Commit Graph

100 Commits

Author SHA1 Message Date
Petr Lautrbach 38cb18e931 Update VERSIONs and Python bindings version to 3.3-rc1 for release
Signed-off-by: Petr Lautrbach <plautrba@redhat.com>
2021-09-08 09:49:46 +02:00
James Carter 4878981229 libsepol/secilc/docs: Update the CIL documentation
Update the CIL documentation for the in-statement processing and
duplicate macro and block declarations with block inheritance.

Duplicate macro and block declarations are allowed if they occur as
the result of block inheritance. Document the fact that inherited
macros are overridden by any macros already declared in a
namespace and that declaring a block in a namespace that will
inherit a block with the same name can be used to allow in-statements
to be used on the block.

The new in-statement syntax still supports the old syntax but adds
the ability to specify whether the in-statement should be resolved
before or after block inheritance is resolved.

Signed-off-by: James Carter <jwcart2@gmail.com>
2021-09-07 10:28:46 -04:00
Christian Göttsche 6d93701f39 secilc: fix memory leaks in secilc2conf
When specifying -o more than once, the previous allocation leaks.

Found by scan-build.

Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
2021-07-19 10:42:45 -04:00
Christian Göttsche edb948fb0b secilc: fix memory leaks in secilc
When specifying -o or -f more than once, the previous allocations leak.

Found by scan-build.

Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
2021-07-19 10:42:45 -04:00
James Carter 532a4cc336
libsepol/cil: Add support for using qualified names to secil2conf
Provide the option "-Q" or "--qualified-names" to indicate that the
policy is using qualified names.

Using qualified names means that declaration names can have "dots"
in them, but blocks, blockinherits, blockabstracts, and in-statements
are not allowed in the policy.

The libsepol function cil_set_qualified_names() is called with the
desired value for the CIL db's "qualified_names" field.

Signed-off-by: James Carter <jwcart2@gmail.com>
2021-07-03 16:00:30 +02:00
James Carter 74c06d763f
libsepol/cil: Add support for using qualified names to secil2tree
Provide the option "-Q" or "--qualified-names" to indicate that the
policy is using qualified names.

Using qualified names means that declaration names can have "dots"
in them, but blocks, blockinherits, blockabstracts, and in-statements
are not allowed in the policy.

The libsepol function cil_set_qualified_names() is called with the
desired value for the CIL db's "qualified_names" field.

Signed-off-by: James Carter <jwcart2@gmail.com>
2021-07-03 16:00:30 +02:00
James Carter f7b8b5055f
secilc: Add support for using qualified names to secilc
Provide the option "-Q" or "--qualified-names" to indicate that the
policy is using qualified names.

Using qualified names means that declaration names can have "dots"
in them, but blocks, blockinherits, blockabstracts, and in-statements
are not allowed in the policy.

The libsepol function cil_set_qualified_names() is called with the
desired value for the CIL db's "qualified_names" field.

Signed-off-by: James Carter <jwcart2@gmail.com>
2021-07-03 16:00:30 +02:00
James Carter 4a60fd78d2 secilc/test: Add test for anonymous args
CIL has rules that allow names to be assigned to certain objects
like MLS category sets, MLS levels, MLS ranges, IP addresses, and
class permission sets. These objects can also be named as parameters
for a macro. A call may pass in a name for one of these objects, but
it also may pass in one of the actual objects. These objects are
referred as anonymous arguments.

Add CIL policy that can be used to test whether or not anonymous
arguments are being handled properly in macros. Also test the
equivalent named arguments to help determine if the problem is with
that argument type or just with an anonymous argument of that type.

The anonymouse arguments that are tested are categoryset, level,
levelrange, ipaddr, and classpermission.

Signed-off-by: James Carter <jwcart2@gmail.com>
Acked-by: Nicolas Iooss <nicolas.iooss@m4x.org>
2021-06-22 09:33:28 -04:00
James Carter fe9f10e0ee secilc/docs: Relocate and reword macro call name resolution order
The listing of the order was in the macro section, but it belongs
in the call section.

