selinux March 2009 archive
Main Archive Page > Month Archives  > selinux archives
selinux: [PATCH] libsepol: fix boolean state smashing

[PATCH] libsepol: fix boolean state smashing

From: Joshua Brindle <method_at_nospam>
Date: Wed Mar 18 2009 - 14:47:34 GMT
To: SE Linux <selinux@tycho.nsa.gov>


If a boolean is encountered in a require block before the place where it is declared it currently gets created with the state set to false no matter what the declared state was. This only affects booleans in modules where the boolean was also required in another module. Patch below: --- diff --git a/libsepol/src/link.c b/libsepol/src/link.c index 28fcda1..d03e599 100644 --- a/libsepol/src/link.c +++ b/libsepol/src/link.c @@ -540,6 +540,7 @@ static int bool_copy_callback(hashtab_key_t key, hashtab_datum_t datum, char *id = key, *new_id = NULL; cond_bool_datum_t *booldatum, *base_bool, *new_bool = NULL; link_state_t *state = (link_state_t *) data;
+ scope_datum_t *scope;
booldatum = (cond_bool_datum_t *) datum; @@ -556,7 +557,6 @@ static int bool_copy_callback(hashtab_key_t key, hashtab_datum_t datum, (cond_bool_datum_t *) malloc(sizeof(*new_bool))) == NULL) { goto cleanup; } - new_bool->state = booldatum->state; new_bool->s.value = state->base->p_bools.nprim + 1; ret = hashtab_insert(state->base->p_bools.table, @@ -570,6 +570,14 @@ static int bool_copy_callback(hashtab_key_t key, hashtab_datum_t datum, }
+ /* Get the scope info for this boolean to see if this is the declaration,
+ * if so set the state */
+ scope = hashtab_search(state->cur->policy->p_bools_scope.table, id);
+ if (!scope)
+ return SEPOL_ERR;
+ if (scope->scope == SCOPE_DECL)
+ base_bool->state = booldatum->state;
+ state->cur->map[SYM_BOOLS][booldatum->s.value - 1] = base_bool->s.value; return 0; -- This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with the words "unsubscribe selinux" without quotes as the message.