From patchwork Fri Dec 17 18:18:58 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: James Carter X-Patchwork-Id: 12685439 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 5F763C433EF for ; Fri, 17 Dec 2021 18:19:27 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234068AbhLQST0 (ORCPT ); Fri, 17 Dec 2021 13:19:26 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:41758 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234149AbhLQST0 (ORCPT ); Fri, 17 Dec 2021 13:19:26 -0500 Received: from mail-qk1-x729.google.com (mail-qk1-x729.google.com [IPv6:2607:f8b0:4864:20::729]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 3DACBC061574 for ; Fri, 17 Dec 2021 10:19:26 -0800 (PST) Received: by mail-qk1-x729.google.com with SMTP id de30so3038266qkb.0 for ; Fri, 17 Dec 2021 10:19:26 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=tKn85cKJmtY5fpLVgW6csAcITiSKsyGMOP6Hjw9OQtI=; b=et3rIzqrqDF9R/cDozPZgJIdlv5HqGnulC74dmCHjwvx8jsVDif81pJ/s1Rh5WLrWO g+frQkvPhGejap9oJVpMJ0EiJtlcy9rc8CuEaxg43i2NLLL8osObwA97Z8XN5ddI1ZDh IyWpkDcTzmdQPVFeOkEa4ARA3egoIHhITF+L0zSGUFbLo51zb8Ap9Plaz/UpQLRPg/Hx MUlMMnJ5+BQGOr9aNFPIaDVU7TnaH85C+XOy5hOtfB4zwnJlMEcozAgTDM/fQD8MFgC4 7bWZAEmKknWqBa3kRqptHN4TXRT3jOA6FYLp+znfvKEhbg7W6PTkv+NzajJRu7ofcREI xy2g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=tKn85cKJmtY5fpLVgW6csAcITiSKsyGMOP6Hjw9OQtI=; b=X+3Nsdh5X8h1XYSi6ZtlFFu3acY7sgj+y4Rc6a++bRR50LjufQa6yHVpeIe4s1HKno sEuIEQe5p8IdwEwEL8S46PZR3eHgcvqN67Ndo2xe3GmInNw5QXBeuiP+dQ04OgV/KI/q 8icwMhGEtzi6rb/fbVAwJTiIrizZ0oqZSvoeDRcPLqRZ+XOkG8BkUsmQmzOnDWML9YyJ yNlpK0ubLIYl0V8sT3hDgM0mBGYr5YUvI2/gwh19MZIBqZWeVhhm1vAdggGvR8dB1+s4 BQty7mE/WGDpUtu7Yk6UyxgcV7SQbMDXFo91YN5LWgWTkgyj/pRodp9cwrA98KTcp/ez izgA== X-Gm-Message-State: AOAM531njhGYqXyMvXevLwOTRZZ3hefxzbQuRKQ1xb6ODCIusHJhXiJ8 J+gfqJ579LvB7m1JbZnxQuECHPgu7LQ= X-Google-Smtp-Source: ABdhPJxlNSLNDlztQ4ZVnmpYtEmS3fF7RW9hBuWWHGza5ijxFMjvaC/EhYdyhawhAsBRbVud44aBaA== X-Received: by 2002:a05:620a:2407:: with SMTP id d7mr2680177qkn.114.1639765165329; Fri, 17 Dec 2021 10:19:25 -0800 (PST) Received: from localhost.localdomain (c-73-200-157-122.hsd1.md.comcast.net. [73.200.157.122]) by smtp.gmail.com with ESMTPSA id o17sm7468094qtv.30.2021.12.17.10.19.24 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 17 Dec 2021 10:19:24 -0800 (PST) From: James Carter To: selinux@vger.kernel.org Cc: cgzones@googlemail.com, James Carter Subject: [PATCH 01/16] libsepol: Return an error if check_assertion() returns an error. Date: Fri, 17 Dec 2021 13:18:58 -0500 Message-Id: <20211217181913.336360-2-jwcart2@gmail.com> X-Mailer: git-send-email 2.31.1 In-Reply-To: <20211217181913.336360-1-jwcart2@gmail.com> References: <20211217181913.336360-1-jwcart2@gmail.com> MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: selinux@vger.kernel.org Instead of calling report_assertion_failures() and treating an error like it was a neverallow violation, just return an error. Signed-off-by: James Carter --- libsepol/src/assertion.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/libsepol/src/assertion.c b/libsepol/src/assertion.c index dd2749a0..ba4a204f 100644 --- a/libsepol/src/assertion.c +++ b/libsepol/src/assertion.c @@ -538,6 +538,10 @@ int check_assertions(sepol_handle_t * handle, policydb_t * p, if (!(a->specified & (AVRULE_NEVERALLOW | AVRULE_XPERMS_NEVERALLOW))) continue; rc = check_assertion(p, a); + if (rc < 0) { + ERR(handle, "Error occurred while checking neverallows"); + return -1; + } if (rc) { rc = report_assertion_failures(handle, p, a); if (rc < 0) { From patchwork Fri Dec 17 18:18:59 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: James Carter X-Patchwork-Id: 12685443 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id D13C9C433FE for ; Fri, 17 Dec 2021 18:19:27 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234154AbhLQST1 (ORCPT ); Fri, 17 Dec 2021 13:19:27 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:41760 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S230030AbhLQST1 (ORCPT ); Fri, 17 Dec 2021 13:19:27 -0500 Received: from mail-qt1-x82f.google.com (mail-qt1-x82f.google.com [IPv6:2607:f8b0:4864:20::82f]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id D94DCC061574 for ; Fri, 17 Dec 2021 10:19:26 -0800 (PST) Received: by mail-qt1-x82f.google.com with SMTP id v22so3485932qtx.8 for ; Fri, 17 Dec 2021 10:19:26 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=106LcaQV+09ecmysXH/0CQoQX/LNoX+Zp7PgkkWnBf0=; b=ZXCeRDAbTGvnFI3MPXhDNrCT2nRbNRppzxlxb0fQ6YFhbydDHw101Vvzzf3IveKyZ6 aAnnX6ob2m5Ms37xuijr0RLxQbl5UVEu9ZsnFvuv6qkgmJmnwQC5US+QGqKGPRHTdidk cgoqDDbI2kCyOKhRY7eQN4u9prgaqCBHjokC2s18PobKyIUfuJ56fdweUfLt6zsS6Y8o 3PPnLibm3gv5+yVZeqyY1aouU5EQky9jyMAIrKpzP/j8iXsSQSmBB16PkN1yYL5uBgkv SGn5lA6/cZ8iAQ9P8HrosaRlK0PV6vyUxjw8Z3FxKi83exehs9d1rJumoVipKIdBKHcE B7uQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=106LcaQV+09ecmysXH/0CQoQX/LNoX+Zp7PgkkWnBf0=; b=ogu8R9orcrTeeYS8sVc+XQ8w583/vum6MIcMlbHl/7Mrj4Urx80lfgGjexbQarI7hI KvOGEd1ykzyTDFVRxH4ZYn6Frvu3fAsZOuHxumTwwALNwWNyw1YDdwGJkZMJKWvJmTko ivNynEWflIZ3dy4PfxBiOMgiLeQk4pZrelS47pLbZfIk3x3aVXw5FBaTVOXvTVREbBGA 2Nk/o513+u635oXLFe6jM6L/0OE5knzU1t0bg8PEMw36QG+up90XyhFm2SNvAW/S2WYs la8jGXtTzW3s58EmKgoP9Ug5b9zI5bahzn84BYbZ2sW7o6rWw1TULuSlw/CNud41YdZC C11A== X-Gm-Message-State: AOAM532LuOw0tgAa9+gBanroEH7xHVzge8qVLsTijrNc6HqJxgu9Uktt fJWyfLo0pvIpZLMpEyGR8VdF+p64Sl4= X-Google-Smtp-Source: ABdhPJwLhpYpDTzgmyoQFkkUVCeBMOUYYRmrv44L1IhQo5+96/pL5IgqjHWnxrxb05jpU52vdv8haw== X-Received: by 2002:a05:622a:30b:: with SMTP id q11mr3618943qtw.235.1639765165937; Fri, 17 Dec 2021 10:19:25 -0800 (PST) Received: from localhost.localdomain (c-73-200-157-122.hsd1.md.comcast.net. [73.200.157.122]) by smtp.gmail.com with ESMTPSA id o17sm7468094qtv.30.2021.12.17.10.19.25 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 17 Dec 2021 10:19:25 -0800 (PST) From: James Carter To: selinux@vger.kernel.org Cc: cgzones@googlemail.com, James Carter Subject: [PATCH 02/16] libsepol: Change label in check_assertion_avtab_match() Date: Fri, 17 Dec 2021 13:18:59 -0500 Message-Id: <20211217181913.336360-3-jwcart2@gmail.com> X-Mailer: git-send-email 2.31.1 In-Reply-To: <20211217181913.336360-1-jwcart2@gmail.com> References: <20211217181913.336360-1-jwcart2@gmail.com> MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: selinux@vger.kernel.org Change the label name from "exit" to "nomatch' to make it clearer what is happening. Signed-off-by: James Carter --- libsepol/src/assertion.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/libsepol/src/assertion.c b/libsepol/src/assertion.c index ba4a204f..d716450f 100644 --- a/libsepol/src/assertion.c +++ b/libsepol/src/assertion.c @@ -454,14 +454,14 @@ static int check_assertion_avtab_match(avtab_key_t *k, avtab_datum_t *d, void *a avtab_t *avtab = a->avtab; if ((k->specified & AVTAB_ALLOWED) == 0) - goto exit; + goto nomatch; if (!match_any_class_permissions(avrule->perms, k->target_class, d->data)) - goto exit; + goto nomatch; rc = ebitmap_match_any(&avrule->stypes.types, &p->attr_type_map[k->source_type - 1]); if (rc == 0) - goto exit; + goto nomatch; if (avrule->flags == RULE_SELF) { /* If the neverallow uses SELF, then it is not enough that the @@ -482,16 +482,16 @@ static int check_assertion_avtab_match(avtab_key_t *k, avtab_datum_t *d, void *a /* neverallow may have tgts even if it uses SELF */ rc = ebitmap_match_any(&avrule->ttypes.types, &p->attr_type_map[k->target_type -1]); if (rc == 0 && rc2 == 0) - goto exit; + goto nomatch; if (avrule->specified == AVRULE_XPERMS_NEVERALLOW) { rc = check_assertion_extended_permissions(avrule, avtab, k, p); if (rc == 0) - goto exit; + goto nomatch; } return 1; -exit: +nomatch: return 0; oom: From patchwork Fri Dec 17 18:19:00 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: James Carter X-Patchwork-Id: 12685441 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 42948C4332F for ; Fri, 17 Dec 2021 18:19:28 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230030AbhLQST1 (ORCPT ); Fri, 17 Dec 2021 13:19:27 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:41762 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234149AbhLQST1 (ORCPT ); Fri, 17 Dec 2021 13:19:27 -0500 Received: from mail-qv1-xf34.google.com (mail-qv1-xf34.google.com [IPv6:2607:f8b0:4864:20::f34]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 40498C06173E for ; Fri, 17 Dec 2021 10:19:27 -0800 (PST) Received: by mail-qv1-xf34.google.com with SMTP id kj6so3222614qvb.2 for ; Fri, 17 Dec 2021 10:19:27 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=x1f7Wd27K5moNxwApZyWDj3kwRyGoa6lCjO7N9A2Dlc=; b=l/Aq3sWrgk5lyHfa8cD7LmGhlNxXuMXHNTqa8mk32+rQrVmSESGrreho8i0vOns2Ct 7wp1bXXtWVpg8An2tNN1GPqqN6fz+mk2RC80Z/+ggeSpad7/DH/09VxT4STetQPPvDrH Zcunp+oV9+elkdnswsrMg+69UQAEkqTPJxGN1Bg+6K4hHSH/SyzeYTrM20yOsMNJ+HTb ncYJ+KDNY/u6bHJrhHjuP/C3elUkZTGkMyaGb1gRDQJ8Qp2vdaMI3Li3wqXpqwjZXX3d a7cHWHNllGm8SLNjGdhwOHWA8CNbNwG0n41a+kpcZ6HNFWWPxPMs3LxO8MNKzLHWMHg8 1EZQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=x1f7Wd27K5moNxwApZyWDj3kwRyGoa6lCjO7N9A2Dlc=; b=1GgsXIJhwO5M0a3RpWPAOMkOSDIesxVoqXqXTNjbLyj0od2MVIoexilaK50VscuJic Sunul9f39LWCgekkx5Th/uv+UUknzByd2oRocF1CgFmqEtON3SefUWPkUCulQINK1nl5 