show correct error message when a policy has duplicate declarations

PATCH In review Jason Tang 3 participants 4 messages Aug 31, 2005 – Sep 2, 2005 SELinux security module

Share & tools

Jason Tang

author

2005-08-31 17:44 UTC #0 lore raw

PATCH 1/1 show correct error message when a policy has duplicate declarations

Although checkpolicy/checkmodule catch duplicate declarations, the compiler prints the wrong message. This patch alters the program so that it shows the correct message.

Signature · 1 line

Jason Tang / [email protected]

module_compiler.c +6 -2

@@ -145,9 +145,11 @@ int declare_symbol(uint32_t symbol_type,
         else if (retval == -2) {
                 return -2;
         }
-        else if (retval == -1 || retval == -ENOMEM) {
+        else if (retval < 0) {
                 return -3;
         }
+        else {  /* fall through possible if retval is 0 */
+        }
         if (datum_value != NULL) {
                 if (ebitmap_set_bit(decl->declared.scope + symbol_type,
                                     *datum_value - 1,

@@ -497,9 +499,11 @@ int require_symbol(uint32_t symbol_type,
         else if (retval == -2) {
                 return -2;
         }
-        else if (retval == -1 || retval == -ENOMEM) {
+        else if (retval < 0) {
                 return -3;
         }
+        else {  /* fall through possible if retval is 0 */
+        }
         if (datum_value != NULL) {
                 if (ebitmap_set_bit(decl->required.scope + symbol_type,
                                     *datum_value - 1,

Stephen Smalley

2005-08-31 18:09 UTC #1 lore raw

Quoted 3 lines · Jason Tang

Although checkpolicy/checkmodule catch duplicate declarations, the compiler prints the wrong message. This patch alters the program so that it shows the correct message.

Hmm...interesting. Adding a duplicate type declaration for device_t, I see the following behaviors before and after this patch:

Before:
checkpolicy: module_compiler.c:318: declare_type: Assertion `0' failed.

After:
types/device.te:16:ERROR 'Out of memory!' at token ';' on line 3855:

type device_t;
checkpolicy: error(s) encountered while parsing configuration

Somewhat improved, but still not what we want.

Signature · 8 lines

Stephen Smalley
National Security Agency


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to [email protected] with
the words "unsubscribe selinux" without quotes as the message.

Stephen Smalley

2005-08-31 18:23 UTC #2 lore raw

Quoted 11 lines · Stephen Smalley

Quoted 3 lines · Jason Tang
Although checkpolicy/checkmodule catch duplicate declarations, the compiler prints the wrong message. This patch alters the program so that it shows the correct message.
Hmm...interesting. Adding a duplicate type declaration for device_t, I see the following behaviors before and after this patch:
Before:
checkpolicy: module_compiler.c:318: declare_type: Assertion `0' failed.

Quoted 7 lines

After:
types/device.te:16:ERROR 'Out of memory!' at token ';' on line 3855:
type device_t;
checkpolicy: error(s) encountered while parsing configuration
Somewhat improved, but still not what we want.

Looks like the real bug is in libsepol, i.e.

Index: libsepol/src/util.c
===================================================================
RCS file: /nfshome/pal/CVS/selinux-usr/libsepol/src/util.c,v retrieving revision 1.4

src/util.c +1 -1

diff -u -p -r1.4 util.c
@@ -175,7 +175,7 @@ int symtab_insert(policydb_t *pol, uint3
                 }
                 else {
                         /* duplicate declarations not allowed for all else */
-                        return rc;
+                        return -2;
                 }
         }
         else {

Not clear whether your patch is needed or not at that point.

Signature · 8 lines

Stephen Smalley
National Security Agency


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to [email protected] with
the words "unsubscribe selinux" without quotes as the message.

Joshua Brindle

2005-09-02 13:36 UTC #3 lore raw

Quoted 46 lines · Stephen Smalley

Quoted 14 lines · Stephen Smalley
Quoted 5 lines · Jason Tang
Although checkpolicy/checkmodule catch duplicate declarations, the compiler prints the wrong message. This patch alters the program so that it shows the correct message.
Hmm...interesting. Adding a duplicate type declaration for device_t, I see the following behaviors before and after this patch:
Before:
checkpolicy: module_compiler.c:318: declare_type: Assertion `0' failed.
Quoted 9 lines
After:
types/device.te:16:ERROR 'Out of memory!' at token ';' on line 3855:
type device_t;
checkpolicy: error(s) encountered while parsing configuration
Somewhat improved, but still not what we want.
Looks like the real bug is in libsepol, i.e.
Index: libsepol/src/util.c
===================================================================
RCS file: /nfshome/pal/CVS/selinux-usr/libsepol/src/util.c,v retrieving revision 1.4
diff -u -p -r1.4 util.c
src/util.c +1 -1
@@ -175,7 +175,7 @@ int symtab_insert(policydb_t *pol, uint3
                }
                else {
                        /* duplicate declarations not allowed for all else */
-                        return rc;
+                        return -2;
                }
        }
        else {

Quoted 3 lines

Not clear whether your patch is needed or not at that point.

Probably not but it would be a good idea to audit all the error handling so that this sort of thing doesn't happen in the future.

--
This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to [email protected] with the words "unsubscribe selinux" without quotes as the message.