libsemanage/libsepol object serialization and ps-api

plain text document attachment (sepol.serialize.diff) Serialization versioning added to the sepol handle.

Serialization utility functions added in serialize.[ch]

---
 libsepol/include/sepol/handle.h |   17 +
 libsepol/src/handle.c           |   89 +++++++++
 libsepol/src/handle.h           |    5 
 libsepol/src/libsepol.map       |    1 
 libsepol/src/serialize.c        |  389 ++++++++++++++++++++++++++++++++++++++++
 libsepol/src/serialize.h        |   45 ++++
 6 files changed, 546 insertions(+)

Index: selinux-pms-support/libsepol/include/sepol/handle.h
===================================================================

libsepol/include/sepol/handle.h +8 -0

@@ -1,6 +1,11 @@
 #ifndef _SEPOL_HANDLE_H_
 #define _SEPOL_HANDLE_H_
 
+#include <inttypes.h>
+
+#define SEPOL_SERIAL_VERSION_MAJOR 1
+#define SEPOL_SERIAL_VERSION_MINOR 0
+
 struct sepol_handle;
 typedef struct sepol_handle sepol_handle_t;
 

@@ -10,4 +15,16 @@ sepol_handle_t *sepol_handle_create(void
 /* Destroy a sepol handle. */
 void sepol_handle_destroy(sepol_handle_t *);
 
+/* Serialize the serialization version. */
+int sepol_handle_version_serialize(sepol_handle_t * sh, char **data, uint64_t *size);
+

Index: selinux-pms-support/libsepol/src/serialize.c
===================================================================

libsepol/src/serialize.c new file +32 -0

@@ -0,0 +1,389 @@
+/* Author: Caleb Case <[email protected]>
+ *
+ * Copyright (C) 2004-2007 Tresys Technology, LLC
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2.1 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#include <stdlib.h>
+#include <string.h>
+#include <limits.h>
+
+#include "handle.h"
+#include "debug.h"
+#include "serialize.h"
+#include "private.h"
+
+/* This file provides general serialize and unserialize functions. */
+
+/** Serializes various kinds of datum.
+ *

libsepol/src/serialize.c new file +6 -0

+ *  This function acts iteratively moving the *data or size values.
+ *
+ *  Supported datum_types (defined in serialize.h):
+ *
+ *  SEPOL_SERIAL_INT32_T
+ *    Serializes datum to a int32_t as defined in inttypes.h

libsepol/src/serialize.c new file +6 -0

+		case SEPOL_SERIAL_SIZE_T:
+			if (size == NULL) {
+				temp = calloc(1, sizeof(uint64_t));
+				if (temp == NULL) {
+					status = STATUS_ERR;
+					goto cleanup;

From: Karl MacMillan [mailto:[email protected]]

Quoted 10 lines · On Mon, 2007-04-23 at 17:34 -0400, [email protected] wrote:

plain text document attachment (sepol.serialize.diff) Serialization versioning added to the sepol handle.

Serialization utility functions added in serialize.[ch]

---
 libsepol/include/sepol/handle.h |   17 +
 libsepol/src/handle.c           |   89 +++++++++
 libsepol/src/handle.h           |    5 
 libsepol/src/libsepol.map       |    1 
 libsepol/src/serialize.c        |  389 

++++++++++++++++++++++++++++++++++++++++

Quoted 30 lines

 libsepol/src/serialize.h        |   45 ++++
 6 files changed, 546 insertions(+)

Index: selinux-pms-support/libsepol/include/sepol/handle.h
===================================================================

libsepol/include/sepol/handle.h +12 -0

@@ -1,6 +1,11 @@
 #ifndef _SEPOL_HANDLE_H_
 #define _SEPOL_HANDLE_H_
 
+#include <inttypes.h>
+
+#define SEPOL_SERIAL_VERSION_MAJOR 1
+#define SEPOL_SERIAL_VERSION_MINOR 0
+
 struct sepol_handle;
 typedef struct sepol_handle sepol_handle_t;
 

@@ -10,4 +15,16 @@ sepol_handle_t *sepol_handle_create(void
 /* Destroy a sepol handle. */
 void sepol_handle_destroy(sepol_handle_t *);
 
+/* Serialize the serialization version. */ int 
+sepol_handle_version_serialize(sepol_handle_t * sh, char **data, 
+uint64_t *size);
+
+/* Unserialize the serialization version. */ int 
+sepol_handle_version_unserialize(sepol_handle_t * sh, char **data, 
+uint64_t *size);

libsepol/include/sepol/handle.h sepol_handle_t *sepol_handle_create(void · line 30

Quoted 10 lines

libsepol/include/sepol/handle.h +9 -0

+
+/* Get the serialization version. */
+int sepol_handle_get_version(sepol_handle_t *sh, uint32_t * major, 
+uint32_t * minor);
+
+/* Set the serialization version. */
+int sepol_handle_set_version(sepol_handle_t *sh, uint32_t major, 
+uint32_t minor);
+
 #endif

Can you give some idea about how the versioning is supposed to work? In
particular:

* How is it related to the policy version?
* Why would it change separately from the policy version?
* Is there any advantage to version each component separately rather that a global version?

<snip>

libsepol/src/serialize.c line 8

Quoted 13 lines

Index: selinux-pms-support/libsepol/src/serialize.c
===================================================================

libsepol/src/serialize.c new file +8 -0

@@ -0,0 +1,389 @@
+/* Author: Caleb Case <[email protected]>
+ *
+ * Copyright (C) 2004-2007 Tresys Technology, LLC
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2.1 of the License, or (at your option) any 

later version.

libsepol/src/serialize.c

Quoted 4 lines

libsepol/src/serialize.c new file +4 -0

+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  

See the GNU

libsepol/src/serialize.c

Quoted 3 lines

libsepol/src/serialize.c new file +3 -0

+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser 

General Public

Quoted 5 lines

libsepol/src/serialize.c new file +5 -0

+ *  License along with this library; if not, write to the Free 
+Software
+ *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  
+02110-1301  USA  */
+

libsepol/src/serialize.c

Quoted 10 lines

libsepol/src/serialize.c new file +10 -0

+#include <stdlib.h>
+#include <string.h>
+#include <limits.h>
+
+#include "handle.h"
+#include "debug.h"
+#include "serialize.h"
+#include "private.h"
+
+/* This file provides general serialize and unserialize 

functions. */

Quoted 9 lines

libsepol/src/serialize.c new file +9 -0

+
+/** Serializes various kinds of datum.
+ *
+ *  Two use cases:
+ *  1) Calling serialize with a non-NULL size.
+ *     This causes serialize to calculate the expected
+ *     size of serializing.  No serialization occurs.
+ *     Destructively modifies size.  Data may be NULL.
+ *  2) Calling serialize with a NULL size.

libsepol/src/serialize.c line 42

Quoted 4 lines

libsepol/src/serialize.c new file +4 -0

+ *     This results in data being filled with the
+ *     serialized information.  Caller must pre-allocate
+ *     space for data.  Destructively modifies data.
+ *

Why don't you allocate space for the caller? These two use cases are, well, odd. If you allocate then the caller can memcpy and free if they want.

