External/libvirt
1
0
Fork 0
mirror of https://gitlab.com/libvirt/libvirt.git synced 2025-01-30 16:35:24 +00:00
Code Issues Packages Projects Releases Wiki Activity

selinux: assume 's0' if the range is empty

Browse Source 
This fixes a crash:
https://bugzilla.redhat.com/show_bug.cgi?id=969878
This commit is contained in:
Ján Tomko 2013-06-10 14:37:40 +02:00
parent e4f6fb04b7
commit 0b466db29b
2 changed files with 13 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
src/security/security_selinux.c
View File

@ -170,11 +170,13 @@ virSecuritySELinuxMCSFind(virSecurityManagerPtr mgr,
/*
* This needs to cope with several styles of range
*
* system_u:system_r:virtd_t
* system_u:system_r:virtd_t:s0
* system_u:system_r:virtd_t:s0-s0
* system_u:system_r:virtd_t:s0-s0:c0.c1023
*
* In the first two cases, we'll assume c0.c1023 for
* In the first case we'll assume s0:c0.c1023 and
* in the next two cases, we'll assume c0.c1023 for
* the category part, since that's what we're really
* interested in. This won't work in Enforcing mode,
* but will prevent libvirtd breaking in Permissive
@ -189,6 +191,7 @@ virSecuritySELinuxMCSGetProcessRange(char **sens,
context_t ourContext = NULL;
char *cat = NULL;
char *tmp;
const char *contextRange;
int ret = -1;
if (getcon_raw(&ourSecContext) < 0) {
@ -202,8 +205,10 @@ virSecuritySELinuxMCSGetProcessRange(char **sens,
ourSecContext);
goto cleanup;
}
if (!(contextRange = context_range_get(ourContext)))
contextRange = "s0";
if (VIR_STRDUP(*sens, context_range_get(ourContext)) < 0)
if (VIR_STRDUP(*sens, contextRange) < 0)
goto cleanup;
/* Find and blank out the category part (if any) */

6
tests/securityselinuxtest.c
View File

@ -333,6 +333,12 @@ mymain(void)
"system_u", "system_r", "object_r",
"svirt_t", "svirt_image_t",
2, 3, 0, 1023);
DO_TEST_GEN_LABEL("dynamic virtd, missing range",
"system_u:system_r:virtd_t",
true, NULL, NULL,
"system_u", "system_r", "object_r",
"svirt_t", "svirt_image_t",
0, 0, 0, 1023);
return (ret == 0) ? EXIT_SUCCESS : EXIT_FAILURE;
}