Commit 01c2253a authored by Christian Göttsche's avatar Christian Göttsche Committed by Paul Moore
Browse files

selinux: make more use of str_read() when loading the policy 



Simplify the call sites, and enable future string validation in a single
place.

Signed-off-by: default avatarChristian Göttsche <cgzones@googlemail.com>
[PM: subject tweak]
Signed-off-by: default avatarPaul Moore <paul@paul-moore.com>
parent 74915363

security/selinux/ss/conditional.c

+2 −8
Original line number Diff line number Diff line
@@ -230,17 +230,11 @@ int cond_read_bool(struct policydb *p, struct symtab *s, struct policy_file *fp) 
		goto err;



	len = le32_to_cpu(buf[2]);

	if (((len == 0) || (len == (u32)-1)))

		goto err;



	rc = -ENOMEM;

	key = kmalloc(len + 1, GFP_KERNEL);

	if (!key)

		goto err;

	rc = next_entry(key, fp, len);

	rc = str_read(&key, GFP_KERNEL, fp, len);

	if (rc)

		goto err;

	key[len] = '\0';



	rc = symtab_insert(s, key, booldatum);

	if (rc)

		goto err;

security/selinux/ss/policydb.c

+8 −14
Original line number Diff line number Diff line
@@ -1093,7 +1093,7 @@ static int context_read_and_validate(struct context *c, struct policydb *p, 
 * binary representation file.

 */



static int str_read(char **strp, gfp_t flags, struct policy_file *fp, u32 len)

int str_read(char **strp, gfp_t flags, struct policy_file *fp, u32 len)

{

	int rc;

	char *str;
@@ -2473,24 +2473,18 @@ int policydb_read(struct policydb *p, struct policy_file *fp) 
		goto bad;

	}



	rc = -ENOMEM;

	policydb_str = kmalloc(len + 1, GFP_KERNEL);

	if (!policydb_str) {

		pr_err("SELinux:  unable to allocate memory for policydb "

		       "string of length %d\n",

		       len);

		goto bad;

	}



	rc = next_entry(policydb_str, fp, len);

	rc = str_read(&policydb_str, GFP_KERNEL, fp, len);

	if (rc) {

		if (rc == -ENOMEM) {

			pr_err("SELinux:  unable to allocate memory for policydb string of length %d\n",

			       len);

		} else {

			pr_err("SELinux:  truncated policydb string identifier\n");

		kfree(policydb_str);

		}

		goto bad;

	}



	rc = -EINVAL;

	policydb_str[len] = '\0';

	if (strcmp(policydb_str, POLICYDB_STRING)) {

		pr_err("SELinux:  policydb string %s does not match "

		       "my string %s\n",

security/selinux/ss/policydb.h

+2 −0
Original line number Diff line number Diff line
@@ -386,6 +386,8 @@ static inline char *sym_name(struct policydb *p, unsigned int sym_num, 
	return p->sym_val_to_name[sym_num][element_nr];

}



extern int str_read(char **strp, gfp_t flags, struct policy_file *fp, u32 len);



extern u16 string_to_security_class(struct policydb *p, const char *name);

extern u32 string_to_av_perm(struct policydb *p, u16 tclass, const char *name);