selinux: bounds-check role and user membership bitmaps at load

role->dominates, role->types and user->roles are read as ebitmaps but
their set bits are never checked against the role and type symbol
tables. A bit naming an undefined value is silently accepted, and an
out-of-range one is used to index those tables later; in particular
role_bounds_sanity_check() passes such a bit straight to sym_name(),
reading p->sym_val_to_name[] out of bounds on a crafted bounded role.

Validate the three bitmaps in policydb_index() once every symbol table
is populated (roles are read before types, so this cannot be done in
role_read()).

Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
Acked-by: Stephen Smalley <stephen.smalley.work@gmail.com>
Signed-off-by: Paul Moore <paul@paul-moore.com>

0 files changed, 0 insertions, 0 deletions