[PATCH] permission value inconsistency

[PATCH] permission value inconsistency

[Joshua Brindle]

[-- Attachment #1: Type: text/plain, Size: 179 bytes --]

These patches fix permission and common permission values being
incremented before they were successfully added. This may cause an
inconsistency in the policy in the error case.


[-- Attachment #2: 4-checkpolicy-perm-value.diff --]
[-- Type: text/x-patch, Size: 877 bytes --]

diff -pur -x .svn checkpolicy/module_compiler.c checkpolicy/module_compiler.c
--- checkpolicy/module_compiler.c	2005-09-29 09:10:43.000000000 -0400
+++ checkpolicy/module_compiler.c	2005-09-29 09:11:31.000000000 -0400
@@ -639,7 +638,7 @@ int require_class(int pass)
                         break;
                 }
                 case HASHTAB_SUCCESS: {
-                        perm->value = ++datum->permissions.nprim;
+                        perm->value = datum->permissions.nprim + 1;
                         break;
                 }
                 default: {
@@ -655,6 +654,9 @@ int require_class(int pass)
                         free(perm);
                         goto cleanup;
                 }
+                if (ret2 == HASHTAB_SUCCESS) {
+                        datum->permissions.nprim++;
+                }
         }
         return 0;
  cleanup:

[-- Attachment #3: 5-checkpolicy-common-perm-value.diff --]
[-- Type: text/x-patch, Size: 1258 bytes --]

diff -pur -x .svn checkpolicy/policy_parse.y checkpolicy/policy_parse.y
--- checkpolicy/policy_parse.y	2005-09-26 17:27:11.000000000 -0400
+++ checkpolicy/policy_parse.y	2005-10-03 09:25:06.000000000 -0400
@@ -1127,11 +1127,12 @@ static int define_common_perms(void)
 		yyerror("hash table overflow");
 		goto bad;
 	}
-        comdatum->value = ++policydbp->p_commons.nprim;
+        comdatum->value = policydbp->p_commons.nprim + 1;
 	if (symtab_init(&comdatum->permissions, PERM_SYMTAB_SIZE)) {
 		yyerror("out of memory");
 		goto bad;
 	}
+        policydbp->p_commons.nprim++;
 	while ((perm = queue_remove(id_queue))) {
 		perdatum = (perm_datum_t *) malloc(sizeof(perm_datum_t));
 		if (!perdatum) {
@@ -1139,7 +1140,7 @@ static int define_common_perms(void)
 			goto bad_perm;
 		}
 		memset(perdatum, 0, sizeof(perm_datum_t));
-		perdatum->value = ++comdatum->permissions.nprim;
+		perdatum->value = comdatum->permissions.nprim + 1;
 
 		if (perdatum->value > (sizeof(sepol_access_vector_t) * 8)) {
 			yyerror("too many permissions to fit in an access vector");
@@ -1159,6 +1160,7 @@ static int define_common_perms(void)
 			yyerror("hash table overflow");
 			goto bad_perm;
 		}
+                comdatum->permissions.nprim++;
 	}
 
 	return 0;

Re: [PATCH] permission value inconsistency

[Stephen Smalley]

On Tue, 2005-10-04 at 10:31 -0400, Joshua Brindle wrote:
> These patches fix permission and common permission values being
> incremented before they were successfully added. This may cause an
> inconsistency in the policy in the error case.

Isn't the error case fatal anyway?

-- 
Stephen Smalley
National Security Agency


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: [PATCH] permission value inconsistency

[Joshua Brindle]

Stephen Smalley wrote:
> On Tue, 2005-10-04 at 10:31 -0400, Joshua Brindle wrote:
> 
>>These patches fix permission and common permission values being
>>incremented before they were successfully added. This may cause an
>>inconsistency in the policy in the error case.
> 
> 
> Isn't the error case fatal anyway?
> 

Yes, the error case is fatal but there may be a possibility of an 
invalid free when destroying the policydb and it certainly doesn't hurt 
anything to keep the policydb consistent an an error case.

Joshua

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.