From: "Christian Göttsche" <cgzones@googlemail.com>
To: selinux@vger.kernel.org
Subject: [PATCH 2/5] checkpolicy: clone level only once
Date: Mon, 11 Mar 2024 15:57:03 +0100 [thread overview]
Message-ID: <20240311145706.34885-2-cgzones@googlemail.com> (raw)
In-Reply-To: <20240311145706.34885-1-cgzones@googlemail.com>
In case of aliases clone the level only once to avoid leaking the fist
one.
Example policy:
class p sid h class p{d}sensitivity d alias s0;dominance{s0}level d;level s0;
Reported-by: oss-fuzz (issue #67308)
Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
---
checkpolicy/policy_define.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/checkpolicy/policy_define.c b/checkpolicy/policy_define.c
index 614b7706..0cf938ea 100644
--- a/checkpolicy/policy_define.c
+++ b/checkpolicy/policy_define.c
@@ -1038,7 +1038,7 @@ static int clone_level(hashtab_key_t key __attribute__ ((unused)), hashtab_datum
level_datum_t *levdatum = (level_datum_t *) datum;
mls_level_t *level = (mls_level_t *) arg, *newlevel;
- if (levdatum->level == level) {
+ if (levdatum->notdefined && levdatum->level == level) {
if (!levdatum->isalias) {
levdatum->notdefined = FALSE;
return 0;
--
2.43.0
next prev parent reply other threads:[~2024-03-11 14:57 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-03-11 14:57 [PATCH 1/5] checkpolicy/fuzz: drop redundant notdefined check Christian Göttsche
2024-03-11 14:57 ` Christian Göttsche [this message]
2024-03-11 14:57 ` [PATCH 3/5] checkpolicy: return YYerror on invalid character Christian Göttsche
2024-03-11 14:57 ` [PATCH 4/5] libsepol: reject MLS support in pre-MLS policies Christian Göttsche
2024-03-11 14:57 ` [PATCH 5/5] checkpolicy/fuzz: scan Xen policies Christian Göttsche
2024-03-14 13:19 ` [PATCH 1/5] checkpolicy/fuzz: drop redundant notdefined check James Carter
2024-03-20 20:05 ` James Carter
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20240311145706.34885-2-cgzones@googlemail.com \
--to=cgzones@googlemail.com \
--cc=selinux@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.