OpenE2K
/
linux
6
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

selinux: ensure the context is NUL terminated in security_context_to_sid_core() 

The syzbot/syzkaller automated tests found a problem in
security_context_to_sid_core() during early boot (before we load the
SELinux policy) where we could potentially feed context strings without
NUL terminators into the strcmp() function.

We already guard against this during normal operation (after the SELinux
policy has been loaded) by making a copy of the context strings and
explicitly adding a NUL terminator to the end.  The patch extends this
protection to the early boot case (no loaded policy) by moving the context
copy earlier in security_context_to_sid_core().

Reported-by: syzbot <syzkaller@googlegroups.com>
Signed-off-by: Paul Moore <paul@paul-moore.com>
Reviewed-By: William Roberts <william.c.roberts@intel.com>
This commit is contained in:
Paul Moore 2017-11-28 18:51:12 -05:00
parent 4f0753e708
commit ef28df55ac
1 changed files with 8 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
security/selinux/ss/services.c
View File

@ -1413,27 +1413,25 @@ static int security_context_to_sid_core(const char *scontext, u32 scontext_len,
if (!scontext_len) if (!scontext_len)
return -EINVAL; return -EINVAL;
/* Copy the string to allow changes and ensure a NUL terminator */
scontext2 = kmemdup_nul(scontext, scontext_len, gfp_flags);
if (!scontext2)
return -ENOMEM;
if (!ss_initialized) { if (!ss_initialized) {
int i; int i;
for (i = 1; i < SECINITSID_NUM; i++) { for (i = 1; i < SECINITSID_NUM; i++) {
if (!strcmp(initial_sid_to_string[i], scontext)) { if (!strcmp(initial_sid_to_string[i], scontext2)) {
*sid = i; *sid = i;
return 0; goto out;
} }
} }
*sid = SECINITSID_KERNEL; *sid = SECINITSID_KERNEL;
return 0; goto out;
} }
*sid = SECSID_NULL; *sid = SECSID_NULL;
/* Copy the string so that we can modify the copy as we parse it. */
scontext2 = kmalloc(scontext_len + 1, gfp_flags);
if (!scontext2)
return -ENOMEM;
memcpy(scontext2, scontext, scontext_len);
scontext2[scontext_len] = 0;
if (force) { if (force) {
/* Save another copy for storing in uninterpreted form */ /* Save another copy for storing in uninterpreted form */
rc = -ENOMEM; rc = -ENOMEM;