Quoted 6 lines

libsepol/src/serialize.c new file +6 -0

+ *  This function acts iteratively moving the *data or size values.
+ *
+ *  Supported datum_types (defined in serialize.h):
+ *
+ *  SEPOL_SERIAL_INT32_T
+ *    Serializes datum to a int32_t as defined in inttypes.h

libsepol/src/serialize.c line 58

Quoted 10 lines

libsepol/src/serialize.c new file +10 -0

+ *    datum may NOT be NULL.
+ *    datum_length is not utilized.
+ *  SEPOL_SERIAL_UINT32_T
+ *    Serializes datum to a uint32_t as defined in inttypes.h
+ *    datum may NOT be NULL.
+ *    datum_length is not utilized.
+ *  SEPOL_SERIAL_SIZE_T
+ *    Serializes datum to a size_t as defined in stddef.h
+ *    datum may NOT be NULL.
+ *    datum_length is not utilized.

How can you serialize a type that is platform specific? How would this be handled when communication between a 32 and 64 bit host? I thought we always used fixed width types for all binary communication anyway.

libsepol/src/serialize.c

Quoted 4 lines

libsepol/src/serialize.c new file +4 -0

+ *  SEPOL_SERIAL_STRING
+ *    Serializes a char*.
+ *    datum may be NULL.
+ *    datum_length should be the length of the string as 

returned by strlen.

Why not call strlen? Especially since the string array version does.

libsepol/src/serialize.c

Quoted 5 lines

libsepol/src/serialize.c new file +5 -0

+ *  SEPOL_SERIAL_STRING_ARRAY
+ *    Serializes a char**.
+ *    datum may be NULL.
+ *    datum_length should be the size of the array.
+ *    Each string will be serialized as per 

SEPOL_SERIAL_STRING and its size

libsepol/src/serialize.c

Quoted 3 lines

libsepol/src/serialize.c new file +3 -0

+ *    determined via strlen.
+ *
+ *  NULL pointers are distinguished (where they are 

allowed at all).

libsepol/src/serialize.c line 74

Quoted 3 lines

libsepol/src/serialize.c new file +3 -0

+ *  In the case of strings this means that a NULL char* has a 
+ different
+ *  serialization from the empty string "".

Why?

libsepol/src/serialize.c

Quoted 6 lines

libsepol/src/serialize.c new file +6 -0

+ *
+ */
+int sepol_serialize(sepol_handle_t * handle,
+		    const void *datum,
+		    size_t datum_length,
+		    unsigned int datum_type, char **data, 

uint64_t * size) {

Why a single multiplexed function? Seems _much_ easier to have a sepol_serialize_string, sepol_serialize_uint32, etc. This would allow type safety and improve readability, both at the call site and the definition.

<snip>

libsepol/src/serialize.c

Quoted 9 lines

libsepol/src/serialize.c new file +9 -0

+		case SEPOL_SERIAL_SIZE_T:
+			if (size == NULL) {
+				temp = calloc(1, sizeof(uint64_t));
+				if (temp == NULL) {
+					status = STATUS_ERR;
+					goto cleanup;
+				}
+
+				*((uint64_t *)temp) = 

cpu_to_le64(*((size_t *) datum));

libsepol/src/serialize.c line 117

Quoted 7 lines

libsepol/src/serialize.c new file +7 -0

+
+				memcpy(*data, temp, sizeof(uint64_t));
+				*data += sizeof(uint64_t);
+			}
+			else
+				*size += sizeof(uint64_t);
+			break;

Err - I don't think this is allowed. I believe that size_t is supposed to be word size and there is no reason that word size is limited to 64 bits.

Quoted 59 lines

From: Karl MacMillan [mailto:[email protected]]

Quoted 10 lines · On Mon, 2007-04-23 at 17:34 -0400, [email protected] wrote:

plain text document attachment (sepol.serialize.diff) Serialization versioning added to the sepol handle.

Serialization utility functions added in serialize.[ch]

---
 libsepol/include/sepol/handle.h |   17 +
 libsepol/src/handle.c           |   89 +++++++++
 libsepol/src/handle.h           |    5 
 libsepol/src/libsepol.map       |    1 
 libsepol/src/serialize.c        |  389 

++++++++++++++++++++++++++++++++++++++++

Quoted 30 lines

 libsepol/src/serialize.h        |   45 ++++
 6 files changed, 546 insertions(+)

Index: selinux-pms-support/libsepol/include/sepol/handle.h
===================================================================

libsepol/include/sepol/handle.h +12 -0

@@ -1,6 +1,11 @@
 #ifndef _SEPOL_HANDLE_H_
 #define _SEPOL_HANDLE_H_
 
+#include <inttypes.h>
+
+#define SEPOL_SERIAL_VERSION_MAJOR 1
+#define SEPOL_SERIAL_VERSION_MINOR 0
+
 struct sepol_handle;
 typedef struct sepol_handle sepol_handle_t;
 

@@ -10,4 +15,16 @@ sepol_handle_t *sepol_handle_create(void
 /* Destroy a sepol handle. */
 void sepol_handle_destroy(sepol_handle_t *);
 
+/* Serialize the serialization version. */ int 
+sepol_handle_version_serialize(sepol_handle_t * sh, char **data, 
+uint64_t *size);
+
+/* Unserialize the serialization version. */ int 
+sepol_handle_version_unserialize(sepol_handle_t * sh, char **data, 
+uint64_t *size);

libsepol/include/sepol/handle.h sepol_handle_t *sepol_handle_create(void · line 30

Quoted 10 lines

libsepol/include/sepol/handle.h +9 -0

+
+/* Get the serialization version. */
+int sepol_handle_get_version(sepol_handle_t *sh, uint32_t * major, 
+uint32_t * minor);
+
+/* Set the serialization version. */
+int sepol_handle_set_version(sepol_handle_t *sh, uint32_t major, 
+uint32_t minor);
+
 #endif

Can you give some idea about how the versioning is supposed to work? In
particular:

Quoted 5 lines

* How is it related to the policy version?
* Why would it change separately from the policy version?
* Is there any advantage to version each component separately rather that a global version?

Most of the stuff we are serializing isn't actually in policy, modules are already a serialized version of policy and we don't do anything with it, the stuff we are serializing is mostly semanage stuff (file contexts, seusers, etc) that have nothing to do with policy.

The
per-component versioning was discussed but thought to be too much overhead for the number of objects we are serializing.

