RepoMirrors/setools
1
0
Fork 0
mirror of https://github.com/SELinuxProject/setools synced 2025-03-20 01:56:31 +00:00
Code Issues Packages Projects Releases Wiki Activity

policyrep: Convert TE rules to direct sepol structure access.

Browse Source
This commit is contained in:
Chris PeBenito 2018-02-25 09:13:25 -05:00
parent aeecacc896
commit f012d55b11
11 changed files with 439 additions and 2820 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

383
libqpol/avrule_query.c
View File

@ -1,383 +0,0 @@
/**
* @file
* Implementation for the public interface for searching and iterating over avrules.
*
* @author Kevin Carr kcarr@tresys.com
* @author Jeremy A. Mowery jmowery@tresys.com
* @author Jason Tang jtang@tresys.com
*
* Copyright (C) 2006-2007 Tresys Technology, LLC
*
* This library is free software; you can redistribute it and/or
* modify it under the terms of the GNU Lesser General Public
* License as published by the Free Software Foundation; either
* version 2.1 of the License, or (at your option) any later version.
*
* This library is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
* Lesser General Public License for more details.
*
* You should have received a copy of the GNU Lesser General Public
* License along with this library; if not, write to the Free Software
* Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA
*/
#include "iterator_internal.h"
#include <qpol/iterator.h>
#include <qpol/policy.h>
#include <qpol/avrule_query.h>
#include <sepol/policydb/policydb.h>
#include <sepol/policydb/avtab.h>
#include <sepol/policydb/util.h>
#include <stdlib.h>
#include "qpol_internal.h"
int qpol_policy_get_avrule_iter(const qpol_policy_t * policy, uint32_t rule_type_mask, qpol_iterator_t ** iter)
{
policydb_t *db;
avtab_state_t *state;
if (iter) {
*iter = NULL;
}
if (policy == NULL || iter == NULL) {
ERR(policy, "%s", strerror(EINVAL));
errno = EINVAL;
return STATUS_ERR;
}
#if 1 // Seems to make sediff/sediffx work better without breaking things
if (!qpol_policy_has_capability(policy, QPOL_CAP_RULES_LOADED)) {
ERR(policy, "%s", "Cannot get avrules: Rules not loaded");
errno = ENOTSUP;
return STATUS_ERR;
}
#endif
if ((rule_type_mask & QPOL_RULE_NEVERALLOW) && !qpol_policy_has_capability(policy, QPOL_CAP_NEVERALLOW)) {
ERR(policy, "%s", "Cannot get avrules: Neverallow rules requested but not available");
errno = ENOTSUP;
return STATUS_ERR;
}
db = &policy->p->p;
state = calloc(1, sizeof(avtab_state_t));
if (state == NULL) {
ERR(policy, "%s", strerror(ENOMEM));
errno = ENOMEM;
return STATUS_ERR;
}
state->ucond_tab = &db->te_avtab;
state->cond_tab = &db->te_cond_avtab;
state->rule_type_mask = rule_type_mask;
state->node = db->te_avtab.htable[0];
if (qpol_iterator_create
(policy, state, avtab_state_get_cur, avtab_state_next, avtab_state_end, avtab_state_size, free, iter)) {
free(state);
return STATUS_ERR;
}
if (state->node == NULL || !(state->node->key.specified & state->rule_type_mask)) {
avtab_state_next(*iter);
}
return STATUS_SUCCESS;
}
int qpol_avrule_get_source_type(const qpol_policy_t * policy, const qpol_avrule_t * rule, const qpol_type_t ** source)
{
policydb_t *db = NULL;
avtab_ptr_t avrule = NULL;
if (source) {
*source = NULL;
}
if (!policy || !rule || !source) {
ERR(policy, "%s", strerror(EINVAL));
errno = EINVAL;
return STATUS_ERR;
}
db = &policy->p->p;
avrule = (avtab_ptr_t) rule;
*source = (qpol_type_t *) db->type_val_to_struct[avrule->key.source_type - 1];
return STATUS_SUCCESS;
}
int qpol_avrule_get_target_type(const qpol_policy_t * policy, const qpol_avrule_t * rule, const qpol_type_t ** target)
{
policydb_t *db = NULL;
avtab_ptr_t avrule = NULL;
if (target) {
*target = NULL;
}
if (!policy || !rule || !target) {
ERR(policy, "%s", strerror(EINVAL));
errno = EINVAL;
return STATUS_ERR;
}
db = &policy->p->p;
avrule = (avtab_ptr_t) rule;
*target = (qpol_type_t *) db->type_val_to_struct[avrule->key.target_type - 1];
return STATUS_SUCCESS;
}
int qpol_avrule_get_object_class(const qpol_policy_t * policy, const qpol_avrule_t * rule, const qpol_class_t ** obj_class)
{
policydb_t *db = NULL;
avtab_ptr_t avrule = NULL;
if (obj_class) {
*obj_class = NULL;
}
if (!policy || !rule || !obj_class) {
ERR(policy, "%s", strerror(EINVAL));
errno = EINVAL;
return STATUS_ERR;
}
db = &policy->p->p;
avrule = (avtab_ptr_t) rule;
*obj_class = (qpol_class_t *) db->class_val_to_struct[avrule->key.target_class - 1];
return STATUS_SUCCESS;
}
int qpol_avrule_get_perm_iter(const qpol_policy_t * policy, const qpol_avrule_t * rule, qpol_iterator_t ** perms)
{
avtab_ptr_t avrule = NULL;
perm_state_t *ps = NULL;
if (perms) {
*perms = NULL;
}
if (!policy || !rule || !perms) {
ERR(policy, "%s", strerror(EINVAL));
errno = EINVAL;
return STATUS_ERR;
}
avrule = (avtab_ptr_t) rule;
ps = calloc(1, sizeof(perm_state_t));
if (!ps) {
return STATUS_ERR;
}
if (avrule->key.specified & QPOL_RULE_DONTAUDIT) {
ps->perm_set = ~(avrule->datum.data); /* stored as auditdeny flip the bits */
} else {
ps->perm_set = avrule->datum.data;
}
ps->obj_class_val = avrule->key.target_class;
if (qpol_iterator_create(policy, (void *)ps, perm_state_get_cur,
perm_state_next, perm_state_end, perm_state_size, free, perms)) {
return STATUS_ERR;
}
if (!(ps->perm_set & 1)) /* defaults to bit 0, if off: advance */
perm_state_next(*perms);
return STATUS_SUCCESS;
}
int qpol_avrule_get_xperm_iter(const qpol_policy_t * policy, const qpol_avrule_t * rule, qpol_iterator_t ** xperms_iter)
{
avtab_ptr_t avrule = NULL;
xperm_state_t *xps = NULL;
avtab_extended_perms_t *xperms = NULL;
if (xperms_iter) {
*xperms_iter = NULL;
}
if (!policy || !rule || !xperms_iter) {
ERR(policy, "%s", strerror(EINVAL));
errno = EINVAL;
return STATUS_ERR;
}
avrule = (avtab_ptr_t) rule;
if (!(avrule->key.specified & QPOL_RULE_XPERMS)) {
ERR(policy, "%s", strerror(EINVAL));
errno = EINVAL;
return STATUS_ERR;
}
xperms = avrule->datum.xperms;
xps = calloc(1, sizeof(xperm_state_t));
if (!xps) {
return STATUS_ERR;
}
xps->xperms = xperms;
xps->cur = 0;
if (qpol_iterator_create(policy, (void *)xps, xperm_state_get_cur,
xperm_state_next, xperm_state_end, xperm_state_size, free, xperms_iter)) {
return STATUS_ERR;
}
if (!((xperms->perms[0] & 1) && ((xperms->specified & AVTAB_XPERMS_IOCTLDRIVER) || xperms->driver == 0))) /* defaults to bit 0, if off: advance */
xperm_state_next(*xperms_iter);
return STATUS_SUCCESS;
}
int qpol_avrule_get_xperm_type(const qpol_policy_t * policy, const qpol_avrule_t * rule, char ** type)
{
avtab_ptr_t avrule = NULL;
avtab_extended_perms_t *xperms = NULL;
if (type) {
*type = NULL;
}
if (!policy || !rule || !type) {
ERR(policy, "%s", strerror(EINVAL));
errno = EINVAL;
return STATUS_ERR;
}
avrule = (avtab_ptr_t) rule;
if (!(avrule->key.specified & QPOL_RULE_XPERMS)) {
ERR(policy, "%s", strerror(EINVAL));
errno = EINVAL;
return STATUS_ERR;
}
xperms = avrule->datum.xperms;
if (xperms->specified & AVTAB_XPERMS_IOCTLFUNCTION ||
xperms->specified & AVTAB_XPERMS_IOCTLDRIVER) {
*type = strdup("ioctl");
} else {
ERR(policy, "%s", strerror(EINVAL));
errno = EINVAL;
return STATUS_ERR;
}
return STATUS_SUCCESS;
}
int qpol_avrule_get_rule_type(const qpol_policy_t * policy, const qpol_avrule_t * rule, uint32_t * rule_type)
{
avtab_ptr_t avrule = NULL;
if (rule_type) {
*rule_type = 0;
}
if (!policy || !rule || !rule_type) {
ERR(policy, "%s", strerror(EINVAL));
errno = EINVAL;
return STATUS_ERR;
}
avrule = (avtab_ptr_t) rule;
*rule_type =
(avrule->key.specified & (QPOL_RULE_AV | QPOL_RULE_XPERMS));
return STATUS_SUCCESS;
}
int qpol_avrule_get_is_extended(const qpol_policy_t * policy, const qpol_avrule_t * rule, uint32_t * is_extended)
{
avtab_ptr_t avrule = NULL;
if (is_extended) {
*is_extended = 0;
}
if (!policy || !rule || !is_extended) {
ERR(policy, "%s", strerror(EINVAL));
errno = EINVAL;
return STATUS_ERR;
}
avrule = (avtab_ptr_t) rule;
*is_extended = (avrule->key.specified & QPOL_RULE_XPERMS) ? 1 : 0;
return STATUS_SUCCESS;
}
int qpol_avrule_get_cond(const qpol_policy_t * policy, const qpol_avrule_t * rule, const qpol_cond_t ** cond)
{
avtab_ptr_t avrule = NULL;
if (cond) {
*cond = NULL;
}
if (!policy || !rule || !cond) {
ERR(policy, "%s", strerror(EINVAL));
errno = EINVAL;
return STATUS_ERR;
}
avrule = (avtab_ptr_t) rule;
*cond = (qpol_cond_t *) avrule->parse_context;
return STATUS_SUCCESS;
}
int qpol_avrule_get_is_enabled(const qpol_policy_t * policy, const qpol_avrule_t * rule, uint32_t * is_enabled)
{
avtab_ptr_t avrule = NULL;
if (is_enabled) {
*is_enabled = 0;
}
if (!policy || !rule || !is_enabled) {
ERR(policy, "%s", strerror(EINVAL));
errno = EINVAL;
return STATUS_ERR;
}
avrule = (avtab_ptr_t) rule;
*is_enabled = ((avrule->merged & QPOL_COND_RULE_ENABLED) ? 1 : 0);
return STATUS_SUCCESS;
}
int qpol_avrule_get_which_list(const qpol_policy_t * policy, const qpol_avrule_t * rule, uint32_t * which_list)
{
avtab_ptr_t avrule = NULL;
if (which_list) {
*which_list = 0;
}
if (!policy || !rule || !which_list) {
ERR(policy, "%s", strerror(EINVAL));
errno = EINVAL;
return STATUS_ERR;
}
avrule = (avtab_ptr_t) rule;
if (!avrule->parse_context) {
ERR(policy, "%s", strerror(EINVAL));
errno = EINVAL;
return STATUS_ERR;
}
*which_list = ((avrule->merged & QPOL_COND_RULE_LIST) ? 1 : 0);
return STATUS_SUCCESS;
}

