* [PATCH 1/3] NetLabel: only deref the CIPSOv4 standard map fields when using standard mapping
2006-10-11 23:10 [PATCH 0/3] Collection of small NetLabel bugfixes paul.moore
@ 2006-10-11 23:10 ` paul.moore
2006-10-11 23:10 ` [PATCH 2/3] NetLabel: better error handling involving mls_export_cat() paul.moore
` (2 subsequent siblings)
3 siblings, 0 replies; 5+ messages in thread
From: paul.moore @ 2006-10-11 23:10 UTC (permalink / raw)
To: netdev, selinux; +Cc: jmorris, eparis, Paul Moore
[-- Attachment #1: netlabel-cipso_mtypefix --]
[-- Type: text/plain, Size: 2578 bytes --]
From: Paul Moore <paul.moore@hp.com>
Fix several places in the CIPSO code where it was dereferencing fields which
did not have valid pointers by moving those pointer dereferences into code
blocks where the pointers are valid.
Signed-off-by: Paul Moore <paul.moore@hp.com>
---
net/ipv4/cipso_ipv4.c | 18 ++++++++++++------
1 files changed, 12 insertions(+), 6 deletions(-)
Index: net-2.6_bugfix_2/net/ipv4/cipso_ipv4.c
===================================================================
--- net-2.6_bugfix_2.orig/net/ipv4/cipso_ipv4.c
+++ net-2.6_bugfix_2/net/ipv4/cipso_ipv4.c
@@ -773,13 +773,15 @@ static int cipso_v4_map_cat_rbm_valid(co
{
int cat = -1;
u32 bitmap_len_bits = bitmap_len * 8;
- u32 cipso_cat_size = doi_def->map.std->cat.cipso_size;
- u32 *cipso_array = doi_def->map.std->cat.cipso;
+ u32 cipso_cat_size;
+ u32 *cipso_array;
switch (doi_def->type) {
case CIPSO_V4_MAP_PASS:
return 0;
case CIPSO_V4_MAP_STD:
+ cipso_cat_size = doi_def->map.std->cat.cipso_size;
+ cipso_array = doi_def->map.std->cat.cipso;
for (;;) {
cat = cipso_v4_bitmap_walk(bitmap,
bitmap_len_bits,
@@ -825,8 +827,8 @@ static int cipso_v4_map_cat_rbm_hton(con
u32 net_spot_max = 0;
u32 host_clen_bits = host_cat_len * 8;
u32 net_clen_bits = net_cat_len * 8;
- u32 host_cat_size = doi_def->map.std->cat.local_size;
- u32 *host_cat_array = doi_def->map.std->cat.local;
+ u32 host_cat_size;
+ u32 *host_cat_array;
switch (doi_def->type) {
case CIPSO_V4_MAP_PASS:
@@ -838,6 +840,8 @@ static int cipso_v4_map_cat_rbm_hton(con
memcpy(net_cat, host_cat, net_spot_max);
return net_spot_max;
case CIPSO_V4_MAP_STD:
+ host_cat_size = doi_def->map.std->cat.local_size;
+ host_cat_array = doi_def->map.std->cat.local;
for (;;) {
host_spot = cipso_v4_bitmap_walk(host_cat,
host_clen_bits,
@@ -893,8 +897,8 @@ static int cipso_v4_map_cat_rbm_ntoh(con
int net_spot = -1;
u32 net_clen_bits = net_cat_len * 8;
u32 host_clen_bits = host_cat_len * 8;
- u32 net_cat_size = doi_def->map.std->cat.cipso_size;
- u32 *net_cat_array = doi_def->map.std->cat.cipso;
+ u32 net_cat_size;
+ u32 *net_cat_array;
switch (doi_def->type) {
case CIPSO_V4_MAP_PASS:
@@ -903,6 +907,8 @@ static int cipso_v4_map_cat_rbm_ntoh(con
memcpy(host_cat, net_cat, net_cat_len);
return net_cat_len;
case CIPSO_V4_MAP_STD:
+ net_cat_size = doi_def->map.std->cat.cipso_size;
+ net_cat_array = doi_def->map.std->cat.cipso;
for (;;) {
net_spot = cipso_v4_bitmap_walk(net_cat,
net_clen_bits,
--
paul moore
linux security @ hp
^ permalink raw reply [flat|nested] 5+ messages in thread* [PATCH 2/3] NetLabel: better error handling involving mls_export_cat()
2006-10-11 23:10 [PATCH 0/3] Collection of small NetLabel bugfixes paul.moore