Move the listing of the order to the call section and provide a
better explanation.

Signed-off-by: James Carter <jwcart2@gmail.com>
2021-06-04 10:23:23 -04:00
James Carter 7fec5e93d9 secilc/docs: Document the order that inherited rules are resolved in
In the blockinherit section of the CIL documentation clearly state
the order in which inherited rules are resolved.

That order is:

1) The parent namespaces (if any) where the blockinherit rule is
   located with the exception of the global namespace.

2) The parent namespaces of the block being inherited (but not that
   block's namespace) with the exception of the global namespace.

3) The global namespace.

Signed-off-by: James Carter <jwcart2@gmail.com>
2021-05-31 12:38:23 +02:00
James Carter d0a07a7f13
secilc: Create the new program called secil2tree to write out CIL AST
secil2tree is the SELinux CIL AST writer. It calls the cil functions
cil_write_parse_ast(), cil_write_build_ast(), or cil_write_resolve_ast()
to write out the parse tree, the CIL AST after the build phase, or the
CIL AST after the resolve phase.

Signed-off-by: James Carter <jwcart2@gmail.com>
2021-04-21 21:45:31 +02:00
James Carter bad0a746e9 secilc/docs: Update the CIL documentation for various blocks
Update the documentation for macros, booleans, booleanifs, tunables,
tunableifs, blocks, blockabstracts, blockinherits, and optionals to
tell where these statements can be used and, for those that have
blocks, what statements are not allowed in them.

Signed-off-by: James Carter <jwcart2@gmail.com>
2021-04-19 14:05:23 -04:00
Yi-Yo Chiang d1a34d3f1d secilc.c: Don't fail if input file is empty
fread(3) returns zero if |size| is zero. This confuses secilc, and
causes it to fail with a "Failure reading file" error, even though there
is no error.

Add a shortcut that closes and skips an input file if file size is zero.

Signed-off-by: Yi-Yo Chiang <yochiang@google.com>
2021-04-14 15:14:59 -04:00
Dominick Grift 1e4e7f6a12 cil_conditional_statements.md: fix expr definition
expr "(expr (tunable_id tunable_id))" does not work but "(expr
tunable_id tunable_id)" does work

for example, this works

(tunable test1)
(tunable test2)
(tunableif (or test1 test2)
	   (true
	    (allow a b (c (d)))))

but this does not work:

(tunable test1)
(tunable test2)
(tunableif (or (test1 test2))
	   (true
	    (allow a b (c (d)))))

Signed-off-by: Dominick Grift <dominick.grift@defensec.nl>
2021-03-29 11:06:11 -04:00
James Carter 45d7a0a563 secilc/docs: Lists are now allowed in constraint expressions
Update the CIL documentation to show that lists are allowed in
constraint expressions.

Signed-off-by: James Carter <jwcart2@gmail.com>
2021-03-18 10:09:08 -04:00
Petr Lautrbach cf853c1a0c
Update VERSIONs to 3.2 for release.
Signed-off-by: Petr Lautrbach <plautrba@redhat.com>
2021-03-04 16:42:59 +01:00
Petr Lautrbach d4d1f4ba7e
Update VERSIONs to 3.2-rc3 for release.
Signed-off-by: Petr Lautrbach <plautrba@redhat.com>
2021-02-24 15:49:59 +01:00
Dominick Grift 49ff851c98 secilc: fixes cil_role_statements.md example
Signed-off-by: Dominick Grift <dominick.grift@defensec.nl>
Acked-by: James Carter <jwcart2@gmail.com>
2021-02-19 15:19:50 +01:00
bauen1 038817036f secilc/docs: add custom color theme
Since the default pandoc themes either don't highlight everything or
don't fit the black/white color style of the html / pdf I've created my
own.