IMnj0vvjMbyS0f7fdjdhhdnPE/sTTb7l+FjZbOxboB8Hdq/JOyl2ibApByS+X/9++8mb rfhisRwy4HJ81le46i4MGLRKak1IMTpFCEWqpAVlA4qsel/IJ1ZaH05kL/QEWufG1xRv 1745g6tPekJ6qH5GdGhRbjhfc+jrZX3TpGxVfsnfpyOK7wWwo2x9tPp8yE+DPUhTo4+g 31ng== X-Gm-Message-State: AOAM532AXc5SE8GHQ+iuWvBqx8CS9cu5wu1RFcXOlYpxwE8pldxp9OJ9 cJLamX+wDOjV7sy7WnFIXlodnHooe1M= X-Google-Smtp-Source: ABdhPJxe3fBfIALCXKd6cbU8M5grhiBRHiWEBg9e4XpaPGpdaR4O5wy+9cptsZikYHI7iSAuSZqnyQ== X-Received: by 2002:a05:6214:76e:: with SMTP id f14mr2585187qvz.43.1639765166380; Fri, 17 Dec 2021 10:19:26 -0800 (PST) Received: from localhost.localdomain (c-73-200-157-122.hsd1.md.comcast.net. [73.200.157.122]) by smtp.gmail.com with ESMTPSA id o17sm7468094qtv.30.2021.12.17.10.19.26 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 17 Dec 2021 10:19:26 -0800 (PST) From: James Carter To: selinux@vger.kernel.org Cc: cgzones@googlemail.com, James Carter Subject: [PATCH 03/16] libsepol: Remove uneeded error messages in assertion checking Date: Fri, 17 Dec 2021 13:19:00 -0500 Message-Id: <20211217181913.336360-4-jwcart2@gmail.com> X-Mailer: git-send-email 2.31.1 In-Reply-To: <20211217181913.336360-1-jwcart2@gmail.com> References: <20211217181913.336360-1-jwcart2@gmail.com> MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: selinux@vger.kernel.org An out of memory condition is unlikely and the general message that an error occured while checking neverallows is sufficient. Signed-off-by: James Carter --- libsepol/src/assertion.c | 6 ------ 1 file changed, 6 deletions(-) diff --git a/libsepol/src/assertion.c b/libsepol/src/assertion.c index d716450f..832d3749 100644 --- a/libsepol/src/assertion.c +++ b/libsepol/src/assertion.c @@ -278,11 +278,8 @@ static int report_assertion_avtab_matches(avtab_key_t *k, avtab_datum_t *d, void } } } - goto exit; oom: - ERR(NULL, "Out of memory - unable to check neverallows"); - exit: ebitmap_destroy(&src_matches); ebitmap_destroy(&tgt_matches); @@ -436,8 +433,6 @@ static int check_assertion_extended_permissions(avrule_t *avrule, avtab_t *avtab goto exit; oom: - ERR(NULL, "Out of memory - unable to check neverallows"); - exit: ebitmap_destroy(&src_matches); ebitmap_destroy(&tgt_matches); @@ -495,7 +490,6 @@ nomatch: return 0; oom: - ERR(NULL, "Out of memory - unable to check neverallows"); return rc; } From patchwork Fri Dec 17 18:19:01 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: James Carter X-Patchwork-Id: 12685445 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id B880EC43217 for ; Fri, 17 Dec 2021 18:19:28 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234205AbhLQST2 (ORCPT ); Fri, 17 Dec 2021 13:19:28 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:41770 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234181AbhLQST2 (ORCPT ); Fri, 17 Dec 2021 13:19:28 -0500 Received: from mail-qk1-x735.google.com (mail-qk1-x735.google.com [IPv6:2607:f8b0:4864:20::735]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id D751AC061574 for ; Fri, 17 Dec 2021 10:19:27 -0800 (PST) Received: by mail-qk1-x735.google.com with SMTP id l25so2981877qkl.5 for ; Fri, 17 Dec 2021 10:19:27 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=jPkVQCcebJo7Yq9WhSxtz3V4v3wlvtz3YCm1gFtNgv4=; b=PRUoqmKQMviSSmLAJX6blUR4Bz5gnd1/S3+FIudpcaug2BpQzJ6n0reGrdZZ/dSYBn HBILX/h9RmFOkMy88FryOZP1Ar8JEIx9DIMRjI8WYDn01DKGz6/je5+OQb88Otl7XOzn Pow0CP2fqSviFSNQwuXWb/H5GW5wGzZv1UoSkle81ec2WHdczzXij29Jv5BfEzgmfs6s vPHj4wrxHqT5W7Wp/c2F2TU8vd1sEEUgyqMwuGXFk/M4+RLuwkHkXJyOglpoysLaQ5tQ CIf06Ru5xwYraaAns76BifFZZj6g7t/Mq7z2pXvwuviiufqLEynYAihHnNnyzOoqZxFU oITQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=jPkVQCcebJo7Yq9WhSxtz3V4v3wlvtz3YCm1gFtNgv4=; b=o5o1kpUGTw4sVt//i76SzIvt2FQxyUU4eaGd+pFGPLXSXk2vzpAfI1Lj3nxOELJK79 jNKvGCDFHyaVinpiZOpSXAn9YeNA97HSP0x8HHrUZGcXxuz/YVrj3PdWF/AhFQAKJTde STwPQ/VI8oVdJ8ldXyjtoMDEeowZoINtxQPBJmkMoDTxQiGF5kcyoPfRrgNsCR7etuqF 0jodTij1FLCBOcqjOTLSanGKGofYOT6xDdhhmHVTqQWViV6o0Z6L4mgAAMjWpBijtubW pg3zb5kIEtbSDm6smt7Vh08RhakXyh4yQGW7bGs0l6vu0beicaD9C9NyHNCPHVa30QmT f7Yw== X-Gm-Message-State: AOAM5300yHxNxVxVcEMUtyB3IEvpscJhDouglyN8qO1IaO/7u+urq+0Z x9ef4DmDc1MJQ/hu3KVOw/RWBCUrZhQ= X-Google-Smtp-Source: ABdhPJxeGXnNvLzGapOc2b9X/g6kMl+gkt3tbtY7kW3kPsu260sd5/JWVQLUnDbFc7iQivEHpy4RpA== X-Received: by 2002:a05:620a:d87:: with SMTP id q7mr2587200qkl.377.1639765166937; Fri, 17 Dec 2021 10:19:26 -0800 (PST) Received: from localhost.localdomain (c-73-200-157-122.hsd1.md.comcast.net. [73.200.157.122]) by smtp.gmail.com with ESMTPSA id o17sm7468094qtv.30.2021.12.17.10.19.26 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 17 Dec 2021 10:19:26 -0800 (PST) From: James Carter To: selinux@vger.kernel.org Cc: cgzones@googlemail.com, James Carter Subject: [PATCH 04/16] libsepol: Check for error from check_assertion_extended_permissions() Date: Fri, 17 Dec 2021 13:19:01 -0500 Message-Id: <20211217181913.336360-5-jwcart2@gmail.com> X-Mailer: git-send-email 2.31.1 In-Reply-To: <20211217181913.336360-1-jwcart2@gmail.com> References: <20211217181913.336360-1-jwcart2@gmail.com> MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: selinux@vger.kernel.org Return an error if check_assertion_extended_permissions() returns an error instead of treating it as an assertion violation. Signed-off-by: James Carter --- libsepol/src/assertion.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/libsepol/src/assertion.c b/libsepol/src/assertion.c index 832d3749..a2cbb74d 100644 --- a/libsepol/src/assertion.c +++ b/libsepol/src/assertion.c @@ -481,6 +481,8 @@ static int check_assertion_avtab_match(avtab_key_t *k, avtab_datum_t *d, void *a if (avrule->specified == AVRULE_XPERMS_NEVERALLOW) { rc = check_assertion_extended_permissions(avrule, avtab, k, p); + if (rc < 0) + goto oom; if (rc == 0) goto nomatch; } From patchwork Fri Dec 17 18:19:02 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: James Carter X-Patchwork-Id: 12685447 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id F194BC433EF for ; Fri, 17 Dec 2021 18:19:29 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S236422AbhLQST2 (ORCPT ); Fri, 17 Dec 2021 13:19:28 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:41772 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234181AbhLQST2 (ORCPT ); Fri, 17 Dec 2021 13:19:28 -0500 Received: from mail-qt1-x836.google.com (mail-qt1-x836.google.com [IPv6:2607:f8b0:4864:20::836]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 58BEEC061574 for ; Fri, 17 Dec 2021 10:19:28 -0800 (PST) Received: by mail-qt1-x836.google.com with SMTP id p19so3463979qtw.12 for ; Fri, 17 Dec 2021 10:19:28 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=75EcyTw5P2z4vDUA60U0TG9nAgtXhZm50zN9nmG3df8=; b=JtIr2ZY8feYldNg1XLz4GpoUQ6eP/zVl0Jq90SQ+8Ry3B01WsZO+FkriJ/ccRHeteN Pyfbv2OuvdKFQ9TUfUqnjNZisTC2A49aRCEQas0rkgk8kOQrUWPweGggOTxqTYWFJE0o Ja4Erluk5WuaDc+csADPvyeikZt++B7M2UiwQfdsBV9d54gfPQLvB3kPTFp9Hs9Y8EGA 4qaZzbt+giCHxb0yCoBDPNp9diCPb8qs5T8SCdHkkf1SP/EULwCLDn1xHD8xZC2TmUyx FGcHQgQNbG13xkkYidDIMx7UK+Erk8L9yXrzklHIqlE9gZg+zdmLn6dYE74WIUbRN13l o6OQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=75EcyTw5P2z4vDUA60U0TG9nAgtXhZm50zN9nmG3df8=; b=S8Ipf+Cni9n3NI0f8KJnV0E+wIvhUD6dEJ6uI3+xJH8eUniZ59M3ZqqUukWV6Tnexn P5MccbUXVrrIs45yaW2T3dDMxDnFvE7ABGTmnoVq2W6GtmwD3zbilVHkG+8+rntIkbgU C3siQJI9LBh1K1amzfvNBXVsnwcWOZelYEa4PAK8VLGXD29+o9wss0GY/SNPtOzHWYJk cIdiDo31FKy1JeeGYYm1GwqJhD07X2kkQsat/sLIHHPWqfqVBQUll9Quj5uC//AVlSwF JJknFs8/3mPdASp/M79Q29pwk98slgvBX/CFTAYA6zJKluYCJW7otqBbbOG8jNqVL+X4 MopA== X-Gm-Message-State: AOAM533P5d6OkJmpgTPKpt2EYKHJcuQf+zcRa3Wlr0nOC3STnzBUM33F QIx4vcbPN8RnUmUiR6oM7j6oAteDB6g= X-Google-Smtp-Source: ABdhPJxQHwyR/+JelpceOhIpylWCnFPmoG5tjq+aXQf+EuzSbLQNa4J2ym0xoMkgVDCZTaBRdA42lg== X-Received: by 2002:ac8:4459:: with SMTP id m25mr3421806qtn.659.1639765167486; Fri, 17 Dec 2021 10:19:27 -0800 (PST) Received: from localhost.localdomain (c-73-200-157-122.hsd1.md.comcast.net. [73.200.157.122]) by smtp.gmail.com with ESMTPSA id o17sm7468094qtv.30.2021.12.17.10.19.27 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 17 Dec 2021 10:19:27 -0800 (PST) From: James Carter To: selinux@vger.kernel.org Cc: cgzones@googlemail.com, James Carter Subject: [PATCH 05/16] libsepol: Use consistent return checking style Date: Fri, 17 Dec 2021 13:19:02 -0500 Message-Id: <20211217181913.336360-6-jwcart2@gmail.com> X-Mailer: git-send-email 2.31.1 In-Reply-To: <20211217181913.336360-1-jwcart2@gmail.com> References: <20211217181913.336360-1-jwcart2@gmail.com> MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: selinux@vger.kernel.org In check_assertion_avtab_match(), for the functions that do not return an error, but only returns 0 or 1 depending on if a match is found, call the function in an if statement. Signed-off-by: James Carter --- libsepol/src/assertion.