Quoted 50 lines

<snip>

libsepol/src/serialize.c line 8

Quoted 13 lines

Index: selinux-pms-support/libsepol/src/serialize.c
===================================================================

libsepol/src/serialize.c new file +8 -0

@@ -0,0 +1,389 @@
+/* Author: Caleb Case <[email protected]>
+ *
+ * Copyright (C) 2004-2007 Tresys Technology, LLC
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2.1 of the License, or (at your option) any 

later version.

libsepol/src/serialize.c

Quoted 4 lines

libsepol/src/serialize.c new file +4 -0

+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  

See the GNU

libsepol/src/serialize.c

Quoted 3 lines

libsepol/src/serialize.c new file +3 -0

+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser 

General Public

Quoted 5 lines

libsepol/src/serialize.c new file +5 -0

+ *  License along with this library; if not, write to the Free 
+Software
+ *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  
+02110-1301  USA  */
+

libsepol/src/serialize.c

Quoted 10 lines

libsepol/src/serialize.c new file +10 -0

+#include <stdlib.h>
+#include <string.h>
+#include <limits.h>
+
+#include "handle.h"
+#include "debug.h"
+#include "serialize.h"
+#include "private.h"
+
+/* This file provides general serialize and unserialize 

functions. */

Quoted 9 lines

libsepol/src/serialize.c new file +9 -0

+
+/** Serializes various kinds of datum.
+ *
+ *  Two use cases:
+ *  1) Calling serialize with a non-NULL size.
+ *     This causes serialize to calculate the expected
+ *     size of serializing.  No serialization occurs.
+ *     Destructively modifies size.  Data may be NULL.
+ *  2) Calling serialize with a NULL size.

Quoted 9 lines

libsepol/src/serialize.c line 42

Quoted 4 lines

libsepol/src/serialize.c new file +4 -0

+ *     This results in data being filled with the
+ *     serialized information.  Caller must pre-allocate
+ *     space for data.  Destructively modifies data.
+ *

Why don't you allocate space for the caller? These two use cases are, well, odd. If you allocate then the caller can memcpy and free if they want.

It works basically the same way the current policy serialization works, pass in the data once to get size, allocate and pass in the buffer to which its being serialized. We did this for consistency with the current mechanisms.

Quoted 17 lines

Quoted 16 lines

libsepol/src/serialize.c new file +16 -0

+ *  This function acts iteratively moving the *data or size values.
+ *
+ *  Supported datum_types (defined in serialize.h):
+ *
+ *  SEPOL_SERIAL_INT32_T
+ *    Serializes datum to a int32_t as defined in inttypes.h
+ *    datum may NOT be NULL.
+ *    datum_length is not utilized.
+ *  SEPOL_SERIAL_UINT32_T
+ *    Serializes datum to a uint32_t as defined in inttypes.h
+ *    datum may NOT be NULL.
+ *    datum_length is not utilized.
+ *  SEPOL_SERIAL_SIZE_T
+ *    Serializes datum to a size_t as defined in stddef.h
+ *    datum may NOT be NULL.
+ *    datum_length is not utilized.

Quoted 5 lines

How can you serialize a type that is platform specific? How would this be handled when communication between a 32 and 64 bit host? I thought we always used fixed width types for all binary communication anyway.

SEPOL_SERIAL_SIZE_T is always 64 bits. We should be checking if it tries to serialize into a smaller type, if not that's a bug.

Quoted 4 lines

Quoted 4 lines

libsepol/src/serialize.c new file +4 -0

+ *  SEPOL_SERIAL_STRING
+ *    Serializes a char*.
+ *    datum may be NULL.
+ *    datum_length should be the length of the string as 

Quoted 4 lines

returned by strlen.

Why not call strlen? Especially since the string array version does.

IIRC because we use the same entry point for all data types to get to these.

Quoted 9 lines

libsepol/src/serialize.c

Quoted 5 lines

libsepol/src/serialize.c new file +5 -0

+ *  SEPOL_SERIAL_STRING_ARRAY
+ *    Serializes a char**.
+ *    datum may be NULL.
+ *    datum_length should be the size of the array.
+ *    Each string will be serialized as per 

SEPOL_SERIAL_STRING and its size

libsepol/src/serialize.c

Quoted 3 lines

libsepol/src/serialize.c new file +3 -0

+ *    determined via strlen.
+ *
+ *  NULL pointers are distinguished (where they are 

Quoted 7 lines

allowed at all).

libsepol/src/serialize.c line 74

Quoted 3 lines

libsepol/src/serialize.c new file +3 -0

+ *  In the case of strings this means that a NULL char* has a 
+ different
+ *  serialization from the empty string "".

Why?

Not sure, will check.

Quoted 8 lines

libsepol/src/serialize.c

Quoted 6 lines

libsepol/src/serialize.c new file +6 -0

+ *
+ */
+int sepol_serialize(sepol_handle_t * handle,
+		    const void *datum,
+		    size_t datum_length,
+		    unsigned int datum_type, char **data, 

uint64_t * size) {

Quoted 5 lines

Why a single multiplexed function? Seems _much_ easier to have a sepol_serialize_string, sepol_serialize_uint32, etc. This would allow type safety and improve readability, both at the call site and the definition.

We can do that I guess, IMO it doesn't make much of a difference.

Quoted 13 lines

<snip>

libsepol/src/serialize.c

Quoted 9 lines

libsepol/src/serialize.c new file +9 -0

+		case SEPOL_SERIAL_SIZE_T:
+			if (size == NULL) {
+				temp = calloc(1, sizeof(uint64_t));
+				if (temp == NULL) {
+					status = STATUS_ERR;
+					goto cleanup;
+				}
+
+				*((uint64_t *)temp) = 

cpu_to_le64(*((size_t *) datum));

Quoted 12 lines

libsepol/src/serialize.c line 117

Quoted 7 lines

libsepol/src/serialize.c new file +7 -0

+
+				memcpy(*data, temp, sizeof(uint64_t));
+				*data += sizeof(uint64_t);
+			}
+			else
+				*size += sizeof(uint64_t);
+			break;

Err - I don't think this is allowed. I believe that size_t is supposed to be word size and there is no reason that word size is limited to 64 bits.

IIRC in ANSI C it is limited to 64 bits. I might be wrong on this but I remember us looking it up when this happened.

From: Karl MacMillan [mailto:[email protected]]

Quoted 4 lines

The
per-component versioning was discussed but thought to be too much overhead for the number of objects we are serializing.

I guess the problem with this is it is hard to know exactly what the version is for. Per-component headers seem better to me.

Quoted 5 lines

Quoted 1 line

<snip>

It works basically the same way the current policy serialization works, pass in the data once to get size, allocate and pass in the buffer to which its being serialized. We did this for

consistency with

Quoted 2 lines

the current mechanisms.

I'm not certain that I would use the current policy serialization code as an example for anything - it is very difficult to work with.