610
libqpol/cond_query.c
View File

@ -1,610 +0,0 @@
/**
* @file
* Implememtation for the public interface for searching and iterating
* conditionals
*
* @author Kevin Carr kcarr@tresys.com
* @author Jeremy A. Mowery jmowery@tresys.com
* @author Jason Tang jtang@tresys.com
*
* Copyright (C) 2006-2007 Tresys Technology, LLC
*
* This library is free software; you can redistribute it and/or
* modify it under the terms of the GNU Lesser General Public
* License as published by the Free Software Foundation; either
* version 2.1 of the License, or (at your option) any later version.
*
* This library is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
* Lesser General Public License for more details.
*
* You should have received a copy of the GNU Lesser General Public
* License along with this library; if not, write to the Free Software
* Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA
*/
#include <qpol/policy.h>
#include <qpol/cond_query.h>
#include <qpol/bool_query.h>
#include <qpol/avrule_query.h>
#include <qpol/terule_query.h>
#include <qpol/iterator.h>
#include "iterator_internal.h"
#include "qpol_internal.h"
#include <sepol/policydb/conditional.h>
#include <stdlib.h>
#include <errno.h>
typedef struct cond_state
{
cond_node_t *head;
cond_node_t *cur;
} cond_state_t;
static int cond_state_end(const qpol_iterator_t * iter)
{
cond_state_t *cs = NULL;
if (!iter || !(cs = (cond_state_t *) qpol_iterator_state(iter))) {
errno = EINVAL;
return STATUS_ERR;
}
return cs->cur ? 0 : 1;
}
static void *cond_state_get_cur(const qpol_iterator_t * iter)
{
cond_state_t *cs = NULL;
if (!iter || !(cs = (cond_state_t *) qpol_iterator_state(iter)) || qpol_iterator_end(iter)) {
errno = EINVAL;
return NULL;
}
return cs->cur;
}
static int cond_state_next(qpol_iterator_t * iter)
{
cond_state_t *cs = NULL;
if (!iter || !(cs = (cond_state_t *) qpol_iterator_state(iter))) {
errno = EINVAL;
return STATUS_ERR;
}
if (qpol_iterator_end(iter)) {
errno = ERANGE;
return STATUS_ERR;
}
cs->cur = cs->cur->next;
return STATUS_SUCCESS;
}
static size_t cond_state_size(const qpol_iterator_t * iter)
{
cond_state_t *cs = NULL;
cond_node_t *tmp = NULL;
size_t count = 0;
if (!iter || !(cs = (cond_state_t *) qpol_iterator_state(iter))) {
errno = EINVAL;
return 0;
}
for (tmp = cs->head; tmp; tmp = tmp->next)
count++;
return count;
}
int qpol_policy_get_cond_iter(const qpol_policy_t * policy, qpol_iterator_t ** iter)
{
int error = 0;
cond_state_t *cs = NULL;
policydb_t *db = NULL;
if (iter)
*iter = NULL;
if (!policy || !iter) {
ERR(policy, "%s", strerror(EINVAL));
errno = EINVAL;
return STATUS_ERR;
}
if (!qpol_policy_has_capability(policy, QPOL_CAP_RULES_LOADED)) {
ERR(policy, "%s", "Cannot get conditionals: Rules not loaded");
errno = ENOTSUP;
return STATUS_ERR;
}
db = &policy->p->p;
if (!(cs = calloc(1, sizeof(cond_state_t)))) {
error = errno;
ERR(policy, "%s", strerror(error));
goto err;
}
cs->head = cs->cur = db->cond_list;
if (qpol_iterator_create(policy, (void *)cs,
cond_state_get_cur, cond_state_next, cond_state_end, cond_state_size, free, iter)) {
error = errno;
goto err;
}
return STATUS_SUCCESS;
err:
free(cs);
errno = error;
return STATUS_ERR;
}
typedef struct cond_expr_state
{
cond_expr_t *head;
cond_expr_t *cur;
} cond_expr_state_t;
static int cond_expr_state_end(const qpol_iterator_t * iter)
{
cond_expr_state_t *ces = NULL;
if (!iter || !(ces = (cond_expr_state_t *) qpol_iterator_state(iter))) {
errno = EINVAL;
return STATUS_ERR;
}
return ces->cur ? 0 : 1;
}
static void *cond_expr_state_get_cur(const qpol_iterator_t * iter)
{
cond_expr_state_t *ces = NULL;
if (!iter || !(ces = (cond_expr_state_t *) qpol_iterator_state(iter)) || qpol_iterator_end(iter)) {
errno = EINVAL;
return NULL;
}
return ces->cur;
}
static int cond_expr_state_next(qpol_iterator_t * iter)
{
cond_expr_state_t *ces = NULL;
if (!iter || !(ces = (cond_expr_state_t *) qpol_iterator_state(iter))) {
errno = EINVAL;
return STATUS_ERR;
}
if (qpol_iterator_end(iter)) {
errno = ERANGE;
return STATUS_ERR;
}
ces->cur = ces->cur->next;
return STATUS_SUCCESS;
}
static size_t cond_expr_state_size(const qpol_iterator_t * iter)
{
cond_expr_state_t *ces = NULL;
cond_expr_t *tmp = NULL;
size_t count = 0;
if (!iter || !(ces = (cond_expr_state_t *) qpol_iterator_state(iter))) {
errno = EINVAL;
return 0;
}
for (tmp = ces->head; tmp; tmp = tmp->next)
count++;
return count;
}
int qpol_cond_get_expr_node_iter(const qpol_policy_t * policy, const qpol_cond_t * cond, qpol_iterator_t ** iter)
{
int error = 0;
cond_expr_state_t *ces = NULL;
cond_node_t *internal_cond = NULL;
if (iter)
*iter = NULL;
if (!policy || !cond || !iter) {
ERR(policy, "%s", strerror(EINVAL));
errno = EINVAL;
return STATUS_ERR;
}
internal_cond = (cond_node_t *) cond;
if (!(ces = calloc(1, sizeof(cond_expr_state_t)))) {
error = errno;
ERR(policy, "%s", strerror(error));
goto err;
}
ces->head = ces->cur = internal_cond->expr;
if (qpol_iterator_create(policy, (void *)ces,
cond_expr_state_get_cur, cond_expr_state_next, cond_expr_state_end,
cond_expr_state_size, free, iter)) {
error = errno;
goto err;
}
return STATUS_SUCCESS;
err:
free(ces);
errno = error;
return STATUS_ERR;
}
typedef struct cond_rule_state
{
cond_av_list_t *head;
cond_av_list_t *cur;
uint32_t rule_type_mask;
} cond_rule_state_t;
static int cond_rule_state_end(const qpol_iterator_t * iter)
{
cond_rule_state_t *crs = NULL;
if (!iter || !(crs = (cond_rule_state_t *) qpol_iterator_state(iter))) {
errno = EINVAL;
return STATUS_ERR;
}
return crs->cur ? 0 : 1;
}
static void *cond_rule_state_get_cur(const qpol_iterator_t * iter)
{
cond_rule_state_t *crs = NULL;
if (!iter || !(crs = (cond_rule_state_t *) qpol_iterator_state(iter)) || qpol_iterator_end(iter)) {
errno = EINVAL;
return NULL;
}
return crs->cur->node;
}
static int cond_rule_state_next(qpol_iterator_t * iter)
{
cond_rule_state_t *crs = NULL;
if (!iter || !(crs = (cond_rule_state_t *) qpol_iterator_state(iter))) {
errno = EINVAL;
return STATUS_ERR;
}
if (qpol_iterator_end(iter)) {
errno = ERANGE;
return STATUS_ERR;
}
do {
crs->cur = crs->cur->next;
} while (crs->cur && !(crs->cur->node->key.specified & crs->rule_type_mask));
return STATUS_SUCCESS;
}
static size_t cond_rule_state_size(const qpol_iterator_t * iter)
{
cond_rule_state_t *crs = NULL;
cond_av_list_t *tmp = NULL;
size_t count = 0;
