提交 e4c82eaf 编写于 作者: P Paul Moore

selinux: add proper NULL termination to the secclass_map permissions

This patch adds the missing NULL termination to the "bpf" and
"perf_event" object class permission lists.

This missing NULL termination should really only affect the tools
under scripts/selinux, with the most important being genheaders.c,
although in practice this has not been an issue on any of my dev/test
systems.  If the problem were to manifest itself it would likely
result in bogus permissions added to the end of the object class;
thankfully with no access control checks using these bogus
permissions and no policies defining these permissions the impact
would likely be limited to some noise about undefined permissions
during policy load.

Cc: stable@vger.kernel.org
Fixes: ec27c356 ("selinux: bpf: Add selinux check for eBPF syscall operations")
Fixes: da97e184 ("perf_event: Add support for LSM and SELinux checks")
Signed-off-by: NPaul Moore <paul@paul-moore.com>
上级 1fb057dc
...@@ -242,11 +242,12 @@ struct security_class_mapping secclass_map[] = { ...@@ -242,11 +242,12 @@ struct security_class_mapping secclass_map[] = {
{ "infiniband_endport", { "infiniband_endport",
{ "manage_subnet", NULL } }, { "manage_subnet", NULL } },
{ "bpf", { "bpf",
{"map_create", "map_read", "map_write", "prog_load", "prog_run"} }, { "map_create", "map_read", "map_write", "prog_load", "prog_run",
NULL } },
{ "xdp_socket", { "xdp_socket",
{ COMMON_SOCK_PERMS, NULL } }, { COMMON_SOCK_PERMS, NULL } },
{ "perf_event", { "perf_event",
{"open", "cpu", "kernel", "tracepoint", "read", "write"} }, { "open", "cpu", "kernel", "tracepoint", "read", "write", NULL } },
{ "lockdown", { "lockdown",
{ "integrity", "confidentiality", NULL } }, { "integrity", "confidentiality", NULL } },
{ "anon_inode", { "anon_inode",
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册