Genfscon: Revise to directly use sepol data structures.

libqpol/genfscon_query.c

@@ -1,294 +0,0 @@
-/**
-*  @file
-*  Defines the public interface for searching and iterating over genfscon statements.
-*
-*  @author Kevin Carr kcarr@tresys.com
-*  @author Jeremy A. Mowery jmowery@tresys.com
-*  @author Jason Tang jtang@tresys.com
-*
-*  Copyright (C) 2006-2007 Tresys Technology, LLC
-*
-*  This library is free software; you can redistribute it and/or
-*  modify it under the terms of the GNU Lesser General Public
-*  License as published by the Free Software Foundation; either
-*  version 2.1 of the License, or (at your option) any later version.
-*
-*  This library is distributed in the hope that it will be useful,
-*  but WITHOUT ANY WARRANTY; without even the implied warranty of
-*  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-*  Lesser General Public License for more details.
-*
-*  You should have received a copy of the GNU Lesser General Public
-*  License along with this library; if not, write to the Free Software
-*  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
-*/
-
-#include <stddef.h>
-#include <stdlib.h>
-#include <stdint.h>
-#include <qpol/iterator.h>
-#include <qpol/policy.h>
-#include <qpol/context_query.h>
-#include <qpol/genfscon_query.h>
-#include <sepol/policydb/policydb.h>
-#include "qpol_internal.h"
-#include "iterator_internal.h"
-
-struct qpol_genfscon
-{
-	const char *fs_name;
-	const char *path;
-	const context_struct_t *context;
-	uint32_t sclass;
-};
-
-int qpol_policy_get_genfscon_by_name(const qpol_policy_t * policy, const char *name, const char *path, qpol_genfscon_t ** genfscon)
-{
-	genfs_t *tmp = NULL;
-	ocontext_t *tmp2 = NULL;
-	policydb_t *db = NULL;
-	int error = 0;
-
-	if (genfscon != NULL)
-		*genfscon = NULL;
-
-	if (policy == NULL || name == NULL || path == NULL || genfscon == NULL) {
-		ERR(policy, "%s", strerror(EINVAL));
-		errno = EINVAL;
-		return STATUS_ERR;
-	}
-
-	db = &policy->p->p;
-	for (tmp = db->genfs; tmp; tmp = tmp->next) {
-		if (!strcmp(name, tmp->fstype))
-			break;
-	}
-
-	if (tmp) {
-		for (tmp2 = tmp->head; tmp2; tmp2 = tmp2->next) {
-			if (!strcmp(path, tmp2->u.name))
-				break;
-		}
-	}
-
-	if (tmp && tmp2) {
-		*genfscon = calloc(1, sizeof(qpol_genfscon_t));
-		if (!(*genfscon)) {
-			error = errno;
-			ERR(policy, "%s", strerror(ENOMEM));
-			errno = error;
-			return STATUS_ERR;
-		}
-		/* shallow copy only the struct pointer (genfscon) should be free()'ed */
-		(*genfscon)->fs_name = tmp->fstype;
-		(*genfscon)->path = tmp2->u.name;
-		(*genfscon)->context = &(tmp2->context[0]);
-		(*genfscon)->sclass = tmp2->v.sclass;
-	}
-
-	if (*genfscon == NULL) {
-		ERR(policy, "could not find genfscon statement for %s %s", name, path);
-		errno = ENOENT;
-		return STATUS_ERR;
-	}
-
-	return STATUS_SUCCESS;
-}
-
-typedef struct genfs_state
-{
-	genfs_t *head;
-	genfs_t *cur;
-	ocontext_t *cur_path;
-} genfs_state_t;
-
-static int genfs_state_end(const qpol_iterator_t * iter)
-{
-	genfs_state_t *gs = NULL;
-
-	if (iter == NULL || qpol_iterator_state(iter) == NULL) {
-		errno = EINVAL;
-		return STATUS_ERR;
-	}
-
-	gs = (genfs_state_t *) qpol_iterator_state(iter);
-
-	if (gs->cur == NULL && gs->cur_path == NULL)
-		return 1;
-
-	return 0;
-}
-
-static void *genfs_state_get_cur(const qpol_iterator_t * iter)
-{
-	genfs_state_t *gs = NULL;
-	qpol_genfscon_t *genfscon = NULL;
-
-	if (iter == NULL || qpol_iterator_state(iter) == NULL || genfs_state_end(iter)) {
-		errno = EINVAL;
-		return NULL;
-	}
-
-	gs = (genfs_state_t *) qpol_iterator_state(iter);
