RepoMirrors/setools
1
0
Fork 0
mirror of https://github.com/SELinuxProject/setools synced 2025-03-11 07:18:15 +00:00
Code Issues Packages Projects Releases Wiki Activity

Genfscon: Revise to directly use sepol data structures.

Browse Source
This commit is contained in:
Chris PeBenito 2018-01-21 21:48:03 -05:00
parent 80a95bd414
commit a06d4a9476
6 changed files with 95 additions and 389 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

294
libqpol/genfscon_query.c
View File

@ -1,294 +0,0 @@
/**
* @file
* Defines the public interface for searching and iterating over genfscon statements.
*
* @author Kevin Carr kcarr@tresys.com
* @author Jeremy A. Mowery jmowery@tresys.com
* @author Jason Tang jtang@tresys.com
*
* Copyright (C) 2006-2007 Tresys Technology, LLC
*
* This library is free software; you can redistribute it and/or
* modify it under the terms of the GNU Lesser General Public
* License as published by the Free Software Foundation; either
* version 2.1 of the License, or (at your option) any later version.
*
* This library is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
* Lesser General Public License for more details.
*
* You should have received a copy of the GNU Lesser General Public
* License along with this library; if not, write to the Free Software
* Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA
*/
#include <stddef.h>
#include <stdlib.h>
#include <stdint.h>
#include <qpol/iterator.h>
#include <qpol/policy.h>
#include <qpol/context_query.h>
#include <qpol/genfscon_query.h>
#include <sepol/policydb/policydb.h>
#include "qpol_internal.h"
#include "iterator_internal.h"
struct qpol_genfscon
{
const char *fs_name;
const char *path;
const context_struct_t *context;
uint32_t sclass;
};
int qpol_policy_get_genfscon_by_name(const qpol_policy_t * policy, const char *name, const char *path, qpol_genfscon_t ** genfscon)
{
genfs_t *tmp = NULL;
ocontext_t *tmp2 = NULL;
policydb_t *db = NULL;
int error = 0;
if (genfscon != NULL)
*genfscon = NULL;
if (policy == NULL || name == NULL || path == NULL || genfscon == NULL) {
ERR(policy, "%s", strerror(EINVAL));
errno = EINVAL;
return STATUS_ERR;
}
db = &policy->p->p;
for (tmp = db->genfs; tmp; tmp = tmp->next) {
if (!strcmp(name, tmp->fstype))
break;
}
if (tmp) {
for (tmp2 = tmp->head; tmp2; tmp2 = tmp2->next) {
if (!strcmp(path, tmp2->u.name))
break;
}
}
if (tmp && tmp2) {
*genfscon = calloc(1, sizeof(qpol_genfscon_t));
if (!(*genfscon)) {
error = errno;
ERR(policy, "%s", strerror(ENOMEM));
errno = error;
return STATUS_ERR;
}
/* shallow copy only the struct pointer (genfscon) should be free()'ed */
(*genfscon)->fs_name = tmp->fstype;
(*genfscon)->path = tmp2->u.name;
(*genfscon)->context = &(tmp2->context[0]);
(*genfscon)->sclass = tmp2->v.sclass;
}
if (*genfscon == NULL) {
ERR(policy, "could not find genfscon statement for %s %s", name, path);
errno = ENOENT;
return STATUS_ERR;
}
return STATUS_SUCCESS;
}
typedef struct genfs_state
{
genfs_t *head;
genfs_t *cur;
ocontext_t *cur_path;
} genfs_state_t;
static int genfs_state_end(const qpol_iterator_t * iter)
{
genfs_state_t *gs = NULL;
if (iter == NULL || qpol_iterator_state(iter) == NULL) {
errno = EINVAL;
return STATUS_ERR;
}
gs = (genfs_state_t *) qpol_iterator_state(iter);
if (gs->cur == NULL && gs->cur_path == NULL)
return 1;
return 0;
}
static void *genfs_state_get_cur(const qpol_iterator_t * iter)
{
genfs_state_t *gs = NULL;
