diff options
| author | Nick Kralevich <nnk@google.com> | 2015-08-08 14:46:58 +0000 |
|---|---|---|
| committer | Gerrit Code Review <noreply-gerritcodereview@google.com> | 2015-08-08 14:46:58 +0000 |
| commit | 2ef4270c9ba60b895ad9b9b9155fca9af5cc07a4 (patch) | |
| tree | 9d19a1362c5bbb9b19bb46a9c8668d35235e7d7c | |
| parent | 82216295fac4bb483624e7870b42ac9e95fc7889 (diff) | |
| parent | a4b36fa45f964b6d23bc7e12a7acb16ad4bcc624 (diff) | |
| download | libselinux-2ef4270c9ba60b895ad9b9b9155fca9af5cc07a4.tar.gz | |
Merge "libselinux: fail hard on invalid file_contexts entries"
| -rw-r--r-- | src/label_file.h | 20 |
1 files changed, 13 insertions, 7 deletions
diff --git a/src/label_file.h b/src/label_file.h index 3f19394..678f07c 100644 --- a/src/label_file.h +++ b/src/label_file.h @@ -392,12 +392,13 @@ static inline int process_line(struct selabel_handle *rec, return items; if (items < 2) { - selinux_log(SELINUX_WARNING, - "%s: line %u is missing fields, skipping\n", path, + selinux_log(SELINUX_ERROR, + "%s: line %u is missing fields\n", path, lineno); if (items == 1) free(regex); - return 0; + errno = EINVAL; + return -1; } else if (items == 2) { /* The type field is optional. */ context = type; @@ -424,10 +425,12 @@ static inline int process_line(struct selabel_handle *rec, spec_arr[nspec].regex_str = regex; if (rec->validating && compile_regex(data, &spec_arr[nspec], &errbuf)) { - selinux_log(SELINUX_WARNING, + selinux_log(SELINUX_ERROR, "%s: line %u has invalid regex %s: %s\n", path, lineno, regex, (errbuf ? errbuf : "out of memory")); + errno = EINVAL; + return -1; } /* Convert the type string to a mode format */ @@ -437,10 +440,11 @@ static inline int process_line(struct selabel_handle *rec, mode_t mode = string_to_mode(type); if (mode == (mode_t)-1) { - selinux_log(SELINUX_WARNING, + selinux_log(SELINUX_ERROR, "%s: line %u has invalid file type %s\n", path, lineno, type); - mode = 0; + errno = EINVAL; + return -1; } spec_arr[nspec].mode = mode; } @@ -453,9 +457,11 @@ static inline int process_line(struct selabel_handle *rec, if (strcmp(context, "<<none>>") && rec->validating) { if (selabel_validate(rec, &spec_arr[nspec].lr) < 0) { - selinux_log(SELINUX_WARNING, + selinux_log(SELINUX_ERROR, "%s: line %u has invalid context %s\n", path, lineno, spec_arr[nspec].lr.ctx_raw); + errno = EINVAL; + return -1; } } |