typeattribute statements

PATCH In review Darrel Goeddel 3 participants 6 messages Dec 13, 2004 SELinux security module

Share & tools

Darrel Goeddel

author

2004-12-13 15:52 UTC #0 lore raw

PATCH 1/1 typeattribute statements

Hello,
I have attached a simple patch which introduces a "typeattribute" statement
to the policy grammar. This will allow attributes to be added to a type after its initial definition - much like the "typealias" statement allows for aliasing after the initial type definition. The usage is as follows:

typeattribute TYPE ATTRIBUTES;

where TYPE is the type you are adding attributes to and ATTRIBUTES is a comma separated list of the attributes you would like to add.

Such statements are useful for policy tweaking without extensive modification to the existing .te files (which makes tracking changes much easier).

The patch is against the current sourceforge CVS chekpolicy directory.

Signature · 1 line

Darrel

Index: policy_parse.y
===================================================================
RCS file: /cvsroot/selinux/nsa/selinux-usr/checkpolicy/policy_parse.y,v retrieving revision 1.25

policy_parse.y +85 -2

diff -u -r1.25 policy_parse.y
@@ -68,6 +68,7 @@
 static int define_av_base(void);
 static int define_attrib(void);
 static int define_typealias(void);
+static int define_typeattribute(void);
 static int define_type(int alias);
 static int define_compute_type(int which);
 static int define_te_avtab(int which);

@@ -121,6 +122,7 @@
 %token ROLE
 %token ROLES
 %token TYPEALIAS
+%token TYPEATTRIBUTE
 %token TYPE
 %token TYPES
 %token ALIAS

@@ -287,6 +289,7 @@
 te_decl			: attribute_def
                         | type_def
                         | typealias_def
+                        | typeattribute_def
                         | bool_def
                         | transition_def
                         | te_avtab_def

@@ -303,6 +306,9 @@
 typealias_def           : TYPEALIAS identifier alias_def ';'
 			{if (define_typealias()) return -1;}
 			;
+typeattribute_def	: TYPEATTRIBUTE identifier id_comma_list ';'
+			{if (define_typeattribute()) return -1;}
+			;
 opt_attr_list           : ',' id_comma_list
 			| 
 			;

@@ -1633,10 +1639,9 @@
 static int define_typealias(void)
 {
 	char *id;
-	type_datum_t *t, *aliasdatum;;
+	type_datum_t *t, *aliasdatum;
 	int ret;
 
-
 	if (pass == 2) {
 		while ((id = queue_remove(id_queue))) 
 			free(id);

@@ -1686,6 +1691,84 @@
 	return 0;
 }
 
+static int define_typeattribute(void)
+{
+	char *id;
+	type_datum_t *t, *attr;
+
+	if (pass == 2) {
+		while ((id = queue_remove(id_queue)))
+			free(id);
+		return 0;
+	}
+
+	id = (char *)queue_remove(id_queue);
+	if (!id) {
+		yyerror("no type name for typeattribute definition?");
+		return -1;
+	}
+
+	t = hashtab_search(policydbp->p_types.table, id);
+	if (!t || t->isattr) {
+		sprintf(errormsg, "unknown type %s", id);
+		yyerror(errormsg);
+		free(id);
+		return -1;
+	}
+
+	while ((id = queue_remove(id_queue))) {
+#ifdef CONFIG_SECURITY_SELINUX_MLS
+		if (!strcmp(id, "mlstrustedreader")) {
+			if (ebitmap_set_bit(&policydbp->trustedreaders,
+			                    (t->value - 1), TRUE)) {
+				yyerror("out of memory");
+				free(id);
+				return -1;
+			}
+		} else if (!strcmp(id, "mlstrustedwriter")) {
+			if (ebitmap_set_bit(&policydbp->trustedwriters,
+			                    (t->value - 1), TRUE)) {
+				yyerror("out of memory");
+				free(id);
+				return -1;
+			}
+		} else if (!strcmp(id, "mlstrustedobject")) {
+			if (ebitmap_set_bit(&policydbp->trustedobjects,
+			                    (t->value - 1), TRUE)) {
+				yyerror("out of memory");
+				free(id);
+				return -1;
+			}
+		}
+#endif
+		attr = hashtab_search(policydbp->p_types.table, id);
+		if (!attr) {
+			sprintf(errormsg, "attribute %s is not declared", id);
+			/* treat it as a fatal error */
+			yyerror(errormsg);
+			free(id);
+			return -1;
+		}
+
+		if (!attr->isattr) {
+			sprintf(errormsg, "%s is a type, not an attribute", id);
+			yyerror(errormsg);
+			free(id);
+			return -1;
+		}
+
+		free(id);
+
+		if (ebitmap_set_bit(&attr->types, (t->value - 1), TRUE)) {
+			yyerror("out of memory");
+			free(id);
+			return -1;
+		}
+	}
+
+	return 0;
+}
+
 static int define_type(int alias)
 {
 	char *id;

