RepoMirrors
/
selinux
mirror of https://github.com/SELinuxProject/selinux
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

libsepol: Sort portcon rules consistently 

The comparison function, portcon_data_cmp(), only made use of the
protocol to put tcp before udp, dccp, and sctp. Rules that have
the same port range, but with different protocols would be considered
equal unless one of the protocols was tcp. When generating a CIL or
conf source policy from a binary or using the "-S" option in
checkpolicy the non-tcp portcon rules with the same port range would
not be consistently sorted.

Changed portcon_data_cmp() to sort portcon rules like the CIL function
cil_post_portcon_compare().

Reported-by: Stephen Smalley <stephen.smalley.work@gmail.com>
Signed-off-by: James Carter <jwcart2@gmail.com>
Acked-by: Stephen Smalley <stephen.smalley.work@gmail.com>
This commit is contained in:
James Carter 2020-05-28 14:40:56 -04:00 committed by Stephen Smalley
parent 4ad0abd983
commit 2a63109872
1 changed files with 2 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
libsepol/src/kernel_to_common.c
View File

@ -470,11 +470,9 @@ static int portcon_data_cmp(const void *a, const void *b)
rc = compare_ranges((*aa)->u.port.low_port, (*aa)->u.port.high_port,
(*bb)->u.port.low_port, (*bb)->u.port.high_port);
if (rc == 0) {
if ((*aa)->u.port.protocol == (*bb)->u.port.protocol) {
rc = 0;
} else if ((*aa)->u.port.protocol == IPPROTO_TCP) {
if ((*aa)->u.port.protocol < (*bb)->u.port.protocol) {
rc = -1;
} else {
} else if ((*aa)->u.port.protocol > (*bb)->u.port.protocol) {
rc = 1;
}
}