Quoted 4 lines

SEPOL_SERIAL_SIZE_T is always 64 bits. We should be checking if it tries to serialize into a smaller type, if not that's a bug.

How can that be? On a 64bit platform I can represent a size that can't be represented by a 32bit size_t. How can I transfer this data to a 32bit system? I can't put it in a data structure with size_t - it would have to be unint64_t. So why not just use that?

Quoted 2 lines

IIRC because we use the same entry point for all data types

to get to

Quoted 2 lines

these.

But you know it is a string.

Quoted 33 lines

Quoted 9 lines

Quoted 5 lines

+ * SEPOL_SERIAL_STRING_ARRAY

+ *    Serializes a char**.
+ *    datum may be NULL.
+ *    datum_length should be the size of the array.
+ *    Each string will be serialized as per 

SEPOL_SERIAL_STRING and its size

Quoted 3 lines

+ * determined via strlen.
+ *
+ * NULL pointers are distinguished (where they are

Quoted 7 lines

allowed at all).

Quoted 3 lines

+ * In the case of strings this means that a NULL char* has a
+ different
+ * serialization from the empty string "".

Why?

Not sure, will check.

Quoted 13 lines

libsepol/src/serialize.c

Quoted 6 lines

+ *
+ */

libsepol/src/serialize.c new file +4 -0

+int sepol_serialize(sepol_handle_t * handle,
+		    const void *datum,
+		    size_t datum_length,
+		    unsigned int datum_type, char **data,

uint64_t * size) {

Why a single multiplexed function? Seems _much_ easier to have a sepol_serialize_string, sepol_serialize_uint32, etc. This would allow type safety and improve readability, both at the call site and the definition.

Quoted 2 lines

We can do that I guess, IMO it doesn't make much of a difference.

I think it makes a big difference.

Quoted 6 lines

Quoted 6 lines

<snip>

libsepol/src/serialize.c

Quoted 3 lines

libsepol/src/serialize.c new file +3 -0

+		case SEPOL_SERIAL_SIZE_T:
+			if (size == NULL) {
+				temp = calloc(1, 

sizeof(uint64_t));

Quoted 9 lines

Quoted 9 lines

libsepol/src/serialize.c

Quoted 6 lines

libsepol/src/serialize.c new file +6 -0

+				if (temp == NULL) {
+					status = STATUS_ERR;
+					goto cleanup;
+				}
+
+				*((uint64_t *)temp) =

cpu_to_le64(*((size_t *) datum));

Review

Quoted 2 lines

(quoted diff) +2 -0

+
+				memcpy(*data, temp, 

sizeof(uint64_t));

Quoted 11 lines

Quoted 10 lines

libsepol/src/serialize.c line 117

Quoted 5 lines

libsepol/src/serialize.c new file +5 -0

+				*data += sizeof(uint64_t);
+			}
+			else
+				*size += sizeof(uint64_t);
+			break;

Err - I don't think this is allowed. I believe that size_t is supposed to be word size and there is no reason that word size is limited to 64 bits.

Quoted 1 line

IIRC in ANSI C it is limited to 64 bits. I might be wrong

on this but

Quoted 2 lines

I remember us looking it up when this happened.

That sounds unlikely, but more importantly, why? Why not just use uint64_t?

Quoted 1 line

From: Karl MacMillan [mailto:[email protected]]

Quoted 11 lines

Quoted 4 lines

SEPOL_SERIAL_SIZE_T is always 64 bits. We should be checking if it tries to serialize into a smaller type, if not that's a bug.

How can that be? On a 64bit platform I can represent a size that can't be represented by a 32bit size_t. How can I transfer this data to a 32bit system? I can't put it in a data structure with size_t - it would have to be unint64_t. So why not just use that?

That's why I said "We should be checking if it tries to serialize into a smaller type, if not that's a bug"

IIRC we needed something that could serialize/unserialize size_t because its used in some components that we serialize. We could always cast to uint64_t and serialize it that way (which is pretty much what we are doing anyway).

From: Karl MacMillan [mailto:[email protected]]

Quoted 1 line · Joshua Brindle

Quoted 1 line

From: Karl MacMillan [mailto:[email protected]]

<snip>

Quoted 2 lines

Quoted 2 lines

Quoted 2 lines

SEPOL_SERIAL_SIZE_T is always 64 bits. We should be

checking if it

Quoted 5 lines

Quoted 5 lines

Quoted 2 lines

tries to serialize into a smaller type, if not that's a bug.

How can that be? On a 64bit platform I can represent a size that can't be represented by a 32bit size_t. How can I

transfer this data

Quoted 1 line

Quoted 1 line

to a 32bit system? I can't put it in a data structure

with size_t -

Quoted 5 lines

Quoted 3 lines

it would have to be unint64_t.
So why not just use that?

That's why I said "We should be checking if it tries to

serialize into

Quoted 4 lines

a smaller type, if not that's a bug"

IIRC we needed something that could serialize/unserialize size_t because its used in some components that we serialize. We

could always

Quoted 1 line

cast to uint64_t and serialize it that way (which is pretty

much what

Quoted 2 lines

we are doing anyway).

Something is going wrong in our communication here. You _cannot_ reliably transfer size_t from a 64bit system to a 32bit system (assuming that size_t is 64 and 32 bits respectively). That means that you cannot reliably serialize data structures that use size_t - you must change the data structures. Otherwise the serialized data will not be valid on all systems.

There is no way to check "if it tries to serialize into a smaller type"
- you will always hit this condition at some point.

As for the size, C99 says:

"The value of the result [of sizeof] is implementation-defined, and its type (an unsigned integer type) is size_t,"

Later it says:

"The types used for size_t and ptrdiff_t should not have an integer conversion rank greater than that of signed long int unless the implementation supports objects large enough to make this necessary."

I read that to say that the width of size_t is implementation defined and could be larger that 64 bits.

Quoted 59 lines

From: Karl MacMillan [mailto:[email protected]]

Quoted 1 line · Joshua Brindle

Quoted 1 line

From: Karl MacMillan [mailto:[email protected]]

<snip>

Quoted 2 lines

Quoted 2 lines

Quoted 2 lines

SEPOL_SERIAL_SIZE_T is always 64 bits. We should be

checking if it

Quoted 5 lines

Quoted 5 lines

Quoted 2 lines

tries to serialize into a smaller type, if not that's a bug.

How can that be? On a 64bit platform I can represent a size that can't be represented by a 32bit size_t. How can I

transfer this data

Quoted 1 line

Quoted 1 line

to a 32bit system? I can't put it in a data structure

with size_t -

Quoted 5 lines

Quoted 3 lines

it would have to be unint64_t.
So why not just use that?

That's why I said "We should be checking if it tries to

serialize into

Quoted 4 lines

a smaller type, if not that's a bug"

IIRC we needed something that could serialize/unserialize size_t because its used in some components that we serialize. We

could always

Quoted 1 line

cast to uint64_t and serialize it that way (which is pretty

much what

Quoted 2 lines

we are doing anyway).

