linux-sg2042/security/selinux
Eric Paris 6931dfc9f3 [PATCH] selinux_sb_copy_data() should not require a whole page
Currently selinux_sb_copy_data requires an entire page be allocated to
*orig when the function is called.  This "requirement" is based on the fact
that we call copy_page(in_save, nosec_save) and in_save = orig when the
data is not FS_BINARY_MOUNTDATA.  This means that if a caller were to call
do_kern_mount with only about 10 bytes of options, they would get passed
here and then we would corrupt PAGE_SIZE - 10 bytes of memory (with all
zeros.)

Currently it appears all in kernel FS's use one page of data so this has
not been a problem.  An out of kernel FS did just what is described above
and it would almost always panic shortly after they tried to mount.  From
looking else where in the kernel it is obvious that this string of data
must always be null terminated.  (See example in do_mount where it always
zeros the last byte.) Thus I suggest we use strcpy in place of copy_page.
In this way we make sure the amount we copy is always less than or equal to
the amount we received and since do_mount is zeroing the last byte this
should be safe for all.

Signed-off-by: Eric Paris <eparis@parisplace.org>
Cc: Stephen Smalley <sds@epoch.ncsc.mil>
Acked-by: James Morris <jmorris@redhat.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
2005-06-30 08:45:09 -07:00
..
include [PATCH] selinux: add executable heap check 2005-06-25 16:24:26 -07:00
ss [PATCH] selinux: kfree cleanup 2005-06-25 16:25:00 -07:00
Kconfig Linux-2.6.12-rc2 2005-04-16 15:20:36 -07:00
Makefile Linux-2.6.12-rc2 2005-04-16 15:20:36 -07:00
avc.c AUDIT: Fix remaining cases of direct logging of untrusted strings by avc_audit 2005-05-24 21:28:28 +01:00
hooks.c [PATCH] selinux_sb_copy_data() should not require a whole page 2005-06-30 08:45:09 -07:00
netif.c Linux-2.6.12-rc2 2005-04-16 15:20:36 -07:00
netlink.c Linux-2.6.12-rc2 2005-04-16 15:20:36 -07:00
nlmsgtab.c [NETLINK]: Neighbour table configuration and statistics via rtnetlink 2005-06-18 22:50:55 -07:00
selinuxfs.c [PATCH] selinux: kfree cleanup 2005-06-25 16:25:00 -07:00