[libselinux/f18] Fix memory leak in label_file, which is effecting virt
Daniel J Walsh
dwalsh at fedoraproject.org
Mon Jan 28 16:35:15 UTC 2013
commit dc169affea3f7c7a364c3cc44feea06e76537b0f
Author: Dan Walsh <dwalsh at redhat.com>
Date: Mon Jan 28 11:34:51 2013 -0500
Fix memory leak in label_file, which is effecting virt
- Clean up closeonexec calls
- Return ENOTSUP rather then EOPNOTSUPP for getfilecon calls
- Fix potential crash in mappings handling
libselinux-f19.patch | 242 ++++++++++++++++++++++++++++++++++++++++++++++++++
libselinux.spec | 66 ++++++++------
2 files changed, 279 insertions(+), 29 deletions(-)
---
diff --git a/libselinux-f19.patch b/libselinux-f19.patch
new file mode 100644
index 0000000..1208c8d
--- /dev/null
+++ b/libselinux-f19.patch
@@ -0,0 +1,242 @@
+diff -up libselinux-2.1.12/src/avc_internal.c.f19 libselinux-2.1.12/src/avc_internal.c
+--- libselinux-2.1.12/src/avc_internal.c.f19 2013-01-28 11:25:30.569512383 -0500
++++ libselinux-2.1.12/src/avc_internal.c 2013-01-28 11:25:54.773617273 -0500
+@@ -60,13 +60,12 @@ int avc_netlink_open(int blocking)
+ int len, rc = 0;
+ struct sockaddr_nl addr;
+
+- fd = socket(PF_NETLINK, SOCK_RAW, NETLINK_SELINUX);
++ fd = socket(PF_NETLINK, SOCK_RAW | SOCK_CLOEXEC, NETLINK_SELINUX);
+ if (fd < 0) {
+ rc = fd;
+ goto out;
+ }
+
+- fcntl(fd, F_SETFD, FD_CLOEXEC);
+ if (!blocking && fcntl(fd, F_SETFL, O_NONBLOCK)) {
+ close(fd);
+ fd = -1;
+diff -up libselinux-2.1.12/src/fgetfilecon.c.f19 libselinux-2.1.12/src/fgetfilecon.c
+--- libselinux-2.1.12/src/fgetfilecon.c.f19 2013-01-28 11:27:01.333897679 -0500
++++ libselinux-2.1.12/src/fgetfilecon.c 2013-01-28 11:27:07.616923677 -0500
+@@ -39,7 +39,7 @@ int fgetfilecon_raw(int fd, security_con
+ out:
+ if (ret == 0) {
+ /* Re-map empty attribute values to errors. */
+- errno = EOPNOTSUPP;
++ errno = ENOTSUP;
+ ret = -1;
+ }
+ if (ret < 0)
+diff -up libselinux-2.1.12/src/getfilecon.c.f19 libselinux-2.1.12/src/getfilecon.c
+--- libselinux-2.1.12/src/getfilecon.c.f19 2013-01-28 11:26:28.091758897 -0500
++++ libselinux-2.1.12/src/getfilecon.c 2013-01-28 11:26:38.652803230 -0500
+@@ -39,7 +39,7 @@ int getfilecon_raw(const char *path, sec
+ out:
+ if (ret == 0) {
+ /* Re-map empty attribute values to errors. */
+- errno = EOPNOTSUPP;
++ errno = ENOTSUP;
+ ret = -1;
+ }
+ if (ret < 0)
+diff -up libselinux-2.1.12/src/label_file.c.f19 libselinux-2.1.12/src/label_file.c
+--- libselinux-2.1.12/src/label_file.c.f19 2013-01-28 11:21:12.946124274 -0500
++++ libselinux-2.1.12/src/label_file.c 2013-01-28 11:21:30.776251054 -0500
+@@ -245,6 +245,7 @@ static int load_mmap(struct selabel_hand
+ char *addr;
+ size_t len;
+ int stem_map_len, *stem_map;
++ struct mmap_area *mmap_area;
+
+ uint32_t *magic;
+ uint32_t *section_len;
+@@ -255,7 +256,7 @@ static int load_mmap(struct selabel_hand