if (!iter || !(crs = (cond_rule_state_t *) qpol_iterator_state(iter))) {
errno = EINVAL;
return 0;
}
for (tmp = crs->head; tmp; tmp = tmp->next) {
if (tmp->node->key.specified & crs->rule_type_mask)
count++;
}
return count;
}
int qpol_cond_get_av_true_iter(const qpol_policy_t * policy, const qpol_cond_t * cond, uint32_t rule_type_mask,
qpol_iterator_t ** iter)
{
int error = 0;
cond_rule_state_t *crs = NULL;
cond_node_t *internal_cond = NULL;
if (iter)
*iter = NULL;
if (!policy || !cond || !iter) {
ERR(policy, "%s", strerror(EINVAL));
errno = EINVAL;
return STATUS_ERR;
}
if (rule_type_mask & ~(QPOL_RULE_ALLOW | QPOL_RULE_NEVERALLOW | QPOL_RULE_AUDITALLOW | QPOL_RULE_DONTAUDIT)) {
ERR(policy, "%s", strerror(EINVAL));
errno = EINVAL;
return STATUS_ERR;
}
internal_cond = (cond_node_t *) cond;
if (!(crs = calloc(1, sizeof(cond_rule_state_t)))) {
error = errno;
ERR(policy, "%s", strerror(error));
goto err;
}
crs->head = crs->cur = internal_cond->true_list;
crs->rule_type_mask = rule_type_mask;
if (qpol_iterator_create(policy, (void *)crs,
cond_rule_state_get_cur, cond_rule_state_next, cond_rule_state_end,
cond_rule_state_size, free, iter)) {
error = errno;
goto err;
}
if (crs->cur && !(crs->cur->node->key.specified & crs->rule_type_mask))
qpol_iterator_next(*iter);
return STATUS_SUCCESS;
err:
free(crs);
errno = error;
return STATUS_ERR;
}
int qpol_cond_get_te_true_iter(const qpol_policy_t * policy, const qpol_cond_t * cond, uint32_t rule_type_mask,
qpol_iterator_t ** iter)
{
int error = 0;
cond_rule_state_t *crs = NULL;
cond_node_t *internal_cond = NULL;
if (iter)
*iter = NULL;
if (!policy || !cond || !iter) {
ERR(policy, "%s", strerror(EINVAL));
errno = EINVAL;
return STATUS_ERR;
}
if (rule_type_mask & ~(QPOL_RULE_TYPE_TRANS | QPOL_RULE_TYPE_CHANGE | QPOL_RULE_TYPE_MEMBER)) {
ERR(policy, "%s", strerror(EINVAL));
errno = EINVAL;
return STATUS_ERR;
}
internal_cond = (cond_node_t *) cond;
if (!(crs = calloc(1, sizeof(cond_rule_state_t)))) {
error = errno;
ERR(policy, "%s", strerror(error));
goto err;
}
crs->head = crs->cur = internal_cond->true_list;
crs->rule_type_mask = rule_type_mask;
if (qpol_iterator_create(policy, (void *)crs,
cond_rule_state_get_cur, cond_rule_state_next, cond_rule_state_end,
cond_rule_state_size, free, iter)) {
error = errno;
goto err;
}
if (crs->cur && !(crs->cur->node->key.specified & crs->rule_type_mask))
qpol_iterator_next(*iter);
return STATUS_SUCCESS;
err:
free(crs);
errno = error;
return STATUS_ERR;
}
int qpol_cond_get_av_false_iter(const qpol_policy_t * policy, const qpol_cond_t * cond, uint32_t rule_type_mask,
qpol_iterator_t ** iter)
{
int error = 0;
cond_rule_state_t *crs = NULL;
cond_node_t *internal_cond = NULL;
if (iter)
*iter = NULL;
if (!policy || !cond || !iter) {
ERR(policy, "%s", strerror(EINVAL));
errno = EINVAL;
return STATUS_ERR;
}
if (rule_type_mask & ~(QPOL_RULE_ALLOW | QPOL_RULE_NEVERALLOW | QPOL_RULE_AUDITALLOW | QPOL_RULE_DONTAUDIT)) {
ERR(policy, "%s", strerror(EINVAL));
errno = EINVAL;
return STATUS_ERR;
}
internal_cond = (cond_node_t *) cond;
if (!(crs = calloc(1, sizeof(cond_rule_state_t)))) {
error = errno;
ERR(policy, "%s", strerror(error));
goto err;
}
crs->head = crs->cur = internal_cond->false_list;
crs->rule_type_mask = rule_type_mask;
if (qpol_iterator_create(policy, (void *)crs,
cond_rule_state_get_cur, cond_rule_state_next, cond_rule_state_end,
cond_rule_state_size, free, iter)) {
error = errno;
goto err;
}
if (crs->cur && !(crs->cur->node->key.specified & crs->rule_type_mask))
qpol_iterator_next(*iter);
return STATUS_SUCCESS;
err:
free(crs);
errno = error;
return STATUS_ERR;
}
int qpol_cond_get_te_false_iter(const qpol_policy_t * policy, const qpol_cond_t * cond, uint32_t rule_type_mask,
qpol_iterator_t ** iter)
{
int error = 0;
cond_rule_state_t *crs = NULL;
cond_node_t *internal_cond = NULL;
if (iter)
*iter = NULL;
if (!policy || !cond || !iter) {
ERR(policy, "%s", strerror(EINVAL));
errno = EINVAL;
return STATUS_ERR;
}
if (rule_type_mask & ~(QPOL_RULE_TYPE_TRANS | QPOL_RULE_TYPE_CHANGE | QPOL_RULE_TYPE_MEMBER)) {
ERR(policy, "%s", strerror(EINVAL));
errno = EINVAL;
return STATUS_ERR;
}
internal_cond = (cond_node_t *) cond;
if (!(crs = calloc(1, sizeof(cond_rule_state_t)))) {
error = errno;
ERR(policy, "%s", strerror(error));
goto err;
}
crs->head = crs->cur = internal_cond->false_list;
crs->rule_type_mask = rule_type_mask;
if (qpol_iterator_create(policy, (void *)crs,
cond_rule_state_get_cur, cond_rule_state_next, cond_rule_state_end,
cond_rule_state_size, free, iter)) {
error = errno;
goto err;
}
if (crs->cur && !(crs->cur->node->key.specified & crs->rule_type_mask))
qpol_iterator_next(*iter);
return STATUS_SUCCESS;
err:
free(crs);
errno = error;
return STATUS_ERR;
}
int qpol_cond_eval(const qpol_policy_t * policy, const qpol_cond_t * cond, uint32_t * is_true)
{
int error = 0;
cond_node_t *internal_cond = NULL;
if (is_true)
*is_true = 0;
if (!policy || !cond || !is_true) {
ERR(policy, "%s", strerror(EINVAL));
errno = EINVAL;
return STATUS_ERR;
}
internal_cond = (cond_node_t *) cond;
if ((*is_true = (uint32_t) cond_evaluate_expr(&policy->p->p, internal_cond->expr)) > 1) {
error = ERANGE;
goto err;
}
return STATUS_SUCCESS;
err:
ERR(policy, "%s", strerror(error));
errno = error;
return STATUS_ERR;
}
int qpol_cond_expr_node_get_expr_type(const qpol_policy_t * policy, const qpol_cond_expr_node_t * node, uint32_t * expr_type)
{
cond_expr_t *internal_cond = NULL;
if (expr_type)
*expr_type = 0;
if (!policy || !node || !expr_type) {
ERR(policy, "%s", strerror(EINVAL));
errno = EINVAL;
return STATUS_ERR;
}
internal_cond = (cond_expr_t *) node;
*expr_type = internal_cond->expr_type;
return STATUS_SUCCESS;
}
int qpol_cond_expr_node_get_bool(const qpol_policy_t * policy, const qpol_cond_expr_node_t * node, qpol_bool_t ** cond_bool)
{
int error = 0;
cond_expr_t *internal_cond = NULL;
policydb_t *db = NULL;
if (cond_bool)
*cond_bool = NULL;
if (!policy || !node || !cond_bool) {
ERR(policy, "%s", strerror(EINVAL));
errno = EINVAL;
return STATUS_ERR;
}
db = &policy->p->p;
internal_cond = (cond_expr_t *) node;
if (internal_cond->expr_type != QPOL_COND_EXPR_BOOL) {
error = EINVAL;
goto err;
}
if (!(*cond_bool = (qpol_bool_t *) db->bool_val_to_struct[internal_cond->bool - 1])) {
error = EINVAL;
goto err;
}
return STATUS_SUCCESS;
err:
ERR(policy, "%s", strerror(error));
errno = error;
return STATUS_ERR;
}