qpol_genfscon_t *genfscon = NULL;
if (iter == NULL || qpol_iterator_state(iter) == NULL || genfs_state_end(iter)) {
errno = EINVAL;
return NULL;
}
gs = (genfs_state_t *) qpol_iterator_state(iter);
genfscon = calloc(1, sizeof(qpol_genfscon_t));
if (!genfscon) {
return NULL;
}
genfscon->fs_name = gs->cur->fstype;
genfscon->path = gs->cur_path->u.name;
genfscon->context = &(gs->cur_path->context[0]);
genfscon->sclass = gs->cur_path->v.sclass;
return genfscon;
}
static size_t genfs_state_size(const qpol_iterator_t * iter)
{
genfs_state_t *gs = NULL;
size_t count = 0;
genfs_t *genfs = NULL;
ocontext_t *path = NULL;
if (iter == NULL || qpol_iterator_state(iter) == NULL) {
errno = EINVAL;
return 0;
}
gs = (genfs_state_t *) qpol_iterator_state(iter);
for (genfs = gs->head; genfs; genfs = genfs->next)
for (path = genfs->head; path; path = path->next)
count++;
return count;
}
static int genfs_state_next(qpol_iterator_t * iter)
{
genfs_state_t *gs = NULL;
if (iter == NULL || qpol_iterator_state(iter) == NULL) {
errno = EINVAL;
return STATUS_ERR;
}
gs = (genfs_state_t *) qpol_iterator_state(iter);
if (gs->cur == NULL) {
errno = ERANGE;
return STATUS_ERR;
}
if (gs->cur_path->next != NULL) {
gs->cur_path = gs->cur_path->next;
} else {
gs->cur = gs->cur->next;
gs->cur_path = gs->cur ? gs->cur->head : NULL;
}
return STATUS_SUCCESS;
}
int qpol_policy_get_genfscon_iter(const qpol_policy_t * policy, qpol_iterator_t ** iter)
{
policydb_t *db = NULL;
genfs_state_t *gs = NULL;
int error = 0;
if (iter != NULL)
*iter = NULL;
if (policy == NULL || iter == NULL) {
ERR(policy, "%s", strerror(EINVAL));
errno = EINVAL;
return STATUS_ERR;
}
db = &policy->p->p;
gs = calloc(1, sizeof(genfs_state_t));
if (gs == NULL) {
error = errno;
ERR(policy, "%s", strerror(ENOMEM));
errno = error;
return STATUS_ERR;
}
gs->head = gs->cur = db->genfs;
if (gs->head)
gs->cur_path = gs->head->head;
if (qpol_iterator_create(policy, (void *)gs, genfs_state_get_cur,
genfs_state_next, genfs_state_end, genfs_state_size, free, iter)) {
free(gs);
return STATUS_ERR;
}
return STATUS_SUCCESS;
}
int qpol_genfscon_get_name(const qpol_policy_t * policy, const qpol_genfscon_t * genfs, const char **name)
{
if (name != NULL)
*name = NULL;
if (policy == NULL || genfs == NULL || name == NULL) {
ERR(policy, "%s", strerror(EINVAL));
errno = EINVAL;
return STATUS_ERR;
}
*name = genfs->fs_name;
return STATUS_SUCCESS;
}
int qpol_genfscon_get_path(const qpol_policy_t * policy, const qpol_genfscon_t * genfs, const char **path)
{
if (path != NULL)
*path = NULL;
if (policy == NULL || genfs == NULL || path == NULL) {
ERR(policy, "%s", strerror(EINVAL));
errno = EINVAL;
return STATUS_ERR;
}
*path = genfs->path;
return STATUS_SUCCESS;
}
int qpol_genfscon_get_class(const qpol_policy_t * policy, const qpol_genfscon_t * genfs, uint32_t * obj_class)
{
if (obj_class != NULL)
*obj_class = 0;
if (policy == NULL || genfs == NULL || obj_class == NULL) {
ERR(policy, "%s", strerror(EINVAL));
errno = EINVAL;
return STATUS_ERR;
}
*obj_class = genfs->sclass;
return STATUS_SUCCESS;
}
int qpol_genfscon_get_context(const qpol_policy_t * policy, const qpol_genfscon_t * genfscon, const qpol_context_t ** context)
{
if (context != NULL)
*context = NULL;
if (policy == NULL || genfscon == NULL || context == NULL) {
ERR(policy, "%s", strerror(EINVAL));
errno = EINVAL;
return STATUS_ERR;
}
*context = (qpol_context_t *) genfscon->context;
return STATUS_SUCCESS;
}