Index: policy_scan.l
===================================================================
RCS file: /cvsroot/selinux/nsa/selinux-usr/checkpolicy/policy_scan.l,v retrieving revision 1.6

policy_scan.l +2 -0

diff -u -r1.6 policy_scan.l
@@ -64,6 +64,8 @@
 types				{ return(TYPES); }
 TYPEALIAS |
 typealias			{ return(TYPEALIAS); }
+TYPEATTRIBUTE |
+typeattribute			{ return(TYPEATTRIBUTE); }
 TYPE |
 type				{ return(TYPE); }
 BOOL |

Darrel Goeddel

author

2004-12-13 20:04 UTC #1 lore raw

Quoted 2 lines · Darrel Goeddel

... The patch is against the current sourceforge CVS chekpolicy directory.

There is a bad call to free() in the patch that was sent earlier. A new patch is attached. I apologize for the goof. Questions/comments?

Signature · 1 line

Darrel

Index: policy_parse.y
===================================================================
RCS file: /cvsroot/selinux/nsa/selinux-usr/checkpolicy/policy_parse.y,v retrieving revision 1.25

policy_parse.y +84 -2

diff -u -r1.25 policy_parse.y
@@ -68,6 +68,7 @@
 static int define_av_base(void);
 static int define_attrib(void);
 static int define_typealias(void);
+static int define_typeattribute(void);
 static int define_type(int alias);
 static int define_compute_type(int which);
 static int define_te_avtab(int which);

@@ -121,6 +122,7 @@
 %token ROLE
 %token ROLES
 %token TYPEALIAS
+%token TYPEATTRIBUTE
 %token TYPE
 %token TYPES
 %token ALIAS

@@ -287,6 +289,7 @@
 te_decl			: attribute_def
                         | type_def
                         | typealias_def
+                        | typeattribute_def
                         | bool_def
                         | transition_def
                         | te_avtab_def

@@ -303,6 +306,9 @@
 typealias_def           : TYPEALIAS identifier alias_def ';'
 			{if (define_typealias()) return -1;}
 			;
+typeattribute_def	: TYPEATTRIBUTE identifier id_comma_list ';'
+			{if (define_typeattribute()) return -1;}
+			;
 opt_attr_list           : ',' id_comma_list
 			| 
 			;

@@ -1633,10 +1639,9 @@
 static int define_typealias(void)
 {
 	char *id;
-	type_datum_t *t, *aliasdatum;;
+	type_datum_t *t, *aliasdatum;
 	int ret;
 
-
 	if (pass == 2) {
 		while ((id = queue_remove(id_queue))) 
 			free(id);

