Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit b076173a authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'selinux-pr-20190612' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux 

Pull selinux fixes from Paul Moore:
 "Three patches for v5.2.

  One fixes a problem where we weren't correctly logging raw SELinux
  labels, the other two fix problems where we weren't properly checking
  calls to kmemdup()"

* tag 'selinux-pr-20190612' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux:
  selinux: fix a missing-check bug in selinux_sb_eat_lsm_opts()
  selinux: fix a missing-check bug in selinux_add_mnt_opt( )
  selinux: log raw contexts as untrusted strings
parents 35110e38 fec63753

security/selinux/avc.c

+8 −2
Original line number Diff line number Diff line
@@ -739,14 +739,20 @@ static void avc_audit_post_callback(struct audit_buffer *ab, void *a) 
	rc = security_sid_to_context_inval(sad->state, sad->ssid, &scontext,

					   &scontext_len);

	if (!rc && scontext) {

		audit_log_format(ab, " srawcon=%s", scontext);

		if (scontext_len && scontext[scontext_len - 1] == '\0')

			scontext_len--;

		audit_log_format(ab, " srawcon=");

		audit_log_n_untrustedstring(ab, scontext, scontext_len);

		kfree(scontext);

	}



	rc = security_sid_to_context_inval(sad->state, sad->tsid, &scontext,

					   &scontext_len);

	if (!rc && scontext) {

		audit_log_format(ab, " trawcon=%s", scontext);

		if (scontext_len && scontext[scontext_len - 1] == '\0')

			scontext_len--;

		audit_log_format(ab, " trawcon=");

		audit_log_n_untrustedstring(ab, scontext, scontext_len);

		kfree(scontext);

	}

}

security/selinux/hooks.c

+28 −11
Original line number Diff line number Diff line
@@ -1052,16 +1052,25 @@ static int selinux_add_mnt_opt(const char *option, const char *val, int len, 
	if (token == Opt_error)

		return -EINVAL;



	if (token != Opt_seclabel)

	if (token != Opt_seclabel) {

		val = kmemdup_nul(val, len, GFP_KERNEL);

		if (!val) {

			rc = -ENOMEM;

			goto free_opt;

		}

	}

	rc = selinux_add_opt(token, val, mnt_opts);

	if (unlikely(rc)) {

		kfree(val);

		goto free_opt;

	}

	return rc;



free_opt:

	if (*mnt_opts) {

		selinux_free_mnt_opts(*mnt_opts);

		*mnt_opts = NULL;

	}

	}

	return rc;

}
@@ -2616,10 +2625,11 @@ static int selinux_sb_eat_lsm_opts(char *options, void **mnt_opts) 
	char *from = options;

	char *to = options;

	bool first = true;

	int rc;



	while (1) {

		int len = opt_len(from);

		int token, rc;

		int token;

		char *arg = NULL;



		token = match_opt_prefix(from, len, &arg);
@@ -2635,15 +2645,15 @@ static int selinux_sb_eat_lsm_opts(char *options, void **mnt_opts) 
						*q++ = c;

				}

				arg = kmemdup_nul(arg, q - arg, GFP_KERNEL);

				if (!arg) {

					rc = -ENOMEM;

					goto free_opt;

				}

			}

			rc = selinux_add_opt(token, arg, mnt_opts);

			if (unlikely(rc)) {

				kfree(arg);

				if (*mnt_opts) {

					selinux_free_mnt_opts(*mnt_opts);

					*mnt_opts = NULL;

				}

				return rc;

				goto free_opt;

			}

		} else {

			if (!first) {	// copy with preceding comma
@@ -2661,6 +2671,13 @@ static int selinux_sb_eat_lsm_opts(char *options, void **mnt_opts) 
	}

	*to = '\0';

	return 0;



free_opt:

	if (*mnt_opts) {

		selinux_free_mnt_opts(*mnt_opts);

		*mnt_opts = NULL;

	}

	return rc;

}



static int selinux_sb_remount(struct super_block *sb, void *mnt_opts)