diff options
| author |   Ondrej Mosnacek <omosnace@redhat.com> | 2018-11-30 16:24:07 +0100 |
|---|---|---|
| committer |   Paul Moore <paul@paul-moore.com> | 2018-12-05 15:36:12 -0500 |
| commit | 24ed7fdae669feda4c5e0dadba2467c4c0d297d3 (patch) | |
| tree | a26c76596744dab9c762d6d5915e9dc67b20e906 /security/selinux/ss/policydb.c | |
| parent | selinux: make "selinux_policycap_names[]" const char * (diff) | |
| download | linux-dev-24ed7fdae669feda4c5e0dadba2467c4c0d297d3.tar.xz linux-dev-24ed7fdae669feda4c5e0dadba2467c4c0d297d3.zip | |
selinux: use separate table for initial SID lookup
This moves handling of initial SIDs into a separate table. Note that the
SIDs stored in the main table are now shifted by SECINITSID_NUM and
converted to/from the actual SIDs transparently by helper functions.
This change doesn't make much sense on its own, but it simplifies
further sidtab overhaul in a succeeding patch.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
Reviewed-by: Stephen Smalley <sds@tycho.nsa.gov>
[PM: fixed some checkpatch warnings on line length, whitespace]
Signed-off-by: Paul Moore <paul@paul-moore.com>
Diffstat (limited to 'security/selinux/ss/policydb.c')
| -rw-r--r-- | security/selinux/ss/policydb.c | 10 |
1 files changed, 9 insertions, 1 deletions
diff --git a/security/selinux/ss/policydb.c b/security/selinux/ss/policydb.c index b63ef865ce1e..a50d625e7946 100644 --- a/security/selinux/ss/policydb.c +++ b/security/selinux/ss/policydb.c @@ -909,13 +909,21 @@ int policydb_load_isids(struct policydb *p, struct sidtab *s) if (!c->context[0].user) { pr_err("SELinux: SID %s was never defined.\n", c->u.name); + sidtab_destroy(s); + goto out; + } + if (c->sid[0] == SECSID_NULL || c->sid[0] > SECINITSID_NUM) { + pr_err("SELinux: Initial SID %s out of range.\n", + c->u.name); + sidtab_destroy(s); goto out; } - rc = sidtab_insert(s, c->sid[0], &c->context[0]); + rc = sidtab_set_initial(s, c->sid[0], &c->context[0]); if (rc) { pr_err("SELinux: unable to load initial SID %s.\n", c->u.name); + sidtab_destroy(s); goto out; } } |