From patchwork Mon Feb 3 11:27:19 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ondrej Mosnacek X-Patchwork-Id: 11362491 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id C7ED813A4 for ; Mon, 3 Feb 2020 11:27:32 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id A73B020838 for ; Mon, 3 Feb 2020 11:27:32 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="bHABjxzJ" Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1727276AbgBCL1c (ORCPT ); Mon, 3 Feb 2020 06:27:32 -0500 Received: from us-smtp-1.mimecast.com ([205.139.110.61]:53339 "EHLO us-smtp-delivery-1.mimecast.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1727240AbgBCL1b (ORCPT ); Mon, 3 Feb 2020 06:27:31 -0500 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1580729249; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=9lIemL6brFPUCAYSBZWFrUpZJZjzccOl0mn5RZzFkss=; b=bHABjxzJbg9Lh7fxRM4NKiQt2/7Q5/syTt7dB1wHTlE+BB9EGGgqUbt0vXfpJ6qi3wez+X OAs3/8FgAz8sDAWKka97gYncKhuwk+rb0rKYxQ7Xd6bIT5IFP/nvdJpQ17GJM9U2y5OHks vqohjIcwGtS9Pmkula/xv8+TEkIEc0k= Received: from mail-wr1-f71.google.com (mail-wr1-f71.google.com [209.85.221.71]) (Using TLS) by relay.mimecast.com with ESMTP id us-mta-370-SMGpf9HNMCKy46AVh7etBg-1; Mon, 03 Feb 2020 06:27:28 -0500 X-MC-Unique: SMGpf9HNMCKy46AVh7etBg-1 Received: by mail-wr1-f71.google.com with SMTP id u8so7083129wrp.10 for ; Mon, 03 Feb 2020 03:27:28 -0800 (PST) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=9lIemL6brFPUCAYSBZWFrUpZJZjzccOl0mn5RZzFkss=; b=M4B1V9pFGx8nid+qPuP6kFpNkVSKEH7imd875HjyJZRpQYQaddEZyHx/CxcGMogJXh iqB8UrITERGTBb0z78vkl4rPAGAHbiSXIyX56RWvg44F0ugo0zmSiQMknuog+88cwLo7 ItLE9ZjHWoaZn5h808q2wgloyiLvdPz+F5e3de/7JGEkmSlOS8CnCCrPSNwD/OBA5lKl E1/HDRLt+EUSNGjQtryOxZcAHLqc70MEL2GK2jJGTSdWhu4wVcPumI4UXRsggZ8bwkOd VJlMdVwejmG2lamU5FwdFB9Z5XsS2hj5lIo00uy2z7uOJ/LYWHGWuep7JiT3uRRhzZYO klqw== X-Gm-Message-State: APjAAAWUJr8v3PDLWZrB+WDtOGD113fKW7UkftQ/z3tISETgT9bkidOs 9B+GW3OnJt5CxqyirIRpI/yu6TUapLqLzvoZXT1WHiLymZxYqr+/eZS4cp8tBJ6QFkjulSQ1kED ejMZ1I3ghMsHhIqlEyw== X-Received: by 2002:a7b:c76a:: with SMTP id x10mr27221942wmk.49.1580729247181; Mon, 03 Feb 2020 03:27:27 -0800 (PST) X-Google-Smtp-Source: APXvYqy/nw6vpN8dOfUXN53cWzZEP3ttaAwoc66q2+6UKX0UjjOifkGdOPzijnf8nhrNZVah2iwhfA== X-Received: by 2002:a7b:c76a:: with SMTP id x10mr27221911wmk.49.1580729246907; Mon, 03 Feb 2020 03:27:26 -0800 (PST) Received: from omos.redhat.com (nat-pool-brq-t.redhat.com. [213.175.37.10]) by smtp.gmail.com with ESMTPSA id b16sm22597593wmj.39.2020.02.03.03.27.25 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 03 Feb 2020 03:27:25 -0800 (PST) From: Ondrej Mosnacek To: selinux@vger.kernel.org, Paul Moore Cc: Stephen Smalley Subject: [PATCH v3 1/5] selinux: simplify evaluate_cond_node() Date: Mon, 3 Feb 2020 12:27:19 +0100 Message-Id: <20200203112723.405341-2-omosnace@redhat.com> X-Mailer: git-send-email 2.24.1 In-Reply-To: <20200203112723.405341-1-omosnace@redhat.com> References: <20200203112723.405341-1-omosnace@redhat.com> MIME-Version: 1.0 Sender: selinux-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: selinux@vger.kernel.org It never fails, so it can just return void. Signed-off-by: Ondrej Mosnacek --- security/selinux/ss/conditional.c | 3 +-- security/selinux/ss/conditional.h | 2 +- security/selinux/ss/services.c | 14 ++++---------- 3 files changed, 6 insertions(+), 13 deletions(-) diff --git a/security/selinux/ss/conditional.c b/security/selinux/ss/conditional.c index 70c378ee1a2f..04593062008d 100644 --- a/security/selinux/ss/conditional.c +++ b/security/selinux/ss/conditional.c @@ -85,7 +85,7 @@ static int cond_evaluate_expr(struct policydb *p, struct cond_expr *expr) * list appropriately. If the result of the expression is undefined * all of the rules are disabled for safety. */ -int evaluate_cond_node(struct policydb *p, struct cond_node *node) +void evaluate_cond_node(struct policydb *p, struct cond_node *node) { int new_state; struct cond_av_list *cur; @@ -111,7 +111,6 @@ int evaluate_cond_node(struct policydb *p, struct cond_node *node) cur->node->key.specified |= AVTAB_ENABLED; } } - return 0; } int cond_policydb_init(struct policydb *p) diff --git a/security/selinux/ss/conditional.h b/security/selinux/ss/conditional.h index ec846e45904c..d86ef286ca84 100644 --- a/security/selinux/ss/conditional.h +++ b/security/selinux/ss/conditional.h @@ -75,6 +75,6 @@ void cond_compute_av(struct avtab *ctab, struct avtab_key *key, struct av_decision *avd, struct extended_perms *xperms); void cond_compute_xperms(struct avtab *ctab, struct avtab_key *key, struct extended_perms_decision *xpermd); -int evaluate_cond_node(struct policydb *p, struct cond_node *node); +void evaluate_cond_node(struct policydb *p, struct cond_node *node); #endif /* _CONDITIONAL_H_ */ diff --git a/security/selinux/ss/services.c b/security/selinux/ss/services.c index 216ce602a2b5..ff43a35bb874 100644 --- a/security/selinux/ss/services.c +++ b/security/selinux/ss/services.c @@ -2958,11 +2958,8 @@ int security_set_bools(struct selinux_state *state, int len, int *values) policydb->bool_val_to_struct[i]->state = 0; } - for (cur = policydb->cond_list; cur; cur = cur->next) { - rc = evaluate_cond_node(policydb, cur); - if (rc) - goto out; - } + for (cur = policydb->cond_list; cur; cur = cur->next) + evaluate_cond_node(policydb, cur); seqno = ++state->ss->latest_granting; rc = 0; @@ -3015,11 +3012,8 @@ static int security_preserve_bools(struct selinux_state *state, if (booldatum) booldatum->state = bvalues[i]; } - for (cur = policydb->cond_list; cur; cur = cur->next) { - rc = evaluate_cond_node(policydb, cur); - if (rc) - goto out; - } + for (cur = policydb->cond_list; cur; cur = cur->next) + evaluate_cond_node(policydb, cur); out: if (bnames) { From patchwork Mon Feb 3 11:27:20 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ondrej Mosnacek X-Patchwork-Id: 11362497 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 9847013A4 for ; Mon, 3 Feb 2020 11:27:35 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 76D432080D for ; Mon, 3 Feb 2020 11:27:35 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="ZUOThVPs" Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1727764AbgBCL1f (ORCPT ); Mon, 3 Feb 2020 06:27:35 -0500 Received: from us-smtp-1.mimecast.com ([205.139.110.61]:60993 "EHLO us-smtp-delivery-1.mimecast.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1727541AbgBCL1e (ORCPT ); Mon, 3 Feb 2020 06:27:34 -0500 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1580729253; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=HfSkkgAS1lHWJhOfFrM9jV3tycaprszdFwk53QWSd6M=; b=ZUOThVPsmabxL36+JF3suX93jCBkjW9vg9oyikf9iKmcTWJ20tsj6+SoHWeUriGAzrcT5e gxsDTUOblWaj3yx5sofuYYDPKYBWBa0A/XOWOpaCrd6HOzKJX/iY5uGFiYVDW2jc7hvJjx Jh8kf95U3dTJ9E7pamhFs2ZmrMmrd74= Received: from mail-wr1-f70.google.com (mail-wr1-f70.google.com [209.85.221.70]) (Using TLS) by relay.mimecast.com with ESMTP id us-mta-306-ItlE5-J-M0GdXh1_Pijozw-1; Mon, 03 Feb 2020 06:27:30 -0500 X-MC-Unique: ItlE5-J-M0GdXh1_Pijozw-1 Received: by mail-wr1-f70.google.com with SMTP id o6so8053818wrp.8 for ; Mon, 03 Feb 2020 03:27:30 -0800 (PST) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=HfSkkgAS1lHWJhOfFrM9jV3tycaprszdFwk53QWSd6M=; b=L6q/f3Sa47Dx8yU5SAxs3p0Rfe+/dI/bTmb7aFUCiJkE37cQHrTAkJUwFo3Yr+9+aI YiYh2sH7WlcVCeMqjKV6W6dZ46vP1NphrJAnlxYufgw9Chn2yHlZ9OU22/0vMSJ1bUWE Z3Q1tOqsHkVNHWsBbLgTkHcFyF8IlBbYNjcpLeIlOp9PdKxf2F1QDsaZNClnnK6FF/+t FWtc0bIPf/AhkDBU02zs9lphzhcFd1Jufbf1pr73AHgYzogiAn4iIMp0Y/rHc1XDIsZ8 OKGa8qnxZSZbPcZd56LH4piDzLZv4mapS01bitUtKIkyINbLKebGH7gLg3rlXmOWIo0L 4Nsg== X-Gm-Message-State: APjAAAUfIPwJlC6kiHCxNfH1lSbfojMhUXyovfDZwnoY+q06YfdhmtVA /vxoJ2PjXA+7h1h1lHUXGeLBH+CEcbPF6apForB8dtIP69U2dd7o00AV30zuaP5izbs33pqLpi9 Z/GcyCEowCYLv1v9zAw== X-Received: by 2002:a7b:c85a:: with SMTP id c26mr28548470wml.107.1580729248511; Mon, 03 Feb 2020 03:27:28 -0800 (PST) X-Google-Smtp-Source: APXvYqwLPGTnPxWAL7tndnxwiw9rI5qvDGTB5tYqAU3cyq5WtNVL7tnwsT4sVgEaC/52+paYWrU2Fg== X-Received: by 2002:a7b:c85a:: with SMTP id c26mr28548439wml.107.1580729248242; Mon, 03 Feb 2020 03:27:28 -0800 (PST) Received: from omos.redhat.com (nat-pool-brq-t.redhat.com. [213.175.37.10]) by smtp.gmail.com with ESMTPSA id b16sm22597593wmj.39.2020.02.03.03.27.27 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 03 Feb 2020 03:27:27 -0800 (PST) From: Ondrej Mosnacek To: selinux@vger.kernel.org, Paul Moore Cc: Stephen Smalley Subject: [PATCH v3 2/5] selinux: convert cond_list to array Date: Mon, 3 Feb 2020 12:27:20 +0100 Message-Id: <20200203112723.405341-3-omosnace@redhat.com> X-Mailer: git-send-email 2.24.1 In-Reply-To: <20200203112723.405341-1-omosnace@redhat.com> References: <20200203112723.405341-1-omosnace@redhat.com> MIME-Version: 1.0 Sender: selinux-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: selinux@vger.kernel.org Since it is fixed-size after allocation and we know the size beforehand, using a plain old array is simpler and more efficient. While there, also fix signedness of some related variables/parameters. Signed-off-by: Ondrej Mosnacek --- security/selinux/include/conditional.h | 8 ++-- security/selinux/selinuxfs.c | 4 +- security/selinux/ss/conditional.c | 54 ++++++++++---------------- security/selinux/ss/conditional.h | 3 +- security/selinux/ss/policydb.c | 2 +- security/selinux/ss/policydb.h | 3 +- security/selinux/ss/services.c | 28 ++++++------- 7 files changed, 43 insertions(+), 59 deletions(-) diff --git a/security/selinux/include/conditional.h b/security/selinux/include/conditional.h index 0ab316f61da0..539ab357707d 100644 --- a/security/selinux/include/conditional.h +++ b/security/selinux/include/conditional.h @@ -14,12 +14,10 @@ #include "security.h" int security_get_bools(struct selinux_state *state, - int *len, char ***names, int **values); + u32 *len, char ***names, int **values); -int security_set_bools(struct selinux_state *state, - int len, int *values); +int security_set_bools(struct selinux_state *state, u32 len, int *values); -int security_get_bool_value(struct selinux_state *state, - int index); +int security_get_bool_value(struct selinux_state *state, u32 index); #endif diff --git a/security/selinux/selinuxfs.c b/security/selinux/selinuxfs.c index 79c710911a3c..296ce86e8b1f 100644 --- a/security/selinux/selinuxfs.c +++ b/security/selinux/selinuxfs.c @@ -1327,14 +1327,14 @@ static void sel_remove_entries(struct dentry *de) static int sel_make_bools(struct selinux_fs_info *fsi) { - int i, ret; + int ret; ssize_t len; struct dentry *dentry = NULL; struct dentry *dir = fsi->bool_dir; struct inode *inode = NULL; struct inode_security_struct *isec; char **names = NULL, *page; - int num; + u32 i, num; int *values = NULL; u32 sid; diff --git a/security/selinux/ss/conditional.c b/security/selinux/ss/conditional.c index 04593062008d..e6d203b76545 100644 --- a/security/selinux/ss/conditional.c +++ b/security/selinux/ss/conditional.c @@ -119,6 +119,7 @@ int cond_policydb_init(struct policydb *p) p->bool_val_to_struct = NULL; p->cond_list = NULL; + p->cond_list_len = 0; rc = avtab_init(&p->te_cond_avtab); if (rc) @@ -147,27 +148,22 @@ static void cond_node_destroy(struct cond_node *node) } cond_av_list_destroy(node->true_list); cond_av_list_destroy(node->false_list); - kfree(node); } -static void cond_list_destroy(struct cond_node *list) +static void cond_list_destroy(struct policydb *p) { - struct cond_node *next, *cur; + u32 i; - if (list == NULL) - return; - - for (cur = list; cur; cur = next) { - next = cur->next; - cond_node_destroy(cur); - } + for (i = 0; i < p->cond_list_len; i++) + cond_node_destroy(&p->cond_list[i]); + kfree(p->cond_list); } void cond_policydb_destroy(struct policydb *p) { kfree(p->bool_val_to_struct); avtab_destroy(&p->te_cond_avtab); - cond_list_destroy(p->cond_list); + cond_list_destroy(p); } int cond_init_bool_indexes(struct policydb *p) @@ -447,7 +443,6 @@ err: int cond_read_list(struct policydb *p, void *fp) { - struct cond_node *node, *last = NULL; __le32 buf[1]; u32 i, len; int rc; @@ -458,29 +453,24 @@ int cond_read_list(struct policydb *p, void *fp) len = le32_to_cpu(buf[0]); + p->cond_list = kcalloc(len, sizeof(*p->cond_list), GFP_KERNEL); + if (!p->cond_list) + return rc; + rc = avtab_alloc(&(p->te_cond_avtab), p->te_avtab.nel); if (rc) goto err; - for (i = 0; i < len; i++) { - rc = -ENOMEM; - node = kzalloc(sizeof(*node), GFP_KERNEL); - if (!node) - goto err; + p->cond_list_len = len; - rc = cond_read_node(p, node, fp); + for (i = 0; i < len; i++) { + rc = cond_read_node(p, &p->cond_list[i], fp); if (rc) goto err; - - if (i == 0) - p->cond_list = node; - else - last->next = node; - last = node; } return 0; err: - cond_list_destroy(p->cond_list); + cond_list_destroy(p); p->cond_list = NULL; return rc; } @@ -585,23 +575,19 @@ static int cond_write_node(struct policydb *p, struct cond_node *node, return 0; } -int cond_write_list(struct policydb *p, struct cond_node *list, void *fp) +int cond_write_list(struct policydb *p, void *fp) { - struct cond_node *cur; - u32 len; + u32 i; __le32 buf[1]; int rc; - len = 0; - for (cur = list; cur != NULL; cur = cur->next) - len++; - buf[0] = cpu_to_le32(len); + buf[0] = cpu_to_le32(p->cond_list_len); rc = put_entry(buf, sizeof(u32), 1, fp); if (rc) return rc; - for (cur = list; cur != NULL; cur = cur->next) { - rc = cond_write_node(p, cur, fp); + for (i = 0; i < p->cond_list_len; i++) { + rc = cond_write_node(p, &p->cond_list[i], fp); if (rc) return rc; } diff --git a/security/selinux/ss/conditional.h b/security/selinux/ss/conditional.h index d86ef286ca84..e474bdd3a0ed 100644 --- a/security/selinux/ss/conditional.h +++ b/security/selinux/ss/conditional.h @@ -55,7 +55,6 @@ struct cond_node { struct cond_expr *expr; struct cond_av_list *true_list; struct cond_av_list *false_list; - struct cond_node *next; }; int cond_policydb_init(struct policydb *p); @@ -69,7 +68,7 @@ int cond_index_bool(void *key, void *datum, void *datap); int cond_read_bool(struct policydb *p, struct hashtab *h, void *fp); int cond_read_list(struct policydb *p, void *fp); int cond_write_bool(void *key, void *datum, void *ptr); -int cond_write_list(struct policydb *p, struct cond_node *list, void *fp); +int cond_write_list(struct policydb *p, void *fp); void cond_compute_av(struct avtab *ctab, struct avtab_key *key, struct av_decision *avd, struct extended_perms *xperms); diff --git a/security/selinux/ss/policydb.c b/security/selinux/ss/policydb.c index 2aa7f2e1a8e7..8ac9b9ffc83c 100644 --- a/security/selinux/ss/policydb.c +++ b/security/selinux/ss/policydb.c @@ -3483,7 +3483,7 @@ int policydb_write(struct policydb *p, void *fp) if (rc) return rc; - rc = cond_write_list(p, p->cond_list, fp); + rc = cond_write_list(p, fp); if (rc) return rc; diff --git a/security/selinux/ss/policydb.h b/security/selinux/ss/policydb.h index 69b24191fa38..6459616f8487 100644 --- a/security/selinux/ss/policydb.h +++ b/security/selinux/ss/policydb.h @@ -272,8 +272,9 @@ struct policydb { struct cond_bool_datum **bool_val_to_struct; /* type enforcement conditional access vectors and transitions */ struct avtab te_cond_avtab; - /* linked list indexing te_cond_avtab by conditional */ + /* array indexing te_cond_avtab by conditional */ struct cond_node *cond_list; + u32 cond_list_len; /* role allows */ struct role_allow *role_allow; diff --git a/security/selinux/ss/services.c b/security/selinux/ss/services.c index ff43a35bb874..8fc8ec317bb6 100644 --- a/security/selinux/ss/services.c +++ b/security/selinux/ss/services.c @@ -2868,10 +2868,11 @@ out: } int security_get_bools(struct selinux_state *state, - int *len, char ***names, int **values) + u32 *len, char ***names, int **values) { struct policydb *policydb; - int i, rc; + u32 i; + int rc; if (!selinux_initialized(state)) { *len = 0; @@ -2925,12 +2926,11 @@ err: } -int security_set_bools(struct selinux_state *state, int len, int *values) +int security_set_bools(struct selinux_state *state, u32 len, int *values) { struct policydb *policydb; - int i, rc; - int lenp, seqno = 0; - struct cond_node *cur; + int rc; + u32 i, lenp, seqno = 0; write_lock_irq(&state->ss->policy_rwlock); @@ -2958,8 +2958,8 @@ int security_set_bools(struct selinux_state *state, int len, int *values) policydb->bool_val_to_struct[i]->state = 0; } - for (cur = policydb->cond_list; cur; cur = cur->next) - evaluate_cond_node(policydb, cur); + for (i = 0; i < policydb->cond_list_len; i++) + evaluate_cond_node(policydb, &policydb->cond_list[i]); seqno = ++state->ss->latest_granting; rc = 0; @@ -2975,11 +2975,11 @@ out: } int security_get_bool_value(struct selinux_state *state, - int index) + u32 index) { struct policydb *policydb; int rc; - int len; + u32 len; read_lock(&state->ss->policy_rwlock); @@ -2999,10 +2999,10 @@ out: static int security_preserve_bools(struct selinux_state *state, struct policydb *policydb) { - int rc, nbools = 0, *bvalues = NULL, i; + int rc, *bvalues = NULL; char **bnames = NULL; struct cond_bool_datum *booldatum; - struct cond_node *cur; + u32 i, nbools = 0; rc = security_get_bools(state, &nbools, &bnames, &bvalues); if (rc) @@ -3012,8 +3012,8 @@ static int security_preserve_bools(struct selinux_state *state, if (booldatum) booldatum->state = bvalues[i]; } - for (cur = policydb->cond_list; cur; cur = cur->next) - evaluate_cond_node(policydb, cur); + for (i = 0; i < policydb->cond_list_len; i++) + evaluate_cond_node(policydb, &policydb->cond_list[i]); out: if (bnames) { From patchwork Mon Feb 3 11:27:21 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ondrej Mosnacek X-Patchwork-Id: 11362493 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 7DF4717E0 for ; Mon, 3 Feb 2020 11:27:34 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 481C52080D for ; Mon, 3 Feb 2020 11:27:34 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="AuQIAQZb" Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1727777AbgBCL1e (ORCPT ); Mon, 3 Feb 2020 06:27:34 -0500 Received: from us-smtp-2.mimecast.com ([207.211.31.81]:55534 "EHLO us-smtp-delivery-1.mimecast.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1727240AbgBCL1d (ORCPT ); Mon, 3 Feb 2020 06:27:33 -0500 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1580729252; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=groQhN/YZxlDjqvmsChyX9CqkmjqTvcLcJj3UeUg83k=; b=AuQIAQZbIoVJyj6os2CdTOxlIUi1TnXc35GSZKxe+yAK2BOa4SlMw179FzLZUV/jeNIt8M iWGYCFOO+D680tsdaMSNuiSTAGx2eoMrINa9yf65DcsUZgUIwJ1ZoxqcVdieYehRF5oUEz g6zHzwj0vmhS0gK9YcV1TqVNoKMV2Y8= Received: from mail-wr1-f72.google.com (mail-wr1-f72.google.com [209.85.221.72]) (Using TLS) by relay.mimecast.com with ESMTP id us-mta-25-_qRNPyG_M_OFjtKSCbXXdw-1; Mon, 03 Feb 2020 06:27:31 -0500 X-MC-Unique: _qRNPyG_M_OFjtKSCbXXdw-1 Received: by mail-wr1-f72.google.com with SMTP id x15so8055290wrl.15 for ; Mon, 03 Feb 2020 03:27:31 -0800 (PST) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=groQhN/YZxlDjqvmsChyX9CqkmjqTvcLcJj3UeUg83k=; b=g1NrKENISV8E1INHnYE1p/tzAX/ks5v3oubc3sxjK6/D6Q8ekfJfTx3Y4eG2/dh20a YXIYaEH3HpyREVynROf2UcNhnSzNEz8dGgBHq6KM32s0aKjM/LtH3iHAqhduUZv02HGR FkBvyc0teo3nFb8YtQYNwW5H74UhMCwDb5JSCS2gVIHKlI7pHAPdpRNPWO+ZyZwGUA5V 9jUfCbFylQlKHn0qxbwPnwcjDAi9IvKidNHhxlgTkHOTpWtP4XYUSxHw/yQu6zC49mnO BDB15LEpTyWPGfbod3juRg+BjpK64PhR3zWy1EQE/iBRGnXX7HEQ7vpfrshNOAipXlgX Ek2g== X-Gm-Message-State: APjAAAXMRDlA/Z2tsDOmPPqr5H0iPynlZqisZxKYp1saJ20FTlDZgIxr 0KTxJArqv0iiFPV+0fZh/2AbUrWI+MDrZtZauYPoosQHpuaKLuXMG7E/2i2ZBpwFtF7JnF+DjzU aASePxWzG3f7LxeDYXQ== X-Received: by 2002:a05:600c:2c44:: with SMTP id r4mr27769777wmg.140.1580729249483; Mon, 03 Feb 2020 03:27:29 -0800 (PST) X-Google-Smtp-Source: APXvYqyusbkRR9NxkFTqcTnIFtWhr10NvOJ2/vGYdhOsxzP/yXahXpkox9Pjvc17H3ueocKKJZp+Rw== X-Received: by 2002:a05:600c:2c44:: with SMTP id r4mr27769754wmg.140.1580729249183; Mon, 03 Feb 2020 03:27:29 -0800 (PST) Received: from omos.redhat.com (nat-pool-brq-t.redhat.com. [213.175.37.10]) by smtp.gmail.com with ESMTPSA id b16sm22597593wmj.39.2020.02.03.03.27.28 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 03 Feb 2020 03:27:28 -0800 (PST) From: Ondrej Mosnacek To: selinux@vger.kernel.org, Paul Moore Cc: Stephen Smalley Subject: [PATCH v3 3/5] selinux: convert cond_av_list to array Date: Mon, 3 Feb 2020 12:27:21 +0100 Message-Id: <20200203112723.405341-4-omosnace@redhat.com> X-Mailer: git-send-email 2.24.1 In-Reply-To: <20200203112723.405341-1-omosnace@redhat.com> References: <20200203112723.405341-1-omosnace@redhat.com> MIME-Version: 1.0 Sender: selinux-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: selinux@vger.kernel.org Since it is fixed-size after allocation and we know the size beforehand, using a plain old array is simpler and more efficient. Signed-off-by: Ondrej Mosnacek Reviewed-by: Stephen Smalley --- security/selinux/ss/conditional.c | 124 ++++++++++++------------------ security/selinux/ss/conditional.h | 8 +- 2 files changed, 53 insertions(+), 79 deletions(-) diff --git a/security/selinux/ss/conditional.c b/security/selinux/ss/conditional.c index e6d203b76545..82002b90809c 100644 --- a/security/selinux/ss/conditional.c +++ b/security/selinux/ss/conditional.c @@ -87,8 +87,9 @@ static int cond_evaluate_expr(struct policydb *p, struct cond_expr *expr) */ void evaluate_cond_node(struct policydb *p, struct cond_node *node) { + struct avtab_node *avnode; int new_state; - struct cond_av_list *cur; + u32 i; new_state = cond_evaluate_expr(p, node->expr); if (new_state != node->cur_state) { @@ -96,19 +97,21 @@ void evaluate_cond_node(struct policydb *p, struct cond_node *node) if (new_state == -1) pr_err("SELinux: expression result was undefined - disabling all rules.