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/libsepol/src/assertion.c b/libsepol/src/assertion.c index a2cbb74d..bd0dc4ed 100644 --- a/libsepol/src/assertion.c +++ b/libsepol/src/assertion.c @@ -454,8 +454,7 @@ static int check_assertion_avtab_match(avtab_key_t *k, avtab_datum_t *d, void *a if (!match_any_class_permissions(avrule->perms, k->target_class, d->data)) goto nomatch; - rc = ebitmap_match_any(&avrule->stypes.types, &p->attr_type_map[k->source_type - 1]); - if (rc == 0) + if (!ebitmap_match_any(&avrule->stypes.types, &p->attr_type_map[k->source_type - 1])) goto nomatch; if (avrule->flags == RULE_SELF) { @@ -475,9 +474,10 @@ static int check_assertion_avtab_match(avtab_key_t *k, avtab_datum_t *d, void *a } /* neverallow may have tgts even if it uses SELF */ - rc = ebitmap_match_any(&avrule->ttypes.types, &p->attr_type_map[k->target_type -1]); - if (rc == 0 && rc2 == 0) - goto nomatch; + if (!ebitmap_match_any(&avrule->ttypes.types, &p->attr_type_map[k->target_type -1])) { + if (rc2 == 0) + goto nomatch; + } if (avrule->specified == AVRULE_XPERMS_NEVERALLOW) { rc = check_assertion_extended_permissions(avrule, avtab, k, p); From patchwork Fri Dec 17 18:19:03 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: James Carter X-Patchwork-Id: 12685449 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id E5CCAC433F5 for ; Fri, 17 Dec 2021 18:19:30 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S232592AbhLQSTa (ORCPT ); Fri, 17 Dec 2021 13:19:30 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:41776 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S236570AbhLQST3 (ORCPT ); Fri, 17 Dec 2021 13:19:29 -0500 Received: from mail-qt1-x82e.google.com (mail-qt1-x82e.google.com [IPv6:2607:f8b0:4864:20::82e]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 3429CC061574 for ; Fri, 17 Dec 2021 10:19:29 -0800 (PST) Received: by mail-qt1-x82e.google.com with SMTP id o17so3536898qtk.1 for ; Fri, 17 Dec 2021 10:19:29 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=dJSIYiK1iYgbVswXsUOfqMg9hjOoN19kqBrH9ke4030=; b=oOWEEiFZM8hPHf73tT62FNMVfSTF2ynyLRvlmMiqIaw8ObaZBgeRu2VA9633CUMn5C NsXPfzIRmtf5J6bCHsaZCOy94V3sLxHFlraXhlv9mK4nyleGitoyV0wVJR807D1Vuedj DEq/vVxeb3fMyncJaBRVvragji5BT960mdverUdfNLkAFP8CavHgKYuGr8b7QLmf0BVZ v6/0bC6M5eWU0JcKXje50xR9HSsIin/eIvGVbrubCpeRTqjTYM5OvQZqcb70z9dw2D8x Vxw3JH41j3rtPnYoCaYbGvzx4wJnsT+5ZVSjGcQSSO97SeG9/j+CM05nFAfKIPxXEs6L LEtQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=dJSIYiK1iYgbVswXsUOfqMg9hjOoN19kqBrH9ke4030=; b=G3Sa7gLpPnUxGyoiJgvrJ8LOkAsoAwyhwfhw6OErr2tPZFdO+PhehUtJSklB+xkGIC hY/MJ1QHD1U1Rty8eoC9zz839GDsx22N1YzsAwg7EOOtWgpm/fnGjvQWqfazoV04tagz V/oTUxEn8dcYQlt0dxU5/Lr3cwxwzhIkl6e7ePMeN7h/EDL5bpyNb3Iqx3Q68e9BTQph GOTpc4mpXLFswb/ATdN2DFXA4pvCjSEG5v6L7cLUTIFjgt7d6p0bQAu3lIPiHHzS7JW5 A/LfWommuJ7hDRv1MC+gtZK5gJuAHFXrHjKVBAggo86TEJAn3tdJVpqJ+vfsb+PopWLw 7jJQ== X-Gm-Message-State: AOAM532eiKIhEhma+ftXvkLOsDepVlON1ItgOsU9mPEv6fOKGHZmf5MX lD8bKv21IE8v7Tdw9aco1bbXlOFcqnQ= X-Google-Smtp-Source: ABdhPJzkfAiP5+72QdWH3kw5rX3FwXDswc6ZKX5+KqoDn81BVUZu522oDZYUj7bbDWnkmxfUskxO7Q== X-Received: by 2002:ac8:4e8a:: with SMTP id 10mr3555644qtp.578.1639765168282; Fri, 17 Dec 2021 10:19:28 -0800 (PST) Received: from localhost.localdomain (c-73-200-157-122.hsd1.md.comcast.net. [73.200.157.122]) by smtp.gmail.com with ESMTPSA id o17sm7468094qtv.30.2021.12.17.10.19.27 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 17 Dec 2021 10:19:27 -0800 (PST) From: James Carter To: selinux@vger.kernel.org Cc: cgzones@googlemail.com, James Carter Subject: [PATCH 06/16] libsepol: Move check of target types to before check for self Date: Fri, 17 Dec 2021 13:19:03 -0500 Message-Id: <20211217181913.336360-7-jwcart2@gmail.com> X-Mailer: git-send-email 2.31.1 In-Reply-To: <20211217181913.336360-1-jwcart2@gmail.com> References: <20211217181913.336360-1-jwcart2@gmail.com> MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: selinux@vger.kernel.org If a neverallow has target types as well as using self and a match is found with the target types, then self does not even need to be checked, since the rule is already in violation of the assertion. So move the check for a match of the target types before dealing with self. Signed-off-by: James Carter --- libsepol/src/assertion.c | 36 +++++++++++++++++++----------------- 1 file changed, 19 insertions(+), 17 deletions(-) diff --git a/libsepol/src/assertion.c b/libsepol/src/assertion.c index bd0dc4ed..7a1c4a5e 100644 --- a/libsepol/src/assertion.c +++ b/libsepol/src/assertion.c @@ -457,26 +457,28 @@ static int check_assertion_avtab_match(avtab_key_t *k, avtab_datum_t *d, void *a if (!ebitmap_match_any(&avrule->stypes.types, &p->attr_type_map[k->source_type - 1])) goto nomatch; - if (avrule->flags == RULE_SELF) { - /* If the neverallow uses SELF, then it is not enough that the - * neverallow's source matches the src and tgt of the rule being checked. - * It must match the same thing in the src and tgt, so AND the source - * and target together and check for a match on the result. - */ - ebitmap_t match; - rc = ebitmap_and(&match, &p->attr_type_map[k->source_type - 1], &p->attr_type_map[k->target_type - 1] ); - if (rc) { - ebitmap_destroy(&match); - goto oom; - } - rc2 = ebitmap_match_any(&avrule->stypes.types, &match); - ebitmap_destroy(&match); - } - /* neverallow may have tgts even if it uses SELF */ if (!ebitmap_match_any(&avrule->ttypes.types, &p->attr_type_map[k->target_type -1])) { - if (rc2 == 0) + if (avrule->flags == RULE_SELF) { + /* If the neverallow uses SELF, then it is not enough that the + * neverallow's source matches the src and tgt of the rule being checked. + * It must match the same thing in the src and tgt, so AND the source + * and target together and check for a match on the result. + */ + ebitmap_t match; + rc = ebitmap_and(&match, &p->attr_type_map[k->source_type - 1], &p->attr_type_map[k->target_type - 1] ); + if (rc) { + ebitmap_destroy(&match); + goto oom; + } + if (!ebitmap_match_any(&avrule->stypes.types, &match)) { + ebitmap_destroy(&match); + goto nomatch; + } + ebitmap_destroy(&match); + } else { goto nomatch; + } } if (avrule->specified == AVRULE_XPERMS_NEVERALLOW) { From patchwork Fri Dec 17 18:19:04 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: James Carter X-Patchwork-Id: 12685451 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 594FFC433FE for ; Fri, 17 Dec 2021 18:19:31 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S236547AbhLQSTa (ORCPT ); Fri, 17 Dec 2021 13:19:30 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:41784 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234181AbhLQST3 (ORCPT ); Fri, 17 Dec 2021 13:19:29 -0500 Received: from mail-qt1-x836.google.com (mail-qt1-x836.google.com [IPv6:2607:f8b0:4864:20::836]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id A998EC06173E for ; Fri, 17 Dec 2021 10:19:29 -0800 (PST) Received: by mail-qt1-x836.google.com with SMTP id t34so3504256qtc.7 for ; Fri, 17 Dec 2021 10:19:29 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=Xhupr/TCQsKOcfDPSB2ZK4KZ1yUWAoE4llznwi/sTCo=; b=XMnVe4zULPd3A+ziptWuk5Hz+CJpW/H9NLRT3Zm9rKVUaym76r66PD14R4aMc9vObK KGkb6/2trNMQoA61Ncb6jzqRmP2tPhiVU88tghRFe23pOjoDn9cPRsy4ZoJnn4s7UvO/ TOqfF9AB5aG5APEFbI5Ljr+O/9OqwtMXH1wwgGgj+jUWv/CQy2iTEwpVYNGmJFAsG71V nN9pYpfZNyf//zPJ1hPFlg/pB52zQhU9VXkTe2glgQvCHUwtG9nXhhbAlULzVvi9IGhE EGq1zSzc7UeAd+sk+1SzEYXjKqwozWjO4L8hSwZVlx+qPn7b8uV99155ame3B/H8xyGe ViBg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=Xhupr/TCQsKOcfDPSB2ZK4KZ1yUWAoE4llznwi/sTCo=; b=1Q+Z/e8Z9io5g2qvp0BFbhpPsK4yau/dGHtrTx19xjOd7dpPpnMS8oQZz7twz+epSe vJ35fNteiZ0LuzM9Z5QsetUS0HQ4NnhlwStD+QvSkY9oKXmA7Mq1nkPXm7DdzFDF1tCG PEFVnxwQO3doW/+xnjqJ+cxHBNfpDhAJRY4Kf7pI+AEheC85mj0sTFUwYcdBT85xPN52 K8IybBgpocMOoWCNALbz8Gohtfs/50ne7YrY7XAlo/xNo7UEOP994QgKJPPp+y3HOkY0 d/tNcWdTy51oi2HCH/oEeqWpwbJsUIVBtWB1blyqF0pqS970X+5r/EB51P3lnTxribrL snWA== X-Gm-Message-State: AOAM532uuMxE/0baiEVgtA/BwLlk2vSuPREtJWUxZwQFGexlCbp+xlKN ypGcghLZFy6H/YaFgGK/C0QDkRUHYJQ= X-Google-Smtp-Source: ABdhPJzj+ECLIuZcCDIAQOpGDQ9fL+YTDrncX0sPsjtgRhxCuVO73cFKvlXiiDjk0VvQbS7HzsBohQ== X-Received: by 2002:a05:622a:120e:: with SMTP id y14mr3513847qtx.671.1639765168775; Fri, 17 Dec 2021 10:19:28 -0800 (PST) Received: from localhost.localdomain (c-73-200-157-122.hsd1.md.comcast.net. [73.200.157.122]) by smtp.gmail.com with ESMTPSA id o17sm7468094qtv.30.2021.12.17.10.19.28 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 17 Dec 2021 10:19:28 -0800 (PST) From: James Carter To: selinux@vger.kernel.org Cc: cgzones@googlemail.com, James Carter Subject: [PATCH 07/16] libsepol: Create function check_assertion_self_match() and use it Date: Fri, 17 Dec 2021 13:19:04 -0500 Message-Id: <20211217181913.336360-8-jwcart2@gmail.com> X-Mailer: git-send-email 2.31.1 In-Reply-To: <20211217181913.336360-1-jwcart2@gmail.com> References: <20211217181913.336360-1-jwcart2@gmail.com> MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: selinux@vger.kernel.org Create the function called check_assertion_self_match() and put the self checking code into it. Signed-off-by: James Carter --- libsepol/src/assertion.c | 45 ++++++++++++++++++++++++++-------------- 1 file changed, 30 insertions(+), 15 deletions(-) diff --git a/libsepol/src/assertion.c b/libsepol/src/assertion.c index 7a1c4a5e..1b13b232 100644 --- a/libsepol/src/assertion.c +++ b/libsepol/src/assertion.c @@ -440,9 +440,35 @@ exit: return ret; } +static int check_assertion_self_match(avtab_key_t *k, avrule_t *avrule, policydb_t *p) +{ + ebitmap_t src_matches; + int rc; + + /* The key's target must match something in the matches of the avrule's source + * and the key's source. + */ + + rc = ebitmap_and(&src_matches, &avrule->stypes.types, &p->attr_type_map[k->source_type - 1]); + if (rc < 0) + goto oom; + + if (!ebitmap_match_any(&src_matches, &p->attr_type_map[k->source_type - 1])) { + rc = 0; + goto nomatch; + } + + rc = 1; + +oom: +nomatch: + ebitmap_destroy(&src_matches); + return rc; +} + static int check_assertion_avtab_match(avtab_key_t *k, avtab_datum_t *d, void *args) { - int rc, rc2 = 0; + int rc; struct avtab_match_args *a = (struct avtab_match_args *)args; policydb_t *p = a->p; avrule_t *avrule = a->avrule; @@ -460,22 +486,11 @@ static int check_assertion_avtab_match(avtab_key_t *k, avtab_datum_t *d, void *a /* neverallow may have tgts even if it uses SELF */ if (!ebitmap_match_any(&avrule->ttypes.types, &p->attr_type_map[k->target_type -1])) { if (avrule->flags == RULE_SELF) { - /* If the neverallow uses SELF, then it is not enough that the - * neverallow's source matches the src and tgt of the rule being checked. - * It must match the same thing in the src and tgt, so AND the source - * and target together and check for a match on the result. - */ - ebitmap_t match; - rc = ebitmap_and(&match, &p->attr_type_map[k->source_type - 1], &p->attr_type_map[k->target_type - 1] ); - if (rc) { - ebitmap_destroy(&match); + rc = check_assertion_self_match(k, avrule, p); + if (rc < 0) goto oom; - } - if (!ebitmap_match_any(&avrule->stypes.types, &match)) { - ebitmap_destroy(&match); + if (rc == 0) goto nomatch; - } - ebitmap_destroy(&match); } else { goto nomatch; } From patchwork Fri Dec 17 18:19:05 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: James Carter X-Patchwork-Id: 12685469 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 93B65C4332F for ; Fri, 17 Dec 2021 18:19:36 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S239981AbhLQSTg (ORCPT ); Fri, 17 Dec 2021 13:19:36 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:41816 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S236660AbhLQSTf (ORCPT ); Fri, 17 Dec 2021 13:19:35 -0500 Received: from mail-qv1-xf2a.google.com (mail-qv1-xf2a.google.com [IPv6:2607:f8b0:4864:20::f2a]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 47A92C061574 for ; Fri, 17 Dec 2021 10:19:35 -0800 (PST) Received: by mail-qv1-xf2a.google.com with SMTP id o10so3199590qvc.5 for ; Fri, 17 Dec 2021 10:19:35 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=HUihKd1ZsQaAR0C1IGh3+vZfEx/FMUbtfZTO0dEhv44=; b=GJJc9gjukaYy2dkvTwhwab/gQI/dkWC/PPaPxN0iV688ItMQx7/LlwLorBDWAxSMB6 eHa7kLu+RMlTKr4k0C+lqjsbAFh7KHd43cuTalKibFxPZk8DEnunt5RyCCGSVygMdgr8 jua7VwKEMfPvjj2aB/8JYQZrXBntGWYCk/dmqOXGrpHYptl1GkOtTiZaPsOQ3ZPz89iI sUhxUeV7L+E5cEhaTlEHsH+nj0lkxzrxCGaYlCADDHWpDrw/UyPOA71i7u65q5VlqJS1 D/0P/eZMGSqTSdSX3TkXhyzqlgs0rqvyxvAPH3+D795uzwZUfDaQywAU4IyDoSYUOr1p byQw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=HUihKd1ZsQaAR0C1IGh3+vZfEx/FMUbtfZTO0dEhv44=; b=c4s/TmMOvKmV6AQkLTyg/YM1qQ+E+ZFy88FkG5pqziOyGiFTI9HBkhlpy19Pgwu3Ek d3rGNovQicBNo7wRKmjaBUJw152NfFg4B0D2ZdkhGhnLHy0szbSwtAoXI0DcNf+jXtgK tEzbu0WcNqb7ayHwKkYnoPprkLnKmGoF3YP8RdOna9Vm7m0IKhQgcjR0jPnPtuo7wXKP bvuIWTF9q4L13EOm1E8Uk97oBcwoPsoPkV14mQU3vL4NMkIHE4qHO8fDoDtGGWa7+RoQ sC2FWHiLWGuJ1fGanAzqwb4bzin+1GFCvbTV5dcyT0TBQBSODjAz83LCy/l3SAR/CFVe WwoQ== X-Gm-Message-State: AOAM533sBKMjMwWvmK/e6N09Ke4CCuZZvZVfDT0ZrwZfqERo34OjsZHs 8tqPGKZnW9YKtrE6i33nd587nxtBWos= X-Google-Smtp-Source: ABdhPJxXnrjuVQNgwq2moVcL4Hgrn4Xw1+lsBd1+ZfheOlmy7J7DP9seDylt4BdIBI36Fy3gZqs9uA== X-Received: by 2002:a05:6214:d08:: with SMTP id 8mr3525591qvh.46.1639765169398; Fri, 17 Dec 2021 10:19:29 -0800 (PST) Received: from localhost.localdomain (c-73-200-157-122.hsd1.md.comcast.net. [73.200.157.122]) by smtp.gmail.com with ESMTPSA id o17sm7468094qtv.30.2021.12.17.10.19.28 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 17 Dec 2021 10:19:29 -0800 (PST) From: James Carter To: selinux@vger.kernel.org Cc: cgzones@googlemail.com, James Carter Subject: [PATCH 08/16] libsepol: Use (rc < 0) instead of (rc) when calling ebitmap functions Date: Fri, 17 Dec 2021 13:19:05 -0500 Message-Id: <20211217181913.336360-9-jwcart2@gmail.com> X-Mailer: git-send-email 2.31.1 In-Reply-To: <20211217181913.336360-1-jwcart2@gmail.com> References: <20211217181913.336360-1-jwcart2@gmail.com> MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: selinux@vger.kernel.org Inorder to differentiate errors from matches, use "(rc < 0)" when calling ebitmap_* functions while checking neverallow rules. Also, just use rc instead of having a separate variable (ret) in check_assertion_extended_permissions(). Signed-off-by: James Carter --- libsepol/src/assertion.c | 44 ++++++++++++++++++++++------------------ 1 file changed, 24 insertions(+), 20 deletions(-) diff --git a/libsepol/src/assertion.c b/libsepol/src/assertion.c index 1b13b232..cf10e41d 100644 --- a/libsepol/src/assertion.c +++ b/libsepol/src/assertion.c @@ -231,27 +231,27 @@ static int report_assertion_avtab_matches(avtab_key_t *k, avtab_datum_t *d, void rc = ebitmap_and(&src_matches, &avrule->stypes.types, &p->attr_type_map[k->source_type - 1]); - if (rc) + if (rc < 0) goto oom; if (ebitmap_is_empty(&src_matches)) goto exit; rc = ebitmap_and(&tgt_matches, &avrule->ttypes.types, &p->attr_type_map[k->target_type -1]); - if (rc) + if (rc < 0) goto oom; if (avrule->flags == RULE_SELF) { rc = ebitmap_and(&matches, &p->attr_type_map[k->source_type - 1], &p->attr_type_map[k->target_type - 1]); - if (rc) + if (rc < 0) goto oom; rc = ebitmap_and(&self_matches, &avrule->stypes.types, &matches); - if (rc) + if (rc < 0) goto oom; if (!ebitmap_is_empty(&self_matches)) { rc = ebitmap_union(&tgt_matches, &self_matches); - if (rc) + if (rc < 0) goto oom; } } @@ -299,11 +299,11 @@ static int report_assertion_failures(sepol_handle_t *handle, policydb_t *p, avru args.errors = 0; rc = avtab_map(&p->te_avtab, report_assertion_avtab_matches, &args); - if (rc) + if (rc < 0) goto oom; rc = avtab_map(&p->te_cond_avtab, report_assertion_avtab_matches, &args); - if (rc) + if (rc < 0) goto oom; return args.errors; @@ -379,7 +379,6 @@ static int check_assertion_extended_permissions(avrule_t *avrule, avtab_t *avtab ebitmap_node_t *snode, *tnode; class_perm_node_t *cp; int rc; - int ret = 1; ebitmap_init(&src_matches); ebitmap_init(&tgt_matches); @@ -388,56 +387,61 @@ static int check_assertion_extended_permissions(avrule_t *avrule, avtab_t *avtab rc = ebitmap_and(&src_matches, &avrule->stypes.types, &p->attr_type_map[k->source_type - 1]); - if (rc) + if (rc < 0) goto oom; - if (ebitmap_is_empty(&src_matches)) + if (ebitmap_is_empty(&src_matches)) { + rc = 0; goto exit; + } rc = ebitmap_and(&tgt_matches, &avrule->ttypes.types, &p->attr_type_map[k->target_type -1]); - if (rc) + if (rc < 0) goto oom; if (avrule->flags == RULE_SELF) { rc = ebitmap_and(&matches, &p->attr_type_map[k->source_type - 1], &p->attr_type_map[k->target_type - 1]); - if (rc) + if (rc < 0) goto oom; rc = ebitmap_and(&self_matches, &avrule->stypes.types, &matches); - if (rc) + if (rc < 0) goto oom; if (!ebitmap_is_empty(&self_matches)) { rc = ebitmap_union(&tgt_matches, &self_matches); - if (rc) + if (rc < 0) goto oom; } } - if (ebitmap_is_empty(&tgt_matches)) + if (ebitmap_is_empty(&tgt_matches)) { + rc = 0; goto exit; + } for (cp = avrule->perms; cp; cp = cp->next) { if (cp->tclass != k->target_class) continue; ebitmap_for_each_positive_bit(&src_matches, snode, i) { ebitmap_for_each_positive_bit(&tgt_matches, tnode, j) { - ret = check_assertion_extended_permissions_avtab( - avrule, avtab, i, j, k, p); - if (ret) + if (check_assertion_extended_permissions_avtab(avrule, avtab, i, j, k, p)) { + rc = 1; goto exit; + } } } } - goto exit; + + rc = 0; oom: exit: ebitmap_destroy(&src_matches); ebitmap_destroy(&tgt_matches); ebitmap_destroy(&matches); - return ret; + return rc; } static int check_assertion_self_match(avtab_key_t *k, avrule_t *avrule, policydb_t *p) From patchwork Fri Dec 17 18:19:06 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: James Carter X-Patchwork-Id: 12685453 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id A7256C433EF for ; Fri, 17 Dec 2021 18:19:32 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S236662AbhLQSTb (ORCPT ); Fri, 17 Dec 2021 13:19:31 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:41786 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234181AbhLQSTb (ORCPT ); Fri, 17 Dec 2021 13:19:31 -0500 Received: from mail-qt1-x82d.google.com (mail-qt1-x82d.google.com [IPv6:2607:f8b0:4864:20::82d]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id B9FF9C061574 for ; Fri, 17 Dec 2021 10:19:30 -0800 (PST) Received: by mail-qt1-x82d.google.com with SMTP id z9so3486305qtj.9 for ; Fri, 17 Dec 2021 10:19:30 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=CpNG+8vcUjTjEvJKJLgCUrfT5YbXg7xDonKfrSoLuY0=; b=NBfcMNYxHPMsamyGsnedxv10v8Ix4uKSAh+ln8/CqNqgTaurkZJBuPKbf/4Hx6TKob akBGoFZqTFuFxRHr4p3Xl54h8YOSaNvFFRqCA3MxOijPVPgNTeSyRK3fZCF7KPjrOC0M 91BEP5DKKvpmPX599s+YTTGXhPEghsbqtXt6rghwuhdjOY3hCKCvm8lir0ijAg24Ym+M 