From patchwork Tue Jan 11 21:54:31 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: James Carter X-Patchwork-Id: 12710784 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 510D7C433EF for ; Tue, 11 Jan 2022 21:55:07 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1345493AbiAKVzE (ORCPT ); Tue, 11 Jan 2022 16:55:04 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:48948 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234206AbiAKVy7 (ORCPT ); Tue, 11 Jan 2022 16:54:59 -0500 Received: from mail-qt1-x835.google.com (mail-qt1-x835.google.com [IPv6:2607:f8b0:4864:20::835]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 5FD75C061751 for ; Tue, 11 Jan 2022 13:54:58 -0800 (PST) Received: by mail-qt1-x835.google.com with SMTP id i8so907076qtw.0 for ; Tue, 11 Jan 2022 13:54:58 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=tKn85cKJmtY5fpLVgW6csAcITiSKsyGMOP6Hjw9OQtI=; b=VmRfFsYDSRLZVbrud+dCFYQDVLFT3xhALaL0NHzAay5gpV2mQM14XUE8onbP91kLQ2 Ryhd3HVEI9cHGdqTJwPIqT41OgpYNBeOcpJj0oItTJKRVtkEgExZUPRlQ2pcWDSf3MiF sQMZmn2XK2FNwX9ulEKxbrlIj3aNMoCEKl41C74QCyB3NqsCriQgFj7vVjsHzWP2cFvN BMc43JD9NBxiw7TgrOMb1o7IqkOUUGyOIEEfBfIyyavRRd0t4gmVvIMf/qImek5pFXmY yOuZNoPRrdZOacaWxD19L/hy2lTjpQqHEG0DF8r9zW/VmtEbAXz3GJ9JhF7q1XdbsNzP CrnA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=tKn85cKJmtY5fpLVgW6csAcITiSKsyGMOP6Hjw9OQtI=; b=wi1Tl+pzufZZ0Fxrk00namqBhNKQOzd7BtgO8wl/WFl5huehLy10E7x6p4ay4yUJUT idyDiUIQdumi9Q9qZlF6WTyRD3nWBQ1zvHdrHMNPBYJ0w4HfdFP3V+RiBypaSy154o+q WvCfdUoVYitALLOn1y+GcW+b39qAmt9hktikjNbeoal4gT3GOut3cFQP68qL9ofMCmjL fSPj0T14rp8EGtmdyPYoHWkaKTbD+GdrKz3IjmbLIcXyJHhjimBn6bP51Lz5ZWeztvyi orumpuM4d7aWQE+L1ey/1T+D6y+ZRPh57UbUrrQhrQgVXAP4ZqEFZnQqnJCOeMEIDt0+ QL4Q== X-Gm-Message-State: AOAM531FKOWbu5cC6CI/NH0xA0C207Jmv+dM9OpoRMVfMajc38L1RFEl Rl7x7bEqvPrT7Oy8fekfxKgY/8u62yw= X-Google-Smtp-Source: ABdhPJx5PSJBo8K7DUnnoa6QASMYVaKNs0ArN+3pPRO2XTxULDUuSwOMHN5BFXqFiNbdnyE13U2b7w== X-Received: by 2002:ac8:580a:: with SMTP id g10mr5441127qtg.515.1641938097524; Tue, 11 Jan 2022 13:54:57 -0800 (PST) Received: from localhost.localdomain (c-69-250-217-147.hsd1.md.comcast.net. [69.250.217.147]) by smtp.gmail.com with ESMTPSA id j22sm5826949qko.46.2022.01.11.13.54.57 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 11 Jan 2022 13:54:57 -0800 (PST) From: James Carter To: selinux@vger.kernel.org Cc: cgzones@googlemail.com, James Carter Subject: [PATCH 01/16 v2] libsepol: Return an error if check_assertion() returns an error. Date: Tue, 11 Jan 2022 16:54:31 -0500 Message-Id: <20220111215446.595516-2-jwcart2@gmail.com> X-Mailer: git-send-email 2.31.1 In-Reply-To: <20220111215446.595516-1-jwcart2@gmail.com> References: <20220111215446.595516-1-jwcart2@gmail.com> MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: selinux@vger.kernel.org Instead of calling report_assertion_failures() and treating an error like it was a neverallow violation, just return an error. Signed-off-by: James Carter --- libsepol/src/assertion.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/libsepol/src/assertion.c b/libsepol/src/assertion.c index dd2749a0..ba4a204f 100644 --- a/libsepol/src/assertion.c +++ b/libsepol/src/assertion.c @@ -538,6 +538,10 @@ int check_assertions(sepol_handle_t * handle, policydb_t * p, if (!(a->specified & (AVRULE_NEVERALLOW | AVRULE_XPERMS_NEVERALLOW))) continue; rc = check_assertion(p, a); + if (rc < 0) { + ERR(handle, "Error occurred while checking neverallows"); + return -1; + } if (rc) { rc = report_assertion_failures(handle, p, a); if (rc < 0) { From patchwork Tue Jan 11 21:54:32 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: James Carter X-Patchwork-Id: 12710785 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 84A49C4332F for ; Tue, 11 Jan 2022 21:55:07 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S245648AbiAKVzF (ORCPT ); Tue, 11 Jan 2022 16:55:05 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:48950 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234664AbiAKVy7 (ORCPT ); Tue, 11 Jan 2022 16:54:59 -0500 Received: from mail-qt1-x831.google.com (mail-qt1-x831.google.com [IPv6:2607:f8b0:4864:20::831]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id CF7D9C06175D for ; Tue, 11 Jan 2022 13:54:58 -0800 (PST) Received: by mail-qt1-x831.google.com with SMTP id b11so806119qtk.12 for ; Tue, 11 Jan 2022 13:54:58 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=106LcaQV+09ecmysXH/0CQoQX/LNoX+Zp7PgkkWnBf0=; b=VJAAjt+GtQdhG1XwQ3QDkdBQZaztuHqjV6xaIHtB6xzPNBqLxX1GGWTvxpwc7fB/H9 4ma9kXBr7ogNSgwQHcOTR4cLCxyJt77xeK5DMDPK7s17W8RKlGQAB4MOhQdbaVcTDO0L E0Ftk66RO5W3q9qIn1txy6GHNzQ1RHTQUQHnbOCGUWRYRPWdsGSV4PUnQxT/bur0+3cu snkdmGS0K3JmKW8dHtkMpZhidimLKi5NoCUsgTzRJU6E3HH6ccZNIUjHciQJNv0FPsvJ vhzppbdMkS8HK4IlZHNiOCgULh5iPxreHOIMYspyt6/HKWpf1NChOiHuVMyMNh9oBU87 1GvQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=106LcaQV+09ecmysXH/0CQoQX/LNoX+Zp7PgkkWnBf0=; b=0Yn5SA6TmijFpV33pWzrR76+ZB6W2ywJ9MFxQnxHHCyM9vVtKS0OIrDT6gjXsN3Ih0 qhEx5/PA7lLHXjCfmuUa/1DIIxLQ9tla50hHzMJSYyjPI9TWHitpz32WhURJzlpHiCqp Mwx7IW/4oNx+GyKSA0gtvUyrsQAIhNy9OxEnXJzaRT/eqEMdOtuc8RoZwcOpLDWBxpt8 67SNDEsPlFEq1j5od6x0B7RJaHq/MyR293fIguqUKwUZXbKYFoESKDX8Wp2xh8sVY5zq JFEQNIcD4wlALHX3JksH1wyIc7+GhvfZpP2D4DoOLSWpsq9OBDegqmp4j3Kt4bHj5npZ mMqw== X-Gm-Message-State: AOAM532+1PjNp7urRpJm7OZsCBqamNzg/scuQbXxeYplzj0/lt80R74D DA4pCkQtsV0yqcigojPgP2k/aw2Kb2o= X-Google-Smtp-Source: ABdhPJwgH7Ul3OpAVZdixMQXTdEYF5EQSIHTxfla2zfYuILSfduhNuby46LW4XsPlviAWJcB4mFDdQ== X-Received: by 2002:ac8:5b92:: with SMTP id a18mr5500783qta.262.1641938097995; Tue, 11 Jan 2022 13:54:57 -0800 (PST) Received: from localhost.localdomain (c-69-250-217-147.hsd1.md.comcast.net. [69.250.217.147]) by smtp.gmail.com with ESMTPSA id j22sm5826949qko.46.2022.01.11.13.54.57 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 11 Jan 2022 13:54:57 -0800 (PST) From: James Carter To: selinux@vger.kernel.org Cc: cgzones@googlemail.com, James Carter Subject: [PATCH 02/16 v2] libsepol: Change label in check_assertion_avtab_match() Date: Tue, 11 Jan 2022 16:54:32 -0500 Message-Id: <20220111215446.595516-3-jwcart2@gmail.com> X-Mailer: git-send-email 2.31.1 In-Reply-To: <20220111215446.595516-1-jwcart2@gmail.com> References: <20220111215446.595516-1-jwcart2@gmail.com> MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: selinux@vger.kernel.org Change the label name from "exit" to "nomatch' to make it clearer what is happening. Signed-off-by: James Carter --- libsepol/src/assertion.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/libsepol/src/assertion.c b/libsepol/src/assertion.c index ba4a204f..d716450f 100644 --- a/libsepol/src/assertion.c +++ b/libsepol/src/assertion.c @@ -454,14 +454,14 @@ static int check_assertion_avtab_match(avtab_key_t *k, avtab_datum_t *d, void *a avtab_t *avtab = a->avtab; if ((k->specified & AVTAB_ALLOWED) == 0) - goto exit; + goto nomatch; if (!match_any_class_permissions(avrule->perms, k->target_class, d->data)) - goto exit; + goto nomatch; rc = ebitmap_match_any(&avrule->stypes.types, &p->attr_type_map[k->source_type - 1]); if (rc == 0) - goto exit; + goto nomatch; if (avrule->flags == RULE_SELF) { /* If the neverallow uses SELF, then it is not enough that the @@ -482,16 +482,16 @@ static int check_assertion_avtab_match(avtab_key_t *k, avtab_datum_t *d, void *a /* neverallow may have tgts even if it uses SELF */ rc = ebitmap_match_any(&avrule->ttypes.types, &p->attr_type_map[k->target_type -1]); if (rc == 0 && rc2 == 0) - goto exit; + goto nomatch; if (avrule->specified == AVRULE_XPERMS_NEVERALLOW) { rc = check_assertion_extended_permissions(avrule, avtab, k, p); if (rc == 0) - goto exit; + goto nomatch; } return 1; -exit: +nomatch: return 0; oom: From patchwork Tue Jan 11 21:54:33 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: James Carter X-Patchwork-Id: 12710788 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 1CE03C433F5 for ; Tue, 11 Jan 2022 21:55:13 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S245624AbiAKVzI (ORCPT ); Tue, 11 Jan 2022 16:55:08 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:48928 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1343494AbiAKVzC (ORCPT ); Tue, 11 Jan 2022 16:55:02 -0500 Received: from mail-qk1-x735.google.com (mail-qk1-x735.google.com [IPv6:2607:f8b0:4864:20::735]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 6A6B6C061245 for ; Tue, 11 Jan 2022 13:54:59 -0800 (PST) Received: by mail-qk1-x735.google.com with SMTP id r139so363784qke.9 for ; Tue, 11 Jan 2022 13:54:59 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=x1f7Wd27K5moNxwApZyWDj3kwRyGoa6lCjO7N9A2Dlc=; b=WslQzrcTTM8zlNkkl14E1pRcYTBCm5+MYEeinBgITGK8Bporof+1C7a8Cp6ujACvyQ dn4FdzE718qmAtlm68zyb/rbCR4WHCAZPS7V9OPIn5rjAQxkWon3LghoEcSJIybFAA/b qHAm4UknIVWLJo7oFVpUGPQgSg9pZiZNN7byK3msyK3uQ4MaOkkZCEKS7vIIeMziyGrn XXOMslGEXMYMR3qfqjc+frn/Av/OwKGjq1s2cYktTm2FtCrmutiOUUgsR3bWk4G1ldbu 5hBkZsvXzSCODfDPYLFs7602KQea0ua1uHBehkixX3XM2nBTQed1miNAN5fZEmq5R4d2 Y/2A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=x1f7Wd27K5moNxwApZyWDj3kwRyGoa6lCjO7N9A2Dlc=; b=U7bGDVRQzQPWdUm40X3Cu7vNGNr2yLyqCKsxRW18zV7VWRlIMCY/PnENF3F8Fun0B5 igVeAnQcTfA+NIG57vfBumxxbXb3gfj0Rvn0Z08pXIe6ahFj8g6NALvUqlJjJEmkreIx