From f012d55b1176095f949030344cb2040e5a0c75a9 Mon Sep 17 00:00:00 2001 From: Chris PeBenito Date: Sun, 25 Feb 2018 09:13:25 -0500 Subject: [PATCH] policyrep: Convert TE rules to direct sepol structure access. --- libqpol/avrule_query.c | 383 ------------ libqpol/cond_query.c | 610 ------------------- libqpol/iterator.c | 897 ---------------------------- libqpol/policy_extend.c | 100 ---- libqpol/terule_query.c | 262 -------- setools/policyrep/boolcond.pxi | 23 +- setools/policyrep/libpolicyrep.pyx | 69 --- setools/policyrep/selinuxpolicy.pxi | 25 +- setools/policyrep/sepol.pxd | 2 + setools/policyrep/terule.pxi | 883 +++++++++++++-------------- setup.py | 5 +- 11 files changed, 439 insertions(+), 2820 deletions(-) delete mode 100644 libqpol/avrule_query.c delete mode 100644 libqpol/cond_query.c delete mode 100644 libqpol/iterator.c delete mode 100644 libqpol/terule_query.c diff --git a/libqpol/avrule_query.c b/libqpol/avrule_query.c deleted file mode 100644 index ebc52c6..0000000 --- a/libqpol/avrule_query.c +++ /dev/null @@ -1,383 +0,0 @@ - /** - * @file - * Implementation for the public interface for searching and iterating over avrules. - * - * @author Kevin Carr kcarr@tresys.com - * @author Jeremy A. Mowery jmowery@tresys.com - * @author Jason Tang jtang@tresys.com - * - * Copyright (C) 2006-2007 Tresys Technology, LLC - * - * This library is free software; you can redistribute it and/or - * modify it under the terms of the GNU Lesser General Public - * License as published by the Free Software Foundation; either - * version 2.1 of the License, or (at your option) any later version. - * - * This library is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU - * Lesser General Public License for more details. - * - * You should have received a copy of the GNU Lesser General Public - * License along with this library; if not, write to the Free Software - * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA - */ - -#include "iterator_internal.h" -#include -#include -#include -#include -#include -#include -#include -#include "qpol_internal.h" - -int qpol_policy_get_avrule_iter(const qpol_policy_t * policy, uint32_t rule_type_mask, qpol_iterator_t ** iter) -{ - policydb_t *db; - avtab_state_t *state; - - if (iter) { - *iter = NULL; - } - if (policy == NULL || iter == NULL) { - ERR(policy, "%s", strerror(EINVAL)); - errno = EINVAL; - return STATUS_ERR; - } - -#if 1 // Seems to make sediff/sediffx work better without breaking things - if (!qpol_policy_has_capability(policy, QPOL_CAP_RULES_LOADED)) { - ERR(policy, "%s", "Cannot get avrules: Rules not loaded"); - errno = ENOTSUP; - return STATUS_ERR; - } -#endif - - if ((rule_type_mask & QPOL_RULE_NEVERALLOW) && !qpol_policy_has_capability(policy, QPOL_CAP_NEVERALLOW)) { - ERR(policy, "%s", "Cannot get avrules: Neverallow rules requested but not available"); - errno = ENOTSUP; - return STATUS_ERR; - } - - db = &policy->p->p; - - state = calloc(1, sizeof(avtab_state_t)); - if (state == NULL) { - ERR(policy, "%s", strerror(ENOMEM)); - errno = ENOMEM; - return STATUS_ERR; - } - state->ucond_tab = &db->te_avtab; - state->cond_tab = &db->te_cond_avtab; - state->rule_type_mask = rule_type_mask; - state->node = db->te_avtab.htable[0]; - - if (qpol_iterator_create - (policy, state, avtab_state_get_cur, avtab_state_next, avtab_state_end, avtab_state_size, free, iter)) { - free(state); - return STATUS_ERR; - } - if (state->node == NULL || !(state->node->key.specified & state->rule_type_mask)) { - avtab_state_next(*iter); - } - return STATUS_SUCCESS; -} - -int qpol_avrule_get_source_type(const qpol_policy_t * policy, const qpol_avrule_t * rule, const qpol_type_t ** source) -{ - policydb_t *db = NULL; - avtab_ptr_t avrule = NULL; - - if (source) { - *source = NULL; - } - - if (!policy || !rule || !source) { - ERR(policy, "%s", strerror(EINVAL)); - errno = EINVAL; - return STATUS_ERR; - } - - db = &policy->p->p; - avrule = (avtab_ptr_t) rule; - - *source = (qpol_type_t *) db->type_val_to_struct[avrule->key.source_type - 1]; - - return STATUS_SUCCESS; -} - -int qpol_avrule_get_target_type(const qpol_policy_t * policy, const qpol_avrule_t * rule, const qpol_type_t ** target) -{ - policydb_t *db = NULL; - avtab_ptr_t avrule = NULL; - - if (target) { - *target = NULL; - } - - if (!policy || !rule || !target) { - ERR(policy, "%s", strerror(EINVAL)); - errno = EINVAL; - return STATUS_ERR; - } - - db = &policy->p->p; - avrule = (avtab_ptr_t) rule; - - *target = (qpol_type_t *) db->type_val_to_struct[avrule->key.target_type - 1]; - - return STATUS_SUCCESS; -} - -int qpol_avrule_get_object_class(const qpol_policy_t * policy, const qpol_avrule_t * rule, const qpol_class_t ** obj_class) -{ - policydb_t *db = NULL; - avtab_ptr_t avrule = NULL; - - if (obj_class) { - *obj_class = NULL; - } - - if (!policy || !rule || !obj_class) { - ERR(policy, "%s", strerror(EINVAL)); - errno = EINVAL; - return STATUS_ERR; - } - - db = &policy->p->p; - avrule = (avtab_ptr_t) rule; - - *obj_class = (qpol_class_t *) db->class_val_to_struct[avrule->key.target_class - 1]; - - return STATUS_SUCCESS; -} - -int qpol_avrule_get_perm_iter(const qpol_policy_t * policy, const qpol_avrule_t * rule, qpol_iterator_t ** perms) -{ - avtab_ptr_t avrule = NULL; - perm_state_t *ps = NULL; - - if (perms) { - *perms = NULL; - } - - if (!policy || !rule || !perms) { - ERR(policy, "%s", strerror(EINVAL)); - errno = EINVAL; - return STATUS_ERR; - } - - avrule = (avtab_ptr_t) rule; - ps = calloc(1, sizeof(perm_state_t)); - if (!ps) { - return STATUS_ERR; - } - if (avrule->key.specified & QPOL_RULE_DONTAUDIT) { - ps->perm_set = ~(avrule->datum.data); /* stored as auditdeny flip the bits */ - } else { - ps->perm_set = avrule->datum.data; - } - ps->obj_class_val = avrule->key.target_class; - - if (qpol_iterator_create(policy, (void *)ps, perm_state_get_cur, - perm_state_next, perm_state_end, perm_state_size, free, perms)) { - return STATUS_ERR; - } - - if (!(ps->perm_set & 1)) /* defaults to bit 0, if off: advance */ - perm_state_next(*perms); - - return STATUS_SUCCESS; -} - -int qpol_avrule_get_xperm_iter(const qpol_policy_t * policy, const qpol_avrule_t * rule, qpol_iterator_t ** xperms_iter) -{ - avtab_ptr_t avrule = NULL; - xperm_state_t *xps = NULL; - avtab_extended_perms_t *xperms = NULL; - - if (xperms_iter) { - *xperms_iter = NULL; - } - - if (!policy || !rule || !xperms_iter) { - ERR(policy, "%s", strerror(EINVAL)); - errno = EINVAL; - return STATUS_ERR; - } - - avrule = (avtab_ptr_t) rule; - if (!(avrule->key.specified & QPOL_RULE_XPERMS)) { - ERR(policy, "%s", strerror(EINVAL)); - errno = EINVAL; - return STATUS_ERR; - } - - xperms = avrule->datum.xperms; - - xps = calloc(1, sizeof(xperm_state_t)); - if (!xps) { - return STATUS_ERR; - } - xps->xperms = xperms; - xps->cur = 0; - - if (qpol_iterator_create(policy, (void *)xps, xperm_state_get_cur, - xperm_state_next, xperm_state_end, xperm_state_size, free, xperms_iter)) { - return STATUS_ERR; - } - - if (!((xperms->perms[0] & 1) && ((xperms->specified & AVTAB_XPERMS_IOCTLDRIVER) || xperms->driver == 0))) /* defaults to bit 0, if off: advance */ - xperm_state_next(*xperms_iter); - - return STATUS_SUCCESS; -} - -int qpol_avrule_get_xperm_type(const qpol_policy_t * policy, const qpol_avrule_t * rule, char ** type) -{ - avtab_ptr_t avrule = NULL; - avtab_extended_perms_t *xperms = NULL; - - if (type) { - *type = NULL; - } - - if (!policy || !rule || !type) { - ERR(policy, "%s", strerror(EINVAL)); - errno = EINVAL; - return STATUS_ERR; - } - - avrule = (avtab_ptr_t) rule; - if (!(avrule->key.specified & QPOL_RULE_XPERMS)) { - ERR(policy, "%s", strerror(EINVAL)); - errno = EINVAL; - return STATUS_ERR; - } - - xperms = avrule->datum.xperms; - if (xperms->specified & AVTAB_XPERMS_IOCTLFUNCTION || - xperms->specified & AVTAB_XPERMS_IOCTLDRIVER) { - *type = strdup("ioctl"); - } else { - ERR(policy, "%s", strerror(EINVAL)); - errno = EINVAL; - return STATUS_ERR; - } - - return STATUS_SUCCESS; -} - -int qpol_avrule_get_rule_type(const qpol_policy_t * policy, const qpol_avrule_t * rule, uint32_t * rule_type) -{ - avtab_ptr_t avrule = NULL; - - if (rule_type) { - *rule_type = 0; - } - - if (!policy || !rule || !rule_type) { - ERR(policy, "%s", strerror(EINVAL)); - errno = EINVAL; - return STATUS_ERR; - } - - avrule = (avtab_ptr_t) rule; - - *rule_type = - (avrule->key.specified & (QPOL_RULE_AV | QPOL_RULE_XPERMS)); - - return STATUS_SUCCESS; -} - -int qpol_avrule_get_is_extended(const qpol_policy_t * policy, const qpol_avrule_t * rule, uint32_t * is_extended) -{ - avtab_ptr_t avrule = NULL; - - if (is_extended) { - *is_extended = 0; - } - - if (!policy || !rule || !is_extended) { - ERR(policy, "%s", strerror(EINVAL)); - errno = EINVAL; - return STATUS_ERR; - } - - avrule = (avtab_ptr_t) rule; - - *is_extended = (avrule->key.specified & QPOL_RULE_XPERMS) ? 1 : 0; - - return STATUS_SUCCESS; -} - -int qpol_avrule_get_cond(const qpol_policy_t * policy, const qpol_avrule_t * rule, const qpol_cond_t ** cond) -{ - avtab_ptr_t avrule = NULL; - - if (cond) { - *cond = NULL; - } - - if (!policy || !rule || !cond) { - ERR(policy, "%s", strerror(EINVAL)); - errno = EINVAL; - return STATUS_ERR; - } - - avrule = (avtab_ptr_t) rule; - - *cond = (qpol_cond_t *) avrule->parse_context; - - return STATUS_SUCCESS; -} - -int qpol_avrule_get_is_enabled(const qpol_policy_t * policy, const qpol_avrule_t * rule, uint32_t * is_enabled) -{ - avtab_ptr_t avrule = NULL; - - if (is_enabled) { - *is_enabled = 0; - } - - if (!policy || !rule || !is_enabled) { - ERR(policy, "%s", strerror(EINVAL)); - errno = EINVAL; - return STATUS_ERR; - } - - avrule = (avtab_ptr_t) rule; - - *is_enabled = ((avrule->merged & QPOL_COND_RULE_ENABLED) ? 1 : 0); - - return STATUS_SUCCESS; -} - -int qpol_avrule_get_which_list(const qpol_policy_t * policy, const qpol_avrule_t * rule, uint32_t * which_list) -{ - avtab_ptr_t avrule = NULL; - - if (which_list) { - *which_list = 0; - } - - if (!policy || !rule || !which_list) { - ERR(policy, "%s", strerror(EINVAL)); - errno = EINVAL; - return STATUS_ERR; - } - - avrule = (avtab_ptr_t) rule; - - if (!avrule->parse_context) { - ERR(policy, "%s", strerror(EINVAL)); - errno = EINVAL; - return STATUS_ERR; - } - - *which_list = ((avrule->merged & QPOL_COND_RULE_LIST) ? 1 : 0); - - return STATUS_SUCCESS; -} diff --git a/libqpol/cond_query.c b/libqpol/cond_query.c deleted file mode 100644 index aa8deb5..0000000 --- a/libqpol/cond_query.c +++ /dev/null @@ -1,610 +0,0 @@ -/** - * @file - * Implememtation for the public interface for searching and iterating - * conditionals - * - * @author Kevin Carr kcarr@tresys.com - * @author Jeremy A. Mowery jmowery@tresys.com - * @author Jason Tang jtang@tresys.com - * - * Copyright (C) 2006-2007 Tresys Technology, LLC - * - * This library is free software; you can redistribute it and/or - * modify it under the terms of the GNU Lesser General Public - * License as published by the Free Software Foundation; either - * version 2.1 of the License, or (at your option) any later version. - * - * This library is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU - * Lesser General Public License for more details. - * - * You should have received a copy of the GNU Lesser General Public - * License along with this library; if not, write to the Free Software - * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA - */ - -#include -#include -#include -#include -#include -#include -#include "iterator_internal.h" -#include "qpol_internal.h" - -#include - -#include -#include - -typedef struct cond_state -{ - cond_node_t *head; - cond_node_t *cur; -} cond_state_t; - -static int cond_state_end(const qpol_iterator_t * iter) -{ - cond_state_t *cs = NULL; - - if (!iter || !