-
-	genfscon = calloc(1, sizeof(qpol_genfscon_t));
-	if (!genfscon) {
-		return NULL;
-	}
-
-	genfscon->fs_name = gs->cur->fstype;
-	genfscon->path = gs->cur_path->u.name;
-	genfscon->context = &(gs->cur_path->context[0]);
-	genfscon->sclass = gs->cur_path->v.sclass;
-
-	return genfscon;
-}
-
-static size_t genfs_state_size(const qpol_iterator_t * iter)
-{
-	genfs_state_t *gs = NULL;
-	size_t count = 0;
-	genfs_t *genfs = NULL;
-	ocontext_t *path = NULL;
-
-	if (iter == NULL || qpol_iterator_state(iter) == NULL) {
-		errno = EINVAL;
-		return 0;
-	}
-
-	gs = (genfs_state_t *) qpol_iterator_state(iter);
-
-	for (genfs = gs->head; genfs; genfs = genfs->next)
-		for (path = genfs->head; path; path = path->next)
-			count++;
-
-	return count;
-}
-
-static int genfs_state_next(qpol_iterator_t * iter)
-{
-	genfs_state_t *gs = NULL;
-
-	if (iter == NULL || qpol_iterator_state(iter) == NULL) {
-		errno = EINVAL;
-		return STATUS_ERR;
-	}
-
-	gs = (genfs_state_t *) qpol_iterator_state(iter);
-
-	if (gs->cur == NULL) {
-		errno = ERANGE;
-		return STATUS_ERR;
-	}
-
-	if (gs->cur_path->next != NULL) {
-		gs->cur_path = gs->cur_path->next;
-	} else {
-		gs->cur = gs->cur->next;
-		gs->cur_path = gs->cur ? gs->cur->head : NULL;
-	}
-
-	return STATUS_SUCCESS;
-}
-
-int qpol_policy_get_genfscon_iter(const qpol_policy_t * policy, qpol_iterator_t ** iter)
-{
-	policydb_t *db = NULL;
-	genfs_state_t *gs = NULL;
-	int error = 0;
-
-	if (iter != NULL)
-		*iter = NULL;
-
-	if (policy == NULL || iter == NULL) {
-		ERR(policy, "%s", strerror(EINVAL));
-		errno = EINVAL;
-		return STATUS_ERR;
-	}
-
-	db = &policy->p->p;
-
-	gs = calloc(1, sizeof(genfs_state_t));
-	if (gs == NULL) {
-		error = errno;
-		ERR(policy, "%s", strerror(ENOMEM));
-		errno = error;
-		return STATUS_ERR;
-	}
-
-	gs->head = gs->cur = db->genfs;
-	if (gs->head)
-		gs->cur_path = gs->head->head;
-
-	if (qpol_iterator_create(policy, (void *)gs, genfs_state_get_cur,
-				 genfs_state_next, genfs_state_end, genfs_state_size, free, iter)) {
-		free(gs);
-		return STATUS_ERR;
-	}
-
-	return STATUS_SUCCESS;
-}
-
-int qpol_genfscon_get_name(const qpol_policy_t * policy, const qpol_genfscon_t * genfs, const char **name)
-{
-	if (name != NULL)
-		*name = NULL;
-
-	if (policy == NULL || genfs == NULL || name == NULL) {
-		ERR(policy, "%s", strerror(EINVAL));
-		errno = EINVAL;
-		return STATUS_ERR;
-	}
-
-	*name = genfs->fs_name;
-
-	return STATUS_SUCCESS;
-}
-
-int qpol_genfscon_get_path(const qpol_policy_t * policy, const qpol_genfscon_t * genfs, const char **path)
-{
-	if (path != NULL)
-		*path = NULL;
-
-	if (policy == NULL || genfs == NULL || path == NULL) {
-		ERR(policy, "%s", strerror(EINVAL));
-		errno = EINVAL;
-		return STATUS_ERR;
-	}
-
-	*path = genfs->path;
-
-	return STATUS_SUCCESS;
-}
-
-int qpol_genfscon_get_class(const qpol_policy_t * policy, const qpol_genfscon_t * genfs, uint32_t * obj_class)
-{
-	if (obj_class != NULL)
-		*obj_class = 0;
-
-	if (policy == NULL || genfs == NULL || obj_class == NULL) {
-		ERR(policy, "%s", strerror(EINVAL));
-		errno = EINVAL;
-		return STATUS_ERR;
-	}
-
-	*obj_class = genfs->sclass;
-
-	return STATUS_SUCCESS;
-}
-
-int qpol_genfscon_get_context(const qpol_policy_t * policy, const qpol_genfscon_t * genfscon, const qpol_context_t ** context)
-{
-	if (context != NULL)
-		*context = NULL;
-
-	if (policy == NULL || genfscon == NULL || context == NULL) {
-		ERR(policy, "%s", strerror(EINVAL));
-		errno = EINVAL;
-		return STATUS_ERR;
-	}
-
-	*context = (qpol_context_t *) genfscon->context;
-
-	return STATUS_SUCCESS;
-}

