• James Carter's avatar
    libsepol/cil: Improve degenerate inheritance check · 37863b0b
    James Carter authored
    The commit 74d00a8d (libsepol/cil:
    Detect degenerate inheritance and exit with an error) detects the
    use of inheritance (mostly by the secilc-fuzzer and not in any real
    policies) that results in the exponential growth of the policy through
    the copying of blocks that takes place with inheritance in CIL.
    Unfortunately, the check takes place during the pass when all the
    blocks are being copied, so it is possible to consume all of a system's
    memory before an error is produced.
    
    The new check happens in two parts. First, a check is made while the
    block inheritance is being linked to the block it will inherit. In
    this check, all of the parent nodes of the inheritance rule up to the
    root node are checked and if enough of these blocks are being inherited
    (>= CIL_DEGENERATE_INHERITANCE_DEPTH), then a flag is set for a more
    in-depth check after the pass. This in-depth check will determine the
    number of potential inheritances that will occur when resolving the
    all of the inheritance rules. If this value is greater than
    CIL_DEGENERATE_INHERITANCE_GROWTH * the original number of inheritance
    rules and greater than CIL_DEGENERATE_INHERITANCE_MINIMUM (which is
    set to 0x1 << CIL_DEGENERATE_INHERITANCE_DEPTH), then degenerate
    inheritance is determined to have occurred and an error result will
    be returned.
    
    Since the potential number of inheritances can quickly be an extremely
    large number, the count of potential inheritances is aborted as soon
    as the threshold for degenerate inheritance has been exceeded.
    
    Normal policies should rarely, if ever, have the in-depth check occur.
    Signed-off-by: default avatarJames Carter <jwcart2@gmail.com>
    Acked-by: default avatarNicolas Iooss <nicolas.iooss@m4x.org>
    37863b0b
Name
Last commit
Last update
.circleci Loading commit data...
.github/workflows Loading commit data...
checkpolicy Loading commit data...
dbus Loading commit data...
gui Loading commit data...
libselinux Loading commit data...
libsemanage Loading commit data...
libsepol Loading commit data...
mcstrans Loading commit data...
policycoreutils Loading commit data...
python Loading commit data...
restorecond Loading commit data...
sandbox Loading commit data...
scripts Loading commit data...
secilc Loading commit data...
semodule-utils Loading commit data...
.gitignore Loading commit data...
.travis.yml Loading commit data...
CONTRIBUTING.md Loading commit data...
CleanSpec.mk Loading commit data...
Makefile Loading commit data...
README.md Loading commit data...
VERSION Loading commit data...
lgtm.yml Loading commit data...