897
libqpol/iterator.c
View File

@ -1,897 +0,0 @@
/**
* @file
* Contains the implementation of the qpol_iterator API, both
* public and private, for returning lists of components and rules
* from the policy database.
*
* @author Kevin Carr kcarr@tresys.com
* @author Jeremy A. Mowery jmowery@tresys.com
* @author Jason Tang jtang@tresys.com
*
* Copyright (C) 2006-2008 Tresys Technology, LLC
*
* This library is free software; you can redistribute it and/or
* modify it under the terms of the GNU Lesser General Public
* License as published by the Free Software Foundation; either
* version 2.1 of the License, or (at your option) any later version.
*
* This library is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
* Lesser General Public License for more details.
*
* You should have received a copy of the GNU Lesser General Public
* License along with this library; if not, write to the Free Software
* Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA
*/
#include <config.h>
#include <qpol/iterator.h>
#include <qpol/policy.h>
#include <qpol/mls_query.h>
#include <stdlib.h>
#include <errno.h>
#include <string.h>
#include <sepol/policydb/policydb.h>
#include <sepol/policydb/polcaps.h>
#include <sepol/policydb/util.h>
#include <sepol/policydb.h>
#include "qpol_internal.h"
#include "iterator_internal.h"
/**
* Declaration of qpol_iterator, an arbitrary valued policy component
* iterator used to return lists of components.
*
*/
struct qpol_iterator
{
policydb_t *policy;
void *state;
void *(*get_cur) (const qpol_iterator_t * iter);
int (*next) (qpol_iterator_t * iter);
int (*end) (const qpol_iterator_t * iter);
size_t(*size) (const qpol_iterator_t * iter);
void (*free_fn) (void *x);
};
/**
* The number of buckets in sepol's av tables was statically set in
* libsepol < 2.0.20. With libsepol 2.0.20, this size was dynamically
* calculated based upon the number of rules.
*/
static uint32_t iterator_get_avtab_size(const avtab_t * avtab)
{
#ifdef SEPOL_DYNAMIC_AVTAB
return avtab->nslot;
#else
return AVTAB_SIZE;
#endif
}
int qpol_iterator_create(const qpol_policy_t * policy, void *state,
void *(*get_cur) (const qpol_iterator_t * iter),
int (*next) (qpol_iterator_t * iter),
int (*end) (const qpol_iterator_t * iter),
size_t(*size) (const qpol_iterator_t * iter), void (*free_fn) (void *x), qpol_iterator_t ** iter)
{
int error = 0;
if (iter != NULL)
*iter = NULL;
if (policy == NULL || state == NULL || iter == NULL || get_cur == NULL || next == NULL || end == NULL || size == NULL) {
ERR(policy, "%s", strerror(EINVAL));
errno = EINVAL;
return STATUS_ERR;
}
*iter = calloc(1, sizeof(struct qpol_iterator));
if (*iter == NULL) {
error = errno;
ERR(policy, "%s", strerror(ENOMEM));
errno = error;
return STATUS_ERR;
}
(*iter)->policy = &policy->p->p;
(*iter)->state = state;
(*iter)->get_cur = get_cur;
(*iter)->next = next;
(*iter)->end = end;
(*iter)->size = size;
(*iter)->free_fn = free_fn;
return STATUS_SUCCESS;
}
void *qpol_iterator_state(const qpol_iterator_t * iter)
{
if (iter == NULL || iter->state == NULL) {
errno = EINVAL;
return NULL;
}
return iter->state;
}
const policydb_t *qpol_iterator_policy(const qpol_iterator_t * iter)
{
if (iter == NULL || iter->policy == NULL) {
errno = EINVAL;
return NULL;
}
return iter->policy;
}
void *hash_state_get_cur(const qpol_iterator_t * iter)
{
hash_state_t *hs = NULL;
if (iter == NULL || iter->state == NULL || hash_state_end(iter)) {
errno = EINVAL;
return NULL;
}
hs = (hash_state_t *) iter->state;
return hs->node->datum;
}
void *hash_state_get_cur_key(const qpol_iterator_t * iter)
{
hash_state_t *hs = NULL;
if (iter == NULL || iter->state == NULL || hash_state_end(iter)) {
errno = EINVAL;
return NULL;
}
hs = (hash_state_t *) iter->state;
return hs->node->key;
}
void *ocon_state_get_cur(const qpol_iterator_t * iter)
{
ocon_state_t *os = NULL;
if (iter == NULL || iter->state == NULL || ocon_state_end(iter)) {
errno = EINVAL;
return NULL;
}
os = (ocon_state_t *) iter->state;
return os->cur;
}
void *avtab_state_get_cur(const qpol_iterator_t * iter)
{
avtab_state_t *state;
if (iter == NULL || iter->state == NULL || avtab_state_end(iter)) {
errno = EINVAL;
return NULL;
}
state = (avtab_state_t *) iter->state;
return state->node;
}
int hash_state_next(qpol_iterator_t * iter)
{
hash_state_t *hs = NULL;
if (iter == NULL || iter->state == NULL) {
errno = EINVAL;
return STATUS_ERR;
}
hs = (hash_state_t *) iter->state;
if (hs->table == NULL || *(hs->table) == NULL || hs->bucket >= (*(hs->table))->size) {
errno = ERANGE;
return STATUS_ERR;
}
if (hs->node != NULL && hs->node->next != NULL) {
hs->node = hs->node->next;
} else {
do {
hs->bucket++;
if (hs->bucket < (*(hs->table))->size) {
hs->node = (*(hs->table))->htable[hs->bucket];
} else {
hs->node = NULL;
}
} while (hs->bucket < (*(hs->table))->size && hs->node == NULL);
}
return STATUS_SUCCESS;
}
int ebitmap_state_next(qpol_iterator_t * iter)
{
ebitmap_state_t *es = NULL;
if (iter == NULL || iter->state == NULL) {
errno = EINVAL;
return STATUS_ERR;
}
es = (ebitmap_state_t *) iter->state;
if (es->cur >= es->bmap->highbit) {
errno = ERANGE;
return STATUS_ERR;
}
do {
es->cur++;
} while (es->cur < es->bmap->highbit && !ebitmap_get_bit(es->bmap, es->cur));
return STATUS_SUCCESS;
}
int ocon_state_next(qpol_iterator_t * iter)
{
ocon_state_t *os = NULL;
if (iter == NULL || iter->state == NULL) {
errno = EINVAL;
return STATUS_ERR;
}
os = (ocon_state_t *) iter->state;
if (os->cur == NULL) {
errno = ERANGE;
return STATUS_ERR;
}
os->cur = os->cur->next;
return STATUS_SUCCESS;
}
int avtab_state_next(qpol_iterator_t * iter)
{
avtab_t *avtab;
avtab_state_t *state;
if (iter == NULL || iter->state == NULL) {
errno = EINVAL;
return STATUS_ERR;
}
state = iter->state;
avtab = (state->which == QPOL_AVTAB_STATE_AV ? state->ucond_tab : state->cond_tab);
if ((!avtab->htable || state->bucket >= iterator_get_avtab_size(avtab)) && state->which == QPOL_AVTAB_STATE_COND) {
errno = ERANGE;
return STATUS_ERR;
}
do {
if (state->node != NULL && state->node->next != NULL) {
state->node = state->node->next;
} else {
/* find the next bucket */
do {
state->bucket++;
if (!avtab->htable || state->bucket >= iterator_get_avtab_size(avtab)) {
if (state->which == QPOL_AVTAB_STATE_AV) {