Something is going wrong in our communication here. You _cannot_ reliably transfer size_t from a 64bit system to a 32bit system (assuming that size_t is 64 and 32 bits respectively). That means that you cannot reliably serialize data structures that use size_t - you must change the data structures. Otherwise the serialized data will not be valid on all systems.

There is no way to check "if it tries to serialize into a smaller type"
- you will always hit this condition at some point.

As for the size, C99 says:

"The value of the result [of sizeof] is implementation-defined, and its type (an unsigned integer type) is size_t,"

Later it says:

"The types used for size_t and ptrdiff_t should not have an integer conversion rank greater than that of signed long int unless the implementation supports objects large enough to make this necessary."

Quoted 2 lines

I read that to say that the width of size_t is implementation defined and could be larger that 64 bits.

How do you suppose we should serialize variables that are normally size_t then? For example, a policy module is essentially a file that gets sent across and has a length of size_t, all the policy module functions (eg., sepol_load_policy, etc) use a size_t so we have to serialize it and unserialize it in some way.

There is an assumption here that a policy file will never be longer than uint64 long, probably a fair assumption. On 32 bit systems I'll cast into a 32 bit and if its too long it should error out.

From: Karl MacMillan [mailto:[email protected]]

Quoted 8 lines · Joshua Brindle

Quoted 8 lines

From: Karl MacMillan [mailto:[email protected]]

Quoted 1 line · Joshua Brindle

Quoted 1 line

From: Karl MacMillan [mailto:[email protected]]

<snip>

Quoted 1 line

Quoted 1 line

Quoted 1 line

Quoted 6 lines

Quoted 6 lines

Quoted 1 line

Quoted 1 line

Quoted 1 line

SEPOL_SERIAL_SIZE_T is always 64 bits. We should be

checking if it

Quoted 4 lines

Quoted 4 lines

Quoted 2 lines

tries to serialize into a smaller type, if not that's a bug.

How can that be? On a 64bit platform I can represent

a size that

Quoted 8 lines

Quoted 8 lines

Quoted 1 line

Quoted 1 line

can't be represented by a 32bit size_t. How can I

transfer this data

Quoted 1 line

Quoted 1 line

to a 32bit system? I can't put it in a data structure

with size_t -

Quoted 4 lines

Quoted 3 lines

it would have to be unint64_t.
So why not just use that?

Quoted 5 lines

Quoted 5 lines

Quoted 1 line

That's why I said "We should be checking if it tries to

serialize into

Quoted 3 lines

a smaller type, if not that's a bug"

IIRC we needed something that could

serialize/unserialize size_t

Quoted 11 lines

Quoted 11 lines

Quoted 1 line

because its used in some components that we serialize. We

could always

Quoted 1 line

cast to uint64_t and serialize it that way (which is pretty

much what

Quoted 2 lines

we are doing anyway).

Something is going wrong in our communication here. You _cannot_ reliably transfer size_t from a 64bit system to a 32bit system (assuming that size_t is 64 and 32 bits respectively). That means that you cannot reliably serialize data structures that

use size_t -

Quoted 1 line

Quoted 1 line

you must change the data structures. Otherwise the

serialized data

Quoted 9 lines

Quoted 9 lines

will not be valid on all systems.

There is no way to check "if it tries to serialize into a smaller type"
- you will always hit this condition at some point.

As for the size, C99 says:

"The value of the result [of sizeof] is

implementation-defined, and

Quoted 6 lines

Quoted 6 lines

its type (an unsigned integer
type) is size_t,"

Later it says:

"The types used for size_t and ptrdiff_t should not have

an integer

Quoted 9 lines

Quoted 6 lines

conversion rank greater than that of signed long int unless the implementation supports objects large enough to make this necessary."

I read that to say that the width of size_t is implementation defined and could be larger that 64 bits.

How do you suppose we should serialize variables that are normally size_t then? For example, a policy module is essentially a

file that

Quoted 4 lines

gets sent across and has a length of size_t, all the policy module functions (eg., sepol_load_policy, etc) use a size_t so we have to serialize it and unserialize it in some way.

You define the size as uint64_t or uint32_t and check for overflow everywhere you convert from size_t (or long for things like fseek).

Quoted 1 line

From: Karl MacMillan [mailto:[email protected]]

Quoted 9 lines

Quoted 3 lines

How do you suppose we should serialize variables that are normally size_t then? For example, a policy module is essentially a

file that

Quoted 4 lines

gets sent across and has a length of size_t, all the policy module functions (eg., sepol_load_policy, etc) use a size_t so we have to serialize it and unserialize it in some way.

Quoted 4 lines

You define the size as uint64_t or uint32_t and check for overflow everywhere you convert from size_t (or long for things like fseek).

*sigh* I must not be making myself clear. That's what we are doing.

From: Karl MacMillan [mailto:[email protected]]

Quoted 1 line · Joshua Brindle

Quoted 1 line

From: Karl MacMillan [mailto:[email protected]]

<snip>

Quoted 2 lines

Quoted 2 lines

Quoted 2 lines

How do you suppose we should serialize variables that

are normally

Quoted 3 lines

Quoted 3 lines

Quoted 1 line

size_t then? For example, a policy module is essentially a

file that

Quoted 1 line

gets sent across and has a length of size_t, all the

policy module

Quoted 1 line

Quoted 1 line

Quoted 1 line

functions (eg., sepol_load_policy, etc) use a size_t so

we have to

Quoted 4 lines

Quoted 4 lines

Quoted 2 lines

serialize it and unserialize it in some way.

You define the size as uint64_t or uint32_t and check for

overflow

Quoted 1 line

Quoted 1 line

everywhere you convert from size_t (or long for things

like fseek).

Quoted 3 lines

Quoted 1 line

*sigh* I must not be making myself clear. That's what we are doing.

No - it is about where you are doing the checking. This doesn't belong in the generic layer because it obscures what the problem is. It belongs at the call site that interprets the fields.

Offering to serialize size_t is not a good interface - it makes it look like you are actually handling the problem when you are not. By forcing all of the serialized data into fixed-width types you are bringing the problem to the foreground.

That way the representation is always clear and valid and good error messages can be generated.

So move boiler plate casting and checking to the call site? I guess we can do that... :\

Quoted 2 lines · Joshua Brindle

So move boiler plate casting and checking to the call site? I guess we can do that... :\

Having a wrapper that does it for you isn't such a bad thing, and
calling that wrapper serialize_sizet/unserialize_sizet or whatever isn't the worst thing in the world[1].

