Re: Process Transition

[David Caplan <dac@tresys.com>]

Luckily it doesn't have any effect on the computation of the access 
vector.  If the transition permission bit was _not_ set (and some other 
permission was set to make avd->allowed evaluate to non zero, i.e. the 
bug case), and the other conditions were true, the net effect is no 
different than if the code were correct.  A little extra code is run, 
but no access is granted or illegal transition permitted.

Nice find!  (It's also present in checkpolicy's version of services.c, 
where it also has no net effect).

Chad Hanson wrote:
> We found a piece of process transition code that should be updated to work
> as expected.
> 
> In ss/services.c context_struct_compute_av() the following should be
> changed:
> 
> 	if (tclass == SECCLASS_PROCESS &&
> bug >>	    avd->allowed && PROCESS__TRANSITION &&
> 	    scontext->role != tcontext->role) {
> 		for (ra = policydb.role_allow; ra; ra = ra->next) {
> 			if (scontext->role == ra->role &&
> 			    tcontext->role == ra->new_role)
> 				break;
> 		}
> 		if (!ra)
> 			avd->allowed = (avd->allowed) &
> ~(PROCESS__TRANSITION);
> 	}
> 
> it should be
> 
> 	if (tclass == SECCLASS_PROCESS &&
> 	    avd->allowed & PROCESS__TRANSITION &&
> 	    scontext->role != tcontext->role) {
> 
> -Chad
> _______________________________________________________________
> Chad Hanson				mailto:chanson@tcs-sec.com
> Trusted Computer Solutions		Phone: 217-384-0028 x12
> 121 W Goose Alley			Fax: 217-384-0288
> Urbana IL 61801
> 
> 
> 
> --
> This message was distributed to subscribers of the selinux mailing list.
> If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
> the words "unsubscribe selinux" without quotes as the message.


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.