2006-10-11 23:10 ` [PATCH 1/3] NetLabel: only deref the CIPSOv4 standard map fields when using standard mapping paul.moore
@ 2006-10-11 23:10 ` paul.moore
2006-10-11 23:10 ` [PATCH 3/3] NetLabel: the CIPSOv4 passthrough mapping does not pass categories correctly paul.moore
2006-10-12 22:35 ` [PATCH 0/3] Collection of small NetLabel bugfixes James Morris
3 siblings, 0 replies; 5+ messages in thread
From: paul.moore @ 2006-10-11 23:10 UTC (permalink / raw)
To: netdev, selinux; +Cc: jmorris, eparis, Paul Moore
[-- Attachment #1: netlabel-selinux_mlsexportfix --]
[-- Type: text/plain, Size: 3230 bytes --]
From: Paul Moore <paul.moore@hp.com>
Upon inspection it looked like the error handling for mls_export_cat() was
rather poor. This patch addresses this by NULL'ing out kfree()'d pointers
before returning and checking the return value of the function everywhere
it is called.
Signed-off-by: Paul Moore <paul.moore@hp.com>
---
security/selinux/ss/ebitmap.c | 8 ++++++--
security/selinux/ss/mls.c | 17 ++++++++++++++---
security/selinux/ss/services.c | 18 ++++++++++--------
3 files changed, 30 insertions(+), 13 deletions(-)
Index: net-2.6_bugfix_2/security/selinux/ss/ebitmap.c
===================================================================
--- net-2.6_bugfix_2.orig/security/selinux/ss/ebitmap.c
+++ net-2.6_bugfix_2/security/selinux/ss/ebitmap.c
@@ -93,11 +93,15 @@ int ebitmap_export(const struct ebitmap
size_t bitmap_byte;
unsigned char bitmask;
+ if (src->highbit == 0) {
+ *dst = NULL;
+ *dst_len = 0;
+ return 0;
+ }
+
bitmap_len = src->highbit / 8;
if (src->highbit % 7)
bitmap_len += 1;
- if (bitmap_len == 0)
- return -EINVAL;
bitmap = kzalloc((bitmap_len & ~(sizeof(MAPTYPE) - 1)) +
sizeof(MAPTYPE),
Index: net-2.6_bugfix_2/security/selinux/ss/mls.c
===================================================================
--- net-2.6_bugfix_2.orig/security/selinux/ss/mls.c
+++ net-2.6_bugfix_2/security/selinux/ss/mls.c
@@ -640,8 +640,13 @@ int mls_export_cat(const struct context
{
int rc = -EPERM;
- if (!selinux_mls_enabled)
+ if (!selinux_mls_enabled) {
+ *low = NULL;
+ *low_len = 0;
+ *high = NULL;
+ *high_len = 0;
return 0;
+ }
if (low != NULL) {
rc = ebitmap_export(&context->range.level[0].cat,
@@ -661,10 +666,16 @@ int mls_export_cat(const struct context
return 0;
export_cat_failure:
- if (low != NULL)
+ if (low != NULL) {
kfree(*low);
- if (high != NULL)
+ *low = NULL;
+ *low_len = 0;
+ }
+ if (high != NULL) {
kfree(*high);
+ *high = NULL;
+ *high_len = 0;
+ }
return rc;
}
Index: net-2.6_bugfix_2/security/selinux/ss/services.c
===================================================================
--- net-2.6_bugfix_2.orig/security/selinux/ss/services.c
+++ net-2.6_bugfix_2/security/selinux/ss/services.c
@@ -2399,31 +2399,33 @@ static int selinux_netlbl_socket_setsid(
if (!ss_initialized)
return 0;
+ netlbl_secattr_init(&secattr);
+
POLICY_RDLOCK;
ctx = sidtab_search(&sidtab, sid);
if (ctx == NULL)
goto netlbl_socket_setsid_return;
- netlbl_secattr_init(&secattr);
secattr.domain = kstrdup(policydb.p_type_val_to_name[ctx->type - 1],
GFP_ATOMIC);
mls_export_lvl(ctx, &secattr.mls_lvl, NULL);
secattr.mls_lvl_vld = 1;
- mls_export_cat(ctx,