@@ -1686,6 +1691,83 @@
 	return 0;
 }
 
+static int define_typeattribute(void)
+{
+	char *id;
+	type_datum_t *t, *attr;
+
+	if (pass == 2) {
+		while ((id = queue_remove(id_queue)))
+			free(id);
+		return 0;
+	}
+
+	id = (char *)queue_remove(id_queue);
+	if (!id) {
+		yyerror("no type name for typeattribute definition?");
+		return -1;
+	}
+
+	t = hashtab_search(policydbp->p_types.table, id);
+	if (!t || t->isattr) {
+		sprintf(errormsg, "unknown type %s", id);
+		yyerror(errormsg);
+		free(id);
+		return -1;
+	}
+
+	while ((id = queue_remove(id_queue))) {
+#ifdef CONFIG_SECURITY_SELINUX_MLS
+		if (!strcmp(id, "mlstrustedreader")) {
+			if (ebitmap_set_bit(&policydbp->trustedreaders,
+			                    (t->value - 1), TRUE)) {
+				yyerror("out of memory");
+				free(id);
+				return -1;
+			}
+		} else if (!strcmp(id, "mlstrustedwriter")) {
+			if (ebitmap_set_bit(&policydbp->trustedwriters,
+			                    (t->value - 1), TRUE)) {
+				yyerror("out of memory");
+				free(id);
+				return -1;
+			}
+		} else if (!strcmp(id, "mlstrustedobject")) {
+			if (ebitmap_set_bit(&policydbp->trustedobjects,
+			                    (t->value - 1), TRUE)) {
+				yyerror("out of memory");
+				free(id);
+				return -1;
+			}
+		}
+#endif
+		attr = hashtab_search(policydbp->p_types.table, id);
+		if (!attr) {
+			sprintf(errormsg, "attribute %s is not declared", id);
+			/* treat it as a fatal error */
+			yyerror(errormsg);
+			free(id);
+			return -1;
+		}
+
+		if (!attr->isattr) {
+			sprintf(errormsg, "%s is a type, not an attribute", id);
+			yyerror(errormsg);
+			free(id);
+			return -1;
+		}
+
+		free(id);
+
+		if (ebitmap_set_bit(&attr->types, (t->value - 1), TRUE)) {
+			yyerror("out of memory");
+			return -1;
+		}
+	}
+
+	return 0;
+}
+
 static int define_type(int alias)
 {
 	char *id;

Index: policy_scan.l
===================================================================
RCS file: /cvsroot/selinux/nsa/selinux-usr/checkpolicy/policy_scan.l,v retrieving revision 1.6

policy_scan.l +2 -0

diff -u -r1.6 policy_scan.l
@@ -64,6 +64,8 @@
 types				{ return(TYPES); }
 TYPEALIAS |
 typealias			{ return(TYPEALIAS); }
+TYPEATTRIBUTE |
+typeattribute			{ return(TYPEATTRIBUTE); }
 TYPE |
 type				{ return(TYPE); }
 BOOL |

Stephen Smalley

2004-12-13 20:34 UTC #2 lore raw

Quoted 2 lines · Darrel Goeddel

There is a bad call to free() in the patch that was sent earlier. A new patch is attached. I apologize for the goof. Questions/comments?

Thanks, looks good. Only concern is the duplication of the MLS attribute handling code; we should use a common helper (although that code should be obsoleted in the future anyway).

Signature · 8 lines

Stephen Smalley <[email protected]>
National Security Agency


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to [email protected] with
the words "unsubscribe selinux" without quotes as the message.

Darrel Goeddel

author

2004-12-13 21:07 UTC #3 lore raw

Quoted 4 lines · Stephen Smalley

Thanks, looks good. Only concern is the duplication of the MLS attribute handling code; we should use a common helper (although that code should be obsoleted in the future anyway).

Yes, that code should be going away - which is probably why I took no real effort to mess with it now. I have consolidated it for the time being with this new version of the patch. How's this one look?