(cs = (cond_state_t *) qpol_iterator_state(iter))) { - errno = EINVAL; - return STATUS_ERR; - } - - return cs->cur ? 0 : 1; -} - -static void *cond_state_get_cur(const qpol_iterator_t * iter) -{ - cond_state_t *cs = NULL; - - if (!iter || !(cs = (cond_state_t *) qpol_iterator_state(iter)) || qpol_iterator_end(iter)) { - errno = EINVAL; - return NULL; - } - - return cs->cur; -} - -static int cond_state_next(qpol_iterator_t * iter) -{ - cond_state_t *cs = NULL; - - if (!iter || !(cs = (cond_state_t *) qpol_iterator_state(iter))) { - errno = EINVAL; - return STATUS_ERR; - } - - if (qpol_iterator_end(iter)) { - errno = ERANGE; - return STATUS_ERR; - } - - cs->cur = cs->cur->next; - - return STATUS_SUCCESS; -} - -static size_t cond_state_size(const qpol_iterator_t * iter) -{ - cond_state_t *cs = NULL; - cond_node_t *tmp = NULL; - size_t count = 0; - - if (!iter || !(cs = (cond_state_t *) qpol_iterator_state(iter))) { - errno = EINVAL; - return 0; - } - - for (tmp = cs->head; tmp; tmp = tmp->next) - count++; - - return count; -} - -int qpol_policy_get_cond_iter(const qpol_policy_t * policy, qpol_iterator_t ** iter) -{ - int error = 0; - cond_state_t *cs = NULL; - policydb_t *db = NULL; - - if (iter) - *iter = NULL; - - if (!policy || !iter) { - ERR(policy, "%s", strerror(EINVAL)); - errno = EINVAL; - return STATUS_ERR; - } - - if (!qpol_policy_has_capability(policy, QPOL_CAP_RULES_LOADED)) { - ERR(policy, "%s", "Cannot get conditionals: Rules not loaded"); - errno = ENOTSUP; - return STATUS_ERR; - } - - db = &policy->p->p; - - if (!(cs = calloc(1, sizeof(cond_state_t)))) { - error = errno; - ERR(policy, "%s", strerror(error)); - goto err; - } - cs->head = cs->cur = db->cond_list; - - if (qpol_iterator_create(policy, (void *)cs, - cond_state_get_cur, cond_state_next, cond_state_end, cond_state_size, free, iter)) { - error = errno; - goto err; - } - - return STATUS_SUCCESS; - - err: - free(cs); - errno = error; - return STATUS_ERR; -} - -typedef struct cond_expr_state -{ - cond_expr_t *head; - cond_expr_t *cur; -} cond_expr_state_t; - -static int cond_expr_state_end(const qpol_iterator_t * iter) -{ - cond_expr_state_t *ces = NULL; - - if (!iter || !(ces = (cond_expr_state_t *) qpol_iterator_state(iter))) { - errno = EINVAL; - return STATUS_ERR; - } - - return ces->cur ? 0 : 1; -} - -static void *cond_expr_state_get_cur(const qpol_iterator_t * iter) -{ - cond_expr_state_t *ces = NULL; - - if (!iter || !(ces = (cond_expr_state_t *) qpol_iterator_state(iter)) || qpol_iterator_end(iter)) { - errno = EINVAL; - return NULL; - } - - return ces->cur; -} - -static int cond_expr_state_next(qpol_iterator_t * iter) -{ - cond_expr_state_t *ces = NULL; - - if (!iter || !(ces = (cond_expr_state_t *) qpol_iterator_state(iter))) { - errno = EINVAL; - return STATUS_ERR; - } - - if (qpol_iterator_end(iter)) { - errno = ERANGE; - return STATUS_ERR; - } - - ces->cur = ces->cur->next; - - return STATUS_SUCCESS; -} - -static size_t cond_expr_state_size(const qpol_iterator_t * iter) -{ - cond_expr_state_t *ces = NULL; - cond_expr_t *tmp = NULL; - size_t count = 0; - - if (!iter || !(ces = (cond_expr_state_t *) qpol_iterator_state(iter))) { - errno = EINVAL; - return 0; - } - - for (tmp = ces->head; tmp; tmp = tmp->next) - count++; - - return count; -} - -int qpol_cond_get_expr_node_iter(const qpol_policy_t * policy, const qpol_cond_t * cond, qpol_iterator_t ** iter) -{ - int error = 0; - cond_expr_state_t *ces = NULL; - cond_node_t *internal_cond = NULL; - - if (iter) - *iter = NULL; - - if (!policy || !cond || !iter) { - ERR(policy, "%s", strerror(EINVAL)); - errno = EINVAL; - return STATUS_ERR; - } - - internal_cond = (cond_node_t *) cond; - - if (!(ces = calloc(1, sizeof(cond_expr_state_t)))) { - error = errno; - ERR(policy, "%s", strerror(error)); - goto err; - } - ces->head = ces->cur = internal_cond->expr; - - if (qpol_iterator_create(policy, (void *)ces, - cond_expr_state_get_cur, cond_expr_state_next, cond_expr_state_end, - cond_expr_state_size, free, iter)) { - error = errno; - goto err; - } - - return STATUS_SUCCESS; - - err: - free(ces); - errno = error; - return STATUS_ERR; -} - -typedef struct cond_rule_state -{ - cond_av_list_t *head; - cond_av_list_t *cur; - uint32_t rule_type_mask; -} cond_rule_state_t; - -static int cond_rule_state_end(const qpol_iterator_t * iter) -{ - cond_rule_state_t *crs = NULL; - - if (!iter || !(crs = (cond_rule_state_t *) qpol_iterator_state(iter))) { - errno = EINVAL; - return STATUS_ERR; - } - - return crs->cur ? 0 : 1; -} - -static void *cond_rule_state_get_cur(const qpol_iterator_t * iter) -{ - cond_rule_state_t *crs = NULL; - - if (!iter || !(crs = (cond_rule_state_t *) qpol_iterator_state(iter)) || qpol_iterator_end(iter)) { - errno = EINVAL; - return NULL; - } - - return crs->cur->node; -} - -static int cond_rule_state_next(qpol_iterator_t * iter) -{ - cond_rule_state_t *crs = NULL; - - if (!iter || !(crs = (cond_rule_state_t *) qpol_iterator_state(iter))) { - errno = EINVAL; - return STATUS_ERR; - } - - if (qpol_iterator_end(iter)) { - errno = ERANGE; - return STATUS_ERR; - } - - do { - crs->cur = crs->cur->next; - } while (crs->cur && !(crs->cur->node->key.specified & crs->rule_type_mask)); - - return STATUS_SUCCESS; -} - -static size_t cond_rule_state_size(const qpol_iterator_t * iter) -{ - cond_rule_state_t *crs = NULL; - cond_av_list_t *tmp = NULL; - size_t count = 0; - - if (!iter || !(crs = (cond_rule_state_t *) qpol_iterator_state(iter))) { - errno = EINVAL; - return 0; - } - - for (tmp = crs->head; tmp; tmp = tmp->next) { - if (tmp->node->key.specified & crs->rule_type_mask) - count++; - } - - return count; -} - -int qpol_cond_get_av_true_iter(const qpol_policy_t * policy, const qpol_cond_t * cond, uint32_t rule_type_mask, - qpol_iterator_t ** iter) -{ - int error = 0; - cond_rule_state_t *crs = NULL; - cond_node_t *internal_cond = NULL; - - if (iter) - *iter = NULL; - - if (!policy || !cond || !iter) { - ERR(policy, "%s", strerror(EINVAL)); - errno = EINVAL; - return STATUS_ERR; - } - - if (rule_type_mask & ~(QPOL_RULE_ALLOW | QPOL_RULE_NEVERALLOW | QPOL_RULE_AUDITALLOW | QPOL_RULE_DONTAUDIT)) { - ERR(policy, "%s", strerror(EINVAL)); - errno = EINVAL; - return STATUS_ERR; - } - - internal_cond = (cond_node_t *) cond; - - if (!(crs = calloc(1, sizeof(cond_rule_state_t)))) { - error = errno; - ERR(policy, "%s", strerror(error)); - goto err; - } - crs->head = crs->cur = internal_cond->true_list; - crs->rule_type_mask = rule_type_mask; - - if (qpol_iterator_create(policy, (void *)crs, - cond_rule_state_get_cur, cond_rule_state_next, cond_rule_state_end, - cond_rule_state_size, free, iter)) { - error = errno; - goto err; - } - - if (crs->cur && !(crs->cur->node->key.specified & crs->rule_type_mask)) - qpol_iterator_next(*iter); - - return STATUS_SUCCESS; - - err: - free(crs); - errno = error; - return STATUS_ERR; -} - -int qpol_cond_get_te_true_iter(const qpol_policy_t * policy, const qpol_cond_t * cond, uint32_t rule_type_mask, - qpol_iterator_t ** iter) -{ - int error = 0; - cond_rule_state_t *crs = NULL; - cond_node_t *internal_cond = NULL; - - if (iter) - *iter = NULL; - - if (!policy || !cond || !iter) { - ERR(policy, "%s", strerror(EINVAL)); - errno = EINVAL; - return STATUS_ERR; - } - - if (rule_type_mask & ~(QPOL_RULE_TYPE_TRANS | QPOL_RULE_TYPE_CHANGE | QPOL_RULE_TYPE_MEMBER)) { - ERR(policy, "%s", strerror(EINVAL)); - errno = EINVAL; - return STATUS_ERR; - } - - internal_cond = (cond_node_t *) cond; - - if (!(crs = calloc(1, sizeof(cond_rule_state_t)))) { - error = errno; - ERR(policy, "%s", strerror(error)); - goto err; - } - crs->head = crs->cur = internal_cond->true_list; - crs->rule_type_mask = rule_type_mask; - - if (qpol_iterator_create(policy, (void *)crs, - cond_rule_state_get_cur, cond_rule_state_next, cond_rule_state_end, - cond_rule_state_size, free, iter)) { - error = errno; - goto err; - } - - if (crs->cur && !(crs->cur->node->key.specified & crs->rule_type_mask)) - qpol_iterator_next(*iter); - - return STATUS_SUCCESS; - - err: - free(crs); - errno = error; - return STATUS_ERR; -} - -int qpol_cond_get_av_false_iter(const qpol_policy_t * policy, const qpol_cond_t * cond, uint32_t rule_type_mask, - qpol_iterator_t ** iter) -{ - int error = 0; - cond_rule_state_t *crs = NULL; - cond_node_t *internal_cond = NULL; - - if (iter) - *iter = NULL; - - if (!policy || !cond || !iter) { - ERR(policy, "%s", strerror(EINVAL)); - errno = EINVAL; - return STATUS_ERR; - } - - if (rule_type_mask & ~(QPOL_RULE_ALLOW | QPOL_RULE_NEVERALLOW | QPOL_RULE_AUDITALLOW | QPOL_RULE_DONTAUDIT)) { - ERR(policy, "%s", strerror(EINVAL)); - errno = EINVAL; - return STATUS_ERR; - } - - internal_cond = (cond_node_t *) cond; - - if (!(crs = calloc(1, sizeof(cond_rule_state_t)))) { - error = errno; - ERR(policy, "%s", strerror(error)); - goto err; - } - crs->head = crs->cur = internal_cond->false_list; - crs->rule_type_mask = rule_type_mask; - - if (qpol_iterator_create(policy, (void *)crs, - cond_rule_state_get_cur, cond_rule_state_next, cond_rule_state_end, - cond_rule_state_size, free, iter)) { - error = errno; - goto err; - } - - if (crs->cur && !(crs->cur->node->key.specified & crs->rule_type_mask)) - qpol_iterator_next(*iter); - - return STATUS_SUCCESS; - - err: - free(crs); - errno = error; - return STATUS_ERR; -} - -int qpol_cond_get_te_false_iter(const qpol_policy_t * policy, const qpol_cond_t * cond, uint32_t rule_type_mask, - qpol_iterator_t ** iter) -{ - int error = 0; - cond_rule_state_t *crs = NULL; - cond_node_t *internal_cond = NULL; - - if (iter) - *iter = NULL; - - if (!policy || !cond || !iter) { - ERR(policy, "%s", strerror(EINVAL)); - errno = EINVAL; - return STATUS_ERR; - } - - if (rule_type_mask & ~(QPOL_RULE_TYPE_TRANS | QPOL_RULE_TYPE_CHANGE | QPOL_RULE_TYPE_MEMBER)) { - ERR(policy, "%s", strerror(EINVAL)); - errno = EINVAL; - return STATUS_ERR; - } - - internal_cond = (cond_node_t *) cond; - - if (!(crs = calloc(1, sizeof(cond_rule_state_t)))) { - error = errno; - ERR(policy, "%s", strerror(error)); - goto err; - } - crs->head = crs->cur = internal_cond->false_list; - crs->rule_type_mask = rule_type_mask; - - if (qpol_iterator_create(policy, (void *)crs, - cond_rule_state_get_cur, cond_rule_state_next, cond_rule_state_end, - cond_rule_state_size, free, iter)) { - error = errno; - goto err; - } - - if (crs->cur && !