RepoMirrors
/
selinux
mirror of https://github.com/SELinuxProject/selinux
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

libsepol: only exempt gaps checking for kernel policies 

Kernel policy versions 20 to 23 store attributes only in type_attr_map
and reference gaps in the type arrays.  Thus they are exempted from gaps
checks.

Only exempt kernel policies, not base and module ones.

Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
Acked-by: James Carter <jwcart2@gmail.com>
This commit is contained in:
Christian Göttsche 2024-05-06 19:31:08 +02:00 committed by James Carter
parent 1c91bc84e6
commit fc3de95d28
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
libsepol/src/policydb_validate.c
View File

@ -63,7 +63,7 @@ static int validate_array_init(const policydb_t *p, validate_t flavors[])
goto bad;
if (validate_init(&flavors[SYM_ROLES], p->p_role_val_to_name, p->p_roles.nprim))
goto bad;
if (p->policyvers < POLICYDB_VERSION_AVTAB || p->policyvers > POLICYDB_VERSION_PERMISSIVE) {
if (p->policy_type != POLICY_KERN || p->policyvers < POLICYDB_VERSION_AVTAB || p->policyvers > POLICYDB_VERSION_PERMISSIVE) {
if (validate_init(&flavors[SYM_TYPES], p->p_type_val_to_name, p->p_types.nprim))
goto bad;
} else {
@ -803,7 +803,7 @@ static int validate_datum_array_gaps(sepol_handle_t *handle, const policydb_t *p
* For policy versions between 20 and 23, attributes exist in the policy,
* but only in the type_attr_map, so all gaps must be assumed to be valid.
*/
if (p->policyvers < POLICYDB_VERSION_AVTAB || p->policyvers > POLICYDB_VERSION_PERMISSIVE) {
if (p->policy_type != POLICY_KERN || p->policyvers < POLICYDB_VERSION_AVTAB || p->policyvers > POLICYDB_VERSION_PERMISSIVE) {
for (i = 0; i < p->p_types.nprim; i++) {
if (bool_xnor(p->type_val_to_struct[i], ebitmap_get_bit(&flavors[SYM_TYPES].gaps, i)))
goto bad;