Re: [PATCH v2 1/2] selinux: reject a permission value exceeding the class permission count

On Jul 27, 2026 Bryam Vargas <[email protected]> wrote:
> 
> perm_read() bounds a permission value by SEL_VEC_MAX but never by the
> nprim of the owning class or common, which is taken verbatim from the
> policy image.  security_get_permissions() then writes perms[value - 1]
> into an nprim-sized kcalloc() array, so a class declaring fewer
> permissions than its largest permission value drives an out-of-bounds
> heap write.  The top-level symbol tables are validated this way; the
> nested per-class permission table is not.
> 
> Reject a permission whose value exceeds nprim, which is already set when
> perm_read() runs.  Well-formed policies are unaffected.
> 
> Fixes: 55fcf09b3fe4 ("selinux: add support for querying object classes and permissions from the running policy")
> Cc: [email protected]
> Signed-off-by: Bryam Vargas <[email protected]>
> Acked-by: Stephen Smalley <[email protected]>
> ---
>  security/selinux/ss/policydb.c | 3 +++
>  1 file changed, 3 insertions(+)

Merged into selinux/stable-7.2, thanks!

--
paul-moore.com