From 4a33c78ca572598ff76976a41d8b456293dfaebc Mon Sep 17 00:00:00 2001 From: Stephen Smalley Date: Thu, 30 Aug 2012 17:17:37 -0400 Subject: [PATCH] libsepol: fix neverallow checking on attributes Ole Kliemann reported that allow rules written using type attributes were not being detected by neverallow assertions in the policy. I think that this was broken in policy.24 and later due to changes in the type datum. Fix the expand logic to correctly distinguish type attributes from types. Signed-off-by: Stephen Smalley Signed-off-by: Eric Paris --- libsepol/src/expand.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/libsepol/src/expand.c b/libsepol/src/expand.c index bef759c1..0b217491 100644 --- a/libsepol/src/expand.c +++ b/libsepol/src/expand.c @@ -3106,12 +3106,12 @@ static int expand_avtab_node(avtab_key_t * k, avtab_datum_t * d, void *args) newkey.target_class = k->target_class; newkey.specified = k->specified; - if (stype && ttype) { + if (stype->flavor != TYPE_ATTRIB && ttype->flavor != TYPE_ATTRIB) { /* Both are individual types, no expansion required. */ return expand_avtab_insert(expa, k, d); } - if (stype) { + if (stype->flavor != TYPE_ATTRIB) { /* Source is an individual type, target is an attribute. */ newkey.source_type = k->source_type; ebitmap_for_each_bit(tattr, tnode, j) { @@ -3125,7 +3125,7 @@ static int expand_avtab_node(avtab_key_t * k, avtab_datum_t * d, void *args) return 0; } - if (ttype) { + if (ttype->flavor != TYPE_ATTRIB) { /* Target is an individual type, source is an attribute. */ newkey.target_type = k->target_type; ebitmap_for_each_bit(sattr, snode, i) { @@ -3236,12 +3236,12 @@ int expand_cond_av_node(policydb_t * p, newkey.target_class = k->target_class; newkey.specified = k->specified; - if (stype && ttype) { + if (stype->flavor != TYPE_ATTRIB && ttype->flavor != TYPE_ATTRIB) { /* Both are individual types, no expansion required. */ return expand_cond_insert(newl, expa, k, d); } - if (stype) { + if (stype->flavor != TYPE_ATTRIB) { /* Source is an individual type, target is an attribute. */ newkey.source_type = k->source_type; ebitmap_for_each_bit(tattr, tnode, j) { @@ -3255,7 +3255,7 @@ int expand_cond_av_node(policydb_t * p, return 0; } - if (ttype) { + if (ttype->flavor != TYPE_ATTRIB) { /* Target is an individual type, source is an attribute. */ newkey.target_type = k->target_type; ebitmap_for_each_bit(sattr, snode, i) {