Signature · 1 line

Darrel

Index: policy_parse.y
===================================================================
RCS file: /cvsroot/selinux/nsa/selinux-usr/checkpolicy/policy_parse.y,v retrieving revision 1.25

policy_parse.y +91 ~~-22~~

diff -u -r1.25 policy_parse.y
@@ -68,6 +68,7 @@
 static int define_av_base(void);
 static int define_attrib(void);
 static int define_typealias(void);
+static int define_typeattribute(void);
 static int define_type(int alias);
 static int define_compute_type(int which);
 static int define_te_avtab(int which);

@@ -121,6 +122,7 @@
 %token ROLE
 %token ROLES
 %token TYPEALIAS
+%token TYPEATTRIBUTE
 %token TYPE
 %token TYPES
 %token ALIAS

@@ -287,6 +289,7 @@
 te_decl			: attribute_def
                         | type_def
                         | typealias_def
+                        | typeattribute_def
                         | bool_def
                         | transition_def
                         | te_avtab_def

@@ -303,6 +306,9 @@
 typealias_def           : TYPEALIAS identifier alias_def ';'
 			{if (define_typealias()) return -1;}
 			;
+typeattribute_def	: TYPEATTRIBUTE identifier id_comma_list ';'
+			{if (define_typeattribute()) return -1;}
+			;
 opt_attr_list           : ',' id_comma_list
 			| 
 			;

@@ -1633,10 +1639,9 @@
 static int define_typealias(void)
 {
 	char *id;
-	type_datum_t *t, *aliasdatum;;
+	type_datum_t *t, *aliasdatum;
 	int ret;
 
-
 	if (pass == 2) {
 		while ((id = queue_remove(id_queue))) 
 			free(id);

@@ -1686,6 +1691,86 @@
 	return 0;
 }
 
+#ifdef CONFIG_SECURITY_SELINUX_MLS
+static int handle_mls_attributes(char *id, unsigned int value)
+{
+	if (!strcmp(id, "mlstrustedreader")) {
+		if (ebitmap_set_bit(&policydbp->trustedreaders, value, TRUE)) {
+			return -1;
+		}
+	} else if (!strcmp(id, "mlstrustedwriter")) {
+		if (ebitmap_set_bit(&policydbp->trustedwriters, value, TRUE)) {
+			return -1;
+		}
+	} else if (!strcmp(id, "mlstrustedobject")) {
+		if (ebitmap_set_bit(&policydbp->trustedobjects, value, TRUE)) {
+			return -1;
+		}
+	}
+	return 0;
+}
+#else /* CONFIG_SECURITY_SELINUX_MLS */
+#define handle_mls_attributes(id, value) 0
+#endif /* CONFIG_SECURITY_SELINUX_MLS */
+
+static int define_typeattribute(void)
+{
+	char *id;
+	type_datum_t *t, *attr;
+
+	if (pass == 2) {
+		while ((id = queue_remove(id_queue)))
+			free(id);
+		return 0;
+	}
+
+	id = (char *)queue_remove(id_queue);
+	if (!id) {
+		yyerror("no type name for typeattribute definition?");
+		return -1;
+	}
+
+	t = hashtab_search(policydbp->p_types.table, id);
+	if (!t || t->isattr) {
+		sprintf(errormsg, "unknown type %s", id);
+		yyerror(errormsg);
+		free(id);
+		return -1;
+	}
+
+	while ((id = queue_remove(id_queue))) {
+		if (handle_mls_attributes(id, (t->value - 1))) {
+			yyerror("out of memory");
+			free(id);
+			return -1;
+		}
+		attr = hashtab_search(policydbp->p_types.table, id);
+		if (!attr) {
+			sprintf(errormsg, "attribute %s is not declared", id);
+			/* treat it as a fatal error */
+			yyerror(errormsg);
+			free(id);
+			return -1;
+		}
+
+		if (!attr->isattr) {
+			sprintf(errormsg, "%s is a type, not an attribute", id);
+			yyerror(errormsg);
+			free(id);
+			return -1;
+		}
+
+		free(id);
+
+		if (ebitmap_set_bit(&attr->types, (t->value - 1), TRUE)) {
+			yyerror("out of memory");
+			return -1;
+		}
+	}
+
+	return 0;
+}
+
 static int define_type(int alias)
 {
 	char *id;

