libsepol, policycoreutils, and checkpolicy: Add support for generating CIL to libsepol and checkpolicy

PATCH In review James Carter 4 participants 7 messages Apr 1, 2015 – May 8, 2015 SELinux security module

Share & tools

James Carter

author

2015-04-01 17:09 UTC #0 lore raw

v5 cover libsepol, policycoreutils, and checkpolicy: Add support for generating CIL to libsepol and checkpolicy

V5 Update usage functions for checkpolicy and checkmodule.
V4 Adds the new command-line options to the checkpolicy and checkmodule man pages, adds error checking and messages to checkpolicy and checkmodule, updates libsepol's Android.mk and libsepol.map.in files as needed, and makes pp linke libsepol dynamically. V3 fixes another whitespace issue.
V2 fixes some whitespace issues and make the new libsepol file LGPL instead of GPL.

This patch set moves the code to generate CIL from pp.c in policycoreutils/hll/pp to libsepol, adds a new function to generate CIL from a module policydb, and modifies checkpolicy and checkmodule to support generating CIL as their output.

The primary motivation of this work is to allow SE for Android to use the CIl compiler. Converting the policy.conf to CIL and then compiling to the kernel binary policy results in a policy that is about 20% smaller. The smaller size is because type expressions with negations are converted to type attribute sets in CIL instead of being expanded.

James Carter (3):
libsepol, policycoreutils: Move functions to convert a module package
to CIL
libsepol: add function to generate CIL from a module policydb
checkpolicy: Add support for generating CIL

 checkpolicy/checkmodule.8              |    5 +-
 checkpolicy/checkmodule.c              |   66 +-
 checkpolicy/checkpolicy.8              |    5 +-
 checkpolicy/checkpolicy.c              |   85 +-
 libsepol/Android.mk                    |    1 +
 libsepol/include/sepol/module_to_cil.h |    8 +
 libsepol/src/libsepol.map.in           |    3 +
 libsepol/src/module_to_cil.c           | 4010 ++++++++++++++++++++++++++++++++
 policycoreutils/hll/pp/Makefile        |    2 +-
 policycoreutils/hll/pp/pp.c            | 3830 +-----------------------------
 10 files changed, 4131 insertions(+), 3884 deletions(-)
 create mode 100644 libsepol/include/sepol/module_to_cil.h
 create mode 100644 libsepol/src/module_to_cil.c

Signature · 1 line

1.9.3

James Carter

author

2015-04-01 17:09 UTC #1 lore raw

PATCH v5 1/3 libsepol, policycoreutils: Move functions to convert a module package to CIL

Move code to convert a policy module to CIL from the policy package to CIL conversion tool, pp, in policycoreutils to libsepol. The only changes to the code are the additions of the prefix "sepol_" to the functions sepol_module_package_to_cil() and sepol_ppfile_to_module_package(). This code is being changed from GPL to LGPL with permission from Tresys.

Convert pp to use the renamed functions in libsepol.

Signed-off-by James Carter <[email protected]>

---
 libsepol/Android.mk                    |    1 +
 libsepol/include/sepol/module_to_cil.h |    6 +
 libsepol/src/libsepol.map.in           |    2 +
 libsepol/src/module_to_cil.c           | 3873 ++++++++++++++++++++++++++++++++
 policycoreutils/hll/pp/Makefile        |    2 +-
 policycoreutils/hll/pp/pp.c            | 3830 +------------------------------
 6 files changed, 3886 insertions(+), 3828 deletions(-)
 create mode 100644 libsepol/include/sepol/module_to_cil.h
 create mode 100644 libsepol/src/module_to_cil.c

libsepol/Android.mk +1 -0

index 3e4700b..6246061 100644
@@ -23,6 +23,7 @@ common_src_files := \
 	src/link.c \
 	src/mls.c \
 	src/module.c \
+	src/module_to_cil.c \
 	src/node_record.c \
 	src/nodes.c \
 	src/polcaps.c \

libsepol/include/sepol/module_to_cil.h new file +6 -0

new file mode 100644
index 0000000..1d0225c
@@ -0,0 +1,6 @@
+#include <stdlib.h>
+
+#include <sepol/module.h>
+
+int sepol_module_package_to_cil(FILE *fp, struct sepol_module_package *mod_pkg);
+int sepol_ppfile_to_module_package(FILE *fp, struct sepol_module_package **mod_pkg);

libsepol/src/libsepol.map.in +2 -0

index 0ae0f1a..4e0c4bc 100644
@@ -45,5 +45,7 @@ LIBSEPOL_1.1 {
 	cil_set_target_platform;
 	cil_set_policy_version;
 	cil_set_mls;
+	sepol_ppfile_to_module_package;
+	sepol_module_package_to_cil;
   local: *;
 } LIBSEPOL_1.0;

libsepol/src/module_to_cil.c new file +3873 -0

2,980 lines not on this page · raw message

policycoreutils/hll/pp/Makefile +1 -1

index 81cf7a4..09168bc 100644

Lines of this file are not shown. View the raw message.

