Re: [PATCH] libsepol/cil: fix mlsconstrain segfault

[William Roberts <bill.c.roberts@gmail.com>]

ack and staged: https://github.com/SELinuxProject/selinux/pull/164

On Mon, Jun 17, 2019 at 8:16 AM <mike.palmiotto@crunchydata.com> wrote:
>
> From: Mike Palmiotto <mike.palmiotto@crunchydata.com>
>
> Installing a cil module with invalid mlsconstrain syntax currently
> results in a segfault. In the following module, the right-hand side of
> the second operand of the OR is a list (mlstrustedobject):
>
> $ cat test.cil
> (class test (foo) )
> (classorder (unordered test))
>
> (mlsconstrain (test (foo))
>         (or
>                 (dom h1 h2)
>                 (eq t2 (mlstrustedobject))
>         )
> )
>
> $ sudo semodule -i test.cil
> zsh: segmentation fault  sudo semodule -i test.cil
>
> This syntax is invalid and should error accordingly, rather than
> segfaulting. This patch provides this syntax error for the same module:
>
> $ sudo semodule -i test.cil
> t1, t2, r1, r2, u1, u2 cannot be used on the left side with a list on the right side
> Bad expression tree for constraint
> Bad constrain declaration at /var/lib/selinux/mls/tmp/modules/400/test/cil:4
> semodule:  Failed!
>
> Signed-off-by: Mike Palmiotto <mike.palmiotto@crunchydata.com>
> ---
>  libsepol/cil/src/cil_verify.c | 3 +++
>  1 file changed, 3 insertions(+)
>
> diff --git a/libsepol/cil/src/cil_verify.c b/libsepol/cil/src/cil_verify.c
> index 1036d73c..346fbac9 100644
> --- a/libsepol/cil/src/cil_verify.c
> +++ b/libsepol/cil/src/cil_verify.c
> @@ -225,6 +225,9 @@ int cil_verify_constraint_leaf_expr_syntax(enum cil_flavor l_flavor, enum cil_fl
>                                 cil_log(CIL_ERR, "u3, r3, and t3 can only be used with mlsvalidatetrans rules\n");
>                                 goto exit;
>                         }
> +               } else if (r_flavor == CIL_LIST) {
> +                       cil_log(CIL_ERR, "t1, t2, r1, r2, u1, u2 cannot be used on the left side with a list on the right side\n");
> +                       goto exit;
>                 }
>         } else {
>                 if (r_flavor == CIL_CONS_U2) {
> --
> 2.21.0
>