\n"); /* turn the rules on or off */ - for (cur = node->true_list; cur; cur = cur->next) { + for (i = 0; i < node->true_list.len; i++) { + avnode = node->true_list.nodes[i]; if (new_state <= 0) - cur->node->key.specified &= ~AVTAB_ENABLED; + avnode->key.specified &= ~AVTAB_ENABLED; else - cur->node->key.specified |= AVTAB_ENABLED; + avnode->key.specified |= AVTAB_ENABLED; } - for (cur = node->false_list; cur; cur = cur->next) { + for (i = 0; i < node->false_list.len; i++) { + avnode = node->false_list.nodes[i]; /* -1 or 1 */ if (new_state) - cur->node->key.specified &= ~AVTAB_ENABLED; + avnode->key.specified &= ~AVTAB_ENABLED; else - cur->node->key.specified |= AVTAB_ENABLED; + avnode->key.specified |= AVTAB_ENABLED; } } } @@ -128,16 +131,6 @@ int cond_policydb_init(struct policydb *p) return 0; } -static void cond_av_list_destroy(struct cond_av_list *list) -{ - struct cond_av_list *cur, *next; - for (cur = list; cur; cur = next) { - next = cur->next; - /* the avtab_ptr_t node is destroy by the avtab */ - kfree(cur); - } -} - static void cond_node_destroy(struct cond_node *node) { struct cond_expr *cur_expr, *next_expr; @@ -146,8 +139,9 @@ static void cond_node_destroy(struct cond_node *node) next_expr = cur_expr->next; kfree(cur_expr); } - cond_av_list_destroy(node->true_list); - cond_av_list_destroy(node->false_list); + /* the avtab_ptr_t nodes are destroyed by the avtab */ + kfree(node->true_list.nodes); + kfree(node->false_list.nodes); } static void cond_list_destroy(struct policydb *p) @@ -255,19 +249,18 @@ err: struct cond_insertf_data { struct policydb *p; + struct avtab_node **dst; struct cond_av_list *other; - struct cond_av_list *head; - struct cond_av_list *tail; }; static int cond_insertf(struct avtab *a, struct avtab_key *k, struct avtab_datum *d, void *ptr) { struct cond_insertf_data *data = ptr; struct policydb *p = data->p; - struct cond_av_list *other = data->other, *list, *cur; + struct cond_av_list *other = data->other; struct avtab_node *node_ptr; - u8 found; - int rc = -EINVAL; + u32 i; + bool found; /* * For type rules we have to make certain there aren't any @@ -277,7 +270,7 @@ static int cond_insertf(struct avtab *a, struct avtab_key *k, struct avtab_datum if (k->specified & AVTAB_TYPE) { if (avtab_search(&p->te_avtab, k)) { pr_err("SELinux: type rule already exists outside of a conditional.\n"); - goto err; + return -EINVAL; } /* * If we are reading the false list other will be a pointer to @@ -292,24 +285,24 @@ static int cond_insertf(struct avtab *a, struct avtab_key *k, struct avtab_datum if (node_ptr) { if (avtab_search_node_next(node_ptr, k->specified)) { pr_err("SELinux: too many conflicting type rules.\n"); - goto err; + return -EINVAL; } - found = 0; - for (cur = other; cur; cur = cur->next) { - if (cur->node == node_ptr) { - found = 1; + found = false; + for (i = 0; i < other->len; i++) { + if (other->nodes[i] == node_ptr) { + found = true; break; } } if (!found) { pr_err("SELinux: conflicting type rules.\n"); - goto err; + return -EINVAL; } } } else { if (avtab_search(&p->te_cond_avtab, k)) { pr_err("SELinux: conflicting type rules when adding type rule for true.\n"); - goto err; + return -EINVAL; } } } @@ -317,39 +310,22 @@ static int cond_insertf(struct avtab *a, struct avtab_key *k, struct avtab_datum node_ptr = avtab_insert_nonunique(&p->te_cond_avtab, k, d); if (!node_ptr) { pr_err("SELinux: could not insert rule.\n"); - rc = -ENOMEM; - goto err; - } - - list = kzalloc(sizeof(*list), GFP_KERNEL); - if (!list) { - rc = -ENOMEM; - goto err; + return -ENOMEM; } - list->node = node_ptr; - if (!data->head) - data->head = list; - else - data->tail->next = list; - data->tail = list; + *data->dst = node_ptr; return 0; - -err: - cond_av_list_destroy(data->head); - data->head = NULL; - return rc; } -static int cond_read_av_list(struct policydb *p, void *fp, struct cond_av_list **ret_list, struct cond_av_list *other) +static int cond_read_av_list(struct policydb *p, void *fp, + struct cond_av_list *list, + struct cond_av_list *other) { - int i, rc; + int rc; __le32 buf[1]; - u32 len; + u32 i, len; struct cond_insertf_data data; - *ret_list = NULL; - rc = next_entry(buf, fp, sizeof(u32)); if (rc) return rc; @@ -358,18 +334,24 @@ static int cond_read_av_list(struct policydb *p, void *fp, struct cond_av_list * if (len == 0) return 0; + list->nodes = kcalloc(len, sizeof(*list->nodes), GFP_KERNEL); + if (!list->nodes) + return -ENOMEM; + data.p = p; data.other = other; - data.head = NULL; - data.tail = NULL; for (i = 0; i < len; i++) { + data.dst = &list->nodes[i]; rc = avtab_read_item(&p->te_cond_avtab, fp, p, cond_insertf, &data); - if (rc) + if (rc) { + kfree(list->nodes); + list->nodes = NULL; return rc; + } } - *ret_list = data.head; + list->len = len; return 0; } @@ -432,7 +414,7 @@ static int cond_read_node(struct policydb *p, struct cond_node *node, void *fp) rc = cond_read_av_list(p, fp, &node->true_list, NULL); if (rc) goto err; - rc = cond_read_av_list(p, fp, &node->false_list, node->true_list); + rc = cond_read_av_list(p, fp, &node->false_list, &node->true_list); if (rc) goto err; return 0; @@ -511,24 +493,16 @@ static int cond_write_av_list(struct policydb *p, struct cond_av_list *list, struct policy_file *fp) { __le32 buf[1]; - struct cond_av_list *cur_list; - u32 len; + u32 i; int rc; - len = 0; - for (cur_list = list; cur_list != NULL; cur_list = cur_list->next) - len++; - - buf[0] = cpu_to_le32(len); + buf[0] = cpu_to_le32(list->len); rc = put_entry(buf, sizeof(u32), 1, fp); if (rc) return rc; - if (len == 0) - return 0; - - for (cur_list = list; cur_list != NULL; cur_list = cur_list->next) { - rc = avtab_write_item(p, cur_list->node, fp); + for (i = 0; i < list->len; i++) { + rc = avtab_write_item(p, list->nodes[i], fp); if (rc) return rc; } @@ -565,10 +539,10 @@ static int cond_write_node(struct policydb *p, struct cond_node *node, return rc; } - rc = cond_write_av_list(p, node->true_list, fp); + rc = cond_write_av_list(p, &node->true_list, fp); if (rc) return rc; - rc = cond_write_av_list(p, node->false_list, fp); + rc = cond_write_av_list(p, &node->false_list, fp); if (rc) return rc; diff --git a/security/selinux/ss/conditional.h b/security/selinux/ss/conditional.h index e474bdd3a0ed..5f97f678440e 100644 --- a/security/selinux/ss/conditional.h +++ b/security/selinux/ss/conditional.h @@ -39,8 +39,8 @@ struct cond_expr { * struct is for that list. */ struct cond_av_list { - struct avtab_node *node; - struct cond_av_list *next; + struct avtab_node **nodes; + u32 len; }; /* @@ -53,8 +53,8 @@ struct cond_av_list { struct cond_node { int cur_state; struct cond_expr *expr; - struct cond_av_list *true_list; - struct cond_av_list *false_list; + struct cond_av_list true_list; + struct cond_av_list false_list; }; int cond_policydb_init(struct policydb *p); From patchwork Mon Feb 3 11:27:22 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ondrej Mosnacek X-Patchwork-Id: 11362495 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 6D39617E0 for ; Mon, 3 Feb 2020 11:27:35 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 423052080D for ; Mon, 3 Feb 2020 11:27:35 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="Ss6SUdld" Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1727569AbgBCL1f (ORCPT ); Mon, 3 Feb 2020 06:27:35 -0500 Received: from us-smtp-2.mimecast.com ([205.139.110.61]:29582 "EHLO us-smtp-delivery-1.mimecast.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1727764AbgBCL1e (ORCPT ); Mon, 3 Feb 2020 06:27:34 -0500 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1580729253; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=LL0L5LM5NstMeBADEcQiQzUcWHSB6Kx4MCuR+9ZHU+0=; b=Ss6SUdldUGPHxHky+18VQgHBN3g3iFtFbF/GXBLexyn+nzgW5+NxMmb5kT/SeGupfzFZ7r LaG+ahEiElFkNG8LRkJXtOT0WpkeVYcpL+i19EUwNUihfCx4V8/Pf00wdl6PKf+jYW8ntC KiXklXPT9k/QK6DAtX5Q7S+8/sE+EDo= Received: from mail-wr1-f71.google.com (mail-wr1-f71.google.com [209.85.221.71]) (Using TLS) by relay.mimecast.com with ESMTP id us-mta-418-ILFBEK2FOteDaZLeATnYdw-1; Mon, 03 Feb 2020 06:27:32 -0500 X-MC-Unique: ILFBEK2FOteDaZLeATnYdw-1 Received: by mail-wr1-f71.google.com with SMTP id f10so8118157wro.14 for ; Mon, 03 Feb 2020 03:27:31 -0800 (PST) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=LL0L5LM5NstMeBADEcQiQzUcWHSB6Kx4MCuR+9ZHU+0=; b=PP0kTeNxc9aP/Af2S78k6pCIynfXzqQloYANp9pSyvdM+PP+4vfXeryel3EzdqjJ67 MSAIHrDyHj2oNaCC7QSmpJ7QQJFZ2wSsxcKvChuga+Rwt+hKCJzSBUjk1zyzakfLZAnp M/86ycQb1JCrsMt1gTECozXIYhAXjEGrnzDpOwr+f3BzLKHWHEYtqXrcp4JnJK2jpMWW KbVUQWkcdSgZj+rH50JkazpO9XCJKSdFZdJLJmo+82x0IqprWAQpIvHsCicNovCtll1Q Gs4zyOhrSjLaX9ZqnIHm/yDw+yEnSehN7VYe0CLKIevTqfqOCmgmPb+IxsTYTQhUzwHN vK7A== X-Gm-Message-State: APjAAAX2/eMeXFYWTBE8iSHnxUsPY5NNbry7qGq/NmJ73SM5nfhB4Kdt 4jPezLleh1s9qhX1L4+vl12DGRQ6W5GC3kxQj4AuXwQLX5wihxNuWA+Mod0WgzuIkuVWHAQE+uu eGSC1vFrQSB3UgHm55w== X-Received: by 2002:a1c:7717:: with SMTP id t23mr29924154wmi.17.1580729250301; Mon, 03 Feb 2020 03:27:30 -0800 (PST) X-Google-Smtp-Source: APXvYqwz2/NZq3dgLCCZvXiWBN43/B1t1AGgT4g5eEHbU17LZRUcMauKCDzB463bckTWTnO+vzipiQ== X-Received: by 2002:a1c:7717:: with SMTP id t23mr29924124wmi.17.1580729250044; Mon, 03 Feb 2020 03:27:30 -0800 (PST) Received: from omos.redhat.com (nat-pool-brq-t.redhat.com. [213.175.37.10]) by smtp.gmail.com with ESMTPSA id b16sm22597593wmj.39.2020.02.03.03.27.29 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 03 Feb 2020 03:27:29 -0800 (PST) From: Ondrej Mosnacek To: selinux@vger.kernel.org, Paul Moore Cc: Stephen Smalley Subject: [PATCH v3 4/5] selinux: convert cond_expr to array Date: Mon, 3 Feb 2020 12:27:22 +0100 Message-Id: <20200203112723.405341-5-omosnace@redhat.com> X-Mailer: git-send-email 2.24.1 In-Reply-To: <20200203112723.405341-1-omosnace@redhat.com> References: <20200203112723.405341-1-omosnace@redhat.com> MIME-Version: 1.0 Sender: selinux-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: selinux@vger.kernel.org Since it is fixed-size after allocation and we know the size beforehand, using a plain old array is simpler and more efficient. Signed-off-by: Ondrej Mosnacek Reviewed-by: Stephen Smalley --- security/selinux/ss/conditional.c | 62 ++++++++++++------------------- security/selinux/ss/conditional.h | 14 ++++--- 2 files changed, 33 insertions(+), 43 deletions(-) diff --git a/security/selinux/ss/conditional.c b/security/selinux/ss/conditional.c index 82002b90809c..669b766c260b 100644 --- a/security/selinux/ss/conditional.c +++ b/security/selinux/ss/conditional.c @@ -23,18 +23,19 @@ */ static int cond_evaluate_expr(struct policydb *p, struct cond_expr *expr) { - - struct cond_expr *cur; + u32 i; int s[COND_EXPR_MAXDEPTH]; int sp = -1; - for (cur = expr; cur; cur = cur->next) { - switch (cur->expr_type) { + for (i = 0; i < expr->len; i++) { + struct cond_expr_node *node = &expr->nodes[i]; + + switch (node->expr_type) { case COND_BOOL: if (sp == (COND_EXPR_MAXDEPTH - 1)) return -1; sp++; - s[sp] = p->bool_val_to_struct[cur->bool - 1]->state; + s[sp] = p->bool_val_to_struct[node->bool - 1]->state; break; case COND_NOT: if (sp < 0) @@ -91,7 +92,7 @@ void evaluate_cond_node(struct policydb *p, struct cond_node *node) int new_state; u32 i; - new_state = cond_evaluate_expr(p, node->expr); + new_state = cond_evaluate_expr(p, &node->expr); if (new_state != node->cur_state) { node->cur_state = new_state; if (new_state == -1) @@ -133,12 +134,7 @@ int cond_policydb_init(struct policydb *p) static void cond_node_destroy(struct cond_node *node) { - struct cond_expr *cur_expr, *next_expr; - - for (cur_expr = node->expr; cur_expr; cur_expr = next_expr) { - next_expr = cur_expr->next; - kfree(cur_expr); - } + kfree(node->expr.nodes); /* the avtab_ptr_t nodes are destroyed by the avtab */ kfree(node->true_list.nodes); kfree(node->false_list.nodes); @@ -355,7 +351,7 @@ static int cond_read_av_list(struct policydb *p, void *fp, return 0; } -static int expr_isvalid(struct policydb *p, struct cond_expr *expr) +static int expr_node_isvalid(struct policydb *p, struct cond_expr_node *expr) { if (expr->expr_type <= 0 || expr->expr_type > COND_LAST) { pr_err("SELinux: conditional expressions uses unknown operator.\n"); @@ -372,43 +368,37 @@ static int expr_isvalid(struct policydb *p, struct cond_expr *expr) static int cond_read_node(struct policydb *p, struct cond_node *node, void *fp) { __le32 buf[2]; - u32 len, i; + u32 i, len; int rc; - struct cond_expr *expr = NULL, *last = NULL; rc = next_entry(buf, fp, sizeof(u32) * 2); if (rc) - goto err; + return rc; node->cur_state = le32_to_cpu(buf[0]); /* expr */ len = le32_to_cpu(buf[1]); + node->expr.nodes = kcalloc(len, sizeof(*node->expr.nodes), GFP_KERNEL); + if (!node->expr.nodes) + return -ENOMEM; + + node->expr.len = len; for (i = 0; i < len; i++) { + struct cond_expr_node *expr = &node->expr.nodes[i]; + rc = next_entry(buf, fp, sizeof(u32) * 2); if (rc) goto err; - rc = -ENOMEM; - expr = kzalloc(sizeof(*expr), GFP_KERNEL); - if (!expr) - goto err; - expr->expr_type = le32_to_cpu(buf[0]); expr->bool = le32_to_cpu(buf[1]); - if (!expr_isvalid(p, expr)) { + if (!expr_node_isvalid(p, expr)) { rc = -EINVAL; - kfree(expr); goto err; } - - if (i == 0) - node->expr = expr; - else - last->next = expr; - last = expr; } rc = cond_read_av_list(p, fp, &node->true_list, NULL); @@ -513,27 +503,23 @@ static int cond_write_av_list(struct policydb *p, static int cond_write_node(struct policydb *p, struct cond_node *node, struct policy_file *fp) { - struct cond_expr *cur_expr; __le32 buf[2]; int rc; - u32 len = 0; + u32 i; buf[0] = cpu_to_le32(node->cur_state); rc = put_entry(buf, sizeof(u32), 1, fp); if (rc) return rc; - for (cur_expr = node->expr; cur_expr != NULL; cur_expr = cur_expr->next) - len++; - - buf[0] = cpu_to_le32(len); + buf[0] = cpu_to_le32(node->expr.len); rc = put_entry(buf, sizeof(u32), 1, fp); if (rc) return rc; - for (cur_expr = node->expr; cur_expr != NULL; cur_expr = cur_expr->next) { - buf[0] = cpu_to_le32(cur_expr->expr_type); - buf[1] = cpu_to_le32(cur_expr->bool); + for (i = 0; i < node->expr.len; i++) { + buf[0] = cpu_to_le32(node->expr.nodes[i].expr_type); + buf[1] = cpu_to_le32(node->expr.nodes[i].bool); rc = put_entry(buf, sizeof(u32), 2, fp); if (rc) return rc; diff --git a/security/selinux/ss/conditional.h b/security/selinux/ss/conditional.h index 5f97f678440e..4677c6ff7450 100644 --- a/security/selinux/ss/conditional.h +++ b/security/selinux/ss/conditional.h @@ -19,7 +19,7 @@ * A conditional expression is a list of operators and operands * in reverse polish notation. */ -struct cond_expr { +struct cond_expr_node { #define COND_BOOL 1 /* plain bool */ #define COND_NOT 2 /* !bool */ #define COND_OR 3 /* bool || bool */ @@ -28,9 +28,13 @@ struct cond_expr { #define COND_EQ 6 /* bool == bool */ #define COND_NEQ 7 /* bool != bool */ #define COND_LAST COND_NEQ - __u32 expr_type; - __u32 bool; - struct cond_expr *next; + u32 expr_type; + u32 bool; +}; + +struct cond_expr { + struct cond_expr_node *nodes; + u32 len; }; /* @@ -52,7 +56,7 @@ struct cond_av_list { */ struct cond_node { int cur_state; - struct cond_expr *expr; + struct cond_expr expr; struct cond_av_list true_list; struct cond_av_list false_list; }; From patchwork Mon Feb 3 11:27:23 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ondrej Mosnacek X-Patchwork-Id: 11362499 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 1BA131892 for ; Mon, 3 Feb 2020 11:27:36 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id EE55D20661 for ; Mon, 3 Feb 2020 11:27:35 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="ME6h3MAL" Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1727541AbgBCL1f (ORCPT ); Mon, 3 Feb 2020 06:27:35 -0500 Received: from us-smtp-delivery-1.mimecast.com ([207.211.31.120]:23882 "EHLO us-smtp-1.mimecast.