Signed-off-by: Jonathan Hettwer <j2468h@gmail.com>
2021-02-16 09:32:36 -05:00
bauen1 4c8d609498 secilc/docs: add syntax highlighting for secil
This is done by creating a somewhat rudimentary KDE syntax xml for
pandoc.

The default styles provided by pandoc don't look very good and don't
highlight e.g. the strings marked as builtin.

Signed-off-by: Jonathan Hettwer <j2468h@gmail.com>
2021-02-16 09:32:32 -05:00
bauen1 057d72af2d secilc/docs: use fenced code blocks for cil examples
Also fixes the occasional missing brackets as higlighted by my editor,
however the individual examples where not reviewed much closer.

secilc was chosen as language name because the compiler is named secilc
and outside of SELinux the name cil is less searchable and could lead to
confusion.

Signed-off-by: Jonathan Hettwer <j2468h@gmail.com>
2021-02-16 09:32:29 -05:00
Petr Lautrbach 2c7c4a84c3
Update VERSIONs to 3.2-rc2 for release.
Signed-off-by: Petr Lautrbach <plautrba@redhat.com>
2021-02-03 11:26:28 +01:00
Petr Lautrbach c534d4e2ce
Update VERSIONs and Python bindings version to 3.2-rc1 for release
Signed-off-by: Petr Lautrbach <plautrba@redhat.com>
2021-01-20 12:40:14 +01:00
Dominick Grift e8bcdb84dc
cil_network_labeling_statements: fixes nodecon examples
The order of the subnet and netmask is wrong and also the value of netmask is wrong for single address subnet
Use an ipaddr reserved for documentation: https://tools.ietf.org/html/rfc5737
Add ipv6 example: https://tools.ietf.org/html/rfc3849

Signed-off-by: Dominick Grift <dominick.grift@defensec.nl>
2020-09-27 12:01:31 +02:00
Dominick Grift eefa5511dd
cil_access_vector_rules: allowx, auditallowx and dontauditx fixes
allowx requires a equivalent "allow ioctl" rule to be present
auditallowx requires a equivalent "auditallow" ioctl rule to be present
dontauditx requires atleast one equivalent "allowx" rule to be present (can be a random irrelevant ioctlcmd)

Signed-off-by: Dominick Grift <dominick.grift@defensec.nl>
2020-09-26 20:26:07 +02:00
Dominick Grift 9e9b810340 secilc/docs: document expandtypeattribute
This was added for Androids Treble in 2017.

Signed-off-by: Dominick Grift <dominick.grift@defensec.nl>
Acked-by: James Carter <jwcart2@gmail.com>
2020-08-17 11:53:47 -04:00
bauen1 fbe1e526dc Update the cil docs to match the current behaviour.
Some features where dropped or change since the docs were last updated.

Signed-off-by: Jonathan Hettwer <j2468h@gmail.com>
Acked-by: James Carter <jwcart2@gmail.com>
2020-07-14 16:28:34 +02:00
Petr Lautrbach 7df27b78e9 Update VERSIONs and Python bindings version to 3.1 for release
Signed-off-by: Petr Lautrbach <plautrba@redhat.com>
2020-07-10 17:17:15 +02:00
Petr Lautrbach b3d8b99f0c Update VERSIONs to 3.1-rc2 for release.
Signed-off-by: Petr Lautrbach <plautrba@redhat.com>
2020-06-19 13:02:31 +02:00
Topi Miettinen 4ad0abd983 secilc/docs: fix use of TMPDIR
Environment variable TMPDIR may be already set for the user building
and this could be equal to $XDG_RUNTIME_DIR or /tmp which are existing
directories. Then when running 'make clean', there are unintended side
effects:

rm -rf /run/user/1000
rm: cannot remove '/run/user/1000/dconf/user': Permission denied
rm: cannot remove '/run/user/1000/systemd': Permission denied
rm: cannot remove '/run/user/1000/gnupg': Permission denied
rm: cannot remove '/run/user/1000/dbus-1': Is a directory
rm: cannot remove '/run/user/1000/inaccessible': Permission denied
make[1]: *** [Makefile:68: clean] Error 1

Fix by always setting the variable.