2V2oOTi3JEFfFtOrghcdQmCwgDCVFvkMS+hTSYAdESbPLHhY7wggpBqd9fEFpc8d9g5l zgJafNZ7c/8rQGGUfH8pjaIcfO46Foynj0Q3ye7gZXwXmFyWTI5cA1HbO1dP+QNmnP8v gubw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=CpNG+8vcUjTjEvJKJLgCUrfT5YbXg7xDonKfrSoLuY0=; b=Y6MYkiaPz/QDZdkqljjyKHq2q5ggSZ3bEogFuZXIcPGo+HQB9vZl9MJH9+d0lk5Kyu a2TcAys9TkyyGqQUaccMEce6KrxzGqL5sbUUR794lQcwVLupxKL0bxF99blVj1XYntd7 XPhMTjhXQr1cLx37xhhfyCPdN7Pl9j2MB2t1aeYSqchltlDbXPw3cWIGAcG9vVMuAb9p 4q6G56blKu2iKi2QwYY3voT5YzdEjoPO+LAiuyhD3xX8+75OVfLctgE5Q8VMIA5r2TTh TG2NLop0T+w2TOI0Vv31DrdxPuLBKCGJEPzqWdFOcWdhrvHS4eQf34WaXqt9CZF9daaX pJaA== X-Gm-Message-State: AOAM533bzybd4qTptDstuajJjS2QtdChSM59+Ddfpk1jIT+VHRqkc6QG lAV+Me/bURrGD1EZqcITurk8qQHt+/I= X-Google-Smtp-Source: ABdhPJz5YWK8fgwo+7fOf/zlPSe0DGGwd2FpHhBN07Lfw+WZ5u0ytrzN0XtDdwe/Nclrr9ur5MPo0w== X-Received: by 2002:ac8:7d8a:: with SMTP id c10mr3577712qtd.415.1639765169866; Fri, 17 Dec 2021 10:19:29 -0800 (PST) Received: from localhost.localdomain (c-73-200-157-122.hsd1.md.comcast.net. [73.200.157.122]) by smtp.gmail.com with ESMTPSA id o17sm7468094qtv.30.2021.12.17.10.19.29 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 17 Dec 2021 10:19:29 -0800 (PST) From: James Carter To: selinux@vger.kernel.org Cc: cgzones@googlemail.com, James Carter Subject: [PATCH 09/16] libsepol: Remove unnessesary check for matching class Date: Fri, 17 Dec 2021 13:19:06 -0500 Message-Id: <20211217181913.336360-10-jwcart2@gmail.com> X-Mailer: git-send-email 2.31.1 In-Reply-To: <20211217181913.336360-1-jwcart2@gmail.com> References: <20211217181913.336360-1-jwcart2@gmail.com> MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: selinux@vger.kernel.org When check_assertion_extended_permissions() is called, it has already been determined that there is a match, and, since neither the class nor the permissions are used, there is no need for the check. Signed-off-by: James Carter --- libsepol/src/assertion.c | 15 +++++---------- 1 file changed, 5 insertions(+), 10 deletions(-) diff --git a/libsepol/src/assertion.c b/libsepol/src/assertion.c index cf10e41d..7aaaf303 100644 --- a/libsepol/src/assertion.c +++ b/libsepol/src/assertion.c @@ -377,7 +377,6 @@ static int check_assertion_extended_permissions(avrule_t *avrule, avtab_t *avtab ebitmap_t src_matches, tgt_matches, self_matches, matches; unsigned int i, j; ebitmap_node_t *snode, *tnode; - class_perm_node_t *cp; int rc; ebitmap_init(&src_matches); @@ -421,15 +420,11 @@ static int check_assertion_extended_permissions(avrule_t *avrule, avtab_t *avtab goto exit; } - for (cp = avrule->perms; cp; cp = cp->next) { - if (cp->tclass != k->target_class) - continue; - ebitmap_for_each_positive_bit(&src_matches, snode, i) { - ebitmap_for_each_positive_bit(&tgt_matches, tnode, j) { - if (check_assertion_extended_permissions_avtab(avrule, avtab, i, j, k, p)) { - rc = 1; - goto exit; - } + ebitmap_for_each_positive_bit(&src_matches, snode, i) { + ebitmap_for_each_positive_bit(&tgt_matches, tnode, j) { + if (check_assertion_extended_permissions_avtab(avrule, avtab, i, j, k, p)) { + rc = 1; + goto exit; } } } From patchwork Fri Dec 17 18:19:07 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: James Carter X-Patchwork-Id: 12685455 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 274E6C433F5 for ; Fri, 17 Dec 2021 18:19:33 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234181AbhLQSTb (ORCPT ); Fri, 17 Dec 2021 13:19:31 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:41788 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S236570AbhLQSTb (ORCPT ); Fri, 17 Dec 2021 13:19:31 -0500 Received: from mail-qt1-x82e.google.com (mail-qt1-x82e.google.com [IPv6:2607:f8b0:4864:20::82e]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 55710C06173E for ; Fri, 17 Dec 2021 10:19:31 -0800 (PST) Received: by mail-qt1-x82e.google.com with SMTP id j17so3523964qtx.2 for ; Fri, 17 Dec 2021 10:19:31 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=hKkkiiUDqwq1OYvg0uY4Xt71sAL2w73EZu6KhmwpUWQ=; b=SqZEn2AOSJn+oUSjHmOUEkqqC5R2WwLAmQsUd43ZVYZXgkEC2c5LkYyaa5R/lHYCWS keirutLbnhuzhU7hN1V4Yaj9Hb5BxUIQAPQIlrn1J+o3famiQ6cWnUsUIThPt+bAuczD uNfr3gbE0CSNeSPXyiXb4+7fB0FedpaTC6gO7ICTEfa2QpP4BMhDvLkdv68503F7m44B VnjoxnnrZQBzNqfZLcQD+jSjAD6WpmcxULBv5EpMWWaQQHYSSrER8T38V6+ajbPrPspX 0rOkqmfq870+RG0ghFStD5OXg8rL5RpAO5c4xqoPUXim3QEvpFowqAyFmkDv6C+CYmV8 IEhw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=hKkkiiUDqwq1OYvg0uY4Xt71sAL2w73EZu6KhmwpUWQ=; b=4EjLtEvPgCl4Ubud8rbCbtonFoevQU+9kvvkfav/S6j7QR1kqmcoN1QSS+T672J254 qLOSVSMEUOUpLLUHreOLtrsVFQiGHoDsKwWuMgnvinE8U23Xkw6iLh/BuhUUBBdUYri4 zt7n+xNqItaTKFlsNcIQGcBt0ZAjYAovZcV4iApOusDmdvjCa923V4k/XJQ2DjAIBpFJ I0+p65yfc/uy6tAXkb9SsqqL9t9KJ9EG84oNLPT+3JbLz9pDyoD61MUmwZFLBF0cPLaK MNyYawd1QCD/0PT5yIeMpZRuDoCkgSMu3d8AMAEG1Hf6N6BA7Hn3JcNPrSF/A3b6qB1c c4Dg== X-Gm-Message-State: AOAM531MfA/qj0r4+lJffKl6tq/bnjFyJ5IBQQCKAg9vayuXD02xbaBz SqCjfNYK2c4F0y7gj1APiPBOtaDW+rU= X-Google-Smtp-Source: ABdhPJyC7yHaEJVyCD8yC/mv5D93CR9cgvBfTJYfLeAG/XLBAhmjMuQjxpuEzsEQXXjcuTzTN4Tuvg== X-Received: by 2002:ac8:5e47:: with SMTP id i7mr3577256qtx.600.1639765170410; Fri, 17 Dec 2021 10:19:30 -0800 (PST) Received: from localhost.localdomain (c-73-200-157-122.hsd1.md.comcast.net. [73.200.157.122]) by smtp.gmail.com with ESMTPSA id o17sm7468094qtv.30.2021.12.17.10.19.29 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 17 Dec 2021 10:19:30 -0800 (PST) From: James Carter To: selinux@vger.kernel.org Cc: cgzones@googlemail.com, James Carter Subject: [PATCH 10/16] libsepol: Move assigning outer loop index out of inner loop Date: Fri, 17 Dec 2021 13:19:07 -0500 Message-Id: <20211217181913.336360-11-jwcart2@gmail.com> X-Mailer: git-send-email 2.31.1 In-Reply-To: <20211217181913.336360-1-jwcart2@gmail.com> References: <20211217181913.336360-1-jwcart2@gmail.com> MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: selinux@vger.kernel.org Assign value based on outer loop index in the outer loop instead of the inner loop. Signed-off-by: James Carter --- libsepol/src/assertion.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/libsepol/src/assertion.c b/libsepol/src/assertion.c index 7aaaf303..d3711b01 100644 --- a/libsepol/src/assertion.c +++ b/libsepol/src/assertion.c @@ -158,8 +158,8 @@ static int report_assertion_extended_permissions(sepol_handle_t *handle, tmp_key.specified = AVTAB_XPERMS_ALLOWED; ebitmap_for_each_positive_bit(sattr, snode, i) { + tmp_key.source_type = i + 1; ebitmap_for_each_positive_bit(tattr, tnode, j) { - tmp_key.source_type = i + 1; tmp_key.target_type = j + 1; for (node = avtab_search_node(avtab, &tmp_key); node; @@ -334,8 +334,8 @@ static int check_assertion_extended_permissions_avtab(avrule_t *avrule, avtab_t tmp_key.specified = AVTAB_XPERMS_ALLOWED; ebitmap_for_each_positive_bit(sattr, snode, i) { + tmp_key.source_type = i + 1; ebitmap_for_each_positive_bit(tattr, tnode, j) { - tmp_key.source_type = i + 1; tmp_key.target_type = j + 1; for (node = avtab_search_node(avtab, &tmp_key); node; From patchwork Fri Dec 17 18:19:08 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: James Carter X-Patchwork-Id: 12685457 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id D2286C4332F for ; Fri, 17 Dec 2021 18:19:33 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234250AbhLQSTd (ORCPT ); Fri, 17 Dec 2021 13:19:33 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:41796 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S236697AbhLQSTc (ORCPT ); Fri, 17 Dec 2021 13:19:32 -0500 Received: from mail-qv1-xf2b.google.com (mail-qv1-xf2b.google.com [IPv6:2607:f8b0:4864:20::f2b]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id D0F35C061574 for ; Fri, 17 Dec 2021 10:19:31 -0800 (PST) Received: by mail-qv1-xf2b.google.com with SMTP id kd9so3148901qvb.11 for ; Fri, 17 Dec 2021 10:19:31 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=LozCoQKUQpmqPMifyhEH/ul1tsFqWRTxqDJtnc3XY5M=; b=JvnobrOXrCIZQPYAsGsEvy11pKyn8+RNgrR5Jsr5hJmjJD7H5HvqA0DFMaaeTPqq3p ikX6jFBjq11s9ZsQJaR1ogt25biz524dKuv0JZ8HlTNXEabnftI7JRKxCDw4rqEXs5mI 5cGJ+X5ritUYPo6zvahgGHJjo0wjDQPt/ZAQr+DhYToQ3UlQ+euTj89FxwNcV4qBFOze /Hdbw2ceDPjRcgaeJzewXrinoVluVM3URdBgTLhTKUQlLmLrjO3roZqAfTpzOkOBzgpW DM09mDKMO5QZu7lmda0ECcjSIGfDEcfnM61sc74t6LW6nZSaRv2+DF+YJP9Cvy380TR3 Pe7g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=LozCoQKUQpmqPMifyhEH/ul1tsFqWRTxqDJtnc3XY5M=; b=AbVHaeCCeAqCp79KzDizVQ8eKFhv5g1ppScrJXNvJNZHmUHjlc06eejOox6MFKIArg tmQnlGlscSWFFXHTFYWK6AO9UbJG33G/c9YH5EMv7C2Vh62Qv3oAW6hGtJBb5fzEXd0x cJLNU6TwL28vLCMW6icTougEKZmsD7f9L3klzmAYSI3S6T9cRnVUpR8o0mgFyyMfndRY /P5lbXtl1eQbCA4FwL6Am0GR2sauxJGfdH3cR1Ya/qqjUW8gY1zJb0YpVt9z/qrlcoaZ CSDd2saoNdn6tocjbaRbixeOHzEg5l6yLcfrG/sWb3+phNDRC+gmPTYHx4E5+ckV9Tfz iMnw== X-Gm-Message-State: AOAM53170RQcInssvZ/o9faCzQ7wYOhl9gKmO5l/xxTqUdc2dqxISueH LFk9HudkY35g+bz5MeExj2Yw7SoB+to= X-Google-Smtp-Source: ABdhPJy+KChSDAtPpoPfdGWwBYAYaY5SMT+oClnNy0veu8nz2ElbLvk+0L7vim6Q0IW37WVnIlguHg== X-Received: by 2002:a05:6214:4f0:: with SMTP id cl16mr3431214qvb.72.1639765170943; Fri, 17 Dec 2021 10:19:30 -0800 (PST) Received: from localhost.localdomain (c-73-200-157-122.hsd1.md.comcast.net. [73.200.157.122]) by smtp.gmail.com with ESMTPSA id