156
setools/policyrep/fscontext.pxi
View File

@ -40,16 +40,29 @@ cdef inline FSUse fs_use_factory(SELinuxPolicy policy, sepol.ocontext_t *symbol)
#
# Genfscon factory functions
#
cdef inline Genfscon genfscon_factory_iter(SELinuxPolicy policy, QpolIteratorItem symbol):
"""Factory function variant for iterating over Genfscon objects."""
return genfscon_factory(policy, <const qpol_genfscon_t *> symbol.obj)
cdef inline genfscon_iterator_factory(SELinuxPolicy policy, sepol.genfs_t *head):
"""Factory function for creating genfscon iterators."""
i = GenfsconIterator()
i.policy = policy
i.head = i.curr = head
return i
cdef inline Genfscon genfscon_factory(SELinuxPolicy policy, const qpol_genfscon_t *symbol):
cdef inline genfscon_subiterator_factory(SELinuxPolicy policy, sepol.ocontext_t *head, fstype):
"""Factory function for creating genfscon sub-iterators."""
i = GenfsconOcontextIterator()
i.policy = policy
i.head = i.curr = head
i.fs = fstype
return i
cdef inline Genfscon genfscon_factory(SELinuxPolicy policy, sepol.ocontext_t *symbol, fstype):
"""Factory function for creating Genfscon objects."""
r = Genfscon()
r.policy = policy
r.handle = symbol
r.fs = fstype
return r
@ -127,20 +140,20 @@ class GenfsFiletype(int):
return self._filetype_to_text[self]
cdef class Genfscon(PolicySymbol):
cdef class Genfscon(Ocontext):
"""A genfscon statement."""
cdef const qpol_genfscon_t *handle
cdef readonly str fs
_qpol_to_stat = {0: 0,
QPOL_CLASS_BLK_FILE: S_IFBLK,
QPOL_CLASS_CHR_FILE: S_IFCHR,
QPOL_CLASS_DIR: S_IFDIR,
QPOL_CLASS_FIFO_FILE: S_IFIFO,
QPOL_CLASS_FILE: S_IFREG,
QPOL_CLASS_LNK_FILE: S_IFLNK,
QPOL_CLASS_SOCK_FILE: S_IFSOCK}
_sclass_to_stat = {0: 0,
sepol.SECCLASS_BLK_FILE: S_IFBLK,
sepol.SECCLASS_CHR_FILE: S_IFCHR,
sepol.SECCLASS_DIR: S_IFDIR,
sepol.SECCLASS_FIFO_FILE: S_IFIFO,
sepol.SECCLASS_FILE: S_IFREG,
sepol.SECCLASS_LNK_FILE: S_IFLNK,
sepol.SECCLASS_SOCK_FILE: S_IFSOCK}
def __str__(self):
return "genfscon {0.fs} {0.path} {0.filetype} {0.context}".format(self)
@ -148,70 +161,71 @@ cdef class Genfscon(PolicySymbol):
def __hash__(self):
return hash("genfscon|{0.fs}|{0.path}|{0.filetype}".format(self))
def __eq__(self, other):
# TODO: free the objects
# TODO: see if this can be fixed
# Libqpol allocates new C objects in the
# genfscons iterator, so pointer comparison
# in the PolicySymbol object doesn't work.
try:
return (self.fs == other.fs and
self.path == other.path and
self.filetype == other.filetype and
self.context == other.context)
except AttributeError:
return str(self) == str(other)
def _eq(self, Genfscon other):
"""Low-level equality check (C pointers)."""
return self.handle == other.handle
@property
def context(self):
"""The context for this statement."""
cdef const qpol_context_t *ctx
if qpol_genfscon_get_context(self.policy.handle, self.handle, &ctx):
ex = LowLevelPolicyError("Error reading genfscon file system context: {}".format(
strerror(errno)))
ex.errno = errno
raise ex
return context_factory(self.policy, ctx)
def __lt__(self, other):
# this is used by Python sorting functions
return str(self) < str(other)
@property
def filetype(self):
"""The file type (e.g. stat.S_IFBLK) for this genfscon statement."""
cdef uint32_t cls
if qpol_genfscon_get_class(self.policy.handle, self.handle, &cls):
ex = LowLevelPolicyError("Error reading genfscon class: {}".format(strerror(errno)))
ex.errno = errno
raise ex
return GenfsFiletype(self._qpol_to_stat[cls])
@property
def fs(self):
"""The filesystem type for this statement."""
cdef const char *name
if qpol_genfscon_get_name(self.policy.handle, self.handle, &name):
ex = LowLevelPolicyError("Error reading genfscon file system type: {}".format(
strerror(errno)))
ex.errno = errno
raise ex
return intern(name)
return GenfsFiletype(self._sclass_to_stat[self.handle.v.sclass])
@property
def path(self):
"""The path for this genfscon statement."""
cdef const char *path
if qpol_genfscon_get_path(self.policy.handle, self.handle, &path):
ex = LowLevelPolicyError("Error reading genfscon file system path: {}".format(
strerror(errno)))
ex.errno = errno
raise ex
return intern(self.handle.u.name)
return intern(path)
def statement(self):
return str(self)
cdef class GenfsconIterator:
"""Iterator for genfscon statements in the policy."""
cdef:
sepol.genfs_t *head
sepol.genfs_t *curr
object ocon_iter
SELinuxPolicy policy
def __iter__(self):
return self
def __next__(self):
# consume sub-iterator first, if one exists
if self.ocon_iter:
try:
return self.ocon_iter.__next__()
except StopIteration:
# sub_iter completed, clear
self.ocon_iter = None
if self.curr == NULL:
raise StopIteration
# create a sub-iterator for this fs entry
self.ocon_iter = genfscon_subiterator_factory(self.policy, self.curr.head,
intern(self.curr.fstype))
self.curr = self.curr.next
return self.ocon_iter.__next__()
def size(self):
cdef:
size_t count = 0
sepol.genfs_t *genfs = self.head
while genfs:
count += genfscon_subiterator_factory(self.policy, genfs.head, genfs.fstype).size()
genfs = genfs.next
return count
cdef class GenfsconOcontextIterator(OcontextIterator):
"""Sub-iterator for genfscon statements."""
cdef str fs
def __next__(self):
super().__next__()
return genfscon_factory(self.policy, self.ocon, self.fs)

