|
 |
71cd55 |
From 9ac9d2dab40826abe049fd07d21a20386fe5b38b Mon Sep 17 00:00:00 2001
|
|
|
71cd55 |
From: James Carter <jwcart2@gmail.com>
|
|
|
71cd55 |
Date: Mon, 14 Jun 2021 12:53:25 -0400
|
|
|
71cd55 |
Subject: [PATCH] libsepol/cil: Fix anonymous IP address call arguments
|
|
|
71cd55 |
|
|
|
71cd55 |
A named IP address (using an ipaddr rule) could be passed as an
|
|
|
71cd55 |
argument, but trying to pass an actual IP address caused an error.
|
|
|
71cd55 |
|
|
|
71cd55 |
As an exmample, consider the following portion of a policy.
|
|
|
71cd55 |
(macro m4 ((ipaddr ip)(ipaddr nm))
|
|
|
71cd55 |
(nodecon ip nm (USER ROLE TYPE ((s0) (s0))))
|
|
|
71cd55 |
)
|
|
|
71cd55 |
(ipaddr nm1 255.255.255.0)
|
|
|
71cd55 |
(ipaddr ip1 1.2.3.4)
|
|
|
71cd55 |
(call m4 (ip1 nm1)) ; This works
|
|
|
71cd55 |
(call m4 (1.2.3.4 255.255.255.0)) ; This doesn't
|
|
|
71cd55 |
|
|
|
71cd55 |
Allow actual IP addresses to be passed as a call argument. Now the
|
|
|
71cd55 |
second call works as well.
|
|
|
71cd55 |
|
|
|
71cd55 |
Signed-off-by: James Carter <jwcart2@gmail.com>
|
|
|
71cd55 |
Acked-by: Nicolas Iooss <nicolas.iooss@m4x.org>
|
|
|
71cd55 |
---
|
|
|
71cd55 |
libsepol/cil/src/cil_build_ast.c | 4 ----
|
|
|
71cd55 |
libsepol/cil/src/cil_resolve_ast.c | 23 ++++++++++-------------
|
|
|
71cd55 |
2 files changed, 10 insertions(+), 17 deletions(-)
|
|
|
71cd55 |
|
|
|
71cd55 |
diff --git a/libsepol/cil/src/cil_build_ast.c b/libsepol/cil/src/cil_build_ast.c
|
|
|
71cd55 |
index 71f14e20e25e..538df2794ade 100644
|
|
|
71cd55 |
--- a/libsepol/cil/src/cil_build_ast.c
|
|
|
71cd55 |
+++ b/libsepol/cil/src/cil_build_ast.c
|
|
|
71cd55 |
@@ -5642,10 +5642,6 @@ int cil_fill_ipaddr(struct cil_tree_node *addr_node, struct cil_ipaddr *addr)
|
|
|
71cd55 |
goto exit;
|
|
|
71cd55 |
}
|
|
|
71cd55 |
|
|
|
71cd55 |
- if (addr_node->cl_head != NULL || addr_node->next != NULL) {
|
|
|
71cd55 |
- goto exit;
|
|
|
71cd55 |
- }
|
|
|
71cd55 |
-
|
|
|
71cd55 |
if (strchr(addr_node->data, '.') != NULL) {
|
|
|
71cd55 |
addr->family = AF_INET;
|
|
|
71cd55 |
} else {
|
|
|
71cd55 |
diff --git a/libsepol/cil/src/cil_resolve_ast.c b/libsepol/cil/src/cil_resolve_ast.c
|
|
|
71cd55 |
index 77ffe0ffd22b..16c8c7533ce3 100644
|
|
|
71cd55 |
--- a/libsepol/cil/src/cil_resolve_ast.c
|
|
|
71cd55 |
+++ b/libsepol/cil/src/cil_resolve_ast.c
|
|
|
71cd55 |
@@ -3024,14 +3024,18 @@ static int cil_build_call_args(struct cil_tree_node *call_node, struct cil_call
|
|
|
71cd55 |
break;
|
|
|
71cd55 |
}
|
|
|
71cd55 |
case CIL_IPADDR: {
|
|
|
71cd55 |
- if (arg_node->cl_head != NULL) {
|
|
|
71cd55 |
+ if (arg_node->data == NULL) {
|
|
|
71cd55 |
+ cil_tree_log(call_node, CIL_ERR, "Invalid macro parameter");
|
|
|
71cd55 |
+ cil_destroy_args(arg);
|
|
|
71cd55 |
+ rc = SEPOL_ERR;
|
|
|
71cd55 |
+ goto exit;
|
|
|
71cd55 |
+ } else if (strchr(arg_node->data, '.') || strchr(arg_node->data, ':')) {
|
|
|
71cd55 |
struct cil_ipaddr *ipaddr = NULL;
|
|
|
71cd55 |
struct cil_tree_node *addr_node = NULL;
|
|
|
71cd55 |
cil_ipaddr_init(&ipaddr);
|
|
|
71cd55 |
-
|
|
|
71cd55 |
- rc = cil_fill_ipaddr(arg_node->cl_head, ipaddr);
|
|
|
71cd55 |
+ rc = cil_fill_ipaddr(arg_node, ipaddr);
|
|
|
71cd55 |
if (rc != SEPOL_OK) {
|
|
|
71cd55 |
- cil_log(CIL_ERR, "Failed to create anonymous ip address, rc: %d\n", rc);
|
|
|
71cd55 |
+ cil_tree_log(call_node, CIL_ERR, "Failed to create anonymous ip address");
|
|
|
71cd55 |
cil_destroy_ipaddr(ipaddr);
|
|
|
71cd55 |
cil_destroy_args(arg);
|
|
|
71cd55 |
goto exit;
|
|
|
71cd55 |
@@ -3039,18 +3043,11 @@ static int cil_build_call_args(struct cil_tree_node *call_node, struct cil_call
|
|
|
71cd55 |
cil_tree_node_init(&addr_node);
|
|
|
71cd55 |
addr_node->flavor = CIL_IPADDR;
|
|
|
71cd55 |
addr_node->data = ipaddr;
|
|
|
71cd55 |
- cil_list_append(((struct cil_symtab_datum*)ipaddr)->nodes,
|
|
|
71cd55 |
- CIL_LIST_ITEM, addr_node);
|
|
|
71cd55 |
- arg->arg = (struct cil_symtab_datum*)ipaddr;
|
|
|
71cd55 |
- } else if (arg_node->data == NULL) {
|
|
|
71cd55 |
- cil_tree_log(call_node, CIL_ERR, "Invalid macro parameter");
|
|
|
71cd55 |
- cil_destroy_args(arg);
|
|
|
71cd55 |
- rc = SEPOL_ERR;
|
|
|
71cd55 |
- goto exit;
|
|
|
71cd55 |
+ cil_list_append(DATUM(ipaddr)->nodes, CIL_LIST_ITEM, addr_node);
|
|
|
71cd55 |
+ arg->arg = DATUM(ipaddr);
|
|
|
71cd55 |
} else {
|
|
|
71cd55 |
arg->arg_str = arg_node->data;
|
|
|
71cd55 |
}
|
|
|
71cd55 |
-
|
|
|
71cd55 |
break;
|
|
|
71cd55 |
}
|
|
|
71cd55 |
case CIL_CLASS:
|
|
|
71cd55 |
--
|
|
|
71cd55 |
2.32.0
|
|
|
71cd55 |
|