RepoMirrors/selinux
1
0
Fork 0
mirror of https://github.com/SELinuxProject/selinux synced 2025-01-02 03:32:13 +00:00
Code Issues Packages Projects Releases Wiki Activity

libsepol/cil: Fix neverallow checking involving classmaps

Browse Source 
When classmaps used in a neverallow were being expanded during CIL
neverallow checking, an empty classmapping in the list of
classmappings for a classmap would cause the classmap expansion to
stop and the rest of the classmapping of the classmap to be ignored.
This would mean that not all of the classes and permissions associated
with the classmap would be used to check for a neverallow violation.

Do not end the expansion of a classmap when one classmapping is empty.

Reported-by: Jonathan Hettwer <j2468h@gmail.com>
Signed-off-by: James Carter <jwcart2@gmail.com>
Acked-by: Stephen Smalley <stephen.smalley.work@gmail.com>
This commit is contained in:
James Carter 2020-09-15 14:48:06 -04:00 committed by Stephen Smalley
parent 7ef5b1854f
commit a152653b9a
1 changed files with 6 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
libsepol/cil/src/cil_binary.c
View File

@ -4363,15 +4363,13 @@ static int __cil_rule_to_sepol_class_perms(policydb_t *pdb, struct cil_list *cla
rc = __cil_perms_to_datum(cp->perms, sepol_class, &data);
if (rc != SEPOL_OK) goto exit;
if (data == 0) {
/* No permissions */
return SEPOL_OK;
if (data != 0) { /* Only add if there are permissions */
cpn = cil_malloc(sizeof(class_perm_node_t));
cpn->tclass = sepol_class->s.value;
cpn->data = data;
cpn->next = *sepol_class_perms;
*sepol_class_perms = cpn;
}
cpn = cil_malloc(sizeof(class_perm_node_t));
cpn->tclass = sepol_class->s.value;
cpn->data = data;
cpn->next = *sepol_class_perms;
*sepol_class_perms = cpn;
} else { /* MAP */
struct cil_list_item *j = NULL;
cil_list_for_each(j, cp->perms) {