c59879b8aa
Rebase on upstream commit 32611aea6543
See
$ cd SELinuxProject/selinux
$ git log --pretty=oneline libsepol-3.2..32611aea6543 -- libsepol
91 lines
3.3 KiB
Diff
91 lines
3.3 KiB
Diff
From 982ec302b67f3c7f8df667dadb67352b1e4a6d18 Mon Sep 17 00:00:00 2001
|
|
From: James Carter <jwcart2@gmail.com>
|
|
Date: Tue, 15 Jun 2021 10:40:20 -0400
|
|
Subject: [PATCH] libsepol/cil: Account for anonymous category sets in an
|
|
expression
|
|
|
|
It is possible for anonymous category sets to be in a category
|
|
expression if the expression has a macro parameter in it.
|
|
Unfortunately, anonymous category sets are not looked for when
|
|
resolving category expressions and a segfault will occur during
|
|
later processing if there was one.
|
|
|
|
As an example, consider the following portion of a policy.
|
|
(macro m1 ((categoryset cs))
|
|
(userlevel USER (s0 (cs)))
|
|
)
|
|
(call m1 ((c0 c1)))
|
|
This policy will cause a segault, because the categoryset datum
|
|
for the parameter cs is not seen as a categoryset and is treated
|
|
as a plain category.
|
|
|
|
When resolving an expression, check whether or not the datum that
|
|
is found is actually an anonymous category set associated with a
|
|
macro parameter. If it is, then resolve the category set if it
|
|
has not already been resolved and treat its categories as a sub
|
|
expression.
|
|
|
|
Signed-off-by: James Carter <jwcart2@gmail.com>
|
|
Acked-by: Nicolas Iooss <nicolas.iooss@m4x.org>
|
|
---
|
|
libsepol/cil/src/cil_resolve_ast.c | 24 +++++++++++++++++-------
|
|
1 file changed, 17 insertions(+), 7 deletions(-)
|
|
|
|
diff --git a/libsepol/cil/src/cil_resolve_ast.c b/libsepol/cil/src/cil_resolve_ast.c
|
|
index 16c8c7533ce3..42a58468ed36 100644
|
|
--- a/libsepol/cil/src/cil_resolve_ast.c
|
|
+++ b/libsepol/cil/src/cil_resolve_ast.c
|
|
@@ -3346,6 +3346,7 @@ int cil_resolve_expr(enum cil_flavor expr_type, struct cil_list *str_expr, struc
|
|
struct cil_list_item *curr;
|
|
struct cil_symtab_datum *res_datum = NULL;
|
|
enum cil_sym_index sym_index = CIL_SYM_UNKNOWN;
|
|
+ struct cil_list *datum_sub_expr;
|
|
|
|
switch (str_expr->flavor) {
|
|
case CIL_BOOL:
|
|
@@ -3379,18 +3380,26 @@ int cil_resolve_expr(enum cil_flavor expr_type, struct cil_list *str_expr, struc
|
|
if (rc != SEPOL_OK) {
|
|
goto exit;
|
|
}
|
|
-
|
|
- if (sym_index == CIL_SYM_TYPES && (expr_type == CIL_CONSTRAIN || expr_type == CIL_VALIDATETRANS)) {
|
|
- cil_type_used(res_datum, CIL_ATTR_CONSTRAINT);
|
|
+ if (sym_index == CIL_SYM_CATS && NODE(res_datum)->flavor == CIL_CATSET) {
|
|
+ struct cil_catset *catset = (struct cil_catset *)res_datum;
|
|
+ if (!catset->cats->datum_expr) {
|
|
+ rc = cil_resolve_expr(expr_type, catset->cats->str_expr, &catset->cats->datum_expr, parent, extra_args);
|
|
+ if (rc != SEPOL_OK) {
|
|
+ goto exit;
|
|
+ }
|
|
+ }
|
|
+ cil_copy_list(catset->cats->datum_expr, &datum_sub_expr);
|
|
+ cil_list_append(*datum_expr, CIL_LIST, datum_sub_expr);
|
|
+ } else {
|
|
+ if (sym_index == CIL_SYM_TYPES && (expr_type == CIL_CONSTRAIN || expr_type == CIL_VALIDATETRANS)) {
|
|
+ cil_type_used(res_datum, CIL_ATTR_CONSTRAINT);
|
|
+ }
|
|
+ cil_list_append(*datum_expr, CIL_DATUM, res_datum);
|
|
}
|
|
-
|
|
- cil_list_append(*datum_expr, CIL_DATUM, res_datum);
|
|
break;
|
|
case CIL_LIST: {
|
|
- struct cil_list *datum_sub_expr;
|
|
rc = cil_resolve_expr(expr_type, curr->data, &datum_sub_expr, parent, extra_args);
|
|
if (rc != SEPOL_OK) {
|
|
- cil_list_destroy(&datum_sub_expr, CIL_TRUE);
|
|
goto exit;
|
|
}
|
|
cil_list_append(*datum_expr, CIL_LIST, datum_sub_expr);
|
|
@@ -3404,6 +3413,7 @@ int cil_resolve_expr(enum cil_flavor expr_type, struct cil_list *str_expr, struc
|
|
return SEPOL_OK;
|
|
|
|
exit:
|
|
+ cil_list_destroy(datum_expr, CIL_FALSE);
|
|
return rc;
|
|
}
|
|
|
|
--
|
|
2.32.0
|
|
|