setools/policyrep/fscontext.pxi

@@ -40,16 +40,29 @@ cdef inline FSUse fs_use_factory(SELinuxPolicy policy, sepol.ocontext_t *symbol)
 #
 # Genfscon factory functions
 #
-cdef inline Genfscon genfscon_factory_iter(SELinuxPolicy policy, QpolIteratorItem symbol):
+cdef inline genfscon_iterator_factory(SELinuxPolicy policy, sepol.genfs_t *head):
-    """Factory function variant for iterating over Genfscon objects."""
+    """Factory function for creating genfscon iterators."""
-    return genfscon_factory(policy, <const qpol_genfscon_t *> symbol.obj)
+    i = GenfsconIterator()
+    i.policy = policy
+    i.head = i.curr = head
+    return i
 
 
-cdef inline Genfscon genfscon_factory(SELinuxPolicy policy, const qpol_genfscon_t *symbol):
+cdef inline genfscon_subiterator_factory(SELinuxPolicy policy, sepol.ocontext_t *head, fstype):
+    """Factory function for creating genfscon sub-iterators."""
+    i = GenfsconOcontextIterator()
+    i.policy = policy
+    i.head = i.curr = head
+    i.fs = fstype
+    return i
+
+
+cdef inline Genfscon genfscon_factory(SELinuxPolicy policy, sepol.ocontext_t *symbol, fstype):
     """Factory function for creating Genfscon objects."""
     r = Genfscon()
     r.policy = policy
     r.handle = symbol
+    r.fs = fstype
     return r
 
 
@@ -127,20 +140,20 @@ class GenfsFiletype(int):
         return self._filetype_to_text[self]
 
 
-cdef class Genfscon(PolicySymbol):
+cdef class Genfscon(Ocontext):
 
     """A genfscon statement."""
 
-    cdef const qpol_genfscon_t *handle
+    cdef readonly str fs
 
-    _qpol_to_stat = {0: 0,
+    _sclass_to_stat = {0: 0,
-                     QPOL_CLASS_BLK_FILE: S_IFBLK,
+                       sepol.SECCLASS_BLK_FILE: S_IFBLK,
-                     QPOL_CLASS_CHR_FILE: S_IFCHR,
+                       sepol.SECCLASS_CHR_FILE: S_IFCHR,
-                     QPOL_CLASS_DIR: S_IFDIR,
+                       sepol.SECCLASS_DIR: S_IFDIR,
-                     QPOL_CLASS_FIFO_FILE: S_IFIFO,
+                       sepol.SECCLASS_FIFO_FILE: S_IFIFO,
-                     QPOL_CLASS_FILE: S_IFREG,
+                       sepol.SECCLASS_FILE: S_IFREG,
-                     QPOL_CLASS_LNK_FILE: S_IFLNK,
+                       sepol.SECCLASS_LNK_FILE: S_IFLNK,
-                     QPOL_CLASS_SOCK_FILE: S_IFSOCK}
+                       sepol.SECCLASS_SOCK_FILE: S_IFSOCK}
 
     def __str__(self):
         return "genfscon {0.fs} {0.path} {0.filetype} {0.context}".format(self)
@@ -148,70 +161,71 @@ cdef class Genfscon(PolicySymbol):
     def __hash__(self):
         return hash("genfscon|{0.fs}|{0.path}|{0.filetype}".format(self))
 
