From: James Carter <jwcart2@gmail.com>
To: selinux@vger.kernel.org
Subject: Re: [PATCH] libsepol/cil: Do not allow classpermissionset to use anonymous classpermission
Date: Tue, 21 Nov 2023 09:11:54 -0500 [thread overview]
Message-ID: <CAP+JOzQuQd=rjPZQ2fQx+9+Wo3=0yLvK4f6vg_Rch5guvOOPOw@mail.gmail.com> (raw)
In-Reply-To: <CAP+JOzTTa_BnpocHZ5_AAJO99z3gF2FbtBj7L=_iOU93LYPVKg@mail.gmail.com>
On Fri, Nov 17, 2023 at 10:31 AM James Carter <jwcart2@gmail.com> wrote:
>
> On Fri, Oct 13, 2023 at 9:52 AM James Carter <jwcart2@gmail.com> wrote:
> >
> > Macros can use classpermission arguments. These are used in two
> > different ways. Either a named classpermission is passed (which is
> > declared using a classpermisison rule) or an anonymous classpermission
> > is passed (something like "(CLASS (PERM))").
> >
> > Usually this will look like either of the following:
> > Ex1/
> > (classpermission cp1)
> > (classpermisisonset cp1 (CLASS (PERM)))
> > (macro m1 ((classpermisison ARG1))
> > (allow t1 self ARG1)
> > )
> > (call m1 (cp1))
> > or
> > Ex2/
> > (macro m2 ((classpermission ARG2))
> > (allow t2 self ARG2)
> > )
> > (call m2 ((CLASS (PERM))))
> >
> > The following would also be valid:
> > Ex3/
> > (classpermission cp3)
> > (macro m3 ((classpermission ARG3))
> > (classpermissionset ARG3 (CLASS (PERM)))
> > (allow t3 self ARG3)
> > )
> > (call m3 (cp3))
> >
> > The oss-fuzzer did the equivalent of the following:
> >
> > (classpermission cp4)
> > (macro m4 ((classpermission ARG4))
> > (classpermissionset ARG4 (CLASS (PERM1)))
> > (allow t4 self ARG4)
> > )
> > (call m4 (CLASS (PERM2)))
> >
> > It passed an anonymous classpermission into a macro where there
> > was a classpermissionset rule. Suprisingly, everything worked well
> > until it was time to destroy the AST. There is no way to distinguish
> > between the anonymous classpermission being passed in which needs
> > to be destroyed and the classpermission in the classpermissionset
> > rule which is destroyed when the classpermissionset rule is
> > destroyed. This led to CIL trying to destroy the classpermission
> > in the classpermissionset rule twice.
> >
> > To fix this, when resolving the classpermission name in the
> > classpermissionset rule, check if the datum returned is for
> > an anonymous classpermission (it has no name) and return an
> > error if it is.
> >
> > This fixes oss-fuzz issue 60670.
> >
> > Signed-off-by: James Carter <jwcart2@gmail.com>
>
> This patch could use a review. I would like to get it in the upcoming release.
> Jim
>
This patch has been merged.
Jim
> > ---
> > libsepol/cil/src/cil_resolve_ast.c | 6 ++++++
> > 1 file changed, 6 insertions(+)
> >
> > diff --git a/libsepol/cil/src/cil_resolve_ast.c b/libsepol/cil/src/cil_resolve_ast.c
> > index 33b9d321..49de8618 100644
> > --- a/libsepol/cil/src/cil_resolve_ast.c
> > +++ b/libsepol/cil/src/cil_resolve_ast.c
> > @@ -254,6 +254,12 @@ int cil_resolve_classpermissionset(struct cil_tree_node *current, struct cil_cla
> > goto exit;
> > }
> >
> > + if (!datum->fqn) {
> > + cil_tree_log(current, CIL_ERR, "Anonymous classpermission used in a classpermissionset");
> > + rc = SEPOL_ERR;
> > + goto exit;
> > + }
> > +
> > rc = cil_resolve_classperms_list(current, cps->classperms, extra_args);
> > if (rc != SEPOL_OK) {
> > goto exit;
> > --
> > 2.41.0
> >
prev parent reply other threads:[~2023-11-21 14:12 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-10-13 13:52 [PATCH] libsepol/cil: Do not allow classpermissionset to use anonymous classpermission James Carter
2023-11-17 15:31 ` James Carter
2023-11-21 14:11 ` James Carter [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to='CAP+JOzQuQd=rjPZQ2fQx+9+Wo3=0yLvK4f6vg_Rch5guvOOPOw@mail.gmail.com' \
--to=jwcart2@gmail.com \
--cc=selinux@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).