|
 |
71cd55 |
From f34d3d30c8325e4847a6b696fe7a3936a8a361f3 Mon Sep 17 00:00:00 2001
|
|
|
71cd55 |
From: James Carter <jwcart2@gmail.com>
|
|
|
71cd55 |
Date: Thu, 8 Apr 2021 13:32:01 -0400
|
|
|
71cd55 |
Subject: [PATCH] libsepol/cil: Destroy classperms list when resetting
|
|
|
71cd55 |
classpermission
|
|
|
71cd55 |
|
|
|
71cd55 |
Nicolas Iooss reports:
|
|
|
71cd55 |
A few months ago, OSS-Fuzz found a crash in the CIL compiler, which
|
|
|
71cd55 |
got reported as
|
|
|
71cd55 |
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=28648 (the title
|
|
|
71cd55 |
is misleading, or is caused by another issue that conflicts with the
|
|
|
71cd55 |
one I report in this message). Here is a minimized CIL policy which
|
|
|
71cd55 |
reproduces the issue:
|
|
|
71cd55 |
|
|
|
71cd55 |
(class CLASS (PERM))
|
|
|
71cd55 |
(classorder (CLASS))
|
|
|
71cd55 |
(sid SID)
|
|
|
71cd55 |
(sidorder (SID))
|
|
|
71cd55 |
(user USER)
|
|
|
71cd55 |
(role ROLE)
|
|
|
71cd55 |
(type TYPE)
|
|
|
71cd55 |
(category CAT)
|
|
|
71cd55 |
(categoryorder (CAT))
|
|
|
71cd55 |
(sensitivity SENS)
|
|
|
71cd55 |
(sensitivityorder (SENS))
|
|
|
71cd55 |
(sensitivitycategory SENS (CAT))
|
|
|
71cd55 |
(allow TYPE self (CLASS (PERM)))
|
|
|
71cd55 |
(roletype ROLE TYPE)
|
|
|
71cd55 |
(userrole USER ROLE)
|
|
|
71cd55 |
(userlevel USER (SENS))
|
|
|
71cd55 |
(userrange USER ((SENS)(SENS (CAT))))
|
|
|
71cd55 |
(sidcontext SID (USER ROLE TYPE ((SENS)(SENS))))
|
|
|
71cd55 |
|
|
|
71cd55 |
(classpermission CLAPERM)
|
|
|
71cd55 |
|
|
|
71cd55 |
(optional OPT
|
|
|
71cd55 |
(roletype nonexistingrole nonexistingtype)
|
|
|
71cd55 |
(classpermissionset CLAPERM (CLASS (PERM)))
|
|
|
71cd55 |
)
|
|
|
71cd55 |
|
|
|
71cd55 |
The CIL policy fuzzer (which mimics secilc built with clang Address
|
|
|
71cd55 |
Sanitizer) reports:
|
|
|
71cd55 |
|
|
|
71cd55 |
==36541==ERROR: AddressSanitizer: heap-use-after-free on address
|
|
|
71cd55 |
0x603000004f98 at pc 0x56445134c842 bp 0x7ffe2a256590 sp
|
|
|
71cd55 |
0x7ffe2a256588
|
|
|
71cd55 |
READ of size 8 at 0x603000004f98 thread T0
|
|
|
71cd55 |
#0 0x56445134c841 in __cil_verify_classperms
|
|
|
71cd55 |
/selinux/libsepol/src/../cil/src/cil_verify.c:1620:8
|
|
|
71cd55 |
#1 0x56445134a43e in __cil_verify_classpermission
|
|
|
71cd55 |
/selinux/libsepol/src/../cil/src/cil_verify.c:1650:9
|
|
|
71cd55 |
#2 0x56445134a43e in __cil_pre_verify_helper
|
|
|
71cd55 |
/selinux/libsepol/src/../cil/src/cil_verify.c:1715:8
|
|
|
71cd55 |
#3 0x5644513225ac in cil_tree_walk_core
|
|
|
71cd55 |
/selinux/libsepol/src/../cil/src/cil_tree.c:272:9
|
|
|
71cd55 |
#4 0x564451322ab1 in cil_tree_walk
|
|
|
71cd55 |
/selinux/libsepol/src/../cil/src/cil_tree.c:316:7
|
|
|
71cd55 |
#5 0x5644513226af in cil_tree_walk_core
|
|
|
71cd55 |
/selinux/libsepol/src/../cil/src/cil_tree.c:284:9
|
|
|
71cd55 |
#6 0x564451322ab1 in cil_tree_walk
|
|
|
71cd55 |
/selinux/libsepol/src/../cil/src/cil_tree.c:316:7
|
|
|
71cd55 |
#7 0x5644512b88fd in cil_pre_verify
|
|
|
71cd55 |
/selinux/libsepol/src/../cil/src/cil_post.c:2510:7
|
|
|
71cd55 |
#8 0x5644512b88fd in cil_post_process
|
|
|
71cd55 |
/selinux/libsepol/src/../cil/src/cil_post.c:2524:7
|
|
|
71cd55 |
#9 0x5644511856ff in cil_compile
|
|
|
71cd55 |
/selinux/libsepol/src/../cil/src/cil.c:564:7
|
|
|
71cd55 |
|
|
|
71cd55 |
The classperms list of a classpermission rule is created and filled
|
|
|
71cd55 |
in when classpermissionset rules are processed, so it doesn't own any
|
|
|
71cd55 |
part of the list and shouldn't retain any of it when it is reset.
|
|
|
71cd55 |
|
|
|
71cd55 |
Destroy the classperms list (without destroying the data in it) when
|
|
|
71cd55 |
resetting a classpermission rule.
|
|
|
71cd55 |
|
|
|
71cd55 |
Reported-by: Nicolas Iooss <nicolas.iooss@m4x.org>
|
|
|
71cd55 |
Signed-off-by: James Carter <jwcart2@gmail.com>
|
|
|
71cd55 |
---
|
|
|
71cd55 |
libsepol/cil/src/cil_reset_ast.c | 2 +-
|
|
|
71cd55 |
1 file changed, 1 insertion(+), 1 deletion(-)
|
|
|
71cd55 |
|
|
|
71cd55 |
diff --git a/libsepol/cil/src/cil_reset_ast.c b/libsepol/cil/src/cil_reset_ast.c
|
|
|
71cd55 |
index 3da1b9a64167..db70a535bd42 100644
|
|
|
71cd55 |
--- a/libsepol/cil/src/cil_reset_ast.c
|
|
|
71cd55 |
+++ b/libsepol/cil/src/cil_reset_ast.c
|
|
|
71cd55 |
@@ -54,7 +54,7 @@ static void cil_reset_classpermission(struct cil_classpermission *cp)
|
|
|
71cd55 |
return;
|
|
|
71cd55 |
}
|
|
|
71cd55 |
|
|
|
71cd55 |
- cil_reset_classperms_list(cp->classperms);
|
|
|
71cd55 |
+ cil_list_destroy(&cp->classperms, CIL_FALSE);
|
|
|
71cd55 |
}
|
|
|
71cd55 |
|
|
|
71cd55 |
static void cil_reset_classperms_set(struct cil_classperms_set *cp_set)
|
|
|
71cd55 |
--
|
|
|
71cd55 |
2.32.0
|
|
|
71cd55 |
|