SgzF++f70FAugDfpzMfNeYqsQ0ijrs8uq9Rb2p7PmJwSMVHKA03WiKzomW7IOJPVokbj e4ocxZuy2+BxPxbTVmoWetLDTe307pkcdgjy5ln1gJ1HunJZAPZp65NcqZHFuXKQ4hK3 Jv10OWn/RF1Hrg8zBaUyRBQhj////1gPMp5J/GC+CQ8PV3cJg3zuJaObNaBlWxdh6dp5 yCyA== X-Gm-Message-State: AOAM530XuGsUsl2SKGhws4N3dtfpDmPIZz5gbcU9Mzez7gn139DF7UWJ Vkll3wN4HHS1W9/9nDiPlV+/cU+x2rc= X-Google-Smtp-Source: ABdhPJwBt88PW7eIsutlPv1ao04TxXKtyRs+GLgi2b0DSD9rz8UvKUGYP5WuvMU5L/Un70xNv4Ix4Q== X-Received: by 2002:a37:d205:: with SMTP id f5mr4613536qkj.698.1641938098485; Tue, 11 Jan 2022 13:54:58 -0800 (PST) Received: from localhost.localdomain (c-69-250-217-147.hsd1.md.comcast.net. [69.250.217.147]) by smtp.gmail.com with ESMTPSA id j22sm5826949qko.46.2022.01.11.13.54.58 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 11 Jan 2022 13:54:58 -0800 (PST) From: James Carter To: selinux@vger.kernel.org Cc: cgzones@googlemail.com, James Carter Subject: [PATCH 03/16 v2] libsepol: Remove uneeded error messages in assertion checking Date: Tue, 11 Jan 2022 16:54:33 -0500 Message-Id: <20220111215446.595516-4-jwcart2@gmail.com> X-Mailer: git-send-email 2.31.1 In-Reply-To: <20220111215446.595516-1-jwcart2@gmail.com> References: <20220111215446.595516-1-jwcart2@gmail.com> MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: selinux@vger.kernel.org An out of memory condition is unlikely and the general message that an error occured while checking neverallows is sufficient. Signed-off-by: James Carter --- libsepol/src/assertion.c | 6 ------ 1 file changed, 6 deletions(-) diff --git a/libsepol/src/assertion.c b/libsepol/src/assertion.c index d716450f..832d3749 100644 --- a/libsepol/src/assertion.c +++ b/libsepol/src/assertion.c @@ -278,11 +278,8 @@ static int report_assertion_avtab_matches(avtab_key_t *k, avtab_datum_t *d, void } } } - goto exit; oom: - ERR(NULL, "Out of memory - unable to check neverallows"); - exit: ebitmap_destroy(&src_matches); ebitmap_destroy(&tgt_matches); @@ -436,8 +433,6 @@ static int check_assertion_extended_permissions(avrule_t *avrule, avtab_t *avtab goto exit; oom: - ERR(NULL, "Out of memory - unable to check neverallows"); - exit: ebitmap_destroy(&src_matches); ebitmap_destroy(&tgt_matches); @@ -495,7 +490,6 @@ nomatch: return 0; oom: - ERR(NULL, "Out of memory - unable to check neverallows"); return rc; } From patchwork Tue Jan 11 21:54:34 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: James Carter X-Patchwork-Id: 12710787 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id C8DA3C433FE for ; Tue, 11 Jan 2022 21:55:08 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1343585AbiAKVzI (ORCPT ); Tue, 11 Jan 2022 16:55:08 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:48930 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S245624AbiAKVzC (ORCPT ); Tue, 11 Jan 2022 16:55:02 -0500 Received: from mail-qt1-x830.google.com (mail-qt1-x830.google.com [IPv6:2607:f8b0:4864:20::830]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id DAA64C061756 for ; Tue, 11 Jan 2022 13:54:59 -0800 (PST) Received: by mail-qt1-x830.google.com with SMTP id q14so818557qtx.10 for ; Tue, 11 Jan 2022 13:54:59 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=jPkVQCcebJo7Yq9WhSxtz3V4v3wlvtz3YCm1gFtNgv4=; b=bbtRkp1MX7gCaAgMwiJLoXgozORa0isW1OtOQU8JCsyaHNN9c8djOag+v/v2kxgYqE UNXAHeCX/YRgwH0Zyr4VcLEia6BkfP6eMAW8UbUr3FGTlTVH29MLD9UIqA+D/EC1qIaT OwRQOdipY8fqNqouGlSzc06EkJKV2zp8+4GaxsU8a2o2Zwfme57c+oGlvyHY7f4CEBrZ lm23WxfyJ9xYLVu4ccE1WyVGpCSsz4aZfPTkQbCJ0hW1XLGCiZGA2rD3D+TmbHTZgBAz IN1fmgnWV/2eDWinn0ObvVyfond2QEftFP1SzLFX1N3XCxWWtBdPYZZBW8i7ro7p1D5P WXYw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=jPkVQCcebJo7Yq9WhSxtz3V4v3wlvtz3YCm1gFtNgv4=; b=KuYh0Xu1Vx62ExRq1a6DDXbrN679mSlyvFft0XYOfQdfzQRcHlKLyGp3q3xNSkeVY7 lumjQStNJvDFtbkP+sKhWhLPFDGdtnmPNT3knSpVl7Sqxp679l+pwnSoRgdX19jiH27s G/bOd8nGPASII7aRZ3PO3iSD9SHvt6JnAMcaD5wZ3qs6aXn+s9R4DvmwuJdbtgfASrcX 94kS9NykLFs94TCY3Y6yup27KKHyd72Acahy4/blgjIWi4F40KMsUBYZD2ywwKEvKbEA kn3M7foYtFjegu/54korS4tjxlMhjrg/RGVytX5Vst1HBJP949aYG6Zwz7tJW5PRzkpR DYqA== X-Gm-Message-State: AOAM531jDeRHH78iIwNeyTEOPsgX1Zhpp8/VD1wbudPwIMh2lllNplwv TKyWgCPL9MWGH0n3HA+dBCEhA2bEcLg= X-Google-Smtp-Source: ABdhPJyz4IONZtyydPHJMHCIp/sCEiub5kYV32LMrUk0S1NhzgOTFMDOubHn5f1YCJN566RnaXhxow== X-Received: by 2002:a05:622a:164b:: with SMTP id y11mr5395237qtj.621.1641938099039; Tue, 11 Jan 2022 13:54:59 -0800 (PST) Received: from localhost.localdomain (c-69-250-217-147.hsd1.md.comcast.net. [69.250.217.147]) by smtp.gmail.com with ESMTPSA id j22sm5826949qko.46.2022.01.11.13.54.58 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 11 Jan 2022 13:54:58 -0800 (PST) From: James Carter To: selinux@vger.kernel.org Cc: cgzones@googlemail.com, James Carter Subject: [PATCH 04/16 v2] libsepol: Check for error from check_assertion_extended_permissions() Date: Tue, 11 Jan 2022 16:54:34 -0500 Message-Id: <20220111215446.595516-5-jwcart2@gmail.com> X-Mailer: git-send-email 2.31.1 In-Reply-To: <20220111215446.595516-1-jwcart2@gmail.com> References: <20220111215446.595516-1-jwcart2@gmail.com> MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: selinux@vger.kernel.org Return an error if check_assertion_extended_permissions() returns an error instead of treating it as an assertion violation. Signed-off-by: James Carter --- libsepol/src/assertion.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/libsepol/src/assertion.c b/libsepol/src/assertion.c index 832d3749..a2cbb74d 100644 --- a/libsepol/src/assertion.c +++ b/libsepol/src/assertion.c @@ -481,6 +481,8 @@ static int check_assertion_avtab_match(avtab_key_t *k, avtab_datum_t *d, void *a if (avrule->specified == AVRULE_XPERMS_NEVERALLOW) { rc = check_assertion_extended_permissions(avrule, avtab, k, p); + if (rc < 0) + goto oom; if (rc == 0) goto nomatch; } From patchwork Tue Jan 11 21:54:35 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: James Carter X-Patchwork-Id: 12710786 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 92D3DC433F5 for ; Tue, 11 Jan 2022 21:55:08 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1344346AbiAKVzH (ORCPT ); Tue, 11 Jan 2022 16:55:07 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:48964 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1345268AbiAKVzC (ORCPT ); Tue, 11 Jan 2022 16:55:02 -0500 Received: from mail-qk1-x729.google.com (mail-qk1-x729.google.com [IPv6:2607:f8b0:4864:20::729]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 6C87DC061201 for ; Tue, 11 Jan 2022 13:55:00 -0800 (PST) Received: by mail-qk1-x729.google.com with SMTP id r139so363846qke.9 for ; Tue, 11 Jan 2022 13:55:00 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=75EcyTw5P2z4vDUA60U0TG9nAgtXhZm50zN9nmG3df8=; b=OqgxQRPHjUO62T8IviIXG+zyGizV1Mq7rFEB6WqgVXJ8g5aRwYVWh5lEr+jqt8e6M7 aPPfZAM2U7S5C5C2stSfghYZnv3FkNmftNdTmPXINDybox485cX01hJHVS2X5RtiKCiX opk/oRTg4+u2GXqzEBSyWLFybID7h1qD/+kIRIhWHnpGpfGCiezCqSBr9BmS76wtLbie AgUV8KKyy+l5ATiKkuieIvFEM34i5xrlTeD3n/SLFxh7BbWky5QDSJ/T+KyjdxZ3iZSw Or6UoIpdIA/PKvYa71Zkes9FRv2BuwuXh6gOmNZjU+PHgxPHiRWJ4c4Iss2OcDy2Bn9J LPng== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=75EcyTw5P2z4vDUA60U0TG9nAgtXhZm50zN9nmG3df8=; b=fpEv7075T+rWkKQPHe/2zxuloVea+qInvYBw/hXhQ7M1AzNNPdfL6ICJ2iazbtpmF9 aNloA/Jw3zMz2c3iNMSeCmgUNQfp48KQRv9aSpPQie2/9XH4JxACO3GLiDs9wBGQAxPE BPR1WXUypSB+NJwBJsfGREnCA+2137y1zKG6CGN43soxLqNqE9OKcOvDWqEiXE4DhZXU 4KmriZ4DqZ5+0o8sNO6QRlbXDhnuSwi8MCK5p0JCtX74bF46YVgggVC6TQgg5ZMZl6SV 5U7pdA9qPol+rr0qpUlAhYxSkvSphcsXlXLsvqIZ0DaEpGtdIJY0/XjYrsWl6uzK6ssk j1NQ== X-Gm-Message-State: AOAM531+Jk9D7RJft1gOdMULPWi2rPUlm2gIi4moLmown+R2U8vs8Iyq i5CBTD38gJhDK6OGhD5BvdEIkckDs1Y= X-Google-Smtp-Source: ABdhPJxV06F9hVsLat5sn2EWAlt1WMvNE0j47FkcaLs8f8xQc0kkDY6fraRphRtPHfCjpO6TXwQEew== X-Received: by 2002:a37:5f04:: with SMTP id t4mr4686707qkb.190.1641938099573; Tue, 11 Jan 2022 13:54:59 -0800 (PST) Received: from localhost.localdomain (c-69-250-217-147.hsd1.md.comcast.net. [69.250.217.147]) by smtp.gmail.com with ESMTPSA id j22sm5826949qko.46.2022.01.11.13.54.59 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 11 Jan 2022 13:54:59 -0800 (PST) From: James Carter To: selinux@vger.kernel.org Cc: cgzones@googlemail.com, James Carter Subject: [PATCH 05/16 v2] libsepol: Use consistent return checking style Date: Tue, 11 Jan 2022 16:54:35 -0500 Message-Id: <20220111215446.595516-6-jwcart2@gmail.com> X-Mailer: git-send-email 2.31.1 In-Reply-To: <20220111215446.595516-1-jwcart2@gmail.com> References: <20220111215446.595516-1-jwcart2@gmail.com> MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: selinux@vger.kernel.org In check_assertion_avtab_match(), for the functions that do not return an error, but only returns 0 or 1 depending on if a match is found, call the function in an if statement. Signed-off-by: James Carter --- libsepol/src/assertion.