RepoMirrors/selinux
1
0
Fork 0
mirror of https://github.com/SELinuxProject/selinux synced 2025-02-22 12:36:51 +00:00
Code Issues Packages Projects Releases Wiki Activity

libsepol: Write "NO_IDENTIFIER" for empty CIL constraint expression

Browse Source 
If a role or user attribute with nothing associated with it is used
in a constraint expression, then the bitmap will be empty. This is
not a problem for the kernel, but does cause problems when converting
a kernel policy or module to CIL.

When creating a CIL policy from a kernel policy or module, if an
empty bitmap is encountered, use the string "NO_IDENTIFIER". An
error will occur if an attempt is made to compile the resulting
policy, but a valid policy was not being produced before anyway.
Treat types the same way even though empty bitmaps are not expected.

Signed-off-by: James Carter <jwcart2@gmail.com>
This commit is contained in:
James Carter 2021-03-16 15:31:06 -04:00
parent 6758addf85
commit b839e9a1cb
2 changed files with 8 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
libsepol/src/kernel_to_cil.c
View File

@ -189,7 +189,7 @@ static char *constraint_expr_to_str(struct policydb *pdb, struct constraint_expr
names = ebitmap_to_str(&curr->names, pdb->p_role_val_to_name, 1);
}
if (!names) {
goto exit;
names = strdup("NO_IDENTIFIER");
}
if (strchr(names, ' ')) {
new_val = create_str("(%s %s (%s))", 3, op, attr1, names);

10
libsepol/src/module_to_cil.c
View File

@ -1793,9 +1793,13 @@ static int constraint_expr_to_string(struct policydb *pdb, struct constraint_exp
goto exit;
}
}
rc = name_list_to_string(name_list, num_names, &names);
if (rc != 0) {
goto exit;
if (num_names == 0) {
names = strdup("NO_IDENTIFIER");
} else {
rc = name_list_to_string(name_list, num_names, &names);
if (rc != 0) {
goto exit;
}
}
// length of values/oper + 2 spaces + 2 parens + null terminator