topjohnwu/selinux
1
0
Fork 0
mirror of https://github.com/topjohnwu/selinux.git synced 2024-11-27 05:20:50 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

libsepol: validate policy properties

Browse Source 
Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
This commit is contained in:
Christian Göttsche 2021-12-09 17:49:25 +01:00 committed by James Carter
parent 2c4da50a9b
commit 80b9441588
1 changed files with 51 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

51
libsepol/src/policydb_validate.c
View File

@ -978,6 +978,54 @@ bad:
return -1;
}
static int validate_properties(sepol_handle_t *handle, policydb_t *p)
{
switch (p->policy_type) {
case POLICY_KERN:
if (p->policyvers < POLICYDB_VERSION_MIN || p->policyvers > POLICYDB_VERSION_MAX)
goto bad;
break;
case POLICY_BASE:
case POLICY_MOD:
if (p->policyvers < MOD_POLICYDB_VERSION_MIN || p->policyvers > MOD_POLICYDB_VERSION_MAX)
goto bad;
break;
default:
goto bad;
}
switch (p->target_platform) {
case SEPOL_TARGET_SELINUX:
case SEPOL_TARGET_XEN:
break;
default:
goto bad;
}
switch (p->mls) {
case 0:
case 1:
break;
default:
goto bad;
}
switch (p->handle_unknown) {
case SEPOL_DENY_UNKNOWN:
case SEPOL_REJECT_UNKNOWN:
case SEPOL_ALLOW_UNKNOWN:
break;
default:
goto bad;
}
return 0;
bad:
ERR(handle, "Invalid policy property");
return -1;
}
static void validate_array_destroy(validate_t flavors[])
{
unsigned int i;
@ -997,6 +1045,9 @@ int validate_policydb(sepol_handle_t *handle, policydb_t *p)
if (validate_array_init(p, flavors))
goto bad;
if (validate_properties(handle, p))
goto bad;
if (p->policy_type == POLICY_KERN) {
if (validate_avtab(handle, &p->te_avtab, flavors))
goto bad;