state->bucket = 0;
avtab = state->cond_tab;
state->which = QPOL_AVTAB_STATE_COND;
} else {
state->node = NULL;
break;
}
}
if (avtab->htable && avtab->htable[state->bucket] != NULL) {
state->node = avtab->htable[state->bucket];
break;
}
} while (avtab->htable && state->bucket < iterator_get_avtab_size(avtab));
}
} while (avtab->htable && state->bucket < iterator_get_avtab_size(avtab) &&
state->node ? !(state->rule_type_mask & state->node->key.specified) : 0);
return STATUS_SUCCESS;
}
int hash_state_end(const qpol_iterator_t * iter)
{
hash_state_t *hs = NULL;
if (iter == NULL || iter->state == NULL) {
errno = EINVAL;
return STATUS_ERR;
}
hs = (hash_state_t *) iter->state;
if (hs->table == NULL || *(hs->table) == NULL || (*(hs->table))->nel == 0 || hs->bucket >= (*(hs->table))->size)
return 1;
return 0;
}
int ebitmap_state_end(const qpol_iterator_t * iter)
{
ebitmap_state_t *es = NULL;
if (iter == NULL || iter->state == NULL) {
errno = EINVAL;
return STATUS_ERR;
}
es = (ebitmap_state_t *) iter->state;
if (es->cur >= es->bmap->highbit)
return 1;
return 0;
}
int ocon_state_end(const qpol_iterator_t * iter)
{
ocon_state_t *os = NULL;
if (iter == NULL || iter->state == NULL) {
errno = EINVAL;
return STATUS_ERR;
}
os = (ocon_state_t *) iter->state;
if (os->cur == NULL)
return 1;
return 0;
}
int avtab_state_end(const qpol_iterator_t * iter)
{
avtab_state_t *state;
avtab_t *avtab;
if (iter == NULL || iter->state == NULL) {
errno = EINVAL;
return STATUS_ERR;
}
state = iter->state;
avtab = (state->which == QPOL_AVTAB_STATE_AV ? state->ucond_tab : state->cond_tab);
if ((!avtab->htable || state->bucket >= iterator_get_avtab_size(avtab)) && state->which == QPOL_AVTAB_STATE_COND)
return 1;
return 0;
}
size_t hash_state_size(const qpol_iterator_t * iter)
{
hash_state_t *hs = NULL;
if (iter == NULL || iter->state == NULL) {
errno = EINVAL;
return 0;
}
hs = (hash_state_t *) iter->state;
return (*(hs->table))->nel;
}
size_t ebitmap_state_size(const qpol_iterator_t * iter)
{
ebitmap_state_t *es = NULL;
size_t count = 0, bit = 0;
ebitmap_node_t *node = NULL;
if (iter == NULL || iter->state == NULL) {
errno = EINVAL;
return 0;
}
es = (ebitmap_state_t *) iter->state;
ebitmap_for_each_bit(es->bmap, node, bit) {
count += ebitmap_get_bit(es->bmap, bit);
}
return count;
}
size_t ocon_state_size(const qpol_iterator_t * iter)
{
ocon_state_t *os = NULL;
size_t count = 0;
ocontext_t *ocon = NULL;
if (iter == NULL || iter->state == NULL) {
errno = EINVAL;
return 0;
}
os = (ocon_state_t *) iter->state;
for (ocon = os->head; ocon; ocon = ocon->next)
count++;
return count;
}
size_t avtab_state_size(const qpol_iterator_t * iter)
{
avtab_state_t *state;
avtab_t *avtab;
size_t count = 0;
avtab_ptr_t node = NULL;
uint32_t bucket = 0;
if (iter == NULL || iter->state == NULL || iter->policy == NULL) {
errno = EINVAL;
return STATUS_ERR;
}
state = iter->state;
avtab = state->ucond_tab;
for (bucket = 0; avtab->htable && bucket < iterator_get_avtab_size(avtab); bucket++) {
for (node = avtab->htable[bucket]; node; node = node->next) {
if (node->key.specified & state->rule_type_mask)
count++;
}
}
avtab = state->cond_tab;
for (bucket = 0; avtab->htable && bucket < iterator_get_avtab_size(avtab); bucket++) {
for (node = avtab->htable[bucket]; node; node = node->next) {
if (node->key.specified & state->rule_type_mask)
count++;
}
}
return count;
}
void qpol_iterator_destroy(qpol_iterator_t ** iter)
{
if (iter == NULL || *iter == NULL)
return;
if ((*iter)->free_fn)
(*iter)->free_fn((*iter)->state);
free(*iter);
*iter = NULL;
}
int qpol_iterator_get_item(const qpol_iterator_t * iter, void **item)
{
if (item != NULL)
*item = NULL;
if (iter == NULL || iter->get_cur == NULL || item == NULL) {
errno = EINVAL;
return STATUS_ERR;
}
*item = iter->get_cur(iter);
if (*item == NULL)
return STATUS_ERR;
return STATUS_SUCCESS;
}
int qpol_iterator_next(qpol_iterator_t * iter)
{
if (iter == NULL || iter->next == NULL) {
errno = EINVAL;
return STATUS_ERR;
}
return iter->next(iter);
}
int qpol_iterator_end(const qpol_iterator_t * iter)
{
if (iter == NULL || iter->end == NULL) {
errno = EINVAL;
return STATUS_ERR;
}
return iter->end(iter);
}
int qpol_iterator_get_size(const qpol_iterator_t * iter, size_t * size)
{
if (size != NULL)
*size = 0;
if (iter == NULL || size == NULL || iter->size == NULL) {
errno = EINVAL;
return STATUS_ERR;
}
*size = iter->size(iter);
return STATUS_SUCCESS;
}
void *ebitmap_state_get_cur_type(const qpol_iterator_t * iter)
{
ebitmap_state_t *es = NULL;
const policydb_t *db = NULL;
if (iter == NULL) {
errno = EINVAL;
return NULL;
}
es = qpol_iterator_state(iter);
if (es == NULL) {
errno = EINVAL;
return NULL;
}
db = qpol_iterator_policy(iter);
if (db == NULL) {
errno = EINVAL;
return NULL;
}
return db->type_val_to_struct[es->cur];
}
void *ebitmap_state_get_cur_role(const qpol_iterator_t * iter)
{
ebitmap_state_t *es = NULL;
const policydb_t *db = NULL;
if (iter == NULL) {
errno = EINVAL;
return NULL;
}
es = qpol_iterator_state(iter);
if (es == NULL) {
errno = EINVAL;
return NULL;
}
db = qpol_iterator_policy(iter);
if (db == NULL) {
errno = EINVAL;
return NULL;
}
return db->role_val_to_struct[es->cur];
}
void *ebitmap_state_get_cur_permissive(const qpol_iterator_t * iter)
{
ebitmap_state_t *es = NULL;
const policydb_t *db = NULL;
if (iter == NULL) {
errno = EINVAL;
return NULL;
}
es = qpol_iterator_state(iter);
if (es == NULL) {
errno = EINVAL;
return NULL;
}
db = qpol_iterator_policy(iter);
if (db == NULL) {
errno = EINVAL;
return NULL;
}
return db->type_val_to_struct[es->cur - 1];
}
void *ebitmap_state_get_cur_polcap(const qpol_iterator_t * iter)
{
ebitmap_state_t *es = NULL;
const policydb_t *db = NULL;
if (iter == NULL) {
errno = EINVAL;
return NULL;
}
es = qpol_iterator_state(iter);
if (es == NULL) {
errno = EINVAL;
return NULL;
}
db = qpol_iterator_policy(iter);
if (db == NULL) {
errno = EINVAL;
return NULL;
}
return (void *)sepol_polcap_getname(es->cur);
}
void ebitmap_state_destroy(void *es)
{
ebitmap_state_t *ies = (ebitmap_state_t *) es;
if (!es)
return;
ebitmap_destroy(ies->bmap);
free(ies->bmap);
free(ies);
}
int perm_state_end(const qpol_iterator_t * iter)
{
perm_state_t *ps = NULL;
const policydb_t *db = NULL;
unsigned int perm_max = 0;
