From: Paul Moore <paul.moore@hp•com>
To: selinux@tycho•nsa.gov, netdev@vger•kernel.org,
linux-security-module@vger•kernel.org
Subject: [RFC PATCH v5 03/14] selinux: Fix a problem in security_netlbl_sid_to_secattr()
Date: Fri, 05 Sep 2008 19:23:31 -0400 [thread overview]
Message-ID: <20080905232331.31840.92786.stgit@flek.lan> (raw)
In-Reply-To: <20080905231853.31840.57880.stgit@flek.lan>
Currently when SELinux fails to allocate memory in
security_netlbl_sid_to_secattr() the NetLabel LSM domain field is set to
NULL which triggers the default NetLabel LSM domain mapping which may not
always be the desired mapping. This patch fixes this by returning an error
when the kernel is unable to allocate memory. This could result in more
failures on a system with heavy memory pressure but it is the "correct"
thing to do.
Signed-off-by: Paul Moore <paul.moore@hp•com>
Acked-by: James Morris <jmorris@namei•org>
---
security/selinux/ss/services.c | 10 ++++++++--
1 files changed, 8 insertions(+), 2 deletions(-)
diff --git a/security/selinux/ss/services.c b/security/selinux/ss/services.c
index d11a815..8d17dfb 100644
--- a/security/selinux/ss/services.c
+++ b/security/selinux/ss/services.c
@@ -2788,7 +2788,7 @@ netlbl_secattr_to_sid_return_cleanup:
*/
int security_netlbl_sid_to_secattr(u32 sid, struct netlbl_lsm_secattr *secattr)
{
- int rc = -ENOENT;
+ int rc;
struct context *ctx;
if (!ss_initialized)
@@ -2796,10 +2796,16 @@ int security_netlbl_sid_to_secattr(u32 sid, struct netlbl_lsm_secattr *secattr)
read_lock(&policy_rwlock);
ctx = sidtab_search(&sidtab, sid);
- if (ctx == NULL)
+ if (ctx == NULL) {
+ rc = -ENOENT;
goto netlbl_sid_to_secattr_failure;
+ }
secattr->domain = kstrdup(policydb.p_type_val_to_name[ctx->type - 1],
GFP_ATOMIC);
+ if (secattr->domain == NULL) {
+ rc = -ENOMEM;
+ goto netlbl_sid_to_secattr_failure;
+ }
secattr->flags |= NETLBL_SECATTR_DOMAIN_CPY;
mls_export_netlbl_lvl(ctx, secattr);
rc = mls_export_netlbl_cat(ctx, secattr);
next prev parent reply other threads:[~2008-09-05 23:23 UTC|newest]
Thread overview: 16+ messages / expand[flat|nested] mbox.gz Atom feed top
2008-09-05 23:23 [RFC PATCH v5 00/14] Labeled networking patches for 2.6.28 Paul Moore
2008-09-05 23:23 ` [RFC PATCH v5 01/14] netlabel: Remove unneeded in-kernel API functions Paul Moore
2008-09-05 23:23 ` [RFC PATCH v5 02/14] selinux: Better local/forward check in selinux_ip_postroute() Paul Moore
2008-09-05 23:23 ` Paul Moore [this message]
2008-09-05 23:23 ` [RFC PATCH v5 04/14] selinux: Fix missing calls to netlbl_skbuff_err() Paul Moore
2008-09-05 23:23 ` [RFC PATCH v5 05/14] smack: " Paul Moore
2008-09-06 2:10 ` Casey Schaufler
2008-09-05 23:23 ` [RFC PATCH v5 06/14] netlabel: Replace protocol/NetLabel linking with refrerence counts Paul Moore
2008-09-05 23:23 ` [RFC PATCH v5 07/14] netlabel: Add a generic way to create ordered linked lists of network addrs Paul Moore
2008-09-05 23:24 ` [RFC PATCH v5 08/14] netlabel: Add network address selectors to the NetLabel/LSM domain mapping Paul Moore
2008-09-05 23:24 ` [RFC PATCH v5 09/14] netlabel: Add functionality to set the security attributes of a packet Paul Moore
2008-09-05 23:24 ` [RFC PATCH v5 10/14] selinux: Set socket NetLabel based on connection endpoint Paul Moore
2008-09-05 23:24 ` [RFC PATCH v5 11/14] selinux: Cache NetLabel secattrs in the socket's security struct Paul Moore
2008-09-05 23:24 ` [RFC PATCH v5 12/14] netlabel: Changes to the NetLabel security attributes to allow LSMs to pass full contexts Paul Moore
2008-09-05 23:24 ` [RFC PATCH v5 13/14] cipso: Add support for native local labeling and fixup mapping names Paul Moore
2008-09-05 23:24 ` [RFC PATCH v5 14/14] netlabel: Add configuration support for local labeling Paul Moore
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20080905232331.31840.92786.stgit@flek.lan \
--to=paul.moore@hp$(echo .)com \
--cc=linux-security-module@vger$(echo .)kernel.org \
--cc=netdev@vger$(echo .)kernel.org \
--cc=selinux@tycho$(echo .)nsa.gov \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox