linux-kernel - Re: [PATCH v3 12/14] selinux: check for simple types

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite for Android: free password hash cracker in your pocket
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <CAEjxPJ6xPrGMcA4HOR6S0Mz61XB0HoV0BuJznJpuUrRKNuTTnQ@mail.gmail.com>
Date: Wed, 14 May 2025 15:22:45 -0400
From: Stephen Smalley <stephen.smalley.work@...il.com>
To: cgzones@...glemail.com
Cc: selinux@...r.kernel.org, Paul Moore <paul@...l-moore.com>, 
	Ondrej Mosnacek <omosnace@...hat.com>, linux-kernel@...r.kernel.org, 
	Eric Suen <ericsu@...ux.microsoft.com>
Subject: Re: [PATCH v3 12/14] selinux: check for simple types

On Sun, May 11, 2025 at 1:31 PM Christian Göttsche
<cgoettsche@...tendoof.de> wrote:
>
> From: Christian Göttsche <cgzones@...glemail.com>
>
> Validate that the target of AVTAB_TYPE rules and file transitions are
> simple types and not attributes.
>
> Signed-off-by: Christian Göttsche <cgzones@...glemail.com>

Acked-by: Stephen Smalley <stephen.smalley.work@...il.com>

> ---
>  security/selinux/ss/avtab.c    |  9 ++++++++-
>  security/selinux/ss/policydb.c | 23 +++++++++++++++++++++--
>  security/selinux/ss/policydb.h |  1 +
>  3 files changed, 30 insertions(+), 3 deletions(-)
>
> diff --git a/security/selinux/ss/avtab.c b/security/selinux/ss/avtab.c
> index 50df8b69de2b..5b45f37fdcbb 100644
> --- a/security/selinux/ss/avtab.c
> +++ b/security/selinux/ss/avtab.c
> @@ -426,6 +426,13 @@ int avtab_read_item(struct avtab *a, struct policy_file *fp, struct policydb *po
>                                 }
>                                 key.specified = spec_order[i] | enabled;
>                                 datum.u.data = le32_to_cpu(buf32[items++]);
> +
> +                               if ((key.specified & AVTAB_TYPE) &&
> +                                   !policydb_simpletype_isvalid(pol, datum.u.data)) {
> +                                       pr_err("SELinux: avtab: invalid type\n");
> +                                       return -EINVAL;
> +                               }
> +
>                                 rc = insertf(a, &key, &datum, p);
>                                 if (rc)
>                                         return rc;
> @@ -517,7 +524,7 @@ int avtab_read_item(struct avtab *a, struct policy_file *fp, struct policydb *po
>                 datum.u.data = le32_to_cpu(*buf32);
>         }
>         if ((key.specified & AVTAB_TYPE) &&
> -           !policydb_type_isvalid(pol, datum.u.data)) {
> +           !policydb_simpletype_isvalid(pol, datum.u.data)) {
>                 pr_err("SELinux: avtab: invalid type\n");
>                 return -EINVAL;
>         }
> diff --git a/security/selinux/ss/policydb.c b/security/selinux/ss/policydb.c
> index 7774f6da2ebe..2b098d9abf17 100644
> --- a/security/selinux/ss/policydb.c
> +++ b/security/selinux/ss/policydb.c
> @@ -686,7 +686,7 @@ static int role_validate(void *key, void *datum, void *datap)
>         }
>
>         ebitmap_for_each_positive_bit(&role->types, node, i) {
> -               if (!policydb_type_isvalid(p, i + 1))
> +               if (!policydb_simpletype_isvalid(p, i + 1))
>                         goto bad;
>         }
>
> @@ -1047,6 +1047,23 @@ bool policydb_type_isvalid(const struct policydb *p, u32 type)
>         return true;
>  }
>
> +bool policydb_simpletype_isvalid(const struct policydb *p, u32 type)
> +{
> +       const struct type_datum *datum;
> +
> +       if (!type || type > p->p_types.nprim)
> +               return false;
> +
> +       datum = p->type_val_to_struct[type - 1];
> +       if (!datum)
> +               return false;
> +
> +       if (datum->attribute)
> +               return false;
> +
> +       return true;
> +}
> +
>  bool policydb_boolean_isvalid(const struct policydb *p, u32 boolean)
>  {
>         if (!boolean || boolean > p->p_bools.nprim)
> @@ -2235,6 +2252,8 @@ static int filename_trans_read_helper_compat(struct policydb *p, struct policy_f
>         key.name = name;
>
>         otype = le32_to_cpu(buf[3]);
> +       if (!policydb_simpletype_isvalid(p, otype))
> +               goto out;
>
>         last = NULL;
>         datum = policydb_filenametr_search(p, &key);
> @@ -2357,7 +2376,7 @@ static int filename_trans_read_helper(struct policydb *p, struct policy_file *fp
>                 datum->otype = le32_to_cpu(buf[0]);
>
>                 rc = -EINVAL;
> -               if (!policydb_type_isvalid(p, datum->otype))
> +               if (!policydb_simpletype_isvalid(p, datum->otype))
>                         goto out;
>
>                 dst = &datum->next;
> diff --git a/security/selinux/ss/policydb.h b/security/selinux/ss/policydb.h
> index 04acf414fffa..b4f0c1a754cf 100644
> --- a/security/selinux/ss/policydb.h
> +++ b/security/selinux/ss/policydb.h
> @@ -323,6 +323,7 @@ extern int policydb_load_isids(struct policydb *p, struct sidtab *s);
>  extern bool policydb_context_isvalid(const struct policydb *p, const struct context *c);
>  extern bool policydb_class_isvalid(const struct policydb *p, u16 class);
>  extern bool policydb_type_isvalid(const struct policydb *p, u32 type);
> +extern bool policydb_simpletype_isvalid(const struct policydb *p, u32 type);
>  extern bool policydb_role_isvalid(const struct policydb *p, u32 role);
>  extern bool policydb_user_isvalid(const struct policydb *p, u32 user);
>  extern bool policydb_boolean_isvalid(const struct policydb *p, u32 boolean);
> --
> 2.49.0
>