if (iter == NULL || (ps = qpol_iterator_state(iter)) == NULL || (db = qpol_iterator_policy(iter)) == NULL) {
errno = EINVAL;
return STATUS_ERR;
}
/* permission max is number of permissions in the class which includes
* the number of permissions in its common if it inherits one */
perm_max = db->class_val_to_struct[ps->obj_class_val - 1]->permissions.nprim;
if (perm_max > 32) {
errno = EDOM; /* perms set mask is a uint32_t cannot use more than 32 bits */
return STATUS_ERR;
}
if (!(ps->perm_set) || ps->cur >= perm_max)
return 1;
return 0;
}
void *perm_state_get_cur(const qpol_iterator_t * iter)
{
const policydb_t *db = NULL;
class_datum_t *obj_class = NULL;
perm_state_t *ps = NULL;
unsigned int perm_max = 0;
char *tmp = NULL;
if (iter == NULL || (db = qpol_iterator_policy(iter)) == NULL ||
(ps = (perm_state_t *) qpol_iterator_state(iter)) == NULL || perm_state_end(iter)) {
errno = EINVAL;
return NULL;
}
obj_class = db->class_val_to_struct[ps->obj_class_val - 1];
/* permission max is number of permissions in the class which includes
* the number of permissions in its common if it inherits one */
perm_max = obj_class->permissions.nprim;
if (perm_max > 32) {
errno = EDOM; /* perms set mask is a uint32_t cannot use more than 32 bits */
return NULL;
}
if (ps->cur >= perm_max) {
errno = ERANGE;
return NULL;
}
if (!(ps->perm_set & 1 << (ps->cur))) { /* perm bit not set? */
errno = EINVAL;
return NULL;
}
/* explicit const_cast for sepol */
tmp = sepol_av_to_string((policydb_t *) db, ps->obj_class_val, (sepol_access_vector_t) 1 << (ps->cur));
if (tmp) {
tmp++; /*sepol_av_to_string prepends a ' ' to the name */
return strdup(tmp);
} else {
errno = EINVAL;
return NULL;
}
}
int perm_state_next(qpol_iterator_t * iter)
{
perm_state_t *ps = NULL;
const policydb_t *db = NULL;
unsigned int perm_max = 0;
if (iter == NULL || (ps = qpol_iterator_state(iter)) == NULL ||
(db = qpol_iterator_policy(iter)) == NULL || perm_state_end(iter)) {
errno = EINVAL;
return STATUS_ERR;
}
/* permission max is number of permissions in the class which includes
* the number of permissions in its common if it inherits one */
perm_max = db->class_val_to_struct[ps->obj_class_val - 1]->permissions.nprim;
if (perm_max > 32) {
errno = EDOM; /* perms set mask is a uint32_t cannot use more than 32 bits */
return STATUS_ERR;
}
if (ps->cur >= perm_max) {
errno = ERANGE;
return STATUS_ERR;
}
do {
ps->cur++;
} while (ps->cur < perm_max && !(ps->perm_set & 1 << (ps->cur)));
return STATUS_SUCCESS;
}
size_t perm_state_size(const qpol_iterator_t * iter)
{
perm_state_t *ps = NULL;
const policydb_t *db = NULL;
unsigned int perm_max = 0;
size_t i, count = 0;
if (iter == NULL || (ps = qpol_iterator_state(iter)) == NULL ||
(db = qpol_iterator_policy(iter)) == NULL || perm_state_end(iter)) {
errno = EINVAL;
return 0; /* as a size_t 0 is error */
}
/* permission max is number of permissions in the class which includes
* the number of permissions in its common if it inherits one */
perm_max = db->class_val_to_struct[ps->obj_class_val - 1]->permissions.nprim;
if (perm_max > 32) {
errno = EDOM; /* perms set mask is a uint32_t cannot use more than 32 bits */
return 0; /* as a size_t 0 is error */
}
for (i = 0; i < perm_max; i++) {
if (ps->perm_set & 1 << i)
count++;
}
return count;
}
#define XPERMS_DRIV(x) (x >> 8)
#define XPERMS_FUNC(x) (x & 0xFF)
#define XPERMS_GETBIT(xperms, bit) (xperms[(bit) >> 5] & (1 << ((bit) & 0x1F)))
int xperm_state_end(const qpol_iterator_t * iter)
{
xperm_state_t *xps = NULL;
const policydb_t *db = NULL;
if (iter == NULL || (xps = qpol_iterator_state(iter)) == NULL || (db = qpol_iterator_policy(iter)) == NULL) {
errno = EINVAL;
return STATUS_ERR;
}
if (xps->cur > 0xFFFF)
return 1;
return 0;
}
void *xperm_state_get_cur(const qpol_iterator_t * iter)
{
const policydb_t *db = NULL;
xperm_state_t *xps = NULL;
avtab_extended_perms_t *xperms = NULL;
int bitset;
int *cur;
if (iter == NULL || (db = qpol_iterator_policy(iter)) == NULL ||
(xps = (xperm_state_t *) qpol_iterator_state(iter)) == NULL || xperm_state_end(iter)) {
errno = EINVAL;
return NULL;
}
if (xps->cur > 0xFFFF) {
errno = ERANGE;
return NULL;
}
xperms = xps->xperms;
if (xperms->specified & AVTAB_XPERMS_IOCTLDRIVER) {
bitset = XPERMS_GETBIT(xperms->perms, XPERMS_DRIV(xps->cur));
} else {
bitset = (xperms->driver == XPERMS_DRIV(xps->cur)) && XPERMS_GETBIT(xperms->perms, XPERMS_FUNC(xps->cur));
}
if (!bitset) { /* xperm bit not set? */
errno = EINVAL;
return NULL;
}
// the caller is responsible for freeing the returned integer. this is
// similar to how the caller must also free the resulting string of
// perm_state_get_cur
cur = calloc(1, sizeof(int));
if (cur == NULL) {
return NULL;
}
*cur = xps->cur;
return cur;
}
int xperm_state_next(qpol_iterator_t * iter)
{
xperm_state_t *xps = NULL;
const policydb_t *db = NULL;
avtab_extended_perms_t *xperms = NULL;
int bitset = 0;
if (iter == NULL || (xps = qpol_iterator_state(iter)) == NULL ||
(db = qpol_iterator_policy(iter)) == NULL || xperm_state_end(iter)) {
errno = EINVAL;
return STATUS_ERR;
}
if (xps->cur > 0xFFFF) {
errno = ERANGE;
return STATUS_ERR;
}
xperms = xps->xperms;
while (1) {
xps->cur++;
if (xps->cur > 0xFFFF) {
break;
}
if (xperms->specified & AVTAB_XPERMS_IOCTLDRIVER) {
bitset = XPERMS_GETBIT(xperms->perms, XPERMS_DRIV(xps->cur));
} else {
bitset = (xperms->driver == XPERMS_DRIV(xps->cur)) && XPERMS_GETBIT(xperms->perms, XPERMS_FUNC(xps->cur));
}
if (bitset) {
break;
}
}
return STATUS_SUCCESS;
}
size_t xperm_state_size(const qpol_iterator_t * iter)
{
xperm_state_t *xps = NULL;
const policydb_t *db = NULL;
avtab_extended_perms_t *xperms = NULL;
size_t i, j, count = 0;
if (iter == NULL || (xps = qpol_iterator_state(iter)) == NULL ||
(db = qpol_iterator_policy(iter)) == NULL || xperm_state_end(iter)) {
errno = EINVAL;
return 0; /* as a size_t 0 is error */
}
xperms = xps->xperms;
// just count how many bits are set in the perms array (size == 8) of uint32_t's
for (i = 0; i < 8; i++) {
for (j = 0; j < 32; j++) {
if (xperms->perms[i] & (1 << j)) {
count++;
}
}
}
if (xperms->specified & AVTAB_XPERMS_IOCTLDRIVER) {
// when icotl driver is true, each bit in the perms array represents
// the enabling of all 256 function bits of driver
count *= 256;
}
return count;
}