-    def __eq__(self, other):
+    def __lt__(self, other):
-        # TODO: free the objects
+        # this is used by Python sorting functions
-        # TODO: see if this can be fixed
+        return str(self) < str(other)
-        # Libqpol allocates new C objects in the
-        # genfscons iterator, so pointer comparison
-        # in the PolicySymbol object doesn't work.
-        try:
-            return (self.fs == other.fs and
-                    self.path == other.path and
-                    self.filetype == other.filetype and
-                    self.context == other.context)
-        except AttributeError:
-            return str(self) == str(other)
-
-    def _eq(self, Genfscon other):
-        """Low-level equality check (C pointers)."""
-        return self.handle == other.handle
-
-    @property
-    def context(self):
-        """The context for this statement."""
-        cdef const qpol_context_t *ctx
-        if qpol_genfscon_get_context(self.policy.handle, self.handle, &ctx):
-            ex = LowLevelPolicyError("Error reading genfscon file system context: {}".format(
-                                     strerror(errno)))
-            ex.errno = errno
-            raise ex
-
-        return context_factory(self.policy, ctx)
 
     @property
     def filetype(self):
         """The file type (e.g. stat.S_IFBLK) for this genfscon statement."""
-        cdef uint32_t cls
+        return GenfsFiletype(self._sclass_to_stat[self.handle.v.sclass])
-        if qpol_genfscon_get_class(self.policy.handle, self.handle, &cls):
-            ex = LowLevelPolicyError("Error reading genfscon class: {}".format(strerror(errno)))
-            ex.errno = errno
-            raise ex
-
-        return GenfsFiletype(self._qpol_to_stat[cls])
-
-    @property
-    def fs(self):
-        """The filesystem type for this statement."""
-        cdef const char *name
-        if qpol_genfscon_get_name(self.policy.handle, self.handle, &name):
-            ex = LowLevelPolicyError("Error reading genfscon file system type: {}".format(
-                                     strerror(errno)))
-            ex.errno = errno
-            raise ex
-
-        return intern(name)
 
     @property
     def path(self):
         """The path for this genfscon statement."""
-        cdef const char *path
+        return intern(self.handle.u.name)
-        if qpol_genfscon_get_path(self.policy.handle, self.handle, &path):
-            ex = LowLevelPolicyError("Error reading genfscon file system path: {}".format(
-                                     strerror(errno)))
-            ex.errno = errno
-            raise ex
 
-        return intern(path)
 
-    def statement(self):
+cdef class GenfsconIterator:
-        return str(self)
+
+    """Iterator for genfscon statements in the policy."""
+
+    cdef:
+        sepol.genfs_t *head
+        sepol.genfs_t *curr
+        object ocon_iter
+        SELinuxPolicy policy
+
+    def __iter__(self):
+        return self
+
+    def __next__(self):
+        # consume sub-iterator first, if one exists
+        if self.ocon_iter:
+            try:
+                return self.ocon_iter.__next__()
+            except StopIteration:
+                # sub_iter completed, clear
+                self.ocon_iter = None
+
+        if self.curr == NULL:
+            raise StopIteration
+
+        # create a sub-iterator for this fs entry
+        self.ocon_iter = genfscon_subiterator_factory(self.policy, self.curr.head,
+                                                      intern(self.curr.fstype))
+
+        self.curr = self.curr.next
+        return self.ocon_iter.__next__()
+
+    def size(self):
+        cdef:
+            size_t count = 0
+            sepol.genfs_t *genfs = self.head
+
+        while genfs:
+            count += genfscon_subiterator_factory(self.policy, genfs.head, genfs.fstype).size()
+            genfs = genfs.next
+
+        return count
+
+
+cdef class GenfsconOcontextIterator(OcontextIterator):
+
+    """Sub-iterator for genfscon statements."""
+
+    cdef str fs
+
+    def __next__(self):
+        super().__next__()
+        return genfscon_factory(self.policy, self.ocon, self.fs)

