c59879b8aa
Rebase on upstream commit 32611aea6543
See
$ cd SELinuxProject/selinux
$ git log --pretty=oneline libsepol-3.2..32611aea6543 -- libsepol
109 lines
4.3 KiB
Diff
109 lines
4.3 KiB
Diff
From 8470058934e89d1876b8e034d1ea818bde62b994 Mon Sep 17 00:00:00 2001
|
|
From: James Carter <jwcart2@gmail.com>
|
|
Date: Mon, 12 Jul 2021 09:50:38 -0400
|
|
Subject: [PATCH] libsepol/cil: Fix handling category sets in an expression
|
|
|
|
There are two problems that need to be addressed when resolving an
|
|
expression with category sets.
|
|
|
|
1. Only expand anonymous category sets in an expression.
|
|
|
|
Commit 982ec302b67f3c7f8df667dadb67352b1e4a6d18 (libsepol/cil:
|
|
Account for anonymous category sets in an expression) attempted to
|
|
properly handle anonymous category sets when resolving category
|
|
expressions. Unfortunately, it did not check whether a category set
|
|
was actually an anonymous category set and expanded all category
|
|
sets in an expression. If a category set refers to itself in the
|
|
expression, then everything from the name of the category set to the
|
|
end of the expression is ignored.
|
|
|
|
For example, the rule "(categoryset cs (c0 cs c1 c2))", would be
|
|
equivalent to the rule "(categoryset cs (c0))" as everything from
|
|
"cs" to the end would be dropped. The secilc-fuzzer found that the
|
|
rule "(categoryset cat (not cat))" would cause a segfault since
|
|
"(not)" is not a valid expression and it is assumed to be valid
|
|
during later evaluation because syntax checking has already been
|
|
done.
|
|
|
|
Instead, check whether or not the category set is anonymous before
|
|
expanding it when resolving an expression.
|
|
|
|
2. Category sets cannot be used in a category range
|
|
|
|
A category range can be used to specify a large number of categories.
|
|
The range "(range c0 c1023)" refers to 1024 categories. Only categories
|
|
and category aliases can be used in a range. Determining if an
|
|
identifier is a category, an alias, or a set can only be done after
|
|
resolving the identifer.
|
|
|
|
Keep track of the current operator as an expression is being resolved
|
|
and if the expression involves categories and a category set is
|
|
encountered, then return an error if the expression is a category
|
|
range.
|
|
|
|
Signed-off-by: James Carter <jwcart2@gmail.com>
|
|
---
|
|
libsepol/cil/src/cil_resolve_ast.c | 28 +++++++++++++++++++++-------
|
|
1 file changed, 21 insertions(+), 7 deletions(-)
|
|
|
|
diff --git a/libsepol/cil/src/cil_resolve_ast.c b/libsepol/cil/src/cil_resolve_ast.c
|
|
index 145d4e7452dd..180073247617 100644
|
|
--- a/libsepol/cil/src/cil_resolve_ast.c
|
|
+++ b/libsepol/cil/src/cil_resolve_ast.c
|
|
@@ -3228,6 +3228,7 @@ int cil_resolve_expr(enum cil_flavor expr_type, struct cil_list *str_expr, struc
|
|
struct cil_symtab_datum *res_datum = NULL;
|
|
enum cil_sym_index sym_index = CIL_SYM_UNKNOWN;
|
|
struct cil_list *datum_sub_expr;
|
|
+ enum cil_flavor op = CIL_NONE;
|
|
|
|
switch (str_expr->flavor) {
|
|
case CIL_BOOL:
|
|
@@ -3263,14 +3264,24 @@ int cil_resolve_expr(enum cil_flavor expr_type, struct cil_list *str_expr, struc
|
|
}
|
|
if (sym_index == CIL_SYM_CATS && NODE(res_datum)->flavor == CIL_CATSET) {
|
|
struct cil_catset *catset = (struct cil_catset *)res_datum;
|
|
- if (!catset->cats->datum_expr) {
|
|
- rc = cil_resolve_expr(expr_type, catset->cats->str_expr, &catset->cats->datum_expr, parent, extra_args);
|
|
- if (rc != SEPOL_OK) {
|
|
- goto exit;
|
|
+ if (op == CIL_RANGE) {
|
|
+ cil_tree_log(parent, CIL_ERR, "Category set not allowed in category range");
|
|
+ rc = SEPOL_ERR;
|
|
+ goto exit;
|
|
+ }
|
|
+ if (!res_datum->name) {
|
|
+ /* Anonymous category sets need to be resolved when encountered */
|
|
+ if (!catset->cats->datum_expr) {
|
|
+ rc = cil_resolve_expr(expr_type, catset->cats->str_expr, &catset->cats->datum_expr, parent, extra_args);
|
|
+ if (rc != SEPOL_OK) {
|
|
+ goto exit;
|
|
+ }
|
|
}
|
|
+ cil_copy_list(catset->cats->datum_expr, &datum_sub_expr);
|
|
+ cil_list_append(*datum_expr, CIL_LIST, datum_sub_expr);
|
|
+ } else {
|
|
+ cil_list_append(*datum_expr, CIL_DATUM, res_datum);
|
|
}
|
|
- cil_copy_list(catset->cats->datum_expr, &datum_sub_expr);
|
|
- cil_list_append(*datum_expr, CIL_LIST, datum_sub_expr);
|
|
} else {
|
|
if (sym_index == CIL_SYM_TYPES && (expr_type == CIL_CONSTRAIN || expr_type == CIL_VALIDATETRANS)) {
|
|
cil_type_used(res_datum, CIL_ATTR_CONSTRAINT);
|
|
@@ -3287,9 +3298,12 @@ int cil_resolve_expr(enum cil_flavor expr_type, struct cil_list *str_expr, struc
|
|
break;
|
|
}
|
|
default:
|
|
+ if (curr->flavor == CIL_OP) {
|
|
+ op = (enum cil_flavor)(uintptr_t)curr->data;
|
|
+ }
|
|
cil_list_append(*datum_expr, curr->flavor, curr->data);
|
|
break;
|
|
- }
|
|
+ }
|
|
}
|
|
return SEPOL_OK;
|
|
|
|
--
|
|
2.32.0
|
|
|