* [PATCH 1/4] libsepol: improve policy lookup failure message
@ 2024-04-08 15:07 Christian Göttsche
2024-04-08 15:08 ` [PATCH 2/4] checkpolicy/tests: add test for splitting xperm rule Christian Göttsche
` (3 more replies)
0 siblings, 4 replies; 6+ messages in thread
From: Christian Göttsche @ 2024-04-08 15:07 UTC (permalink / raw
To: selinux; +Cc: Christian Göttsche
From: Christian Göttsche <cgzones@googlemail.com>
If a policy version cannot be found include the policy target, and a
module prefix for non kernel policies in the message.
Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
---
libsepol/src/write.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/libsepol/src/write.c b/libsepol/src/write.c
index 283d11c8..2fcc1701 100644
--- a/libsepol/src/write.c
+++ b/libsepol/src/write.c
@@ -2252,8 +2252,10 @@ int policydb_write(policydb_t * p, struct policy_file *fp)
info = policydb_lookup_compat(p->policyvers, p->policy_type,
p->target_platform);
if (!info) {
- ERR(fp->handle, "compatibility lookup failed for policy "
- "version %d", p->policyvers);
+ ERR(fp->handle, "compatibility lookup failed for %s%s policy version %d",
+ p->target_platform == SEPOL_TARGET_SELINUX ? "selinux" : "xen",
+ p->policy_type == POLICY_KERN ? "" : " module",
+ p->policyvers);
return POLICYDB_ERROR;
}
--
2.43.0
^ permalink raw reply related [flat|nested] 6+ messages in thread
* [PATCH 2/4] checkpolicy/tests: add test for splitting xperm rule
2024-04-08 15:07 [PATCH 1/4] libsepol: improve policy lookup failure message Christian Göttsche
@ 2024-04-08 15:08 ` Christian Göttsche
2024-04-08 15:08 ` [PATCH 3/4] checkpolicy: declare file local variable static Christian Göttsche
` (2 subsequent siblings)
3 siblings, 0 replies; 6+ messages in thread
From: Christian Göttsche @ 2024-04-08 15:08 UTC (permalink / raw
To: selinux; +Cc: Christian Göttsche
From: Christian Göttsche <cgzones@googlemail.com>
An extended permission rule statement might get split into multiple
access vector rules, due to size limitations.
Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
---
checkpolicy/tests/policy_allonce.conf | 2 +-
checkpolicy/tests/policy_allonce.expected.conf | 4 +++-
checkpolicy/tests/policy_allonce.expected_opt.conf | 4 +++-
3 files changed, 7 insertions(+), 3 deletions(-)
diff --git a/checkpolicy/tests/policy_allonce.conf b/checkpolicy/tests/policy_allonce.conf
index 34e6402d..54a4c811 100644
--- a/checkpolicy/tests/policy_allonce.conf
+++ b/checkpolicy/tests/policy_allonce.conf
@@ -36,7 +36,7 @@ allow TYPE1 self : CLASS1 { PERM1 };
auditallow { TYPE1 TYPE2 } TYPE3 : CLASS1 { PERM1 };
dontaudit TYPE1 { TYPE2 TYPE3 } : CLASS3 { PERM1 CPERM1 };
neverallow TYPE1 TYPE2 : { CLASS2 CLASS3 } { CPERM1 };
-allowxperm TYPE1 TYPE2 : CLASS1 ioctl 0x1;
+allowxperm TYPE1 TYPE2 : CLASS1 ioctl { 0x456-0x5678 };
auditallowxperm TYPE1 TYPE2 : CLASS1 ioctl 0x2;
dontauditxperm TYPE1 TYPE2 : CLASS1 ioctl 0x3;
neverallowxperm TYPE1 TYPE2 : CLASS1 ioctl 0x4;
diff --git a/checkpolicy/tests/policy_allonce.expected.conf b/checkpolicy/tests/policy_allonce.expected.conf
index 63739e1f..aff6bfa3 100644
--- a/checkpolicy/tests/policy_allonce.expected.conf
+++ b/checkpolicy/tests/policy_allonce.expected.conf
@@ -34,7 +34,9 @@ auditallow TYPE1 TYPE3:CLASS1 { PERM1 };
auditallow TYPE2 TYPE3:CLASS1 { PERM1 };
dontaudit TYPE1 TYPE2:CLASS3 { CPERM1 PERM1 };
dontaudit TYPE1 TYPE3:CLASS3 { CPERM1 PERM1 };
-allowxperm TYPE1 TYPE2:CLASS1 ioctl { 0x1 };
+allowxperm TYPE1 TYPE2:CLASS1 ioctl { 0x456-0x4ff };
+allowxperm TYPE1 TYPE2:CLASS1 ioctl { 0x500-0x55ff };
+allowxperm TYPE1 TYPE2:CLASS1 ioctl { 0x5600-0x5678 };
auditallowxperm TYPE1 TYPE2:CLASS1 ioctl { 0x2 };
dontauditxperm TYPE1 TYPE2:CLASS1 ioctl { 0x3 };
type_transition TYPE1 TYPE2:CLASS1 TYPE3;
diff --git a/checkpolicy/tests/policy_allonce.expected_opt.conf b/checkpolicy/tests/policy_allonce.expected_opt.conf
index 1c969961..335486d1 100644
--- a/checkpolicy/tests/policy_allonce.expected_opt.conf
+++ b/checkpolicy/tests/policy_allonce.expected_opt.conf
@@ -34,7 +34,9 @@ auditallow TYPE1 TYPE3:CLASS1 { PERM1 };
auditallow TYPE2 TYPE3:CLASS1 { PERM1 };
dontaudit TYPE1 TYPE2:CLASS3 { CPERM1 PERM1 };
dontaudit TYPE1 TYPE3:CLASS3 { CPERM1 PERM1 };
-allowxperm TYPE1 TYPE2:CLASS1 ioctl { 0x1 };
+allowxperm TYPE1 TYPE2:CLASS1 ioctl { 0x456-0x4ff };
+allowxperm TYPE1 TYPE2:CLASS1 ioctl { 0x500-0x55ff };
+allowxperm TYPE1 TYPE2:CLASS1 ioctl { 0x5600-0x5678 };
auditallowxperm TYPE1 TYPE2:CLASS1 ioctl { 0x2 };
dontauditxperm TYPE1 TYPE2:CLASS1 ioctl { 0x3 };
type_transition TYPE1 TYPE2:CLASS1 TYPE3;
--
2.43.0
^ permalink raw reply related [flat|nested] 6+ messages in thread
* [PATCH 3/4] checkpolicy: declare file local variable static
2024-04-08 15:07 [PATCH 1/4] libsepol: improve policy lookup failure message Christian Göttsche
2024-04-08 15:08 ` [PATCH 2/4] checkpolicy/tests: add test for splitting xperm rule Christian Göttsche
@ 2024-04-08 15:08 ` Christian Göttsche
2024-04-08 15:08 ` [PATCH 4/4] checkpolicy: drop global policyvers variable Christian Göttsche
2024-04-22 20:48 ` [PATCH 1/4] libsepol: improve policy lookup failure message James Carter
3 siblings, 0 replies; 6+ messages in thread
From: Christian Göttsche @ 2024-04-08 15:08 UTC (permalink / raw
To: selinux; +Cc: Christian Göttsche
From: Christian Göttsche <cgzones@googlemail.com>
The variable policy_type used by checkmodule is only used inside of
checkmodule.c.
Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
---
checkpolicy/checkmodule.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/checkpolicy/checkmodule.c b/checkpolicy/checkmodule.c
index 14e6c891..e7869bf1 100644
--- a/checkpolicy/checkmodule.c
+++ b/checkpolicy/checkmodule.c
@@ -43,7 +43,7 @@ static int handle_unknown = SEPOL_DENY_UNKNOWN;
static const char *txtfile = "policy.conf";
static const char *binfile = "policy";
-unsigned int policy_type = POLICY_BASE;
+static unsigned int policy_type = POLICY_BASE;
unsigned int policyvers = MOD_POLICYDB_VERSION_MAX;
static int read_binary_policy(policydb_t * p, const char *file, const char *progname)
--
2.43.0
^ permalink raw reply related [flat|nested] 6+ messages in thread
* [PATCH 4/4] checkpolicy: drop global policyvers variable
2024-04-08 15:07 [PATCH 1/4] libsepol: improve policy lookup failure message Christian Göttsche
2024-04-08 15:08 ` [PATCH 2/4] checkpolicy/tests: add test for splitting xperm rule Christian Göttsche
2024-04-08 15:08 ` [PATCH 3/4] checkpolicy: declare file local variable static Christian Göttsche
@ 2024-04-08 15:08 ` Christian Göttsche
2024-04-22 20:48 ` [PATCH 1/4] libsepol: improve policy lookup failure message James Carter
3 siblings, 0 replies; 6+ messages in thread
From: Christian Göttsche @ 2024-04-08 15:08 UTC (permalink / raw
To: selinux; +Cc: Christian Göttsche
From: Christian Göttsche <cgzones@googlemail.com>
Drop the global variable policyvers. The variable is only used within
checkpolicy.c and checkmodule.c, but never in any shared code.