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/libsepol/src/assertion.c b/libsepol/src/assertion.c index a2cbb74d..bd0dc4ed 100644 --- a/libsepol/src/assertion.c +++ b/libsepol/src/assertion.c @@ -454,8 +454,7 @@ static int check_assertion_avtab_match(avtab_key_t *k, avtab_datum_t *d, void *a if (!match_any_class_permissions(avrule->perms, k->target_class, d->data)) goto nomatch; - rc = ebitmap_match_any(&avrule->stypes.types, &p->attr_type_map[k->source_type - 1]); - if (rc == 0) + if (!ebitmap_match_any(&avrule->stypes.types, &p->attr_type_map[k->source_type - 1])) goto nomatch; if (avrule->flags == RULE_SELF) { @@ -475,9 +474,10 @@ static int check_assertion_avtab_match(avtab_key_t *k, avtab_datum_t *d, void *a } /* neverallow may have tgts even if it uses SELF */ - rc = ebitmap_match_any(&avrule->ttypes.types, &p->attr_type_map[k->target_type -1]); - if (rc == 0 && rc2 == 0) - goto nomatch; + if (!ebitmap_match_any(&avrule->ttypes.types, &p->attr_type_map[k->target_type -1])) { + if (rc2 == 0) + goto nomatch; + } if (avrule->specified == AVRULE_XPERMS_NEVERALLOW) { rc = check_assertion_extended_permissions(avrule, avtab, k, p); From patchwork Tue Jan 11 21:54:36 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: James Carter X-Patchwork-Id: 12710794 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id D7C45C433F5 for ; Tue, 11 Jan 2022 21:55:15 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S233904AbiAKVzP (ORCPT ); Tue, 11 Jan 2022 16:55:15 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:48934 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1345191AbiAKVzE (ORCPT ); Tue, 11 Jan 2022 16:55:04 -0500 Received: from mail-qk1-x733.google.com (mail-qk1-x733.google.com [IPv6:2607:f8b0:4864:20::733]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id F2A57C061212 for ; Tue, 11 Jan 2022 13:55:00 -0800 (PST) Received: by mail-qk1-x733.google.com with SMTP id t66so392593qkb.4 for ; Tue, 11 Jan 2022 13:55:00 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=dJSIYiK1iYgbVswXsUOfqMg9hjOoN19kqBrH9ke4030=; b=LsufjLZSXNFYKifPP/rlNjuKkf4J+0Pg+2t7nn/QJ80Hg2baAqiD2samqs8RDKHHZh zZF+lQt/cGoUvUCZcWxENUAT4OgCzNlMAZ0QI6eYIC9yqeub4LkCzo+Zc6Ib0Eorkh1E jlfSVWymRsyOVtInj9tk4XSbqzJdPs2Ak4COGt7ywZGLSrAvOkjF5i/RNsxrsHspGq0n scXwBig6Sk79VDLjPkSZwoNfLRUyKNaZAUloIaq3eAugJWKryRP7I2rBd6zsiOYCSvVb 7M37ikNavGqsx6UdW4xe+oJ8CvYBqJSEBkA26oPOr0VIeicM4IF8LDX2aAQ/SaS29pQr Zaqg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=dJSIYiK1iYgbVswXsUOfqMg9hjOoN19kqBrH9ke4030=; b=UFUxBJR7v3o3GkAQcvYsd1a9DDNOO8JVQ7xwWwrLsWdn0LhUSfM4i8yZMpIRMmmBgY sA+F0/shqbpnDvNOWY75IO04qbwWSnWxVWtO5lpvPGVkeeijclkj9zVoxM7zqXPl44c2 qriHSx5VRS6sBhjg8fLHwuj3OvS5FHTwYxlc8WIp4bez1yRkFOz88Zq9Mt2ikGbzfiu+ hCqXdm/KdRZNZMaSTn2r3Gc96AK54KGS+dRieAM5Qciy1pOPz8hSGWqysioh2vjUToCh v6NE72+RSHzu9ujld2SoubVvnQGk8HL6Prbk1GS/i8SUpajcyaGi/8SxuWP0Xeo1P2Jj y5DA== X-Gm-Message-State: AOAM533KRRS7n1PR7/SyHXoRPbj9XbcUgmckZGMlN04xIIFcw/FlGpjj j9gmifZo4gsFfVqys4/Qb6QtSs9rphs= X-Google-Smtp-Source: ABdhPJzGQZ+hFVDBzSk8hZgFP79TasNWj64kNhDcvStrh8v3+H8MvExsB4+6tRG2aO9yhKJy6qn5+A== X-Received: by 2002:a05:620a:12e4:: with SMTP id f4mr4638515qkl.249.1641938100073; Tue, 11 Jan 2022 13:55:00 -0800 (PST) Received: from localhost.localdomain (c-69-250-217-147.hsd1.md.comcast.net. [69.250.217.147]) by smtp.gmail.com with ESMTPSA id j22sm5826949qko.46.2022.01.11.13.54.59 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 11 Jan 2022 13:54:59 -0800 (PST) From: James Carter To: selinux@vger.kernel.org Cc: cgzones@googlemail.com, James Carter Subject: [PATCH 06/16 v2] libsepol: Move check of target types to before check for self Date: Tue, 11 Jan 2022 16:54:36 -0500 Message-Id: <20220111215446.595516-7-jwcart2@gmail.com> X-Mailer: git-send-email 2.31.1 In-Reply-To: <20220111215446.595516-1-jwcart2@gmail.com> References: <20220111215446.595516-1-jwcart2@gmail.com> MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: selinux@vger.kernel.org If a neverallow has target types as well as using self and a match is found with the target types, then self does not even need to be checked, since the rule is already in violation of the assertion. So move the check for a match of the target types before dealing with self. Signed-off-by: James Carter --- libsepol/src/assertion.c | 36 +++++++++++++++++++----------------- 1 file changed, 19 insertions(+), 17 deletions(-) diff --git a/libsepol/src/assertion.c b/libsepol/src/assertion.c index bd0dc4ed..7a1c4a5e 100644 --- a/libsepol/src/assertion.c +++ b/libsepol/src/assertion.c @@ -457,26 +457,28 @@ static int check_assertion_avtab_match(avtab_key_t *k, avtab_datum_t *d, void *a if (!ebitmap_match_any(&avrule->stypes.types, &p->attr_type_map[k->source_type - 1])) goto nomatch; - if (avrule->flags == RULE_SELF) { - /* If the neverallow uses SELF, then it is not enough that the - * neverallow's source matches the src and tgt of the rule being checked. - * It must match the same thing in the src and tgt, so AND the source - * and target together and check for a match on the result. - */ - ebitmap_t match; - rc = ebitmap_and(&match, &p->attr_type_map[k->source_type - 1], &p->attr_type_map[k->target_type - 1] ); - if (rc) { - ebitmap_destroy(&match); - goto oom; - } - rc2 = ebitmap_match_any(&avrule->stypes.types, &match); - ebitmap_destroy(&match); - } - /* neverallow may have tgts even if it uses SELF */ if (!ebitmap_match_any(&avrule->ttypes.types, &p->attr_type_map[k->target_type -1])) { - if (rc2 == 0) + if (avrule->flags == RULE_SELF) { + /* If the neverallow uses SELF, then it is not enough that the + * neverallow's source matches the src and tgt of the rule being checked. + * It must match the same thing in the src and tgt, so AND the source + * and target together and check for a match on the result. + */ + ebitmap_t match; + rc = ebitmap_and(&match, &p->attr_type_map[k->source_type - 1], &p->attr_type_map[k->target_type - 1] ); + if (rc) { + ebitmap_destroy(&match); + goto oom; + } + if (!ebitmap_match_any(&avrule->stypes.types, &match)) { + ebitmap_destroy(&match); + goto nomatch; + } + ebitmap_destroy(&match); + } else { goto nomatch; + } } if (avrule->specified == AVRULE_XPERMS_NEVERALLOW) { From patchwork Tue Jan 11 21:54:37 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: James Carter X-Patchwork-Id: 12710790 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 859D5C433FE for ; Tue, 11 Jan 2022 21:55:15 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1345590AbiAKVzN (ORCPT ); Tue, 11 Jan 2022 16:55:13 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:48974 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1345279AbiAKVzE (ORCPT ); Tue, 11 Jan 2022 16:55:04 -0500 Received: from mail-qt1-x836.google.com (mail-qt1-x836.google.com [IPv6:2607:f8b0:4864:20::836]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 80CC6C0611FD for ; Tue, 11 Jan 2022 13:55:01 -0800 (PST) Received: by mail-qt1-x836.google.com with SMTP id y17so825313qtx.9 for ; Tue, 11 Jan 2022 13:55:01 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=wUkVWMGFzR0RIyDH4k4H7XT087kiExp2zHkWnR8Emyo=; b=F+bkbdda4XF6otL0AXiCzXJJvMaabwNq9xRFschovhlmQbwRrkISKWyBiT6qu5navq 4qtkgbiftBijxaYwA4NEMhfmScO138Hfss11MKSQQ1OTaseiuXinx+t+LGkbih7FqX+n rx+tryK+1Hn88N3Sdp6YPI3hgTeXOZfyJywQZsyNAxxsYbR7+KsTZFVZCBt9D6+zH0s0 Ag+d3iOrPnizT06NDlqzuhhOH89LDh2MTcrjHG7kNmuzl3dznRiyCN4SlFn5lHQdH+tA 7eavxPGjDiqFMrCVX2AEWVR/weUgZ8avhPz4a9KIHi/CpIzsiyvB2unpoWP5NA3lMDDx N7ig== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=wUkVWMGFzR0RIyDH4k4H7XT087kiExp2zHkWnR8Emyo=; b=dnUUJYLOkr2UOaRoDRdWHXbQP44M8+7BO/xjXBfQvAGcxOczphXU3O0PaeZjWkZ7K9 Oyd9jIuiLvTKNOnZmjLOkkLkOulbomQgAVINSlBIIQOr3+QzcjcHZgq4wpNDgGoeX4cU ftaUDnG46h0hV0eB4ZRoRCZGx7ShCxuO9fpGhOxQZ1x/SkpRqYXsvWQZExOOVwn4CJbG VQ3MJBSLU12mD39Ftc+30ay44RkLjsk8zrrGz2oSvhng3ZjQ/AlMA56vJNV6Shm1UIK6 /Zlu+vi3XDHtsx5LJqnmlLuT9p8yf6fcxg1sfz8VJsKMZGz4DzNEB1S04nLpS6I4oCli Pi7A== X-Gm-Message-State: AOAM533euTUIqemOWwN8BzuK94ifoGvJt8qQ+DPiqBX9H2LwtenWkjDJ Rj3SpnFANSZbzChTL8Y6Sz5feClQa1A= X-Google-Smtp-Source: ABdhPJydr56wG1OKzRYwrUJ4lzoNsdAijWvFXhAPzJZuY+bFcAGzEwSms1kNWyn/Hr7hpeL01pjkdA== X-Received: by 2002:a05:622a:44a:: with SMTP id o10mr5552260qtx.251.1641938100632; Tue, 11 Jan 2022 13:55:00 -0800 (PST) Received: from localhost.localdomain (c-69-250-217-147.hsd1.md.comcast.net. [69.250.217.147]) by smtp.gmail.com with ESMTPSA id j22sm5826949qko.46.2022.01.11.13.55.00 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 11 Jan 2022 13:55:00 -0800 (PST) From: James Carter To: selinux@vger.kernel.org Cc: cgzones@googlemail.com, James Carter Subject: [PATCH 07/16 v2] libsepol: Create function check_assertion_self_match() and use it Date: Tue, 11 Jan 2022 16:54:37 -0500 Message-Id: <20220111215446.595516-8-jwcart2@gmail.com> X-Mailer: git-send-email 2.31.1 In-Reply-To: <20220111215446.595516-1-jwcart2@gmail.com> References: <20220111215446.595516-1-jwcart2@gmail.com> MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: selinux@vger.kernel.org Create the function called check_assertion_self_match() and put the self checking code into it. Signed-off-by: James Carter --- v2: Use k->target_type instead of k->source_type in call to ebitmap_match_any() libsepol/src/assertion.c | 45 ++++++++++++++++++++++++++-------------- 1 file changed, 30 insertions(+), 15 deletions(-) diff --git a/libsepol/src/assertion.c b/libsepol/src/assertion.c index 7a1c4a5e..6881c5f6 100644 --- a/libsepol/src/assertion.c +++ b/libsepol/src/assertion.c @@ -440,9 +440,35 @@ exit: return ret; } +static int check_assertion_self_match(avtab_key_t *k, avrule_t *avrule, policydb_t *p) +{ + ebitmap_t src_matches; + int rc; + + /* The key's target must match something in the matches of the avrule's source + * and the key's source. + */ + + rc = ebitmap_and(&src_matches, &avrule->stypes.types, &p->attr_type_map[k->source_type - 1]); + if (rc < 0) + goto oom; + + if (!ebitmap_match_any(&src_matches, &p->attr_type_map[k->target_type - 1])) { + rc = 0; + goto nomatch; + } + + rc = 1; + +oom: +nomatch: + ebitmap_destroy(&src_matches); + return rc; +} + static int check_assertion_avtab_match(avtab_key_t *k, avtab_datum_t *d, void *args) { - int rc, rc2 = 0; + int rc; struct avtab_match_args *a = (struct avtab_match_args *)args; policydb_t *p = a->p; avrule_t *avrule = a->avrule; @@ -460,22 +486,11 @@ static int check_assertion_avtab_match(avtab_key_t *k, avtab_datum_t *d, void *a /* neverallow may have tgts even if it uses SELF */ if (!ebitmap_match_any(&avrule->ttypes.types, &p->attr_type_map[k->target_type -1])) { if (avrule->flags == RULE_SELF) { - /* If the neverallow uses SELF, then it is not enough that the - * neverallow's source matches the src and tgt of the rule being checked. - * It must match the same thing in the src and tgt, so AND the source - * and target together and check for a match on the result. - */ - ebitmap_t match; - rc = ebitmap_and(&match, &p->attr_type_map[k->source_type - 1], &p->attr_type_map[k->target_type - 1] ); - if (rc) { - ebitmap_destroy(&match); + rc = check_assertion_self_match(k, avrule, p); + if (rc < 0) goto oom; - } - if (!ebitmap_match_any(&avrule->stypes.types, &match)) { - ebitmap_destroy(&match); + if (rc == 0) goto nomatch; - } - ebitmap_destroy(&match); } else { goto nomatch; } From patchwork Tue Jan 11 21:54:38 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: James Carter X-Patchwork-Id: 12710789 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 07F44C433EF for ; Tue, 11 Jan 2022 21:55:15 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1343494AbiAKVzK (ORCPT ); Tue, 11 Jan 2022 16:55:10 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:48932 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1345307AbiAKVzE (ORCPT ); Tue, 11 Jan 2022 16:55:04 -0500 Received: from mail-qk1-x72d.google.com (mail-qk1-x72d.google.com [IPv6:2607:f8b0:4864:20::72d]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id EAFBBC0611FF for ; Tue, 11 Jan 2022 13:55:01 -0800 (PST) Received: by mail-qk1-x72d.google.com with SMTP id h16so398544qkp.3 for ; Tue, 11 Jan 2022 13:55:01 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=kSJJxbqAqd96eKdMqq1E9ZVWmim7jioRfBH3JX0prX0=; b=Alu/yVvZppm7spUfTbT+tNQp2NcGGL8yJN4isnsVnNzZaFyzfcQVdWbfpBOCTfow0v eMJ47KkbB48WfgTlTffzddEIXFCgFV68EWDh8OStIKsqZEUJOqnjDTn02e7kq51eVrEi Ssrr7dJ3yW5sg0HGyUTScCTJ1ik0VhxglBsfcMlsbpXtE7F2XTKu2tGpds4pCtP6dbUZ Y4F4G5VB3QOWIB42nZhuh/h9Iu6p9fAffbvC2ghi9OIHy/4CwVahpA4QiT9onaPaY7aK VmoexBNG+LEqQpxWtDf3wJMUC3RHdp5bH7ad0S6X9g9CBlx/r2tzlylomXBOZvmS+MG5 Tecw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=kSJJxbqAqd96eKdMqq1E9ZVWmim7jioRfBH3JX0prX0=; b=BUwpH8H46fh4pSjt8cbHumPwtRSArFtk0WgVog4mUQWCFqXyPprP2WUi4n0w4JUZm/ iN+lWbV02bitb5a2T3Jq9IQ93We/Xf+3rJEbo73U1Mk74flBYpm6ivEZ9DvI538WKR+3 nAIUjqg2n1vtA48ASLJKcJi4CXO4ar/o7HLE/ci/HezcCfGevAAaMMcanvgx4nZY6lOS onF7sUjCeMKZhwjw70WaIXe2Xz2LDAtWLBGJxytQ3CZNnmtvd0we6xTzDBZDC1YYMu9d UKzGUOYJbJseNlUKl/TL2mkYt9oLWcxYqyEtcw7ZpnZyoaoUrEsohPLKoiw+7HXOFJw4 4LvQ== X-Gm-Message-State: AOAM530stFsNxx2XzgaXMFEBG/OdmHsvpRMnkbT8SDVq4VsEPTbD8FDS k7sinDrKB1g0L8juVBCkx8rTgO1yfVg= X-Google-Smtp-Source: ABdhPJyY8StStJ1f4dqGCzb26HQDz8iQlw2tZChbUrFurJy5a+mkxLLvzeLRW7xN4MURmbaAiweOLQ== X-Received: by 2002:a37:a8cc:: with SMTP id r195mr4662440qke.480.1641938101063; Tue, 11 Jan 2022 13:55:01 -0800 (PST) Received: from localhost.localdomain (c-69-250-217-147.hsd1.md.comcast.net. [69.250.217.147]) by smtp.gmail.com with ESMTPSA id j22sm5826949qko.46.2022.01.11.13.55.00 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 11 Jan 2022 13:55:00 -0800 (PST) From: James Carter To: selinux@vger.kernel.org Cc: cgzones@googlemail.com, James Carter Subject: [PATCH 08/16 v2] libsepol: Use (rc < 0) instead of (rc) when calling ebitmap functions Date: Tue, 11 Jan 2022 16:54:38 -0500 Message-Id: <20220111215446.595516-9-jwcart2@gmail.com> X-Mailer: git-send-email 2.31.1 In-Reply-To: <20220111215446.595516-1-jwcart2@gmail.com> References: <20220111215446.595516-1-jwcart2@gmail.com> MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: selinux@vger.kernel.org Inorder to differentiate errors from matches, use "(rc < 0)" when calling ebitmap_* functions while checking neverallow rules. Also, just use rc instead of having a separate variable (ret) in check_assertion_extended_permissions(). Signed-off-by: James Carter --- libsepol/src/assertion.c | 44 ++++++++++++++++++++++------------------ 1 file changed, 24 insertions(+), 20 deletions(-) diff --git a/libsepol/src/assertion.c b/libsepol/src/assertion.c index 6881c5f6..b48169ef 100644 --- a/libsepol/src/assertion.c +++ b/libsepol/src/assertion.c @@ -231,27 +231,27 @@ static int report_assertion_avtab_matches(avtab_key_t *k, avtab_datum_t *d, void rc = ebitmap_and(&src_matches, &avrule->stypes.types, &p->attr_type_map[k->source_type - 1]); - if (rc) + if (rc < 0) goto oom; if (ebitmap_is_empty(&src_matches)) goto exit; rc = ebitmap_and(&tgt_matches, &avrule->ttypes.types, &p->attr_type_map[k->target_type -1]); - if (rc) + if (rc < 0) goto oom; if (avrule->flags == RULE_SELF) { rc = ebitmap_and(&matches, &p->attr_type_map[k->source_type - 1], &p->attr_type_map[k->target_type - 1]); - if (rc) + if (rc < 0) goto oom; rc = ebitmap_and(&self_matches, &avrule->stypes.types, &matches); - if (rc) + if (rc < 0) goto oom; if (!ebitmap_is_empty(&self_matches)) { rc = ebitmap_union(&tgt_matches, &self_matches); - if (rc) + if (rc < 0) goto oom; } } @@ -299,11 +299,11 @@ static int report_assertion_failures(sepol_handle_t *handle, policydb_t *p, avru args.errors = 0; rc = avtab_map(&p->te_avtab, report_assertion_avtab_matches, &args); - if (rc) + if (rc < 0) goto oom; rc = avtab_map(&p->te_cond_avtab, report_assertion_avtab_matches, &args); - if (rc) + if (rc < 0) goto oom; return args.errors; @@ -379,7 +379,6 @@ static int check_assertion_extended_permissions(avrule_t *avrule, avtab_t *avtab ebitmap_node_t *snode, *tnode; class_perm_node_t *cp; int rc; - int ret = 1; ebitmap_init(&src_matches); ebitmap_init(&tgt_matches); @@ -388,56 +387,61 @@ static int check_assertion_extended_permissions(avrule_t *avrule, avtab_t *avtab rc = ebitmap_and(&src_matches, &avrule->stypes.types, &p->attr_type_map[k->source_type - 1]); - if (rc) + if (rc < 0) goto oom; - if (ebitmap_is_empty(&src_matches)) + if (ebitmap_is_empty(&src_matches)) { + rc = 0; goto exit; + } rc = ebitmap_and(&tgt_matches, &avrule->ttypes.types, &p->attr_type_map[k->target_type -1]); - if (rc) + if (rc < 0) goto oom; if (avrule->flags == RULE_SELF) { rc = ebitmap_and(&matches, &p->attr_type_map[k->source_type - 1], &p->attr_type_map[k->target_type - 1]); - if (rc) + if (rc < 0) goto oom; rc = ebitmap_and(&self_matches, &avrule->stypes.types, &matches); - if (rc) + if (rc < 0) goto oom; if (!ebitmap_is_empty(&self_matches)) { rc = ebitmap_union(&tgt_matches, &self_matches); - if (rc) + if (rc < 0) goto oom; } } - if (ebitmap_is_empty(&tgt_matches)) + if (ebitmap_is_empty(&tgt_matches)) { + rc = 0; goto exit; + } for (cp = avrule->perms; cp; cp = cp->next) { if (cp->tclass != k->target_class) continue; ebitmap_for_each_positive_bit(&src_matches, snode, i) { ebitmap_for_each_positive_bit(&tgt_matches, tnode, j) { - ret = check_assertion_extended_permissions_avtab( - avrule, avtab, i, j, k, p); - if (ret) + if (check_assertion_extended_permissions_avtab(avrule, avtab, i, j, k, p)) { + rc = 1; goto exit; + } } } } - goto exit; + + rc = 0; oom: exit: ebitmap_destroy(&src_matches); ebitmap_destroy(&tgt_matches); ebitmap_destroy(&matches); - return ret; + return rc; } static int check_assertion_self_match(avtab_key_t *k, avrule_t *avrule, policydb_t *p) From patchwork Tue Jan 11 21:54:39 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: James Carter X-Patchwork-Id: 12710792 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 28CC3C4332F for ; Tue, 11 Jan 2022 21:55:16 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1345076AbiAKVzP (ORCPT ); Tue, 11 Jan 2022 16:55:15 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:48976 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1345361AbiAKVzE (ORCPT ); Tue, 11 Jan 2022 16:55:04 -0500 Received: from mail-qk1-x72f.google.com (mail-qk1-x72f.google.com [IPv6:2607:f8b0:4864:20::72f]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 85F57C06175A for ; Tue, 11 Jan 2022 13:55:02 -0800 (PST) Received: by mail-qk1-x72f.google.com with SMTP id 82so357497qki.10 for ; Tue, 11 Jan 2022 13:55:02 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=h5IQn+wjR96hczfWvjDPMValHg7jyFmrTziQGvCJVSQ=; b=YtJTmO7vaueueQSIxNYp5P27mcvUJuNSVR+lxWbiee2tbQ6z5ZKg5pnvbKavppxShO 9izWR9dGp21CwTgsUDqeBjXcjWmBCI5nE7m6DRxeXzBta/R4p60TSwtuLPEN4MKX2Qna dRi9ghE56fPK4/Q6de/+Tkm8QnD1sQjbm+eqM9d6AmLeB7XP2fiI+ccPTHRD57lPagcT 