|
 |
060220 |
From dadf1e9ad66318fdd814cf06af2b83741467a3d8 Mon Sep 17 00:00:00 2001
|
|
|
060220 |
From: James Carter <jwcart2@gmail.com>
|
|
|
060220 |
Date: Tue, 30 Mar 2021 13:39:17 -0400
|
|
|
060220 |
Subject: [PATCH] libsepol/cil: Sync checks for invalid rules in booleanifs
|
|
|
060220 |
|
|
|
060220 |
When building the AST, typemember rules in a booleanif block will
|
|
|
060220 |
be incorrectly called invalid. They are allowed in the kernel
|
|
|
060220 |
policy and should be allowed in CIL.
|
|
|
060220 |
|
|
|
060220 |
When resolving the AST, if a neverallow rule is copied into a
|
|
|
060220 |
booleanif block, it will not be considered an invalid rule, even
|
|
|
060220 |
though this is not allowed in the kernel policy.
|
|
|
060220 |
|
|
|
060220 |
Update the booleanif checks to allow typemember rules and to not
|
|
|
060220 |
allow neverallow rules in booleanifs. Also use the same form of
|
|
|
060220 |
conditional for the checks when building and resolving the AST.
|
|
|
060220 |
|
|
|
060220 |
Signed-off-by: James Carter <jwcart2@gmail.com>
|
|
|
060220 |
---
|
|
|
060220 |
libsepol/cil/src/cil_build_ast.c | 3 ++-
|
|
|
060220 |
libsepol/cil/src/cil_resolve_ast.c | 23 +++++++++++++++--------
|
|
|
060220 |
2 files changed, 17 insertions(+), 9 deletions(-)
|
|
|
060220 |
|
|
|
060220 |
diff --git a/libsepol/cil/src/cil_build_ast.c b/libsepol/cil/src/cil_build_ast.c
|
|
|
060220 |
index ceb55324..3a91be03 100644
|
|
|
060220 |
--- a/libsepol/cil/src/cil_build_ast.c
|
|
|
060220 |
+++ b/libsepol/cil/src/cil_build_ast.c
|
|
|
060220 |
@@ -6136,7 +6136,8 @@ int __cil_build_ast_node_helper(struct cil_tree_node *parse_current, uint32_t *f
|
|
|
060220 |
parse_current->data != CIL_KEY_DONTAUDIT &&
|
|
|
060220 |
parse_current->data != CIL_KEY_AUDITALLOW &&
|
|
|
060220 |
parse_current->data != CIL_KEY_TYPETRANSITION &&
|
|
|
060220 |
- parse_current->data != CIL_KEY_TYPECHANGE) {
|
|
|
060220 |
+ parse_current->data != CIL_KEY_TYPECHANGE &&
|
|
|
060220 |
+ parse_current->data != CIL_KEY_TYPEMEMBER) {
|
|
|
060220 |
rc = SEPOL_ERR;
|
|
|
060220 |
cil_tree_log(parse_current, CIL_ERR, "Found %s", (char*)parse_current->data);
|
|
|
060220 |
if (((struct cil_booleanif*)boolif->data)->preserved_tunable) {
|
|
|
060220 |
diff --git a/libsepol/cil/src/cil_resolve_ast.c b/libsepol/cil/src/cil_resolve_ast.c
|
|
|
060220 |
index c520c44a..06b6ab48 100644
|
|
|
060220 |
--- a/libsepol/cil/src/cil_resolve_ast.c
|
|
|
060220 |
+++ b/libsepol/cil/src/cil_resolve_ast.c
|
|
|
060220 |
@@ -3689,7 +3689,7 @@ exit:
|
|
|
060220 |
|
|
|
060220 |
int __cil_resolve_ast_node_helper(struct cil_tree_node *node, uint32_t *finished, void *extra_args)
|
|
|
060220 |
{
|
|
|
060220 |
- int rc = SEPOL_ERR;
|
|
|
060220 |
+ int rc = SEPOL_OK;
|
|
|
060220 |
struct cil_args_resolve *args = extra_args;
|
|
|
060220 |
enum cil_pass pass = args->pass;
|
|
|
060220 |
struct cil_tree_node *block = args->block;
|
|
|
060220 |
@@ -3732,18 +3732,25 @@ int __cil_resolve_ast_node_helper(struct cil_tree_node *node, uint32_t *finished
|
|
|
060220 |
}
|
|
|
060220 |
|
|
|
060220 |
if (boolif != NULL) {
|
|
|
060220 |
- if (!(node->flavor == CIL_TUNABLEIF ||
|
|
|
060220 |
- node->flavor == CIL_CALL ||
|
|
|
060220 |
- node->flavor == CIL_CONDBLOCK ||
|
|
|
060220 |
- node->flavor == CIL_AVRULE ||
|
|
|
060220 |
- node->flavor == CIL_TYPE_RULE ||
|
|
|
060220 |
- node->flavor == CIL_NAMETYPETRANSITION)) {
|
|
|
060220 |
+ if (node->flavor != CIL_TUNABLEIF &&
|
|
|
060220 |
+ node->flavor != CIL_CALL &&
|
|
|
060220 |
+ node->flavor != CIL_CONDBLOCK &&
|
|
|
060220 |
+ node->flavor != CIL_AVRULE &&
|
|
|
060220 |
+ node->flavor != CIL_TYPE_RULE &&
|
|
|
060220 |
+ node->flavor != CIL_NAMETYPETRANSITION) {
|
|
|
060220 |
+ rc = SEPOL_ERR;
|
|
|
060220 |
+ } else if (node->flavor == CIL_AVRULE) {
|
|
|
060220 |
+ struct cil_avrule *rule = node->data;
|
|
|
060220 |
+ if (rule->rule_kind == CIL_AVRULE_NEVERALLOW) {
|
|
|
060220 |
+ rc = SEPOL_ERR;
|
|
|
060220 |
+ }
|
|
|
060220 |
+ }
|
|
|
060220 |
+ if (rc == SEPOL_ERR) {
|
|
|
060220 |
if (((struct cil_booleanif*)boolif->data)->preserved_tunable) {
|
|
|
060220 |
cil_tree_log(node, CIL_ERR, "%s statement is not allowed in booleanifs (tunableif treated as a booleanif)", cil_node_to_string(node));
|
|
|
060220 |
} else {
|
|
|
060220 |
cil_tree_log(node, CIL_ERR, "%s statement is not allowed in booleanifs", cil_node_to_string(node));
|
|
|
060220 |
}
|
|
|
060220 |
- rc = SEPOL_ERR;
|
|
|
060220 |
goto exit;
|
|
|
060220 |
}
|
|
|
060220 |
}
|
|
|
060220 |
--
|
|
|
060220 |
2.30.2
|
|
|
060220 |
|