[PATCH] netlabel: fix export of SELinux categories > 127

[PATCH] netlabel: fix export of SELinux categories > 127

[Joshua Roys]

This fixes corrupted CIPSO packets when SELinux categories greater
than 127 are used.  The bug occured on the second (and later) loops
through the while; the inner for loop through the ebitmap->maps array
used the same index as the NetLabel catmap->bitmap array, even though
the NetLabel bitmap is twice as long as the SELinux bitmap.

Signed-off-by: Joshua Roys <joshua.roys@gtri.gatech.edu>
---
 security/selinux/ss/ebitmap.c |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

diff --git a/security/selinux/ss/ebitmap.c b/security/selinux/ss/ebitmap.c
index 68c7348..04b6145 100644
--- a/security/selinux/ss/ebitmap.c
+++ b/security/selinux/ss/ebitmap.c
@@ -128,7 +128,7 @@ int ebitmap_netlbl_export(struct ebitmap *ebmap,
 			cmap_idx = delta / NETLBL_CATMAP_MAPSIZE;
 			cmap_sft = delta % NETLBL_CATMAP_MAPSIZE;
 			c_iter->bitmap[cmap_idx]
-				|= e_iter->maps[cmap_idx] << cmap_sft;
+				|= e_iter->maps[i] << cmap_sft;
 		}
 		e_iter = e_iter->next;
 	}
-- 
1.6.5.2


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: [PATCH] netlabel: fix export of SELinux categories > 127

[Paul Moore]

On Wednesday 24 February 2010 11:52:37 am Joshua Roys wrote:
> This fixes corrupted CIPSO packets when SELinux categories greater
> than 127 are used.  The bug occured on the second (and later) loops
> through the while; the inner for loop through the ebitmap->maps array
> used the same index as the NetLabel catmap->bitmap array, even though
> the NetLabel bitmap is twice as long as the SELinux bitmap.
> 
> Signed-off-by: Joshua Roys <joshua.roys@gtri.gatech.edu>

Ha!  I came to the same conclusion and sent you a similar patch a few hours 
ago (should have checked my SELinux email folder first it seems).

Acked-by: Paul Moore <paul.moore@hp.com>

This should also be sent to stable - James or Josh do one of you guys want to 
do that?

> ---
>  security/selinux/ss/ebitmap.c |    2 +-
>  1 files changed, 1 insertions(+), 1 deletions(-)
> 
> diff --git a/security/selinux/ss/ebitmap.c b/security/selinux/ss/ebitmap.c
> index 68c7348..04b6145 100644
> --- a/security/selinux/ss/ebitmap.c
> +++ b/security/selinux/ss/ebitmap.c
> @@ -128,7 +128,7 @@ int ebitmap_netlbl_export(struct ebitmap *ebmap,
>  			cmap_idx = delta / NETLBL_CATMAP_MAPSIZE;
>  			cmap_sft = delta % NETLBL_CATMAP_MAPSIZE;
>  			c_iter->bitmap[cmap_idx]
> -				|= e_iter->maps[cmap_idx] << cmap_sft;
> +				|= e_iter->maps[i] << cmap_sft;
>  		}
>  		e_iter = e_iter->next;
>  	}

-- 
paul moore
linux @ hp

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: [PATCH] netlabel: fix export of SELinux categories > 127

[Joshua Roys]

[-- Attachment #1: Type: text/plain, Size: 979 bytes --]

On 02/24/2010 06:52 PM, Paul Moore wrote:
> On Wednesday 24 February 2010 11:52:37 am Joshua Roys wrote:
>> This fixes corrupted CIPSO packets when SELinux categories greater
>> than 127 are used.  The bug occured on the second (and later) loops
>> through the while; the inner for loop through the ebitmap->maps array
>> used the same index as the NetLabel catmap->bitmap array, even though
>> the NetLabel bitmap is twice as long as the SELinux bitmap.
>>
>> Signed-off-by: Joshua Roys<joshua.roys@gtri.gatech.edu>
>
> Ha!  I came to the same conclusion and sent you a similar patch a few hours
> ago (should have checked my SELinux email folder first it seems).
>
> Acked-by: Paul Moore<paul.moore@hp.com>
>
> This should also be sent to stable - James or Josh do one of you guys want to
> do that?
>

Cool!  I'm glad we came to the same solution, although next time I'll CC 
you directly to avoid doing duplicate work.

Thanks for your help,

Josh


[-- Attachment #2: S/MIME Cryptographic Signature --]
[-- Type: application/pkcs7-signature, Size: 2719 bytes --]

Re: [PATCH] netlabel: fix export of SELinux categories > 127

[Paul Moore]

On Friday 26 February 2010 01:08:03 pm Joshua Roys wrote:
> On 02/24/2010 06:52 PM, Paul Moore wrote:
> > On Wednesday 24 February 2010 11:52:37 am Joshua Roys wrote:
> >> This fixes corrupted CIPSO packets when SELinux categories greater
> >> than 127 are used.  The bug occured on the second (and later) loops
> >> through the while; the inner for loop through the ebitmap->maps array
> >> used the same index as the NetLabel catmap->bitmap array, even though
> >> the NetLabel bitmap is twice as long as the SELinux bitmap.
> >> 
> >> Signed-off-by: Joshua Roys<joshua.roys@gtri.gatech.edu>
> > 
> > Ha!  I came to the same conclusion and sent you a similar patch a few
> > hours ago (should have checked my SELinux email folder first it seems).
> > 
> > Acked-by: Paul Moore<paul.moore@hp.com>
> > 
> > This should also be sent to stable - James or Josh do one of you guys
> > want to do that?
> 
> Cool!  I'm glad we came to the same solution, although next time I'll CC
> you directly to avoid doing duplicate work.

Okay, no problem either way - the important part is that the problem is now 
fixed.

> Thanks for your help,

Thanks to you as well, it's always nice to see others get involved.

-- 
paul moore
linux @ hp

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.