Signed-off-by: Topi Miettinen <toiwoton@gmail.com>
Suggested-by: Petr Lautrbach <plautrba@redhat.com>
Acked-by: Petr Lautrbach <plautrba@redhat.com>
2020-06-01 10:40:10 +02:00
Petr Lautrbach c554c3d88a Update VERSIONs to 3.1-rc1 for release.
Signed-off-by: Petr Lautrbach <plautrba@redhat.com>
2020-05-15 15:54:08 +02:00
Petr Lautrbach 415989003e secilc: Fix policy optimization test
Commit 692716fc5f ("libsepol/cil: raise default attrs_expand_size to 2") was
reverted and attributes with one type are not expanded anymore.

Fixes:
    ./secilc test/policy.cil
    ./secilc -c 32 -O -M 1 -f /dev/null -o opt-actual.bin test/opt-input.cil
    checkpolicy -b -C -M -o opt-actual.cil opt-actual.bin >/dev/null
    diff test/opt-expected.cil opt-actual.cil
    11a12
    > (typeattribute at01)
    21a23
    > (typeattributeset at01 (tp01))
    25c27,28
    < (allow tp01 self (cl01 (p01a p01b p11a p11b)))
    ---
    > (allow tp01 at01 (cl01 (p11b)))
    > (allow tp01 self (cl01 (p01a p01b p11a)))

Signed-off-by: Petr Lautrbach <plautrba@redhat.com>
Acked-by: James Carter <jwcart2@gmail.com>
2020-05-15 12:40:13 +02:00
Ondrej Mosnacek 87be2fbbd2 secilc: add basic test for policy optimization
Add a simple test for secilc -O to make sure that it produces the
expected output. This might produce some false positives when the output
of secilc/checkpolicy changes slightly, in which case the expected CIL
will need to be updated along with the change.

The test should normally work even with a checkpolicy built from an
older tree, as long as it produces the same CIL output, so it uses the
checkpolicy it finds in PATH by default.

The test policy is taken from an e-mail from James Carter:
https://lore.kernel.org/selinux/CAP+JOzTQQx6aM81QyVe0yoiPJeDU+7xE6nn=0UMAB1EZ_c9ryA@mail.gmail.com/T/

Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
Acked-by: James Carter <jwcart2@gmail.com>
2020-03-18 13:56:34 -04:00
Petr Lautrbach dca7ce8195
Update VERSIONs to 3.0 for release.
Signed-off-by: Petr Lautrbach <plautrba@redhat.com>
2019-11-28 13:46:48 +01:00
Petr Lautrbach 6e187f8a2a Update VERSIONs to 3.0-rc2 for release.
Signed-off-by: Petr Lautrbach <plautrba@redhat.com>
2019-11-22 13:54:17 +01:00
Petr Lautrbach b3ed0a7a60 Update VERSIONs to 3.0-rc1 for release.
Signed-off-by: Petr Lautrbach <plautrba@redhat.com>
2019-10-28 13:06:11 +01:00
Nicolas Iooss b550c0e202
Fix many misspellings
Use codespell (https://github.com/codespell-project/codespell) in order
to find many common misspellings that are present in English texts.

Signed-off-by: Nicolas Iooss <nicolas.iooss@m4x.org>
2019-09-18 22:47:35 +02:00
Joshua Brindle 9ba35fe8c2 Add default_range glblub support
Policy developers can set a default_range default to glblub and
computed contexts will be the intersection of the ranges of the
source and target contexts. This can be used by MLS userspace
object managers to find the range of clearances that two contexts
have in common. An example usage is computing a transition between
the network context and the context of a user logging into an MLS
application.

