From d03e9373e82d143c396401adf4912ed0ea490ecf Mon Sep 17 00:00:00 2001 From: Richard Haines Date: Mon, 23 Mar 2015 15:58:32 +0000 Subject: [PATCH] libsepol: Fix building Xen policy with devicetreecon Problems fixed: 1) Fix core dump when building CIL policy (corrupted double-linked list) by Steve Lawrence 2) Binary policy failed to read with devicetreecon statement. 3) Free path name - With a Xen policy running secilc/valgrind there are no memory errors. Also added devicetreecon statement to CIL policy.cil and updated the CIL Reference Guide. Signed-off-by: Richard Haines --- libsepol/cil/docs/cil_xen_statements.xml | 44 ++++++++++++++++++++++++ libsepol/cil/src/cil_build_ast.c | 2 -- libsepol/cil/test/policy.cil | 1 + libsepol/src/policydb.c | 6 ++-- 4 files changed, 49 insertions(+), 4 deletions(-) diff --git a/libsepol/cil/docs/cil_xen_statements.xml b/libsepol/cil/docs/cil_xen_statements.xml index 1035b685..c72ef6cd 100644 --- a/libsepol/cil/docs/cil_xen_statements.xml +++ b/libsepol/cil/docs/cil_xen_statements.xml @@ -3,6 +3,7 @@ Xen Statements + Policy version 30 introduced the devicetreecon statement and also expanded the existing I/O memory range to 64 bits in order to support hardware with more than 44 bits of physical address space (32-bit count of 4K pages). See the "XSM/FLASK Configuration" document for further information () iomemcon @@ -180,4 +181,47 @@ + + devicetreecon + Label device tree nodes. + Statement definition: + + Where: + + + + + + + + devicetreecon + + + The devicetreecon keyword. + + + + + path + + + The device tree path. If this contains spaces enclose within "". + + + + + context_id + + + A previously declared context identifier or an anonymous security context (user role type levelrange), the range MUST be defined whether the policy is MLS/MCS enabled or not. + + + + + + Example: + An anonymous context for the specified path: + + + diff --git a/libsepol/cil/src/cil_build_ast.c b/libsepol/cil/src/cil_build_ast.c index 973b2d79..92c3e092 100644 --- a/libsepol/cil/src/cil_build_ast.c +++ b/libsepol/cil/src/cil_build_ast.c @@ -4583,8 +4583,6 @@ void cil_destroy_devicetreecon(struct cil_devicetreecon *devicetreecon) return; } - free(devicetreecon->path); - if (devicetreecon->context_str == NULL && devicetreecon->context != NULL) { cil_destroy_context(devicetreecon->context); } diff --git a/libsepol/cil/test/policy.cil b/libsepol/cil/test/policy.cil index 9c76cad2..25c85458 100644 --- a/libsepol/cil/test/policy.cil +++ b/libsepol/cil/test/policy.cil @@ -250,6 +250,7 @@ (iomemcon (0 255) system_u_bin_t_l2h) (ioportcon (22 22) system_u_bin_t_l2h) (pcidevicecon 345 system_u_bin_t_l2h) + (devicetreecon "/this is/a/path" system_u_bin_t_l2h) (constrain (files (read)) (not (or (and (eq t1 exec_t) (eq t2 bin_t)) (eq r1 r2)))) (constrain char_w (not (or (and (eq t1 exec_t) (eq t2 bin_t)) (eq r1 r2)))) diff --git a/libsepol/src/policydb.c b/libsepol/src/policydb.c index b45b6628..d1c00187 100644 --- a/libsepol/src/policydb.c +++ b/libsepol/src/policydb.c @@ -1274,7 +1274,7 @@ void ocontext_xen_free(ocontext_t **ocontexts) c = c->next; context_destroy(&ctmp->context[0]); context_destroy(&ctmp->context[1]); - if (i == OCON_ISID) + if (i == OCON_ISID || i == OCON_XEN_DEVICETREE) free(ctmp->u.name); free(ctmp); } @@ -2559,11 +2559,13 @@ static int ocontext_read_xen(struct policydb_compat_info *info, rc = next_entry(buf, fp, sizeof(uint32_t)); if (rc < 0) return -1; - len = le32_to_cpu(buf[1]); + len = le32_to_cpu(buf[0]); c->u.name = malloc(len + 1); if (!c->u.name) return -1; rc = next_entry(c->u.name, fp, len); + if (rc < 0) + return -1; c->u.name[len] = 0; if (context_read_and_validate (&c->context[0], p, fp))