Skip to contentSkip to conversation

checkpolicy: parse for default_file_trans rules

PATCH In review Daniel J Walsh 3 participants 3 messages Nov 1, 2011 – Nov 2, 2011 SELinux security module

lore
Share & tools
lore

Daniel J Walsh

author
#0 lore raw

PATCH 50/63 checkpolicy: parse for default_file_trans rules

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

This patch looks good to me. acked.

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iEYEARECAAYFAk6wTHYACgkQrlYvE4MpobP/wwCePf+mpFHYQ/5uvtuYA1MYA8Yt GEoAoLq+aavuux14a6NhsSpg/h2rR61Z
=fzsp
-----END PGP SIGNATURE-----

#1 lore raw
Quoted 160 lines · Daniel J Walsh

OpenPGP: *Attachments to this message have not been signed or encrypted*

********* *BEGIN ENCRYPTED or SIGNED PART* *********

This patch looks good to me. acked.

********** *END ENCRYPTED or SIGNED PART* **********

0050-checkpolicy-parse-for-default_file_trans-rules.patchFrom 8ead51a6d41f63b43726c617480593f6a8fd0899 Mon Sep 17 00:00:00 2001
From: Eric Paris <[email protected]>
Date: Fri, 14 Oct 2011 10:57:20 -0400
Subject: [PATCH 50/63] checkpolicy: parse for default_file_trans rules

Signed-off-by Eric Paris <[email protected]>
---
 checkpolicy/policy_define.c |   33 +++++++++++++++++++++++++++++++++
 checkpolicy/policy_define.h |    9 +++++++++
 checkpolicy/policy_parse.y  |   21 ++++++++++++++++++++-
 checkpolicy/policy_scan.l   |    8 +++++++-
 4 files changed, 69 insertions(+), 2 deletions(-)
checkpolicy/policy_define.c +33 -0
index 1bf669c..838b6aa 100644
@@ -327,6 +327,39 @@ int define_initial_sid(void)
 	return -1;
 }
 
+int define_default_file_trans(int component, int from)
+{
+	char *id;
+	ebitmap_t e_tclasses;
+	class_datum_t *cladatum;
+
+	if (pass == 1) {
+		while ((id = queue_remove(id_queue)))
+			free(id);
+		return 0;
+	}
+
+	ebitmap_init(&e_tclasses);
+	while ((id = queue_remove(id_queue))) {
+		if (!is_id_in_scope(SYM_CLASSES, id)) {
+			yyerror2("class %s is not within scope", id);
+			return -1;
+		}
+		cladatum = hashtab_search(policydbp->p_classes.table, id);
+		if (!cladatum) {
+			yyerror2("unknown class %s", id);
+			return -1;
+		}
+		if (ebitmap_set_bit(&e_tclasses, cladatum->s.value - 1, TRUE)) {
+			yyerror("Out of memory");
+			return -1;
+		}
+		free(id);
+	}
+
+	return 0;
+}
+
 int define_common_perms(void)
 {
 	char *id = 0, *perm = 0;
checkpolicy/policy_define.h +9 -0
index 92a9be7..c77e87d 100644
@@ -13,6 +13,14 @@
 #define TRUE 1
 #define FALSE 0
 
+enum dft_enum {
+	DFT_USER,
+	DFT_ROLE,
+	DFT_LEVEL,
+	DFT_PROCESS,
+	DFT_PARENT,
+};
+
 avrule_t *define_cond_compute_type(int which);
 avrule_t *define_cond_pol_list(avrule_t *avlist, avrule_t *stmt);
 avrule_t *define_cond_te_avtab(int which);

@@ -52,6 +60,7 @@ int define_role_types(void);
 int define_role_attr(void);
 int define_roleattribute(void);
 int define_filename_trans(void);
+int define_default_file_trans(int componnt, int from);
 int define_sens(void);
 int define_te_avtab(int which);
 int define_typealias(void);
checkpolicy/policy_parse.y +20 -1
index 1e3ef6f..1107d79 100644
@@ -143,6 +143,9 @@ typedef int (* require_func_t)();
 %token POLICYCAP
 %token PERMISSIVE
 %token FILESYSTEM
+%token DEFAULT_FILE_TRANS
+%token PROCESS
+%token PARENT
 
