Note: This bug is displayed in read-only format because
the product is no longer active in Red Hat Bugzilla.
RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
# ls -l id000000
-rw-------. 1 root root 834610 Nov 30 06:12 id000000
# gdb seinfo ./id000000
GNU gdb (GDB) Red Hat Enterprise Linux 7.6.1-94.el7
Copyright (C) 2013 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law. Type "show copying"
and "show warranty" for details.
This GDB was configured as "x86_64-redhat-linux-gnu".
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>...
Reading symbols from /usr/bin/seinfo...Reading symbols from /usr/lib/debug/usr/bin/seinfo.debug...done.
done.
"/root/./id000000" is not a core dump: File format not recognized
(gdb) r ./id000000
Starting program: /usr/bin/seinfo ./id000000
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib64/libthread_db.so.1".
Statistics for policy file: ./id000000
Policy Version & Type: v.30 (binary, mls)
Classes: 91 Permissions: 256
Sensitivities: 1 Categories: 1024
Types: 1599 Attributes: 157
Users: 6 Roles: 9
Booleans: 112 Cond. Expr.: 117
Allow: 20350 Neverallow: 0
Auditallow: 41 Dontaudit: 1934
Type_trans: 1621 Type_change: 21
Type_member: 13 Role allow: 25
Role_trans: 32 Range_trans: 88
Constraints: 109 Validatetrans: 0
Initial SIDs: 27 Fs_use: 28
Genfscon: 105 Portcon: 595
Netifcon: 0 Nodecon: 0
Program received signal SIGSEGV, Segmentation fault.
ebitmap_state_size (iter=<optimized out>) at iterator.c:403
403 ebitmap_for_each_bit(es->bmap, node, bit) {
(gdb) bt
#0 ebitmap_state_size (iter=<optimized out>) at iterator.c:403
#1 0x00007ffff7b1afd0 in qpol_iterator_get_size (iter=<optimized out>,
size=size@entry=0x7fffffffe128) at iterator.c:523
#2 0x0000000000408c34 in print_stats (fp=0x7ffff7438400 <_IO_2_1_stdout_>,
policydb=<optimized out>) at seinfo.c:402
#3 0x0000000000406acb in main (argc=<optimized out>, argv=0x7fffffffe408)
at seinfo.c:1875
(gdb)
Created attachment 1226256 [details] first input file found by AFL that crashed seinfo Description of problem: * found by American Fuzzy Lop * the /etc/selinux/minimum/policy/policy.30 file was used as input for fuzzing Version-Release number of selected component (if applicable): setools-debuginfo-3.3.8-1.1.el7.x86_64 setools-console-3.3.8-1.1.el7.x86_64 setools-libs-3.3.8-1.1.el7.x86_64 selinux-policy-minimum-3.13.1-102.el7.noarch selinux-policy-3.13.1-102.el7.noarch selinux-policy-targeted-3.13.1-102.el7.noarch How reproducible: * always Steps to Reproduce: # seinfo ./id000000 Statistics for policy file: ./id000000 Policy Version & Type: v.30 (binary, mls) Classes: 91 Permissions: 256 Sensitivities: 1 Categories: 1024 Types: 1599 Attributes: 157 Users: 6 Roles: 9 Booleans: 112 Cond. Expr.: 117 Allow: 20350 Neverallow: 0 Auditallow: 41 Dontaudit: 1934 Type_trans: 1621 Type_change: 21 Type_member: 13 Role allow: 25 Role_trans: 32 Range_trans: 88 Constraints: 109 Validatetrans: 0 Initial SIDs: 27 Fs_use: 28 Genfscon: 105 Portcon: 595 Netifcon: 0 Nodecon: 0 Segmentation fault # dmesg | grep -i segfault [ 5215.317909] seinfo[13399]: segfault at 0 ip 00007f82f8a78cfe sp 00007ffe67c50800 error 4 in libqpol.so.1.7[7f82f8a6b000+ca000] # Actual results: * segfault Expected results: * some error message but no segfault