回合上游社区补丁,补丁数量：10

回合如下10个补丁：<table ><tr><td colSpan="1" rowSpan="1">软件包</td><td colSpan="1" rowSpan="1">CommitId</td><td colSpan="1" rowSpan="1">描述</td><td colSpan="1" rowSpan="1">分析人</td></tr><tr><td colSpan="1" rowSpan="1">openEuler:libselinux</td><td colSpan="1" rowSpan="1">6e2f7033406aeccc1fb93e580be8120f113520a6</td><td colSpan="1" rowSpan="1">libselinux: avoid logs in get_ordered_context_list without policyIf no policy has been loaded yet and thus the current context is stillkernel avoid logging failures in get_ordered_context_list, like: get_ordered_context_list: error in processing configuration file /etc/selinux/debian/contexts/users/rootget_ordered_context_list: error in processing configuration file /etc/selinux/debian/contexts/default_contexts Move the context parsing from get_context_user failure and not logged. The command line option -d is not supported, drop from usage message. In case the specfiles have very long paths or there are too many abortinstead of writing past the stack buffer. In case the init function for a selabel backend fails, free the possiblealready allocated data: Direct leak of 16 byte#1 0x7233764baa65 in selabel_media_init /home/christian/Coding/workspaces/selinux/libselinux/src/label_media.c:226:30#2 0x7233764ac1fe in selabel_open /home/christian/Coding/workspaces/selinux/libselinux/src/label.c:227:6#3 0x5e7e2bf3ebfc in main /home/christian/Coding/workspaces/selinux/libselinux/utils/selabel_digest.c:125:8#4 0x7233761856c9 in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16 SUMMARY: AddressSanitizer: 16 byte. In case scandir finds no entries still free the returned result toavoid leaking it. Also do not override errno in case of a failure. Reported.by: Cppcheck Since commit 5876aca0 the close handler of label backends must support partial initializedstate, e.g. -&gt;data being NULL. Thus checks for NULL were added, but intwo cases the pointers in question were already dereferenced before. Reorder the dereference after the NULL-checks. Fixes segfault in selabel_open: $ sestatusSELinux status: disabled $ cat /etc/selinux/configcat: /etc/selinux/config: No such file or directory $ matchpathcon /abc[1] 907999 segmentation fault matchpathcon /abc Fixes:Error: RESOURCE_LEAK { Free the allocated line if it fails to parse via process_line for theX or media database. Also declare the line_buf parameter of process_line const, so it ismore obvious it is not modified or free&#x27;d. In selinux_restorecon_set_sehandle before setting the new one. </td></tr></table>
**二、缺陷分析结构反馈**
影响性分析说明：

缺陷严重等级:(Critical/High/Moderate/Low)

缺陷根因说明:

受影响版本排查(受影响/不受影响):
openEuler-20.03-LTS-SP4
openEuler-22.03-LTS-SP3
openEuler-22.03-LTS-SP4
openEuler-24.03-LTS
openEuler-24.03-LTS-SP1

修复是否涉及abi变化(是/否):
openEuler-20.03-LTS-SP4
openEuler-22.03-LTS-SP3
openEuler-22.03-LTS-SP4
openEuler-24.03-LTS
openEuler-24.03-LTS-SP1

src-openEuler/libselinux
关闭

内容风险标识

评论 (3)

src-openEuler/libselinux关闭 .gitee-modal { width: 500px !important; }

内容风险标识