4NrT2DLsiEQ67txBQj0egv0PLbLvtOk1+c8q1lVf+jnN9TXgIy/bXGpbZT8jAPAeBrhZ GHYQlnPN++jGlbWISKLEEUE17spgy/7LanolxMpOL2xjbRvjXhKQUFO4KkIMRepRq5GH t28w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=h5IQn+wjR96hczfWvjDPMValHg7jyFmrTziQGvCJVSQ=; b=Ce75vqFl5fHRZtCB/p8UaZw5CVIRe1FSqZStk8tzMqbV0AYKYppWWhzpN2VjgF2ulO qGBuOWMJpxiBq7G4ZYehvlrKt5WELVLTv/PM1jT3NXlPurfRBv4eYL6AH2EePOEVf2Yg hUsZGS9YKCXa/gF9gYOnOwzTWJgZRLKVxOLn/oodwHfs+MHDP9+GNGxE4JHWFAIpW16n fbWySSNL97o048WHF+hU3Y8k+24NgHm6tmRKZruSuQgeFYH7QHs7iy0KpAupAQQDjvlg /k5MH0UqxarVXlLFcFUELfTSIe7MO+mpsLIMp+Zn78s40ytjPHG2ptPGPgYUKl2eseT4 v8Mg== X-Gm-Message-State: AOAM533AuxbFxLiWlnduAT0hPP6LmSDX3b50yVzXuEaKJJ1y9LBgCSGy V4FN5v/v8CvfcUe40NvHEJODMPFYyIs= X-Google-Smtp-Source: ABdhPJzxL5SVrH1Kjhg537ND5UjXeGLxaKMRgAWB+to0Czal4Wv+uICIG5haGHDU9guZfoJFWaNsDg== X-Received: by 2002:a05:620a:178b:: with SMTP id ay11mr4513672qkb.420.1641938101639; Tue, 11 Jan 2022 13:55:01 -0800 (PST) Received: from localhost.localdomain (c-69-250-217-147.hsd1.md.comcast.net. [69.250.217.147]) by smtp.gmail.com with ESMTPSA id j22sm5826949qko.46.2022.01.11.13.55.01 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 11 Jan 2022 13:55:01 -0800 (PST) From: James Carter To: selinux@vger.kernel.org Cc: cgzones@googlemail.com, James Carter Subject: [PATCH 09/16 v2] libsepol: Remove unnessesary check for matching class Date: Tue, 11 Jan 2022 16:54:39 -0500 Message-Id: <20220111215446.595516-10-jwcart2@gmail.com> X-Mailer: git-send-email 2.31.1 In-Reply-To: <20220111215446.595516-1-jwcart2@gmail.com> References: <20220111215446.595516-1-jwcart2@gmail.com> MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: selinux@vger.kernel.org When check_assertion_extended_permissions() is called, it has already been determined that there is a match, and, since neither the class nor the permissions are used, there is no need for the check. Signed-off-by: James Carter --- libsepol/src/assertion.c | 15 +++++---------- 1 file changed, 5 insertions(+), 10 deletions(-) diff --git a/libsepol/src/assertion.c b/libsepol/src/assertion.c index b48169ef..42fa87d9 100644 --- a/libsepol/src/assertion.c +++ b/libsepol/src/assertion.c @@ -377,7 +377,6 @@ static int check_assertion_extended_permissions(avrule_t *avrule, avtab_t *avtab ebitmap_t src_matches, tgt_matches, self_matches, matches; unsigned int i, j; ebitmap_node_t *snode, *tnode; - class_perm_node_t *cp; int rc; ebitmap_init(&src_matches); @@ -421,15 +420,11 @@ static int check_assertion_extended_permissions(avrule_t *avrule, avtab_t *avtab goto exit; } - for (cp = avrule->perms; cp; cp = cp->next) { - if (cp->tclass != k->target_class) - continue; - ebitmap_for_each_positive_bit(&src_matches, snode, i) { - ebitmap_for_each_positive_bit(&tgt_matches, tnode, j) { - if (check_assertion_extended_permissions_avtab(avrule, avtab, i, j, k, p)) { - rc = 1; - goto exit; - } + ebitmap_for_each_positive_bit(&src_matches, snode, i) { + ebitmap_for_each_positive_bit(&tgt_matches, tnode, j) { + if (check_assertion_extended_permissions_avtab(avrule, avtab, i, j, k, p)) { + rc = 1; + goto exit; } } } From patchwork Tue Jan 11 21:54:40 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: James Carter X-Patchwork-Id: 12710791 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id DA187C43219 for ; Tue, 11 Jan 2022 21:55:16 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1345170AbiAKVzQ (ORCPT ); Tue, 11 Jan 2022 16:55:16 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:48940 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1345404AbiAKVzE (ORCPT ); Tue, 11 Jan 2022 16:55:04 -0500 Received: from mail-qt1-x82a.google.com (mail-qt1-x82a.google.com [IPv6:2607:f8b0:4864:20::82a]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 0BC96C034000 for ; Tue, 11 Jan 2022 13:55:03 -0800 (PST) Received: by mail-qt1-x82a.google.com with SMTP id l17so839084qtk.7 for ; Tue, 11 Jan 2022 13:55:03 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=9gRanSiycO/zRRQM7PRkt+DCm4KzjHr1EXVa37LNDsg=; b=UxTdXEUT3alcI3RD9PuNaH10zlXDpHJiQH7SyzGNREIfaPRSS3CTahym2Faiy4zbi9 +Zmp91UClYv76YpO8VyZ/HsvZWrpd7VTtmkM7S5kADQA5i9YTzBbLxmvOYkLsPN8YV4t UDvvwdxikt459Ci2tAaZGxtXWXrSUORzMpM5CV7Gc5T6N2ZBYjcpSOsRvdQiXKEHiiGY gXrMdNoEIYWmrrh+0TmAVIoQsXxhjvxT2pMwezLBmtHO+C/aOuIs1FO28jRFXoY1nLzZ aPHzKhoLbyUIdd7MGnzYeZTVxXFLAgCCXn+7NTJBDMcolx2g3iRBZX+IubdgYat5sYjm ZAwA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=9gRanSiycO/zRRQM7PRkt+DCm4KzjHr1EXVa37LNDsg=; b=eWJP3p8vI9+RZULNZquRVP9JRbToG869MqhRTYEWCWI1TPFykl9sbn5ylxKFYjP+C8 lhvYGo//j5HykYRvxcnGkMbyFeSfY9Y62BqCclesSg7gtkBEjREgvFJGp2fbUhk/aQ2K taTrOyT88DndVxo4x57qao84/kWu6xBObhiU2t54ZVrIIwp49ryt4InU+fJjxfI3nc47 AEnZANch37Ol09pF16j0cQzNaVWUwid9FgAUOInGPYVVxlpJeca5ANgy2j8ciU3mz2e/ IjZdIQgNl+uscz0eUWAxpVVIZ4or1NwbNlt7LhYSEUDzOSOFkhahGNf3IgMh96e+noIY veiA== X-Gm-Message-State: AOAM531ld3T7Z95ot1i3YVymXhZedGgtbaLVWOEZVXrmSLb0tAnbOLEj htv++pYhcok+mz+zSgJBZ/nCONGIbMc= X-Google-Smtp-Source: ABdhPJys4KTVBmRTmoCzaP3xLaHOCzuLiA95fDujQmeRqGO5WhJq+wMcuFlnNgbCG+SBryUZ0VjnZg== X-Received: by 2002:a05:622a:130b:: with SMTP id v11mr384786qtk.355.1641938102143; Tue, 11 Jan 2022 13:55:02 -0800 (PST) Received: from localhost.localdomain (c-69-250-217-147.hsd1.md.comcast.net. [69.250.217.147]) by smtp.gmail.com with ESMTPSA id j22sm5826949qko.46.2022.01.11.13.55.01 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 11 Jan 2022 13:55:01 -0800 (PST) From: James Carter To: selinux@vger.kernel.org Cc: cgzones@googlemail.com, James Carter Subject: [PATCH 10/16 v2] libsepol: Move assigning outer loop index out of inner loop Date: Tue, 11 Jan 2022 16:54:40 -0500 Message-Id: <20220111215446.595516-11-jwcart2@gmail.com> X-Mailer: git-send-email 2.31.1 In-Reply-To: <20220111215446.595516-1-jwcart2@gmail.com> References: <20220111215446.595516-1-jwcart2@gmail.com> MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: selinux@vger.kernel.org Assign value based on outer loop index in the outer loop instead of the inner loop. Signed-off-by: James Carter --- libsepol/src/assertion.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/libsepol/src/assertion.c b/libsepol/src/assertion.c index 42fa87d9..9c09eef3 100644 --- a/libsepol/src/assertion.c +++ b/libsepol/src/assertion.c @@ -158,8 +158,8 @@ static int report_assertion_extended_permissions(sepol_handle_t *handle, tmp_key.specified = AVTAB_XPERMS_ALLOWED; ebitmap_for_each_positive_bit(sattr, snode, i) { + tmp_key.source_type = i + 1; ebitmap_for_each_positive_bit(tattr, tnode, j) { - tmp_key.source_type = i + 1; tmp_key.target_type = j + 1; for (node = avtab_search_node(avtab, &tmp_key); node; @@ -334,8 +334,8 @@ static int check_assertion_extended_permissions_avtab(avrule_t *avrule, avtab_t tmp_key.specified = AVTAB_XPERMS_ALLOWED; ebitmap_for_each_positive_bit(sattr, snode, i) { + tmp_key.source_type = i + 1; ebitmap_for_each_positive_bit(tattr, tnode, j) { - tmp_key.source_type = i + 1; tmp_key.target_type = j + 1; for (node = avtab_search_node(avtab, &tmp_key); node; From patchwork Tue Jan 11 21:54:41 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: James Carter X-Patchwork-Id: 12710793 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 4DA7AC43217 for ; Tue, 11 Jan 2022 21:55:17 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234692AbiAKVzQ (ORCPT ); Tue, 11 Jan 2022 16:55:16 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:48948 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1345437AbiAKVzE (ORCPT ); Tue, 11 Jan 2022 16:55:04 -0500 Received: from mail-qt1-x82f.google.com (mail-qt1-x82f.google.com [IPv6:2607:f8b0:4864:20::82f]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 8BD7EC034001 for ; Tue, 11 Jan 2022 13:55:03 -0800 (PST) Received: by mail-qt1-x82f.google.com with SMTP id s19so848823qtc.5 for ; Tue, 11 Jan 2022 13:55:03 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=M5T03bEnp5V21xYQMv2byghA2J4HbcGOzDNBumOeQk0=; b=DvKFujzD6bHSu/WfEXEpxibsCK2feVNz/GXmbhhKaZLJGUU5pZ4oqWPLDZONUD0fTD SECeUaP1g5UMWt0cjvvlMmEWuPNgEeZ2DQerX4qmt5aLBUQNOqQMNu6JC2uP8AySaaGw MoC9RUojUuEeQxl1ujlU2yKnGn37Ruf3Hu2DTWG6jP/quKMEwMnS0GmvqITfU3xEqs0A 7MEOuSm/wlR4PLuY/Wc7fi562etOek2sWoyf8VZItfwS8e14dBcgi+3Vh/nmuhu7nWBD ar4XIIwHZT1O5nGTOODdJan3VKI0nrc/aVgKryRUGu49KTM5BsOMxvAz7v2viibcvYv1 A+mw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=M5T03bEnp5V21xYQMv2byghA2J4HbcGOzDNBumOeQk0=; b=PDX38zL7hA9bM1OJwPHtdviyWpoE1v2B8nmDgdNLWjbcOAgePnFk8ei7nzq1uDzF8E wIOclMRUanWhUhBRxIB09pSNmlzAzb1GGC3ocCbkJmGWqFxVrV2S2+cNe+NmiAXvLly2 YkuSOxuyChVCidago/eJ2kMoX0GhxszxDGrTC7WbNpAa6S1ViAsdCYARB14bxz5blDG8 CupDEQL4LWhAor/Wf90oap+80AZxUlwbO/PHjY2QV9ULNY6TiV3CRjoeKWPW1wKu3JMl HDxFeOa8WW7j8AMX6oapobqg8NAro9n/mg57qWmjaCh3SQT8Luswflx+MmoNeglthyS5 M51A== X-Gm-Message-State: AOAM53020RQ04a/1Zv5p8PORGpq5emlwqLBzUKs8M0qL8YHSzK2KATB1 z5o9KS0oBvnJzILP7urx1g3iIP3tNvs= X-Google-Smtp-Source: ABdhPJxhXaspz/RWnA+6kT6Utfff1jlXEBrYcHbVlcwhqJoWH6QL39p9yCyqrJx/PPHPJBSshrIIpg== X-Received: by 2002:a05:622a:1b86:: with SMTP id bp6mr5529584qtb.157.1641938102676; Tue, 11 Jan 2022 13:55:02 -0800 (PST) Received: from localhost.localdomain (c-69-250-217-147.hsd1.md.comcast.net. [69.250.217.147]) by smtp.gmail.com with