* [PATCH 1/5] libsepol: validate some object contexts
@ 2023-05-12 9:29 Christian Göttsche
2023-05-12 9:29 ` [PATCH 2/5] libsepol: validate old style range trans classes Christian Göttsche
` (4 more replies)
0 siblings, 5 replies; 7+ messages in thread
From: Christian Göttsche @ 2023-05-12 9:29 UTC (permalink / raw)
To: selinux
Ensure various object context entries have a name, since they are
duplicated via strdup(3), and the order for ports and memory regions is
valid.
Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
---
libsepol/src/policydb_validate.c | 30 ++++++++++++++++++++++++++++++
1 file changed, 30 insertions(+)
diff --git a/libsepol/src/policydb_validate.c b/libsepol/src/policydb_validate.c
index 301aa200..e0d290ff 100644
--- a/libsepol/src/policydb_validate.c
+++ b/libsepol/src/policydb_validate.c
@@ -1149,6 +1149,8 @@ static int validate_ocontexts(sepol_handle_t *handle, const policydb_t *p, valid
case OCON_NETIF:
if (validate_context(&octx->context[1], flavors, p->mls))
goto bad;
+ if (!octx->u.name)
+ goto bad;
break;
case OCON_PORT:
if (octx->u.port.low_port > octx->u.port.high_port)
@@ -1163,6 +1165,34 @@ static int validate_ocontexts(sepol_handle_t *handle, const policydb_t *p, valid
default:
goto bad;
}
+ if (!octx->u.name)
+ goto bad;
+ break;
+ case OCON_IBPKEY:
+ if (octx->u.ibpkey.low_pkey > octx->u.ibpkey.high_pkey)
+ goto bad;
+ break;
+ case OCON_IBENDPORT:
+ if (!octx->u.ibendport.dev_name)
+ goto bad;
+ break;
+ }
+ } else if (p->target_platform == SEPOL_TARGET_XEN) {
+ switch(i) {
+ case OCON_XEN_IOPORT:
+ if (octx->u.ioport.low_ioport > octx->u.ioport.high_ioport)
+ goto bad;
+ break;
+ case OCON_XEN_IOMEM:
+ if (octx->u.iomem.low_iomem > octx->u.iomem.high_iomem)
+ goto bad;
+ if (p->policyvers < POLICYDB_VERSION_XEN_DEVICETREE && octx->u.iomem.high_iomem > 0xFFFFFFFFULL)
+ goto bad;
+ break;
+ case OCON_XEN_DEVICETREE:
+ if (!octx->u.name)
+ goto bad;
+ break;
}
}
}
--
2.40.1
^ permalink raw reply related [flat|nested] 7+ messages in thread
* [PATCH 2/5] libsepol: validate old style range trans classes
2023-05-12 9:29 [PATCH 1/5] libsepol: validate some object contexts Christian Göttsche
@ 2023-05-12 9:29 ` Christian Göttsche
2023-05-12 9:29 ` [PATCH 3/5] libsepol: validate: check low category is not bigger than high Christian Göttsche
` (3 subsequent siblings)
4 siblings, 0 replies; 7+ messages in thread
From: Christian Göttsche @ 2023-05-12 9:29 UTC (permalink / raw)
To: selinux
For old style range transition rules the class defaults to process.
