This patch against 2.6.0-test3-bk fixes a bug in the SELinux module
by adding a check of the filesystem labeling behavior value
obtained from the policy.
security/selinux/hooks.c | 12 +++++++++---
security/selinux/ss/policydb.c | 2 ++
2 files changed, 11 insertions(+), 3 deletions(-)
Index: linux-2.6/security/selinux/ss/policydb.c
diff -u linux-2.6/security/selinux/ss/policydb.c:1.1.1.1 linux-2.6/security/selinux/ss/policydb.c:1.23
--- linux-2.6/security/selinux/ss/policydb.c:1.1.1.1 Tue Aug 12 09:05:06 2003
+++ linux-2.6/security/selinux/ss/policydb.c Wed Aug 13 09:57:03 2003
@@ -1301,6 +1301,8 @@
if (!buf)
goto bad;
c->v.behavior = le32_to_cpu(buf[0]);
+ if (c->v.behavior > SECURITY_FS_USE_NONE)
+ goto bad;
len = le32_to_cpu(buf[1]);
buf = next_entry(fp, len);
if (!buf)
Index: linux-2.6/security/selinux/hooks.c
diff -u linux-2.6/security/selinux/hooks.c:1.66 linux-2.6/security/selinux/hooks.c:1.67
--- linux-2.6/security/selinux/hooks.c:1.66 Thu Jul 17 07:33:31 2003
+++ linux-2.6/security/selinux/hooks.c Tue Aug 12 14:29:53 2003
@@ -313,9 +313,15 @@
sbsec->initialized = 1;
- printk(KERN_INFO "SELinux: initialized (dev %s, type %s), %s\n",
- sb->s_id, sb->s_type->name,
- labeling_behaviors[sbsec->behavior-1]);
+ if (sbsec->behavior > ARRAY_SIZE(labeling_behaviors)) {
+ printk(KERN_INFO "SELinux: initialized (dev %s, type %s), unknown behavior\n",
+ sb->s_id, sb->s_type->name);
+ }
+ else {
+ printk(KERN_INFO "SELinux: initialized (dev %s, type %s), %s\n",
+ sb->s_id, sb->s_type->name,
+ labeling_behaviors[sbsec->behavior-1]);
+ }
/* Initialize the root inode. */
rc = inode_doinit_with_dentry(sb->s_root->d_inode, sb->s_root);
--
Stephen Smalley <[email protected]>
National Security Agency