lkml.org 
[lkml]   [2018]   [Feb]   [23]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.15 04/45] selinux: ensure the context is NUL terminated in security_context_to_sid_core()
    Date
    4.15-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Paul Moore <paul@paul-moore.com>

    commit ef28df55ac27e1e5cd122e19fa311d886d47a756 upstream.

    The syzbot/syzkaller automated tests found a problem in
    security_context_to_sid_core() during early boot (before we load the
    SELinux policy) where we could potentially feed context strings without
    NUL terminators into the strcmp() function.

    We already guard against this during normal operation (after the SELinux
    policy has been loaded) by making a copy of the context strings and
    explicitly adding a NUL terminator to the end. The patch extends this
    protection to the early boot case (no loaded policy) by moving the context
    copy earlier in security_context_to_sid_core().

    Reported-by: syzbot <syzkaller@googlegroups.com>
    Signed-off-by: Paul Moore <paul@paul-moore.com>
    Reviewed-By: William Roberts <william.c.roberts@intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    security/selinux/ss/services.c | 18 ++++++++----------
    1 file changed, 8 insertions(+), 10 deletions(-)

    --- a/security/selinux/ss/services.c
    +++ b/security/selinux/ss/services.c
    @@ -1413,27 +1413,25 @@ static int security_context_to_sid_core(
    if (!scontext_len)
    return -EINVAL;

    + /* Copy the string to allow changes and ensure a NUL terminator */
    + scontext2 = kmemdup_nul(scontext, scontext_len, gfp_flags);
    + if (!scontext2)
    + return -ENOMEM;
    +
    if (!ss_initialized) {
    int i;

    for (i = 1; i < SECINITSID_NUM; i++) {
    - if (!strcmp(initial_sid_to_string[i], scontext)) {
    + if (!strcmp(initial_sid_to_string[i], scontext2)) {
    *sid = i;
    - return 0;
    + goto out;
    }
    }
    *sid = SECINITSID_KERNEL;
    - return 0;
    + goto out;
    }
    *sid = SECSID_NULL;

    - /* Copy the string so that we can modify the copy as we parse it. */
    - scontext2 = kmalloc(scontext_len + 1, gfp_flags);
    - if (!scontext2)
    - return -ENOMEM;
    - memcpy(scontext2, scontext, scontext_len);
    - scontext2[scontext_len] = 0;
    -
    if (force) {
    /* Save another copy for storing in uninterpreted form */
    rc = -ENOMEM;

    \
     
     \ /
      Last update: 2018-02-23 20:05    [W:4.664 / U:0.272 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site