(crs->cur->node->key.specified & crs->rule_type_mask)) - qpol_iterator_next(*iter); - - return STATUS_SUCCESS; - - err: - free(crs); - errno = error; - return STATUS_ERR; -} - -int qpol_cond_eval(const qpol_policy_t * policy, const qpol_cond_t * cond, uint32_t * is_true) -{ - int error = 0; - cond_node_t *internal_cond = NULL; - - if (is_true) - *is_true = 0; - - if (!policy || !cond || !is_true) { - ERR(policy, "%s", strerror(EINVAL)); - errno = EINVAL; - return STATUS_ERR; - } - - internal_cond = (cond_node_t *) cond; - - if ((*is_true = (uint32_t) cond_evaluate_expr(&policy->p->p, internal_cond->expr)) > 1) { - error = ERANGE; - goto err; - } - - return STATUS_SUCCESS; - - err: - ERR(policy, "%s", strerror(error)); - errno = error; - return STATUS_ERR; -} - -int qpol_cond_expr_node_get_expr_type(const qpol_policy_t * policy, const qpol_cond_expr_node_t * node, uint32_t * expr_type) -{ - cond_expr_t *internal_cond = NULL; - - if (expr_type) - *expr_type = 0; - - if (!policy || !node || !expr_type) { - ERR(policy, "%s", strerror(EINVAL)); - errno = EINVAL; - return STATUS_ERR; - } - - internal_cond = (cond_expr_t *) node; - - *expr_type = internal_cond->expr_type; - - return STATUS_SUCCESS; -} - -int qpol_cond_expr_node_get_bool(const qpol_policy_t * policy, const qpol_cond_expr_node_t * node, qpol_bool_t ** cond_bool) -{ - int error = 0; - cond_expr_t *internal_cond = NULL; - policydb_t *db = NULL; - - if (cond_bool) - *cond_bool = NULL; - - if (!policy || !node || !cond_bool) { - ERR(policy, "%s", strerror(EINVAL)); - errno = EINVAL; - return STATUS_ERR; - } - - db = &policy->p->p; - internal_cond = (cond_expr_t *) node; - - if (internal_cond->expr_type != QPOL_COND_EXPR_BOOL) { - error = EINVAL; - goto err; - } - - if (!(*cond_bool = (qpol_bool_t *) db->bool_val_to_struct[internal_cond->bool - 1])) { - error = EINVAL; - goto err; - } - - return STATUS_SUCCESS; - - err: - ERR(policy, "%s", strerror(error)); - errno = error; - return STATUS_ERR; -} diff --git a/libqpol/iterator.c b/libqpol/iterator.c deleted file mode 100644 index 4bb53fe..0000000 --- a/libqpol/iterator.c +++ /dev/null @@ -1,897 +0,0 @@ -/** - * @file - * Contains the implementation of the qpol_iterator API, both - * public and private, for returning lists of components and rules - * from the policy database. - * - * @author Kevin Carr kcarr@tresys.com - * @author Jeremy A. Mowery jmowery@tresys.com - * @author Jason Tang jtang@tresys.com - * - * Copyright (C) 2006-2008 Tresys Technology, LLC - * - * This library is free software; you can redistribute it and/or - * modify it under the terms of the GNU Lesser General Public - * License as published by the Free Software Foundation; either - * version 2.1 of the License, or (at your option) any later version. - * - * This library is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU - * Lesser General Public License for more details. - * - * You should have received a copy of the GNU Lesser General Public - * License along with this library; if not, write to the Free Software - * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA - */ - -#include - -#include -#include -#include - -#include -#include -#include - -#include -#include -#include -#include - -#include "qpol_internal.h" -#include "iterator_internal.h" - -/** - * Declaration of qpol_iterator, an arbitrary valued policy component - * iterator used to return lists of components. - * - */ -struct qpol_iterator -{ - policydb_t *policy; - void *state; - void *(*get_cur) (const qpol_iterator_t * iter); - int (*next) (qpol_iterator_t * iter); - int (*end) (const qpol_iterator_t * iter); - size_t(*size) (const qpol_iterator_t * iter); - void (*free_fn) (void *x); -}; - -/** - * The number of buckets in sepol's av tables was statically set in - * libsepol < 2.0.20. With libsepol 2.0.20, this size was dynamically - * calculated based upon the number of rules. - */ -static uint32_t iterator_get_avtab_size(const avtab_t * avtab) -{ -#ifdef SEPOL_DYNAMIC_AVTAB - return avtab->nslot; -#else - return AVTAB_SIZE; -#endif -} - -int qpol_iterator_create(const qpol_policy_t * policy, void *state, - void *(*get_cur) (const qpol_iterator_t * iter), - int (*next) (qpol_iterator_t * iter), - int (*end) (const qpol_iterator_t * iter), - size_t(*size) (const qpol_iterator_t * iter), void (*free_fn) (void *x), qpol_iterator_t ** iter) -{ - int error = 0; - - if (iter != NULL) - *iter = NULL; - - if (policy == NULL || state == NULL || iter == NULL || get_cur == NULL || next == NULL || end == NULL || size == NULL) { - ERR(policy, "%s", strerror(EINVAL)); - errno = EINVAL; - return STATUS_ERR; - } - - *iter = calloc(1, sizeof(struct qpol_iterator)); - if (*iter == NULL) { - error = errno; - ERR(policy, "%s", strerror(ENOMEM)); - errno = error; - return STATUS_ERR; - } - - (*iter)->policy = &policy->p->p; - (*iter)->state = state; - (*iter)->get_cur = get_cur; - (*iter)->next = next; - (*iter)->end = end; - (*iter)->size = size; - (*iter)->free_fn = free_fn; - - return STATUS_SUCCESS; -} - -void *qpol_iterator_state(const qpol_iterator_t * iter) -{ - if (iter == NULL || iter->state == NULL) { - errno = EINVAL; - return NULL; - } - - return iter->state; -} - -const policydb_t *qpol_iterator_policy(const qpol_iterator_t * iter) -{ - if (iter == NULL || iter->policy == NULL) { - errno = EINVAL; - return NULL; - } - - return iter->policy; -} - -void *hash_state_get_cur(const qpol_iterator_t * iter) -{ - hash_state_t *hs = NULL; - - if (iter == NULL || iter->state == NULL || hash_state_end(iter)) { - errno = EINVAL; - return NULL; - } - - hs = (hash_state_t *) iter->state; - - return hs->node->datum; -} - -void *hash_state_get_cur_key(const qpol_iterator_t * iter) -{ - hash_state_t *hs = NULL; - - if (iter == NULL || iter->state == NULL || hash_state_end(iter)) { - errno = EINVAL; - return NULL; - } - - hs = (hash_state_t *) iter->state; - - return hs->node->key; -} - -void *ocon_state_get_cur(const qpol_iterator_t * iter) -{ - ocon_state_t *os = NULL; - - if (iter == NULL || iter->state == NULL || ocon_state_end(iter)) { - errno = EINVAL; - return NULL; - } - - os = (ocon_state_t *) iter->state; - - return os->cur; -} - -void *avtab_state_get_cur(const qpol_iterator_t * iter) -{ - avtab_state_t *state; - - if (iter == NULL || iter->state == NULL || avtab_state_end(iter)) { - errno = EINVAL; - return NULL; - } - state = (avtab_state_t *) iter->state; - return state->node; -} - -int hash_state_next(qpol_iterator_t * iter) -{ - hash_state_t *hs = NULL; - - if (iter == NULL || iter->state == NULL) { - errno = EINVAL; - return STATUS_ERR; - } - - hs = (hash_state_t *) iter->state; - - if (hs->table == NULL || *(hs->table) == NULL || hs->bucket >= (*(hs->table))->size) { - errno = ERANGE; - return STATUS_ERR; - } - - if (hs->node != NULL && hs->node->next != NULL) { - hs->node = hs->node->next; - } else { - do { - hs->bucket++; - if (hs->bucket < (*(hs->table))->size) { - hs->node = (*(hs->table))->htable[hs->bucket]; - } else { - hs->node = NULL; - } - } while (hs->bucket < (*(hs->table))->size && hs->node == NULL); - } - - return STATUS_SUCCESS; -} - -int ebitmap_state_next(qpol_iterator_t * iter) -{ - ebitmap_state_t *es = NULL; - - if (iter == NULL || iter->state == NULL) { - errno = EINVAL; - return STATUS_ERR; - } - - es = (ebitmap_state_t *) iter->state; - - if (es->cur >= es->bmap->highbit) { - errno = ERANGE; - return STATUS_ERR; - } - - do { - es->cur++; - } while (es->cur < es->bmap->highbit && !ebitmap_get_bit(es->bmap, es->cur)); - - return STATUS_SUCCESS; -} - -int ocon_state_next(qpol_iterator_t * iter) -{ - ocon_state_t *os = NULL; - - if (iter == NULL || iter->state == NULL) { - errno = EINVAL; - return STATUS_ERR; - } - - os = (ocon_state_t *) iter->state; - - if (os->cur == NULL) { - errno = ERANGE; - return STATUS_ERR; - } - - os->cur = os->cur->next; - - return STATUS_SUCCESS; -} - -int avtab_state_next(qpol_iterator_t * iter) -{ - avtab_t *avtab; - avtab_state_t *state; - - if (iter == NULL || iter->state == NULL) { - errno = EINVAL; - return STATUS_ERR; - } - - state = iter->state; - avtab = (state->which == QPOL_AVTAB_STATE_AV ? state->ucond_tab : state->cond_tab); - - if ((!avtab->htable || state->bucket >= iterator_get_avtab_size(avtab)) && state->which == QPOL_AVTAB_STATE_COND) { - errno = ERANGE; - return STATUS_ERR; - } - - do { - if (state->node != NULL && state->node->next != NULL) { - state->node = state->node->next; - } else { - /* find the next bucket */ - do { - state->bucket++; - if (!avtab->htable || state->bucket >= iterator_get_avtab_size(avtab)) { - if (state->which == QPOL_AVTAB_STATE_AV) { - state->bucket = 0; - avtab = state->cond_tab; - state->which = QPOL_AVTAB_STATE_COND; - } else { - state->node = NULL; - break; - } - } - if (avtab->htable && avtab->htable[state->bucket] != NULL) { - state->node = avtab->htable[state->bucket]; - break; - } - } while (avtab->htable && state->bucket < iterator_get_avtab_size(avtab)); - } - } while (avtab->htable && state->bucket < iterator_get_avtab_size(avtab) && - state->node ? !(state->rule_type_mask & state->node->key.specified) : 0); - - return STATUS_SUCCESS; -} - -int hash_state_end(const qpol_iterator_t * iter) -{ - hash_state_t *hs = NULL; - - if (iter == NULL || iter->state == NULL) { - errno = EINVAL; - return STATUS_ERR; - } - - hs = (hash_state_t *) iter->state; - - if (hs->table == NULL || *(hs->table) == NULL || (*(hs->table))->nel == 0 || hs->bucket >= (*(hs->table))->size) - return 1; - - return 0; -} - -int ebitmap_state_end(const qpol_iterator_t * iter) -{ - ebitmap_state_t *es = NULL; - - if (iter == NULL || iter->state == NULL) { - errno = EINVAL; - return STATUS_ERR; - } - - es = (ebitmap_state_t *) iter->state; - - if (es->cur >= es->bmap->highbit) - return 1; - - return 0; -} - -int ocon_state_end(const qpol_iterator_t * iter) -{ - ocon_state_t *os = NULL; - - if (iter == NULL || iter->state == NULL) { - errno = EINVAL; - return STATUS_ERR; - } - - os = (ocon_state_t *) iter->state; - - if (os->cur == NULL) - return 1; - - return 0; -} - -int avtab_state_end(const qpol_iterator_t * iter) -{ - avtab_state_t *state; - avtab_t *avtab; - - if (iter == NULL || iter->state == NULL) { - errno = EINVAL; - return STATUS_ERR; - } - state = iter->state; - avtab = (state->which == QPOL_AVTAB_STATE_AV ? state->ucond_tab : state->cond_tab); - if ((!avtab->htable || state->bucket >= iterator_get_avtab_size(avtab)) && state->which == QPOL_AVTAB_STATE_COND) - return 1; - return 0; -} - -size_t hash_state_size(const qpol_iterator_t * iter) -{ - hash_state_t *hs = NULL; - - if (iter == NULL || iter->state == NULL) { - errno = EINVAL; - return 0; - } - - hs = (hash_state_t *) iter->state; - - return (*(hs->table))->nel; -} - -size_t ebitmap_state_size(const qpol_iterator_t * iter) -{ - ebitmap_state_t *es = NULL; - size_t count = 0, bit = 0; - ebitmap_node_t *node = NULL; - - if (iter == NULL || iter->state == NULL) { - errno = EINVAL; - return 0; - } - - es = (ebitmap_state_t *) iter->state; - - ebitmap_for_each_bit(es->bmap, node, bit) { - count += ebitmap_get_bit(es->bmap, bit); - } - - return count; -} - -size_t ocon_state_size(const qpol_iterator_t * iter) -{ - ocon_state_t *os = NULL; - size_t count = 0; - ocontext_t *ocon = NULL; - - if (iter == NULL || iter->state == NULL) { - errno = EINVAL; - return 0; - } - - os = (ocon_state_t *) iter->state; - - for (ocon = os->head; ocon; ocon = ocon->next) - count++; - - return count; -} - -size_t avtab_state_size(const qpol_iterator_t * iter) -{ - avtab_state_t *state; - avtab_t *avtab; - size_t count = 0; - avtab_ptr_t node = NULL; - uint32_t bucket = 0; - - if (iter == NULL || iter->state == NULL || iter->policy == NULL) { - errno = EINVAL; - return STATUS_ERR; - } - - state = iter->state; - avtab = state->ucond_tab; - - for (bucket = 0; avtab->htable && bucket < iterator_get_avtab_size(avtab); bucket++) { - for (node = avtab->htable[bucket]; node; node = node->next) { - if (node->key.specified & state->rule_type_mask) - count++; - } - } - - avtab = state->cond_tab; - - for (bucket = 0; avtab->htable && bucket < iterator_get_avtab_size(avtab); bucket++) { - for (node = avtab->htable[bucket]; node; node = node->next) { - if (node->key.specified & state->rule_type_mask) - count++; - } - } - - return count; -} - -void qpol_iterator_destroy(qpol_iterator_t ** iter) -{ - if (iter == NULL || *iter == NULL) - return; - - if ((*iter)->free_fn) - (*iter)->free_fn((*iter)->state); - - free(*iter); - *iter = NULL; -} - -int qpol_iterator_get_item(const qpol_iterator_t * iter, void **item) -{ - if (item != NULL) - *item = NULL; - - if (iter == NULL || iter->get_cur == NULL || item == NULL) { - errno = EINVAL; - return STATUS_ERR; - } - - *item = iter->get_cur(iter); - if (*item == NULL) - return STATUS_ERR; - - return STATUS_SUCCESS; -} - -int qpol_iterator_next(qpol_iterator_t * iter) -{ - if (iter == NULL || iter->next == NULL) { - errno = EINVAL; - return STATUS_ERR; - } - - return iter->next(iter); -} - -int qpol_iterator_end(const qpol_iterator_t * iter) -{ - if (iter == NULL || iter->end == NULL) { - errno = EINVAL; - return STATUS_ERR; - } - - return iter->end(iter); -} - -int qpol_iterator_get_size(const qpol_iterator_t * iter, size_t * size) -{ - if (size != NULL) - *size = 0; - - if (iter == NULL || size == NULL || iter->size == NULL) { - errno = EINVAL; - return STATUS_ERR; - } - - *size = iter->size(iter); - - return STATUS_SUCCESS; -} - -void *ebitmap_state_get_cur_type(const qpol_iterator_t * iter) -{ - ebitmap_state_t *es = NULL; - const policydb_t *db = NULL; - - if (iter == NULL) { - errno = EINVAL; - return NULL; - } - es = qpol_iterator_state(iter); - if (es == NULL) { - errno = EINVAL; - return NULL; - } - db = qpol_iterator_policy(iter); - if (db == NULL) { - errno = EINVAL; - return NULL; - } - - return db->type_val_to_struct[es->cur]; -} - -void *ebitmap_state_get_cur_role(const qpol_iterator_t * iter) -{ - ebitmap_state_t *es = NULL; - const policydb_t *db = NULL; - - if (iter == NULL) { - errno = EINVAL; - return NULL; - } - es = qpol_iterator_state(iter); - if (es == NULL) { - errno = EINVAL; - return NULL; - } - db = qpol_iterator_policy(iter); - if (db == NULL) { - errno = EINVAL; - return NULL; - } - - return db->role_val_to_struct[es->cur]; -} - -void *ebitmap_state_get_cur_permissive(const qpol_iterator_t * iter) -{ - ebitmap_state_t *es = NULL; - const policydb_t *db = NULL; - - if (iter == NULL) { - errno = EINVAL; - return NULL; - } - es = qpol_iterator_state(iter); - if (es == NULL) { - errno = EINVAL; - return NULL; - } - db = qpol_iterator_policy(iter); - if (db == NULL) { - errno = EINVAL; - return NULL; - } - - return db->type_val_to_struct[es->cur - 1]; -} - -void *ebitmap_state_get_cur_polcap(const qpol_iterator_t * iter) -{ - ebitmap_state_t *es = NULL; - const policydb_t *db = NULL; - - if (iter == NULL) { - errno = EINVAL; - return NULL; - } - es = qpol_iterator_state(iter); - if (es == NULL) { - errno = EINVAL; - return NULL; - } - db = qpol_iterator_policy(iter); - if (db == NULL) { - errno = EINVAL; - return NULL; - } - - return (void *)sepol_polcap_getname(es->cur); -} - -void ebitmap_state_destroy(void *es) -{ - ebitmap_state_t *ies = (ebitmap_state_t *) es; - - if (!es) - return; - - ebitmap_destroy(ies->bmap); - free(ies->bmap); - free(ies); -} - -int perm_state_end(const qpol_iterator_t * iter) -{ - perm_state_t *ps = NULL; - const policydb_t *db = NULL; - unsigned int perm_max = 0; - - if (iter == NULL || (ps = qpol_iterator_state(iter)) == NULL || (db = qpol_iterator_policy(iter)) == NULL) { - errno = EINVAL; - return STATUS_ERR; - } - - /* permission max is number of permissions in the class which includes - * the number of permissions in its common if it inherits one */ - perm_max = db->class_val_to_struct[ps->obj_class_val - 1]->permissions.nprim; - if (perm_max > 32) { - errno = EDOM; /* perms set mask is a uint32_t cannot use more than 32 bits */ - return STATUS_ERR; - } - - if (!(ps->perm_set) || ps->cur >= perm_max) - return 1; - - return 0; -} - -void *perm_state_get_cur(const qpol_iterator_t * iter) -{ - const policydb_t *db = NULL; - class_datum_t *obj_class = NULL; - perm_state_t *ps = NULL; - unsigned int perm_max = 0; - char *tmp = NULL; - - if (iter == NULL || (db = qpol_iterator_policy(iter)) == NULL || - (ps = (perm_state_t *) qpol_iterator_state(iter)) == NULL || perm_state_end(iter)) { - errno = EINVAL; - return NULL; - } - - obj_class = db->class_val_to_struct[ps->obj_class_val - 1]; - - /* permission max is number of permissions in the class which includes - * the number of permissions in its common if it inherits one */ - perm_max = obj_class->permissions.nprim; - if (perm_max > 32) { - errno = EDOM; /* perms set mask is a uint32_t cannot use more than 32 bits */ - return NULL; - } - if (ps->cur >= perm_max) { - errno = ERANGE; - return NULL; - } - if (!(ps->perm_set & 1 << (ps->cur))) { /* perm bit not set? */ - errno = EINVAL; - return NULL; - } - - /* explicit const_cast for sepol */ - tmp = sepol_av_to_string((policydb_t *) db, ps->obj_class_val, (sepol_access_vector_t) 1 << (ps->cur)); - if (tmp) { - tmp++; /*sepol_av_to_string prepends a ' ' to the name */ - return strdup(tmp); - } else { - errno = EINVAL; - return NULL; - } -} - -int perm_state_next(qpol_iterator_t * iter) -{ - perm_state_t *ps = NULL; - const policydb_t *db = NULL; - unsigned int perm_max = 0; - - if (iter == NULL || (ps = qpol_iterator_state(iter)) == NULL || - (db = qpol_iterator_policy(iter)) == NULL || perm_state_end(iter)) { - errno = EINVAL; - return STATUS_ERR; - } - - /* permission max is number of permissions in the class which includes - * the number of permissions in its common if it inherits one */ - perm_max = db->class_val_to_struct[ps->obj_class_val - 1]->permissions.nprim; - if (perm_max > 32) { - errno = EDOM; /* perms set mask is a uint32_t cannot use more than 32 bits */ - return STATUS_ERR; - } - - if (ps->cur >= perm_max) { - errno = ERANGE; - return STATUS_ERR; - } - - do { - ps->cur++; - } while (ps->cur < perm_max && !(ps->perm_set & 1 << (ps->cur))); - - return STATUS_SUCCESS; -} - -size_t perm_state_size(const qpol_iterator_t * iter) -{ - perm_state_t *ps = NULL; - const policydb_t *db = NULL; - unsigned int perm_max = 0; - size_t i, count = 0; - - if (iter == NULL || (ps = qpol_iterator_state(iter)) == NULL || - (db = qpol_iterator_policy(iter)) == NULL || perm_state_end(iter)) { - errno = EINVAL; - return 0; /* as a size_t 0 is error */ - } - - /* permission max is number of permissions in the class which includes - * the number of permissions in its common if it inherits one */ - perm_max = db->class_val_to_struct[ps->obj_class_val - 1]->permissions.nprim; - if (perm_max > 32) { - errno = EDOM; /* perms set mask is a uint32_t cannot use more than 32 bits */ - return 0; /* as a size_t 0 is error */ - } - - for (i = 0; i < perm_max; i++) { - if (ps->perm_set & 1 << i) - count++; - } - - return count; -} - -#define XPERMS_DRIV(x) (x >> 8) -#define XPERMS_FUNC(x) (x & 0xFF) -#define XPERMS_GETBIT(xperms, bit) (xperms[(bit) >> 5] & (1 << ((bit) & 0x1F))) - -int xperm_state_end(const qpol_iterator_t * iter) -{ - xperm_state_t *xps = NULL; - const policydb_t *db = NULL; - - if (iter == NULL || (xps = qpol_iterator_state(iter)) == NULL || (db = qpol_iterator_policy(iter)) == NULL) { - errno = EINVAL; - return STATUS_ERR; - } - - if (xps->cur > 0xFFFF) - return 1; - - return 0; -} - -void *xperm_state_get_cur(const qpol_iterator_t * iter) -{ - const policydb_t *db = NULL; - xperm_state_t *xps = NULL; - avtab_extended_perms_t *xperms = NULL; - int bitset; - int *cur; - - if (iter == NULL || (db = qpol_iterator_policy(iter)) == NULL || - (xps = (xperm_state_t *) qpol_iterator_state(iter)) == NULL || xperm_state_end(iter)) { - errno = EINVAL; - return NULL; - } - - if (xps->cur > 0xFFFF) { - errno = ERANGE; - return NULL; - } - - xperms = xps->xperms; - - if (xperms->specified & AVTAB_XPERMS_IOCTLDRIVER) { - bitset = XPERMS_GETBIT(xperms->perms, XPERMS_DRIV(xps->cur)); - } else { - bitset = (xperms->driver == XPERMS_DRIV(xps->cur)) && XPERMS_GETBIT(xperms->perms, XPERMS_FUNC(xps->cur)); - } - - if (!bitset) { /* xperm bit not set? */ - errno = EINVAL; - return NULL; - } - - // the caller is responsible for freeing the returned integer. this is - // similar to how the caller must also free the resulting string of - // perm_state_get_cur - cur = calloc(1, sizeof(int)); - if (cur == NULL) { - return NULL; - } - *cur = xps->cur; - return cur; -} - -int xperm_state_next(qpol_iterator_t * iter) -{ - xperm_state_t *xps = NULL; - const policydb_t *db = NULL; - avtab_extended_perms_t *xperms = NULL; - int bitset = 0; - - if (iter == NULL || (xps = qpol_iterator_state(iter)) == NULL || - (db = qpol_iterator_policy(iter)) == NULL || xperm_state_end(iter)) { - errno = EINVAL; - return STATUS_ERR; - } - - if (xps->cur > 0xFFFF) { - errno = ERANGE; - return STATUS_ERR; - } - - xperms = xps->xperms; - - while (1) { - xps->cur++; - if (xps->cur > 0xFFFF) { - break; - } - - if (xperms->specified & AVTAB_XPERMS_IOCTLDRIVER) { - bitset = XPERMS_GETBIT(xperms->perms, XPERMS_DRIV(xps->cur)); - } else { - bitset = (xperms->driver == XPERMS_DRIV(xps->cur)) && XPERMS_GETBIT(xperms->perms, XPERMS_FUNC(xps->cur)); - } - - if (bitset) { - break; - } - } - - return STATUS_SUCCESS; -} - - -size_t xperm_state_size(const qpol_iterator_t * iter) -{ - xperm_state_t *xps = NULL; - const policydb_t *db = NULL; - avtab_extended_perms_t *xperms = NULL; - size_t i, j, count = 0; - - if (iter == NULL || (xps = qpol_iterator_state(iter)) == NULL || - (db = qpol_iterator_policy(iter)) == NULL || xperm_state_end(iter)) { - errno = EINVAL; - return 0; /* as a size_t 0 is error */ - } - - xperms = xps->xperms; - - // just count how many bits are set in the perms array (size == 8) of uint32_t's - for (i = 0; i < 8; i++) { - for (j = 0; j < 32; j++) { - if (xperms->perms[i] & (1 << j)) { - count++; - } - } - } - - if (xperms->specified & AVTAB_XPERMS_IOCTLDRIVER) { - // when icotl driver is true, each bit in the perms array represents - // the enabling of all 256 function bits of driver - count *= 256; - } - - return count; -} - diff --git a/libqpol/policy_extend.c b/libqpol/policy_extend.c index 7fd86c9..2e5b070 100644 --- a/libqpol/policy_extend.c +++ b/libqpol/policy_extend.c @@ -383,100 +383,6 @@ static int qpol_policy_add_isid_names(qpol_policy_t * policy) return 0; } -/** - * Walks the conditional list and adds links for reverse look up from - * a te/av rule to the conditional from which it came. - * @param policy The policy to which to add conditional trace backs. - * This policy will be altered by this function. - * @return 0 on success and < 0 on failure; if the call fails, - * errno will be set. On failure, the policy state may be inconsistent. - */ -static int qpol_policy_add_cond_rule_traceback(qpol_policy_t * policy) -{ - policydb_t *db = NULL; - cond_node_t *cond = NULL; - cond_av_list_t *list_ptr = NULL; - qpol_iterator_t *iter = NULL; - avtab_ptr_t rule = NULL; - int error = 0; - uint32_t rules = 0; - - INFO(policy, "%s", "Building conditional rules tables. (Step 5 of 5)"); - if (!policy) { - ERR(policy, "%s", strerror(EINVAL)); - errno = EINVAL; - return STATUS_ERR; - } - - db = &policy->p->p; - - rules = (QPOL_RULE_ALLOW | QPOL_RULE_AUDITALLOW | QPOL_RULE_DONTAUDIT); - if (!