policycoreutils/hll/pp/pp.c +3 ~~-3827~~

3,830 lines not on this page · raw message

The rest of this diff is not shown. View the raw message.

Signature · 1 line

1.9.3

Part of the diff is not shown here. View the raw message.

James Carter

author

2015-04-01 17:09 UTC #2 lore raw

PATCH v5 2/3 libsepol: add function to generate CIL from a module policydb

In reply to James Carter

Add a new function, sepol_module_policydb_to_cil, that generates CIL from a module (not kernel) policydb. Refactor sepol_module_package_to_cil() to use the new function.

Signed-off-by James Carter <[email protected]>

---
 libsepol/include/sepol/module_to_cil.h |   2 +
 libsepol/src/libsepol.map.in           |   1 +
 libsepol/src/module_to_cil.c           | 367 ++++++++++++++++++++++-----------
 3 files changed, 255 insertions(+), 115 deletions(-)

libsepol/include/sepol/module_to_cil.h +2 -0

index 1d0225c..18bb3bf 100644
@@ -1,6 +1,8 @@
 #include <stdlib.h>
 
 #include <sepol/module.h>
+#include <sepol/policydb/policydb.h>
 
+int sepol_module_policydb_to_cil(FILE *fp, struct policydb *pdb, int linked);
 int sepol_module_package_to_cil(FILE *fp, struct sepol_module_package *mod_pkg);
 int sepol_ppfile_to_module_package(FILE *fp, struct sepol_module_package **mod_pkg);

libsepol/src/libsepol.map.in +1 -0

index 4e0c4bc..0a46b09 100644
@@ -47,5 +47,6 @@ LIBSEPOL_1.1 {
 	cil_set_mls;
 	sepol_ppfile_to_module_package;
 	sepol_module_package_to_cil;
+	sepol_module_policydb_to_cil;
   local: *;
 } LIBSEPOL_1.0;

libsepol/src/module_to_cil.c +252 ~~-115~~

503 lines not on this page · raw message

Signature · 1 line

1.9.3

James Carter

author

2015-04-01 17:09 UTC #3 lore raw

PATCH v5 3/3 checkpolicy: Add support for generating CIL

In reply to James Carter

Add support to checkpolicy and checkmodule for generating CIL as their output.

Add new options "-C" and "--cil" to specify CIL as the output format.

Signed-off-by James Carter <[email protected]>

---
 checkpolicy/checkmodule.8 |  5 ++-
 checkpolicy/checkmodule.c | 66 ++++++++++++++++++++++--------------
 checkpolicy/checkpolicy.8 |  5 ++-
 checkpolicy/checkpolicy.c | 85 +++++++++++++++++++++++++++++++----------------
 4 files changed, 105 insertions(+), 56 deletions(-)

checkpolicy/checkmodule.8 +4 -1

index 2a7ab5c..ee95882 100644
@@ -3,7 +3,7 @@
 checkmodule \- SELinux policy module compiler
 .SH SYNOPSIS
 .B checkmodule
-.I "[\-h] [\-b] [\-m] [\-M] [\-U handle_unknown ] [\-V] [\-o output_file] [input_file]"
+.I "[\-h] [\-b] [\-C] [\-m] [\-M] [\-U handle_unknown ] [\-V] [\-o output_file] [input_file]"
 .SH "DESCRIPTION"
 This manual page describes the
 .BR checkmodule

@@ -25,6 +25,9 @@ the module package into the module store and load the resulting policy.
 Read an existing binary policy module file rather than a source policy
 module file.  This option is a development/debugging aid.
 .TP
+.B \-C,\-\-cil
+Write CIL policy file rather than binary policy file.
+.TP
 .B \-h,\-\-help
 Print usage.
 .TP

checkpolicy/checkmodule.c +41 ~~-25~~

131 lines not on this page · raw message

checkpolicy/checkpolicy.8 +4 -1

index 0086bdc..600d5cd 100644
@@ -3,7 +3,7 @@
 checkpolicy \- SELinux policy compiler
 .SH SYNOPSIS
 .B checkpolicy
-.I "[\-b] [\-d] [\-M] [\-c policyvers] [\-o output_file] [input_file]"
+.I "[\-b] [\-C] [\-d] [\-M] [\-c policyvers] [\-o output_file] [input_file]"
 .br
 .SH "DESCRIPTION"
 This manual page describes the

