RepoMirrors/selinux
1
0
Fork 0
mirror of https://github.com/SELinuxProject/selinux synced 2025-02-26 22:40:28 +00:00
Code Issues Packages Projects Releases Wiki Activity

checkpolicy: add option to skip checking neverallow rules

Browse Source 
Add the command line argument `-N/--disable-neverallow`, similar to
secilc(8), to checkpolicy(8) and checkmodule(8) to skip the check of
neverallow rule violations.

This is mainly useful in development, e.g. to quickly add rules to a
policy without fulfilling all neverallow rules or build policies with
known violations.

Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
Acked-by: James Carter <jwcart2@gmail.com>
This commit is contained in:
Christian Göttsche 2023-05-12 11:57:49 +02:00 committed by Petr Lautrbach
parent 02e471f17e
commit b87724cbdd
4 changed files with 25 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
checkpolicy/checkmodule.8
View File

@ -3,7 +3,7 @@
checkmodule \- SELinux policy module compiler
.SH SYNOPSIS
.B checkmodule
.I "[\-h] [\-b] [\-c policy_version] [\-C] [\-E] [\-m] [\-M] [\-U handle_unknown] [\-V] [\-o output_file] [input_file]"
.I "[\-h] [\-b] [\-c policy_version] [\-C] [\-E] [\-m] [\-M] [\-N] [\-U handle_unknown] [\-V] [\-o output_file] [input_file]"
.SH "DESCRIPTION"
This manual page describes the
.BR checkmodule
@ -43,6 +43,9 @@ Generate a non-base policy module.
.B \-M,\-\-mls
Enable the MLS/MCS support when checking and compiling the policy module.
.TP
.B \-N,\-\-disable-neverallow
Do not check neverallow rules.
.TP
.B \-V,\-\-version
Show policy versions created by this program.
.TP

13
checkpolicy/checkmodule.c
View File

@ -123,7 +123,7 @@ static int write_binary_policy(policydb_t * p, FILE *outfp)
static __attribute__((__noreturn__)) void usage(const char *progname)
{
printf("usage: %s [-h] [-V] [-b] [-C] [-E] [-U handle_unknown] [-m] [-M] [-o FILE] [-c VERSION] [INPUT]\n", progname);
printf("usage: %s [-h] [-V] [-b] [-C] [-E] [-U handle_unknown] [-m] [-M] [-N] [-o FILE] [-c VERSION] [INPUT]\n", progname);
printf("Build base and policy modules.\n");
printf("Options:\n");
printf(" INPUT build module from INPUT (else read from \"%s\")\n",
@ -139,6 +139,7 @@ static __attribute__((__noreturn__)) void usage(const char *progname)
printf(" allow: Allow unknown kernel checks\n");
printf(" -m build a policy module instead of a base module\n");
printf(" -M enable MLS policy\n");
printf(" -N do not check neverallow rules\n");
printf(" -o FILE write module to FILE (else just check syntax)\n");
printf(" -c VERSION build a policy module targeting a modular policy version (%d-%d)\n",
MOD_POLICYDB_VERSION_MIN, MOD_POLICYDB_VERSION_MAX);
@ -148,7 +149,7 @@ static __attribute__((__noreturn__)) void usage(const char *progname)
int main(int argc, char **argv)
{
const char *file = txtfile, *outfile = NULL;
unsigned int binary = 0, cil = 0;
unsigned int binary = 0, cil = 0, disable_neverallow = 0;
int ch;
int show_version = 0;
policydb_t modpolicydb;
@ -159,12 +160,13 @@ int main(int argc, char **argv)
{"version", no_argument, NULL, 'V'},
{"handle-unknown", required_argument, NULL, 'U'},
{"mls", no_argument, NULL, 'M'},
{"disable-neverallow", no_argument, NULL, 'N'},
{"cil", no_argument, NULL, 'C'},
{"werror", no_argument, NULL, 'E'},
{NULL, 0, NULL, 0}
};
while ((ch = getopt_long(argc, argv, "ho:bVEU:mMCc:", long_options, NULL)) != -1) {
while ((ch = getopt_long(argc, argv, "ho:bVEU:mMNCc:", long_options, NULL)) != -1) {
switch (ch) {
case 'h':
usage(argv[0]);
@ -202,6 +204,9 @@ int main(int argc, char **argv)
case 'M':
mlspol = 1;
break;
case 'N':
disable_neverallow = 1;
break;
case 'C':
cil = 1;
break;
@ -317,7 +322,7 @@ int main(int argc, char **argv)
fprintf(stderr, "%s: link modules failed\n", argv[0]);
exit(1);
}
if (expand_module(NULL, &modpolicydb, &kernpolicydb, 0, 1)) {
if (expand_module(NULL, &modpolicydb, &kernpolicydb, /*verbose=*/0, !disable_neverallow)) {
fprintf(stderr, "%s: expand module failed\n", argv[0]);
exit(1);
}