For example, one can add a default with
this cil:

(defaultrange db_table glblub)

or in te (base module only):

default_range db_table glblub;

and then test using the compute_create utility:

$ ./compute_create system_u:system_r:kernel_t:s0:c1,c2,c5-s0:c1.c20 system_u:system_r:kernel_t:s0:c0.c20-s0:c0.c36 db_table
system_u:object_r:kernel_t:s0:c1,c2,c5-s0:c1.c20

Some example range transitions are:

User Permitted Range | Network Device Label | Computed Label
---------------------|----------------------|----------------
s0-s1:c0.c12         | s0                   | s0
s0-s1:c0.c12         | s0-s1:c0.c1023       | s0-s1:c0.c12
s0-s4:c0.c512        | s1-s1:c0.c1023       | s1-s1:c0.c512
s0-s15:c0,c2         | s4-s6:c0.c128        | s4-s6:c0,c2
s0-s4                | s2-s6                | s2-s4
s0-s4                | s5-s8                | INVALID
s5-s8                | s0-s4                | INVALID

Signed-off-by: Joshua Brindle <joshua.brindle@crunchydata.com>
2019-09-10 12:30:29 -04:00
Ondrej Mosnacek f7cb5901f1 secilc: add flag to enable policy optimization
Add a command-line option -O/--optimize to optimize the final policydb
using sepol_policydb_optimize() before writing it out.

Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
2019-06-25 10:11:00 -04:00
Petr Lautrbach 891cfee44f Update VERSIONs to 2.9 for release.
Signed-off-by: Petr Lautrbach <plautrba@redhat.com>
2019-03-15 11:32:30 +01:00
Petr Lautrbach ee1809f453 Update VERSIONs to 2.9-rc2 for release.
Signed-off-by: Petr Lautrbach <plautrba@redhat.com>
2019-03-01 13:58:20 +01:00
Petr Lautrbach 53312c7d61 Update VERSIONs to 2.9-rc1 for release.
Signed-off-by: Petr Lautrbach <plautrba@redhat.com>
2019-01-25 11:48:54 +01:00
Nick Kralevich via Selinux 2896967775 secilc: better error handling
Fix a situation where the secilc command line tool could return success
even though the compilation failed.

  $ secilc /dev/null -o /dev/null -f /dev/null
  Failure reading file: /dev/null
  $ echo $?
  0

Signed-off-by: Nick Kralevich <nnk@google.com>
2018-09-25 08:05:41 -07:00
Nick Kralevich via Selinux 0a71c5f3eb whitespace and spelling cleanup
Signed-off-by: Nick Kralevich <nnk@google.com>
2018-09-25 08:05:41 -07:00
Laurent Bigonville 3ef0fef845 secilc: Make the clean target call the clean target of docs/
Thanks to Russell Coker <russell@coker.com.au>

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=899083

Signed-off-by: Laurent Bigonville <bigon@bigon.be>
2018-05-30 22:06:43 +02:00
Stephen Smalley a9f8a101fd Update VERSIONs to 2.8 for release.
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2018-05-24 14:21:09 -04:00
Stephen Smalley 20c9b4971e Update VERSION files to 2.8-rc3
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2018-05-10 11:08:22 -04:00
Stephen Smalley dc03bae194 Update VERSION files to 2.8-rc2.
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2018-04-26 13:20:40 -04:00
Stephen Smalley f04d64012a Update VERSION files to 2.8-rc1
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2018-04-19 10:40:16 -04:00
Richard Haines via Selinux cf0ab12414 selinux: Add support for the SCTP portcon keyword
Update libsepol, checkpolicy and the CIL compiler to support the SCTP
portcon keyword.

Signed-off-by: Richard Haines <richard_c_haines@btinternet.com>
2018-03-19 12:34:29 -04:00