[userspace,v2,0/2] Support the 'self' keyword in type transitions

Message

Ondrej Mosnacek April 26, 2022, 10:51 a.m. UTC

With the addition of the anon_inode class in the kernel, 'self'
transition rules became useful, but haven't been implemented.

This series implements the self keyword support in the CIL & TE
languages and the module policydb format. The kernel policydb format
doesn't need any changes, as type transitions are always expanded in the
kernel policydb.

The patches have been tested using the following WIP beakerlib/tmt test:
https://src.fedoraproject.org/fork/omos/tests/selinux/blob/self-in-tt/f/libsepol/self-keyword-in-type-transitions

Changes in v2:
- validate the flags member of filename_trans_rule_t in
  policy_validate.c (Christian Göttsche)
- add missing error check in filename_trans_rule_write()
  (Christian Göttsche)

Ondrej Mosnacek (2):
  libsepol/cil: add support for self keyword in type transitions
  libsepol,checkpolicy: add support for self keyword in type transitions

 checkpolicy/policy_define.c                |  42 +++++-
 libsepol/cil/src/cil_binary.c              | 168 +++++++++++++++------
 libsepol/cil/src/cil_resolve_ast.c         |  25 ++-
 libsepol/include/sepol/policydb/policydb.h |   4 +-
 libsepol/src/expand.c                      |  69 ++++++---
 libsepol/src/link.c                        |   1 +
 libsepol/src/module_to_cil.c               |  30 ++--
 libsepol/src/policydb.c                    |  33 +++-
 libsepol/src/policydb_validate.c           |   4 +
 libsepol/src/write.c                       |  19 ++-
 secilc/test/policy.cil                     |   3 +
 11 files changed, 298 insertions(+), 100 deletions(-)