(policy->options & QPOL_POLICY_OPTION_NO_NEVERALLOWS)) - rules |= QPOL_RULE_NEVERALLOW; - - /* mark all unconditional rules as enabled */ - if (qpol_policy_get_avrule_iter(policy, rules, &iter)) - return STATUS_ERR; - for (; !qpol_iterator_end(iter); qpol_iterator_next(iter)) { - if (qpol_iterator_get_item(iter, (void **)&rule)) { - error = errno; - ERR(policy, "%s", strerror(error)); - errno = error; - return STATUS_ERR; - } - rule->parse_context = NULL; - rule->merged = QPOL_COND_RULE_ENABLED; - } - qpol_iterator_destroy(&iter); - if (qpol_policy_get_terule_iter(policy, (QPOL_RULE_TYPE_TRANS | QPOL_RULE_TYPE_CHANGE | QPOL_RULE_TYPE_MEMBER), &iter)) - return STATUS_ERR; - for (; !qpol_iterator_end(iter); qpol_iterator_next(iter)) { - if (qpol_iterator_get_item(iter, (void **)&rule)) { - error = errno; - ERR(policy, "%s", strerror(error)); - errno = error; - return STATUS_ERR; - } - rule->parse_context = NULL; - rule->merged = QPOL_COND_RULE_ENABLED; - } - qpol_iterator_destroy(&iter); - - for (cond = db->cond_list; cond; cond = cond->next) { - /* evaluate cond */ - cond->cur_state = cond_evaluate_expr(db, cond->expr); - if (cond->cur_state < 0) { - ERR(policy, "Error evaluating conditional: %s", strerror(EILSEQ)); - errno = EILSEQ; - return STATUS_ERR; - } - - /* walk true list */ - for (list_ptr = cond->true_list; list_ptr; list_ptr = list_ptr->next) { - /* field not used after parse, now stores cond */ - list_ptr->node->parse_context = (void *)cond; - /* field not used (except by write), - * now storing list and enabled flags */ - list_ptr->node->merged = QPOL_COND_RULE_LIST; - if (cond->cur_state) - list_ptr->node->merged |= QPOL_COND_RULE_ENABLED; - } - - /* walk false list */ - for (list_ptr = cond->false_list; list_ptr; list_ptr = list_ptr->next) { - /* field not used after parse, now stores cond */ - list_ptr->node->parse_context = (void *)cond; - /* field not used (except by write), - * now storing list and enabled flags */ - list_ptr->node->merged = 0; /* i.e. !QPOL_COND_RULE_LIST */ - if (!cond->cur_state) - list_ptr->node->merged |= QPOL_COND_RULE_ENABLED; - } - } - - return 0; -} - int policy_extend(qpol_policy_t * policy) { int retv, error; @@ -516,12 +422,6 @@ int policy_extend(qpol_policy_t * policy) goto err; } - retv = qpol_policy_add_cond_rule_traceback(policy); - if (retv) { - error = errno; - goto err; - } - return STATUS_SUCCESS; err: diff --git a/libqpol/terule_query.c b/libqpol/terule_query.c deleted file mode 100644 index 61f9e14..0000000 --- a/libqpol/terule_query.c +++ /dev/null @@ -1,262 +0,0 @@ -/** - * @file - * Implementation for the public interface for searching and iterating over type rules. - * - * @author Kevin Carr kcarr@tresys.com - * @author Jeremy A. Mowery jmowery@tresys.com - * @author Jason Tang jtang@tresys.com - * - * Copyright (C) 2006-2007 Tresys Technology, LLC - * - * This library is free software; you can redistribute it and/or - * modify it under the terms of the GNU Lesser General Public - * License as published by the Free Software Foundation; either - * version 2.1 of the License, or (at your option) any later version. - * - * This library is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU - * Lesser General Public License for more details. - * - * You should have received a copy of the GNU Lesser General Public - * License along with this library; if not, write to the Free Software - * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA - */ - -#include "iterator_internal.h" -#include -#include -#include -#include -#include -#include -#include -#include "qpol_internal.h" - -int qpol_policy_get_terule_iter(const qpol_policy_t * policy, uint32_t rule_type_mask, qpol_iterator_t ** iter) -{ - policydb_t *db; - avtab_state_t *state; - - if (iter) { - *iter = NULL; - } - if (policy == NULL || iter == NULL) { - ERR(policy, "%s", strerror(EINVAL)); - errno = EINVAL; - return STATUS_ERR; - } - -#if 1 // Seems to make sediff/sediffx work better without breaking things - if (!qpol_policy_has_capability(policy, QPOL_CAP_RULES_LOADED)) { - ERR(policy, "%s", "Cannot get terules: Rules not loaded"); - errno = ENOTSUP; - return STATUS_ERR; - } -#endif - - db = &policy->p->p; - - state = calloc(1, sizeof(avtab_state_t)); - if (state == NULL) { - ERR(policy, "%s", strerror(ENOMEM)); - errno = ENOMEM; - return STATUS_ERR; - } - state->ucond_tab = &db->te_avtab; - state->cond_tab = &db->te_cond_avtab; - state->rule_type_mask = rule_type_mask; - state->node = db->te_avtab.htable[0]; - - if (qpol_iterator_create - (policy, state, avtab_state_get_cur, avtab_state_next, avtab_state_end, avtab_state_size, free, iter)) { - free(state); - return STATUS_ERR; - } - if (state->node == NULL || !(state->node->key.specified & state->rule_type_mask)) { - avtab_state_next(*iter); - } - return STATUS_SUCCESS; -} - -int qpol_terule_get_source_type(const qpol_policy_t * policy, const qpol_terule_t * rule, const qpol_type_t ** source) -{ - policydb_t *db = NULL; - avtab_ptr_t terule = NULL; - - if (source) { - *source = NULL; - } - - if (!policy || !rule || !source) { - ERR(policy, "%s", strerror(EINVAL)); - errno = EINVAL; - return STATUS_ERR; - } - - db = &policy->p->p; - terule = (avtab_ptr_t) rule; - - *source = (qpol_type_t *) db->type_val_to_struct[terule->key.source_type - 1]; - - return STATUS_SUCCESS; -} - -int qpol_terule_get_target_type(const qpol_policy_t * policy, const qpol_terule_t * rule, const qpol_type_t ** target) -{ - policydb_t *db = NULL; - avtab_ptr_t terule = NULL; - - if (target) { - *target = NULL; - } - - if (!policy || !rule || !target) { - ERR(policy, "%s", strerror(EINVAL)); - errno = EINVAL; - return STATUS_ERR; - } - - db = &policy->p->p; - terule = (avtab_ptr_t) rule; - - *target = (qpol_type_t *) db->type_val_to_struct[terule->key.target_type - 1]; - - return STATUS_SUCCESS; -} - -int qpol_terule_get_object_class(const qpol_policy_t * policy, const qpol_terule_t * rule, const qpol_class_t ** obj_class) -{ - policydb_t *db = NULL; - avtab_ptr_t terule = NULL; - - if (obj_class) { - *obj_class = NULL; - } - - if (!policy || !rule || !obj_class) { - ERR(policy, "%s", strerror(EINVAL)); - errno = EINVAL; - return STATUS_ERR; - } - - db = &policy->p->p; - terule = (avtab_ptr_t) rule; - - *obj_class = (qpol_class_t *) db->class_val_to_struct[terule->key.target_class - 1]; - - return STATUS_SUCCESS; -} - -int qpol_terule_get_default_type(const qpol_policy_t * policy, const qpol_terule_t * rule, const qpol_type_t ** dflt) -{ - policydb_t *db = NULL; - avtab_ptr_t terule = NULL; - - if (dflt) { - *dflt = NULL; - } - - if (!policy || !rule || !dflt) { - ERR(policy, "%s", strerror(EINVAL)); - errno = EINVAL; - return STATUS_ERR; - } - - db = &policy->p->p; - terule = (avtab_ptr_t) rule; - - *dflt = (qpol_type_t *) db->type_val_to_struct[terule->datum.data - 1]; - - return STATUS_SUCCESS; -} - -int qpol_terule_get_rule_type(const qpol_policy_t * policy, const qpol_terule_t * rule, uint32_t * rule_type) -{ - avtab_ptr_t terule = NULL; - - if (rule_type) { - *rule_type = 0; - } - - if (!policy || !rule || !rule_type) { - ERR(policy, "%s", strerror(EINVAL)); - errno = EINVAL; - return STATUS_ERR; - } - - terule = (avtab_ptr_t) rule; - - *rule_type = (terule->key.specified & (QPOL_RULE_TYPE_TRANS | QPOL_RULE_TYPE_CHANGE | QPOL_RULE_TYPE_MEMBER)); - - return STATUS_SUCCESS; -} - -int qpol_terule_get_cond(const qpol_policy_t * policy, const qpol_terule_t * rule, const qpol_cond_t ** cond) -{ - avtab_ptr_t terule = NULL; - - if (cond) { - *cond = NULL; - } - - if (!policy || !rule || !cond) { - ERR(policy, "%s", strerror(EINVAL)); - errno = EINVAL; - return STATUS_ERR; - } - - terule = (avtab_ptr_t) rule; - - *cond = (qpol_cond_t *) terule->parse_context; - - return STATUS_SUCCESS; -} - -int qpol_terule_get_is_enabled(const qpol_policy_t * policy, const qpol_terule_t * rule, uint32_t * is_enabled) -{ - avtab_ptr_t terule = NULL; - - if (is_enabled) { - *is_enabled = 0; - } - - if (!policy || !rule || !is_enabled) { - ERR(policy, "%s", strerror(EINVAL)); - errno = EINVAL; - return STATUS_ERR; - } - - terule = (avtab_ptr_t) rule; - - *is_enabled = ((terule->merged & QPOL_COND_RULE_ENABLED) ? 1 : 0); - - return STATUS_SUCCESS; -} - -int qpol_terule_get_which_list(const qpol_policy_t * policy, const qpol_terule_t * rule, uint32_t * which_list) -{ - avtab_ptr_t terule = NULL; - - if (which_list) { - *which_list = 0; - } - - if (!policy || !rule || !which_list) { - ERR(policy, "%s", strerror(EINVAL)); - errno = EINVAL; - return STATUS_ERR; - } - - terule = (avtab_ptr_t) rule; - - if (!terule->parse_context) { - ERR(policy, "%s", strerror(EINVAL)); - errno = EINVAL; - return STATUS_ERR; - } - - *which_list = ((terule->merged & QPOL_COND_RULE_LIST) ? 1 : 0); - - return STATUS_SUCCESS; -} diff --git a/setools/policyrep/boolcond.pxi b/setools/policyrep/boolcond.pxi index 3a34d87..933c536 100644 --- a/setools/policyrep/boolcond.pxi +++ b/setools/policyrep/boolcond.pxi @@ -139,6 +139,25 @@ cdef class Conditional(PolicySymbol): except TypeError: return str(self) == str(other) + def __deepcopy__(self, memo): + # shallow copy as all of the members are immutable + newobj = Conditional.factory(self.policy, self.handle) + memo[id(self)] = newobj + return newobj + + def __getstate__(self): + return (self.policy, self._pickle()) + + def __setstate__(self, state): + self.policy = state[0] + self._unpickle(state[1]) + + cdef bytes _pickle(self): + return (self.handle) + + cdef _unpickle(self, bytes handle): + memcpy(&self.handle, handle, sizeof(sepol.cond_node_t *)) + def _eq(self, Conditional other): """Low-level equality check (C pointers).""" return self.handle == other.handle @@ -206,14 +225,14 @@ cdef class Conditional(PolicySymbol): def false_rules(self): """An iterator over the rules in the false (else) block of the conditional.""" - pass + return ConditionalTERuleIterator.factory(self.policy, self.handle.false_list, self, False) def statement(self): raise NoStatement def true_rules(self): """An iterator over the rules in the true block of the conditional.""" - pass + return ConditionalTERuleIterator.factory(self.policy, self.handle.true_list, self, True) def truth_table(self): """ diff --git a/setools/policyrep/libpolicyrep.pyx b/setools/policyrep/libpolicyrep.pyx index 634f4a7..8489244 100644 --- a/setools/policyrep/libpolicyrep.pyx +++ b/setools/policyrep/libpolicyrep.pyx @@ -275,75 +275,6 @@ include "user.pxi" include "xencontext.pxi" -cdef QpolIterator qpol_iterator_factory(SELinuxPolicy policy, qpol_iterator_t *iter, factory, - suppress=None): - i = QpolIterator() - i.policy = policy - i.iter = iter - i.factory = factory - i.suppress = suppress - return i - - -cdef class QpolIterator: - cdef: - qpol_iterator_t *iter - SELinuxPolicy policy - object factory - object suppress - - def __dealloc__(self): - if self.iter: - qpol_iterator_destroy(&self.iter) - - def __iter__(self): - return self - - def __next__(self): - cdef void *item - - while not qpol_iterator_end(self.iter): - qpol_iterator_get_item(self.iter, &item) - qpol_iterator_next(self.iter) - w = QpolIteratorItem() - w.obj = item - - if self.suppress: - # this is to handle where factory functions - # throw exceptions since aliases are included - # in some qpol iterators (i.e. that's how - # the policy structure works) - try: - return self.factory(self.policy, w) - except self.suppress: - pass - - else: - return self.factory(self.policy, w) - - raise StopIteration - - def __len__(self): - cdef