o17sm7468094qtv.30.2021.12.17.10.19.30 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 17 Dec 2021 10:19:30 -0800 (PST) From: James Carter To: selinux@vger.kernel.org Cc: cgzones@googlemail.com, James Carter Subject: [PATCH 11/16] libsepol: Make use of previously created ebitmap when checking self Date: Fri, 17 Dec 2021 13:19:08 -0500 Message-Id: <20211217181913.336360-12-jwcart2@gmail.com> X-Mailer: git-send-email 2.31.1 In-Reply-To: <20211217181913.336360-1-jwcart2@gmail.com> References: <20211217181913.336360-1-jwcart2@gmail.com> MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: selinux@vger.kernel.org In both check_assertion_extended_permissions() and report_assertion_avtab_matches(), when checking for a match involving a rule using self, the matches between the source and target of the rule being checked are found using ebitmap_and() and then the matches between that result and the source of the neverallow are found using another ebitmap_and() call. Since the matches between the sources of the rule being checked and the neverallow have already been found, just find the matches between that result and the target of the rule being checked. This only requires one call to ebitmap_and() instead of two. Signed-off-by: James Carter --- libsepol/src/assertion.c | 20 +++++--------------- 1 file changed, 5 insertions(+), 15 deletions(-) diff --git a/libsepol/src/assertion.c b/libsepol/src/assertion.c index d3711b01..4c9b9557 100644 --- a/libsepol/src/assertion.c +++ b/libsepol/src/assertion.c @@ -214,7 +214,7 @@ static int report_assertion_avtab_matches(avtab_key_t *k, avtab_datum_t *d, void avrule_t *avrule = a->avrule; class_perm_node_t *cp; uint32_t perms; - ebitmap_t src_matches, tgt_matches, self_matches, matches; + ebitmap_t src_matches, tgt_matches, self_matches; ebitmap_node_t *snode, *tnode; unsigned int i, j; @@ -227,7 +227,6 @@ static int report_assertion_avtab_matches(avtab_key_t *k, avtab_datum_t *d, void ebitmap_init(&src_matches); ebitmap_init(&tgt_matches); ebitmap_init(&self_matches); - ebitmap_init(&matches); rc = ebitmap_and(&src_matches, &avrule->stypes.types, &p->attr_type_map[k->source_type - 1]); @@ -242,10 +241,7 @@ static int report_assertion_avtab_matches(avtab_key_t *k, avtab_datum_t *d, void goto oom; if (avrule->flags == RULE_SELF) { - rc = ebitmap_and(&matches, &p->attr_type_map[k->source_type - 1], &p->attr_type_map[k->target_type - 1]); - if (rc < 0) - goto oom; - rc = ebitmap_and(&self_matches, &avrule->stypes.types, &matches); + rc = ebitmap_and(&self_matches, &src_matches, &p->attr_type_map[k->target_type - 1]); if (rc < 0) goto oom; @@ -284,7 +280,6 @@ exit: ebitmap_destroy(&src_matches); ebitmap_destroy(&tgt_matches); ebitmap_destroy(&self_matches); - ebitmap_destroy(&matches); return rc; } @@ -374,7 +369,7 @@ static int check_assertion_extended_permissions_avtab(avrule_t *avrule, avtab_t static int check_assertion_extended_permissions(avrule_t *avrule, avtab_t *avtab, avtab_key_t *k, policydb_t *p) { - ebitmap_t src_matches, tgt_matches, self_matches, matches; + ebitmap_t src_matches, tgt_matches, self_matches; unsigned int i, j; ebitmap_node_t *snode, *tnode; int rc; @@ -382,7 +377,6 @@ static int check_assertion_extended_permissions(avrule_t *avrule, avtab_t *avtab ebitmap_init(&src_matches); ebitmap_init(&tgt_matches); ebitmap_init(&self_matches); - ebitmap_init(&matches); rc = ebitmap_and(&src_matches, &avrule->stypes.types, &p->attr_type_map[k->source_type - 1]); @@ -400,11 +394,7 @@ static int check_assertion_extended_permissions(avrule_t *avrule, avtab_t *avtab goto oom; if (avrule->flags == RULE_SELF) { - rc = ebitmap_and(&matches, &p->attr_type_map[k->source_type - 1], - &p->attr_type_map[k->target_type - 1]); - if (rc < 0) - goto oom; - rc = ebitmap_and(&self_matches, &avrule->stypes.types, &matches); + rc = ebitmap_and(&self_matches, &src_matches, &p->attr_type_map[k->target_type - 1]); if (rc < 0) goto oom; @@ -435,7 +425,7 @@ oom: exit: ebitmap_destroy(&src_matches); ebitmap_destroy(&tgt_matches); - ebitmap_destroy(&matches); + ebitmap_destroy(&self_matches); return rc; } From patchwork Fri Dec 17 18:19:09 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: James Carter X-Patchwork-Id: 12685459 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 2C99DC433FE for ; Fri, 17 Dec 2021 18:19:34 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S236565AbhLQSTd (ORCPT ); Fri, 17 Dec 2021 13:19:33 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:41800 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S236570AbhLQSTc (ORCPT ); Fri, 17 Dec 2021 13:19:32 -0500 Received: from mail-qv1-xf2c.google.com (mail-qv1-xf2c.google.com [IPv6:2607:f8b0:4864:20::f2c]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 424E2C06173E for ; Fri, 17 Dec 2021 10:19:32 -0800 (PST) Received: by mail-qv1-xf2c.google.com with SMTP id p3so3169246qvj.9 for ; Fri, 17 Dec 2021 10:19:32 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=38U78WGYR/L8/AuwymvaYK3uZ/Ep9BAcF3uvxLGoLmY=; b=IAuI9yMAymZSTfLImeq8ZFzpw1xLmZVGLX20vdA8vHguK2xTcdw75jSYeQS2+EF2VD htfg65xLWs/GaItbHOKZ2j+WS4dOTxJPvMHttl/szfeV1KDzTpTaLDFcwIt4bw+yKWvZ 3b4OyZ99Ww2p1E4o9U3Xt/7RdVTVQMeRlwu++1AC9wPmanhj+6KWqFeaXLqc5t23bj7V hvJgzYV/vRT4FyYETTY/viLwBmEpvL8xFJIPyUQV0vv3sYTu3qRE2yqMVleRwfP1Hy7u Ll6Ex+0niv3VJqpqCOTYaJoP5Q1fT9Nc+hs1PGE6hARm247vUgiKtna+HyoRMBYv5KoO o1VQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=38U78WGYR/L8/AuwymvaYK3uZ/Ep9BAcF3uvxLGoLmY=; b=30KEVQRA3kEAxMOp8pXMsmbETjPGNdZ6XosJauZiYToZ+ZjNBjlT8YKSp6MUfihhoZ eoEYQhGouBciBsxbnW2aDQBzzrKHoAUwOoZ3oyyGZLp//l27JY7XanDSQf+yDQOdaHdJ m9Jh/DI/oPc8Tb9XOf1hXUHd/d8NykKGD0Pdc/3QU9i9lBB3wWWh3mCbrWuTIOzEQ+e3 Y1gAiNvAbRfQCGEMpkYZJfOihBRSZfQcFPac17rUc4wnVYb5+rWijQkLEAr/IucxPdEC n4QbklTjcr61DL/Lj6pLPdqAmcSwbs+okTpqcecgl54QUMRCAYRUPE8Hh/R2zyhZ7ckc 2Gmg== X-Gm-Message-State: AOAM531FvSOLotNY6z83w22VwRe527gYgBj5JwB9teSN/Oe2bOeYIbqv NDzC6c31rhf9MgpwTQ78rBdnlUg5Fao= X-Google-Smtp-Source: ABdhPJwFKNgnl7HxMAv5pp4L53A9i9Sov4USJm9kSTpIwouMLXh+yQHHu+Uz565FDLSudj5GkxeITQ== X-Received: by 2002:ad4:574f:: with SMTP id q15mr3720950qvx.97.1639765171367; Fri, 17 Dec 2021 10:19:31 -0800 (PST) Received: from localhost.localdomain (c-73-200-157-122.hsd1.md.comcast.net. [73.200.157.122]) by smtp.gmail.com with ESMTPSA id o17sm7468094qtv.30.2021.12.17.10.19.30 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 17 Dec 2021 10:19:31 -0800 (PST) From: James Carter To: selinux@vger.kernel.org Cc: cgzones@googlemail.com, James Carter Subject: [PATCH 12/16] libsepol: Refactor match_any_class_permissions() to be clearer Date: Fri, 17 Dec 2021 13:19:09 -0500 Message-Id: <20211217181913.336360-13-jwcart2@gmail.com> X-Mailer: git-send-email 2.31.1 In-Reply-To: <20211217181913.336360-1-jwcart2@gmail.com> References: <20211217181913.336360-1-jwcart2@gmail.com> MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: selinux@vger.kernel.org Signed-off-by: James Carter --- libsepol/src/assertion.c | 9 +++------ 1 file changed, 3 insertions(+), 6 deletions(-) diff --git a/libsepol/src/assertion.c b/libsepol/src/assertion.c index 4c9b9557..0bd620a7 100644 --- a/libsepol/src/assertion.c +++ b/libsepol/src/assertion.c @@ -65,14 +65,11 @@ static void report_failure(sepol_handle_t *handle, policydb_t *p, const avrule_t static int match_any_class_permissions(class_perm_node_t *cp, uint32_t class, uint32_t data) { for (; cp; cp = cp->next) { - if ((cp->tclass == class) && (cp->data & data)) { - break; - } + if ((cp->tclass == class) && (cp->data & data)) + return 1; } - if (!cp) - return 0; - return 1; + return 0; } static int extended_permissions_and(uint32_t *perms1, uint32_t *perms2) { From patchwork Fri Dec 17 18:19:10 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: James Carter X-Patchwork-Id: 12685461 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 66BFEC43219 for ; Fri, 17 Dec 2021 18:19:34 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S236570AbhLQSTe (ORCPT ); Fri, 17 Dec 2021 13:19:34 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:41802 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S236660AbhLQSTd (ORCPT ); Fri, 17 Dec 2021 13:19:33 -0500 Received: from mail-qv1-xf2f.google.com (mail-qv1-xf2f.google.com [IPv6:2607:f8b0:4864:20::f2f]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 0D997C061574 for ; Fri, 17 Dec 2021 10:19:33 -0800 (PST) Received: by mail-qv1-xf2f.google.com with SMTP id ke6so3218084qvb.1 for ; Fri, 17 Dec 2021 10:19:33 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=oB1Gkr/CwqG8K0NbDDq6P8Np0LYych3pguT1Dlmmv+w=; b=JqjpABqN6thF+9U8ja3pvcSINYpMa6IPxtP04S3FOomuE4hO7/D4wQZ6kAt3MrOmBg Shx82NZPh2Iz5ZvXvidGeBljAu+mJelBilwY7KHPjvgsCLC4cBwyVYfOFlBS/dPHgZw9 jFhSIDp53SkDITX2BjX5aX+QVXZZLJnWdr7ggx/2mNUbf0egwcMjJIQ7nVv/kNO+T9mX CuXwlvhFDhSiiwALN3SKwsdyrgZcwlf4ABUItrvh8a2exG4X09yuRAbNZAm5SFRiMlS2 wUR2H8Pm6iW07OqzsG4WCR72u00NZ7itxTu6k+bz3aCbEGDfscrc97E+/+dJ0mJKVGt/ lM2Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=oB1Gkr/CwqG8K0NbDDq6P8Np0LYych3pguT1Dlmmv+w=; b=THvjmo7hwCV66GftZnh1wz7y16cMDWk8Qbr1BoTu+28nngioEZ473/das7vA2fLVu9 ANxDhkSAQZo0K8lCkzALi8g7MlkwxF+JUd+3OP2dW3deUFZq5EY5yTmzZLzEePIMcj7L