libselinux/0007-libselinux-check-for-truncations.patch

183 lines
5.6 KiB
Diff
Raw Normal View History

From 1eb6229a48d2b8ca08a230e7c60176c56c5cb6d5 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Christian=20G=C3=B6ttsche?= <cgzones@googlemail.com>
Date: Tue, 7 Jun 2022 19:14:09 +0200
Subject: [PATCH] libselinux: check for truncations
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Content-type: text/plain
Check for truncations when building or copying strings involving user
input.
Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
---
libselinux/src/canonicalize_context.c | 6 +++++-
libselinux/src/compute_av.c | 8 +++++++-
libselinux/src/compute_create.c | 7 +++++++
libselinux/src/compute_member.c | 8 +++++++-
libselinux/src/compute_relabel.c | 8 +++++++-
libselinux/src/compute_user.c | 8 +++++++-
libselinux/src/selinux_restorecon.c | 11 ++++++++++-
libselinux/src/setrans_client.c | 8 +++++++-
8 files changed, 57 insertions(+), 7 deletions(-)
diff --git a/libselinux/src/canonicalize_context.c b/libselinux/src/canonicalize_context.c
index faab730592c2..6af8491dd4a6 100644
--- a/libselinux/src/canonicalize_context.c
+++ b/libselinux/src/canonicalize_context.c
@@ -33,7 +33,11 @@ int security_canonicalize_context_raw(const char * con,
ret = -1;
goto out;
}
- strncpy(buf, con, size);
+ if (strlcpy(buf, con, size) >= size) {
+ errno = EOVERFLOW;
+ ret = -1;
+ goto out2;
+ }
ret = write(fd, buf, strlen(buf) + 1);
if (ret < 0)
diff --git a/libselinux/src/compute_av.c b/libselinux/src/compute_av.c
index 9d17339d1a32..354a19e1051c 100644
--- a/libselinux/src/compute_av.c
+++ b/libselinux/src/compute_av.c
@@ -40,8 +40,14 @@ int security_compute_av_flags_raw(const char * scon,
}
kclass = unmap_class(tclass);
- snprintf(buf, len, "%s %s %hu %x", scon, tcon,
+
+ ret = snprintf(buf, len, "%s %s %hu %x", scon, tcon,
kclass, unmap_perm(tclass, requested));
+ if (ret < 0 || (size_t)ret >= len) {
+ errno = EOVERFLOW;
+ ret = -1;
+ goto out2;
+ }
ret = write(fd, buf, strlen(buf));
if (ret < 0)
diff --git a/libselinux/src/compute_create.c b/libselinux/src/compute_create.c
index 1d75714d852d..e9f3c96a1a6a 100644
--- a/libselinux/src/compute_create.c
+++ b/libselinux/src/compute_create.c
@@ -75,8 +75,15 @@ int security_compute_create_name_raw(const char * scon,
ret = -1;
goto out;
}
+
len = snprintf(buf, size, "%s %s %hu",
scon, tcon, unmap_class(tclass));
+ if (len < 0 || (size_t)len >= size) {
+ errno = EOVERFLOW;
+ ret = -1;
+ goto out2;
+ }
+
if (objname &&
object_name_encode(objname, buf + len, size - len) < 0) {
errno = ENAMETOOLONG;
diff --git a/libselinux/src/compute_member.c b/libselinux/src/compute_member.c
index 16234b7908f2..53d2f55950f6 100644
--- a/libselinux/src/compute_member.c
+++ b/libselinux/src/compute_member.c
@@ -36,7 +36,13 @@ int security_compute_member_raw(const char * scon,
ret = -1;
goto out;
}
- snprintf(buf, size, "%s %s %hu", scon, tcon, unmap_class(tclass));
+
+ ret = snprintf(buf, size, "%s %s %hu", scon, tcon, unmap_class(tclass));
+ if (ret < 0 || (size_t)ret >= size) {
+ errno = EOVERFLOW;
+ ret = -1;
+ goto out2;
+ }
ret = write(fd, buf, strlen(buf));
if (ret < 0)
diff --git a/libselinux/src/compute_relabel.c b/libselinux/src/compute_relabel.c
index dd20d6525993..9c0a2304f356 100644
--- a/libselinux/src/compute_relabel.c
+++ b/libselinux/src/compute_relabel.c
@@ -36,7 +36,13 @@ int security_compute_relabel_raw(const char * scon,
ret = -1;
goto out;
}
- snprintf(buf, size, "%s %s %hu", scon, tcon, unmap_class(tclass));
+
+ ret = snprintf(buf, size, "%s %s %hu", scon, tcon, unmap_class(tclass));
+ if (ret < 0 || (size_t)ret >= size) {
+ errno = EOVERFLOW;
+ ret = -1;
+ goto out2;
+ }
ret = write(fd, buf, strlen(buf));
if (ret < 0)
diff --git a/libselinux/src/compute_user.c b/libselinux/src/compute_user.c
index ae5e7b4a8f68..f55f945a01e0 100644
--- a/libselinux/src/compute_user.c
+++ b/libselinux/src/compute_user.c
@@ -38,7 +38,13 @@ int security_compute_user_raw(const char * scon,
ret = -1;
goto out;
}
- snprintf(buf, size, "%s %s", scon, user);
+
+ ret = snprintf(buf, size, "%s %s", scon, user);
+ if (ret < 0 || (size_t)ret >= size) {
+ errno = EOVERFLOW;
+ ret = -1;
+ goto out2;
+ }
ret = write(fd, buf, strlen(buf));
if (ret < 0)
diff --git a/libselinux/src/selinux_restorecon.c b/libselinux/src/selinux_restorecon.c
index 9f5b326c19ec..66e6a4a239d1 100644
--- a/libselinux/src/selinux_restorecon.c
+++ b/libselinux/src/selinux_restorecon.c
@@ -954,7 +954,16 @@ loop_body:
}
/* fall through */
default:
- strcpy(ent_path, ftsent->fts_path);
+ if (strlcpy(ent_path, ftsent->fts_path, sizeof(ent_path)) >= sizeof(ent_path)) {
+ selinux_log(SELINUX_ERROR,
+ "Path name too long on %s.\n",
+ ftsent->fts_path);
+ errno = ENAMETOOLONG;
+ state->error = -1;
+ state->abort = true;
+ goto finish;
+ }
+
ent_st = *ftsent->fts_statp;
if (state->parallel)
pthread_mutex_unlock(&state->mutex);
diff --git a/libselinux/src/setrans_client.c b/libselinux/src/setrans_client.c
index faa126813a77..920f9032c3f6 100644
--- a/libselinux/src/setrans_client.c
+++ b/libselinux/src/setrans_client.c
@@ -66,7 +66,13 @@ static int setransd_open(void)
memset(&addr, 0, sizeof(addr));
addr.sun_family = AF_UNIX;
- strncpy(addr.sun_path, SETRANS_UNIX_SOCKET, sizeof(addr.sun_path));
+
+ if (strlcpy(addr.sun_path, SETRANS_UNIX_SOCKET, sizeof(addr.sun_path)) >= sizeof(addr.sun_path)) {
+ close(fd);
+ errno = EOVERFLOW;
+ return -1;
+ }
+
if (connect(fd, (struct sockaddr *)&addr, sizeof(addr)) < 0) {
close(fd);
return -1;
--
2.38.1