RepoMirrors/selinux
1
0
Fork 0
mirror of https://github.com/SELinuxProject/selinux synced 2025-01-10 15:39:25 +00:00
Code Issues Packages Projects Releases Wiki Activity

checkpolicy: Check the right bits of an ibpkeycon rule subnet prefix

Browse Source 
The lower 64 bits of the subnet prefix for an ibpkeycon rule should
all be 0's. Unfortunately the check uses the s6_addr macro which refers
to the 16 entry array of 8-bit values in the union and does not refer
to the correct bits.

Use the s6_addr32 macro instead which refers to the 4 entry array of
32-bit values in the union and refers to the lower 64 bits.

Signed-off-by: James Carter <jwcart2@gmail.com>
Acked-by: Stephen Smalley <stephen.smalley.work@gmail.com>
This commit is contained in:
James Carter 2024-07-08 12:50:32 -04:00 committed by Stephen Smalley
parent d96f27bf7c
commit 84a33fb96b
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
checkpolicy/policy_define.c
View File

@ -5036,7 +5036,7 @@ int define_ibpkey_context(unsigned int low, unsigned int high)
goto out;
}
if (subnet_prefix.s6_addr[2] || subnet_prefix.s6_addr[3]) {
if (subnet_prefix.s6_addr32[2] || subnet_prefix.s6_addr32[3]) {
yyerror("subnet prefix should be 0's in the low order 64 bits.");
rc = -1;
goto out;