RepoMirrors/selinux
1
0
Fork 0
mirror of https://github.com/SELinuxProject/selinux synced 2024-12-14 01:54:42 +00:00
Code Issues Packages Projects Releases Wiki Activity

libsepol/cil: Check syntax of src_info statement

Browse Source 
Every rule other than src_info has their syntax checked when
building the AST. It wasn't considered necessary for src_info rules
because they were expected to always be generated by the parser and
aren't part of the CIL language. But there is no check preventing
them from occurring in a policy and the secilc fuzzer found some bugs
by using src_info rules in a policy. This caused some syntax checking
to be added. Since the parse AST from secil2tree will contain src_info
rules and since the goal is to be able to compile the output of
secil2tree, it makes sense to check the syntax of src_info rules
in the same way that all of the other rules are checked.

Check the syntax of src_info statements in the same way every other
rule is checked.

Signed-off-by: James Carter <jwcart2@gmail.com>
This commit is contained in:
James Carter 2021-08-16 13:43:52 -04:00
parent 33621cb7c8
commit 8823bea1b0
1 changed files with 20 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

24
libsepol/cil/src/cil_build_ast.c
View File

@ -6075,12 +6075,24 @@ void cil_destroy_mls(struct cil_mls *mls)
int cil_gen_src_info(struct cil_tree_node *parse_current, struct cil_tree_node *ast_node)
{
/* No need to check syntax, because this is auto generated */
int rc = SEPOL_ERR;
enum cil_syntax syntax[] = {
CIL_SYN_STRING,
CIL_SYN_STRING,
CIL_SYN_STRING,
CIL_SYN_N_LISTS | CIL_SYN_END,
CIL_SYN_END
};
int syntax_len = sizeof(syntax)/sizeof(*syntax);
struct cil_src_info *info = NULL;
if (parse_current->next == NULL || parse_current->next->next == NULL) {
cil_tree_log(parse_current, CIL_ERR, "Bad <src_info>");
return SEPOL_ERR;
if (parse_current == NULL || ast_node == NULL) {
goto exit;
}
rc = __cil_verify_syntax(parse_current, syntax, syntax_len);
if (rc != SEPOL_OK) {
goto exit;
}
cil_src_info_init(&info);
@ -6092,6 +6104,10 @@ int cil_gen_src_info(struct cil_tree_node *parse_current, struct cil_tree_node *
ast_node->flavor = CIL_SRC_INFO;
return SEPOL_OK;
exit:
cil_tree_log(parse_current, CIL_ERR, "Bad src info");
return rc;
}
void cil_destroy_src_info(struct cil_src_info *info)