aboutsummaryrefslogtreecommitdiffstats
path: root/security/selinux
diff options
context:
space:
mode:
authorStephen Smalley <sds@tycho.nsa.gov>2008-06-05 09:48:51 -0400
committerJames Morris <jmorris@namei.org>2008-07-14 01:01:54 -0400
commit59dbd1ba9847837aa7095f3e4a29599dae412ac4 (patch)
tree7027450aa23e7f25a67e5cd9a7686e013956ac61 /security/selinux
parent242631c49d4cf39642741d6627750151b058233b (diff)
selinux: fix endianness bug in network node address handling
Fix an endianness bug in the handling of network node addresses by SELinux. This yields no change on little endian hardware but fixes the incorrect handling on big endian hardware. The network node addresses are stored in network order in memory by checkpolicy, not in cpu/host order, and thus should not have cpu_to_le32/le32_to_cpu conversions applied upon policy write/read unlike other data in the policy. Bug reported by John Weeks of Sun, who noticed that binary policy files built from the same policy source on x86 and sparc differed and tracked it down to the ipv4 address handling in checkpolicy. Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov> Signed-off-by: James Morris <jmorris@namei.org>
Diffstat (limited to 'security/selinux')
-rw-r--r--security/selinux/ss/policydb.c15
1 files changed, 8 insertions, 7 deletions
diff --git a/security/selinux/ss/policydb.c b/security/selinux/ss/policydb.c
index 84f8cc73c7db..2391761ae422 100644
--- a/security/selinux/ss/policydb.c
+++ b/security/selinux/ss/policydb.c
@@ -1478,7 +1478,8 @@ int policydb_read(struct policydb *p, void *fp)
1478 struct ocontext *l, *c, *newc; 1478 struct ocontext *l, *c, *newc;
1479 struct genfs *genfs_p, *genfs, *newgenfs; 1479 struct genfs *genfs_p, *genfs, *newgenfs;
1480 int i, j, rc; 1480 int i, j, rc;
1481 __le32 buf[8]; 1481 __le32 buf[4];
1482 u32 nodebuf[8];
1482 u32 len, len2, config, nprim, nel, nel2; 1483 u32 len, len2, config, nprim, nel, nel2;
1483 char *policydb_str; 1484 char *policydb_str;
1484 struct policydb_compat_info *info; 1485 struct policydb_compat_info *info;
@@ -1749,11 +1750,11 @@ int policydb_read(struct policydb *p, void *fp)
1749 goto bad; 1750 goto bad;
1750 break; 1751 break;
1751 case OCON_NODE: 1752 case OCON_NODE:
1752 rc = next_entry(buf, fp, sizeof(u32) * 2); 1753 rc = next_entry(nodebuf, fp, sizeof(u32) * 2);
1753 if (rc < 0) 1754 if (rc < 0)
1754 goto bad; 1755 goto bad;
1755 c->u.node.addr = le32_to_cpu(buf[0]); 1756 c->u.node.addr = nodebuf[0]; /* network order */
1756 c->u.node.mask = le32_to_cpu(buf[1]); 1757 c->u.node.mask = nodebuf[1]; /* network order */
1757 rc = context_read_and_validate(&c->context[0], p, fp); 1758 rc = context_read_and_validate(&c->context[0], p, fp);
1758 if (rc) 1759 if (rc)
1759 goto bad; 1760 goto bad;
@@ -1782,13 +1783,13 @@ int policydb_read(struct policydb *p, void *fp)
1782 case OCON_NODE6: { 1783 case OCON_NODE6: {
1783 int k; 1784 int k;
1784 1785
1785 rc = next_entry(buf, fp, sizeof(u32) * 8); 1786 rc = next_entry(nodebuf, fp, sizeof(u32) * 8);
1786 if (rc < 0) 1787 if (rc < 0)
1787 goto bad; 1788 goto bad;
1788 for (k = 0; k < 4; k++) 1789 for (k = 0; k < 4; k++)
1789 c->u.node6.addr[k] = le32_to_cpu(buf[k]); 1790 c->u.node6.addr[k] = nodebuf[k];
1790 for (k = 0; k < 4; k++) 1791 for (k = 0; k < 4; k++)
1791 c->u.node6.mask[k] = le32_to_cpu(buf[k+4]); 1792 c->u.node6.mask[k] = nodebuf[k+4];
1792 if (context_read_and_validate(&c->context[0], p, fp)) 1793 if (context_read_and_validate(&c->context[0], p, fp))
1793 goto bad; 1794 goto bad;
1794 break; 1795 break;