rpms/libsepol
5
0
Fork 0
Code Issues Pull Requests Releases Activity
7a85deddcf
libsepol/libsepol-rhat.patch
rhatdan 7a85deddcf Update to upstream 
* fix neverallow checking on attributes
	* Move context_copy() after switch block in ocontext_copy_*().
	* check for missing initial SID labeling statement.
	* Add always_check_network policy capability
	* role_fix_callback skips out-of-scope roles during expansion.
2012-09-13 12:32:09 -04:00

283 lines
8.4 KiB
Diff
Raw Blame History

diff --git a/libsepol/include/sepol/policydb/polcaps.h b/libsepol/include/sepol/policydb/polcaps.h
index f90a48d..9152446 100644
--- a/libsepol/include/sepol/policydb/polcaps.h
+++ b/libsepol/include/sepol/policydb/polcaps.h
@@ -5,7 +5,7 @@
enum {
POLICYDB_CAPABILITY_NETPEER,
POLICYDB_CAPABILITY_OPENPERM,
- POLICYDB_CAPABILITY_REDHAT1, /* reserved for RH testing of ptrace_child */
+ POLICYDB_CAPABILITY_PTRACE_CHILD,
POLICYDB_CAPABILITY_ALWAYSNETWORK,
__POLICYDB_CAPABILITY_MAX
};
diff --git a/libsepol/src/expand.c b/libsepol/src/expand.c
index 2003eb6..79587af 100644
--- a/libsepol/src/expand.c
+++ b/libsepol/src/expand.c
@@ -49,6 +49,82 @@ typedef struct expand_state {
int expand_neverallow;
} expand_state_t;
+struct linear_probe {
+ filename_trans_t **table; /* filename_trans chunks with same stype */
+ filename_trans_t **ends; /* pointers to ends of **table chunks */
+ uint32_t length; /* length of the table */
+};
+
+static int linear_probe_create(struct linear_probe *probe, uint32_t length)
+{
+ probe->table = calloc(length, sizeof(*probe->table));
+ if (probe->table == NULL)
+ return -1;
+
+ probe->ends = calloc(length, sizeof(*probe->ends));
+ if (probe->ends == NULL)
+ return -1;
+
+ probe->length = length;
+
+ return 0;
+}
+
+static void linear_probe_destroy(struct linear_probe *probe)
+{
+ if (probe->length == 0)
+ return;
+
+ free(probe->table);
+ free(probe->ends);
+ memset(probe, 0, sizeof(*probe));
+}
+
+static void linear_probe_insert(struct linear_probe *probe, uint32_t key,
+ filename_trans_t *data)
+{
+ assert(probe->length > key);
+
+ if (probe->table[key] != NULL) {
+ data->next = probe->table[key];
+ probe->table[key] = data;
+ } else {
+ probe->table[key] = probe->ends[key] = data;
+ }
+}
+
+static filename_trans_t *linear_probe_find(struct linear_probe *probe, uint32_t key)
+{
+ assert(probe->length > key);
+
+ return probe->table[key];
+}
+
+/* Returns all chunks stored in the *probe as single-linked list */
+static filename_trans_t *linear_probe_dump(struct linear_probe *probe,
+ filename_trans_t **endp)
+{
+ uint32_t i;
+ filename_trans_t *result = NULL;
+ filename_trans_t *end = NULL;
+
+ for (i = 0; i < probe->length; i++) {
+ if (probe->table[i] != NULL) {
+ if (end == NULL)
+ end = probe->ends[i];
+ probe->ends[i]->next = result;
+ result = probe->table[i];
+ probe->table[i] = probe->ends[i] = NULL;
+ }
+ }
+
+ /* Incoherent result and end pointers indicates bug */
+ assert((result != NULL && end != NULL) || (result == NULL && end == NULL));
+
+ *endp = end;
+ return result;
+}
+
static void expand_state_init(expand_state_t * state)
{
memset(state, 0, sizeof(expand_state_t));
@@ -1357,10 +1433,20 @@ static int copy_role_trans(expand_state_t * state, role_trans_rule_t * rules)
static int expand_filename_trans(expand_state_t *state, filename_trans_rule_t *rules)
{
unsigned int i, j;
- filename_trans_t *new_trans, *cur_trans;
+ filename_trans_t *new_trans, *cur_trans, *end;
filename_trans_rule_t *cur_rule;
ebitmap_t stypes, ttypes;
ebitmap_node_t *snode, *tnode;
+ struct linear_probe probe;
+
+ /*
+ * Linear probing speeds-up finding filename_trans rules with certain
+ * "stype" value.