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1727240AbgBCL1f (ORCPT ); Mon, 3 Feb 2020 06:27:35 -0500 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1580729254; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=NsDVjOhc++zTz7h+huIdm3hhYfQZnmFt2SBo4Tk9NXI=; b=ME6h3MALZe167VyT7nZJO2oZfkgSITFfhv4qaumH80YEfzqc4oj9oDsVnXPlQqo7MdXPy6 hbCHV+amfka0nNDYtZyMbBAvsdxH6da1AwY0fsVahD4ydy8woOpwxEAeir1egHMP8sou1F tdl+rd/eMEwzhimt8BlldRnfumoDDxk= Received: from mail-wr1-f69.google.com (mail-wr1-f69.google.com [209.85.221.69]) (Using TLS) by relay.mimecast.com with ESMTP id us-mta-139-a9sZmNKfMIiENw2ucAtcOw-1; Mon, 03 Feb 2020 06:27:33 -0500 X-MC-Unique: a9sZmNKfMIiENw2ucAtcOw-1 Received: by mail-wr1-f69.google.com with SMTP id 50so7235428wrc.2 for ; Mon, 03 Feb 2020 03:27:33 -0800 (PST) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=NsDVjOhc++zTz7h+huIdm3hhYfQZnmFt2SBo4Tk9NXI=; b=PyuetZkKstVLPiMnbAN/9LnvNuo9fzElFcS68ZbZH3t2bEzaUjHTnZPGBzq2bzHKq0 HsKWLgSFSrAAmjyS8js5cruDPqPhe6lriRbv6RHNeXrFt0PvhHbqAgNJAhyjxD0Kynaf 7M8rlJgzT6pNUtmdmKDPe3Y2W+0LBNEGsaxU2hI1agaC+eYnDBg29eQsk+NHW/D8p6Sx AlROFuKoa8utLeN2s6cFOjLud9gTMJambgD3MN6FBDnlY+u2y/HuiOy8qU4RbN5bFGc9 LaB1IzCnHp4wFqcv/mbmslqtgpZb/ZzZafVatM0K7UD0FfLH1hJahe45UTmb0jhcuorE TR2g== X-Gm-Message-State: APjAAAWz8IA7lkW+tgyGvmH7c2GSUv7lVcsV7t6fh66W58oKCLdpFM8C SrOXGtRb/CVNU3pdtoCe6x3N13Tq5C+f9AiFGjYdEIMu7UQwRIcoLvYl8GaeAU4rgKX3iBrSuvS ZPX/e/vPEf/g3GfZ5SA== X-Received: by 2002:a1c:9c4c:: with SMTP id f73mr27508426wme.125.1580729251887; Mon, 03 Feb 2020 03:27:31 -0800 (PST) X-Google-Smtp-Source: APXvYqy8DuAE/QcJ8nJOkjkVZDm93+96MQpgn6ttSMZ+6p7C17AEZ34ISe2unTufyiPGD6wIYt65ow== X-Received: by 2002:a1c:9c4c:: with SMTP id f73mr27508398wme.125.1580729251654; Mon, 03 Feb 2020 03:27:31 -0800 (PST) Received: from omos.redhat.com (nat-pool-brq-t.redhat.com. [213.175.37.10]) by smtp.gmail.com with ESMTPSA id b16sm22597593wmj.39.2020.02.03.03.27.30 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 03 Feb 2020 03:27:30 -0800 (PST) From: Ondrej Mosnacek To: selinux@vger.kernel.org, Paul Moore Cc: Stephen Smalley Subject: [PATCH v3 5/5] selinux: generalize evaluate_cond_node() Date: Mon, 3 Feb 2020 12:27:23 +0100 Message-Id: <20200203112723.405341-6-omosnace@redhat.com> X-Mailer: git-send-email 2.24.1 In-Reply-To: <20200203112723.405341-1-omosnace@redhat.com> References: <20200203112723.405341-1-omosnace@redhat.com> MIME-Version: 1.0 Sender: selinux-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: selinux@vger.kernel.org Both callers iterate the cond_list and call it for each node - turn it into evaluate_cond_nodes(), which does the iteration for them. Signed-off-by: Ondrej Mosnacek --- security/selinux/ss/conditional.c | 10 +++++++++- security/selinux/ss/conditional.h | 2 +- security/selinux/ss/services.c | 6 ++---- 3 files changed, 12 insertions(+), 6 deletions(-) diff --git a/security/selinux/ss/conditional.c b/security/selinux/ss/conditional.c index 669b766c260b..cce4a75fb3e7 100644 --- a/security/selinux/ss/conditional.c +++ b/security/selinux/ss/conditional.c @@ -86,7 +86,7 @@ static int cond_evaluate_expr(struct policydb *p, struct cond_expr *expr) * list appropriately. If the result of the expression is undefined * all of the rules are disabled for safety. */ -void evaluate_cond_node(struct policydb *p, struct cond_node *node) +static void evaluate_cond_node(struct policydb *p, struct cond_node *node) { struct avtab_node *avnode; int new_state; @@ -117,6 +117,14 @@ void evaluate_cond_node(struct policydb *p, struct cond_node *node) } } +void evaluate_cond_nodes(struct policydb *p) +{ + u32 i; + + for (i = 0; i < p->cond_list_len; i++) + evaluate_cond_node(p, &p->cond_list[i]); +} + int cond_policydb_init(struct policydb *p) { int rc; diff --git a/security/selinux/ss/conditional.h b/security/selinux/ss/conditional.h index 4677c6ff7450..b9eb888ffa76 100644 --- a/security/selinux/ss/conditional.h +++ b/security/selinux/ss/conditional.h @@ -78,6 +78,6 @@ void cond_compute_av(struct avtab *ctab, struct avtab_key *key, struct av_decision *avd, struct extended_perms *xperms); void cond_compute_xperms(struct avtab *ctab, struct avtab_key *key, struct extended_perms_decision *xpermd); -void evaluate_cond_node(struct policydb *p, struct cond_node *node); +void evaluate_cond_nodes(struct policydb *p); #endif /* _CONDITIONAL_H_ */ diff --git a/security/selinux/ss/services.c b/security/selinux/ss/services.c index 8fc8ec317bb6..7fb7f2efe566 100644 --- a/security/selinux/ss/services.c +++ b/security/selinux/ss/services.c @@ -2958,8 +2958,7 @@ int security_set_bools(struct selinux_state *state, u32 len, int *values) policydb->bool_val_to_struct[i]->state = 0; } - for (i = 0; i < policydb->cond_list_len; i++) - evaluate_cond_node(policydb, &policydb->cond_list[i]); + evaluate_cond_nodes(policydb); seqno = ++state->ss->latest_granting; rc = 0; @@ -3012,8 +3011,7 @@ static int security_preserve_bools(struct selinux_state *state, if (booldatum) booldatum->state = bvalues[i]; } - for (i = 0; i < policydb->cond_list_len; i++) - evaluate_cond_node(policydb, &policydb->cond_list[i]); + evaluate_cond_nodes(policydb); out: if (bnames) {