5
checkpolicy/checkpolicy.8
View File

@ -3,7 +3,7 @@
checkpolicy \- SELinux policy compiler
.SH SYNOPSIS
.B checkpolicy
.I "[\-b[F]] [\-C] [\-d] [\-U handle_unknown (allow,deny,reject)] [\-M] [\-c policyvers] [\-o output_file|\-] [\-S] [\-t target_platform (selinux,xen)] [\-O] [\-E] [\-V] [input_file]"
.I "[\-b[F]] [\-C] [\-d] [\-U handle_unknown (allow,deny,reject)] [\-M] [\-N] [\-c policyvers] [\-o output_file|\-] [\-S] [\-t target_platform (selinux,xen)] [\-O] [\-E] [\-V] [input_file]"
.br
.SH "DESCRIPTION"
This manual page describes the
@ -38,6 +38,9 @@ Specify how the kernel should handle unknown classes or permissions (deny, allow
.B \-M,\-\-mls
Enable the MLS policy when checking and compiling the policy.
.TP
.B \-N,\-\-disable-neverallow
Do not check neverallow rules.
.TP
.B \-c policyvers
Specify the policy version, defaults to the latest.
.TP

12
checkpolicy/checkpolicy.c
View File

@ -109,7 +109,7 @@ static __attribute__((__noreturn__)) void usage(const char *progname)
{
printf
("usage: %s [-b[F]] [-C] [-d] [-U handle_unknown (allow,deny,reject)] [-M] "
"[-c policyvers (%d-%d)] [-o output_file|-] [-S] [-O] "
"[-N] [-c policyvers (%d-%d)] [-o output_file|-] [-S] [-O] "
"[-t target_platform (selinux,xen)] [-E] [-V] [input_file]\n",
progname, POLICYDB_VERSION_MIN, POLICYDB_VERSION_MAX);
exit(1);
@ -393,7 +393,7 @@ int main(int argc, char **argv)
size_t scontext_len, pathlen;
unsigned int i;
unsigned int protocol, port;
unsigned int binary = 0, debug = 0, sort = 0, cil = 0, conf = 0, optimize = 0;
unsigned int binary = 0, debug = 0, sort = 0, cil = 0, conf = 0, optimize = 0, disable_neverallow = 0;
struct val_to_name v;
int ret, ch, fd, target = SEPOL_TARGET_SELINUX;
unsigned int nel, uret;
@ -415,6 +415,7 @@ int main(int argc, char **argv)
{"version", no_argument, NULL, 'V'},
{"handle-unknown", required_argument, NULL, 'U'},
{"mls", no_argument, NULL, 'M'},
{"disable-neverallow", no_argument, NULL, 'N'},
{"cil", no_argument, NULL, 'C'},
{"conf",no_argument, NULL, 'F'},
{"sort", no_argument, NULL, 'S'},
@ -424,7 +425,7 @@ int main(int argc, char **argv)
{NULL, 0, NULL, 0}
};
while ((ch = getopt_long(argc, argv, "o:t:dbU:MCFSVc:OEh", long_options, NULL)) != -1) {
while ((ch = getopt_long(argc, argv, "o:t:dbU:MNCFSVc:OEh", long_options, NULL)) != -1) {
switch (ch) {
case 'o':
outfile = optarg;
@ -473,6 +474,9 @@ int main(int argc, char **argv)
case 'M':
mlspol = 1;
break;
case 'N':
disable_neverallow = 1;
break;
case 'C':
cil = 1;
break;
@ -630,7 +634,7 @@ int main(int argc, char **argv)
fprintf(stderr, "%s: policydb_init failed\n", argv[0]);
exit(1);
}
if (expand_module(NULL, policydbp, &policydb, 0, 1)) {
if (expand_module(NULL, policydbp, &policydb, /*verbose=*/0, !disable_neverallow)) {
fprintf(stderr, "Error while expanding policy\n");
exit(1);
}