ESMTPSA id j22sm5826949qko.46.2022.01.11.13.55.02 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 11 Jan 2022 13:55:02 -0800 (PST) From: James Carter To: selinux@vger.kernel.org Cc: cgzones@googlemail.com, James Carter Subject: [PATCH 11/16 v2] libsepol: Make use of previously created ebitmap when checking self Date: Tue, 11 Jan 2022 16:54:41 -0500 Message-Id: <20220111215446.595516-12-jwcart2@gmail.com> X-Mailer: git-send-email 2.31.1 In-Reply-To: <20220111215446.595516-1-jwcart2@gmail.com> References: <20220111215446.595516-1-jwcart2@gmail.com> MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: selinux@vger.kernel.org In both check_assertion_extended_permissions() and report_assertion_avtab_matches(), when checking for a match involving a rule using self, the matches between the source and target of the rule being checked are found using ebitmap_and() and then the matches between that result and the source of the neverallow are found using another ebitmap_and() call. Since the matches between the sources of the rule being checked and the neverallow have already been found, just find the matches between that result and the target of the rule being checked. This only requires one call to ebitmap_and() instead of two. Signed-off-by: James Carter --- libsepol/src/assertion.c | 20 +++++--------------- 1 file changed, 5 insertions(+), 15 deletions(-) diff --git a/libsepol/src/assertion.c b/libsepol/src/assertion.c index 9c09eef3..71ee7815 100644 --- a/libsepol/src/assertion.c +++ b/libsepol/src/assertion.c @@ -214,7 +214,7 @@ static int report_assertion_avtab_matches(avtab_key_t *k, avtab_datum_t *d, void avrule_t *avrule = a->avrule; class_perm_node_t *cp; uint32_t perms; - ebitmap_t src_matches, tgt_matches, self_matches, matches; + ebitmap_t src_matches, tgt_matches, self_matches; ebitmap_node_t *snode, *tnode; unsigned int i, j; @@ -227,7 +227,6 @@ static int report_assertion_avtab_matches(avtab_key_t *k, avtab_datum_t *d, void ebitmap_init(&src_matches); ebitmap_init(&tgt_matches); ebitmap_init(&self_matches); - ebitmap_init(&matches); rc = ebitmap_and(&src_matches, &avrule->stypes.types, &p->attr_type_map[k->source_type - 1]); @@ -242,10 +241,7 @@ static int report_assertion_avtab_matches(avtab_key_t *k, avtab_datum_t *d, void goto oom; if (avrule->flags == RULE_SELF) { - rc = ebitmap_and(&matches, &p->attr_type_map[k->source_type - 1], &p->attr_type_map[k->target_type - 1]); - if (rc < 0) - goto oom; - rc = ebitmap_and(&self_matches, &avrule->stypes.types, &matches); + rc = ebitmap_and(&self_matches, &src_matches, &p->attr_type_map[k->target_type - 1]); if (rc < 0) goto oom; @@ -284,7 +280,6 @@ exit: ebitmap_destroy(&src_matches); ebitmap_destroy(&tgt_matches); ebitmap_destroy(&self_matches); - ebitmap_destroy(&matches); return rc; } @@ -374,7 +369,7 @@ static int check_assertion_extended_permissions_avtab(avrule_t *avrule, avtab_t static int check_assertion_extended_permissions(avrule_t *avrule, avtab_t *avtab, avtab_key_t *k, policydb_t *p) { - ebitmap_t src_matches, tgt_matches, self_matches, matches; + ebitmap_t src_matches, tgt_matches, self_matches; unsigned int i, j; ebitmap_node_t *snode, *tnode; int rc; @@ -382,7 +377,6 @@ static int check_assertion_extended_permissions(avrule_t *avrule, avtab_t *avtab ebitmap_init(&src_matches); ebitmap_init(&tgt_matches); ebitmap_init(&self_matches); - ebitmap_init(&matches); rc = ebitmap_and(&src_matches, &avrule->stypes.types, &p->attr_type_map[k->source_type - 1]); @@ -400,11 +394,7 @@ static int check_assertion_extended_permissions(avrule_t *avrule, avtab_t *avtab goto oom; if (avrule->flags == RULE_SELF) { - rc = ebitmap_and(&matches, &p->attr_type_map[k->source_type - 1], - &p->attr_type_map[k->target_type - 1]); - if (rc < 0) - goto oom; - rc = ebitmap_and(&self_matches, &avrule->stypes.types, &matches); + rc = ebitmap_and(&self_matches, &src_matches, &p->attr_type_map[k->target_type - 1]); if (rc < 0) goto oom; @@ -435,7 +425,7 @@ oom: exit: ebitmap_destroy(&src_matches); ebitmap_destroy(&tgt_matches); - ebitmap_destroy(&matches); + ebitmap_destroy(&self_matches); return rc; } From patchwork Tue Jan 11 21:54:42 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: James Carter X-Patchwork-Id: 12710795 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 0461EC433EF for ; Tue, 11 Jan 2022 21:55:18 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234206AbiAKVzR (ORCPT ); Tue, 11 Jan 2022 16:55:17 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:48984 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1345466AbiAKVzE (ORCPT ); Tue, 11 Jan 2022 16:55:04 -0500 Received: from mail-qv1-xf2e.google.com (mail-qv1-xf2e.google.com [IPv6:2607:f8b0:4864:20::f2e]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 05111C06175C for ; Tue, 11 Jan 2022 13:55:04 -0800 (PST) Received: by mail-qv1-xf2e.google.com with SMTP id p12so806371qvj.6 for ; Tue, 11 Jan 2022 13:55:03 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=dOlUD/6M8RpYf4A/EhuDic2deC8FqdjLFmW+hM25Zbs=; b=C1AknvRbWn7/tUN3zF90B8Nk3fl2tkFZJzPeX2POLEXRdjeESjVMr9E24aEuygpwb8 /q0BVMyvjmDRjN9ue47X0xq0hrsOY2GJh3RINWXZXeY4i6yCXfvIpyfsyBu4w7nsNkRJ lGVl4tpSUo5wuhBvw/Hga4P3PtkHLYoPIssjaSR9FtKX5alAOuEKl9rcMLQaks0Mfn1C v8OBFx8G50hF1lEGHPTLl3zRxZwl3BXe4HpfJEuu8KD23EvtQeXn1HdyLF4SIxIcp2b3 DC/bAKoS1YEQ0VQFUNMBuVF9SOB+l5E9J2WKUNo6bBEENK5eAItVrGkreY7h7+N/C+Zy GXdQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=dOlUD/6M8RpYf4A/EhuDic2deC8FqdjLFmW+hM25Zbs=; b=ffKnRQrf2PodN28GlMEzANFqiJLIRS4bvICoXqt2UF4VMfjHbCawUOh0mxzkMeLLDJ SvlBwQVq7O4KiDYvqyJ1Cdy6P6LMYGhuYxE2Z0EoBWTCYl8YlcaQZDzcUVapoPFKrqUp /qzvNp/BpHNFVBgpPZCrLiyAZofH8y1polUTJLbSaBO5BLAjoKX11PXXt51++Dpca6gj maxMi0MrAvADF8htafPhDxdqagNyjwPvhXYBYAYswktaFuYtrfmIPFFckAihs6As7WR3 daXMxH2dQQcuz06prj5oXrQkTAXImsAG/lbsws4c+GCty0wvQBvDVTVInmPVj8SeUOSu Zwtw== X-Gm-Message-State: AOAM531m3aFiJLGmwHhhJVhyy0X9627G/I20/7HE2r9Botl/RtzeY9rX dRn7jFAhOk4bxZTLS3Pb38qP1sjBgac= X-Google-Smtp-Source: ABdhPJxipt+706saINZZZiA2rOfsobK6UfIWSyceFYshB+WpyEDYQVlOzEZRls7Ns6XcddbcYgOD4A== X-Received: by 2002:a05:6214:c65:: with SMTP id t5mr5720862qvj.111.1641938103170; Tue, 11 Jan 2022 13:55:03 -0800 (PST) Received: from localhost.localdomain (c-69-250-217-147.hsd1.md.comcast.net. [69.250.217.147]) by smtp.gmail.com with ESMTPSA id j22sm5826949qko.46.2022.01.11.13.55.02 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 11 Jan 2022 13:55:02 -0800 (PST) From: James Carter To: selinux@vger.kernel.org Cc: cgzones@googlemail.com, James Carter Subject: [PATCH 12/16 v2] libsepol: Refactor match_any_class_permissions() to be clearer Date: Tue, 11 Jan 2022 16:54:42 -0500 Message-Id: <20220111215446.595516-13-jwcart2@gmail.com> X-Mailer: git-send-email 2.31.1 In-Reply-To: <20220111215446.595516-1-jwcart2@gmail.com> References: <20220111215446.595516-1-jwcart2@gmail.com> MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: selinux@vger.kernel.org Signed-off-by: James Carter --- libsepol/src/assertion.c | 9 +++------ 1 file changed, 3 insertions(+), 6 deletions(-) diff --git a/libsepol/src/assertion.c b/libsepol/src/assertion.c index 71ee7815..26fa8d96 100644 --- a/libsepol/src/assertion.c +++ b/libsepol/src/assertion.c @@ -65,14 +65,11 @@ static void report_failure(sepol_handle_t *handle, policydb_t *p, const avrule_t static int match_any_class_permissions(class_perm_node_t *cp, uint32_t class, uint32_t data) { for (; cp; cp = cp->next) { - if ((cp->tclass == class) && (cp->data & data)) { - break; - } + if ((cp->tclass == class) && (cp->data & data)) + return 1; } - if (!cp) - return 0; - return 1; + return 0; } static int extended_permissions_and(uint32_t *perms1, uint32_t *perms2) { From patchwork Tue Jan 11 21:54:43 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: James Carter X-Patchwork-Id: 12710796 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 40B68C433FE for ; Tue, 11 Jan 2022 21:55:19 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1345361AbiAKVzR (ORCPT ); Tue, 11 Jan 2022 16:55:17 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:48986 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234033AbiAKVzE (ORCPT ); Tue, 11 Jan 2022 16:55:04 -0500 Received: from mail-qt1-x82b.google.com (mail-qt1-x82b.google.com [IPv6:2607:f8b0:4864:20::82b]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 968B3C061748 for ; Tue, 11 Jan 2022 13:55:04 -0800 (PST) Received: by mail-qt1-x82b.google.com with SMTP id v7so807858qtw.13 for ; Tue, 11 Jan 2022 13:55:04 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=HqowdsrtetExLhFsrH9aI0xzH9bMziJ8hdFMjMvbq88=; b=nU85OLSLlOtiRkTNKB2vjy3+k+vxxICYc0qKNMbdr266y6wIoMHaedRzoHct6LhuYl pCSBr14v/OhqKgsj/75tntL9T4y2LXxaZqvVnbwITIcuUYi6RG2DgkAFn3LhAaX8QtVX uNPT5t4dhzrnETzBEhSNn0QsQxVFBlYcTvu8tkMGuziblzESVMenl5u0LLzyQ/n18MAk Xv3sXuiyrIGwa8/IwNpjD9aUoAM10x7OOb+PDb+sBBqAcWEPnyl++q8g2fEbq9f4nZ4i 4JJlNtbGa1wZURRPszbzpaU9lnYbbh3WKn3TqQqZDuxs9dNBlGc6MgtqIxy8TvMmna0a t8SA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=HqowdsrtetExLhFsrH9aI0xzH9bMziJ8hdFMjMvbq88=; b=Zy8CMuSVKNfvmeh6YfrQzJOkuWMXAse6bKVh487zi/4zZWFE5NIdrrTJNS4qNphUXW NsD2JOZPl+Ee1N88Z74W8hxoafDlgJsDrgXm6KAU5N7zQ/BJcpQPuDfI+guzCWLSKDyW