RepoMirrors/selinux
1
0
Fork 0
mirror of https://github.com/SELinuxProject/selinux synced 2025-01-19 03:40:50 +00:00
Code Issues Packages Projects Releases Wiki Activity

libsepol: validate avtab and avrule types

Browse Source 
Check for invalid avtab or avrule types.

Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
This commit is contained in:
Christian Göttsche 2021-12-09 17:49:19 +01:00 committed by James Carter
parent ba6d82255b
commit 312eac1c18
1 changed files with 31 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

31
libsepol/src/policydb_validate.c
View File

@ -483,6 +483,20 @@ static int validate_avtab_key(avtab_key_t *key, validate_t flavors[])
goto bad;
if (validate_value(key->target_class, &flavors[SYM_CLASSES]))
goto bad;
switch (0xFFF & key->specified) {
case AVTAB_ALLOWED:
case AVTAB_AUDITALLOW:
case AVTAB_AUDITDENY:
case AVTAB_XPERMS_ALLOWED:
case AVTAB_XPERMS_AUDITALLOW:
case AVTAB_XPERMS_DONTAUDIT:
case AVTAB_TRANSITION:
case AVTAB_MEMBER:
case AVTAB_CHANGE:
break;
default:
goto bad;
}
return 0;
@ -536,6 +550,23 @@ static int validate_avrules(sepol_handle_t *handle, avrule_t *avrule, validate_t
if (validate_value(class->tclass, &flavors[SYM_CLASSES]))
goto bad;
}
switch(avrule->specified) {
case AVRULE_ALLOWED:
case AVRULE_AUDITALLOW:
case AVRULE_AUDITDENY:
case AVRULE_DONTAUDIT:
case AVRULE_NEVERALLOW:
case AVRULE_TRANSITION:
case AVRULE_MEMBER:
case AVRULE_CHANGE:
case AVRULE_XPERMS_ALLOWED:
case AVRULE_XPERMS_AUDITALLOW:
case AVRULE_XPERMS_DONTAUDIT:
case AVRULE_XPERMS_NEVERALLOW:
break;
default:
goto bad;
}
}
return 0;