Re: [PATCH v2] selinux: tighten policydb_context_isvalid() checks

[sashiko-bot@kernel.org]

> policydb_context_isvalid() bounds each of user, role, and type but
> does not require the value to be defined. A crafted policy can declare
> more identifiers that it defines, so an initial SID or ocontext
> context whose type is not defined can be inserted into the sidtab and
> later reach type_attribute_bounds_av() from
> context_struct_compute_av(), thereby reaching the
> BUG_ON(!type_val_to_struct[type - 1]). A user with no datum can reach
> context_struct_to_string() and thereby trigger strlen(NULL). The user
> and role datums are already NULL-checked further down but only when
> role is not OBJECT_R_VAL, so an object context can carry an undefined
> value through.
> 
> Use policydb_{role,user,type}_isvalid(), which check both the range
> and that the value has a name, in place of the inline range checks.
> The name and datum arrays are populated by *_index(), so a value with
> a name also has a datum. This runs after policydb_index(), so the
> arrays are populated. The now-redundant NULL guards on role and
> usrdatum in the OBJECT_R_VAL block can then be dropped.
> 
> Signed-off-by: Stephen Smalley <stephen.smalley.work@gmail.com>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260807191342.19500-2-stephen.smalley.work@gmail.com?part=1