RepoMirrors/selinux
1
0
Fork 0
mirror of https://github.com/SELinuxProject/selinux synced 2024-12-25 07:22:07 +00:00
Code Issues Packages Projects Releases Wiki Activity

libsepol/cil: Account for anonymous category sets in an expression

Browse Source 
It is possible for anonymous category sets to be in a category
expression if the expression has a macro parameter in it.
Unfortunately, anonymous category sets are not looked for when
resolving category expressions and a segfault will occur during
later processing if there was one.

As an example, consider the following portion of a policy.
  (macro m1 ((categoryset cs))
    (userlevel USER (s0 (cs)))
  )
  (call m1 ((c0 c1)))
This policy will cause a segault, because the categoryset datum
for the parameter cs is not seen as a categoryset and is treated
as a plain category.

When resolving an expression, check whether or not the datum that
is found is actually an anonymous category set associated with a
macro parameter. If it is, then resolve the category set if it
has not already been resolved and treat its categories as a sub
expression.

Signed-off-by: James Carter <jwcart2@gmail.com>
Acked-by: Nicolas Iooss <nicolas.iooss@m4x.org>
This commit is contained in:
James Carter 2021-06-15 10:40:20 -04:00
parent 9ac9d2dab4
commit 982ec302b6
1 changed files with 17 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

24
libsepol/cil/src/cil_resolve_ast.c
View File

@ -3346,6 +3346,7 @@ int cil_resolve_expr(enum cil_flavor expr_type, struct cil_list *str_expr, struc
struct cil_list_item *curr; struct cil_list_item *curr;
struct cil_symtab_datum *res_datum = NULL; struct cil_symtab_datum *res_datum = NULL;
enum cil_sym_index sym_index = CIL_SYM_UNKNOWN; enum cil_sym_index sym_index = CIL_SYM_UNKNOWN;
struct cil_list *datum_sub_expr;
switch (str_expr->flavor) { switch (str_expr->flavor) {
case CIL_BOOL: case CIL_BOOL:
@ -3379,18 +3380,26 @@ int cil_resolve_expr(enum cil_flavor expr_type, struct cil_list *str_expr, struc
if (rc != SEPOL_OK) { if (rc != SEPOL_OK) {
goto exit; goto exit;
} }
if (sym_index == CIL_SYM_CATS && NODE(res_datum)->flavor == CIL_CATSET) {
if (sym_index == CIL_SYM_TYPES && (expr_type == CIL_CONSTRAIN || expr_type == CIL_VALIDATETRANS)) { struct cil_catset *catset = (struct cil_catset *)res_datum;
cil_type_used(res_datum, CIL_ATTR_CONSTRAINT); if (!catset->cats->datum_expr) {
rc = cil_resolve_expr(expr_type, catset->cats->str_expr, &catset->cats->datum_expr, parent, extra_args);
if (rc != SEPOL_OK) {
goto exit;
}
}
cil_copy_list(catset->cats->datum_expr, &datum_sub_expr);
cil_list_append(*datum_expr, CIL_LIST, datum_sub_expr);
} else {
if (sym_index == CIL_SYM_TYPES && (expr_type == CIL_CONSTRAIN || expr_type == CIL_VALIDATETRANS)) {
cil_type_used(res_datum, CIL_ATTR_CONSTRAINT);
}
cil_list_append(*datum_expr, CIL_DATUM, res_datum);
} }
cil_list_append(*datum_expr, CIL_DATUM, res_datum);
break; break;
case CIL_LIST: { case CIL_LIST: {
struct cil_list *datum_sub_expr;
rc = cil_resolve_expr(expr_type, curr->data, &datum_sub_expr, parent, extra_args); rc = cil_resolve_expr(expr_type, curr->data, &datum_sub_expr, parent, extra_args);
if (rc != SEPOL_OK) { if (rc != SEPOL_OK) {
cil_list_destroy(&datum_sub_expr, CIL_TRUE);
goto exit; goto exit;
} }
cil_list_append(*datum_expr, CIL_LIST, datum_sub_expr); cil_list_append(*datum_expr, CIL_LIST, datum_sub_expr);
@ -3404,6 +3413,7 @@ int cil_resolve_expr(enum cil_flavor expr_type, struct cil_list *str_expr, struc
return SEPOL_OK; return SEPOL_OK;
exit: exit:
cil_list_destroy(datum_expr, CIL_FALSE);
return rc; return rc;
} }