RepoMirrors/selinux
1
0
Fork 0
mirror of https://github.com/SELinuxProject/selinux synced 2024-12-27 00:12:05 +00:00
Code Issues Packages Projects Releases Wiki Activity

libsepol: Skip writing role attributes for policy.X and downgraded pp.

Browse Source 
Role attributes are redundant for policy.X, their destiny has been
fulfilled in the expand phase when their types.types ebitmap have
been populated to that of their sub regular roles.

When pp is downgraded, role_datum_t's the flavor flag and roles
ebitmap would be discarded, resulting in role attributes useless
at all. So for such case they should also be skipped.

Deduct the number of role attributes from p_roles.table->nel when
they are skipped.

Last, uncount attributes number before converting endianness.

Signed-off-by: Harry Ciao <qingtao.cao@windriver.com>
Signed-off-by: Eric Paris <eparis@redhat.com>
Acked-by: Dan Walsh <dwalsh@redhat.com>
This commit is contained in:
Harry Ciao 2011-08-16 16:08:52 +08:00 committed by Eric Paris
parent 60c780ffb6
commit 0299119625
1 changed files with 41 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

42
libsepol/src/write.c
View File

@ -972,6 +972,19 @@ static int role_write(hashtab_key_t key, hashtab_datum_t datum, void *ptr)
role = (role_datum_t *) datum;
/*
* Role attributes are redundant for policy.X, skip them
* when writing the roles symbol table. They are also skipped
* when pp is downgraded.
*
* Their numbers would be deducted in policydb_write().
*/
if ((role->flavor == ROLE_ATTRIB) &&
((p->policy_type == POLICY_KERN) ||
(p->policy_type != POLICY_KERN &&
p->policyvers < MOD_POLICYDB_VERSION_ROLEATTRIB)))
return POLICYDB_SUCCESS;
len = strlen(key);
items = 0;
buf[items++] = cpu_to_le32(len);
@ -1795,6 +1808,19 @@ static int type_attr_uncount(hashtab_key_t key __attribute__ ((unused)),
return 0;
}
static int role_attr_uncount(hashtab_key_t key __attribute__ ((unused)),
hashtab_datum_t datum, void *args)
{
role_datum_t *role = datum;
uint32_t *p_nel = args;
if (role->flavor == ROLE_ATTRIB) {
/* uncount attribute from total number of roles */
(*p_nel)--;
}
return 0;
}
/*
* Write the configuration data in a policy database
* structure to a policy database binary representation
@ -1926,7 +1952,7 @@ int policydb_write(policydb_t * p, struct policy_file *fp)
num_syms = info->sym_num;
for (i = 0; i < num_syms; i++) {
buf[0] = cpu_to_le32(p->symtab[i].nprim);
buf[1] = cpu_to_le32(p->symtab[i].table->nel);
buf[1] = p->symtab[i].table->nel;
/*
* A special case when writing type/attribute symbol table.
@ -1939,6 +1965,20 @@ int policydb_write(policydb_t * p, struct policy_file *fp)
p->policy_type == POLICY_KERN) {
hashtab_map(p->symtab[i].table, type_attr_uncount, &buf[1]);
}
/*
* Another special case when writing role/attribute symbol
* table, role attributes are redundant for policy.X, or
* when the pp's version is not big enough. So deduct
* their numbers from p_roles.table->nel.
*/
if ((i == SYM_ROLES) &&
((p->policy_type == POLICY_KERN) ||
(p->policy_type != POLICY_KERN &&
p->policyvers < MOD_POLICYDB_VERSION_ROLEATTRIB)))
hashtab_map(p->symtab[i].table, role_attr_uncount, &buf[1]);
buf[1] = cpu_to_le32(buf[1]);
items = put_entry(buf, sizeof(uint32_t), 2, fp);
if (items != 2)
return POLICYDB_ERROR;