Skip to content

Commit 7f2e272

Browse files
jwcart2cgzones
jwcart2
authored and
cgzones
committed
libsepol/cil: Add notself and minusself support to CIL
Like "self", both of these reserved words can be used as a target in an access vector rule. "notself" means all types other than the source type. "minuself" is meant to be used with an attribute and its use results in the rule being expanded with each type of the attribute being used as the source type with each of the other types being used as the target type. Using "minusself" with just a type will result in no rule. Example 1 (allow TYPE1 notself (CLASS (PERM))) This rule is expanded to a number of rules with TYPE1 as the source and every type except for TYPE1 as the target. Example 2 (allow ATTR1 notself (CLASS (PERM))) Like Example 1, this rule will be expanded to each type in ATTR1 being the source with every type except for the type used as the source being the target. Example 3 (allow TYPE1 minusself (CLASS (PERM))) This expands to no rule. Example 4 (allow ATTR1 minusself (CLASS (PERM))) Like Example 2, but the target types will be limited to the types in the attribute ATTR1 instead of all types. So if ATTR1 has the type t1, t2, and t3, then this rule expands to the following rules. (allow t1 t2 (CLASS (PERM))) (allow t1 t3 (CLASS (PERM))) (allow t2 t1 (CLASS (PERM))) (allow t2 t3 (CLASS (PERM))) (allow t3 t1 (CLASS (PERM))) (allow t3 t2 (CLASS (PERM))) Signed-off-by: James Carter <[email protected]>
1 parent d929e3b commit 7f2e272

File tree

7 files changed

+300
-30
lines changed

7 files changed

+300
-30
lines changed

‎libsepol/cil/src/cil.c‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -84,6 +84,8 @@ char *CIL_KEY_CONS_INCOMP;
8484
char *CIL_KEY_CONDTRUE;
8585
char *CIL_KEY_CONDFALSE;
8686
char *CIL_KEY_SELF;
87+
char *CIL_KEY_NOTSELF;
88+
char *CIL_KEY_MINUSSELF;
8789
char *CIL_KEY_OBJECT_R;
8890
char *CIL_KEY_STAR;
8991
char *CIL_KEY_TCP;
@@ -253,6 +255,8 @@ static void cil_init_keys(void)
253255
CIL_KEY_CONDTRUE = cil_strpool_add("true");
254256
CIL_KEY_CONDFALSE = cil_strpool_add("false");
255257
CIL_KEY_SELF = cil_strpool_add("self");
258+
CIL_KEY_NOTSELF = cil_strpool_add("notself");
259+
CIL_KEY_MINUSSELF = cil_strpool_add("minusself");
256260
CIL_KEY_OBJECT_R = cil_strpool_add("object_r");
257261
CIL_KEY_STAR = cil_strpool_add("*");
258262
CIL_KEY_UDP = cil_strpool_add("udp");
@@ -430,6 +434,12 @@ void cil_db_init(struct cil_db **db)
430434
cil_type_init(&(*db)->selftype);
431435
(*db)->selftype->datum.name = CIL_KEY_SELF;
432436
(*db)->selftype->datum.fqn = CIL_KEY_SELF;
437+
cil_type_init(&(*db)->notselftype);
438+
(*db)->notselftype->datum.name = CIL_KEY_NOTSELF;
439+
(*db)->notselftype->datum.fqn = CIL_KEY_NOTSELF;
440+
cil_type_init(&(*db)->minusselftype);
441+
(*db)->minusselftype->datum.name = CIL_KEY_MINUSSELF;
442+
(*db)->minusselftype->datum.fqn = CIL_KEY_MINUSSELF;
433443
(*db)->num_types_and_attrs = 0;
434444
(*db)->num_classes = 0;
435445
(*db)->num_types = 0;
@@ -483,6 +493,8 @@ void cil_db_destroy(struct cil_db **db)
483493
cil_list_destroy(&(*db)->names, CIL_TRUE);
484494

485495
cil_destroy_type((*db)->selftype);
496+
cil_destroy_type((*db)->notselftype);
497+
cil_destroy_type((*db)->minusselftype);
486498

487499
cil_strpool_destroy();
488500
free((*db)->val_to_type);

