Re: [PATCH 2/4] selinux: require a class's permission values to cover its permission count

[sashiko-bot@kernel.org]

> From: Bryam Vargas <hexlabsecurity@proton.me>
> 
> security_get_permissions() sizes an array by the class's permissions.nprim
> and fills it at value - 1, from the inherited common's permission table and
> then the class's own. A value no permission defines leaves a NULL that
> sel_make_perm_files() passes to d_alloc_name(), an oops inside
> sel_write_load() that strands selinux_state.policy_mutex and leaves every
> later load in uninterruptible sleep; two permissions sharing a value
> overwrite the first kstrdup(). Bounding each value by nprim catches
> neither, and neither would a count: the symbol table is keyed on the
> permission name, so duplicates pass.
> 
> Track the values each permission table claims and require them to cover
> exactly what its count declares, rejecting a count no value can reach.
> Conforming policies are unaffected.
> 
> Fixes: 55fcf09b3fe4 ("selinux: add support for querying object classes and permissions from the running policy")
> Cc: stable@vger.kernel.org
> Signed-off-by: Bryam Vargas <hexlabsecurity@proton.me>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260731-b4-disp-d32e997b-v1-0-0341d038ee47@proton.me?part=2