+ return -1;
+
+ mmapfd = open(mmap_path, O_RDONLY | O_CLOEXEC);
+- if (!mmapfd)
++ if (mmapfd < 0)
+ return -1;
+
+ rc = fstat(mmapfd, &mmap_stat);
+@@ -281,13 +282,26 @@ static int load_mmap(struct selabel_hand
+ len += (sysconf(_SC_PAGE_SIZE) - 1);
+ len &= ~(sysconf(_SC_PAGE_SIZE) - 1);
+
++ mmap_area = malloc(sizeof(*mmap_area));
++ if (!mmap_area) {
++ close(mmapfd);
++ return -1;
++ }
++
+ addr = mmap(NULL, len, PROT_READ, MAP_PRIVATE, mmapfd, 0);
+ close(mmapfd);
+ if (addr == MAP_FAILED) {
++ free(mmap_area);
+ perror("mmap");
+ return -1;
+ }
+
++ /* save where we mmap'd the file to cleanup on close() */
++ mmap_area->addr = addr;
++ mmap_area->len = len;
++ mmap_area->next = data->mmap_areas;
++ data->mmap_areas = mmap_area;
++
+ /* check if this looks like an fcontext file */
+ magic = (uint32_t *)addr;
+ if (*magic != SELINUX_MAGIC_COMPILED_FCONTEXT)
+@@ -330,8 +344,10 @@ static int load_mmap(struct selabel_hand
+ newid = find_stem(data, buf, stem_len);
+ if (newid < 0) {
+ newid = store_stem(data, buf, stem_len);
+- if (newid < 0)
+- return newid;
++ if (newid < 0) {
++ rc = newid;
++ goto err;
++ }
+ data->stem_arr[newid].from_mmap = 1;
+ }
+ stem_map[i] = newid;
+@@ -347,7 +363,7 @@ static int load_mmap(struct selabel_hand
+
+ rc = grow_specs(data);
+ if (rc < 0)
+- return rc;
++ goto err;
+
+ spec = &data->spec_arr[data->nspec];
+ spec->from_mmap = 1;
+@@ -355,9 +371,11 @@ static int load_mmap(struct selabel_hand
+
+ plen = (uint32_t *)addr;
+ addr += sizeof(uint32_t);
++ rc = -1;
+ spec->lr.ctx_raw = strdup((char *)addr);
+ if (!spec->lr.ctx_raw)
+- return -1;
++ goto err;
++
+ addr += *plen;
+
+ plen = (uint32_t *)addr;
+@@ -370,12 +388,10 @@ static int load_mmap(struct selabel_hand
+
+ /* map the stem id from the mmap file to the data->stem_arr */
+ stem_id = *(int32_t *)addr;
+- if (stem_id == -1) {
++ if (stem_id == -1 || stem_id >= stem_map_len)
+ spec->stem_id = -1;
+- } else {
+- assert(stem_id <= stem_map_len);
++ else
+ spec->stem_id = stem_map[stem_id];
+- }
+ addr += sizeof(int32_t);
+
+ /* retrieve the hasMetaChars bit */
+@@ -395,11 +411,12 @@ static int load_mmap(struct selabel_hand
+
+ data->nspec++;
+ }
+-
++ /* win */
++ rc = 0;
++err:
+ free(stem_map);
+
+- /* win */
+- return 0;
++ return rc;
+ }
+
+ static int process_file(const char *path, const char *suffix, struct selabel_handle *rec, const char *prefix)
+@@ -529,18 +546,19 @@ finish:
+ static void closef(struct selabel_handle *rec)
+ {
+ struct saved_data *data = (struct saved_data *)rec->data;
++ struct mmap_area *area, *last_area;
+ struct spec *spec;
+ struct stem *stem;
+ unsigned int i;
+
+ for (i = 0; i < data->nspec; i++) {
+ spec = &data->spec_arr[i];
++ free(spec->lr.ctx_trans);
++ free(spec->lr.ctx_raw);
+ if (spec->from_mmap)
+ continue;
+ free(spec->regex_str);