@@ -21,6 +21,9 @@ policy.conf or policy, depending on whether the \-b flag is specified.
 .B \-b,\-\-binary
 Read an existing binary policy file rather than a source policy.conf file.
 .TP
+.B \-C,\-\-cil
+Write CIL policy file rather than binary policy file.
+.TP
 .B \-d,\-\-debug
 Enter debug mode after loading the policy.
 .TP

checkpolicy/checkpolicy.c +56 ~~-29~~

165 lines not on this page · raw message

Signature · 1 line

1.9.3

Steve Lawrence

Acked-by on the v5 series

2015-04-01 17:29 UTC #4 lore raw

In reply to James Carter

Quoted 15 lines · James Carter

V5 Update usage functions for checkpolicy and checkmodule.
V4 Adds the new command-line options to the checkpolicy and checkmodule man pages, adds error checking and messages to checkpolicy and checkmodule, updates libsepol's Android.mk and libsepol.map.in files as needed, and makes pp linke libsepol dynamically. V3 fixes another whitespace issue.
V2 fixes some whitespace issues and make the new libsepol file LGPL instead of GPL.
This patch set moves the code to generate CIL from pp.c in policycoreutils/hll/pp to libsepol, adds a new function to generate CIL from a module policydb, and modifies checkpolicy and checkmodule to support generating CIL as their output.
The primary motivation of this work is to allow SE for Android to use the CIl compiler. Converting the policy.conf to CIL and then compiling to the kernel binary policy results in a policy that is about 20% smaller. The smaller size is because type expressions with negations are converted to type attribute sets in CIL instead of being expanded.
James Carter (3):
libsepol, policycoreutils: Move functions to convert a module package
to CIL
libsepol: add function to generate CIL from a module policydb
checkpolicy: Add support for generating CIL

Quoted 14 lines

 checkpolicy/checkmodule.8              |    5 +-
 checkpolicy/checkmodule.c              |   66 +-
 checkpolicy/checkpolicy.8              |    5 +-
 checkpolicy/checkpolicy.c              |   85 +-
 libsepol/Android.mk                    |    1 +
 libsepol/include/sepol/module_to_cil.h |    8 +
 libsepol/src/libsepol.map.in           |    3 +
 libsepol/src/module_to_cil.c           | 4010 ++++++++++++++++++++++++++++++++
 policycoreutils/hll/pp/Makefile        |    2 +-
 policycoreutils/hll/pp/pp.c            | 3830 +-----------------------------
 10 files changed, 4131 insertions(+), 3884 deletions(-)
 create mode 100644 libsepol/include/sepol/module_to_cil.h
 create mode 100644 libsepol/src/module_to_cil.c

Acked-by Steve Lawrence <[email protected]>

Jeffrey Vander Stoep

2015-05-06 22:33 UTC #5 lore raw

I am working on switching AOSP to the upstream selinux project. Unfortunately this commit breaks the AOSP build on Mac OS. Darwin has no fmemopen.

external/selinux/libsepol/src/module_to_cil.c:2927:7: warning: implicit declaration of function 'fmemopen' [-Wimplicit-function-declaration]

        fp = fmemopen(seusers, seusers_len, "r");
             ^
external/selinux/libsepol/src/module_to_cil.c:2927:5: error: incompatible
integer to pointer conversion assigning to 'FILE *' (aka 'struct __sFILE
*') from 'int' [-Werror,-Wint-conversion]
        fp = fmemopen(seusers, seusers_len, "r");
           ^ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
external/selinux/libsepol/src/module_to_cil.c:3017:5: error: incompatible
integer to pointer conversion assigning to 'FILE *' (aka 'struct __sFILE
*') from 'int' [-Werror,-Wint-conversion]
        fp = fmemopen(userx, userx_len, "r");
           ^ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
external/selinux/libsepol/src/module_to_cil.c:3073:5: error: incompatible
integer to pointer conversion assigning to 'FILE *' (aka 'struct __sFILE
*') from 'int' [-Werror,-Wint-conversion]
        fp = fmemopen(fc, fc_len, "r");
           ^ ~~~~~~~~~~~~~~~~~~~~~~~~~