‎libsepol/cil/src/cil_binary.c‎

Lines changed: 90 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1519,6 +1519,46 @@ static int __cil_avrule_to_avtab(policydb_t *pdb, const struct cil_db *db, struc
15191519
}
15201520
}
15211521
ebitmap_destroy(&src_bitmap);
1522+
} else if (tgt->fqn == CIL_KEY_NOTSELF) {
1523+
rc = __cil_expand_type(src, &src_bitmap);
1524+
if (rc != SEPOL_OK) {
1525+
goto exit;
1526+
}
1527+
1528+
ebitmap_for_each_positive_bit(&src_bitmap, snode, s) {
1529+
src = DATUM(db->val_to_type[s]);
1530+
for (t = 0; t < (unsigned int)db->num_types; t++) {
1531+
if (s != t) {
1532+
tgt = DATUM(db->val_to_type[t]);
1533+
rc = __cil_avrule_expand(pdb, kind, src, tgt, classperms, cond_node, cond_flavor);
1534+
if (rc != SEPOL_OK) {
1535+
ebitmap_destroy(&src_bitmap);
1536+
goto exit;
1537+
}
1538+
}
1539+
}
1540+
}
1541+
ebitmap_destroy(&src_bitmap);
1542+
} else if (tgt->fqn == CIL_KEY_MINUSSELF) {
1543+
rc = __cil_expand_type(src, &src_bitmap);
1544+
if (rc != SEPOL_OK) {
1545+
goto exit;
1546+
}
1547+
1548+
ebitmap_for_each_positive_bit(&src_bitmap, snode, s) {
1549+
src = DATUM(db->val_to_type[s]);
1550+
ebitmap_for_each_positive_bit(&src_bitmap, tnode, t) {
1551+
if (s != t) {
1552+
tgt = DATUM(db->val_to_type[t]);
1553+
rc = __cil_avrule_expand(pdb, kind, src, tgt, classperms, cond_node, cond_flavor);
1554+
if (rc != SEPOL_OK) {
1555+
ebitmap_destroy(&src_bitmap);
1556+
goto exit;
1557+
}
1558+
}
1559+
}
1560+
}
1561+
ebitmap_destroy(&src_bitmap);
15221562
} else {
15231563
int expand_src = __cil_should_expand_attribute(db, src);
15241564
int expand_tgt = __cil_should_expand_attribute(db, tgt);
@@ -1875,10 +1915,51 @@ static int cil_avrulex_to_hashtable(policydb_t *pdb, const struct cil_db *db, st
18751915
src = DATUM(db->val_to_type[s]);
18761916
rc = __cil_avrulex_to_hashtable_helper(pdb, kind, src, src, cil_avrulex->perms.x.permx, args);
18771917
if (rc != SEPOL_OK) {
1918+
ebitmap_destroy(&src_bitmap);
18781919
goto exit;
18791920
}
18801921
}
18811922
ebitmap_destroy(&src_bitmap);
1923+
} else if (tgt->fqn == CIL_KEY_NOTSELF) {
1924+
rc = __cil_expand_type(src, &src_bitmap);
1925+
if (rc != SEPOL_OK) {
1926+
goto exit;
1927+
}
1928+
1929+
ebitmap_for_each_positive_bit(&src_bitmap, snode, s) {
1930+
src = DATUM(db->val_to_type[s]);
1931+
for (t = 0; t < (unsigned int)db->num_types; t++) {
1932+
if (s != t) {
1933+
tgt = DATUM(db->val_to_type[t]);
1934+
rc = __cil_avrulex_to_hashtable_helper(pdb, kind, src, tgt, cil_avrulex->perms.x.permx, args);
1935+
if (rc != SEPOL_OK) {
1936+
ebitmap_destroy(&src_bitmap);
1937+
goto exit;
1938+
}
1939+
}
1940+
}
1941+
}
1942+
ebitmap_destroy(&src_bitmap);
1943+
} else if (tgt->fqn == CIL_KEY_MINUSSELF) {
1944+
rc = __cil_expand_type(src, &src_bitmap);
1945+
if (rc != SEPOL_OK) {
1946+
goto exit;
1947+
}
1948+
1949+
ebitmap_for_each_positive_bit(&src_bitmap, snode, s) {
1950+
src = DATUM(db->val_to_type[s]);
1951+
ebitmap_for_each_positive_bit(&src_bitmap, tnode, t) {
1952+
if (s != t) {
1953+
tgt = DATUM(db->val_to_type[t]);
1954+
rc = __cil_avrulex_to_hashtable_helper(pdb, kind, src, tgt, cil_avrulex->perms.x.permx, args);
1955+
if (rc != SEPOL_OK) {
1956+
ebitmap_destroy(&src_bitmap);
1957+
goto exit;
1958+
}
1959+
}
1960+
}
1961+
}
1962+
ebitmap_destroy(&src_bitmap);
18821963
} else {
18831964
int expand_src = __cil_should_expand_attribute(db, src);
18841965
int expand_tgt = __cil_should_expand_attribute(db, tgt);
@@ -4813,8 +4894,16 @@ static int cil_check_neverallow(const struct cil_db *db, policydb_t *pdb, struct
48134894

48144895
if (tgt->fqn == CIL_KEY_SELF) {
48154896
rule->flags = RULE_SELF;
4897+
} else if (tgt->fqn == CIL_KEY_NOTSELF) {
4898+
rule->flags = RULE_NOTSELF;
4899+
} else if (tgt->fqn == CIL_KEY_MINUSSELF) {
4900+
rule->flags = RULE_NOTSELF;
4901+
rc = __cil_add_sepol_type(pdb, db, cil_rule->src, &rule->ttypes.types);
4902+
if (rc != SEPOL_OK) {
4903+
goto exit;
4904+
}
48164905
} else {
4817-
rc = __cil_add_sepol_type(pdb, db, cil_rule->tgt, &rule->ttypes.types);
4906+
rc = __cil_add_sepol_type(pdb, db, tgt, &rule->ttypes.types);
48184907
if (rc != SEPOL_OK) {
48194908
goto exit;
48204909
}

‎libsepol/cil/src/cil_build_ast.c‎

Lines changed: 7 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -3126,9 +3126,13 @@ int cil_gen_aliasactual(struct cil_db *db, struct cil_tree_node *parse_current,
31263126
goto exit;
31273127
}
31283128

3129-
if ((flavor == CIL_TYPEALIAS && parse_current->next->data == CIL_KEY_SELF) || parse_current->next->next->data == CIL_KEY_SELF) {
3130-
cil_log(CIL_ERR, "The keyword '%s' is reserved\n", CIL_KEY_SELF);
3131-
rc = SEPOL_ERR;
3129+
rc = cil_verify_name(db, parse_current->next->data, flavor);
3130+
if (rc != SEPOL_OK) {
3131+
goto exit;
3132+
}
3133+
3134+
rc = cil_verify_name(db, parse_current->next->next->data, flavor);
3135+
if (rc != SEPOL_OK) {
31323136
goto exit;
31333137
}
31343138

0 commit comments

Comments
 (0)