAP_MAPSIZE;
c_iter->bitmap[cmap_idx]
- |= e_iter->maps[cmap_idx] << cmap_sft;
+ |= e_iter->maps[i] << cmap_sft;
}
e_iter = e_iter->next;
}
--
1.6.5.2
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [PATCH] netlabel: fix export of SELinux categories > 127
2010-02-24 16:52 [PATCH] netlabel: fix export of SELinux categories > 127 Joshua Roys
@ 2010-02-24 23:52 ` Paul Moore
2010-02-26 18:08 ` Joshua Roys
0 siblings, 1 reply; 4+ messages in thread
From: Paul Moore @ 2010-02-24 23:52 UTC (permalink / raw)
To: Joshua Roys; +Cc: selinux
On Wednesday 24 February 2010 11:52:37 am Joshua Roys wrote:
> This fixes corrupted CIPSO packets when SELinux categories greater
> than 127 are used. The bug occured on the second (and later) loops
> through the while; the inner for loop through the ebitmap->maps array
> used the same index as the NetLabel catmap->bitmap array, even though
> the NetLabel bitmap is twice as long as the SELinux bitmap.
>
> Signed-off-by: Joshua Roys <joshua.roys@gtri.gatech.edu>
Ha! I came to the same conclusion and sent you a similar patch a few hours
ago (should have checked my SELinux email folder first it seems).
Acked-by: Paul Moore <paul.moore@hp.com>
This should also be sent to stable - James or Josh do one of you guys want to
do that?
> ---
> security/selinux/ss/ebitmap.c | 2 +-
> 1 files changed, 1 insertions(+), 1 deletions(-)
>
> diff --git a/security/selinux/ss/ebitmap.c b/security/selinux/ss/ebitmap.c
> index 68c7348..04b6145 100644
> --- a/security/selinux/ss/ebitmap.c
> +++ b/security/selinux/ss/ebitmap.c
> @@ -128,7 +128,7 @@ int ebitmap_netlbl_export(struct ebitmap *ebmap,
> cmap_idx = delta / NETLBL_CATMAP_MAPSIZE;
> cmap_sft = delta % NETLBL_CATMAP_MAPSIZE;
> c_iter->bitmap[cmap_idx]
> - |= e_iter->maps[cmap_idx] << cmap_sft;
> + |= e_iter->maps[i] << cmap_sft;
> }
> e_iter = e_iter->next;
> }
--
paul moore
linux @ hp
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH] netlabel: fix export of SELinux categories > 127
2010-02-24 23:52 ` Paul Moore
@ 2010-02-26 18:08 ` Joshua Roys
2010-03-01 1:01 ` Paul Moore
0 siblings, 1 reply; 4+ messages in thread
From: Joshua Roys @ 2010-02-26 18:08 UTC (permalink / raw)
To: Paul Moore; +Cc: selinux
[-- Attachment #1: Type: text/plain, Size: 979 bytes --]
On 02/24/2010 06:52 PM, Paul Moore wrote:
> On Wednesday 24 February 2010 11:52:37 am Joshua Roys wrote:
>> This fixes corrupted CIPSO packets when SELinux categories greater
>> than 127 are used. The bug occured on the second (and later) loops
>> through the while; the inner for loop through the ebitmap->maps array
>> used the same index as the NetLabel catmap->bitmap array, even though
>> the NetLabel bitmap is twice as long as the SELinux bitmap.
>>
>> Signed-off-by: Joshua Roys<joshua.roys@gtri.gatech.edu>
>
> Ha! I came to the same conclusion and sent you a similar patch a few hours
> ago (should have checked my SELinux email folder first it seems).
>
> Acked-by: Paul Moore<paul.moore@hp.com>
>
> This should also be sent to stable - James or Josh do one of you guys want to
> do that?
>
Cool! I'm glad we came to the same solution, although next time I'll CC
you directly to avoid doing duplicate work.
Thanks for your help,
Josh
[-- Attachment #2: S/MIME Cryptographic Signature --]
[-- Type: application/pkcs7-signature, Size: 2719 bytes --]
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH] netlabel: fix export of SELinux categories > 127
2010-02-26 18:08 ` Joshua Roys
@ 2010-03-01 1:01 ` Paul Moore
0 siblings, 0 replies; 4+ messages in thread
From: Paul Moore @ 2010-03-01 1:01 UTC (permalink / raw)
To: Joshua Roys; +Cc: selinux
On Friday 26 February 2010 01:08:03 pm Joshua Roys wrote:
> On 02/24/2010 06:52 PM, Paul Moore wrote:
> > On Wednesday 24 February 2010 11:52:37 am Joshua Roys wrote:
> >> This fixes corrupted CIPSO packets when SELinux categories greater
> >> than 127 are used. The bug occured on the second (and later) loops
> >> through the while; the inner for loop through the ebitmap->maps array
> >> used the same index as the NetLabel catmap->bitmap array, even though
> >> the NetLabel bitmap is twice as long as the SELinux bitmap.
> >>
> >> Signed-off-by: Joshua Roys<joshua.roys@gtri.gatech.edu>
> >
> > Ha! I came to the same conclusion and sent you a similar patch a few
> > hours ago (should have checked my SELinux email folder first it seems).
> >
> > Acked-by: Paul Moore<paul.moore@hp.com>
> >
> > This should also be sent to stable - James or Josh do one of you guys
> > want to do that?
>
> Cool! I'm glad we came to the same solution, although next time I'll CC
> you directly to avoid doing duplicate work.
Okay, no problem either way - the important part is that the problem is now
fixed.
> Thanks for your help,
Thanks to you as well, it's always nice to see others get involved.
--
paul moore
linux @ hp
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2010-03-01 1:01 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2010-02-24 16:52 [PATCH] netlabel: fix export of SELinux categories > 127 Joshua Roys
2010-02-24 23:52 ` Paul Moore
2010-02-26 18:08 ` Joshua Roys
2010-03-01 1:01 ` Paul Moore
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.