The problem, from my POV, is that you check on the receiving side if
size_t happens to be bigger than uint32_t[2]. You are basically sending a uint64_t over the network that can never hold a value bigger than a uint32_t, so everything gets to send extra zeros. This is very misleading, just say what you mean by having the protocol use uint32_t, and check at the sending side if the value > uint32_t can hold, if so error in some way.

libsepol/src/boolean_record.c +9 -0

+
+/* Serialize/Unserialize */
+/** Destructively modifies data and size.
+ *  Caller must pre-allocate space for data.
+ *  Use sepol_bool_calculate_serialized_size(). */
+int sepol_bool_serialize(sepol_handle_t * handle,
+			 const sepol_bool_t * boolean,
+			 char **data, uint64_t * size)
+{

libsepol/src/boolean_record.c +22 -0

+}
+
+hidden_def(sepol_bool_serialize)
+
+/** Destructively modifies boolean, data and size.
+ *  Allocates space for boolean.
+ *  Caller must free. */
+int sepol_bool_unserialize(sepol_handle_t * handle,
+			   char **data, uint64_t * size,
+			   sepol_bool_t ** boolean)
+{
+	int status = STATUS_SUCCESS;
+	char *name = NULL;
+	size_t *name_size = NULL;
+	int *value = NULL;
+
+	/* Sundry sanity checks. */
+	if (handle == NULL || data == NULL || *data == NULL || size == NULL) {
+		status = STATUS_ERR;
+		goto cleanup;
+	}
+

plain text document attachment (semanage.serialize.diff) This is the serialization infrastructure for libsemanage.

---
 libsemanage/include/semanage/handle.h |   17 +
 libsemanage/src/handle.c              |   28 ++
 libsemanage/src/handle_internal.h     |    5 
 libsemanage/src/libsemanage.map       |    1 
 libsemanage/src/serialize.c           |  389 ++++++++++++++++++++++++++++++++++
 libsemanage/src/serialize.h           |   45 +++
 6 files changed, 485 insertions(+)

Index: selinux-pms-support/libsemanage/include/semanage/handle.h
===================================================================

libsemanage/include/semanage/handle.h +17 -0

@@ -21,6 +21,11 @@
 #ifndef _SEMANAGE_HANDLE_H_
 #define _SEMANAGE_HANDLE_H_
 
+#define SEMANAGE_SERIAL_VERSION_MAJOR 1
+#define SEMANAGE_SERIAL_VERSION_MINOR 0
+
+#include <inttypes.h>
+
 /* All accesses with semanage are through a "semanage_handle".  The
  * handle may ultimately reference local config files,
  * the binary policy file, a module store, or a policy management server. 

@@ -38,6 +43,18 @@ semanage_handle_t *semanage_handle_creat
  * previously called if the handle was connected. */
 void semanage_handle_destroy(semanage_handle_t *);
 
+/* Get the serialization version. */
+int semanage_handle_get_version(semanage_handle_t *sh, uint32_t * major, uint32_t * minor);
+
+/* Set the serialization version. */
+int semanage_handle_set_version(semanage_handle_t *sh, uint32_t major, uint32_t minor);
+
+/* Serialize the serialization version. */
+int semanage_handle_version_serialize(semanage_handle_t *sh, char **data, uint64_t *size);
+
+/* Unserialize the serialization version. */
+int semanage_handle_version_unserialize(semanage_handle_t *sh, char **data, uint64_t *size);
+
 /* This is the type of connection to the store, for now only
  * direct is supported */
 enum semanage_connect_type {

Index: selinux-pms-support/libsemanage/src/handle.c
===================================================================

libsemanage/src/handle.c +28 -0

@@ -82,6 +82,34 @@ semanage_handle_t *semanage_handle_creat
 	return NULL;
 }
 
+int semanage_handle_get_version(semanage_handle_t *sh, uint32_t * major, uint32_t * minor)
+{
+	return sepol_handle_get_version(sh->sepolh, major, minor);
+}
+
+hidden_def(semanage_handle_get_version)
+
+int semanage_handle_set_version(semanage_handle_t *sh, uint32_t major, uint32_t minor)
+{
+	return sepol_handle_set_version(sh->sepolh, major, minor);
+}
+
+hidden_def(semanage_handle_set_version)
+
+int semanage_handle_version_serialize(semanage_handle_t *sh, char **data, uint64_t *size)
+{
+	return sepol_handle_version_serialize(sh->sepolh, data, size);
+}
+
+hidden_def(semanage_handle_version_serialize)
+
+int semanage_handle_version_unserialize(semanage_handle_t *sh, char **data, uint64_t *size)
+{
+	return sepol_handle_version_unserialize(sh->sepolh, data, size);
+}
+
+hidden_def(semanage_handle_version_unserialize)
+
 void semanage_set_rebuild(semanage_handle_t * sh, int do_rebuild)
 {
 

Index: selinux-pms-support/libsemanage/src/handle_internal.h
===================================================================

libsemanage/src/handle_internal.h +5 -0

@@ -8,4 +8,9 @@ hidden_proto(semanage_begin_transaction)
     hidden_proto(semanage_handle_destroy)
     hidden_proto(semanage_reload_policy)
     hidden_proto(semanage_access_check)
+hidden_proto(semanage_handle_get_version)
+hidden_proto(semanage_handle_set_version)
+hidden_proto(semanage_handle_version_serialize)
+hidden_proto(semanage_handle_version_unserialize)
+
 #endif

Index: selinux-pms-support/libsemanage/src/libsemanage.map
===================================================================

libsemanage/src/libsemanage.map +1 -0

@@ -13,6 +13,7 @@ LIBSEMANAGE_1.0 {
 	  semanage_iface_*; semanage_port_*; semanage_context_*;
 	  semanage_node_*;
 	  semanage_fcontext_*; semanage_access_check; semanage_set_create_store;
+	  semanage_*_serialize; semanage_*_unserialize;
 	  semanage_is_connected;
   local: *;
 };

Index: selinux-pms-support/libsemanage/src/serialize.c
===================================================================

