From 785e80c4fc0804812a148977cf42ea1f626ecece Mon Sep 17 00:00:00 2001 From: Rob Crittenden Date: Tue, 28 Aug 2012 17:14:28 -0400 Subject: Restrict the SELinux user map user MLS value to 0-1023 https://fedorahosted.org/freeipa/ticket/3001 --- ipalib/plugins/selinuxusermap.py | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) (limited to 'ipalib/plugins/selinuxusermap.py') diff --git a/ipalib/plugins/selinuxusermap.py b/ipalib/plugins/selinuxusermap.py index e4cebc1e..d793987a 100644 --- a/ipalib/plugins/selinuxusermap.py +++ b/ipalib/plugins/selinuxusermap.py @@ -97,7 +97,8 @@ def validate_selinuxuser(ugettext, user): return _('Invalid SELinux user name, only a-Z and _ are allowed') if not mls or not regex_mls.match(mls): return _('Invalid MLS value, must match s[0-15](-s[0-15])') - if mcs and not regex_mcs.match(mcs): + m = regex_mcs.match(mcs) + if mcs and (not m or (m.group(3) and (int(m.group(3)) > 1023))): return _('Invalid MCS value, must match c[0-1023].c[0-1023] and/or c[0-1023]-c[0-c0123]') return None -- cgit