lCB0BuXJb6YODTiFirb3qvoG3ePHKJDVva8bPH93ldg+f2qCSUV0VGbgsSIkk+Ax9+ec pEyhwlBwIVEEDwA59b2anIIiKxx6w/ofXL7vyjcMB2WBYw15Uaa6O3ED2+Tn8YbquxJE 4WrOLuQcV2MI0Jf97Qr7O2Jf8u4eSuG/5Y4JeaNjC2fm5lrlfndh/tLoWe0LMm1gXNuM 3P8w== X-Gm-Message-State: AOAM531Cm0Ekp03SMkqyxj6jmf2HRL/hsvlkxEFoDCI1iZ9WLYryuarJ LjhEiDW100xEDzQ3f8YlkIGpntPZYFw= X-Google-Smtp-Source: ABdhPJxw+sFmC6CbjKnzAbj+szLKa/L6cYSsl70xHu+1UksQEwzZOqetroVImoo9mWl7ewr8b1SN1w== X-Received: by 2002:a05:6214:5186:: with SMTP id kl6mr3762698qvb.33.1639765171928; Fri, 17 Dec 2021 10:19:31 -0800 (PST) Received: from localhost.localdomain (c-73-200-157-122.hsd1.md.comcast.net. [73.200.157.122]) by smtp.gmail.com with ESMTPSA id o17sm7468094qtv.30.2021.12.17.10.19.31 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 17 Dec 2021 10:19:31 -0800 (PST) From: James Carter To: selinux@vger.kernel.org Cc: cgzones@googlemail.com, James Carter Subject: [PATCH 13/16] libsepol: Make return value clearer when reporting neverallowx errors Date: Fri, 17 Dec 2021 13:19:10 -0500 Message-Id: <20211217181913.336360-14-jwcart2@gmail.com> X-Mailer: git-send-email 2.31.1 In-Reply-To: <20211217181913.336360-1-jwcart2@gmail.com> References: <20211217181913.336360-1-jwcart2@gmail.com> MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: selinux@vger.kernel.org The value returned from report_assertion_extended_permissions() is the nubmer of errors, so call it that instead of ret. Signed-off-by: James Carter --- libsepol/src/assertion.c | 13 ++++++------- 1 file changed, 6 insertions(+), 7 deletions(-) diff --git a/libsepol/src/assertion.c b/libsepol/src/assertion.c index 0bd620a7..b8fe8b21 100644 --- a/libsepol/src/assertion.c +++ b/libsepol/src/assertion.c @@ -148,8 +148,8 @@ static int report_assertion_extended_permissions(sepol_handle_t *handle, ebitmap_t *tattr = &p->type_attr_map[ttype]; ebitmap_node_t *snode, *tnode; unsigned int i, j; - int rc = 1; - int ret = 0; + int rc; + int errors = 0; memcpy(&tmp_key, k, sizeof(avtab_key_t)); tmp_key.specified = AVTAB_XPERMS_ALLOWED; @@ -178,15 +178,14 @@ static int report_assertion_extended_permissions(sepol_handle_t *handle, p->p_class_val_to_name[curperm->tclass - 1], sepol_extended_perms_to_string(&error)); - rc = 0; - ret++; + errors++; } } } } /* failure on the regular permissions */ - if (rc) { + if (!errors) { ERR(handle, "neverallowxperm on line %lu of %s (or line %lu of policy.conf) violated by\n" "allow %s %s:%s {%s };", avrule->source_line, avrule->source_filename, avrule->line, @@ -194,11 +193,11 @@ static int report_assertion_extended_permissions(sepol_handle_t *handle, p->p_type_val_to_name[ttype], p->p_class_val_to_name[curperm->tclass - 1], sepol_av_to_string(p, curperm->tclass, perms)); - ret++; + errors++; } - return ret; + return errors; } static int report_assertion_avtab_matches(avtab_key_t *k, avtab_datum_t *d, void *args) From patchwork Fri Dec 17 18:19:11 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: James Carter X-Patchwork-Id: 12685463 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id DEC8BC433EF for ; Fri, 17 Dec 2021 18:19:34 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S236700AbhLQSTe (ORCPT ); Fri, 17 Dec 2021 13:19:34 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:41810 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S236697AbhLQSTd (ORCPT ); Fri, 17 Dec 2021 13:19:33 -0500 Received: from mail-qv1-xf34.google.com (mail-qv1-xf34.google.com [IPv6:2607:f8b0:4864:20::f34]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 8573AC06173E for ; Fri, 17 Dec 2021 10:19:33 -0800 (PST) Received: by mail-qv1-xf34.google.com with SMTP id eq6so3179361qvb.7 for ; Fri, 17 Dec 2021 10:19:33 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=wPNzMcGdW3jTxa/cCbMlFEpv3jL3BV/8GbwgBDJUAt4=; b=lcQo6YKJbKiwaMKsIKqsAeimXuJKAVQp6CRy11rNEBgLbJAst5ZnPU9SPR4nyf9yUe KfKDxXLFxx0fiSxRkjCwPUREfVfY75J7YVOP45+FTu7FIRARfX7RNpjQwkGL1UDhZ+HA daOaOX1IkXND5bgwuYw2IZs/JDaZwizTUDVY5uXOAh3Vw94vX748RVnB5xFMdHMPFl9W aIJN3+SglPP835uq5fgnCRmhmjeTN1vGXsLg5Wa+LU0JHzYl/Ovj3OZEHurvFLn0Vzpz WCbzgdfvRXllfypxKuXjjSwasQL3VQHl+fDtFzyTlxhW2CKqGvwCpxNWUkm+HKHJzsZa anZQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=wPNzMcGdW3jTxa/cCbMlFEpv3jL3BV/8GbwgBDJUAt4=; b=mx/OdNKCFsk3T2POawSLUV84fn3E8bbr2HVpg4bajfjX4GYWymNFvXOGSqQ93cf+iz ZzPUC7KYVeTmy+MuXSNBqnILM8FuKhOWpHrZ8sQu0W7aegTFAKAgxj10YZdPN1Lp2EIo MmvrKHtfMUcnW19jWEl2Oc8YgjS9cP63CC7mJfjDCOrKiBxG0CNMxfPKl8u92CLZO0Qm dSy0PZWssd1UKAwlTZOSAp1S3riJY0EDowG6x4Q8Q+ffAoo5ha+3fkllPYXD1ck6R9Vt XriFXOeKrqqz42MZEUz63vnC35dtI+Bzflxb+mnVuKn/klv48BFmo5e1UAKpG/0vpQbR XXdw== X-Gm-Message-State: AOAM5316p+F8DkAKul57qEn6OOdVBL68b0CoSjhZ1WV+CAztE6Ciwb75 hvH3RnmvT9lKWXgIAw9cgnI6sdhAwRs= X-Google-Smtp-Source: ABdhPJx9MkCZMrKqvtYf1ZCW6svV+9S1mkECT82jUmsTas+TG0gvjmlIi+AhoPfLIufpn6IzpDu72g== X-Received: by 2002:ad4:5be5:: with SMTP id k5mr1197650qvc.124.1639765172572; Fri, 17 Dec 2021 10:19:32 -0800 (PST) Received: from localhost.localdomain (c-73-200-157-122.hsd1.md.comcast.net. [73.200.157.122]) by smtp.gmail.com with ESMTPSA id o17sm7468094qtv.30.2021.12.17.10.19.32 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 17 Dec 2021 10:19:32 -0800 (PST) From: James Carter To: selinux@vger.kernel.org Cc: cgzones@googlemail.com, James Carter Subject: [PATCH 14/16] libsepol: The src and tgt must be the same if neverallow uses self Date: Fri, 17 Dec 2021 13:19:11 -0500 Message-Id: <20211217181913.336360-15-jwcart2@gmail.com> X-Mailer: git-send-email 2.31.1 In-Reply-To: <20211217181913.336360-1-jwcart2@gmail.com> References: <20211217181913.336360-1-jwcart2@gmail.com> MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: selinux@vger.kernel.org When checking for violations of neverallow rules, if the neverallow uses self, then the src and tgt must be the same when checking extended permissions and when reporting violations. Example: allow attr attr : CLASS PERM; neverallow attr self : CLASS PERM; If the types t1 and t2 have attribute attr, then the violations that would be reported would be: allow t1 t1 : CLASS PERM; allow t1 t2 : CLASS PERM; allow t2 t1 : CLASS PERM; allow t2 t2 : CLASS PERM; instead of: allow t1 t1 : CLASS PERM; allow t2 t2 : CLASS PERM; Signed-off-by: James Carter --- libsepol/src/assertion.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/libsepol/src/assertion.c b/libsepol/src/assertion.c index b8fe8b21..ae3c18be 100644 --- a/libsepol/src/assertion.c +++ b/libsepol/src/assertion.c @@ -213,6 +213,7 @@ static int report_assertion_avtab_matches(avtab_key_t *k, avtab_datum_t *d, void ebitmap_t src_matches, tgt_matches, self_matches; ebitmap_node_t *snode, *tnode; unsigned int i, j; + const int is_avrule_self = (avrule->flags & RULE_SELF) != 0; if ((k->specified & AVTAB_ALLOWED) == 0) return 0; @@ -236,7 +237,7 @@ static int report_assertion_avtab_matches(avtab_key_t *k, avtab_datum_t *d, void if (rc < 0) goto oom; - if (avrule->flags == RULE_SELF) { + if (is_avrule_self) { rc = ebitmap_and(&self_matches, &src_matches, &p->attr_type_map[k->target_type - 1]); if (rc < 0) goto oom; @@ -260,6 +261,8 @@ static int report_assertion_avtab_matches(avtab_key_t *k, avtab_datum_t *d, void ebitmap_for_each_positive_bit(&src_matches, snode, i) { ebitmap_for_each_positive_bit(&tgt_matches, tnode, j) { + if (is_avrule_self && i != j) + continue; if (avrule->specified == AVRULE_XPERMS_NEVERALLOW) { a->errors += report_assertion_extended_permissions(handle,p, avrule, i, j, cp, perms, k, avtab); @@ -368,6 +371,7 @@ static int check_assertion_extended_permissions(avrule_t *avrule, avtab_t *avtab ebitmap_t src_matches, tgt_matches, self_matches; unsigned int i, j; ebitmap_node_t *snode, *tnode; + const int is_avrule_self = (avrule->flags & RULE_SELF) != 0; int rc; ebitmap_init(&src_matches); @@ -389,7 +393,7 @@ static int check_assertion_extended_permissions(avrule_t *avrule, avtab_t *avtab if (rc < 0) goto oom; - if (avrule->flags == RULE_SELF) { + if (is_avrule_self) { rc = ebitmap_and(&self_matches, &src_matches, &p->attr_type_map[k->target_type - 1]); if (rc < 0) goto oom; @@ -408,6 +412,8 @@ static int check_assertion_extended_permissions(avrule_t *avrule, avtab_t *avtab ebitmap_for_each_positive_bit(&src_matches, snode, i) { ebitmap_for_each_positive_bit(&tgt_matches, tnode, j) { + if (is_avrule_self && i != j) + continue; if (check_assertion_extended_permissions_avtab(avrule, avtab, i, j, k, p)) { rc = 1; goto exit; From patchwork Fri Dec 17 18:19:12 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: James Carter X-Patchwork-Id: 12685465 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 2F6CDC43217 for ; Fri, 17 Dec 2021 18:19:35 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S240052AbhLQSTe (ORCPT ); Fri, 17 Dec 2021 13:19:34 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:41812 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S239981AbhLQSTe (ORCPT ); Fri, 17 Dec 2021 13:19:34 -0500 Received: from mail-qk1-x732.google.com (mail-qk1-x732.google.com [IPv6:2607:f8b0:4864:20::732]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 1BB14C061574 for ; Fri, 17 Dec 2021 10:19:34 -0800 (PST) Received: by mail-qk1-x732.google.com with SMTP id l25so2982171qkl.5 