Skip to contentSkip to conversation

sepolgen: correctly extract params from interface calls

PATCH New Karl MacMillan 1 participant 1 message Mar 1, 2007 SELinux security module

lore
Share & tools
lore
#0 lore raw

PATCH 1/1 sepolgen: correctly extract params from interface calls

This patch makes the interface parameter extraction code extract parameters from interface calls. This didn't matter much before because interfaces normally contained allow rules, but the new policy patterns make it likely that an interface will have only interface calls. Also included is a small bug fix in the code that handles conflicting parameter types.

sepolgen/src/sepolgen/interfaces.py +23 -1
diff -r 62550235fedc sepolgen/src/sepolgen/interfaces.py
@@ -71,7 +71,11 @@ def __param_insert(name, type, av, param
             # If the object is not implicitly typed, tell the
             # caller there is a likely conflict.
             ret = 1
-            for obj in itertools.chain(p.obj_classes, [av.obj_class]):
+            if av:
+                avobjs = [av.obj_class]
+            else:
+                avobjs = []
+            for obj in itertools.chain(p.obj_classes, avobjs):
                 if obj in objectmodel.implicitly_typed_objects:
                     ret = 0
                     break
@@ -181,6 +185,17 @@ def type_rule_extract_params(rule, param
         if __param_insert(rule.dest_type, refpolicy.DEST_TYPE, None, params):
             ret = 1
             
+    return ret
+
+def ifcall_extract_params(ifcall, params):
+    ret = 0
+    for arg in ifcall.args:
+        if access.is_idparam(arg):
+            # Assume interface arguments are source types. Fairly safe
+            # assumption for most interfaces
+            if __param_insert(arg, refpolicy.SRC_TYPE, None, params):
+                ret = 1
+
     return ret
             
 
@@ -229,6 +244,13 @@ class InterfaceVector:
                 pass
                 #print "found conflicting params in rule %s in interface %s" % \
                 #      (str(rule), interface.name)
+
+        for ifcall in interface.interface_calls():
+            if ifcall_extract_params(ifcall, self.params):
+                pass
+                #print "found conflicting params in ifcall %s in interface %s" % \
+                #      (str(ifcall), interface.name)
+            
 
     def add_av(self, av):
         if av_extract_params(av, self.params) == 1:

--
This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to [email protected] with the words "unsubscribe selinux" without quotes as the message.