Re: [PATCH] selinux: reject a permission value exceeding the class permission count

[Paul Moore]

On Fri, Jul 24, 2026 at 11:56 AM Stephen Smalley
<stephen.smalley.work@xxxxxxxxx> wrote:
> On Fri, Jul 24, 2026 at 11:48 AM Stephen Smalley
> <stephen.smalley.work@xxxxxxxxx> wrote:
> >
> > On Fri, Jul 24, 2026 at 10:47 AM Bryam Vargas via B4 Relay
> > <devnull+hexlabsecurity.proton.me@xxxxxxxxxx> wrote:
> > >
> > > From: Bryam Vargas <hexlabsecurity@xxxxxxxxx>
> > >
> > > perm_read() bounds a permission value by SEL_VEC_MAX but never by the
> > > owning class or common's nprim, which is taken verbatim from the policy
> > > image.  security_get_permissions() then writes perms[value - 1] into an
> > > nprim-sized kcalloc() array, so a class declaring fewer permissions than
> > > its largest permission value drives an out-of-bounds heap write.  The
> > > top-level symbol tables are validated this way; the nested per-class
> > > permission table is not.
> > >
> > > Reject a permission whose value exceeds nprim, which is already set when
> > > perm_read() runs.  Well-formed policies are unaffected.
> > >
> > > Fixes: 55fcf09b3fe4 ("selinux: add support for querying object classes and permissions from the running policy")
> > > Cc: stable@xxxxxxxxxxxxxxx
> > > Signed-off-by: Bryam Vargas <hexlabsecurity@xxxxxxxxx>
> >
> > Acked-by: Stephen Smalley <stephen.smalley.work@xxxxxxxxx>
> > but also see:
> > https://lore.kernel.org/selinux/CAEjxPJ7YRgtOXrbPYar0qXAq=wNbOTTMS-EsU=9HKR1NQ3qA1g@xxxxxxxxxxxxxx/T/#me98ec932b314ae94242ed3af7ab74445d273cc7d
>
> Also wondering to what extent this may overlap with this series that
> was never fully merged:
> https://lore.kernel.org/selinux/20250511173055.406906-15-cgoettsche@xxxxxxxxxxxxx/

FWIW, most of that patchset is has been merged, the individual patches
that haven't been merged were held back due to review comments.

-- 
paul-moore.com