+ free(spec->type_str);
+- free(spec->lr.ctx_raw);
+- free(spec->lr.ctx_trans);
+ if (spec->regcomp) {
+ pcre_free(spec->regex);
+ pcre_free_study(spec->sd);
+@@ -558,7 +576,14 @@ static void closef(struct selabel_handle
+ free(data->spec_arr);
+ if (data->stem_arr)
+ free(data->stem_arr);
+-
++
++ area = data->mmap_areas;
++ while (area) {
++ munmap(area->addr, area->len);
++ last_area = area;
++ area = area->next;
++ free(last_area);
++ }
+ free(data);
+ }
+
+diff -up libselinux-2.1.12/src/label_file.h.f19 libselinux-2.1.12/src/label_file.h
+--- libselinux-2.1.12/src/label_file.h.f19 2013-01-28 11:23:29.058943892 -0500
++++ libselinux-2.1.12/src/label_file.h 2013-01-28 11:23:42.335010763 -0500
+@@ -33,6 +33,13 @@ struct stem {
+ char from_mmap;
+ };
+
++/* Where we map the file in during selabel_open() */
++struct mmap_area {
++ void *addr;
++ size_t len;
++ struct mmap_area *next;
++};
++
+ /* Our stored configuration */
+ struct saved_data {
+ /*
+@@ -49,6 +56,7 @@ struct saved_data {
+ struct stem *stem_arr;
+ int num_stems;
+ int alloc_stems;
++ struct mmap_area *mmap_areas;
+ };
+
+ static inline pcre_extra *get_pcre_extra(struct spec *spec)
+diff -up libselinux-2.1.12/src/lgetfilecon.c.f19 libselinux-2.1.12/src/lgetfilecon.c
+--- libselinux-2.1.12/src/lgetfilecon.c.f19 2013-01-28 11:28:09.108175100 -0500
++++ libselinux-2.1.12/src/lgetfilecon.c 2013-01-28 11:28:16.215203869 -0500
+@@ -39,7 +39,7 @@ int lgetfilecon_raw(const char *path, se
+ out:
+ if (ret == 0) {
+ /* Re-map empty attribute values to errors. */
+- errno = EOPNOTSUPP;
++ errno = ENOTSUP;
+ ret = -1;
+ }
+ if (ret < 0)
+diff -up libselinux-2.1.12/src/mapping.c.f19 libselinux-2.1.12/src/mapping.c
+--- libselinux-2.1.12/src/mapping.c.f19 2013-01-28 11:27:45.646079743 -0500
++++ libselinux-2.1.12/src/mapping.c 2013-01-28 11:27:56.241122881 -0500
+@@ -66,7 +66,7 @@ selinux_set_mapping(struct security_clas
+ goto err2;
+
+ k = 0;
+- while (p_in->perms && p_in->perms[k]) {
++ while (p_in->perms[k]) {
+ /* An empty permission string skips ahead */
+ if (!*p_in->perms[k]) {
+ k++;
diff --git a/libselinux.spec b/libselinux.spec
index 43a057e..f0a5ae2 100644
--- a/libselinux.spec
+++ b/libselinux.spec
@@ -10,7 +10,7 @@
Summary: SELinux library and simple utilities
Name: libselinux
Version: 2.1.12
-Release: 7%{?dist}
+Release: 7.1%{?dist}
License: Public Domain
Group: System Environment/Libraries
Source: %{name}-%{version}.tgz
@@ -18,6 +18,7 @@ Source1: selinuxconlist.8
Source2: selinuxdefcon.8
Url: http://oss.tresys.com/git/selinux.git
Patch1: libselinux-rhat.patch
+Patch2: libselinux-f19.patch
BuildRequires: pkgconfig python-devel ruby-devel ruby libsepol-static >= %{libsepolver} swig pcre-devel
%if 0%{?with_python3}
BuildRequires: python3-devel
@@ -101,6 +102,7 @@ needed for developing SELinux applications.