 %left OR
 %left XOR

@@ -160,7 +163,7 @@ base_policy             : { if (define_policy(pass, 0) == -1) return -1; }
 			  opt_mls te_rbac users opt_constraints 
                          { if (pass == 1) { if (policydb_index_bools(policydbp)) return -1;}
 			   else if (pass == 2) { if (policydb_index_others(NULL, policydbp, 0)) return -1;}}
-			  initial_sid_contexts opt_fs_contexts opt_fs_uses opt_genfs_contexts net_contexts opt_dev_contexts
+			  initial_sid_contexts opt_fs_contexts opt_fs_uses opt_genfs_contexts net_contexts opt_dev_contexts default_file_trans_rules
 			;
 classes			: class_def 
 			| classes class_def

@@ -176,6 +179,22 @@ initial_sid_def		: SID identifier
 			;
 access_vectors		: opt_common_perms av_perms
 			;
+default_file_trans_rules : default_file_trans_def
+                        | default_file_trans_rules default_file_trans_def
+                        ;
+default_file_trans_def	: DEFAULT_FILE_TRANS USER names PROCESS ';'
+			{if (define_default_file_trans(DFT_USER, DFT_PROCESS)) return -1;}
+			| DEFAULT_FILE_TRANS ROLE names PROCESS ';'
+			{if (define_default_file_trans(DFT_ROLE, DFT_PROCESS)) return -1;}
+			| DEFAULT_FILE_TRANS LEVEL names PROCESS ';'
+			{if (define_default_file_trans(DFT_LEVEL, DFT_PROCESS)) return -1;}
+			| DEFAULT_FILE_TRANS USER names PARENT ';'
+			{if (define_default_file_trans(DFT_USER, DFT_PARENT)) return -1;}
+			| DEFAULT_FILE_TRANS ROLE names PARENT ';'
+			{if (define_default_file_trans(DFT_ROLE, DFT_PARENT)) return -1;}
+			| DEFAULT_FILE_TRANS LEVEL names PARENT ';'
+			{if (define_default_file_trans(DFT_LEVEL, DFT_PARENT)) return -1;}
+			;
 opt_common_perms        : common_perms
                         |
                         ;
checkpolicy/policy_scan.l +6 -0
index 2ba5971..c6fd24c 100644
@@ -219,6 +219,12 @@ h2 |
 H2				{ return(H2); }
 policycap |
 POLICYCAP			{ return(POLICYCAP); }
+process |
+PROCESS				{ return(PROCESS); }
+parent |
+PARENT				{ return(PARENT); }
+default_file_trans |
+DEFAULT_FILE_TRANS		{ return(DEFAULT_FILE_TRANS); }
 permissive |
 PERMISSIVE			{ return(PERMISSIVE); }
 "/"({alnum}|[_\.\-/])*	        { return(PATH); }

checkpolicy/policy_scan.l PERMISSIVE { return(PERMISSIVE); }

Quoted 9 lines
checkpolicy/policy_scan.l +1 -2
@@ -228,7 +234,7 @@ PERMISSIVE			{ return(PERMISSIVE); }
 {hexval}{0,4}":"{hexval}{0,4}":"({hexval}|[:.])*  { return(IPV6_ADDR); }
 {digit}+(\.({alnum}|[_.])*)?    { return(VERSION_IDENTIFIER); }
 {alnum}*                        { return(FILENAME); }
-\.({alnum}|[_\.\-])*	        { return(FILENAME); }
+\.({alnum}|[_\.\-])+	        { return(FILENAME); }
 {letter}+([-_\.]|{alnum})+      { return(FILENAME); }
 ([_\.]){alnum}+                 { return(FILENAME); }
 #line[ ]1[ ]\"[^\n]*\"		{ set_source_file(yytext+9); }
-- 1.7.7

This looks like this is the same patch sent to the list a couple of weeks ago but with a couple of name changes (e.g. DT -> DFT, default_trans -> default_file_trans), and there was still some discussion on it. I believe it ended with "Eric is on vacation, we'll see what he has to say when he gets back." Is this right?