libsemanage/src/serialize.c new file +389 -0

@@ -0,0 +1,389 @@
+/* Author: Caleb Case <[email protected]>
+ *
+ * Copyright (C) 2004-2007 Tresys Technology, LLC
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2.1 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#include <stdlib.h>
+#include <string.h>
+#include <limits.h>
+
+#include "handle.h"
+#include "debug.h"
+#include "serialize.h"
+#include "byteswap.h"
+
+/* This file provides general serialize and unserialize functions. */
+
+/** Serializes various kinds of datum.
+ *
+ *  Two use cases:
+ *  1) Calling serialize with a non-NULL size.
+ *     This causes serialize to calculate the expected
+ *     size of serializing.  No serialization occurs.
+ *     Destructively modifies size.  Data may be NULL.
+ *  2) Calling serialize with a NULL size.
+ *     This results in data being filled with the
+ *     serialized information.  Caller must pre-allocate
+ *     space for data.  Destructively modifies data.
+ *
+ *  This function acts iteratively moving the *data or size values.
+ *
+ *  Supported datum_types (defined in serialize.h):
+ *
+ *  SEMANAGE_SERIAL_INT32_T
+ *    Serializes datum to a int32_t as defined in inttypes.h
+ *    datum may NOT be NULL.
+ *    datum_length is not utilized.
+ *  SEMANAGE_SERIAL_UINT32_T
+ *    Serializes datum to a uint32_t as defined in inttypes.h
+ *    datum may NOT be NULL.
+ *    datum_length is not utilized.
+ *  SEMANAGE_SERIAL_SIZE_T
+ *    Serializes datum to a size_t as defined in stddef.h
+ *    datum may NOT be NULL.
+ *    datum_length is not utilized.
+ *  SEMANAGE_SERIAL_STRING
+ *    Serializes a char*.
+ *    datum may be NULL.
+ *    datum_length should be the length of the string as returned by strlen.
+ *  SEMANAGE_SERIAL_STRING_ARRAY
+ *    Serializes a char**.
+ *    datum may be NULL.
+ *    datum_length should be the size of the array.
+ *    Each string will be serialized as per SEMANAGE_SERIAL_STRING and its size
+ *    determined via strlen.
+ *
+ *  NULL pointers are distinguished (where they are allowed at all).
+ *  In the case of strings this means that a NULL char* has a different
+ *  serialization from the empty string "".
+ *
+ */
+int semanage_serialize(semanage_handle_t * handle,
+		    const void *datum,
+		    size_t datum_length,
+		    unsigned int datum_type, char **data, uint64_t * size)
+{
+	int status;
+	unsigned int flags;
+	uint32_t i;
+	void *temp = NULL;
+
+	switch (datum_type) {
+		case SEMANAGE_SERIAL_INT32_T:
+		case SEMANAGE_SERIAL_UINT32_T:
+			if (size == NULL) {
+				temp = calloc(1, sizeof(int32_t));
+				if (temp == NULL) {
+					status = STATUS_ERR;
+					goto cleanup;
+				}
+
+				*((int32_t *)temp) = cpu_to_le32(*((int32_t *) datum));
+				memcpy(*data, temp, sizeof(int32_t));
+				*data += sizeof(int32_t);
+			}
+			else
+				*size += sizeof(int32_t);
+			break;
+		case SEMANAGE_SERIAL_SIZE_T:
+			if (size == NULL) {
+				temp = calloc(1, sizeof(uint64_t));
+				if (temp == NULL) {
+					status = STATUS_ERR;
+					goto cleanup;
+				}
+
+				*((uint64_t *)temp) = cpu_to_le64(*((size_t *) datum));
+
+				memcpy(*data, temp, sizeof(uint64_t));
+				*data += sizeof(uint64_t);
+			}
+			else
+				*size += sizeof(uint64_t);
+			break;
+		case SEMANAGE_SERIAL_STRING:
+			/* Flags (intended as a bitmap):
+			 * 0 == NULL
+			 * 1 == Non NULL
+			 */
+			flags = (datum == NULL) ? 0 : 1;
+
+			status =
+				semanage_serialize(handle, &flags, 0, SEMANAGE_SERIAL_UINT32_T, data,
+						size);
+			if (status != STATUS_SUCCESS)
+				goto cleanup;
+
+			/* Write if not null. */
+			if (flags & 1) {
+				/* Size. */
+				status =
+					semanage_serialize(handle, &datum_length, 0,
+							SEMANAGE_SERIAL_SIZE_T, data, size);
+				if (status != STATUS_SUCCESS)
+					goto cleanup;
+
+				/* Datum. */
+				if (size == NULL) {
+					status =
+						snprintf(*data, datum_length + 1, "%s",
+								(char *)datum);
+					if (status < 0 || (unsigned)status > datum_length)
+						goto cleanup;
+					else {
+						*data += status + 1;
+						status = STATUS_SUCCESS;
+					}
+				} else {
+					*size += datum_length + 1;
+				}
+			}
+			break;
+		case SEMANAGE_SERIAL_STRING_ARRAY:
+			/* Flags (intended as a bitmap):
+			 * 0 == NULL
+			 * 1 == Non NULL
+			 */
+			flags = (datum == NULL) ? 0 : 1;
+
+			status =
+				semanage_serialize(handle, &flags, 0, SEMANAGE_SERIAL_UINT32_T, data,
+						size);
+			if (status != STATUS_SUCCESS)
+				goto cleanup;
+
+			/* Write if not null. */
+			if (flags & 1) {
+				/* Size. */
+				status =
+					semanage_serialize(handle, &datum_length, 0,
+							SEMANAGE_SERIAL_UINT32_T, data, size);
+				if (status != STATUS_SUCCESS)
+					goto cleanup;
+
+				/* Datum. */
+				for (i = 0; i < datum_length; i++) {
+					status =
+						semanage_serialize(handle, ((char **)datum)[i],
+								strlen(((char **)datum)[i]),
+								SEMANAGE_SERIAL_STRING, data, size);
+					if (status != STATUS_SUCCESS)
+						goto cleanup;
+				}
+			}
+			break;
+		default:
+			status = STATUS_ERR;
+			goto cleanup;
+	}
+
+	/* Cleanup. */
+	status = STATUS_SUCCESS;
+cleanup:
+	free(temp);
+	return status;
+}
+
+/** Unserializes various kinds of datum as serialized by semanage_serialize.
+ *
+ *  This function acts iteratively moving the *data AND size values.
+ *  size is decremented as data is unserialized.
+ *
+ *  It also allocates memory for datum and, depending on datum_type, datum_length.
+ *  Caller must free.
+ *
+ *  Supported datum_types (defined in serialize.h):
+ *
+ *  SEMANAGE_SERIAL_INT32_T
+ *    Unserializes data into an int32_t as defined in inttypes.h.
+ *    datum_length may be NULL.
+ *  SEMANAGE_SERIAL_UINT32_T
+ *    Unserializes data into an uint32_t as defined in inttypes.h.
+ *    datum_length may be NULL.
+ *  SEMANAGE_SERIAL_SIZE_T
+ *    Unserializes data into an size_t as defined in stddef.h.
+ *    datum_length may be NULL.
+ *  SEMANAGE_SERIAL_STRING
+ *    Unserializes data into a NULL terminated char*.
+ *    datum_length may NOT be NULL and will be the size of the string.
+ *  SEMANAGE_SERIAL_STRING_ARRAY
+ *    Unserializes data into a char**.
+ *    Each entry in the array will be unserialized as per SEMANAGE_SERIAL_STRING.
+ *    datum_length may NOT be NULL and will be the size of the array.
+ */
+int semanage_unserialize(semanage_handle_t * handle,
+		char **data, uint64_t * size,
+		void **datum,
+		size_t ** datum_length,
+		unsigned int datum_type)
+{
+	int status;
+	unsigned int *flags = NULL;
+	uint32_t i;
+	void *temp = NULL;
+	size_t *temp_length = NULL;
+
+	switch (datum_type) {
+		case SEMANAGE_SERIAL_INT32_T:
+		case SEMANAGE_SERIAL_UINT32_T:
+			*datum = calloc(1, sizeof(int32_t));
+			if (*datum == NULL) {
+				status = STATUS_ERR;
+				goto cleanup;
+			}
+
+			memcpy(*datum, *data, sizeof(int32_t));
+			**((int32_t **)datum) = le32_to_cpu(**((int32_t **) datum));
+
+			*size -= sizeof(int32_t);
+			*data += sizeof(int32_t);
+			break;
+		case SEMANAGE_SERIAL_SIZE_T:
+			temp = calloc(1, sizeof(uint64_t));
+			if (temp == NULL) {
+				status = STATUS_ERR;
+				goto cleanup;
+			}
+
+			memcpy(temp, *data, sizeof(uint64_t));
+
+			*((uint64_t *) temp) = le64_to_cpu(*((uint64_t *) temp));
+
+			if (*((uint64_t *) temp) > UINT_MAX) {
+				status = STATUS_ERR;
+				goto cleanup;
+			}
+
+			*datum = calloc(1, sizeof(size_t));
+			if (datum == NULL) {
+				status = STATUS_ERR;
+				goto cleanup;
+			}
+
+			**((size_t **)datum) = *((uint64_t *) temp);
+
+			*size -= sizeof(uint64_t);
+			*data += sizeof(uint64_t);
+			break;
+		case SEMANAGE_SERIAL_STRING:
+			/* Flags (intended as a bitmap):
+			 * 0 == NULL
+			 * 1 == Non NULL
+			 */
+			status =
+				semanage_unserialize(handle,
+						data, size,
+						(void **)(&flags), NULL,
+						SEMANAGE_SERIAL_UINT32_T);
+			if (status != STATUS_SUCCESS)
+				goto cleanup;
+
+			if (*flags & 1) {
+				/* Size. */
+				status =
+					semanage_unserialize(handle,
+							data, size,
+							(void **)datum_length, NULL,
+							SEMANAGE_SERIAL_SIZE_T);
+				if (status != STATUS_SUCCESS)
+					goto cleanup;
+
+				/* Datum. */
+				*datum = calloc(**datum_length + 1, sizeof(char));
+				if (*datum == NULL) {
+					status = STATUS_ERR;
+					goto cleanup;
+				}
+
+				memcpy(*datum, *data, **datum_length + 1);
+
+				*size -= **datum_length + 1;
+				*data += **datum_length + 1;
+			} else {
+				*datum = NULL;
+				*datum_length = NULL;
+			}
+
+			free(flags);
+			flags = NULL;
+			break;
+		case SEMANAGE_SERIAL_STRING_ARRAY:
+			/* Flags (intended as a bitmap):
+			 * 0 == NULL
+			 * 1 == Non NULL
+			 */
+			status =
+				semanage_unserialize(handle,
+						data, size,
+						(void **)(&flags), NULL,
+						SEMANAGE_SERIAL_UINT32_T);
+			if (status != STATUS_SUCCESS)
+				goto cleanup;
+
+			/* Write if not null. */
+			if (*flags & 1) {
+				/* Size. */
+				status =
+					semanage_unserialize(handle,
+							data, size,
+							(void **)datum_length, NULL,
+							SEMANAGE_SERIAL_UINT32_T);
+				if (status != STATUS_SUCCESS)
+					goto cleanup;
+
+				/* Datum. */
+				*datum =
+					calloc(sizeof(char *),
+							sizeof(char *) * (**datum_length));
+				if (*datum == NULL) {
+					status = STATUS_ERR;
+					goto cleanup;
+				}
+
+				for (i = 0; i < **datum_length; i++) {
+					status = semanage_unserialize(handle,
+							data,
+							size,
+							(void **)&(((char **)(*datum))[i]),
+							&temp_length,
+							SEMANAGE_SERIAL_STRING);
+
+					if (status != STATUS_SUCCESS)
+						goto cleanup;
+
+					free(temp_length);
+					temp_length = NULL;
+				}
+			}
+
+			free(flags);
+			flags = NULL;
+			break;
+		default:
+			status = STATUS_ERR;
+			goto cleanup;
+	}
+
+	/* Cleanup. */
+	status = STATUS_SUCCESS;
+cleanup:
+	free(flags);
+	free(temp);
+	free(temp_length);
+	return status;
+}
+

