|
 |
060220 |
From d6863cc6e4f472444a7944c9ea95333e587efd73 Mon Sep 17 00:00:00 2001
|
|
|
060220 |
From: James Carter <jwcart2@gmail.com>
|
|
|
060220 |
Date: Thu, 8 Apr 2021 13:32:14 -0400
|
|
|
060220 |
Subject: [PATCH] libsepol/cil: Allow permission expressions when using map
|
|
|
060220 |
classes
|
|
|
060220 |
|
|
|
060220 |
The following policy will cause a segfault:
|
|
|
060220 |
(class CLASS (PERM))
|
|
|
060220 |
(class C (P1 P2 P3))
|
|
|
060220 |
(classorder (CLASS C))
|
|
|
060220 |
(sid SID)
|
|
|
060220 |
(sidorder (SID))
|
|
|
060220 |
(user USER)
|
|
|
060220 |
(role ROLE)
|
|
|
060220 |
(type TYPE)
|
|
|
060220 |
(category CAT)
|
|
|
060220 |
(categoryorder (CAT))
|
|
|
060220 |
(sensitivity SENS)
|
|
|
060220 |
(sensitivityorder (SENS))
|
|
|
060220 |
(sensitivitycategory SENS (CAT))
|
|
|
060220 |
(allow TYPE self (CLASS (PERM)))
|
|
|
060220 |
(roletype ROLE TYPE)
|
|
|
060220 |
(userrole USER ROLE)
|
|
|
060220 |
(userlevel USER (SENS))
|
|
|
060220 |
(userrange USER ((SENS)(SENS (CAT))))
|
|
|
060220 |
(sidcontext SID (USER ROLE TYPE ((SENS)(SENS))))
|
|
|
060220 |
|
|
|
060220 |
(classmap CM (PM1 PM2 PM3))
|
|
|
060220 |
(classmapping CM PM1 (C (P1)))
|
|
|
060220 |
(classmapping CM PM2 (C (P2)))
|
|
|
060220 |
(classmapping CM PM3 (C (P3)))
|
|
|
060220 |
(allow TYPE self (CM (and (all) (not PM2))))
|
|
|
060220 |
|
|
|
060220 |
The problem is that, while permission expressions are allowed for
|
|
|
060220 |
normal classes, map classes are expected to only have permission
|
|
|
060220 |
lists and no check is done to verify that only a permission list
|
|
|
060220 |
is being used.
|
|
|
060220 |
|
|
|
060220 |
When the above policy is parsed, the "and" and "all" are seen as
|
|
|
060220 |
expression operators, but when the map permissions are converted to
|
|
|
060220 |
normal class and permissions, the permission expression is assumed
|
|
|
060220 |
to be a list of datums and since the operators are not datums a
|
|
|
060220 |
segfault is the result.
|
|
|
060220 |
|
|
|
060220 |
There is no reason to limit map classes to only using a list of
|
|
|
060220 |
permissions and, in fact, it would be better to be able to use them
|
|
|
060220 |
in the same way normal classes are used.
|
|
|
060220 |
|
|
|
060220 |
Allow permissions expressions to be used for map classes by first
|
|
|
060220 |
evaluating the permission expression and then converting the
|
|
|
060220 |
resulting list to normal classes and permissions.
|
|
|
060220 |
|
|
|
060220 |
Signed-off-by: James Carter <jwcart2@gmail.com>
|
|
|
060220 |
---
|
|
|
060220 |
libsepol/cil/src/cil_post.c | 4 ++++
|
|
|
060220 |
1 file changed, 4 insertions(+)
|
|
|
060220 |
|
|
|
060220 |
diff --git a/libsepol/cil/src/cil_post.c b/libsepol/cil/src/cil_post.c
|
|
|
060220 |
index bdeaa7c6..a820d5ba 100644
|
|
|
060220 |
--- a/libsepol/cil/src/cil_post.c
|
|
|
060220 |
+++ b/libsepol/cil/src/cil_post.c
|
|
|
060220 |
@@ -2138,6 +2138,10 @@ static int __evaluate_classperms_list(struct cil_list *classperms, struct cil_db
|
|
|
060220 |
}
|
|
|
060220 |
} else { /* MAP */
|
|
|
060220 |
struct cil_list_item *i = NULL;
|
|
|
060220 |
+ rc = __evaluate_classperms(cp, db);
|
|
|
060220 |
+ if (rc != SEPOL_OK) {
|
|
|
060220 |
+ goto exit;
|
|
|
060220 |
+ }
|
|
|
060220 |
cil_list_for_each(i, cp->perms) {
|
|
|
060220 |
struct cil_perm *cmp = i->data;
|
|
|
060220 |
rc = __evaluate_classperms_list(cmp->classperms, db);
|
|
|
060220 |
--
|
|
|
060220 |
2.30.2
|
|
|
060220 |
|