1 warning and 3 errors generated.
make: *** [out/host/darwin-x86/obj32/STATIC_LIBRARIES/libsepol_intermediates/src/module_to_cil.o] Error 1

Quoted 52 lines · Steve Lawrence

Quoted 2 lines · James Carter
V5 Update usage functions for checkpolicy and checkmodule. V4 Adds the new command-line options to the checkpolicy and checkmodule
man pages, adds error checking and messages to checkpolicy and checkmodule, updates libsepol's Android.mk and libsepol.map.in files as needed, and makes pp linke libsepol dynamically.
Quoted 2 lines
V3 fixes another whitespace issue.
V2 fixes some whitespace issues and make the new libsepol file LGPL
instead of GPL.
Quoted 2 lines
This patch set moves the code to generate CIL from pp.c in
policycoreutils/hll/pp to libsepol, adds a new function to generate CIL from a module policydb, and modifies checkpolicy and checkmodule to support generating CIL as their output.
Quoted 2 lines
The primary motivation of this work is to allow SE for Android to use
the CIl compiler. Converting the policy.conf to CIL and then compiling to the kernel binary policy results in a policy that is about 20% smaller. The smaller size is because type expressions with negations are converted to type attribute sets in CIL instead of being expanded.
Quoted 7 lines
James Carter (3):
libsepol, policycoreutils: Move functions to convert a module package
to CIL
libsepol: add function to generate CIL from a module policydb
checkpolicy: Add support for generating CIL
Quoted 8 lines
 checkpolicy/checkmodule.8              |    5 +-
 checkpolicy/checkmodule.c              |   66 +-
 checkpolicy/checkpolicy.8              |    5 +-
 checkpolicy/checkpolicy.c              |   85 +-
 libsepol/Android.mk                    |    1 +
 libsepol/include/sepol/module_to_cil.h |    8 +
 libsepol/src/libsepol.map.in           |    3 +
 libsepol/src/module_to_cil.c           | 4010
++++++++++++++++++++++++++++++++
Quoted 2 lines
 policycoreutils/hll/pp/Makefile        |    2 +-
 policycoreutils/hll/pp/pp.c            | 3830
+-----------------------------
>  10 files changed, 4131 insertions(+), 3884 deletions(-)
>  create mode 100644 libsepol/include/sepol/module_to_cil.h
>  create mode 100644 libsepol/src/module_to_cil.c
Quoted 1 line
Acked-by Steve Lawrence <[email protected]>
_______________________________________________
Selinux mailing list
[email protected]
To unsubscribe, send email to [email protected]. To get help, send an email containing "help" to [email protected].

Stephen Smalley

2015-05-08 12:11 UTC #6 lore raw

Quoted 23 lines · Jeffrey Vander Stoep

I am working on switching AOSP to the upstream selinux project. Unfortunately this commit breaks the AOSP build on Mac OS. Darwin has no fmemopen.

external/selinux/libsepol/src/module_to_cil.c:2927:7: warning: implicit declaration of function 'fmemopen' [-Wimplicit-function-declaration]

        fp = fmemopen(seusers, seusers_len, "r");
             ^
external/selinux/libsepol/src/module_to_cil.c:2927:5: error:
incompatible integer to pointer conversion assigning to 'FILE *' (aka
'struct __sFILE *') from 'int' [-Werror,-Wint-conversion]
        fp = fmemopen(seusers, seusers_len, "r");
           ^ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
external/selinux/libsepol/src/module_to_cil.c:3017:5: error:
incompatible integer to pointer conversion assigning to 'FILE *' (aka
'struct __sFILE *') from 'int' [-Werror,-Wint-conversion]
        fp = fmemopen(userx, userx_len, "r");
           ^ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
external/selinux/libsepol/src/module_to_cil.c:3073:5: error:
incompatible integer to pointer conversion assigning to 'FILE *' (aka
'struct __sFILE *') from 'int' [-Werror,-Wint-conversion]
        fp = fmemopen(fc, fc_len, "r");
           ^ ~~~~~~~~~~~~~~~~~~~~~~~~~

Quoted 4 lines

1 warning and 3 errors generated.
make: *** [out/host/darwin-x86/obj32/STATIC_LIBRARIES/libsepol_intermediates/src/module_to_cil.o] Error 1

Could we perhaps use this when building on OSX:
https://github.com/NimbusKit/memorymapping