[libvirt PATCH] security: fix SELinux label generation logic

[Peter Krempa]

On Wed, Jun 30, 2021 at 11:03:12 +0100, Daniel P. Berrangé wrote:
> A process can access a file if the set of MCS categories
> for the file is equal-to *or* a subset-of, the set of
> MCS categories for the process.
> 
> If there are two VMs:
> 
>   a) svirt_t:s0:c117
>   b) svirt_t:s0:c117,c720
> 
> Then VM (b) is able to access files labelled for VM (a).
> 
> IOW, we must discard case where the categories are equal
> because that is a subset of many other valid category pairs.
> 
> Fixes: https://gitlab.com/libvirt/libvirt/-/issues/153
> CVE-2021-xxxx - tbd before pushing
> Signed-off-by: Daniel P. Berrangé <berrange at redhat.com>
> ---
>  src/security/security_selinux.c | 10 +++++++++-
>  1 file changed, 9 insertions(+), 1 deletion(-)
> 
> diff --git a/src/security/security_selinux.c b/src/security/security_selinux.c
> index b50f4463cc..c98dab0d6f 100644
> --- a/src/security/security_selinux.c
> +++ b/src/security/security_selinux.c
> @@ -383,7 +383,15 @@ virSecuritySELinuxMCSFind(virSecurityManager *mgr,
>          VIR_DEBUG("Try cat %s:c%d,c%d", sens, c1 + catMin, c2 + catMin);
>  
>          if (c1 == c2) {
> -            mcs = g_strdup_printf("%s:c%d", sens, catMin + c1);
> +            /*
> +             * A process can access a file if the set of MCS categories
> +             * for the file is equal-to *or* a subset-of, the set of
> +             * MCS categories for the process.
> +             *
> +             * IOW, we must discard case where the categories are equal
> +             * because that is a subset of other category pairs.
> +             */
> +            continue

Missing ';'

>          } else {
>              if (c1 > c2) {
>                  int t = c1;

This algorithm seems to be susceptible to infinite loops in case when
'catMin' and 'catMax' are too close or there's already enough of them
taken. Not a problem with this patch per-se, but it makes it more
likely.