* [PATCH] selinux: Augment BUG_ON assertion for secclass_map.
@ 2015-06-15 17:27 Stephen Smalley
2015-06-18 19:25 ` Paul Moore
0 siblings, 1 reply; 2+ messages in thread
From: Stephen Smalley @ 2015-06-15 17:27 UTC (permalink / raw
To: selinux; +Cc: Stephen Smalley
Ensure that we catch any cases where tclass == 0.
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
---
security/selinux/avc.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/security/selinux/avc.c b/security/selinux/avc.c
index 3c17dda..dcb8b0f 100644
--- a/security/selinux/avc.c
+++ b/security/selinux/avc.c
@@ -101,6 +101,7 @@ static void avc_dump_av(struct audit_buffer *ab, u16 tclass, u32 av)
return;
}
+ BUG_ON(!tclass || tclass >= ARRAY_SIZE(secclass_map));
perms = secclass_map[tclass-1].perms;
audit_log_format(ab, " {");
@@ -149,7 +150,7 @@ static void avc_dump_query(struct audit_buffer *ab, u32 ssid, u32 tsid, u16 tcla
kfree(scontext);
}
- BUG_ON(tclass >= ARRAY_SIZE(secclass_map));
+ BUG_ON(!tclass || tclass >= ARRAY_SIZE(secclass_map));
audit_log_format(ab, " tclass=%s", secclass_map[tclass-1].name);
}
--
2.1.0
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH] selinux: Augment BUG_ON assertion for secclass_map.
2015-06-15 17:27 [PATCH] selinux: Augment BUG_ON assertion for secclass_map Stephen Smalley
@ 2015-06-18 19:25 ` Paul Moore
0 siblings, 0 replies; 2+ messages in thread
From: Paul Moore @ 2015-06-18 19:25 UTC (permalink / raw
To: Stephen Smalley; +Cc: selinux
On Monday, June 15, 2015 01:27:10 PM Stephen Smalley wrote:
> Ensure that we catch any cases where tclass == 0.
>
> Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
> ---
> security/selinux/avc.c | 3 ++-
> 1 file changed, 2 insertions(+), 1 deletion(-)
Applied to SELinux next-queue, thanks.
At some point we should go through the SELinux code and take a closer look at
these BUG/BUG_ON statements; it would be nice to have safety/notification
checks that aren't dependent on Kconfig options which can be disabled.
> diff --git a/security/selinux/avc.c b/security/selinux/avc.c
> index 3c17dda..dcb8b0f 100644
> --- a/security/selinux/avc.c
> +++ b/security/selinux/avc.c
> @@ -101,6 +101,7 @@ static void avc_dump_av(struct audit_buffer *ab, u16
> tclass, u32 av) return;
> }
>
> + BUG_ON(!tclass || tclass >= ARRAY_SIZE(secclass_map));
> perms = secclass_map[tclass-1].perms;
>
> audit_log_format(ab, " {");
> @@ -149,7 +150,7 @@ static void avc_dump_query(struct audit_buffer *ab, u32
> ssid, u32 tsid, u16 tcla kfree(scontext);
> }
>
> - BUG_ON(tclass >= ARRAY_SIZE(secclass_map));
> + BUG_ON(!tclass || tclass >= ARRAY_SIZE(secclass_map));
> audit_log_format(ab, " tclass=%s", secclass_map[tclass-1].name);
> }
--
paul moore
www.paul-moore.com
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2015-06-18 19:25 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2015-06-15 17:27 [PATCH] selinux: Augment BUG_ON assertion for secclass_map Stephen Smalley
2015-06-18 19:25 ` Paul Moore
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.