However the policy might not declare the process class leading to
setting a wrong bit later on via:
if (ebitmap_set_bit(&rtr->tclasses, rt->target_class - 1, 1))
UBSAN report:
policydb.c:3684:56: runtime error: unsigned integer overflow: 0 - 1 cannot be represented in type 'uint32_t' (aka 'unsigned int')
Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
---
libsepol/src/policydb.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/libsepol/src/policydb.c b/libsepol/src/policydb.c
index b79c19b9..605d290a 100644
--- a/libsepol/src/policydb.c
+++ b/libsepol/src/policydb.c
@@ -3650,10 +3650,10 @@ static int range_read(policydb_t * p, struct policy_file *fp)
if (rc < 0)
goto err;
rt->target_class = le32_to_cpu(buf[0]);
- if (!value_isvalid(rt->target_class, p->p_classes.nprim))
- goto err;
} else
rt->target_class = p->process_class;
+ if (!value_isvalid(rt->target_class, p->p_classes.nprim))
+ goto err;
r = calloc(1, sizeof(*r));
if (!r)
goto err;
--
2.40.1
^ permalink raw reply related [flat|nested] 7+ messages in thread
* [PATCH 3/5] libsepol: validate: check low category is not bigger than high
2023-05-12 9:29 [PATCH 1/5] libsepol: validate some object contexts Christian Göttsche
2023-05-12 9:29 ` [PATCH 2/5] libsepol: validate old style range trans classes Christian Göttsche
@ 2023-05-12 9:29 ` Christian Göttsche
2023-05-12 9:30 ` [PATCH 4/5] libsepol: validate: reject XEN policy with xperm rules Christian Göttsche
` (2 subsequent siblings)
4 siblings, 0 replies; 7+ messages in thread
From: Christian Göttsche @ 2023-05-12 9:29 UTC (permalink / raw)
To: selinux
Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
---
libsepol/src/policydb_validate.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/libsepol/src/policydb_validate.c b/libsepol/src/policydb_validate.c
index e0d290ff..b34f83ec 100644
--- a/libsepol/src/policydb_validate.c
+++ b/libsepol/src/policydb_validate.c
@@ -545,6 +545,8 @@ static int validate_mls_semantic_cat(const mls_semantic_cat_t *cat, const valida
goto bad;
if (validate_value(cat->high, cats))
goto bad;
+ if (cat->low > cat->high)
+ goto bad;
}
return 0;
--
2.40.1
^ permalink raw reply related [flat|nested] 7+ messages in thread
* [PATCH 4/5] libsepol: validate: reject XEN policy with xperm rules
2023-05-12 9:29 [PATCH 1/5] libsepol: validate some object contexts Christian Göttsche
2023-05-12 9:29 ` [PATCH 2/5] libsepol: validate old style range trans classes Christian Göttsche
2023-05-12 9:29 ` [PATCH 3/5] libsepol: validate: check low category is not bigger than high Christian Göttsche
@ 2023-05-12 9:30 ` Christian Göttsche
2023-05-12 9:30 ` [PATCH 5/5] libsepol: expand: skip invalid cat Christian Göttsche
2023-05-25 20:36 ` [PATCH 1/5] libsepol: validate some object contexts James Carter
4 siblings, 0 replies; 7+ messages in thread
From: Christian Göttsche @ 2023-05-12 9:30 UTC (permalink / raw)
To: selinux
XEN policies with extended permissions are not supported, e.g. writing
them will fail (see write.c:avrule_write()).
Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
---
libsepol/src/policydb_validate.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/libsepol/src/policydb_validate.c b/libsepol/src/policydb_validate.c
index b34f83ec..3540f34a 100644
--- a/libsepol/src/policydb_validate.c
+++ b/libsepol/src/policydb_validate.c
@@ -799,6 +799,8 @@ static int validate_avtab_key(const avtab_key_t *key, int conditional, const pol
case AVTAB_XPERMS_ALLOWED:
case AVTAB_XPERMS_AUDITALLOW:
case AVTAB_XPERMS_DONTAUDIT:
+ if (p->target_platform != SEPOL_TARGET_SELINUX)
+ goto bad;
if (conditional)
goto bad;
break;
@@ -910,6 +912,8 @@ static int validate_avrules(sepol_handle_t *handle, const avrule_t *avrule, int
}
if (avrule->specified & AVRULE_XPERMS) {
+ if (p->target_platform != SEPOL_TARGET_SELINUX)
+ goto bad;
if (!avrule->xperms)
goto bad;
switch (avrule->xperms->specified) {
--
2.40.1
^ permalink raw reply related [flat|nested] 7+ messages in thread
* [PATCH 5/5] libsepol: expand: skip invalid cat
2023-05-12 9:29 [PATCH 1/5] libsepol: validate some object contexts Christian Göttsche
` (2 preceding siblings ...)
2023-05-12 9:30 ` [PATCH 4/5] libsepol: validate: reject XEN policy with xperm rules Christian Göttsche
@ 2023-05-12 9:30 ` Christian Göttsche
2023-05-25 20:36 ` [PATCH 1/5] libsepol: validate some object contexts James Carter
4 siblings, 0 replies; 7+ messages in thread
From: Christian Göttsche @ 2023-05-12 9:30 UTC (permalink / raw)
To: selinux
Bail out on expanding levels with invalid low category.