@@ -1767,27 +1852,11 @@
 	}
 
 	while ((id = queue_remove(id_queue))) {
-#ifdef CONFIG_SECURITY_SELINUX_MLS
-		if (!strcmp(id, "mlstrustedreader")) {
-			if (ebitmap_set_bit(&policydbp->trustedreaders, datum->value - 1, TRUE)) {
-				yyerror("out of memory");
-				free(id);
-				return -1;
-			}
-		} else if (!strcmp(id, "mlstrustedwriter")) {
-			if (ebitmap_set_bit(&policydbp->trustedwriters, datum->value - 1, TRUE)) {
-				yyerror("out of memory");
-				free(id);
-				return -1;
-			}
-		} else if (!strcmp(id, "mlstrustedobject")) {
-			if (ebitmap_set_bit(&policydbp->trustedobjects, datum->value - 1, TRUE)) {
-				yyerror("out of memory");
-				free(id);
-				return -1;
-			}
+		if (handle_mls_attributes(id, (datum->value - 1))) {
+			yyerror("out of memory");
+			free(id);
+			return -1;
 		}
-#endif
 		attr = hashtab_search(policydbp->p_types.table, id);
 		if (!attr) {
 			sprintf(errormsg, "attribute %s is not declared", id);

Index: policy_scan.l
===================================================================
RCS file: /cvsroot/selinux/nsa/selinux-usr/checkpolicy/policy_scan.l,v retrieving revision 1.6

policy_scan.l +2 -0

diff -u -r1.6 policy_scan.l
@@ -64,6 +64,8 @@
 types				{ return(TYPES); }
 TYPEALIAS |
 typealias			{ return(TYPEALIAS); }
+TYPEATTRIBUTE |
+typeattribute			{ return(TYPEATTRIBUTE); }
 TYPE |
 type				{ return(TYPE); }
 BOOL |

Stephen Smalley

2004-12-13 21:31 UTC #4 lore raw

Quoted 3 lines · Darrel Goeddel

Yes, that code should be going away - which is probably why I took no real effort to mess with it now. I have consolidated it for the time being with this new version of the patch. How's this one look?

Looks good, thanks.

Signature · 8 lines

Stephen Smalley <[email protected]>
National Security Agency


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to [email protected] with
the words "unsubscribe selinux" without quotes as the message.

Karl MacMillan

2004-12-13 22:21 UTC #5 lore raw

In reply to Darrel Goeddel

Quoted 8 lines · Darrel Goeddel

Hello,
I have attached a simple patch which introduces a "typeattribute" statement
to the policy grammar. This will allow attributes to be added to a type after its initial definition - much like the "typealias" statement allows for aliasing after the initial type definition. The usage is as follows:
typeattribute TYPE ATTRIBUTES;

Quoted 8 lines

where TYPE is the type you are adding attributes to and ATTRIBUTES is a comma separated list of the attributes you would like to add.
Such statements are useful for policy tweaking without extensive modification to the existing .te files (which makes tracking changes much easier).
The patch is against the current sourceforge CVS chekpolicy directory.

I think that this is a needed language extension and was on the list of things that we were planning to do for the policy server project. It might be nice if this worked inside conditional statements, but the patch would be much more intrusive. For anyone who has looked at the module syntax, we will add this to ifopt blocks to only enable the specified attributes with the optional requirements are made.

Karl

Signature · 4 lines

Karl MacMillan
Tresys Technology
http://www.tresys.com
(410) 290-1411 ext134

Quoted 147 lines

plain text document attachment (typeattr.patch)
Index: policy_parse.y
===================================================================
RCS file: /cvsroot/selinux/nsa/selinux-usr/checkpolicy/policy_parse.y,v retrieving revision 1.25
diff -u -r1.25 policy_parse.y

policy_parse.y +85 -2

@@ -68,6 +68,7 @@
 static int define_av_base(void);
 static int define_attrib(void);
 static int define_typealias(void);
+static int define_typeattribute(void);
 static int define_type(int alias);
 static int define_compute_type(int which);
 static int define_te_avtab(int which);

@@ -121,6 +122,7 @@
 %token ROLE
 %token ROLES
 %token TYPEALIAS
+%token TYPEATTRIBUTE
 %token TYPE
 %token TYPES
 %token ALIAS