18
setools/policyrep/libpolicyrep.pyx
View File

@ -211,24 +211,6 @@ cdef extern from "include/qpol/ftrule_query.h":
int qpol_filename_trans_get_object_class(const qpol_policy_t * policy, const qpol_filename_trans_t * rule, const qpol_class_t ** obj_class)
int qpol_filename_trans_get_filename(const qpol_policy_t * policy, const qpol_filename_trans_t * rule, const char ** name)
cdef extern from "include/qpol/genfscon_query.h":
ctypedef struct qpol_genfscon_t:
pass
extern int qpol_policy_get_genfscon_by_name(const qpol_policy_t * policy, const char *name, const char *path, qpol_genfscon_t ** genfscon)
extern int qpol_policy_get_genfscon_iter(const qpol_policy_t * policy, qpol_iterator_t ** iter)
extern int qpol_genfscon_get_name(const qpol_policy_t * policy, const qpol_genfscon_t * genfs, const char **name)
extern int qpol_genfscon_get_path(const qpol_policy_t * policy, const qpol_genfscon_t * genfs, const char **path)
cdef int QPOL_CLASS_ALL
cdef int QPOL_CLASS_BLK_FILE
cdef int QPOL_CLASS_CHR_FILE
cdef int QPOL_CLASS_DIR
cdef int QPOL_CLASS_FIFO_FILE
cdef int QPOL_CLASS_FILE
cdef int QPOL_CLASS_LNK_FILE
cdef int QPOL_CLASS_SOCK_FILE
extern int qpol_genfscon_get_class(const qpol_policy_t * policy, const qpol_genfscon_t * genfs, uint32_t * obj_class)
extern int qpol_genfscon_get_context(const qpol_policy_t * policy, const qpol_genfscon_t * genfscon, const qpol_context_t ** context)
cdef extern from "include/qpol/iterator.h":
ctypedef struct qpol_iterator_t:
pass

6
setools/policyrep/selinuxpolicy.pxi
View File

@ -671,11 +671,7 @@ cdef class SELinuxPolicy:
def genfscons(self):
"""Iterator over all genfscon statements."""
cdef qpol_iterator_t *iter
if qpol_policy_get_genfscon_iter(self.handle, &iter):
raise MemoryError
return qpol_iterator_factory(self, iter, genfscon_factory_iter)
return genfscon_iterator_factory(self, self.handle.p.p.genfs)
def initialsids(self):
"""Iterator over all initial SID statements."""

9
setools/policyrep/sepol.pxd
View File

@ -16,6 +16,15 @@ cdef extern from "<sepol/policydb/services.h>":
cdef int SECURITY_FS_USE_GENFS
cdef int SECURITY_FS_USE_NONE
cdef extern from "<sepol/policydb/flask.h>":
cdef int SECCLASS_DIR
cdef int SECCLASS_FILE
cdef int SECCLASS_LNK_FILE
cdef int SECCLASS_FIFO_FILE
cdef int SECCLASS_SOCK_FILE
cdef int SECCLASS_CHR_FILE
cdef int SECCLASS_BLK_FILE
cdef extern from "<sepol/policydb/flask_types.h>":
cdef int SELINUX_MAGIC

1
setup.py
View File

@ -75,7 +75,6 @@ ext_py_mods = [Extension('setools.policyrep.libpolicyrep',
'libqpol/context_query.c',
'libqpol/default_object_query.c',
'libqpol/ftrule_query.c',
'libqpol/genfscon_query.c',
'libqpol/iterator.c',
'libqpol/mls_query.c',
'libqpol/mlsrule_query.c',