mirror of
https://github.com/AuxXxilium/linux_dsm_epyc7002.git
synced 2024-12-28 11:18:45 +07:00
95ffe19420
The intended behavior change for this patch is to reject any MLS strings that contain (trailing) garbage if p->mls_enabled is true. As suggested by Paul Moore, change mls_context_to_sid() so that the two parts of the range are extracted before the rest of the parsing. Because now we don't have to scan for two different separators simultaneously everywhere, we can actually switch to strchr() everywhere instead of the open-coded loops that scan for two separators at once. mls_context_to_sid() used to signal how much of the input string was parsed by updating `*scontext`. However, there is actually no case in which mls_context_to_sid() only parses a subset of the input and still returns a success (other than the buggy case with a second '-' in which it incorrectly claims to have consumed the entire string). Turn `scontext` into a simple pointer argument and stop redundantly checking whether the entire input was consumed in string_to_context_struct(). This also lets us remove the `scontext_len` argument from `string_to_context_struct()`. Signed-off-by: Jann Horn <jannh@google.com> [PM: minor merge fuzz in convert_context()] Signed-off-by: Paul Moore <paul@paul-moore.com>
105 lines
2.8 KiB
C
105 lines
2.8 KiB
C
/* SPDX-License-Identifier: GPL-2.0 */
|
|
/*
|
|
* Multi-level security (MLS) policy operations.
|
|
*
|
|
* Author : Stephen Smalley, <sds@tycho.nsa.gov>
|
|
*/
|
|
/*
|
|
* Updated: Trusted Computer Solutions, Inc. <dgoeddel@trustedcs.com>
|
|
*
|
|
* Support for enhanced MLS infrastructure.
|
|
*
|
|
* Copyright (C) 2004-2006 Trusted Computer Solutions, Inc.
|
|
*/
|
|
/*
|
|
* Updated: Hewlett-Packard <paul@paul-moore.com>
|
|
*
|
|
* Added support to import/export the MLS label from NetLabel
|
|
*
|
|
* (c) Copyright Hewlett-Packard Development Company, L.P., 2006
|
|
*/
|
|
|
|
#ifndef _SS_MLS_H_
|
|
#define _SS_MLS_H_
|
|
|
|
#include "context.h"
|
|
#include "policydb.h"
|
|
|
|
int mls_compute_context_len(struct policydb *p, struct context *context);
|
|
void mls_sid_to_context(struct policydb *p, struct context *context,
|
|
char **scontext);
|
|
int mls_context_isvalid(struct policydb *p, struct context *c);
|
|
int mls_range_isvalid(struct policydb *p, struct mls_range *r);
|
|
int mls_level_isvalid(struct policydb *p, struct mls_level *l);
|
|
|
|
int mls_context_to_sid(struct policydb *p,
|
|
char oldc,
|
|
char *scontext,
|
|
struct context *context,
|
|
struct sidtab *s,
|
|
u32 def_sid);
|
|
|
|
int mls_from_string(struct policydb *p, char *str, struct context *context,
|
|
gfp_t gfp_mask);
|
|
|
|
int mls_range_set(struct context *context, struct mls_range *range);
|
|
|
|
int mls_convert_context(struct policydb *oldp,
|
|
struct policydb *newp,
|
|
struct context *context);
|
|
|
|
int mls_compute_sid(struct policydb *p,
|
|
struct context *scontext,
|
|
struct context *tcontext,
|
|
u16 tclass,
|
|
u32 specified,
|
|
struct context *newcontext,
|
|
bool sock);
|
|
|
|
int mls_setup_user_range(struct policydb *p,
|
|
struct context *fromcon, struct user_datum *user,
|
|
struct context *usercon);
|
|
|
|
#ifdef CONFIG_NETLABEL
|
|
void mls_export_netlbl_lvl(struct policydb *p,
|
|
struct context *context,
|
|
struct netlbl_lsm_secattr *secattr);
|
|
void mls_import_netlbl_lvl(struct policydb *p,
|
|
struct context *context,
|
|
struct netlbl_lsm_secattr *secattr);
|
|
int mls_export_netlbl_cat(struct policydb *p,
|
|
struct context *context,
|
|
struct netlbl_lsm_secattr *secattr);
|
|
int mls_import_netlbl_cat(struct policydb *p,
|
|
struct context *context,
|
|
struct netlbl_lsm_secattr *secattr);
|
|
#else
|
|
static inline void mls_export_netlbl_lvl(struct policydb *p,
|
|
struct context *context,
|
|
struct netlbl_lsm_secattr *secattr)
|
|
{
|
|
return;
|
|
}
|
|
static inline void mls_import_netlbl_lvl(struct policydb *p,
|
|
struct context *context,
|
|
struct netlbl_lsm_secattr *secattr)
|
|
{
|
|
return;
|
|
}
|
|
static inline int mls_export_netlbl_cat(struct policydb *p,
|
|
struct context *context,
|
|
struct netlbl_lsm_secattr *secattr)
|
|
{
|
|
return -ENOMEM;
|
|
}
|
|
static inline int mls_import_netlbl_cat(struct policydb *p,
|
|
struct context *context,
|
|
struct netlbl_lsm_secattr *secattr)
|
|
{
|
|
return -ENOMEM;
|
|
}
|
|
#endif
|
|
|
|
#endif /* _SS_MLS_H */
|
|
|