Since the variable declaration is the only content of checkpolicy.h drop
it.
Also set the policy version before calls to read_source_policy(), so the
parser can access the requested version for checks this way.
Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
---
checkpolicy/checkmodule.c | 11 +++++------
checkpolicy/checkpolicy.c | 8 +++-----
checkpolicy/checkpolicy.h | 6 ------
checkpolicy/fuzz/checkpolicy-fuzzer.c | 1 +
checkpolicy/policy_define.c | 1 -
checkpolicy/policy_parse.y | 1 -
6 files changed, 9 insertions(+), 19 deletions(-)
delete mode 100644 checkpolicy/checkpolicy.h
diff --git a/checkpolicy/checkmodule.c b/checkpolicy/checkmodule.c
index e7869bf1..2d6f2399 100644
--- a/checkpolicy/checkmodule.c
+++ b/checkpolicy/checkmodule.c
@@ -31,7 +31,6 @@
#include <sepol/policydb/sidtab.h>
#include "queue.h"
-#include "checkpolicy.h"
#include "parse_util.h"
static sidtab_t sidtab;
@@ -43,9 +42,6 @@ static int handle_unknown = SEPOL_DENY_UNKNOWN;
static const char *txtfile = "policy.conf";
static const char *binfile = "policy";
-static unsigned int policy_type = POLICY_BASE;
-unsigned int policyvers = MOD_POLICYDB_VERSION_MAX;
-
static int read_binary_policy(policydb_t * p, const char *file, const char *progname)
{
int fd;
@@ -107,7 +103,7 @@ static int read_binary_policy(policydb_t * p, const char *file, const char *prog
return 0;
}
-static int write_binary_policy(policydb_t * p, FILE *outfp)
+static int write_binary_policy(policydb_t * p, FILE *outfp, unsigned int policy_type, unsigned int policyvers)
{
struct policy_file pf;
@@ -150,6 +146,8 @@ int main(int argc, char **argv)
{
const char *file = txtfile, *outfile = NULL;
unsigned int binary = 0, cil = 0, disable_neverallow = 0;
+ unsigned int policy_type = POLICY_BASE;
+ unsigned int policyvers = MOD_POLICYDB_VERSION_MAX;
int ch;
int show_version = 0;
policydb_t modpolicydb;
@@ -279,6 +277,7 @@ int main(int argc, char **argv)
modpolicydb.policy_type = policy_type;
modpolicydb.mls = mlspol;
modpolicydb.handle_unknown = handle_unknown;
+ modpolicydb.policyvers = policyvers;
if (read_source_policy(&modpolicydb, file, argv[0]) == -1) {
exit(1);
@@ -343,7 +342,7 @@ int main(int argc, char **argv)
}
if (!cil) {
- if (write_binary_policy(&modpolicydb, outfp) != 0) {
+ if (write_binary_policy(&modpolicydb, outfp, policy_type, policyvers) != 0) {
fprintf(stderr, "%s: error writing %s\n", argv[0], outfile);
exit(1);
}
diff --git a/checkpolicy/checkpolicy.c b/checkpolicy/checkpolicy.c
index d7cafaa4..ede2b6ad 100644
--- a/checkpolicy/checkpolicy.c
+++ b/checkpolicy/checkpolicy.c
@@ -89,7 +89,6 @@
#include <sepol/policydb/link.h>
#include "queue.h"
-#include "checkpolicy.h"
#include "parse_util.h"
static policydb_t policydb;
@@ -103,8 +102,6 @@ static int handle_unknown = SEPOL_DENY_UNKNOWN;
static const char *txtfile = "policy.conf";
static const char *binfile = "policy";
