topjohnwu/selinux
1
0
Fork 0
mirror of https://github.com/topjohnwu/selinux.git synced 2024-12-03 00:56:29 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

libsepol/cil: Provide error if classperms are empty

Browse Source 
Fixes https://github.com/SELinuxProject/cil/issues/7.

This fixes a bug where cil_verify_classperms was executed on NULL
classperms lists. A check is now performed when verifying
classpermissions and classmap to ensure the classperms lists are not
empty.

Signed-off-by: Yuli Khodorkovskiy <ykhodorkovskiy@tresys.com>
Signed-off-by: James Carter <jwcart2@tycho.nsa.gov>
This commit is contained in:
Yuli Khodorkovskiy 2015-09-10 14:55:34 -04:00 committed by James Carter
parent 77779d2ca5
commit de4c95f9c8
1 changed files with 19 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

21
libsepol/cil/src/cil_verify.c
View File

@ -1486,13 +1486,22 @@ static int __cil_verify_classpermission(struct cil_tree_node *node)
int rc = SEPOL_ERR;
struct cil_classpermission *cp = node->data;
if (cp->classperms == NULL) {
cil_log(CIL_ERR, "Classpermission %s does not have a classpermissionset at line %d of %s\n", cp->datum.name, node->line, node->path);
rc = SEPOL_ERR;
goto exit;
}
rc = __cil_verify_classperms(cp->classperms, &cp->datum);
if (rc != SEPOL_OK) {
cil_log(CIL_ERR, "Found circular class permissions involving the set %s at line %d of %s\n",cp->datum.name, node->line, node->path);
return rc;
goto exit;
}
return SEPOL_OK;
rc = SEPOL_OK;
exit:
return rc;
}
struct cil_verify_map_args {
@ -1507,12 +1516,20 @@ static int __verify_map_perm_classperms(__attribute__((unused)) hashtab_key_t k,
struct cil_verify_map_args *map_args = args;
struct cil_perm *cmp = (struct cil_perm *)d;
if (cmp->classperms == NULL) {
cil_log(CIL_ERR, "Map class %s does not have a classmapping for %s at line %d of %s\n", map_args->class->datum.name, cmp->datum.name, map_args->node->line, map_args->node->path);
map_args->rc = SEPOL_ERR;
goto exit;
}
rc = __cil_verify_classperms(cmp->classperms, &cmp->datum);
if (rc != SEPOL_OK) {
cil_log(CIL_ERR, "Found circular class permissions involving the map class %s and permission %s at line %d of %s\n", map_args->class->datum.name, cmp->datum.name, map_args->node->line, map_args->node->path);
map_args->rc = SEPOL_ERR;
goto exit;
}
exit:
return SEPOL_OK;
}