Index: selinux-pms-support/libsemanage/src/serialize.h
===================================================================

libsemanage/src/serialize.h new file +35 -0

@@ -0,0 +1,45 @@
+/* Author: Caleb Case <[email protected]>
+ *
+ * Copyright (C) 2005-2007 Tresys Technology, LLC
+ * Copyright (C) 2005 Red Hat Inc.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2.1 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#ifndef _SEMANAGE_SERIALIZE_INTERNAL_H_
+#define _SEMANAGE_SERIALIZE_INTERNAL_H_
+
+#include <inttypes.h>
+#include "handle.h"
+
+/* Datum types. */
+#define SEMANAGE_SERIAL_INT32_T 0
+#define SEMANAGE_SERIAL_UINT32_T 1
+#define SEMANAGE_SERIAL_SIZE_T 2
+#define SEMANAGE_SERIAL_STRING 3
+#define SEMANAGE_SERIAL_STRING_ARRAY 4
+
+int semanage_serialize(semanage_handle_t * handle,
+		    const void *datum,

From: Karl MacMillan [mailto:[email protected]]

Quoted 1 line · On Mon, 2007-04-23 at 17:35 -0400, [email protected] wrote:

plain text document attachment (semanage.serialize.diff)

This is the

Quoted 2 lines

serialization infrastructure for libsemanage.

We have talked about this in the past, but I think the duplication between libsemanage and libsepol should be removed. This is just ridiculous.

Quoted 8 lines

From: Karl MacMillan [mailto:[email protected]]

Quoted 1 line · On Mon, 2007-04-23 at 17:35 -0400, [email protected] wrote:

plain text document attachment (semanage.serialize.diff)

This is the

Quoted 2 lines

serialization infrastructure for libsemanage.

Quoted 4 lines

We have talked about this in the past, but I think the duplication between libsemanage and libsepol should be removed. This is just ridiculous.

We haven't figured out how to remove it. There are lots of objects that are only in semanage (fcontext, seuser, etc) and many that are in sepol (user, boolean, etc).

We could do serialization of all sepol types (we
are going to do that anyway for the new policy rep) and remove that stuff from libsemanage (I thought that was the plan anyway), for now this is how we did it. Hopefully that'll change. Both libraries are going to have to have serialization/unserialization infrastructure in any case.