100
libqpol/policy_extend.c
View File

@ -383,100 +383,6 @@ static int qpol_policy_add_isid_names(qpol_policy_t * policy)
return 0;
}
/**
* Walks the conditional list and adds links for reverse look up from
* a te/av rule to the conditional from which it came.
* @param policy The policy to which to add conditional trace backs.
* This policy will be altered by this function.
* @return 0 on success and < 0 on failure; if the call fails,
* errno will be set. On failure, the policy state may be inconsistent.
*/
static int qpol_policy_add_cond_rule_traceback(qpol_policy_t * policy)
{
policydb_t *db = NULL;
cond_node_t *cond = NULL;
cond_av_list_t *list_ptr = NULL;
qpol_iterator_t *iter = NULL;
avtab_ptr_t rule = NULL;
int error = 0;
uint32_t rules = 0;
INFO(policy, "%s", "Building conditional rules tables. (Step 5 of 5)");
if (!policy) {
ERR(policy, "%s", strerror(EINVAL));
errno = EINVAL;
return STATUS_ERR;
}
db = &policy->p->p;
rules = (QPOL_RULE_ALLOW | QPOL_RULE_AUDITALLOW | QPOL_RULE_DONTAUDIT);
if (!(policy->options & QPOL_POLICY_OPTION_NO_NEVERALLOWS))
rules |= QPOL_RULE_NEVERALLOW;
/* mark all unconditional rules as enabled */
if (qpol_policy_get_avrule_iter(policy, rules, &iter))
return STATUS_ERR;
for (; !qpol_iterator_end(iter); qpol_iterator_next(iter)) {
if (qpol_iterator_get_item(iter, (void **)&rule)) {
error = errno;
ERR(policy, "%s", strerror(error));
errno = error;
return STATUS_ERR;
}
rule->parse_context = NULL;
rule->merged = QPOL_COND_RULE_ENABLED;
}
qpol_iterator_destroy(&iter);
if (qpol_policy_get_terule_iter(policy, (QPOL_RULE_TYPE_TRANS | QPOL_RULE_TYPE_CHANGE | QPOL_RULE_TYPE_MEMBER), &iter))
return STATUS_ERR;
for (; !qpol_iterator_end(iter); qpol_iterator_next(iter)) {
if (qpol_iterator_get_item(iter, (void **)&rule)) {
error = errno;
ERR(policy, "%s", strerror(error));
errno = error;
return STATUS_ERR;
}
rule->parse_context = NULL;
rule->merged = QPOL_COND_RULE_ENABLED;
}
qpol_iterator_destroy(&iter);
for (cond = db->cond_list; cond; cond = cond->next) {
/* evaluate cond */
cond->cur_state = cond_evaluate_expr(db, cond->expr);
if (cond->cur_state < 0) {
ERR(policy, "Error evaluating conditional: %s", strerror(EILSEQ));
errno = EILSEQ;
return STATUS_ERR;
}
/* walk true list */
for (list_ptr = cond->true_list; list_ptr; list_ptr = list_ptr->next) {
/* field not used after parse, now stores cond */
list_ptr->node->parse_context = (void *)cond;
/* field not used (except by write),
* now storing list and enabled flags */
list_ptr->node->merged = QPOL_COND_RULE_LIST;
if (cond->cur_state)
list_ptr->node->merged |= QPOL_COND_RULE_ENABLED;
}
/* walk false list */
for (list_ptr = cond->false_list; list_ptr; list_ptr = list_ptr->next) {
/* field not used after parse, now stores cond */
list_ptr->node->parse_context = (void *)cond;
/* field not used (except by write),
* now storing list and enabled flags */
list_ptr->node->merged = 0; /* i.e. !QPOL_COND_RULE_LIST */
if (!cond->cur_state)
list_ptr->node->merged |= QPOL_COND_RULE_ENABLED;
}
}
return 0;
}
int policy_extend(qpol_policy_t * policy)
{
int retv, error;
@ -516,12 +422,6 @@ int policy_extend(qpol_policy_t * policy)
goto err;
}
retv = qpol_policy_add_cond_rule_traceback(policy);
if (retv) {
error = errno;
goto err;
}
return STATUS_SUCCESS;
err:

262
libqpol/terule_query.c
View File

@ -1,262 +0,0 @@
/**
* @file
* Implementation for the public interface for searching and iterating over type rules.
*
* @author Kevin Carr kcarr@tresys.com
* @author Jeremy A. Mowery jmowery@tresys.com
* @author Jason Tang jtang@tresys.com
*
* Copyright (C) 2006-2007 Tresys Technology, LLC
*
* This library is free software; you can redistribute it and/or
* modify it under the terms of the GNU Lesser General Public
* License as published by the Free Software Foundation; either
* version 2.1 of the License, or (at your option) any later version.
*
* This library is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
* Lesser General Public License for more details.
*
* You should have received a copy of the GNU Lesser General Public
* License along with this library; if not, write to the Free Software
* Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA
*/
#include "iterator_internal.h"
#include <qpol/iterator.h>
#include <qpol/policy.h>
#include <qpol/terule_query.h>
#include <sepol/policydb/policydb.h>
#include <sepol/policydb/avtab.h>
#include <sepol/policydb/util.h>
#include <stdlib.h>
#include "qpol_internal.h"
int qpol_policy_get_terule_iter(const qpol_policy_t * policy, uint32_t rule_type_mask, qpol_iterator_t ** iter)
{
policydb_t *db;
avtab_state_t *state;
if (iter) {
*iter = NULL;
}
if (policy == NULL || iter == NULL) {
ERR(policy, "%s", strerror(EINVAL));
errno = EINVAL;
return STATUS_ERR;
}
#if 1 // Seems to make sediff/sediffx work better without breaking things
if (!qpol_policy_has_capability(policy, QPOL_CAP_RULES_LOADED)) {
ERR(policy, "%s", "Cannot get terules: Rules not loaded");
errno = ENOTSUP;
return STATUS_ERR;
}
#endif
db = &policy->p->p;
state = calloc(1, sizeof(avtab_state_t));
if (state == NULL) {
ERR(policy, "%s", strerror(ENOMEM));
errno = ENOMEM;
return STATUS_ERR;
}
state->ucond_tab = &db->te_avtab;
state->cond_tab = &db->te_cond_avtab;
state->rule_type_mask = rule_type_mask;
state->node = db->te_avtab.htable[0];
if (qpol_iterator_create
(policy, state, avtab_state_get_cur, avtab_state_next, avtab_state_end, avtab_state_size, free, iter)) {
free(state);
return STATUS_ERR;
}
if (state->node == NULL || !(state->node->key.specified & state->rule_type_mask)) {
avtab_state_next(*iter);
}
return STATUS_SUCCESS;
}
int qpol_terule_get_source_type(const qpol_policy_t * policy, const qpol_terule_t * rule, const qpol_type_t ** source)
{
policydb_t *db = NULL;
avtab_ptr_t terule = NULL;
if (source) {
*source = NULL;
}
if (!policy || !rule || !source) {
ERR(policy, "%s", strerror(EINVAL));
errno = EINVAL;
return STATUS_ERR;
}
db = &policy->p->p;
terule = (avtab_ptr_t) rule;
*source = (qpol_type_t *) db->type_val_to_struct[terule->key.source_type - 1];
return STATUS_SUCCESS;
}
int qpol_terule_get_target_type(const qpol_policy_t * policy, const qpol_terule_t * rule, const qpol_type_t ** target)
{
policydb_t *db = NULL;
avtab_ptr_t terule = NULL;
if (target) {
*target = NULL;
}
if (!policy || !rule || !target) {
ERR(policy, "%s", strerror(EINVAL));
errno = EINVAL;
return STATUS_ERR;
}
db = &policy->p->p;
terule = (avtab_ptr_t) rule;
*target = (qpol_type_t *) db->type_val_to_struct[terule->key.target_type - 1];
return STATUS_SUCCESS;
}
int qpol_terule_get_object_class(const qpol_policy_t * policy, const qpol_terule_t * rule, const qpol_class_t ** obj_class)
{
policydb_t *db = NULL;
avtab_ptr_t terule = NULL;
if (obj_class) {
*obj_class = NULL;
}
if (!policy || !rule || !obj_class) {
ERR(policy, "%s", strerror(EINVAL));
errno = EINVAL;
return STATUS_ERR;
}
db = &policy->p->p;
terule = (avtab_ptr_t) rule;
*obj_class = (qpol_class_t *) db->class_val_to_struct[terule->key.target_class - 1];
return STATUS_SUCCESS;
}
int qpol_terule_get_default_type(const qpol_policy_t * policy, const qpol_terule_t * rule, const qpol_type_t ** dflt)
{
policydb_t *db = NULL;
avtab_ptr_t terule = NULL;
if (dflt) {
*dflt = NULL;
}
if (!policy || !rule || !dflt) {
ERR(policy, "%s", strerror(EINVAL));
errno = EINVAL;
return STATUS_ERR;
}
db = &policy->p->p;
terule = (avtab_ptr_t) rule;
*dflt = (qpol_type_t *) db->type_val_to_struct[terule->datum.data - 1];
return STATUS_SUCCESS;
}
int qpol_terule_get_rule_type(const qpol_policy_t * policy, const qpol_terule_t * rule, uint32_t * rule_type)
{
avtab_ptr_t terule = NULL;
if (rule_type) {
*rule_type = 0;
}
if (!policy || !rule || !rule_type) {
ERR(policy, "%s", strerror(EINVAL));
errno = EINVAL;
return STATUS_ERR;
}
terule = (avtab_ptr_t) rule;
*rule_type = (terule->key.specified & (QPOL_RULE_TYPE_TRANS | QPOL_RULE_TYPE_CHANGE | QPOL_RULE_TYPE_MEMBER));
return STATUS_SUCCESS;
}
int qpol_terule_get_cond(const qpol_policy_t * policy, const qpol_terule_t * rule, const qpol_cond_t ** cond)
{
avtab_ptr_t terule = NULL;
if (cond) {
*cond = NULL;
}
if (!policy || !rule || !cond) {
ERR(policy, "%s", strerror(EINVAL));
errno = EINVAL;
return STATUS_ERR;
}
terule = (avtab_ptr_t) rule;
*cond = (qpol_cond_t *) terule->parse_context;
return STATUS_SUCCESS;
}
int qpol_terule_get_is_enabled(const qpol_policy_t * policy, const qpol_terule_t * rule, uint32_t * is_enabled)
{
avtab_ptr_t terule = NULL;
if (is_enabled) {
*is_enabled = 0;
}
if (!policy || !rule || !is_enabled) {
ERR(policy, "%s", strerror(EINVAL));
errno = EINVAL;
return STATUS_ERR;
}
terule = (avtab_ptr_t) rule;
*is_enabled = ((terule->merged & QPOL_COND_RULE_ENABLED) ? 1 : 0);
return STATUS_SUCCESS;
}
int qpol_terule_get_which_list(const qpol_policy_t * policy, const qpol_terule_t * rule, uint32_t * which_list)
{
avtab_ptr_t terule = NULL;
if (which_list) {
*which_list = 0;
}
if (!policy || !rule || !which_list) {
ERR(policy, "%s", strerror(EINVAL));
errno = EINVAL;
return STATUS_ERR;
}
terule = (avtab_ptr_t) rule;
if (!terule->parse_context) {
ERR(policy, "%s", strerror(EINVAL));
errno = EINVAL;
return STATUS_ERR;
}
*which_list = ((terule->merged & QPOL_COND_RULE_LIST) ? 1 : 0);
return STATUS_SUCCESS;
}

