Attachment 312235 Details for Bug 456051 – Upstream patch for this issue

[patch] Upstream patch for this issue

SELinux-fix-array-out-of-bounds-when-mounting-with.patch (text/plain), 1.28 KB, created by Eugene Teo (Security Response) on 2008-07-21 08:50:43 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Eugene Teo (Security Response)

Created: 2008-07-21 08:50:43 UTC

Size: 1.28 KB

patch

obsolete

>From 31e879309474d1666d645b96de99d0b682fa055f Mon Sep 17 00:00:00 2001
>From: Eric Paris <eparis@redhat.com>
>Date: Wed, 19 Sep 2007 17:19:12 -0400
>Subject: [PATCH] SELinux: fix array out of bounds when mounting with selinux options
>
>Given an illegal selinux option it was possible for match_token to work in
>random memory at the end of the match_table_t array.
>
>Note that privilege is required to perform a context mount, so this issue is
>effectively limited to root only.
>
>Signed-off-by: Eric Paris <eparis@redhat.com>
>Acked-by: Stephen Smalley <sds@tycho.nsa.gov>
>Signed-off-by: James Morris <jmorris@namei.org>
>---
> security/selinux/hooks.c |    2 ++
> 1 files changed, 2 insertions(+), 0 deletions(-)
>
>diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
>index 3694662..0753b20 100644
>--- a/security/selinux/hooks.c
>+++ b/security/selinux/hooks.c
>@@ -316,6 +316,7 @@ static inline int inode_doinit(struct inode *inode)
> }
> 
> enum {
>+	Opt_error = -1,
> 	Opt_context = 1,
> 	Opt_fscontext = 2,
> 	Opt_defcontext = 4,
>@@ -327,6 +328,7 @@ static match_table_t tokens = {
> 	{Opt_fscontext, "fscontext=%s"},
> 	{Opt_defcontext, "defcontext=%s"},
> 	{Opt_rootcontext, "rootcontext=%s"},
>+	{Opt_error, NULL},
> };
> 
> #define SEL_MOUNT_FAIL_MSG "SELinux:  duplicate or incompatible mount options\n"
>-- 
>1.5.5.1
>

Actions: View | Diff

Attachments on bug 456051: 312235