-unsigned int policyvers = 0;
-
static __attribute__((__noreturn__)) void usage(const char *progname)
{
printf
@@ -395,6 +392,7 @@ int main(int argc, char **argv)
unsigned int binary = 0, debug = 0, sort = 0, cil = 0, conf = 0, optimize = 0, disable_neverallow = 0;
struct val_to_name v;
int ret, ch, fd, target = SEPOL_TARGET_SELINUX;
+ unsigned int policyvers = 0;
unsigned int nel, uret;
struct stat sb;
void *map;
@@ -613,6 +611,7 @@ int main(int argc, char **argv)
/* Let sepol know if we are dealing with MLS support */
parse_policy.mls = mlspol;
parse_policy.handle_unknown = handle_unknown;
+ parse_policy.policyvers = policyvers ? policyvers : POLICYDB_VERSION_MAX;
policydbp = &parse_policy;
@@ -637,11 +636,10 @@ int main(int argc, char **argv)
fprintf(stderr, "Error while expanding policy\n");
exit(1);
}
+ policydb.policyvers = policyvers ? policyvers : POLICYDB_VERSION_MAX;
policydb_destroy(policydbp);
policydbp = &policydb;
}
-
- policydbp->policyvers = policyvers ? policyvers : POLICYDB_VERSION_MAX;
}
if (policydb_load_isids(&policydb, &sidtab))
diff --git a/checkpolicy/checkpolicy.h b/checkpolicy/checkpolicy.h
deleted file mode 100644
index f127687e..00000000
--- a/checkpolicy/checkpolicy.h
+++ /dev/null
@@ -1,6 +0,0 @@
-#ifndef _CHECKPOLICY_H_
-#define _CHECKPOLICY_H_
-
-extern unsigned int policyvers;
-
-#endif
diff --git a/checkpolicy/fuzz/checkpolicy-fuzzer.c b/checkpolicy/fuzz/checkpolicy-fuzzer.c
index 6c5ce02f..ddb43260 100644
--- a/checkpolicy/fuzz/checkpolicy-fuzzer.c
+++ b/checkpolicy/fuzz/checkpolicy-fuzzer.c
@@ -200,6 +200,7 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
parsepolicydb.policy_type = POLICY_BASE;
parsepolicydb.mls = mls;
parsepolicydb.handle_unknown = DENY_UNKNOWN;
+ parsepolicydb.policyvers = policyvers;
policydb_set_target_platform(&parsepolicydb, platform);
if (read_source_policy(&parsepolicydb, data, size))
diff --git a/checkpolicy/policy_define.c b/checkpolicy/policy_define.c
index 1c019a3b..aa2ac2e6 100644
--- a/checkpolicy/policy_define.c
+++ b/checkpolicy/policy_define.c
@@ -55,7 +55,6 @@
#include <sepol/policydb/hierarchy.h>
#include <sepol/policydb/polcaps.h>
#include "queue.h"
-#include "checkpolicy.h"
#include "module_compiler.h"
#include "policy_define.h"
diff --git a/checkpolicy/policy_parse.y b/checkpolicy/policy_parse.y
index 1b275ebc..c57a988a 100644
--- a/checkpolicy/policy_parse.y
+++ b/checkpolicy/policy_parse.y
@@ -49,7 +49,6 @@
#include <sepol/policydb/hierarchy.h>
#include <sepol/policydb/polcaps.h>
#include "queue.h"
-#include "checkpolicy.h"
#include "module_compiler.h"
#include "policy_define.h"
--
2.43.0
^ permalink raw reply related [flat|nested] 6+ messages in thread
* Re: [PATCH 1/4] libsepol: improve policy lookup failure message
2024-04-08 15:07 [PATCH 1/4] libsepol: improve policy lookup failure message Christian Göttsche
` (2 preceding siblings ...)