23
setools/policyrep/boolcond.pxi
View File

@ -139,6 +139,25 @@ cdef class Conditional(PolicySymbol):
except TypeError:
return str(self) == str(other)
def __deepcopy__(self, memo):
# shallow copy as all of the members are immutable
newobj = Conditional.factory(self.policy, self.handle)
memo[id(self)] = newobj
return newobj
def __getstate__(self):
return (self.policy, self._pickle())
def __setstate__(self, state):
self.policy = state[0]
self._unpickle(state[1])
cdef bytes _pickle(self):
return <bytes>(<char *>self.handle)
cdef _unpickle(self, bytes handle):
memcpy(&self.handle, <char *>handle, sizeof(sepol.cond_node_t *))
def _eq(self, Conditional other):
"""Low-level equality check (C pointers)."""
return self.handle == other.handle
@ -206,14 +225,14 @@ cdef class Conditional(PolicySymbol):
def false_rules(self):
"""An iterator over the rules in the false (else) block of the conditional."""
pass
return ConditionalTERuleIterator.factory(self.policy, self.handle.false_list, self, False)
def statement(self):
raise NoStatement
def true_rules(self):
"""An iterator over the rules in the true block of the conditional."""
pass
return ConditionalTERuleIterator.factory(self.policy, self.handle.true_list, self, True)
def truth_table(self):
"""

69
setools/policyrep/libpolicyrep.pyx
View File

@ -275,75 +275,6 @@ include "user.pxi"
include "xencontext.pxi"
cdef QpolIterator qpol_iterator_factory(SELinuxPolicy policy, qpol_iterator_t *iter, factory,
suppress=None):
i = QpolIterator()
i.policy = policy
i.iter = iter
i.factory = factory
i.suppress = suppress
return i
cdef class QpolIterator:
cdef:
qpol_iterator_t *iter
SELinuxPolicy policy
object factory
object suppress
def __dealloc__(self):
if self.iter:
qpol_iterator_destroy(&self.iter)
def __iter__(self):
return self
def __next__(self):
cdef void *item
while not qpol_iterator_end(self.iter):
qpol_iterator_get_item(self.iter, &item)
qpol_iterator_next(self.iter)
w = QpolIteratorItem()
w.obj = item
if self.suppress:
# this is to handle where factory functions
# throw exceptions since aliases are included
# in some qpol iterators (i.e. that's how
# the policy structure works)
try:
return self.factory(self.policy, w)
except self.suppress:
pass
else:
return self.factory(self.policy, w)
raise StopIteration
def __len__(self):
cdef size_t s
qpol_iterator_get_size(self.iter, &s)
return s
cdef class QpolIteratorItem:
"""Wrap void pointers so they can be passed easily."""
cdef void *obj
cdef str string_factory_iter(SELinuxPolicy _, QpolIteratorItem item):
"""Factory function for returning strings from qpol iterators."""
return intern(<const char *> item.obj)
cdef int ebitmap_get_bit(sepol.ebitmap_t *e, unsigned int bit):
"""
Get a specific bit value.

25
setools/policyrep/selinuxpolicy.pxi
View File

@ -602,27 +602,12 @@ cdef class SELinuxPolicy:
def terules(self):
"""Iterator over all type enforcement rules."""
cdef qpol_iterator_t *av_iter
cdef qpol_iterator_t *te_iter
cdef qpol_iterator_t *ft_iter
yield from TERuleIterator.factory(self, &self.handle.p.p.te_avtab)
yield from FileNameTERuleIterator.factory(self, &self.handle.p.p.filename_trans)
cdef uint32_t av_rule_types = QPOL_RULE_ALLOW | QPOL_RULE_AUDITALLOW | QPOL_RULE_DONTAUDIT \
| QPOL_RULE_XPERMS_ALLOW | QPOL_RULE_XPERMS_AUDITALLOW | QPOL_RULE_XPERMS_DONTAUDIT
cdef uint32_t te_rule_types = QPOL_RULE_TYPE_TRANS | QPOL_RULE_TYPE_CHANGE | QPOL_RULE_TYPE_MEMBER
if qpol_policy_has_capability(self.handle, QPOL_CAP_NEVERALLOW):
av_rule_types |= QPOL_RULE_NEVERALLOW | QPOL_RULE_XPERMS_NEVERALLOW
if qpol_policy_get_avrule_iter(self.handle, av_rule_types, &av_iter):
raise MemoryError
if qpol_policy_get_terule_iter(self.handle, te_rule_types, &te_iter):
raise MemoryError
return chain(qpol_iterator_factory(self, av_iter, avrule_factory_iter),
qpol_iterator_factory(self, te_iter, terule_factory_iter),
FileNameTERuleIterator.factory(self, &self.handle.p.p.filename_trans))
for c in self.conditionals():
yield from c.true_rules()
yield from c.false_rules()
#
# Constraints iterators

2
setools/policyrep/sepol.pxd
View File

@ -440,6 +440,8 @@ cdef extern from "<sepol/policydb/policydb.h>":
ctypedef av_extended_perms av_extended_perms_t
cdef bint xperm_test(size_t x, uint32_t *perms)
#
# avrule_t
#

883
setools/policyrep/terule.pxi
View File

File diff suppressed because it is too large Load Diff

5
setup.py
View File

@ -66,11 +66,8 @@ else:
ext_py_mods = [Extension('setools.policyrep.libpolicyrep',
['setools/policyrep/libpolicyrep.pyx',
'libqpol/avrule_query.c',
'libqpol/iterator.c',
'libqpol/policy.c',
'libqpol/policy_extend.c',
'libqpol/terule_query.c'],
'libqpol/policy_extend.c'],
include_dirs=include_dirs,
libraries=['selinux'],
extra_compile_args=['-Werror', '-Wextra',