[PATCH] selinux: fix non-MLS handling in mls_context_to_sid()

[PATCH] selinux: fix non-MLS handling in mls_context_to_sid()

[Paul Moore]

Commit 95ffe194204a ("selinux: refactor mls_context_to_sid() and make
it stricter") inadvertently changed how we handle labels that did not
contain MLS information.  This patch restores the proper behavior in
mls_context_to_sid() and adds a comment explaining the proper
behavior to help ensure this doesn't happen again.

Fixes: 95ffe194204a ("selinux: refactor mls_context_to_sid() and make it stricter")
Reported-by: Stephen Smalley <sds@tycho.nsa.gov>
Signed-off-by: Paul Moore <paul@paul-moore.com>
---
 security/selinux/ss/mls.c |   10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/security/selinux/ss/mls.c b/security/selinux/ss/mls.c
index 2fe459df3c85..b7efa2296969 100644
--- a/security/selinux/ss/mls.c
+++ b/security/selinux/ss/mls.c
@@ -245,9 +245,13 @@ int mls_context_to_sid(struct policydb *pol,
 	char *rangep[2];
 
 	if (!pol->mls_enabled) {
-		if ((def_sid != SECSID_NULL && oldc) || (*scontext) == '\0')
-			return 0;
-		return -EINVAL;
+		/*
+		 * With no MLS, only return -EINVAL if there is a MLS field
+		 * and it did not come from an xattr.
+		 */
+		if (oldc && def_sid == SECSID_NULL)
+			return -EINVAL;
+		return 0;
 	}
 
 	/*

Re: [PATCH] selinux: fix non-MLS handling in mls_context_to_sid()

[Paul Moore]

On Wed, Nov 14, 2018 at 2:47 PM Paul Moore <paul@paul-moore.com> wrote:
> Commit 95ffe194204a ("selinux: refactor mls_context_to_sid() and make
> it stricter") inadvertently changed how we handle labels that did not
> contain MLS information.  This patch restores the proper behavior in
> mls_context_to_sid() and adds a comment explaining the proper
> behavior to help ensure this doesn't happen again.
>
> Fixes: 95ffe194204a ("selinux: refactor mls_context_to_sid() and make it stricter")
> Reported-by: Stephen Smalley <sds@tycho.nsa.gov>
> Signed-off-by: Paul Moore <paul@paul-moore.com>
> ---
>  security/selinux/ss/mls.c |   10 +++++++---
>  1 file changed, 7 insertions(+), 3 deletions(-)

Building a test kernel now, assuming all goes well I'll merge this
into selinux/stable-4.20 and send it to Linus this week.

> diff --git a/security/selinux/ss/mls.c b/security/selinux/ss/mls.c
> index 2fe459df3c85..b7efa2296969 100644
> --- a/security/selinux/ss/mls.c
> +++ b/security/selinux/ss/mls.c
> @@ -245,9 +245,13 @@ int mls_context_to_sid(struct policydb *pol,
>         char *rangep[2];
>
>         if (!pol->mls_enabled) {
> -               if ((def_sid != SECSID_NULL && oldc) || (*scontext) == '\0')
> -                       return 0;
> -               return -EINVAL;
> +               /*
> +                * With no MLS, only return -EINVAL if there is a MLS field
> +                * and it did not come from an xattr.
> +                */
> +               if (oldc && def_sid == SECSID_NULL)
> +                       return -EINVAL;
> +               return 0;
>         }
>
>         /*
>


-- 
paul moore
www.paul-moore.com