byitd2NhHhUA1qIJNUe/MiazZjOx2L80LNjZrP1VH1cX4RpNAOshoOa2gUQSfyfSnH8M TynMJZl+A5eg5dZIXVm9sIjLWiLqVUOFM20jV5L0NcOceecmG1WYlNkUjSguL4SXsPal fTHGoYPnmwl3IXd2mBZ72lM0pM1vfRY5lklEx0yxP7y0bqo/lju0DgfTtHOvqosT06JA TWCA== X-Gm-Message-State: AOAM532PYwIouXBW03bkA4q65uyvt2AKBgC4Rom2cidEAmJTx8Vm1+TJ giBYIEq+U3zNO1w6zsj2gl3vaBTsPPM= X-Google-Smtp-Source: ABdhPJzTsOwGn+9gHkY/invrveLs/mfGIAJK5mrmzfZIMoo75ay+HWXFcX+eDf3RsLbJROzmxZ4h2Q== X-Received: by 2002:a05:622a:1054:: with SMTP id f20mr4921516qte.132.1641938103694; Tue, 11 Jan 2022 13:55:03 -0800 (PST) Received: from localhost.localdomain (c-69-250-217-147.hsd1.md.comcast.net. [69.250.217.147]) by smtp.gmail.com with ESMTPSA id j22sm5826949qko.46.2022.01.11.13.55.03 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 11 Jan 2022 13:55:03 -0800 (PST) From: James Carter To: selinux@vger.kernel.org Cc: cgzones@googlemail.com, James Carter Subject: [PATCH 13/16 v2] libsepol: Make return value clearer when reporting neverallowx errors Date: Tue, 11 Jan 2022 16:54:43 -0500 Message-Id: <20220111215446.595516-14-jwcart2@gmail.com> X-Mailer: git-send-email 2.31.1 In-Reply-To: <20220111215446.595516-1-jwcart2@gmail.com> References: <20220111215446.595516-1-jwcart2@gmail.com> MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: selinux@vger.kernel.org The value returned from report_assertion_extended_permissions() is the nubmer of errors, so call it that instead of ret. Signed-off-by: James Carter --- libsepol/src/assertion.c | 13 ++++++------- 1 file changed, 6 insertions(+), 7 deletions(-) diff --git a/libsepol/src/assertion.c b/libsepol/src/assertion.c index 26fa8d96..93c57061 100644 --- a/libsepol/src/assertion.c +++ b/libsepol/src/assertion.c @@ -148,8 +148,8 @@ static int report_assertion_extended_permissions(sepol_handle_t *handle, ebitmap_t *tattr = &p->type_attr_map[ttype]; ebitmap_node_t *snode, *tnode; unsigned int i, j; - int rc = 1; - int ret = 0; + int rc; + int errors = 0; memcpy(&tmp_key, k, sizeof(avtab_key_t)); tmp_key.specified = AVTAB_XPERMS_ALLOWED; @@ -178,15 +178,14 @@ static int report_assertion_extended_permissions(sepol_handle_t *handle, p->p_class_val_to_name[curperm->tclass - 1], sepol_extended_perms_to_string(&error)); - rc = 0; - ret++; + errors++; } } } } /* failure on the regular permissions */ - if (rc) { + if (!errors) { ERR(handle, "neverallowxperm on line %lu of %s (or line %lu of policy.conf) violated by\n" "allow %s %s:%s {%s };", avrule->source_line, avrule->source_filename, avrule->line, @@ -194,11 +193,11 @@ static int report_assertion_extended_permissions(sepol_handle_t *handle, p->p_type_val_to_name[ttype], p->p_class_val_to_name[curperm->tclass - 1], sepol_av_to_string(p, curperm->tclass, perms)); - ret++; + errors++; } - return ret; + return errors; } static int report_assertion_avtab_matches(avtab_key_t *k, avtab_datum_t *d, void *args) From patchwork Tue Jan 11 21:54:44 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: James Carter X-Patchwork-Id: 12710797 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 8AD55C4321E for ; Tue, 11 Jan 2022 21:55:19 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1345391AbiAKVzS (ORCPT ); Tue, 11 Jan 2022 16:55:18 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:48954 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1345518AbiAKVzF (ORCPT ); Tue, 11 Jan 2022 16:55:05 -0500 Received: from mail-qv1-xf2e.google.com (mail-qv1-xf2e.google.com [IPv6:2607:f8b0:4864:20::f2e]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 03E11C06175B for ; Tue, 11 Jan 2022 13:55:05 -0800 (PST) Received: by mail-qv1-xf2e.google.com with SMTP id r6so767125qvr.13 for ; Tue, 11 Jan 2022 13:55:04 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=/oGXUnaG67opnE2dI+Wcfc77eKI5xjFbB3YQCwNs8BM=; b=hIux8aXTMNCWTrRbXZ3BZOXzZC1MHD4ZSquXjrFqO6dG4r2AD2JnYQySUbwAN9Zv9V wZNgFRbC7o0KZIz5AzMDWl1jxZDqiyw/lRE1jRXB2YVe9HhnWLNpCJKliPSW/tUccDtZ DJrU8NFMsoV209g+B/K4Eeg/bbibCQpYlTOiBzRdKs834wOM1AGUvZgF7shWN7d8Kqz0 FbLcIYdirHphmZtoCWBCGI7PuzVOpBAb5bL8AqrcPSQ6bzNgXtZtrYhpe2EZP/EmOhhm XS4e8AKtEY53/39xKqtGKrn3SLE2JqG1ir5e06JjuRyb3j9nYS4RX3QVgt5bFdYtEkO1 z9+g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=/oGXUnaG67opnE2dI+Wcfc77eKI5xjFbB3YQCwNs8BM=; b=BMUAcIiG7minp5X8cvJVYPoQUUnAUclMdIUNes1oQfY24KeL+2Uy4/09thQmkaie9K 7AYnA3wSiNw4UpJfCSrVIiAar7dKCZh4aQW9Mt099mPHSo98ZyATlXZFtZfjvTEjxvwQ jP8/1SSyi0ja73O8AJ9gFKEgGmWzL6V8MxsSHCC7Q+xziP/GxT46UhZrGWSJq3fT1+Bl DITokpv6MZ1+u2reeSiW4b/uUngTav7FkGNVfh8Z1vb1I14+pDQZoio3fuCF0URMaqUN Xj5efgmdJ4fCN4Sc9PsJT1lrQdZ7yPIehymbUDaUJpHZITWGt8sD+jkzyTJsD0MwFnrV MD9w== X-Gm-Message-State: AOAM5316XlyXHGbWePJyvQVRntTv57qBXyXab2xapylifJz/6KYXMxvG e/v11IRS0ZJXcdzB7Owc9vxvlLfxHFg= X-Google-Smtp-Source: ABdhPJyc6tySq1hc4oUC/GX6OiHKRLbdP0ZedcRHMWVrzkbW5KzFv2buHGSIyTBfk45riiLrS/bIRA== X-Received: by 2002:a05:6214:c4f:: with SMTP id r15mr5719572qvj.87.1641938104142; Tue, 11 Jan 2022 13:55:04 -0800 (PST) Received: from localhost.localdomain (c-69-250-217-147.hsd1.md.comcast.net. [69.250.217.147]) by smtp.gmail.com with ESMTPSA id j22sm5826949qko.46.2022.01.11.13.55.03 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 11 Jan 2022 13:55:03 -0800 (PST) From: James Carter To: selinux@vger.kernel.org Cc: cgzones@googlemail.com, James Carter Subject: [PATCH 14/16 v2] libsepol: The src and tgt must be the same if neverallow uses self Date: Tue, 11 Jan 2022 16:54:44 -0500 Message-Id: <20220111215446.595516-15-jwcart2@gmail.com> X-Mailer: git-send-email 2.31.1 In-Reply-To: <20220111215446.595516-1-jwcart2@gmail.com> References: <20220111215446.595516-1-jwcart2@gmail.com> MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: selinux@vger.kernel.org When checking for violations of neverallow rules, if the neverallow uses self, then the src and tgt must be the same when checking extended permissions and when reporting violations. Example: allow attr attr : CLASS PERM; neverallow attr self : CLASS PERM; If the types t1 and t2 have attribute attr, then the violations that would be reported would be: allow t1 t1 : CLASS PERM; allow t1 t2 : CLASS PERM; allow t2 t1 : CLASS PERM; allow t2 t2 : CLASS PERM; instead of: allow t1 t1 : CLASS PERM; allow t2 t2 : CLASS PERM; Signed-off-by: James Carter --- libsepol/src/assertion.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/libsepol/src/assertion.c b/libsepol/src/assertion.c index 93c57061..1c69f4d9 100644 --- a/libsepol/src/assertion.c +++ b/libsepol/src/assertion.c @@ -213,6 +213,7 @@ static int report_assertion_avtab_matches(avtab_key_t *k, avtab_datum_t *d, void ebitmap_t src_matches, tgt_matches, self_matches; ebitmap_node_t *snode, *tnode; unsigned int i, j; + const int is_avrule_self = (avrule->flags & RULE_SELF) != 0; if ((k->specified & AVTAB_ALLOWED) == 0) return 0; @@ -236,7 +237,7 @@ static int report_assertion_avtab_matches(avtab_key_t *k, avtab_datum_t *d, void if (rc < 0) goto oom; - if (avrule->flags == RULE_SELF) { + if (is_avrule_self) { rc = ebitmap_and(&self_matches, &src_matches, &p->attr_type_map[k->target_type - 1]); if (rc < 0) goto oom; @@ -260,6 +261,8 @@ static int report_assertion_avtab_matches(avtab_key_t *k, avtab_datum_t *d, void ebitmap_for_each_positive_bit(&src_matches, snode, i) { ebitmap_for_each_positive_bit(&tgt_matches, tnode, j) { + if (is_avrule_self && i != j) + continue; if (avrule->specified == AVRULE_XPERMS_NEVERALLOW) { a->errors += report_assertion_extended_permissions(handle,p, avrule, i, j, cp, perms, k, avtab); @@ -368,6 +371,7 @@ static int check_assertion_extended_permissions(avrule_t *avrule, avtab_t *avtab ebitmap_t src_matches, tgt_matches, self_matches; unsigned int i, j; ebitmap_node_t *snode, *tnode; + const int is_avrule_self = (avrule->flags & RULE_SELF) != 0; int rc; ebitmap_init(&src_matches); @@ -389,7 +393,7 @@ static int check_assertion_extended_permissions(avrule_t *avrule, avtab_t *avtab if (rc < 0) goto oom; - if (avrule->flags == RULE_SELF) { + if (is_avrule_self) { rc = ebitmap_and(&self_matches, &src_matches, &p->attr_type_map[k->target_type - 1]); if (rc < 0) goto oom; @@ -408,6 +412,8 @@ static int check_assertion_extended_permissions(avrule_t *avrule, avtab_t *avtab ebitmap_for_each_positive_bit(&src_matches, snode, i) { ebitmap_for_each_positive_bit(&tgt_matches, tnode, j) { + if (is_avrule_self && i != j) + continue; if (check_assertion_extended_permissions_avtab(avrule, avtab, i, j, k, p)) { rc = 1; goto exit; From patchwork Tue Jan 11 21:54:45 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: James Carter X-Patchwork-Id: 12710798 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 4D70EC433F5 for ; Tue, 11 Jan 2022 21:55:20 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1345266AbiAKVzT (ORCPT ); Tue, 11 Jan 2022 16:55:19 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:48962 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S233882AbiAKVzG (ORCPT ); Tue, 11 Jan 2022 16:55:06 -0500 Received: from mail-qt1-x832.google.com (mail-qt1-x832.google.com [IPv6:2607:f8b0:4864:20::832]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 833B7C06175D for ; Tue, 11 Jan 2022 13:55:05 -0800 (PST) Received: by mail-qt1-x832.google.com with SMTP id