setools/policyrep/libpolicyrep.pyx

@@ -211,24 +211,6 @@ cdef extern from "include/qpol/ftrule_query.h":
     int qpol_filename_trans_get_object_class(const qpol_policy_t * policy, const qpol_filename_trans_t * rule, const qpol_class_t ** obj_class)
     int qpol_filename_trans_get_filename(const qpol_policy_t * policy, const qpol_filename_trans_t * rule, const char ** name)
 
-cdef extern from "include/qpol/genfscon_query.h":
-    ctypedef struct qpol_genfscon_t:
-        pass
-    extern int qpol_policy_get_genfscon_by_name(const qpol_policy_t * policy, const char *name, const char *path, qpol_genfscon_t ** genfscon)
-    extern int qpol_policy_get_genfscon_iter(const qpol_policy_t * policy, qpol_iterator_t ** iter)
-    extern int qpol_genfscon_get_name(const qpol_policy_t * policy, const qpol_genfscon_t * genfs, const char **name)
-    extern int qpol_genfscon_get_path(const qpol_policy_t * policy, const qpol_genfscon_t * genfs, const char **path)
-    cdef int QPOL_CLASS_ALL
-    cdef int QPOL_CLASS_BLK_FILE
-    cdef int QPOL_CLASS_CHR_FILE
-    cdef int QPOL_CLASS_DIR
-    cdef int QPOL_CLASS_FIFO_FILE
-    cdef int QPOL_CLASS_FILE
-    cdef int QPOL_CLASS_LNK_FILE
-    cdef int QPOL_CLASS_SOCK_FILE
-    extern int qpol_genfscon_get_class(const qpol_policy_t * policy, const qpol_genfscon_t * genfs, uint32_t * obj_class)
-    extern int qpol_genfscon_get_context(const qpol_policy_t * policy, const qpol_genfscon_t * genfscon, const qpol_context_t ** context)
-
 cdef extern from "include/qpol/iterator.h":
     ctypedef struct qpol_iterator_t:
         pass

setools/policyrep/selinuxpolicy.pxi

@@ -671,11 +671,7 @@ cdef class SELinuxPolicy:
 
     def genfscons(self):
         """Iterator over all genfscon statements."""
-        cdef qpol_iterator_t *iter
+        return genfscon_iterator_factory(self, self.handle.p.p.genfs)
-        if qpol_policy_get_genfscon_iter(self.handle, &iter):
-            raise MemoryError
-
-        return qpol_iterator_factory(self, iter, genfscon_factory_iter)
 
     def initialsids(self):
         """Iterator over all initial SID statements."""

setools/policyrep/sepol.pxd

@@ -16,6 +16,15 @@ cdef extern from "<sepol/policydb/services.h>":
     cdef int SECURITY_FS_USE_GENFS
     cdef int SECURITY_FS_USE_NONE
 
+cdef extern from "<sepol/policydb/flask.h>":
+    cdef int SECCLASS_DIR
+    cdef int SECCLASS_FILE
+    cdef int SECCLASS_LNK_FILE
+    cdef int SECCLASS_FIFO_FILE
+    cdef int SECCLASS_SOCK_FILE
+    cdef int SECCLASS_CHR_FILE
+    cdef int SECCLASS_BLK_FILE
+
 cdef extern from "<sepol/policydb/flask_types.h>":
     cdef int SELINUX_MAGIC
 

setup.py

@@ -75,7 +75,6 @@ ext_py_mods = [Extension('setools.policyrep.libpolicyrep',
                           'libqpol/context_query.c',
                           'libqpol/default_object_query.c',
                           'libqpol/ftrule_query.c',
-                          'libqpol/genfscon_query.c',
                           'libqpol/iterator.c',
                           'libqpol/mls_query.c',
                           'libqpol/mlsrule_query.c',