James Morris a280b89982 [SECURITY] secmark: nul-terminate secdata ...

The patch below fixes a problem in the iptables SECMARK target, where
the user-supplied 'selctx' string may not be nul-terminated.

From initial analysis, it seems that the strlen() called from
selinux_string_to_sid() could run until it arbitrarily finds a zero,
and possibly cause a kernel oops before then.

The impact of this appears limited because the operation requires
CAP_NET_ADMIN, which is essentially always root.  Also, the module is
not yet in wide use.

Signed-off-by: James Morris <jmorris@namei.org>
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
Signed-off-by: David S. Miller <davem@davemloft.net>

2006-08-02 13:38:23 -07:00

..

core.c

Remove obsolete #include <linux/config.h>

2006-06-30 19:25:36 +02:00

Kconfig

[NETFILTER]: Demote xt_sctp to EXPERIMENTAL

2006-07-24 22:55:29 -07:00

Makefile

…

nf_conntrack_core.c

Remove obsolete #include <linux/config.h>

2006-06-30 19:25:36 +02:00

nf_conntrack_ftp.c

Remove obsolete #include <linux/config.h>

2006-06-30 19:25:36 +02:00

nf_conntrack_l3proto_generic.c

Remove obsolete #include <linux/config.h>

2006-06-30 19:25:36 +02:00

nf_conntrack_netlink.c

[NETFILTER]: nf_conntrack: Fix undefined references to local_bh_*

2006-06-29 16:57:42 -07:00

nf_conntrack_proto_generic.c

…

nf_conntrack_proto_sctp.c

[NETFILTER]: SCTP conntrack: fix crash triggered by packet without chunks

2006-06-30 14:12:01 -07:00

nf_conntrack_proto_tcp.c

Remove obsolete #include <linux/config.h>

2006-06-30 19:25:36 +02:00

nf_conntrack_proto_udp.c

…

nf_conntrack_standalone.c

[NETFILTER]: conntrack: fix SYSCTL=n compile

2006-07-24 22:53:12 -07:00

nf_internals.h

Remove obsolete #include <linux/config.h>

2006-06-30 19:25:36 +02:00

nf_log.c

Remove obsolete #include <linux/config.h>

2006-06-30 19:25:36 +02:00

nf_queue.c

[NETFILTER]: nf_queue: handle NF_STOP and unknown verdicts in nf_reinject

2006-07-24 22:52:47 -07:00

nf_sockopt.c

Remove obsolete #include <linux/config.h>

2006-06-30 19:25:36 +02:00

nfnetlink_log.c

…

nfnetlink_queue.c

[NETFILTER]: ip_queue/nfnetlink_queue: drop bridge port references when dev disappears

2006-06-29 16:57:48 -07:00

nfnetlink.c

Remove obsolete #include <linux/config.h>

2006-06-30 19:25:36 +02:00

x_tables.c

Remove obsolete #include <linux/config.h>

2006-06-30 19:25:36 +02:00

xt_CLASSIFY.c

…

xt_comment.c

…

xt_connbytes.c

…

xt_connmark.c

…

xt_CONNMARK.c

…

xt_CONNSECMARK.c

…

xt_conntrack.c

…

xt_dccp.c

…

xt_esp.c

…

xt_helper.c

…

xt_length.c

…

xt_limit.c

…

xt_mac.c

…

xt_mark.c

…

xt_MARK.c

…

xt_multiport.c

…

xt_NFQUEUE.c

…

xt_NOTRACK.c

…

xt_physdev.c

[NETFILTER]: bridge netfilter: add deferred output hooks to feature-removal-schedule

2006-07-24 22:54:55 -07:00

xt_pkttype.c

[NETFILTER]: xt_pkttype: fix mismatches on locally generated packets

2006-07-24 22:54:14 -07:00

xt_policy.c

Remove obsolete #include <linux/config.h>

2006-06-30 19:25:36 +02:00

xt_quota.c

…

xt_realm.c

…

xt_sctp.c

[NETFILTER]: xt_sctp: fix --chunk-types matching

2006-06-29 16:57:46 -07:00

xt_SECMARK.c

[SECURITY] secmark: nul-terminate secdata

2006-08-02 13:38:23 -07:00

xt_state.c

…

xt_statistic.c

…

xt_string.c

…

xt_tcpmss.c

…

xt_tcpudp.c

[NETFILTER]: xt_tcpudp: fix double unregistration in error path

2006-06-29 16:57:44 -07:00