--
This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to [email protected] with the words "unsubscribe selinux" without quotes as the message.

#2 lore raw
Quoted 168 lines · Steve Lawrence
Quoted 167 lines · Daniel J Walsh

OpenPGP: *Attachments to this message have not been signed or encrypted*

********* *BEGIN ENCRYPTED or SIGNED PART* *********

This patch looks good to me. acked.

********** *END ENCRYPTED or SIGNED PART* **********

0050-checkpolicy-parse-for-default_file_trans-rules.patchFrom 8ead51a6d41f63b43726c617480593f6a8fd0899 Mon Sep 17 00:00:00 2001
From: Eric Paris <[email protected]>
Date: Fri, 14 Oct 2011 10:57:20 -0400
Subject: [PATCH 50/63] checkpolicy: parse for default_file_trans rules

Signed-off-by Eric Paris <[email protected]>
---
 checkpolicy/policy_define.c |   33 +++++++++++++++++++++++++++++++++
 checkpolicy/policy_define.h |    9 +++++++++
 checkpolicy/policy_parse.y  |   21 ++++++++++++++++++++-
 checkpolicy/policy_scan.l   |    8 +++++++-
 4 files changed, 69 insertions(+), 2 deletions(-)
checkpolicy/policy_define.c +33 -0
index 1bf669c..838b6aa 100644
@@ -327,6 +327,39 @@ int define_initial_sid(void)
 	return -1;
 }
 
+int define_default_file_trans(int component, int from)
+{
+	char *id;
+	ebitmap_t e_tclasses;
+	class_datum_t *cladatum;
+
+	if (pass == 1) {
+		while ((id = queue_remove(id_queue)))
+			free(id);
+		return 0;
+	}
+
+	ebitmap_init(&e_tclasses);
+	while ((id = queue_remove(id_queue))) {
+		if (!is_id_in_scope(SYM_CLASSES, id)) {
+			yyerror2("class %s is not within scope", id);
+			return -1;
+		}
+		cladatum = hashtab_search(policydbp->p_classes.table, id);
+		if (!cladatum) {
+			yyerror2("unknown class %s", id);
+			return -1;
+		}
+		if (ebitmap_set_bit(&e_tclasses, cladatum->s.value - 1, TRUE)) {
+			yyerror("Out of memory");
+			return -1;
+		}
+		free(id);
+	}
+
+	return 0;
+}
+
 int define_common_perms(void)
 {
 	char *id = 0, *perm = 0;
checkpolicy/policy_define.h +9 -0
index 92a9be7..c77e87d 100644
@@ -13,6 +13,14 @@
 #define TRUE 1
 #define FALSE 0
 
+enum dft_enum {
+	DFT_USER,
+	DFT_ROLE,
+	DFT_LEVEL,
+	DFT_PROCESS,
+	DFT_PARENT,
+};
+
 avrule_t *define_cond_compute_type(int which);
 avrule_t *define_cond_pol_list(avrule_t *avlist, avrule_t *stmt);
 avrule_t *define_cond_te_avtab(int which);

@@ -52,6 +60,7 @@ int define_role_types(void);
 int define_role_attr(void);
 int define_roleattribute(void);
 int define_filename_trans(void);
+int define_default_file_trans(int componnt, int from);
 int define_sens(void);
 int define_te_avtab(int which);
 int define_typealias(void);
checkpolicy/policy_parse.y +20 -1
index 1e3ef6f..1107d79 100644
@@ -143,6 +143,9 @@ typedef int (* require_func_t)();
 %token POLICYCAP
 %token PERMISSIVE
 %token FILESYSTEM
+%token DEFAULT_FILE_TRANS
+%token PROCESS
+%token PARENT
 