- &secattr.mls_cat,
- &secattr.mls_cat_len,
- NULL,
- NULL);
+ rc = mls_export_cat(ctx,
+ &secattr.mls_cat,
+ &secattr.mls_cat_len,
+ NULL,
+ NULL);
+ if (rc != 0)
+ goto netlbl_socket_setsid_return;
rc = netlbl_socket_setattr(sock, &secattr);
if (rc == 0)
sksec->nlbl_state = NLBL_LABELED;
- netlbl_secattr_destroy(&secattr);
-
netlbl_socket_setsid_return:
POLICY_RDUNLOCK;
+ netlbl_secattr_destroy(&secattr);
return rc;
}
--
paul moore
linux security @ hp
^ permalink raw reply [flat|nested] 5+ messages in thread* [PATCH 3/3] NetLabel: the CIPSOv4 passthrough mapping does not pass categories correctly
2006-10-11 23:10 [PATCH 0/3] Collection of small NetLabel bugfixes paul.moore
2006-10-11 23:10 ` [PATCH 1/3] NetLabel: only deref the CIPSOv4 standard map fields when using standard mapping paul.moore
2006-10-11 23:10 ` [PATCH 2/3] NetLabel: better error handling involving mls_export_cat() paul.moore
@ 2006-10-11 23:10 ` paul.moore
2006-10-12 22:35 ` [PATCH 0/3] Collection of small NetLabel bugfixes James Morris
3 siblings, 0 replies; 5+ messages in thread
From: paul.moore @ 2006-10-11 23:10 UTC (permalink / raw)
To: netdev, selinux; +Cc: jmorris, eparis, Paul Moore
[-- Attachment #1: netlabel-cipso_passfix --]
[-- Type: text/plain, Size: 1011 bytes --]
From: Paul Moore <paul.moore@hp.com>
The CIPSO passthrough mapping had a problem when sending categories which
would cause no or incorrect categories to be sent on the wire with a packet.
This patch fixes the problem which was a simple off-by-one bug.
Signed-off-by: Paul Moore <paul.moore@hp.com>
---
net/ipv4/cipso_ipv4.c | 4 ++--
1 files changed, 2 insertions(+), 2 deletions(-)
Index: net-2.6_bugfix_2/net/ipv4/cipso_ipv4.c
===================================================================
--- net-2.6_bugfix_2.orig/net/ipv4/cipso_ipv4.c
+++ net-2.6_bugfix_2/net/ipv4/cipso_ipv4.c
@@ -832,8 +832,8 @@ static int cipso_v4_map_cat_rbm_hton(con
switch (doi_def->type) {
case CIPSO_V4_MAP_PASS:
- net_spot_max = host_cat_len - 1;
- while (net_spot_max > 0 && host_cat[net_spot_max] == 0)
+ net_spot_max = host_cat_len;
+ while (net_spot_max > 0 && host_cat[net_spot_max - 1] == 0)
net_spot_max--;
if (net_spot_max > net_cat_len)
return -EINVAL;
--
paul moore
linux security @ hp
^ permalink raw reply [flat|nested] 5+ messages in thread* Re: [PATCH 0/3] Collection of small NetLabel bugfixes
2006-10-11 23:10 [PATCH 0/3] Collection of small NetLabel bugfixes paul.moore
` (2 preceding siblings ...)
2006-10-11 23:10 ` [PATCH 3/3] NetLabel: the CIPSOv4 passthrough mapping does not pass categories correctly paul.moore
@ 2006-10-12 22:35 ` James Morris
3 siblings, 0 replies; 5+ messages in thread
From: James Morris @ 2006-10-12 22:35 UTC (permalink / raw)
To: paul.moore; +Cc: netdev, selinux, eparis
On Wed, 11 Oct 2006, paul.moore@hp.com wrote:
> When doing some more testing today I ran into a few bugs, this patchset
> addresses those bugs. This patchset is backed against today's net-2.6 git
> tree.
>
> Please apply these patches for 2.6.19, thanks.
Applied to
git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/selinux-net-2.6.git
--
James Morris
<jmorris@namei.org>
^ permalink raw reply [flat|nested] 5+ messages in thread