From 2a63109872687aa271877a7037a2f43cb896a801 Mon Sep 17 00:00:00 2001 From: James Carter Date: Thu, 28 May 2020 14:40:56 -0400 Subject: [PATCH] libsepol: Sort portcon rules consistently The comparison function, portcon_data_cmp(), only made use of the protocol to put tcp before udp, dccp, and sctp. Rules that have the same port range, but with different protocols would be considered equal unless one of the protocols was tcp. When generating a CIL or conf source policy from a binary or using the "-S" option in checkpolicy the non-tcp portcon rules with the same port range would not be consistently sorted. Changed portcon_data_cmp() to sort portcon rules like the CIL function cil_post_portcon_compare(). Reported-by: Stephen Smalley Signed-off-by: James Carter Acked-by: Stephen Smalley --- libsepol/src/kernel_to_common.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/libsepol/src/kernel_to_common.c b/libsepol/src/kernel_to_common.c index 7b53c92f..a7453d3c 100644 --- a/libsepol/src/kernel_to_common.c +++ b/libsepol/src/kernel_to_common.c @@ -470,11 +470,9 @@ static int portcon_data_cmp(const void *a, const void *b) rc = compare_ranges((*aa)->u.port.low_port, (*aa)->u.port.high_port, (*bb)->u.port.low_port, (*bb)->u.port.high_port); if (rc == 0) { - if ((*aa)->u.port.protocol == (*bb)->u.port.protocol) { - rc = 0; - } else if ((*aa)->u.port.protocol == IPPROTO_TCP) { + if ((*aa)->u.port.protocol < (*bb)->u.port.protocol) { rc = -1; - } else { + } else if ((*aa)->u.port.protocol > (*bb)->u.port.protocol) { rc = 1; } }