|
 |
71cd55 |
From 43c5ed469c2f3bc1beed9110b72bcc29c367ecfb Mon Sep 17 00:00:00 2001
|
|
|
71cd55 |
From: James Carter <jwcart2@gmail.com>
|
|
|
71cd55 |
Date: Mon, 15 Mar 2021 11:09:38 -0400
|
|
|
71cd55 |
Subject: [PATCH] libsepol: Check kernel to CIL and Conf functions for
|
|
|
71cd55 |
supported versions
|
|
|
71cd55 |
|
|
|
71cd55 |
For policy versions between 20 and 23, attributes exist in the
|
|
|
71cd55 |
policy, but only in the type_attr_map. This means that there are
|
|
|
71cd55 |
gaps in both the type_val_to_struct and p_type_val_to_name arrays
|
|
|
71cd55 |
and policy rules can refer to those gaps which can lead to NULL
|
|
|
71cd55 |
dereferences when using sepol_kernel_policydb_to_conf() and
|
|
|
71cd55 |
sepol_kernel_policydb_to_cil().
|
|
|
71cd55 |
|
|
|
71cd55 |
This can be seen with the following policy:
|
|
|
71cd55 |
class CLASS1
|
|
|
71cd55 |
sid SID1
|
|
|
71cd55 |
class CLASS1 { PERM1 }
|
|
|
71cd55 |
attribute TYPE_ATTR1;
|
|
|
71cd55 |
type TYPE1;
|
|
|
71cd55 |
typeattribute TYPE1 TYPE_ATTR1;
|
|
|
71cd55 |
allow TYPE_ATTR1 self : CLASS1 PERM1;
|
|
|
71cd55 |
role ROLE1;
|
|
|
71cd55 |
role ROLE1 types TYPE1;
|
|
|
71cd55 |
user USER1 roles ROLE1;
|
|
|
71cd55 |
sid SID1 USER1:ROLE1:TYPE1
|
|
|
71cd55 |
|
|
|
71cd55 |
Compile the policy:
|
|
|
71cd55 |
checkpolicy -c 23 -o policy.bin policy.conf
|
|
|
71cd55 |
Converting back to a policy.conf causes a segfault:
|
|
|
71cd55 |
checkpolicy -F -b -o policy.bin.conf policy.bin
|
|
|
71cd55 |
|
|
|
71cd55 |
Have both sepol_kernel_policydb_to_conf() and
|
|
|
71cd55 |
sepol_kernel_policydb_to_cil() exit with an error if the kernel
|
|
|
71cd55 |
policy version is between 20 and 23.
|
|
|
71cd55 |
|
|
|
71cd55 |
Acked-by: Nicolas Iooss <nicolas.iooss@m4x.org>
|
|
|
71cd55 |
Signed-off-by: James Carter <jwcart2@gmail.com>
|
|
|
71cd55 |
---
|
|
|
71cd55 |
libsepol/src/kernel_to_cil.c | 12 ++++++++++++
|
|
|
71cd55 |
libsepol/src/kernel_to_conf.c | 12 ++++++++++++
|
|
|
71cd55 |
2 files changed, 24 insertions(+)
|
|
|
71cd55 |
|
|
|
71cd55 |
diff --git a/libsepol/src/kernel_to_cil.c b/libsepol/src/kernel_to_cil.c
|
|
|
71cd55 |
index a146ac514018..edfebeafe283 100644
|
|
|
71cd55 |
--- a/libsepol/src/kernel_to_cil.c
|
|
|
71cd55 |
+++ b/libsepol/src/kernel_to_cil.c
|
|
|
71cd55 |
@@ -3164,6 +3164,18 @@ int sepol_kernel_policydb_to_cil(FILE *out, struct policydb *pdb)
|
|
|
71cd55 |
goto exit;
|
|
|
71cd55 |
}
|
|
|
71cd55 |
|
|
|
71cd55 |
+ if (pdb->policyvers >= POLICYDB_VERSION_AVTAB && pdb->policyvers <= POLICYDB_VERSION_PERMISSIVE) {
|
|
|
71cd55 |
+ /*
|
|
|
71cd55 |
+ * For policy versions between 20 and 23, attributes exist in the policy,
|
|
|
71cd55 |
+ * but only in the type_attr_map. This means that there are gaps in both
|
|
|
71cd55 |
+ * the type_val_to_struct and p_type_val_to_name arrays and policy rules
|
|
|
71cd55 |
+ * can refer to those gaps.
|
|
|
71cd55 |
+ */
|
|
|
71cd55 |
+ sepol_log_err("Writing policy versions between 20 and 23 as CIL is not supported");
|
|
|
71cd55 |
+ rc = -1;
|
|
|
71cd55 |
+ goto exit;
|
|
|
71cd55 |
+ }
|
|
|
71cd55 |
+
|
|
|
71cd55 |
rc = constraint_rules_to_strs(pdb, mls_constraints, non_mls_constraints);
|
|
|
71cd55 |
if (rc != 0) {
|
|
|
71cd55 |
goto exit;
|
|
|
71cd55 |
diff --git a/libsepol/src/kernel_to_conf.c b/libsepol/src/kernel_to_conf.c
|
|
|
71cd55 |
index a22f196df9e9..ea58a026501f 100644
|
|
|
71cd55 |
--- a/libsepol/src/kernel_to_conf.c
|
|
|
71cd55 |
+++ b/libsepol/src/kernel_to_conf.c
|
|
|
71cd55 |
@@ -3041,6 +3041,18 @@ int sepol_kernel_policydb_to_conf(FILE *out, struct policydb *pdb)
|
|
|
71cd55 |
goto exit;
|
|
|
71cd55 |
}
|
|
|
71cd55 |
|
|
|
71cd55 |
+ if (pdb->policyvers >= POLICYDB_VERSION_AVTAB && pdb->policyvers <= POLICYDB_VERSION_PERMISSIVE) {
|
|
|
71cd55 |
+ /*
|
|
|
71cd55 |
+ * For policy versions between 20 and 23, attributes exist in the policy,
|
|
|
71cd55 |
+ * but only in the type_attr_map. This means that there are gaps in both
|
|
|
71cd55 |
+ * the type_val_to_struct and p_type_val_to_name arrays and policy rules
|
|
|
71cd55 |
+ * can refer to those gaps.
|
|
|
71cd55 |
+ */
|
|
|
71cd55 |
+ sepol_log_err("Writing policy versions between 20 and 23 as a policy.conf is not supported");
|
|
|
71cd55 |
+ rc = -1;
|
|
|
71cd55 |
+ goto exit;
|
|
|
71cd55 |
+ }
|
|
|
71cd55 |
+
|
|
|
71cd55 |
rc = constraint_rules_to_strs(pdb, mls_constraints, non_mls_constraints);
|
|
|
71cd55 |
if (rc != 0) {
|
|
|
71cd55 |
goto exit;
|
|
|
71cd55 |
--
|
|
|
71cd55 |
2.32.0
|
|
|
71cd55 |
|