2024-04-08 15:08 ` [PATCH 4/4] checkpolicy: drop global policyvers variable Christian Göttsche
@ 2024-04-22 20:48 ` James Carter
2024-05-02 18:03 ` James Carter
3 siblings, 1 reply; 6+ messages in thread
From: James Carter @ 2024-04-22 20:48 UTC (permalink / raw
To: cgzones; +Cc: selinux
On Mon, Apr 8, 2024 at 11:08 AM Christian Göttsche
<cgoettsche@seltendoof.de> wrote:
>
> From: Christian Göttsche <cgzones@googlemail.com>
>
> If a policy version cannot be found include the policy target, and a
> module prefix for non kernel policies in the message.
>
> Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
For these four patches:
Acked-by: James Carter <jwcart2@gmail.com>
> ---
> libsepol/src/write.c | 6 ++++--
> 1 file changed, 4 insertions(+), 2 deletions(-)
>
> diff --git a/libsepol/src/write.c b/libsepol/src/write.c
> index 283d11c8..2fcc1701 100644
> --- a/libsepol/src/write.c
> +++ b/libsepol/src/write.c
> @@ -2252,8 +2252,10 @@ int policydb_write(policydb_t * p, struct policy_file *fp)
> info = policydb_lookup_compat(p->policyvers, p->policy_type,
> p->target_platform);
> if (!info) {
> - ERR(fp->handle, "compatibility lookup failed for policy "
> - "version %d", p->policyvers);
> + ERR(fp->handle, "compatibility lookup failed for %s%s policy version %d",
> + p->target_platform == SEPOL_TARGET_SELINUX ? "selinux" : "xen",
> + p->policy_type == POLICY_KERN ? "" : " module",
> + p->policyvers);
> return POLICYDB_ERROR;
> }
>
> --
> 2.43.0
>
>
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH 1/4] libsepol: improve policy lookup failure message
2024-04-22 20:48 ` [PATCH 1/4] libsepol: improve policy lookup failure message James Carter
@ 2024-05-02 18:03 ` James Carter
0 siblings, 0 replies; 6+ messages in thread
From: James Carter @ 2024-05-02 18:03 UTC (permalink / raw
To: cgzones; +Cc: selinux
On Mon, Apr 22, 2024 at 4:48 PM James Carter <jwcart2@gmail.com> wrote:
>
> On Mon, Apr 8, 2024 at 11:08 AM Christian Göttsche
> <cgoettsche@seltendoof.de> wrote:
> >
> > From: Christian Göttsche <cgzones@googlemail.com>
> >
> > If a policy version cannot be found include the policy target, and a
> > module prefix for non kernel policies in the message.
> >
> > Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
>
> For these four patches:
> Acked-by: James Carter <jwcart2@gmail.com>
>
These four patches have been merged.
Thanks,
Jim
> > ---
> > libsepol/src/write.c | 6 ++++--
> > 1 file changed, 4 insertions(+), 2 deletions(-)
> >
> > diff --git a/libsepol/src/write.c b/libsepol/src/write.c
> > index 283d11c8..2fcc1701 100644
> > --- a/libsepol/src/write.c
> > +++ b/libsepol/src/write.c
> > @@ -2252,8 +2252,10 @@ int policydb_write(policydb_t * p, struct policy_file *fp)
> > info = policydb_lookup_compat(p->policyvers, p->policy_type,
> > p->target_platform);
> > if (!info) {
> > - ERR(fp->handle, "compatibility lookup failed for policy "
> > - "version %d", p->policyvers);
> > + ERR(fp->handle, "compatibility lookup failed for %s%s policy version %d",
> > + p->target_platform == SEPOL_TARGET_SELINUX ? "selinux" : "xen",
> > + p->policy_type == POLICY_KERN ? "" : " module",
> > + p->policyvers);
> > return POLICYDB_ERROR;
> > }
> >
> > --
> > 2.43.0
> >
> >
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2024-05-02 18:04 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2024-04-08 15:07 [PATCH 1/4] libsepol: improve policy lookup failure message Christian Göttsche
2024-04-08 15:08 ` [PATCH 2/4] checkpolicy/tests: add test for splitting xperm rule Christian Göttsche
2024-04-08 15:08 ` [PATCH 3/4] checkpolicy: declare file local variable static Christian Göttsche
2024-04-08 15:08 ` [PATCH 4/4] checkpolicy: drop global policyvers variable Christian Göttsche
2024-04-22 20:48 ` [PATCH 1/4] libsepol: improve policy lookup failure message James Carter
2024-05-02 18:03 ` James Carter
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).