+ */
+ if (linear_probe_create(&probe, 4096)) { /* Assume 4096 is enough for most cases */
+ ERR(state->handle, "Out of memory!");
+ return -1;
+ }
cur_rule = rules;
while (cur_rule) {
@@ -1370,19 +1456,27 @@ static int expand_filename_trans(expand_state_t *state, filename_trans_rule_t *r
ebitmap_init(&ttypes);
if (expand_convert_type_set(state->out, state->typemap,
- &cur_rule->stypes, &stypes, 1)) {
+ &cur_rule->stypes, &stypes, 0)) {
ERR(state->handle, "Out of memory!");
return -1;
}
if (expand_convert_type_set(state->out, state->typemap,
- &cur_rule->ttypes, &ttypes, 1)) {
+ &cur_rule->ttypes, &ttypes, 0)) {
ERR(state->handle, "Out of memory!");
return -1;
}
mapped_otype = state->typemap[cur_rule->otype - 1];
+ if (ebitmap_length(&stypes) > probe.length) {
+ linear_probe_destroy(&probe);
+ if (linear_probe_create(&probe, ebitmap_length(&stypes))) {
+ ERR(state->handle, "Out of memory!");
+ return -1;
+ }
+ }
+
ebitmap_for_each_bit(&stypes, snode, i) {
if (!ebitmap_node_get_bit(snode, i))
continue;
@@ -1390,16 +1484,14 @@ static int expand_filename_trans(expand_state_t *state, filename_trans_rule_t *r
if (!ebitmap_node_get_bit(tnode, j))
continue;
- cur_trans = state->out->filename_trans;
- while (cur_trans) {
- if ((cur_trans->stype == i + 1) &&
- (cur_trans->ttype == j + 1) &&
+ cur_trans = linear_probe_find(&probe, i);
+ while (cur_trans != NULL) {
+ if ((cur_trans->ttype == j + 1) &&
(cur_trans->tclass == cur_rule->tclass) &&
(!strcmp(cur_trans->name, cur_rule->name))) {
/* duplicate rule, who cares */
if (cur_trans->otype == mapped_otype)
break;
-
ERR(state->handle, "Conflicting filename trans rules %s %s %s : %s otype1:%s otype2:%s",
cur_trans->name,
state->out->p_type_val_to_name[i],
@@ -1407,7 +1499,7 @@ static int expand_filename_trans(expand_state_t *state, filename_trans_rule_t *r
state->out->p_class_val_to_name[cur_trans->tclass - 1],
state->out->p_type_val_to_name[cur_trans->otype - 1],
state->out->p_type_val_to_name[mapped_otype - 1]);
-
+
return -1;
}
cur_trans = cur_trans->next;
@@ -1422,8 +1514,6 @@ static int expand_filename_trans(expand_state_t *state, filename_trans_rule_t *r
return -1;
}
memset(new_trans, 0, sizeof(*new_trans));
- new_trans->next = state->out->filename_trans;
- state->out->filename_trans = new_trans;
new_trans->name = strdup(cur_rule->name);
if (!new_trans->name) {
@@ -1434,9 +1524,16 @@ static int expand_filename_trans(expand_state_t *state, filename_trans_rule_t *r
new_trans->ttype = j + 1;
new_trans->tclass = cur_rule->tclass;
new_trans->otype = mapped_otype;
+ linear_probe_insert(&probe, i, new_trans);
}
}
+ cur_trans = linear_probe_dump(&probe, &end);
+ if (cur_trans != NULL) {
+ end->next = state->out->filename_trans;
+ state->out->filename_trans = cur_trans;
+ }
+
ebitmap_destroy(&stypes);
ebitmap_destroy(&ttypes);
@@ -2037,14 +2134,13 @@ static int ocontext_copy_xen(expand_state_t *state)
else
state->out->ocontexts[i] = n;
l = n;
+ if (context_copy(&n->context[0], &c->context[0],
+ state)) {
+ ERR(state->handle, "Out of memory!");
+ return -1;
+ }
switch (i) {
case OCON_XEN_ISID:
- if (c->context[0].user == 0) {
- ERR(state->handle,
- "Missing context for %s initial sid",
- c->u.name);
- return -1;
- }
n->sid[0] = c->sid[0];
break;
case OCON_XEN_PIRQ:
@@ -2067,11 +2163,6 @@ static int ocontext_copy_xen(expand_state_t *state)
ERR(state->handle, "Unknown ocontext");
return -1;
}
- if (context_copy(&n->context[0], &c->context[0],
- state)) {
- ERR(state->handle, "Out of memory!");
- return -1;
- }
}
}
return 0;
@@ -2096,14 +2187,12 @@ static int ocontext_copy_selinux(expand_state_t *state)
else
state->out->ocontexts[i] = n;
l = n;
+ if (context_copy(&n->context[0], &c->context[0], state)) {
+ ERR(state->handle, "Out of memory!");
+ return -1;
+ }
switch (i) {
case OCON_ISID:
- if (c->context[0].user == 0) {
- ERR(state->handle,
- "Missing context for %s initial sid",
- c->u.name);
- return -1;
- }
n->sid[0] = c->sid[0];
break;
case OCON_FS: /* FALLTHROUGH */
@@ -2147,10 +2236,6 @@ static int ocontext_copy_selinux(expand_state_t *state)
ERR(state->handle, "Unknown ocontext");
return -1;
}
- if (context_copy(&n->context[0], &c->context[0], state)) {
- ERR(state->handle, "Out of memory!");
- return -1;
- }
}
}
return 0;
diff --git a/libsepol/src/polcaps.c b/libsepol/src/polcaps.c
index 43a71a7..7615a9b 100644
--- a/libsepol/src/polcaps.c
+++ b/libsepol/src/polcaps.c
@@ -8,7 +8,7 @@
static const char *polcap_names[] = {
"network_peer_controls", /* POLICYDB_CAPABILITY_NETPEER */
"open_perms", /* POLICYDB_CAPABILITY_OPENPERM */
- "redhat1", /* POLICYDB_CAPABILITY_REDHAT1, aka ptrace_child */
+ "ptrace_child", /* POLICYDB_CAPABILITY_PTRACE_CHILD */
"always_check_network", /* POLICYDB_CAPABILITY_ALWAYSNETWORK */
NULL
};
Reference in New Issue View Git Blame Copy Permalink