size_t s - - qpol_iterator_get_size(self.iter, &s) - return s - - -cdef class QpolIteratorItem: - - """Wrap void pointers so they can be passed easily.""" - - cdef void *obj - - -cdef str string_factory_iter(SELinuxPolicy _, QpolIteratorItem item): - - """Factory function for returning strings from qpol iterators.""" - - return intern( item.obj) - - cdef int ebitmap_get_bit(sepol.ebitmap_t *e, unsigned int bit): """ Get a specific bit value. diff --git a/setools/policyrep/selinuxpolicy.pxi b/setools/policyrep/selinuxpolicy.pxi index 39b2abb..6bd9841 100644 --- a/setools/policyrep/selinuxpolicy.pxi +++ b/setools/policyrep/selinuxpolicy.pxi @@ -602,27 +602,12 @@ cdef class SELinuxPolicy: def terules(self): """Iterator over all type enforcement rules.""" - cdef qpol_iterator_t *av_iter - cdef qpol_iterator_t *te_iter - cdef qpol_iterator_t *ft_iter + yield from TERuleIterator.factory(self, &self.handle.p.p.te_avtab) + yield from FileNameTERuleIterator.factory(self, &self.handle.p.p.filename_trans) - cdef uint32_t av_rule_types = QPOL_RULE_ALLOW | QPOL_RULE_AUDITALLOW | QPOL_RULE_DONTAUDIT \ - | QPOL_RULE_XPERMS_ALLOW | QPOL_RULE_XPERMS_AUDITALLOW | QPOL_RULE_XPERMS_DONTAUDIT - - cdef uint32_t te_rule_types = QPOL_RULE_TYPE_TRANS | QPOL_RULE_TYPE_CHANGE | QPOL_RULE_TYPE_MEMBER - - if qpol_policy_has_capability(self.handle, QPOL_CAP_NEVERALLOW): - av_rule_types |= QPOL_RULE_NEVERALLOW | QPOL_RULE_XPERMS_NEVERALLOW - - if qpol_policy_get_avrule_iter(self.handle, av_rule_types, &av_iter): - raise MemoryError - - if qpol_policy_get_terule_iter(self.handle, te_rule_types, &te_iter): - raise MemoryError - - return chain(qpol_iterator_factory(self, av_iter, avrule_factory_iter), - qpol_iterator_factory(self, te_iter, terule_factory_iter), - FileNameTERuleIterator.factory(self, &self.handle.p.p.filename_trans)) + for c in self.conditionals(): + yield from c.true_rules() + yield from c.false_rules() # # Constraints iterators diff --git a/setools/policyrep/sepol.pxd b/setools/policyrep/sepol.pxd index 470b2cd..86914d6 100644 --- a/setools/policyrep/sepol.pxd +++ b/setools/policyrep/sepol.pxd @@ -440,6 +440,8 @@ cdef extern from "": ctypedef av_extended_perms av_extended_perms_t + cdef bint xperm_test(size_t x, uint32_t *perms) + # # avrule_t # diff --git a/setools/policyrep/terule.pxi b/setools/policyrep/terule.pxi index 8763a25..45b9abb 100644 --- a/setools/policyrep/terule.pxi +++ b/setools/policyrep/terule.pxi @@ -19,109 +19,6 @@ # import itertools -# -# AV rule factory functions -# -cdef inline AVRule avrule_factory_iter(SELinuxPolicy policy, QpolIteratorItem symbol): - """Factory function variant for iterating over AVRule objects.""" - cdef const qpol_avrule_t *rule = symbol.obj - cdef uint32_t extended - - if qpol_avrule_get_is_extended(policy.handle, rule, &extended): - ex = LowLevelPolicyError("Error determining if av rule is extended: {}".format( - strerror(errno))) - ex.errno = errno - raise ex - - if extended: - return avrulex_factory(policy, rule) - else: - return avrule_factory(policy, rule) - - -cdef inline AVRule avrule_factory(SELinuxPolicy policy, const qpol_avrule_t *symbol): - """Factory function for creating AVRule objects.""" - r = AVRule() - r.policy = policy - r.handle = symbol - return r - - -cdef inline AVRuleXperm avrulex_factory(SELinuxPolicy policy, const qpol_avrule_t *symbol): - """Factory function for creating AVRuleXperm objects.""" - r = AVRuleXperm() - r.policy = policy - r.handle = symbol - return r - -# -# TE rule factory functions -# -cdef inline TERule terule_factory_iter(SELinuxPolicy policy, QpolIteratorItem symbol): - """Factory function variant for iterating over TERule objects.""" - return terule_factory(policy, symbol.obj) - - -cdef inline TERule terule_factory(SELinuxPolicy policy, const qpol_terule_t *symbol): - """Factory function for creating TERule objects.""" - r = TERule() - r.policy = policy - r.handle = symbol - return r - -# -# Extended permission set iterator factory function -# -cdef inline int xperms_factory_iter(SELinuxPolicy _, QpolIteratorItem item): - cdef int *obj = item.obj - cdef int i = obj[0] - - # The library allocates integers while reading out the bitmap - free(item.obj) - - return i - - -# -# Expanded TE rule factory functions -# -cdef expanded_avrule_factory(AVRule original, source, target): - """Factory function for creating ExpandedAVRule objects.""" - if original.extended: - r = ExpandedAVRuleXperm() - else: - r = ExpandedAVRule() - - r.policy = original.policy - r.handle = original.handle - r.source = source - r.target = target - r.origin = original - r.perms = original.perms - return r - - -cdef expanded_terule_factory(TERule original, source, target): - """Factory function for creating ExpandedTERule objects.""" - r = ExpandedTERule() - r.policy = original.policy - r.handle = original.handle - r.source = source - r.target = target - r.origin = original - return r - - -cdef expanded_filename_terule_factory(FileNameTERule original, source, target): - """Factory function for creating ExpandedTERule objects.""" - r = ExpandedFileNameTERule() - r.policy = original.policy - r.handle = original.handle - r.source = source - r.target = target - r.origin = original - return r - # # Classes @@ -130,24 +27,112 @@ class TERuletype(PolicyEnum): """Enumeration of types of TE rules.""" - allow = QPOL_RULE_ALLOW - neverallow = QPOL_RULE_NEVERALLOW - auditallow = QPOL_RULE_AUDITALLOW - dontaudit = QPOL_RULE_DONTAUDIT - allowxperm = QPOL_RULE_XPERMS_ALLOW - neverallowxperm = QPOL_RULE_XPERMS_NEVERALLOW - auditallowxperm = QPOL_RULE_XPERMS_AUDITALLOW - dontauditxperm = QPOL_RULE_XPERMS_DONTAUDIT - type_transition = QPOL_RULE_TYPE_TRANS - type_change = QPOL_RULE_TYPE_CHANGE - type_member = QPOL_RULE_TYPE_MEMBER + allow = sepol.AVTAB_ALLOWED + neverallow = sepol.AVTAB_NEVERALLOW + auditallow = sepol.AVTAB_AUDITALLOW + dontaudit = sepol.AVTAB_AUDITDENY + allowxperm = sepol.AVTAB_XPERMS_ALLOWED + neverallowxperm = sepol.AVTAB_XPERMS_NEVERALLOW + auditallowxperm = sepol.AVTAB_XPERMS_AUDITALLOW + dontauditxperm = sepol.AVTAB_XPERMS_DONTAUDIT + type_transition = sepol.AVTAB_TRANSITION + type_change = sepol.AVTAB_CHANGE + type_member = sepol.AVTAB_MEMBER -cdef class AVRule(PolicyRule): +cdef class BaseTERule(PolicyRule): + + """Base class for TE rules.""" + + cdef: + sepol.avtab_key_t *key + sepol.avtab_datum_t *datum + object _conditional + object _conditional_block + + def __hash__(self): + return hash("{0.ruletype}|{0.source}|{0.target}|{0.tclass}|{1}|{2}".format( + self, self._conditional, self._conditional_block)) + + def _eq(self, BaseTERule other): + return self.key == other.key and self.datum == other.datum + + @property + def ruletype(self): + """The rule type.""" + # mask the enabled bit for the ruletype lookup in conditional rules + return TERuletype(self.key.specified & ~sepol.AVTAB_ENABLED) + + @property + def source(self): + """The rule's source type/attribute.""" + return type_or_attr_factory( + self.policy, self.policy.handle.p.p.type_val_to_struct[self.key.source_type - 1]) + + @property + def target(self): + """The rule's target type/attribute.""" + return type_or_attr_factory( + self.policy, self.policy.handle.p.p.type_val_to_struct[self.key.target_type - 1]) + + @property + def tclass(self): + """The rule's object class.""" + return ObjClass.factory(self.policy, + self.policy.handle.p.p.class_val_to_struct[self.key.target_class - 1]) + + @property + def filename(self): + """The type_transition rule's file name.""" + # Since name type_transitions have a different + # class, this is always an error. + if self.ruletype == TERuletype.type_transition: + raise TERuleNoFilename + else: + raise RuleUseError("{0} rules do not have file names".format(self.ruletype)) + + @property + def conditional(self): + """The rule's conditional expression.""" + if self._conditional is None: + raise RuleNotConditional + else: + return self._conditional + + @property + def conditional_block(self): + """ + The conditional block of the rule (T/F) + + For example, if the policy looks like this: + + if ( the_conditional_expression ) { + If the rule is here, this property is True + } else { + If the rule is here, this property is False + } + """ + if self._conditional_block is None: + raise RuleNotConditional + else: + return self._conditional_block + + +cdef class AVRule(BaseTERule): """An access vector type enforcement rule.""" - cdef const qpol_avrule_t *handle + @staticmethod + cdef factory(SELinuxPolicy policy, sepol.avtab_key_t *key, sepol.avtab_datum_t *datum, + conditional, conditional_block): + """Factory function for creating AVRule objects.""" + r = AVRule() + r.policy = policy + r.key = key + r.datum = datum + r._conditional = conditional + r._conditional_block = conditional_block + return r def __str__(self): rule_string = "{0.ruletype} {0.source} {0.target}:{0.tclass} ".format(self) @@ -167,92 +152,38 @@ cdef class AVRule(PolicyRule): return rule_string - def __hash__(self): - try: - cond = self.conditional - cond_block = self.conditional_block - except RuleNotConditional: - cond = None - cond_block = None - - return hash("{0.ruletype}|{0.source}|{0.target}|{0.tclass}|{1}|{2}".format( - self, cond, cond_block)) - def __lt__(self, other): return str(self) < str(other) def __deepcopy__(self, memo): # shallow copy as all of the members are immutable - newobj = avrule_factory(self.policy, self.handle) + newobj = AVRule.factory(self.policy, self.key, self.datum, self._conditional, + self._conditional_block) memo[id(self)] = newobj return newobj def __getstate__(self): - return (self.policy, self._pickle()) + return self._pickle() def __setstate__(self, state): - self.policy = state[0] - self._unpickle(state[1]) + self._unpickle(state) - cdef bytes _pickle(self): - return (self.handle) + cdef _pickle(self): + return self.policy, (self.key), (self.datum), \ + self._conditional, self._conditional_block - cdef _unpickle(self, bytes handle): - memcpy(&self.handle, handle, sizeof(qpol_avrule_t*)) - - def _eq(self, AVRule other): - """Low-level equality check (C pointers).""" - return self.handle == other.handle - - @property - def ruletype(self): - """The rule type.""" - cdef uint32_t rt - if qpol_avrule_get_rule_type(self.policy.handle, self.handle, &rt): - ex = LowLevelPolicyError("Error reading rule type for AV rule: {}".format( - strerror(errno))) - ex.errno = errno - raise ex - - return TERuletype(rt) - - @property - def source(self): - """The rule's source type/attribute.""" - cdef const qpol_type_t *t - if qpol_avrule_get_source_type(self.policy.handle, self.handle, &t): - ex = LowLevelPolicyError("Error reading source type/attr for AV rule: {}".format( - strerror(errno))) - ex.errno = errno - raise ex - - return type_or_attr_factory(self.policy, t) - - @property - def target(self): - """The rule's target type/attribute.""" - cdef const qpol_type_t *t - if qpol_avrule_get_target_type(self.policy.handle, self.handle, &t): - ex = LowLevelPolicyError("Error reading target type/attr for AV rule: {}".format( - strerror(errno))) - ex.errno = errno - raise ex - - return type_or_attr_factory(self.policy, t) - - @property - def tclass(self): - """The rule's object class.""" - return ObjClass.factory(self.policy, self.policy.handle.p.p.class_val_to_struct[(self.handle).key.target_class - 1]) + cdef _unpickle(self, objs): + self.policy = objs[0] + memcpy(&self.key, objs[1], sizeof(sepol.avtab_key_t*)) + memcpy(&self.datum, objs[2], sizeof(sepol.avtab_datum_t*)) + self._conditional = objs[3] + self._conditional_block = objs[4] @property def perms(self): """The rule's permission set.""" - cdef qpol_iterator_t *iter - if qpol_avrule_get_perm_iter(self.policy.handle, self.handle, &iter): - raise MemoryError - - return set(qpol_iterator_factory(self.policy, iter, string_factory_iter)) + return set(p for p in PermissionVectorIterator.factory(self.policy, self.tclass, + ~self.datum.data if self.key.specified & sepol.AVTAB_AUDITDENY else self.datum.data)) @property def default(self): @@ -263,58 +194,20 @@ cdef class AVRule(PolicyRule): def filename(self): raise RuleUseError("{0} rules do not have file names".format(self.ruletype)) - @property - def conditional(self): - """The rule's conditional expression.""" - cdef const qpol_cond_t *c - if qpol_avrule_get_cond(self.policy.handle, self.handle, &c): - ex = LowLevelPolicyError("Error reading AV rule conditional: {}".format( - strerror(errno))) - ex.errno = errno - raise ex - - if c: - return Conditional.factory(self.policy, c) - else: - raise RuleNotConditional - - @property - def conditional_block(self): - """ - The conditional block of the rule (T/F) - - For example, if the policy looks like this: - - if ( the_conditional_expression ) { - If the rule is here, this property is True - } else { - If the rule is here, this property is False - } - """ - cdef const qpol_cond_t *c - cdef uint32_t which - - if qpol_avrule_get_cond(self.policy.handle, self.handle, &c): - ex = LowLevelPolicyError("Error reading AV rule conditional: {}".format( - strerror(errno))) - ex.errno = errno - raise ex - - if not c: - raise RuleNotConditional - - if qpol_avrule_get_which_list(self.policy.handle, self.handle, &which): - ex = LowLevelPolicyError("Error reading AV rule conditional block: {}".format( - strerror(errno))) - ex.errno = errno - raise ex - - return bool(which) - def expand(self): """Expand the rule into an equivalent set of rules without attributes.""" for s, t in itertools.product(self.source.expand(), self.target.expand()): - yield expanded_avrule_factory(self, s, t) + r = ExpandedAVRule() + r.policy = self.policy + r.key = self.key + r.datum = self.datum + r.source = s + r.target = t + r.origin = self + r.perms = self.perms + r._conditional = self._conditional + r._conditional_block = self._conditional_block + yield r cdef class IoctlSet(set): @@ -375,6 +268,18 @@ cdef class AVRuleXperm(AVRule): """An extended permission access vector type enforcement rule.""" + @staticmethod + cdef factory(SELinuxPolicy policy, sepol.avtab_key_t *key, sepol.avtab_datum_t *datum, + conditional, conditional_block): + """Factory function for creating AVRule objects.""" + r = AVRuleXperm() + r.policy = policy + r.key = key + r.datum = datum + r._conditional = conditional + r._conditional_block = conditional_block + return r + def __init__(self): self.extended = True @@ -391,52 +296,104 @@ cdef class AVRuleXperm(AVRule): return rule_string + def __hash__(self): + return hash("{0.ruletype}|{0.source}|{0.target}|{0.tclass}|{0.xperm_type}|{1}|{2}". + format(self, self._conditional, self._conditional_block)) + def __lt__(self, other): return str(self) < str(other) def __deepcopy__(self, memo): # shallow copy as all of the members are immutable - newobj = avrulex_factory(self.policy, self.handle) + newobj = AVRuleXperm.factory(self.policy, self.key, self.datum, self._conditional, + self._conditional_block) memo[id(self)] = newobj return newobj def __getstate__(self): - return (self.policy, self._pickle()) + return self._pickle() def __setstate__(self, state): - self.policy = state[0] - self._unpickle(state[1]) + self._unpickle(state) - cdef bytes _pickle(self): - return (self.handle) + cdef _pickle(self): + return self.policy, (self.key), (self.datum), \ + self._conditional, self._conditional_block - cdef _unpickle(self, bytes handle): - memcpy(&self.handle, handle, sizeof(qpol_avrule_t*)) - - @property - def perms(self): - """The rule's extended permission set.""" - cdef qpol_iterator_t *iter - if qpol_avrule_get_xperm_iter(self.policy.handle, self.handle, &iter): - raise MemoryError - - return IoctlSet(qpol_iterator_factory(self.policy, iter, xperms_factory_iter)) + cdef _unpickle(self, objs): + self.policy = objs[0] + memcpy(&self.key, objs[1], sizeof(sepol.avtab_key_t*)) + memcpy(&self.datum, objs[2], sizeof(sepol.avtab_datum_t*)) + self._conditional = objs[3] + self._conditional_block = objs[4] @property def xperm_type(self): """The standard permission extended by these permissions (e.g. ioctl).""" - cdef char *xt - if qpol_avrule_get_xperm_type(self.policy.handle, self.handle, &xt): - raise ValueError("Could not get xperm type for av rule") + if self.datum.xperms == NULL: + raise LowLevelPolicyError("Extended permission information is NULL") - return intern(xt) + if self.datum.xperms.specified == sepol.AVTAB_XPERMS_IOCTLFUNCTION \ + or self.datum.xperms.specified == sepol.AVTAB_XPERMS_IOCTLDRIVER: + return intern("ioctl") + else: + raise LowLevelPolicyError("Unknown extended permission: {}".format( + self.datum.xperms.specified)) + + @property + def perms(self): + """The rule's extended permission set.""" + cdef: + sepol.avtab_extended_perms_t *xperms = self.datum.xperms + IoctlSet ret = IoctlSet() + size_t curr = 0 + size_t len = sizeof(xperms.perms) * sepol.EXTENDED_PERMS_LEN + + while curr < len: + if sepol.xperm_test(curr, xperms.perms): + if xperms.specified & sepol.AVTAB_XPERMS_IOCTLFUNCTION: + ret.add(xperms.driver << 8 | curr) + elif xperms.specified & sepol.AVTAB_XPERMS_IOCTLDRIVER: + ret.add(curr << 8) + else: + raise LowLevelPolicyError("Unknown extended permission: {}".format( + xperms.specified)) + + curr += 1 + + return ret + + def expand(self): + """Expand the rule into an equivalent set of rules without attributes.""" + for s, t in itertools.product(self.source.expand(), self.target.expand()): + r = ExpandedAVRuleXperm() + r.policy = self.policy + r.key = self.key + r.datum = self.datum + r.source = s + r.target = t + r.origin = self + r.perms = self.perms + r._conditional = self._conditional + r._conditional_block = self._conditional_block + yield r -cdef class TERule(PolicyRule): +cdef class TERule(BaseTERule): """A type_* type enforcement rule.""" - cdef const qpol_terule_t *handle + @staticmethod + cdef factory(SELinuxPolicy policy, sepol.avtab_key_t *key, sepol.avtab_datum_t *datum, + conditional, conditional_block): + """Factory function for creating TERule objects.""" + r = TERule() + r.policy = policy + r.key = key + r.datum = datum + r._conditional = conditional + r._conditional_block = conditional_block + return r def __str__(self): rule_string = "{0.ruletype} {0.source} {0.target}:{0.tclass} {0.default};".format(self) @@ -448,88 +405,32 @@ cdef class TERule(PolicyRule): return rule_string - def __hash__(self): - try: - cond = self.conditional - cond_block = self.conditional_block - except RuleNotConditional: - cond = None - cond_block = None - - try: - filename = self.filename - except (TERuleNoFilename, RuleUseError): - filename = None - - return hash("{0.ruletype}|{0.source}|{0.target}|{0.tclass}|{1}|{2}|{3}".format( - self, filename, cond, cond_block)) - def __lt__(self, other): return str(self) < str(other) def __deepcopy__(self, memo): # shallow copy as all of the members are immutable - newobj = terule_factory(self.policy, self.handle) + newobj = TERule.factory(self.policy, self.key, self.datum, self._conditional, + self._conditional_block) memo[id(self)] = newobj return newobj def __getstate__(self): - return (self.policy, self._pickle()) + return self._pickle() def __setstate__(self, state): - self.policy = state[0] - self._unpickle(state[1]) + self._unpickle(state) - cdef bytes _pickle(self): - return (self.handle) + cdef _pickle(self): + return self.policy, (self.key), (self.datum), \ + self._conditional, self._conditional_block - cdef _unpickle(self, bytes handle): - memcpy(&self.handle, handle, sizeof(qpol_terule_t*)) - - def _eq(self, TERule other): - """Low-level equality check (C pointers).""" - return self.handle == other.handle - - @property - def ruletype(self): - """The rule type.""" - cdef uint32_t rt - if qpol_terule_get_rule_type(self.policy.handle, self.handle, &rt): - ex = LowLevelPolicyError("Error reading rule type for TE rule: {}".format( - strerror(errno))) - ex.errno = errno - raise ex - - return TERuletype(rt) - - @property - def source(self): - """The rule's source type/attribute.""" - cdef const qpol_type_t *t - if qpol_terule_get_source_type(self.policy.handle, self.handle, &t): - ex = LowLevelPolicyError("Error reading source type/attr for TE rule: {}".format( - strerror(errno))) - ex.errno = errno - raise ex - - return type_or_attr_factory(self.policy, t) - - @property - def target(self): - """The rule's target type/attribute.""" - cdef const qpol_type_t *t - if qpol_terule_get_target_type(self.policy.handle, self.handle, &t): - ex = LowLevelPolicyError("Error reading target type/attr for TE rule: {}".format( - strerror(errno))) - ex.errno = errno - raise ex - - return type_or_attr_factory(self.policy, t) - - @property - def tclass(self): - """The rule's object set.""" - return ObjClass.factory(self.policy, self.policy.handle.p.p.class_val_to_struct[(self.handle).key.target_class - 1]) + cdef _unpickle(self, objs): + self.policy = objs[0] + memcpy(&self.key, objs[1], sizeof(sepol.avtab_key_t*)) + memcpy(&self.datum, objs[2], sizeof(sepol.avtab_datum_t*)) + self._conditional = objs[3] + self._conditional_block = objs[4] @property def perms(self): @@ -539,75 +440,22 @@ cdef class TERule(PolicyRule): @property def default(self): """The rule's default type.""" - cdef const qpol_type_t *t - if qpol_terule_get_default_type(self.policy.handle, self.handle, &t): - ex = LowLevelPolicyError("Error reading default type for TE rule: {}".format( - strerror(errno))) - ex.errno = errno - raise ex - - return Type.factory(self.policy, t) - - @property - def filename(self): - """The type_transition rule's file name.""" - if self.ruletype == TERuletype.type_transition: - raise TERuleNoFilename - else: - raise RuleUseError("{0} rules do not have file names".format(self.ruletype)) - - @property - def conditional(self): - """The rule's conditional expression.""" - cdef const qpol_cond_t *c - if qpol_terule_get_cond(self.policy.handle, self.handle, &c): - ex = LowLevelPolicyError("Error reading TE rule conditional: {}".format( - strerror(errno))) - ex.errno = errno - raise ex - - if c: - return Conditional.factory(self.policy, c) - else: - raise RuleNotConditional - - @property - def conditional_block(self): - """ - The conditional block of the rule (T/F) - - For example, if the policy looks like this: - - if ( the_conditional_expression ) { - If the rule is here, this property is True - } else { - If the rule is here, this property is False - } - """ - cdef const qpol_cond_t *c - cdef uint32_t which - - if qpol_terule_get_cond(self.policy.handle, self.handle, &c): - ex = LowLevelPolicyError("Error reading TE rule conditional: {}".format( - strerror(errno))) - ex.errno = errno - raise ex - - if not c: - raise RuleNotConditional - - if qpol_terule_get_which_list(self.policy.handle, self.handle, &which): - ex = LowLevelPolicyError("Error reading TE rule conditional block: {}".format( - strerror(errno))) - ex.errno = errno - raise ex - - return bool(which) + return Type.factory(self.policy, + self.policy.handle.p.p.type_val_to_struct[self.datum.data - 1]) def expand(self): """Expand the rule into an equivalent set of rules without attributes.""" for s, t in itertools.product(self.source.expand(), self.target.expand()): - yield expanded_terule_factory(self, s, t) + r = ExpandedTERule() + r.policy = self.policy + r.key = self.key + r.datum = self.datum + r.source = s + r.target = t + r._conditional = self._conditional + r._conditional_block = self._conditional_block + r.origin = self + yield r cdef class FileNameTERule(PolicyRule): @@ -615,89 +463,74 @@ cdef class FileNameTERule(PolicyRule): """A type_transition type enforcement rule with filename.""" cdef: - sepol.filename_trans_t *handle + sepol.filename_trans_t *key + sepol.filename_trans_datum_t *datum readonly object ruletype - Type dft @staticmethod - cdef factory(SELinuxPolicy policy, sepol.filename_trans_t *symbol, sepol.type_datum_t *dft): + cdef factory(SELinuxPolicy policy, sepol.filename_trans_t *key, sepol.filename_trans_datum_t *datum): """Factory function for creating TERule objects.""" - r = FileNameTERule(Type.factory(policy, dft)) + r = FileNameTERule() r.policy = policy - r.handle = symbol + r.key = key + r.datum = datum return r - def __init__(self, dft): + def __init__(self): self.ruletype = TERuletype.type_transition - self.dft = dft def __str__(self): - rule_string = "{0.ruletype} {0.source} {0.target}:{0.tclass} {0.default} {0.filename};". \ + return "{0.ruletype} {0.source} {0.target}:{0.tclass} {0.default} {0.filename};". \ format(self) - try: - rule_string += " [ {0.conditional} ]:{0.conditional_block}".format(self) - except RuleNotConditional: - pass - - return rule_string - def __hash__(self): - try: - cond = self.conditional - cond_block = self.conditional_block - except RuleNotConditional: - cond = None - cond_block = None - - try: - filename = self.filename - except (TERuleNoFilename, RuleUseError): - filename = None - - return hash("{0.ruletype}|{0.source}|{0.target}|{0.tclass}|{1}|{2}|{3}".format( - self, filename, cond, cond_block)) + return hash("{0.ruletype}|{0.source}|{0.target}|{0.tclass}|{0.filename}|{1}|{2}".format( + self, None, None)) def __lt__(self, other): return str(self) < str(other) def __deepcopy__(self, memo): # shallow copy as all of the members are immutable - newobj = FileNameTERule.factory(self.policy, self.handle, self.dft.handle) + newobj = FileNameTERule.factory(self.policy, self.key, self.datum) memo[id(self)] = newobj return newobj def __getstate__(self): - return (self.policy, self._pickle()) + return self._pickle() def __setstate__(self, state): - self.policy = state[0] - self._unpickle(state[1]) + self._unpickle(state) - cdef bytes _pickle(self): - return (self.handle) + cdef _pickle(self): + return self.policy, (self.key), (self.datum), \ + self._conditional, self._conditional_block - cdef _unpickle(self, bytes handle): - memcpy(&self.handle, handle, sizeof(sepol.filename_trans_t*)) + cdef _unpickle(self, objs): + self.policy = objs[0] + memcpy(&self.key, objs[1], sizeof(sepol.filename_trans_t*)) + memcpy(&self.datum, objs[2], sizeof(sepol.filename_trans_datum_t*)) + self._conditional = objs[3] + self._conditional_block = objs[4] def _eq(self, FileNameTERule other): """Low-level equality check (C pointers).""" - return self.handle == other.handle + return self.key == other.key and self.datum == other.datum @property def source(self): """The rule's source type/attribute.""" - return type_or_attr_factory(self.policy, self.policy.handle.p.p.type_val_to_struct[self.handle.stype - 1]) + return type_or_attr_factory(self.policy, self.policy.handle.p.p.type_val_to_struct[self.key.stype - 1]) @property def target(self): """The rule's target type/attribute.""" - return type_or_attr_factory(self.policy, self.policy.handle.p.p.type_val_to_struct[self.handle.ttype - 1]) + return type_or_attr_factory(self.policy, self.policy.handle.p.p.type_val_to_struct[self.key.ttype - 1]) @property def tclass(self): """The rule's object class.""" - return ObjClass.factory(self.policy, self.policy.handle.p.p.class_val_to_struct[self.handle.ttype - 1]) + return ObjClass.factory(self.policy, self.policy.handle.p.p.class_val_to_struct[self.key.tclass - 1]) @property def perms(self): @@ -707,17 +540,24 @@ cdef class FileNameTERule(PolicyRule): @property def default(self): """The rule's default type.""" - return self.dft + return Type.factory(self.policy, self.policy.handle.p.p.type_val_to_struct[self.datum.otype - 1]) @property def filename(self): """The type_transition rule's file name.""" - return intern(self.handle.name) + return intern(self.key.name) def expand(self): """Expand the rule into an equivalent set of rules without attributes.""" for s, t in itertools.product(self.source.expand(), self.target.expand()): - yield expanded_filename_terule_factory(self, s, t) + r = ExpandedFileNameTERule() + r.policy = self.policy + r.key = self.key + r.datum = self.datum + r.source = s + r.target = t + r.origin = self + yield r cdef class ExpandedAVRule(AVRule): @@ -731,15 +571,8 @@ cdef class ExpandedAVRule(AVRule): public object origin def __hash__(self): - try: - cond = self.conditional - cond_block = self.conditional_block - except RuleNotConditional: - cond = None - cond_block = None - - return hash("{0.ruletype}|{0.source}|{0.target}|{0.tclass}|{1}|{2}".format( - self, cond, cond_block)) + return hash("{0.ruletype}|{0.source}|{0.target}|{0.tclass}|{1}|{2}". + format(self, self._conditional, self._conditional_block)) def __lt__(self, other): return str(self) < str(other) @@ -756,7 +589,8 @@ cdef class ExpandedAVRuleXperm(AVRuleXperm): public object origin def __hash__(self): - return hash("{0.ruletype}|{0.source}|{0.target}|{0.tclass}|{0.xperm_type}".format(self)) + return hash("{0.ruletype}|{0.source}|{0.target}|{0.tclass}|{0.xperm_type}|{1}|{2}". + format(self, self._conditional, self._conditional_block)) def __lt__(self, other): return str(self) < str(other) @@ -772,20 +606,8 @@ cdef class ExpandedTERule(TERule): public object origin def __hash__(self): - try: - cond = self.conditional - cond_block = self.conditional_block - except RuleNotConditional: - cond = None - cond_block = None - - try: - filename = self.filename - except (TERuleNoFilename, RuleUseError): - filename = None - return hash("{0.ruletype}|{0.source}|{0.target}|{0.tclass}|{1}|{2}|{3}".format( - self, filename, cond, cond_block)) + self, None, self._conditional, self._conditional_block)) def __lt__(self, other): return str(self) < str(other) @@ -801,20 +623,8 @@ cdef class ExpandedFileNameTERule(FileNameTERule): public object origin def __hash__(self): - try: - cond = self.conditional - cond_block = self.conditional_block - except RuleNotConditional: - cond = None - cond_block = None - - try: - filename = self.filename - except (TERuleNoFilename, RuleUseError): - filename = None - - return hash("{0.ruletype}|{0.source}|{0.target}|{0.tclass}|{1}|{2}|{3}".format( - self, filename, cond, cond_block)) + return hash("{0.ruletype}|{0.source}|{0.target}|{0.tclass}|{0.filename}|{1}|{2}".format( + self, None, None)) def __lt__(self, other): return str(self) < str(other) @@ -823,6 +633,133 @@ cdef class ExpandedFileNameTERule(FileNameTERule): # # Iterators # +cdef class TERuleIterator(PolicyIterator): + + """Iterator for access vector tables.""" + + cdef: + sepol.avtab_t *table + sepol.avtab_ptr_t node + unsigned int bucket + object conditional + object cond_block + + @staticmethod + cdef factory(SELinuxPolicy policy, sepol.avtab *table): + """Factory function for creating TERule iterators.""" + i = TERuleIterator() + i.policy = policy + i.table = table + i.reset() + return i + + def _next_bucket(self): + """Internal method for advancing to the next bucket.""" + self.bucket += 1 + if self.bucket < self.table.nslot: + self.node = self.table.htable[self.bucket] + else: + self.node = NULL + + def _next_node(self): + """Internal method for advancing to the next node.""" + if self.node != NULL and self.node.next != NULL: + self.node = self.node.next + else: + self._next_bucket() + while self.bucket < self.table.nslot and self.node == NULL: + self._next_bucket() + + def __next__(self): + cdef: + sepol.avtab_key_t *key + sepol.avtab_datum_t *datum + + if self.table == NULL or self.table.nel == 0 or self.bucket >= self.table.nslot: + raise StopIteration + + key = &self.node.key + datum = &self.node.datum + + self._next_node() + + if key.specified & sepol.AVRULE_AV: + return AVRule.factory(self.policy, key, datum, None, None) + elif key.specified & sepol.AVRULE_TYPE: + return TERule.factory(self.policy, key, datum, None, None) + elif key.specified & sepol.AVRULE_XPERMS: + return AVRuleXperm.factory(self.policy, key, datum, None, None) + else: + raise LowLevelPolicyError("Unknown AV rule type 0x{}".format(key.specified, '04x')) + + def __len__(self): + return self.table.nel + + def reset(self): + """Reset the iterator to the start.""" + self.node = self.table.htable[0] + + # advance to first item + if self.node == NULL: + self._next_node() + + +cdef class ConditionalTERuleIterator(PolicyIterator): + + """Conditional TE rule iterator.""" + + cdef: + sepol.cond_av_list_t *head + sepol.cond_av_list_t *curr + object conditional + object conditional_block + + @staticmethod + cdef factory(SELinuxPolicy policy, sepol.cond_av_list_t *head, conditional, cond_block): + """ConditionalTERuleIterator iterator factory.""" + c = ConditionalTERuleIterator() + c.policy = policy + c.head = head + c.conditional = conditional + c.conditional_block = cond_block + c.reset() + return c + + def __next__(self): + if self.curr == NULL: + raise StopIteration + + key = &self.curr.node.key + datum = &self.curr.node.datum + + self.curr = self.curr.next + + if key.specified & sepol.AVRULE_AV: + return AVRule.factory(self.policy, key, datum, self.conditional, self.conditional_block) + elif key.specified & sepol.AVRULE_TYPE: + return TERule.factory(self.policy, key, datum, self.conditional, self.conditional_block) + elif key.specified & sepol.AVRULE_XPERMS: + return AVRuleXperm.factory(self.policy, key, datum, self.conditional, self.conditional_block) + else: + raise LowLevelPolicyError("Unknown AV rule type 0x{}".format(key.specified, '04x')) + + def __len__(self): + cdef: + sepol.cond_av_list_t *curr + size_t count = 0 + + curr = self.head + while curr != NULL: + count += 1 + curr = curr.next + + return count + + def reset(self): + """Reset the iterator back to the start.""" + self.curr = self.head + + cdef class FileNameTERuleIterator(HashtabIterator): """Iterate over FileNameTERules in the policy.""" @@ -839,4 +776,4 @@ cdef class FileNameTERuleIterator(HashtabIterator): def __next__(self): super().__next__() return FileNameTERule.factory(self.policy, self.curr.key, - self.curr.datum) + self.curr.datum) diff --git a/setup.py b/setup.py index f6bbbb9..099be32 100644 --- a/setup.py +++ b/setup.py @@ -66,11 +66,8 @@ else: ext_py_mods = [Extension('setools.policyrep.libpolicyrep', ['setools/policyrep/libpolicyrep.pyx', - 'libqpol/avrule_query.c', - 'libqpol/iterator.c', 'libqpol/policy.c', - 'libqpol/policy_extend.c', - 'libqpol/terule_query.c'], + 'libqpol/policy_extend.c'], include_dirs=include_dirs, libraries=['selinux'], extra_compile_args=['-Werror', '-Wextra',