for ; Fri, 17 Dec 2021 10:19:34 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=JO2PmnmZZkFd18wSxIIzSNz2VBHTXfG2JJ83387mSyA=; b=qnwktJmz3KPGZ0aL53Yvci2+aYPS/Hw99KcY7pcksK6Uj6ehVl8ew7LdEk87MVNyju x9IBCwh+52DKPVkW49K54IHiqZWa458mKy3NNesmxOQRIHPsV5VA3GAeprT40MVmLGM2 M4BNW+QHboGTuaEjTtDeQyj0SM+7TM8dBRzbzJ2pTADvyY+JR0aCmf87Til/ICttzO/Y IvMySziDamvTZCLGhAintq03ehXMhxkH/XeEpj9KF1lmYyh8x4XRBsHyXFkTFOWx12qj sVBLJFqZd/jNIojTfg6N+Viw415CP5a0w5JSxgsgEeU31dUbzQw/PCqflyx+rU1BixiB ikBg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=JO2PmnmZZkFd18wSxIIzSNz2VBHTXfG2JJ83387mSyA=; b=Y+aE90XOqw+hHFynFlhuMD8JRu9sVEv05P4sQiCGWGRWufwZQExBHEU0dBoRQYoVdU dGVXOj/E4gTjOb6I9PN+GZ1f4ZqosmZ1UO0p7dqjv7/NCl1aDCLz4sOsgFl7km3WNGWS TVsV6nc5wuw1KMFhsHQ9GdLm4ccFpjCuiE1bbhyfrsBskJQimmkqqOjZzjZwW+bL8niF e9PXHCKbYxVmHgsdfwjA+ACss8b81AcCPPUWnU/INv4p1wK+kubBYjcbgPr6rdkEfzwN wxhElJkeUj6BCHn2JLdJT7VTY+HFnUqcjoQgo7Y/46hWzHXktgHpsejLfTI9RaIdNjyh wyhA== X-Gm-Message-State: AOAM5318IaiG8JAvLHRJel2goQHsRiLxka39UPqAqOtcZD8OiWhNGzF1 9edDmpK4jhmlUadJ2o+XEEiKaf8mWrQ= X-Google-Smtp-Source: ABdhPJw8Wk4oOMqTZ7JTVTajkR2aXcL3rGSds6h+ZvGduW9kOYjLzRG1e23bfzHwSsxH4ROHwWfTLw== X-Received: by 2002:a05:620a:1789:: with SMTP id ay9mr2660257qkb.657.1639765173109; Fri, 17 Dec 2021 10:19:33 -0800 (PST) Received: from localhost.localdomain (c-73-200-157-122.hsd1.md.comcast.net. [73.200.157.122]) by smtp.gmail.com with ESMTPSA id o17sm7468094qtv.30.2021.12.17.10.19.32 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 17 Dec 2021 10:19:32 -0800 (PST) From: James Carter To: selinux@vger.kernel.org Cc: cgzones@googlemail.com, James Carter Subject: [PATCH 15/16] libsepol: Set args avtab pointer when reporting assertion violations Date: Fri, 17 Dec 2021 13:19:12 -0500 Message-Id: <20211217181913.336360-16-jwcart2@gmail.com> X-Mailer: git-send-email 2.31.1 In-Reply-To: <20211217181913.336360-1-jwcart2@gmail.com> References: <20211217181913.336360-1-jwcart2@gmail.com> MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: selinux@vger.kernel.org The changes are the same as in a patch sent by Christian Göttsche to support adding not-self to neverallowxperm checking, but it is needed for normal neverallowxperm checking as well and the following explanation reflects that. When reporting neverallowxperm violations, the avtab is searched to find the rule that violates the assertion. If the avtab pointer of the args is not set, then it will report the error as if no extended permissions existed for the source and target (so allowing the ioctl permission at all violates the neverallowxperm). Example (where t1 has attribute attr): allow attr attr:CLASS ioctl; allowxperm attr attr:CLASS ioctl 0x9411; neverallowxperm t1 self:CLASS ioctl 0x9411; Would be reported as: neverallowxperm on line 3 of policy.conf (or line 3 of policy.conf) violated by allow t1 t1:CLASS { ioctl }; Instead of: neverallowxperm on line 3 of policy.conf (or line 3 of policy.conf) violated by allowxperm attr attr:CLASS ioctl { 0x9411 }; Reported-by: Christian Göttsche Signed-off-by: James Carter --- libsepol/src/assertion.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/libsepol/src/assertion.c b/libsepol/src/assertion.c index ae3c18be..ecd3f567 100644 --- a/libsepol/src/assertion.c +++ b/libsepol/src/assertion.c @@ -292,10 +292,12 @@ static int report_assertion_failures(sepol_handle_t *handle, policydb_t *p, avru args.avrule = avrule; args.errors = 0; + args.avtab = &p->te_avtab; rc = avtab_map(&p->te_avtab, report_assertion_avtab_matches, &args); if (rc < 0) goto oom; + args.avtab = &p->te_cond_avtab; rc = avtab_map(&p->te_cond_avtab, report_assertion_avtab_matches, &args); if (rc < 0) goto oom; From patchwork Fri Dec 17 18:19:13 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: James Carter X-Patchwork-Id: 12685467 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id C85C1C433F5 for ; Fri, 17 Dec 2021 18:19:35 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S236697AbhLQSTf (ORCPT ); Fri, 17 Dec 2021 13:19:35 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:41814 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S236660AbhLQSTe (ORCPT ); Fri, 17 Dec 2021 13:19:34 -0500 Received: from mail-qv1-xf2b.google.com (mail-qv1-xf2b.google.com [IPv6:2607:f8b0:4864:20::f2b]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 79A55C06173E for ; Fri, 17 Dec 2021 10:19:34 -0800 (PST) Received: by mail-qv1-xf2b.google.com with SMTP id m6so3177253qvh.10 for ; Fri, 17 Dec 2021 10:19:34 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=B27Crs8BDI/b0uopwtXzC0FMir/HbJXcmoMpkqLZ7hc=; b=OkBnuJcaKZcmjPWZ0SX+HIO31hRNSmcuq9+opHcc/h0eSI7ieiFSqjn26LYy7ePCFl m1/yXnmXCl11Gt4WOSJrqDXbEuUKyf55it3GZRsRW/ALH6z01EEbRQUgsAiVXIeWqaA1 xegUN6dBU/nDyGR0tQrFFDRaPog5dW2XTtlIC8vrcaahWoh/+TeT+tEk7/T+TMAr/k9v sP4K5OclfA80d4t3TPdoQyeJgxGS6jOCy4DpqSMD3muVJ/3hoK2KWF2v218qbZM62lOA Qyk9ggpA/UsjufuVjgOj/LIwHMU1oLQLLTU8sUOtTEV8jVqf96EmrN1MJFCihDfQIdXH lzQw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=B27Crs8BDI/b0uopwtXzC0FMir/HbJXcmoMpkqLZ7hc=; b=N5u8THPEfLNmemAA1cszaR89aB87ouoygK6cMGivmUENOHDmxfufyhxqmHNjkIPMVg rGhoAZk5br9j0d2R2xts3hZJYT+Aj5xUqca1/zGqixSnJ19rLZfOOHU2jnz2Aogj1SS7 Oqg7jP8h+jSfczoLbbdcyPKSTNf/Fvu6ZBF16s9iDERZRU/B/GMfWzcQG6dYs1xTukbx 71YTqlTU5mqoJ08SyyFsoviEZ8e6cPG1/xVyIOmloqNw3pD1Mg15WyUyE2Ki3Sa1lp+P WSr0qBJuW5LBRsanBMcPhussWZM3xbiTs4MM/eaGRu9REDo46xXH3tVol7fApnjxNZNB WMtA== X-Gm-Message-State: AOAM533W7vtrymw4W2vHexakw/oaNsW+ZQc8DVmm61Ka07q8igqL/9YQ LQA9TxSNCK0UkIc+0k5B/Hw7Qh+JcKw= X-Google-Smtp-Source: ABdhPJwLja+pP4p/y7vbm988DzQLu9bSkUBrcs/ydvGtSLxzdeE54Xqy+CxasL+j6nCHFr4vFMNi4w== X-Received: by 2002:ad4:5965:: with SMTP id eq5mr3667146qvb.64.1639765173601; Fri, 17 Dec 2021 10:19:33 -0800 (PST) Received: from localhost.localdomain (c-73-200-157-122.hsd1.md.comcast.net. [73.200.157.122]) by smtp.gmail.com with ESMTPSA id o17sm7468094qtv.30.2021.12.17.10.19.33 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 17 Dec 2021 10:19:33 -0800 (PST) From: James Carter To: selinux@vger.kernel.org Cc: cgzones@googlemail.com, James Carter Subject: [PATCH 16/16] libsepol: Fix two problems with neverallowxperm reporting Date: Fri, 17 Dec 2021 13:19:13 -0500 Message-Id: <20211217181913.336360-17-jwcart2@gmail.com> X-Mailer: git-send-email 2.31.1 In-Reply-To: <20211217181913.336360-1-jwcart2@gmail.com> References: <20211217181913.336360-1-jwcart2@gmail.com> MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: selinux@vger.kernel.org Not all violations of neverallowxperm rules were being reported. In check_assertion_extended_permissions_avtab(), a break was performed after finding a match rather than just returning right away. This means that if other src and tgt pairs were checked afterward that did not match, then no match would be reported. Example: allow attr attr:CLASS ioctl; allowxperm attr attr:CLASS ioctl 0x9401; allowxperm t1 self:CLASS ioctl 0x9421; neverallowxperm attr self:CLASS ioctl 0x9421; Would result in no assertion violations being found. Another problem was that the reporting function did not properly recognize when there was a valid allowxperm rule and falsely reported additional violations that did not exist. (There had to be at least one legitimate violation.) Using the same example as above (and assuming t1 and t2 both have attribute attr), the following would be reported as: neverallowxperm on line 4 of policy.conf (or line 4 of policy.conf) violated by allowxperm t1 t1:CLASS ioctl { 0x9421 }; neverallowxperm on line 4 of policy.conf (or line 4 of policy.conf) violated by allow t2 t2:CLASS4 { ioctl }; There is no violation for t2 because there is a valid allowxperm rule for it. With this patch, only the first error message (which is the correct one) is printed. Signed-off-by: James Carter --- libsepol/src/assertion.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/libsepol/src/assertion.c b/libsepol/src/assertion.c index ecd3f567..0ee7f104 100644 --- a/libsepol/src/assertion.c +++ b/libsepol/src/assertion.c @@ -149,6 +149,7 @@ static int report_assertion_extended_permissions(sepol_handle_t *handle, ebitmap_node_t *snode, *tnode; unsigned int i, j; int rc; + int found_xperm = 0; int errors = 0; memcpy(&tmp_key, k, sizeof(avtab_key_t)); @@ -165,7 +166,7 @@ static int report_assertion_extended_permissions(sepol_handle_t *handle, if ((xperms->specified != AVTAB_XPERMS_IOCTLFUNCTION) && (xperms->specified != AVTAB_XPERMS_IOCTLDRIVER)) continue; - + found_xperm = 1; rc = check_extended_permissions(avrule->xperms, xperms); /* failure on the extended permission check_extended_permissions */ if (rc) { @@ -185,7 +186,7 @@ static int report_assertion_extended_permissions(sepol_handle_t *handle, } /* failure on the regular permissions */ - if (!errors) { + if (!found_xperm) { ERR(handle, "neverallowxperm on line %lu of %s (or line %lu of policy.conf) violated by\n" "allow %s %s:%s {%s };", avrule->source_line, avrule->source_filename, avrule->line, @@ -343,7 +344,7 @@ static int check_assertion_extended_permissions_avtab(avrule_t *avrule, avtab_t continue; rc = check_extended_permissions(neverallow_xperms, xperms); if (rc) - break; + return rc; } } }