%prep
%setup -q
%patch1 -p2 -b .rhat
+%patch2 -p1 -b .f19
%build
# To support building the Python wrapper against multiple Python runtimes
@@ -241,6 +243,12 @@ rm -rf %{buildroot}
%{ruby_sitearch}/selinux.so
%changelog
+* Mon Jan 28 2013 Dan Walsh <dwalsh at redhat.com> - 2.1.12-7.1
+- Fix memory leak in label_file, which is effecting virt
+- Clean up closeonexec calls
+- Return ENOTSUP rather then EOPNOTSUPP for getfilecon calls
+- Fix potential crash in mappings handling
+
* Thu Nov 1 2012 Dan Walsh <dwalsh at redhat.com> - 2.1.12-7
- Apply patch from eparis to fix leaked file descriptor in new labeling code
@@ -401,7 +409,7 @@ rm -rf %{buildroot}
* Cleanup Man pages
* merge freecon with getcon man page
-* Mon Dec 18 2011 Dan Walsh <dwalsh at redhat.com> - 2.1.8-5
+* Mon Dec 19 2011 Dan Walsh <dwalsh at redhat.com> - 2.1.8-5
- Add patch from Richard Haines
When selabel_lookup found an invalid context with validation enabled, it
always stated it was 'file_contexts' whether media, x, db or file.
@@ -558,7 +566,7 @@ context
by Dan Walsh.
* Update man pages for selinux_color_* functions by Richard Haines.
-* Wed Apr 5 2011 Dan Walsh <dwalsh at redhat.com> - 2.0.101-1
+* Wed Apr 6 2011 Dan Walsh <dwalsh at redhat.com> - 2.0.101-1
- Clean up patch to make handling of constructor cleanup more portable
* db_language object class support for selabel_lookup from KaiGai Kohei.
* Library destructors for thread local storage keys from Eamon Walsh.
@@ -607,10 +615,10 @@ pthread_key_delete, and is ignored.
- Update to upstream
* Thread local storage fixes from Eamon Walsh.
-* Wed Dec 2 2010 Dan Walsh <dwalsh at redhat.com> - 2.0.96-9
+* Sat Dec 4 2010 Dan Walsh <dwalsh at redhat.com> - 2.0.96-9
- Add /etc/tmpfiles.d support for /var/run/setrans
-* Sun Nov 24 2010 Dan Walsh <dwalsh at redhat.com> - 2.0.96-8
+* Wed Nov 24 2010 Dan Walsh <dwalsh at redhat.com> - 2.0.96-8
- Ghost /var/run/setrans
* Wed Sep 29 2010 jkeating - 2.0.96-7
@@ -643,7 +651,7 @@ pthread_key_delete, and is ignored.
* Wed Mar 24 2010 Dan Walsh <dwalsh at redhat.com> - 2.0.94-1
* Set errno=EINVAL for invalid contexts from Dan Walsh.
-* Sun Mar 16 2010 Dan Walsh <dwalsh at redhat.com> - 2.0.93-1
+* Tue Mar 16 2010 Dan Walsh <dwalsh at redhat.com> - 2.0.93-1
- Update to upstream
* Show strerror for security_getenforce() by Colin Waters.
* Merged selabel database support by KaiGai Kohei.
@@ -1172,23 +1180,23 @@ pthread_key_delete, and is ignored.
* Merged patch to drop support for old /etc/sysconfig/selinux and
/etc/security policy file layout from Steve Grubb.
-* Tue Mar 8 2007 Dan Walsh <dwalsh at redhat.com> - 2.0.5-2
+* Thu Mar 8 2007 Dan Walsh <dwalsh at redhat.com> - 2.0.5-2
- Do not fail on permission denied in getsebool
* Tue Feb 27 2007 Dan Walsh <dwalsh at redhat.com> - 2.0.5-1
- Upgrade to upstream
* Merged init_selinuxmnt() and is_selinux_enabled() improvements from Steve Grubb.
-* Fri Feb 21 2007 Dan Walsh <dwalsh at redhat.com> - 2.0.4-1
+* Wed Feb 21 2007 Dan Walsh <dwalsh at redhat.com> - 2.0.4-1
- Upgrade to upstream
* Removed sending of setrans init message.
* Merged matchpathcon memory leak fix from Steve Grubb.
-* Thu Feb 20 2007 Dan Walsh <dwalsh at redhat.com> - 2.0.2-1
+* Tue Feb 20 2007 Dan Walsh <dwalsh at redhat.com> - 2.0.2-1
- Upgrade to upstream
* Merged more swig initializers from Dan Walsh.