bp39so839277qtb.6 for ; Tue, 11 Jan 2022 13:55:05 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=CEfa5+omoDzwLmrn6ck4iz87TuJFgKvummx5dT/Q7Ak=; b=RZjoEEdgR7F8zMREBBSBtNQDbBarI4qanS1iQ/QqryeD7q2Fak1Bpe2aniKXQn8WuW fRv2/u1B+lU2bzlaEhEmZQQCkiYN4L1pn5xhvW+RB3GLE43BpmmT2E7p4AEh4ZGqq07+ ZcPWWbl4vmlI+NDvt7EhTBIHE3W0cbvcP9/MLtZ1AP1g/ilh7d7bzzONeaQOOltxrDw4 OVT8Nx1/LwIv3YiJ/vHemVZLZLQPevZa7PfjVUMTPjIDsgT7VsrIJtUnzJKaW61s/ga4 Gz/FMHICaJn+J6/IKNDxyU8sLDCb7nx6MQ1IYtTlOxMF23dSXCHcyqzcqKhIpFFjAXGQ EfQg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=CEfa5+omoDzwLmrn6ck4iz87TuJFgKvummx5dT/Q7Ak=; b=uRqlgNovLX8YqZ36P4pNYRwkgnXZC723YyobV8XdHHK1qyUeKJWfm55P6xhjd+ZTbA V2SdGoylmmcSpVpB7ptFmCoLvZw8cPoOtdmpLoOH3Khwt++xohRxj+St+Ntc1J7NVqFl g3iBxv3y2ifjpP6ovCRKh1oQpSqcrkauG7T6WIaLNLBE5LJvq6syR1fh35X0uEqS86XP ATjvRcKgi5PzGjzC1Wt6wlxk3FhzGgBRHaCfi4G3D1m25kTskuFz+MRyryVzXRcnY5+v s9jDSqCgW4Bi6tZHZDSODblABIdSvcajWmTyiZAGavCzHgY2WvL1yAKRPdoQnuA8JVmg +ojQ== X-Gm-Message-State: AOAM531BNHI9SIFagem8P1mwsekT8PbSiiza0L8/Zn2P6hcbQLMfvHsF rrmvjnFeQvKipK6zSuTXy4iuQNm5YT4= X-Google-Smtp-Source: ABdhPJzA15JrYiMQz02LR4/RcxPDdGFzuXkkPQ9nA5VfjkeftAz4Sid/7uFMC6HrZNWLCUKrbCdK+A== X-Received: by 2002:a05:622a:1493:: with SMTP id t19mr1563704qtx.230.1641938104673; Tue, 11 Jan 2022 13:55:04 -0800 (PST) Received: from localhost.localdomain (c-69-250-217-147.hsd1.md.comcast.net. [69.250.217.147]) by smtp.gmail.com with ESMTPSA id j22sm5826949qko.46.2022.01.11.13.55.04 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 11 Jan 2022 13:55:04 -0800 (PST) From: James Carter To: selinux@vger.kernel.org Cc: cgzones@googlemail.com, James Carter Subject: [PATCH 15/16 v2] libsepol: Set args avtab pointer when reporting assertion violations Date: Tue, 11 Jan 2022 16:54:45 -0500 Message-Id: <20220111215446.595516-16-jwcart2@gmail.com> X-Mailer: git-send-email 2.31.1 In-Reply-To: <20220111215446.595516-1-jwcart2@gmail.com> References: <20220111215446.595516-1-jwcart2@gmail.com> MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: selinux@vger.kernel.org The changes are the same as in a patch sent by Christian Göttsche to support adding not-self to neverallowxperm checking, but it is needed for normal neverallowxperm checking as well and the following explanation reflects that. When reporting neverallowxperm violations, the avtab is searched to find the rule that violates the assertion. If the avtab pointer of the args is not set, then it will report the error as if no extended permissions existed for the source and target (so allowing the ioctl permission at all violates the neverallowxperm). Example (where t1 has attribute attr): allow attr attr:CLASS ioctl; allowxperm attr attr:CLASS ioctl 0x9411; neverallowxperm t1 self:CLASS ioctl 0x9411; Would be reported as: neverallowxperm on line 3 of policy.conf (or line 3 of policy.conf) violated by allow t1 t1:CLASS { ioctl }; Instead of: neverallowxperm on line 3 of policy.conf (or line 3 of policy.conf) violated by allowxperm attr attr:CLASS ioctl { 0x9411 }; Reported-by: Christian Göttsche Signed-off-by: James Carter --- libsepol/src/assertion.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/libsepol/src/assertion.c b/libsepol/src/assertion.c index 1c69f4d9..b21c83ba 100644 --- a/libsepol/src/assertion.c +++ b/libsepol/src/assertion.c @@ -292,10 +292,12 @@ static int report_assertion_failures(sepol_handle_t *handle, policydb_t *p, avru args.avrule = avrule; args.errors = 0; + args.avtab = &p->te_avtab; rc = avtab_map(&p->te_avtab, report_assertion_avtab_matches, &args); if (rc < 0) goto oom; + args.avtab = &p->te_cond_avtab; rc = avtab_map(&p->te_cond_avtab, report_assertion_avtab_matches, &args); if (rc < 0) goto oom; From patchwork Tue Jan 11 21:54:46 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: James Carter X-Patchwork-Id: 12710799 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 5B245C433EF for ; Tue, 11 Jan 2022 21:55:21 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S233882AbiAKVzT (ORCPT ); Tue, 11 Jan 2022 16:55:19 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:48964 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234664AbiAKVzH (ORCPT ); Tue, 11 Jan 2022 16:55:07 -0500 Received: from mail-qv1-xf32.google.com (mail-qv1-xf32.google.com [IPv6:2607:f8b0:4864:20::f32]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 1FAA7C06175E for ; Tue, 11 Jan 2022 13:55:06 -0800 (PST) Received: by mail-qv1-xf32.google.com with SMTP id kc16so825196qvb.3 for ; Tue, 11 Jan 2022 13:55:06 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=J4jP2ewQcNQ4DhsgIwnpCS2JpHQRPnKkJFPN3R9sR9A=; b=h20HlJrkECD6ei1m8sKXvOSPDrCwmGghT2M+Uu+hlDgupWOp4uj6+OTe0IonOP4a3p z/4mB/1URXFQRpa8AhQa6rhkIefRFoXJfmjRIpzU+KQV0rqzYysGYqKPvTnf/aPWuc8C ZGmF1iy6GJYo1Roj9MDVNuNJe0P+2W9cOEYXr63mQxvV7FZCiPoBThbjEJoC/fbaga8Q zmGRApn7kHy8YGKA6KYEnIQAMjmjstViCZxXGdlEOzbffrx41OlgezSZEdK8HN6yANl4 Wp0SNVGJkX5xvfLTBfb0AKOkBV+0a9TEbP9L/L66AT8Tqng1LUISb7dHZMzabHosFHT2 1UEQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=J4jP2ewQcNQ4DhsgIwnpCS2JpHQRPnKkJFPN3R9sR9A=; b=aiHDZm0SJxXdCPD9WSm9qh3Vo8iR/wrjHuojsHdSW+RI6Dhf++mDkbNbMC6lsE4tKI aELGxoqyLIWn7+mS8jkJgmba47YFj+x2OrylZ23w93Bg7Xx/KnjVxMwpsOuBbLjlauOI moThOiX1Tyl+R3ptUTNV5MmcmgrJNQWcgiqU+8GDgywbv2gm31OtqRDcjlfWoQEs8gSf m7pZMZ9izn2wU3Z7JPoeHRSZb9Ezs+rWv//5Sos9fvHkfKxYuPztcgHaPRfOG3VuE5nu pWY9cTA2Jgwsm6sgdEyzDyj1MjTqerL7ziiXT5Wf8RuMSCy4iAXcbp6kdDr+gSzFzkwU LITQ== X-Gm-Message-State: AOAM533M1V46zdLd5AN3WOKkjoOZkkYKI8uFXCrpwv7dPfs1zYBcC0ZS CkPjzhFYcQEQIJ3bepkVgqbtkZ9oksY= X-Google-Smtp-Source: ABdhPJwsBuKzxOZc1I3A81jHdLHBYXYzz8RWLifDsB2ha6QbZ5geRu6PNyVVd4D9eD/n3AzGNzsAbQ== X-Received: by 2002:a05:6214:27c6:: with SMTP id ge6mr5859509qvb.83.1641938105164; Tue, 11 Jan 2022 13:55:05 -0800 (PST) Received: from localhost.localdomain (c-69-250-217-147.hsd1.md.comcast.net. [69.250.217.147]) by smtp.gmail.com with ESMTPSA id j22sm5826949qko.46.2022.01.11.13.55.04 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 11 Jan 2022 13:55:04 -0800 (PST) From: James Carter To: selinux@vger.kernel.org Cc: cgzones@googlemail.com, James Carter Subject: [PATCH 16/16 v2] libsepol: Fix two problems with neverallowxperm reporting Date: Tue, 11 Jan 2022 16:54:46 -0500 Message-Id: <20220111215446.595516-17-jwcart2@gmail.com> X-Mailer: git-send-email 2.31.1 In-Reply-To: <20220111215446.595516-1-jwcart2@gmail.com> References: <20220111215446.595516-1-jwcart2@gmail.com> MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: selinux@vger.kernel.org Not all violations of neverallowxperm rules were being reported. In check_assertion_extended_permissions_avtab(), a break was performed after finding a match rather than just returning right away. This means that if other src and tgt pairs were checked afterward that did not match, then no match would be reported. Example: allow attr attr:CLASS ioctl; allowxperm attr attr:CLASS ioctl 0x9401; allowxperm t1 self:CLASS ioctl 0x9421; neverallowxperm attr self:CLASS ioctl 0x9421; Would result in no assertion violations being found. Another problem was that the reporting function did not properly recognize when there was a valid allowxperm rule and falsely reported additional violations that did not exist. (There had to be at least one legitimate violation.) Using the same example as above (and assuming t1 and t2 both have attribute attr), the following would be reported as: neverallowxperm on line 4 of policy.conf (or line 4 of policy.conf) violated by allowxperm t1 t1:CLASS ioctl { 0x9421 }; neverallowxperm on line 4 of policy.conf (or line 4 of policy.conf) violated by allow t2 t2:CLASS4 { ioctl }; There is no violation for t2 because there is a valid allowxperm rule for it. With this patch, only the first error message (which is the correct one) is printed. Signed-off-by: James Carter --- libsepol/src/assertion.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/libsepol/src/assertion.c b/libsepol/src/assertion.c index b21c83ba..44c20362 100644 --- a/libsepol/src/assertion.c +++ b/libsepol/src/assertion.c @@ -149,6 +149,7 @@ static int report_assertion_extended_permissions(sepol_handle_t *handle, ebitmap_node_t *snode, *tnode; unsigned int i, j; int rc; + int found_xperm = 0; int errors = 0; memcpy(&tmp_key, k, sizeof(avtab_key_t)); @@ -165,7 +166,7 @@ static int report_assertion_extended_permissions(sepol_handle_t *handle, if ((xperms->specified != AVTAB_XPERMS_IOCTLFUNCTION) && (xperms->specified != AVTAB_XPERMS_IOCTLDRIVER)) continue; - + found_xperm = 1; rc = check_extended_permissions(avrule->xperms, xperms); /* failure on the extended permission check_extended_permissions */ if (rc) { @@ -185,7 +186,7 @@ static int report_assertion_extended_permissions(sepol_handle_t *handle, } /* failure on the regular permissions */ - if (!errors) { + if (!found_xperm) { ERR(handle, "neverallowxperm on line %lu of %s (or line %lu of policy.conf) violated by\n" "allow %s %s:%s {%s };", avrule->source_line, avrule->source_filename, avrule->line, @@ -343,7 +344,7 @@ static int check_assertion_extended_permissions_avtab(avrule_t *avrule, avtab_t continue; rc = check_extended_permissions(neverallow_xperms, xperms); if (rc) - break; + return rc; } } }