 %left OR
 %left XOR

@@ -160,7 +163,7 @@ base_policy             : { if (define_policy(pass, 0) == -1) return -1; }
 			  opt_mls te_rbac users opt_constraints 
                          { if (pass == 1) { if (policydb_index_bools(policydbp)) return -1;}
 			   else if (pass == 2) { if (policydb_index_others(NULL, policydbp, 0)) return -1;}}
-			  initial_sid_contexts opt_fs_contexts opt_fs_uses opt_genfs_contexts net_contexts opt_dev_contexts
+			  initial_sid_contexts opt_fs_contexts opt_fs_uses opt_genfs_contexts net_contexts opt_dev_contexts default_file_trans_rules
 			;
 classes			: class_def 
 			| classes class_def

@@ -176,6 +179,22 @@ initial_sid_def		: SID identifier
 			;
 access_vectors		: opt_common_perms av_perms
 			;
+default_file_trans_rules : default_file_trans_def
+                        | default_file_trans_rules default_file_trans_def
+                        ;
+default_file_trans_def	: DEFAULT_FILE_TRANS USER names PROCESS ';'
+			{if (define_default_file_trans(DFT_USER, DFT_PROCESS)) return -1;}
+			| DEFAULT_FILE_TRANS ROLE names PROCESS ';'
+			{if (define_default_file_trans(DFT_ROLE, DFT_PROCESS)) return -1;}
+			| DEFAULT_FILE_TRANS LEVEL names PROCESS ';'
+			{if (define_default_file_trans(DFT_LEVEL, DFT_PROCESS)) return -1;}
+			| DEFAULT_FILE_TRANS USER names PARENT ';'
+			{if (define_default_file_trans(DFT_USER, DFT_PARENT)) return -1;}
+			| DEFAULT_FILE_TRANS ROLE names PARENT ';'
+			{if (define_default_file_trans(DFT_ROLE, DFT_PARENT)) return -1;}
+			| DEFAULT_FILE_TRANS LEVEL names PARENT ';'
+			{if (define_default_file_trans(DFT_LEVEL, DFT_PARENT)) return -1;}
+			;
 opt_common_perms        : common_perms
                         |
                         ;
checkpolicy/policy_scan.l +7 -1
index 2ba5971..c6fd24c 100644
@@ -219,6 +219,12 @@ h2 |
 H2				{ return(H2); }
 policycap |
 POLICYCAP			{ return(POLICYCAP); }
+process |
+PROCESS				{ return(PROCESS); }
+parent |
+PARENT				{ return(PARENT); }
+default_file_trans |
+DEFAULT_FILE_TRANS		{ return(DEFAULT_FILE_TRANS); }
 permissive |
 PERMISSIVE			{ return(PERMISSIVE); }
 "/"({alnum}|[_\.\-/])*	        { return(PATH); }

@@ -228,7 +234,7 @@ PERMISSIVE			{ return(PERMISSIVE); }
 {hexval}{0,4}":"{hexval}{0,4}":"({hexval}|[:.])*  { return(IPV6_ADDR); }
 {digit}+(\.({alnum}|[_.])*)?    { return(VERSION_IDENTIFIER); }
 {alnum}*                        { return(FILENAME); }
-\.({alnum}|[_\.\-])*	        { return(FILENAME); }
+\.({alnum}|[_\.\-])+	        { return(FILENAME); }
 {letter}+([-_\.]|{alnum})+      { return(FILENAME); }
 ([_\.]){alnum}+                 { return(FILENAME); }
Quoted 8 lines

checkpolicy/policy_scan.l PERMISSIVE { return(PERMISSIVE); }

Quoted 2 lines
checkpolicy/policy_scan.l +0 -1
 #line[ ]1[ ]\"[^\n]*\"		{ set_source_file(yytext+9); }
-- 1.7.7

This looks like this is the same patch sent to the list a couple of weeks ago but with a couple of name changes (e.g. DT -> DFT, default_trans -> default_file_trans), and there was still some discussion on it. I believe it ended with "Eric is on vacation, we'll see what he has to say when he gets back." Is this right?

Yes. It won't get applied, I just forgot to pull it from my tree before Dan took a look. It needs reworked.

-Eric

--
This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to [email protected] with the words "unsubscribe selinux" without quotes as the message.