-* Tue Feb 20 2007 Dan Walsh <dwalsh at redhat.com> - 2.0.1-1
+* Sun Feb 18 2007 Dan Walsh <dwalsh at redhat.com> - 2.0.1-1
- Upgrade to upstream
* Merged patch from Todd Miller to convert int types over to C99 style.
@@ -1208,7 +1216,8 @@ pthread_key_delete, and is ignored.
* Wed Jan 17 2007 Dan Walsh <dwalsh at redhat.com> - 1.33.6-1
- Upgrade to upstream
* Merged man page updates to make "apropos selinux" work from Dan Walsh.
-* Wed Jan 15 2007 Dan Walsh <dwalsh at redhat.com> - 1.33.5-1
+
+* Wed Jan 17 2007 Dan Walsh <dwalsh at redhat.com> - 1.33.5-1
- Upgrade to upstream
* Merged getdefaultcon utility from Dan Walsh.
@@ -1274,7 +1283,7 @@ Resolves: #200110
* Wed Sep 27 2006 Jeremy Katz <katzj at redhat.com> - 1.30.28-3
- really make -devel depend on libsepol-devel
-* Wed Sep 25 2006 Dan Walsh <dwalsh at redhat.com> - 1.30.28-2
+* Wed Sep 27 2006 Dan Walsh <dwalsh at redhat.com> - 1.30.28-2
- Add sgrubb patch for polmatch
* Wed Sep 13 2006 Dan Walsh <dwalsh at redhat.com> - 1.30.28-1
@@ -1441,7 +1450,7 @@ Resolves: #200110
a regular file.
* Merged python binding t_output_helper removal patch from Dan Walsh.
-* Mon Apr 11 2006 Dan Walsh <dwalsh at redhat.com> 1.30.1-2
+* Tue Apr 11 2006 Dan Walsh <dwalsh at redhat.com> 1.30.1-2
- Fix python bindings for matchpathcon
- Fix booleans man page
@@ -1476,7 +1485,7 @@ Resolves: #200110
- Upgrade to latest from NSA
* Added getseuser test program.
-* Fri Jan 7 2006 Dan Walsh <dwalsh at redhat.com> 1.29.4-1
+* Fri Jan 6 2006 Dan Walsh <dwalsh at redhat.com> 1.29.4-1
- Upgrade to latest from NSA
* Added format attribute to myprintf in matchpathcon.c and
removed obsoleted rootlen variable in init_selinux_config().
@@ -1682,13 +1691,13 @@ Resolves: #200110
- Update to latest from NSA
- Add getseuserbyname
-* Fri Sep 12 2005 Dan Walsh <dwalsh at redhat.com> 1.26-6
+* Fri Sep 16 2005 Dan Walsh <dwalsh at redhat.com> 1.26-6
- Fix patch call
-* Tue Sep 12 2005 Dan Walsh <dwalsh at redhat.com> 1.26-5
+* Tue Sep 13 2005 Dan Walsh <dwalsh at redhat.com> 1.26-5
- Fix strip_con call
-* Tue Sep 12 2005 Dan Walsh <dwalsh at redhat.com> 1.26-3
+* Tue Sep 13 2005 Dan Walsh <dwalsh at redhat.com> 1.26-3
- Go back to original libsetrans code
* Mon Sep 12 2005 Dan Walsh <dwalsh at redhat.com> 1.26-2
@@ -1754,13 +1763,13 @@ Resolves: #200110
* Changed security_load_booleans to process booleans.local
even if booleans file doesn't exist.
-* Fri Apr 26 2005 Dan Walsh <dwalsh at redhat.com> 1.23.10-3
+* Fri Apr 29 2005 Dan Walsh <dwalsh at redhat.com> 1.23.10-3
- Fix avcstat to clear totals
-* Fri Apr 26 2005 Dan Walsh <dwalsh at redhat.com> 1.23.10-2
+* Fri Apr 29 2005 Dan Walsh <dwalsh at redhat.com> 1.23.10-2
- Add info to man page
-* Fri Apr 26 2005 Dan Walsh <dwalsh at redhat.com> 1.23.10-1
+* Fri Apr 29 2005 Dan Walsh <dwalsh at redhat.com> 1.23.10-1
- Update from NSA
* Merged set_selinuxmnt patch from Bill Nottingham (Red Hat).