UBSAN report:
expand.c:952:21: runtime error: unsigned integer overflow: 0 - 1 cannot be represented in type 'uint32_t' (aka 'unsigned int')
Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
---
libsepol/src/expand.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/libsepol/src/expand.c b/libsepol/src/expand.c
index c08d3a35..8795229a 100644
--- a/libsepol/src/expand.c
+++ b/libsepol/src/expand.c
@@ -943,7 +943,7 @@ int mls_semantic_level_expand(mls_semantic_level_t * sl, mls_level_t * l,
return -1;
}
for (cat = sl->cat; cat; cat = cat->next) {
- if (cat->low > cat->high) {
+ if (!cat->low || cat->low > cat->high) {
ERR(h, "Category range is not valid %s.%s",
p->p_cat_val_to_name[cat->low - 1],
p->p_cat_val_to_name[cat->high - 1]);
--
2.40.1
^ permalink raw reply related [flat|nested] 7+ messages in thread
* Re: [PATCH 1/5] libsepol: validate some object contexts
2023-05-12 9:29 [PATCH 1/5] libsepol: validate some object contexts Christian Göttsche
` (3 preceding siblings ...)
2023-05-12 9:30 ` [PATCH 5/5] libsepol: expand: skip invalid cat Christian Göttsche
@ 2023-05-25 20:36 ` James Carter
2023-06-05 20:09 ` James Carter
4 siblings, 1 reply; 7+ messages in thread
From: James Carter @ 2023-05-25 20:36 UTC (permalink / raw)
To: Christian Göttsche; +Cc: selinux
On Fri, May 12, 2023 at 5:32 AM Christian Göttsche
<cgzones@googlemail.com> wrote:
>
> Ensure various object context entries have a name, since they are
> duplicated via strdup(3), and the order for ports and memory regions is
> valid.
>
> Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
For these five patches:
Acked-by: James Carter <jwcart2@gmail.com>
> ---
> libsepol/src/policydb_validate.c | 30 ++++++++++++++++++++++++++++++
> 1 file changed, 30 insertions(+)
>
> diff --git a/libsepol/src/policydb_validate.c b/libsepol/src/policydb_validate.c
> index 301aa200..e0d290ff 100644
> --- a/libsepol/src/policydb_validate.c
> +++ b/libsepol/src/policydb_validate.c
> @@ -1149,6 +1149,8 @@ static int validate_ocontexts(sepol_handle_t *handle, const policydb_t *p, valid
> case OCON_NETIF:
> if (validate_context(&octx->context[1], flavors, p->mls))
> goto bad;
> + if (!octx->u.name)
> + goto bad;
> break;
> case OCON_PORT:
> if (octx->u.port.low_port > octx->u.port.high_port)
> @@ -1163,6 +1165,34 @@ static int validate_ocontexts(sepol_handle_t *handle, const policydb_t *p, valid
> default:
> goto bad;
> }
> + if (!octx->u.name)
> + goto bad;
> + break;
> + case OCON_IBPKEY:
> + if (octx->u.ibpkey.low_pkey > octx->u.ibpkey.high_pkey)
> + goto bad;
> + break;
> + case OCON_IBENDPORT:
> + if (!octx->u.ibendport.dev_name)
> + goto bad;
> + break;
> + }
> + } else if (p->target_platform == SEPOL_TARGET_XEN) {
> + switch(i) {
> + case OCON_XEN_IOPORT:
> + if (octx->u.ioport.low_ioport > octx->u.ioport.high_ioport)
> + goto bad;
> + break;
> + case OCON_XEN_IOMEM:
> + if (octx->u.iomem.low_iomem > octx->u.iomem.high_iomem)
> + goto bad;
> + if (p->policyvers < POLICYDB_VERSION_XEN_DEVICETREE && octx->u.iomem.high_iomem > 0xFFFFFFFFULL)
> + goto bad;
> + break;
> + case OCON_XEN_DEVICETREE:
> + if (!octx->u.name)
> + goto bad;
> + break;
> }
> }
> }
> --
> 2.40.1
>
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [PATCH 1/5] libsepol: validate some object contexts
2023-05-25 20:36 ` [PATCH 1/5] libsepol: validate some object contexts James Carter
@ 2023-06-05 20:09 ` James Carter
0 siblings, 0 replies; 7+ messages in thread
From: James Carter @ 2023-06-05 20:09 UTC (permalink / raw)
To: Christian Göttsche; +Cc: selinux
On Thu, May 25, 2023 at 4:36 PM James Carter <jwcart2@gmail.com> wrote:
>
> On Fri, May 12, 2023 at 5:32 AM Christian Göttsche
> <cgzones@googlemail.com> wrote:
> >
> > Ensure various object context entries have a name, since they are
> > duplicated via strdup(3), and the order for ports and memory regions is
> > valid.
