selinux: normalize input to /sys/fs/selinux/enforce

At present, one can write any signed integer value to
/sys/fs/selinux/enforce and it will be stored,
e.g. echo -1 > /sys/fs/selinux/enforce or echo 2 >
/sys/fs/selinux/enforce. This makes no real difference
to the kernel, since it only ever cares if it is zero or non-zero,
but some userspace code compares it with 1 to decide if SELinux
is enforcing, and this could confuse it. Only a process that is
already root and is allowed the setenforce permission in SELinux
policy can write to /sys/fs/selinux/enforce, so this is not considered
to be a security issue, but it should be fixed.

Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
Signed-off-by: Paul Moore <paul@paul-moore.com>

1 files changed, 4 insertions, 0 deletions

diff --git a/direct-append.c b/direct-append.c
index af7efb4..2b782ff 100644
--- a/direct-append.c
+++ b/direct-append.c
@@ -61,6 +61,10 @@ int main(int argc, char *argv[])
 	}
 
 	str = malloc(n_chars * sizeof(char));
+	if (!str) {
+		perror("malloc");
+		exit(EXIT_FAILURE);
+	}
 
 	for (i = 0; i < n_chars; i++)
 		str[i] = get_random_printable_char();