@@ -287,6 +289,7 @@
 te_decl			: attribute_def
                         | type_def
                         | typealias_def
+                        | typeattribute_def
                         | bool_def
                         | transition_def
                         | te_avtab_def

@@ -303,6 +306,9 @@
 typealias_def           : TYPEALIAS identifier alias_def ';'
 			{if (define_typealias()) return -1;}
 			;
+typeattribute_def	: TYPEATTRIBUTE identifier id_comma_list ';'
+			{if (define_typeattribute()) return -1;}
+			;
 opt_attr_list           : ',' id_comma_list
 			| 
 			;

@@ -1633,10 +1639,9 @@
 static int define_typealias(void)
 {
 	char *id;
-	type_datum_t *t, *aliasdatum;;
+	type_datum_t *t, *aliasdatum;
 	int ret;
 
-
 	if (pass == 2) {
 		while ((id = queue_remove(id_queue))) 
 			free(id);

@@ -1686,6 +1691,84 @@
 	return 0;
 }
 
+static int define_typeattribute(void)
+{
+	char *id;
+	type_datum_t *t, *attr;
+
+	if (pass == 2) {
+		while ((id = queue_remove(id_queue)))
+			free(id);
+		return 0;
+	}
+
+	id = (char *)queue_remove(id_queue);
+	if (!id) {
+		yyerror("no type name for typeattribute definition?");
+		return -1;
+	}
+
+	t = hashtab_search(policydbp->p_types.table, id);
+	if (!t || t->isattr) {
+		sprintf(errormsg, "unknown type %s", id);
+		yyerror(errormsg);
+		free(id);
+		return -1;
+	}
+
+	while ((id = queue_remove(id_queue))) {
+#ifdef CONFIG_SECURITY_SELINUX_MLS
+		if (!strcmp(id, "mlstrustedreader")) {
+			if (ebitmap_set_bit(&policydbp->trustedreaders,
+			                    (t->value - 1), TRUE)) {
+				yyerror("out of memory");
+				free(id);
+				return -1;
+			}
+		} else if (!strcmp(id, "mlstrustedwriter")) {
+			if (ebitmap_set_bit(&policydbp->trustedwriters,
+			                    (t->value - 1), TRUE)) {
+				yyerror("out of memory");
+				free(id);
+				return -1;
+			}
+		} else if (!strcmp(id, "mlstrustedobject")) {
+			if (ebitmap_set_bit(&policydbp->trustedobjects,
+			                    (t->value - 1), TRUE)) {
+				yyerror("out of memory");
+				free(id);
+				return -1;
+			}
+		}
+#endif
+		attr = hashtab_search(policydbp->p_types.table, id);
+		if (!attr) {
+			sprintf(errormsg, "attribute %s is not declared", id);
+			/* treat it as a fatal error */
+			yyerror(errormsg);
+			free(id);
+			return -1;
+		}
+
+		if (!attr->isattr) {
+			sprintf(errormsg, "%s is a type, not an attribute", id);
+			yyerror(errormsg);
+			free(id);
+			return -1;
+		}
+
+		free(id);
+
+		if (ebitmap_set_bit(&attr->types, (t->value - 1), TRUE)) {
+			yyerror("out of memory");
+			free(id);
+			return -1;
+		}
+	}
+
+	return 0;
+}
+
 static int define_type(int alias)
 {
 	char *id;

Index: policy_scan.l
===================================================================
RCS file: /cvsroot/selinux/nsa/selinux-usr/checkpolicy/policy_scan.l,v retrieving revision 1.6
diff -u -r1.6 policy_scan.l

policy_scan.l line 71

Quoted 8 lines

policy_scan.l +2 -0

@@ -64,6 +64,8 @@
 types				{ return(TYPES); }
 TYPEALIAS |
 typealias			{ return(TYPEALIAS); }
+TYPEATTRIBUTE |
+typeattribute			{ return(TYPEATTRIBUTE); }
 TYPE |
 type				{ return(TYPE); }
 BOOL |

--
This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to [email protected] with the words "unsubscribe selinux" without quotes as the message.