> >
> > Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
>
> For these five patches:
> Acked-by: James Carter <jwcart2@gmail.com>
>
These five patches have been merged.
Thanks,
Jim
> > ---
> > libsepol/src/policydb_validate.c | 30 ++++++++++++++++++++++++++++++
> > 1 file changed, 30 insertions(+)
> >
> > diff --git a/libsepol/src/policydb_validate.c b/libsepol/src/policydb_validate.c
> > index 301aa200..e0d290ff 100644
> > --- a/libsepol/src/policydb_validate.c
> > +++ b/libsepol/src/policydb_validate.c
> > @@ -1149,6 +1149,8 @@ static int validate_ocontexts(sepol_handle_t *handle, const policydb_t *p, valid
> > case OCON_NETIF:
> > if (validate_context(&octx->context[1], flavors, p->mls))
> > goto bad;
> > + if (!octx->u.name)
> > + goto bad;
> > break;
> > case OCON_PORT:
> > if (octx->u.port.low_port > octx->u.port.high_port)
> > @@ -1163,6 +1165,34 @@ static int validate_ocontexts(sepol_handle_t *handle, const policydb_t *p, valid
> > default:
> > goto bad;
> > }
> > + if (!octx->u.name)
> > + goto bad;
> > + break;
> > + case OCON_IBPKEY:
> > + if (octx->u.ibpkey.low_pkey > octx->u.ibpkey.high_pkey)
> > + goto bad;
> > + break;
> > + case OCON_IBENDPORT:
> > + if (!octx->u.ibendport.dev_name)
> > + goto bad;
> > + break;
> > + }
> > + } else if (p->target_platform == SEPOL_TARGET_XEN) {
> > + switch(i) {
> > + case OCON_XEN_IOPORT:
> > + if (octx->u.ioport.low_ioport > octx->u.ioport.high_ioport)
> > + goto bad;
> > + break;
> > + case OCON_XEN_IOMEM:
> > + if (octx->u.iomem.low_iomem > octx->u.iomem.high_iomem)
> > + goto bad;
> > + if (p->policyvers < POLICYDB_VERSION_XEN_DEVICETREE && octx->u.iomem.high_iomem > 0xFFFFFFFFULL)
> > + goto bad;
> > + break;
> > + case OCON_XEN_DEVICETREE:
> > + if (!octx->u.name)
> > + goto bad;
> > + break;
> > }
> > }
> > }
> > --
> > 2.40.1
> >
^ permalink raw reply [flat|nested] 7+ messages in thread
end of thread, other threads:[~2023-06-05 20:10 UTC | newest]
Thread overview: 7+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2023-05-12 9:29 [PATCH 1/5] libsepol: validate some object contexts Christian Göttsche
2023-05-12 9:29 ` [PATCH 2/5] libsepol: validate old style range trans classes Christian Göttsche
2023-05-12 9:29 ` [PATCH 3/5] libsepol: validate: check low category is not bigger than high Christian Göttsche
2023-05-12 9:30 ` [PATCH 4/5] libsepol: validate: reject XEN policy with xperm rules Christian Göttsche
2023-05-12 9:30 ` [PATCH 5/5] libsepol: expand: skip invalid cat Christian Göttsche
2023-05-25 20:36 ` [PATCH 1/5] libsepol: validate some object contexts James Carter
2023-06-05 20:09 ` James Carter
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).