RepoMirrors
/
selinux
mirror of https://github.com/SELinuxProject/selinux
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

libsepol: validate the identifier for initials SID is valid 

Check the identifier for initial SIDs is less than the maximum known ID.
The kernel will ignore all unknown IDs, see
security/selinux/ss/policydb.c:policydb_load_isids().

Without checking huge IDs result in OOM events, while writing policies,
e.g. in write_sids_to_conf() or write_sids_to_cil(), due to allocation
of large (continuous) string lists.

Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
Acked-by: James Carter <jwcart2@gmail.com>
This commit is contained in:
Christian Göttsche 2023-11-09 14:51:21 +01:00 committed by James Carter
parent bd1b7848c6
commit cf6ddded16
1 changed files with 9 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
libsepol/src/policydb_validate.c
View File

@ -6,6 +6,7 @@
#include <sepol/policydb/services.h>
#include "debug.h"
#include "kernel_to_common.h"
#include "policydb_validate.h"
#define bool_xor(a, b) (!(a) != !(b))
@ -1180,6 +1181,10 @@ static int validate_ocontexts(sepol_handle_t *handle, const policydb_t *p, valid
if (p->target_platform == SEPOL_TARGET_SELINUX) {
switch (i) {
case OCON_ISID:
if (octx->sid[0] == SEPOL_SECSID_NULL || octx->sid[0] >= SELINUX_SID_SZ)
goto bad;
break;
case OCON_FS:
case OCON_NETIF:
if (validate_context(&octx->context[1], flavors, p->mls))
@ -1216,6 +1221,10 @@ static int validate_ocontexts(sepol_handle_t *handle, const policydb_t *p, valid
}
} else if (p->target_platform == SEPOL_TARGET_XEN) {
switch(i) {
case OCON_XEN_ISID:
if (octx->sid[0] == SEPOL_SECSID_NULL || octx->sid[0] >= XEN_SID_SZ)
goto bad;
break;
case OCON_XEN_IOPORT:
if (octx->u.ioport.low_ioport > octx->u.ioport.high_ioport)
goto bad;