selinux/libsemanage
Stephen Smalley 0b2f9ef8f3 bzip support in libsemanage and out of memory (userspace ticket 7)
On Sun, 2010-01-24 at 21:29 +0100, Guido Trentalancia wrote:
> Hi !
>
> Has anybody had any time to look at this ticket:
> http://userspace.selinuxproject.org/trac/ticket/7 ?
>
> I have experienced the same issue and verified that the problem is actually triggered by the bzip support (as pointed out by Stephen Smalley back in August). In fact, if I use bzip-blocksize=0 in semanage.conf then the problem disappears...
>
> Otherwise with a default semanage.conf and bzip enabled, I get:
>
> libsepol.module_package_read_offsets: offset greater than file size (at 4, offset 200478 -> 8192 (No such file or directory).
> libsemanage.semanage_load_module: Error while reading from module file /etc/selinux/refpolicy/modules/tmp/base.pp. (No such file or directory).
> semodule:  Failed!
>
> I am using libsepol-2.0.41 and libsemanage-2.0.42.

Looking into this more closely, I believe this is another manifestation
of:
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=543915#17

which was ultimately traced down to two issues:
1) A missing offset check in libsepol (fixed in libsepol 2.0.38), and
2) A bug / lack of binary mode support in the fmemopen implementation in
glibc that was later fixed, see:
http://sourceware.org/bugzilla/show_bug.cgi?id=6544

Maybe you have the older glibc still?

Looking at the libsemanage code though, I think we could in fact avoid
any dependency on fmemopen by using the native libsepol support for
operating on a memory region via sepol_policy_file_set_mem(), ala:

Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2010-02-02 15:31:28 -05:00
..
example Author: Daniel J Walsh 2008-09-15 09:25:33 -04:00
include libsemanage: Add function to turn off file contexts validation 2009-10-22 13:53:19 -04:00
man libsemanage: Fix the format of the NAME lines 2009-11-27 12:51:57 -05:00
src bzip support in libsemanage and out of memory (userspace ticket 7) 2010-02-02 15:31:28 -05:00
tests regenerate swig bindings for compression support from commit 142bafa24900b5d9480818c9e81670bbeba2b44d 2009-01-12 10:19:58 -05:00
.gitignore Add subdirectory .gitignore files. 2009-10-20 21:25:55 -04:00
ChangeLog bump libsemanage to 2.0.43 and policycoreutils to 2.0.78 2009-11-27 13:02:43 -05:00
COPYING initial import from svn trunk revision 2950 2008-08-19 15:30:36 -04:00
Makefile initial import from svn trunk revision 2950 2008-08-19 15:30:36 -04:00
VERSION bump libsemanage to 2.0.43 and policycoreutils to 2.0.78 2009-11-27 13:02:43 -05:00