* Rewrote get_ordered_context_list and helpers, including
@@ -1875,7 +1884,7 @@ Resolves: #200110
* Mon Jan 24 2005 Dan Walsh <dwalsh at redhat.com> 1.21.1-3
- rpmexeccon should not fail in permissive mode.
-* Fri Jan 20 2005 Dan Walsh <dwalsh at redhat.com> 1.21.1-2
+* Fri Jan 21 2005 Dan Walsh <dwalsh at redhat.com> 1.21.1-2
- fix printf in avcstat
* Thu Jan 20 2005 Dan Walsh <dwalsh at redhat.com> 1.21.1-1
@@ -2039,7 +2048,7 @@ Resolves: #200110
- Update from NSA
- Add optflags
-* Fri Aug 26 2004 Dan Walsh <dwalsh at redhat.com> 1.17.3-1
+* Fri Aug 27 2004 Dan Walsh <dwalsh at redhat.com> 1.17.3-1
- Update from NSA
* Thu Aug 26 2004 Dan Walsh <dwalsh at redhat.com> 1.17.2-1
@@ -2081,7 +2090,7 @@ Resolves: #200110
* Thu Aug 12 2004 Dan Walsh <dwalsh at redhat.com> 1.15.3-2
- Add man page for boolean functions and SELinux
-* Sat Aug 8 2004 Dan Walsh <dwalsh at redhat.com> 1.15.3-1
+* Sun Aug 8 2004 Dan Walsh <dwalsh at redhat.com> 1.15.3-1
- Latest from NSA
* Mon Jul 19 2004 Dan Walsh <dwalsh at redhat.com> 1.15.2-1
@@ -2107,7 +2116,7 @@ Resolves: #200110
* Tue Jun 15 2004 Elliot Lee <sopwith at redhat.com>
- rebuilt
-* Sat Jun 13 2004 Dan Walsh <dwalsh at redhat.com> 1.13.3-2
+* Sun Jun 13 2004 Dan Walsh <dwalsh at redhat.com> 1.13.3-2
- Fix selinux_config to break once it finds SELINUXTYPE.
* Fri May 28 2004 Dan Walsh <dwalsh at redhat.com> 1.13.2-1
@@ -2119,7 +2128,7 @@ Resolves: #200110
* Mon May 17 2004 Dan Walsh <dwalsh at redhat.com> 1.12-2
- add man patch
-* Thu May 14 2004 Dan Walsh <dwalsh at redhat.com> 1.12-1
+* Fri May 14 2004 Dan Walsh <dwalsh at redhat.com> 1.12-1
- Update with latest from NSA
* Wed May 5 2004 Dan Walsh <dwalsh at redhat.com> 1.11.4-1
@@ -2211,7 +2220,7 @@ Resolves: #200110
* Mon Oct 27 2003 Dan Walsh <dwalsh at redhat.com> 1.3-2
- Fix x86_64 build
-* Wed Oct 21 2003 Dan Walsh <dwalsh at redhat.com> 1.3-1
+* Wed Oct 22 2003 Dan Walsh <dwalsh at redhat.com> 1.3-1
- Latest tarball from NSA.
* Tue Oct 21 2003 Dan Walsh <dwalsh at redhat.com> 1.2-9
@@ -2235,12 +2244,11 @@ Resolves: #200110
* Fri Sep 12 2003 Dan Walsh <dwalsh at redhat.com> 1.2-3
- Update with latest from NSA.
-* Fri Aug 28 2003 Dan Walsh <dwalsh at redhat.com> 1.2-2
+* Thu Aug 28 2003 Dan Walsh <dwalsh at redhat.com> 1.2-2
- Fix to build on x86_64
* Thu Aug 21 2003 Dan Walsh <dwalsh at redhat.com> 1.2-1
- update for version 1.2
-* Wed May 27 2003 Dan Walsh <dwalsh at redhat.com> 1.0-1
+* Tue May 27 2003 Dan Walsh <dwalsh at redhat.com> 1.0-1
- Initial version
-
More information about the scm-commits
mailing list