diff options
| author | Christian Göttsche <cgzones@googlemail.com> | 2026-09-28 18:52:51 +0200 |
|---|---|---|
| committer | Paul Moore <paul@paul-moore.com> | 2026-09-30 16:59:43 -0400 |
| commit | 167d70651df872adcb37ab8317b837eb3a47d824 (patch) | |
| tree | 65aa102352adff4439308c821bb0ecf305c26610 /security | |
| parent | d0e7866390ad1ae2cf24c8d3bf9856e44fd135b5 (diff) | |
selinux: validate user MLS range and default level at load
user_read() reads each user's MLS range and default level but, unlike
range transitions and security contexts, never validates them.
Validate usr->range and usr->dfltlevel in user_index_check() when MLS is
enabled, once the level and category symbol tables are populated.
Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
Acked-by: Stephen Smalley <stephen.smalley.work@gmail.com>
Signed-off-by: Paul Moore <paul@paul-moore.com>
Diffstat (limited to 'security')
| -rw-r--r-- | security/selinux/ss/policydb.c | 14 |
1 files changed, 14 insertions, 0 deletions
diff --git a/security/selinux/ss/policydb.c b/security/selinux/ss/policydb.c index e0304297def4..e51293e3ca8c 100644 --- a/security/selinux/ss/policydb.c +++ b/security/selinux/ss/policydb.c @@ -748,6 +748,20 @@ static int user_index_check(void *key, void *datum, void *datap) } } + if (p->mls_enabled) { + if (!mls_range_isvalid(p, &usr->range)) { + pr_err("SELinux: user %s has an invalid MLS range\n", + (const char *)key); + return -EINVAL; + } + + if (!mls_level_isvalid(p, &usr->dfltlevel)) { + pr_err("SELinux: user %s has an invalid MLS default level\n", + (const char *)key); + return -EINVAL; + } + } + return 0; } |