Commit 3040a6d5 authored by Paul Moore's avatar Paul Moore Committed by James Morris

selinux: Fix an uninitialized variable BUG/panic in selinux_secattr_to_sid()

At some point during the 2.6.27 development cycle two new fields were added
to the SELinux context structure, a string pointer and a length field.  The
code in selinux_secattr_to_sid() was not modified and as a result these two
fields were left uninitialized which could result in erratic behavior,
including kernel panics, when NetLabel is used.  This patch fixes the
problem by fully initializing the context in selinux_secattr_to_sid() before
use and reducing the level of direct context manipulation done to help
prevent future problems.

Please apply this to the 2.6.27-rcX release stream.
Signed-off-by: default avatarPaul Moore <paul.moore@hp.com>
Signed-off-by: default avatarJames Morris <jmorris@namei.org>
parent b5ff7df3
...@@ -2737,6 +2737,7 @@ int security_netlbl_secattr_to_sid(struct netlbl_lsm_secattr *secattr, ...@@ -2737,6 +2737,7 @@ int security_netlbl_secattr_to_sid(struct netlbl_lsm_secattr *secattr,
if (ctx == NULL) if (ctx == NULL)
goto netlbl_secattr_to_sid_return; goto netlbl_secattr_to_sid_return;
context_init(&ctx_new);
ctx_new.user = ctx->user; ctx_new.user = ctx->user;
ctx_new.role = ctx->role; ctx_new.role = ctx->role;
ctx_new.type = ctx->type; ctx_new.type = ctx->type;
...@@ -2745,13 +2746,9 @@ int security_netlbl_secattr_to_sid(struct netlbl_lsm_secattr *secattr, ...@@ -2745,13 +2746,9 @@ int security_netlbl_secattr_to_sid(struct netlbl_lsm_secattr *secattr,
if (ebitmap_netlbl_import(&ctx_new.range.level[0].cat, if (ebitmap_netlbl_import(&ctx_new.range.level[0].cat,
secattr->attr.mls.cat) != 0) secattr->attr.mls.cat) != 0)
goto netlbl_secattr_to_sid_return; goto netlbl_secattr_to_sid_return;
ctx_new.range.level[1].cat.highbit = memcpy(&ctx_new.range.level[1].cat,
ctx_new.range.level[0].cat.highbit; &ctx_new.range.level[0].cat,
ctx_new.range.level[1].cat.node = sizeof(ctx_new.range.level[0].cat));
ctx_new.range.level[0].cat.node;
} else {
ebitmap_init(&ctx_new.range.level[0].cat);
ebitmap_init(&ctx_new.range.level[1].cat);
} }
if (mls_context_isvalid(&policydb, &ctx_new) != 1) if (mls_context_isvalid(&policydb, &ctx_new) != 1)
goto netlbl_secattr_to_sid_return_cleanup; goto netlbl_secattr_to_sid_return_cleanup;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment