From: Paul Moore <paul@paul-moore.com>
To: "Christian Göttsche" <cgoettsche@seltendoof.de>, selinux@vger.kernel.org
Cc: "Christian Göttsche" <cgzones@googlemail.com>,
"Stephen Smalley" <stephen.smalley.work@gmail.com>,
"Ondrej Mosnacek" <omosnace@redhat.com>,
linux-kernel@vger.kernel.org,
"Eric Suen" <ericsu@linux.microsoft.com>,
"Canfeng Guo" <guocanfeng@uniontech.com>
Subject: Re: [PATCH v3 7/14] selinux: check type attr map overflows
Date: Wed, 06 May 2026 19:43:09 -0400 [thread overview]
Message-ID: <c374e00a48c66581f55b19e88e149bb1@paul-moore.com> (raw)
In-Reply-To: <20250511173055.406906-7-cgoettsche@seltendoof.de>
On May 11, 2025 =?UTF-8?q?Christian=20G=C3=B6ttsche?= <cgoettsche@seltendoof.de> wrote:
>
> Validate that no types with an invalid too high ID are present in the
> attribute map. Gaps are still not checked.
>
> Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
> Acked-by: Stephen Smalley <stephen.smalley.work@gmail.com>
> ---
> v3: squash with previous patch ("selinux: introduce
> ebitmap_highest_set_bit()")
> ---
> security/selinux/ss/ebitmap.c | 27 +++++++++++++++++++++++++++
> security/selinux/ss/ebitmap.h | 1 +
> security/selinux/ss/policydb.c | 5 +++++
> 3 files changed, 33 insertions(+)
I changed the name to ebitmap_get_highest_set_bit(), but otherwise this
looks good to me, merged to selinux/dev, thanks.
--
paul-moore.com
next prev parent reply other threads:[~2026-05-06 23:43 UTC|newest]
Thread overview: 37+ messages / expand[flat|nested] mbox.gz Atom feed top
2025-05-11 17:30 [PATCH v3 01/14] selinux: avoid nontransitive comparison Christian Göttsche
2025-05-11 17:30 ` [PATCH v3 02/14] selinux: use u16 for security classes Christian Göttsche
2025-05-13 19:44 ` Stephen Smalley
2025-05-17 21:53 ` David Laight
2025-05-11 17:30 ` [PATCH v3 03/14] selinux: more strict policy parsing Christian Göttsche
2025-05-14 14:15 ` Stephen Smalley
2025-05-14 14:25 ` Stephen Smalley
2026-05-06 23:43 ` [PATCH v3 3/14] " Paul Moore
2025-05-11 17:30 ` [PATCH v3 04/14] selinux: check length fields in policies Christian Göttsche
2025-05-14 17:26 ` Stephen Smalley
2025-05-11 17:30 ` [PATCH v3 05/14] selinux: validate constraints Christian Göttsche
2025-05-14 17:51 ` Stephen Smalley
2025-05-11 17:30 ` [PATCH v3 06/14] selinux: pre-validate conditional expressions Christian Göttsche
2025-05-14 17:55 ` Stephen Smalley
2025-05-11 17:30 ` [PATCH v3 07/14] selinux: check type attr map overflows Christian Göttsche
2025-05-14 18:15 ` Stephen Smalley
2026-05-06 23:43 ` Paul Moore [this message]
2025-05-11 17:30 ` [PATCH v3 08/14] selinux: reorder policydb_index() Christian Göttsche
2025-05-14 18:24 ` Stephen Smalley
2026-05-06 23:43 ` [PATCH v3 8/14] " Paul Moore
2025-05-11 17:30 ` [PATCH v3 09/14] selinux: beef up isvalid checks Christian Göttsche
2025-05-14 18:59 ` Stephen Smalley
2025-05-11 17:30 ` [PATCH v3 10/14] selinux: validate symbols Christian Göttsche
2025-05-14 19:06 ` Stephen Smalley
2026-05-06 23:43 ` Paul Moore
2025-05-11 17:30 ` [PATCH v3 11/14] selinux: more strict bounds check Christian Göttsche
2025-05-14 19:11 ` Stephen Smalley
2026-05-01 17:15 ` Stephen Smalley
2025-05-11 17:30 ` [PATCH v3 12/14] selinux: check for simple types Christian Göttsche
2025-05-14 19:22 ` Stephen Smalley
2025-05-11 17:30 ` [PATCH v3 13/14] selinux: restrict policy strings Christian Göttsche
2025-05-14 19:40 ` Stephen Smalley
2025-05-14 20:02 ` James Carter
2025-05-11 17:30 ` [PATCH v3 14/14] selinux: harden MLS context string generation against overflows Christian Göttsche
2025-05-14 19:53 ` Stephen Smalley
2025-05-11 17:30 ` [PATCH v3 00/14] selinux: harden against malformed policies Christian Göttsche
2025-05-13 19:40 ` [PATCH v3 01/14] selinux: avoid nontransitive comparison Stephen Smalley
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=c374e00a48c66581f55b19e88e149bb1@paul-moore.com \
--to=paul@paul-moore.com \
--cc=cgoettsche@seltendoof.de \
--cc=cgzones@googlemail.com \
--cc=ericsu@linux.microsoft.com \
--cc=guocanfeng@uniontech.com \
--cc=linux-kernel@vger.kernel.org \
--cc=omosnace@redhat.com \
--cc=selinux@vger.kernel.org \
--cc=stephen.smalley.work@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.