Re: [PATCH v2 1/3] selinux: bounds-check role and user membership bitmaps at load

[Paul Moore <paul@paul-moore.com>]

On Sep 28, 2026 =?UTF-8?q?Christian=20G=C3=B6ttsche?= <cgoettsche@seltendoof.de> wrote:
> 
> role->dominates, role->types and user->roles are read as ebitmaps but
> their set bits are never checked against the role and type symbol
> tables. A bit naming an undefined value is silently accepted, and an
> out-of-range one is used to index those tables later; in particular
> role_bounds_sanity_check() passes such a bit straight to sym_name(),
> reading p->sym_val_to_name[] out of bounds on a crafted bounded role.
> 
> Validate the three bitmaps in policydb_index() once every symbol table
> is populated (roles are read before types, so this cannot be done in
> role_read()).
> 
> Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
> Acked-by: Stephen Smalley <stephen.smalley.work@gmail.com>
> ---
> v2: check each bit instead of just comparing the highest bit against
> nprim
> ---
>  security/selinux/ss/policydb.c | 52 ++++++++++++++++++++++++++++++++++
>  1 file changed, 52 insertions(+)

Merged into selinux/dev, thanks!

--
paul-moore.com