Re: [PATCH] selinux: reject a permission value exceeding the class permission count

[Stephen Smalley]

On Fri, Jul 24, 2026 at 11:48 AM Stephen Smalley
<stephen.smalley.work@xxxxxxxxx> wrote:
>
> On Fri, Jul 24, 2026 at 10:47 AM Bryam Vargas via B4 Relay
> <devnull+hexlabsecurity.proton.me@xxxxxxxxxx> wrote:
> >
> > From: Bryam Vargas <hexlabsecurity@xxxxxxxxx>
> >
> > perm_read() bounds a permission value by SEL_VEC_MAX but never by the
> > owning class or common's nprim, which is taken verbatim from the policy
> > image.  security_get_permissions() then writes perms[value - 1] into an
> > nprim-sized kcalloc() array, so a class declaring fewer permissions than
> > its largest permission value drives an out-of-bounds heap write.  The
> > top-level symbol tables are validated this way; the nested per-class
> > permission table is not.
> >
> > Reject a permission whose value exceeds nprim, which is already set when
> > perm_read() runs.  Well-formed policies are unaffected.
> >
> > Fixes: 55fcf09b3fe4 ("selinux: add support for querying object classes and permissions from the running policy")
> > Cc: stable@xxxxxxxxxxxxxxx
> > Signed-off-by: Bryam Vargas <hexlabsecurity@xxxxxxxxx>
>
> Acked-by: Stephen Smalley <stephen.smalley.work@xxxxxxxxx>
> but also see:
> https://lore.kernel.org/selinux/CAEjxPJ7YRgtOXrbPYar0qXAq=wNbOTTMS-EsU=9HKR1NQ3qA1g@xxxxxxxxxxxxxx/T/#me98ec932b314ae94242ed3af7ab74445d273cc7d

Also wondering to what extent this may overlap with this series that
was never fully merged:
https://lore.kernel.org/selinux/20250511173055.406906-15-cgoettsche@xxxxxxxxxxxxx/