b158f13b17
Backport the source patches from the version 7.0.0-3+deb11u3. [https://sources.debian.org/src/libvirt/7.0.0-3%2Bdeb11u3/debian/patches/] Refer to: CVE-2021-3631: https://nvd.nist.gov/vuln/detail/CVE-2021-3631 CVE-2021-3667: https://nvd.nist.gov/vuln/detail/CVE-2021-3667 CVE-2021-3975: https://nvd.nist.gov/vuln/detail/CVE-2021-3975 CVE-2021-4147: https://nvd.nist.gov/vuln/detail/CVE-2021-4147 CVE-2022-0897: https://nvd.nist.gov/vuln/detail/CVE-2022-0897 CVE-2024-1441: https://nvd.nist.gov/vuln/detail/CVE-2024-1441 CVE-2024-2494: https://nvd.nist.gov/vuln/detail/CVE-2024-2494 CVE-2024-2496: https://nvd.nist.gov/vuln/detail/CVE-2024-2496 Test Plan: Pass: downloader Pass: build-pkgs --clean --all Pass: build-image Pass: Debian AIO jenkins installation Closes-Bug: 2078664 Signed-off-by: Wentao Zhang <wentao.zhang@windriver.com> Change-Id: Ic2c0d6a8208b18ec4d1db2c07fc1fb2508cef183
50 lines
1.9 KiB
Diff
50 lines
1.9 KiB
Diff
From: Daniel P. Berrangé <berrange@redhat.com>
|
|
Date: Mon, 28 Jun 2021 13:09:04 +0100
|
|
Subject: security: fix SELinux label generation logic
|
|
|
|
A process can access a file if the set of MCS categories
|
|
for the file is equal-to *or* a subset-of, the set of
|
|
MCS categories for the process.
|
|
|
|
If there are two VMs:
|
|
|
|
a) svirt_t:s0:c117
|
|
b) svirt_t:s0:c117,c720
|
|
|
|
Then VM (b) is able to access files labelled for VM (a).
|
|
|
|
IOW, we must discard case where the categories are equal
|
|
because that is a subset of many other valid category pairs.
|
|
|
|
Reviewed-by: Peter Krempa <pkrempa@redhat.com>
|
|
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
|
|
Origin: https://gitlab.com/libvirt/libvirt/-/commit/15073504dbb624d3f6c911e85557019d3620fdb2
|
|
Bug: https://gitlab.com/libvirt/libvirt/-/issues/153
|
|
Bug-Debian: https://security-tracker.debian.org/tracker/CVE-2021-3631
|
|
Bug-Debian: https://bugs.debian.org/990709
|
|
---
|
|
src/security/security_selinux.c | 10 +++++++++-
|
|
1 file changed, 9 insertions(+), 1 deletion(-)
|
|
|
|
diff --git a/src/security/security_selinux.c b/src/security/security_selinux.c
|
|
index 2fc6ef2..61a871e 100644
|
|
--- a/src/security/security_selinux.c
|
|
+++ b/src/security/security_selinux.c
|
|
@@ -389,7 +389,15 @@ virSecuritySELinuxMCSFind(virSecurityManagerPtr mgr,
|
|
VIR_DEBUG("Try cat %s:c%d,c%d", sens, c1 + catMin, c2 + catMin);
|
|
|
|
if (c1 == c2) {
|
|
- mcs = g_strdup_printf("%s:c%d", sens, catMin + c1);
|
|
+ /*
|
|
+ * A process can access a file if the set of MCS categories
|
|
+ * for the file is equal-to *or* a subset-of, the set of
|
|
+ * MCS categories for the process.
|
|
+ *
|
|
+ * IOW, we must discard case where the categories are equal
|
|
+ * because that is a subset of other category pairs.
|
|
+ */
|
|
+ continue;
|
|
} else {
|
|
if (c1 > c2) {
|
|
int t = c1;
|