Re: Fwd: strange issue with name-base type trans

[Dominick Grift <dominick.grift@defensec.nl>]

[-- Attachment #1: Type: text/plain, Size: 2496 bytes --]

On Wed, Mar 04, 2020 at 01:53:47PM -0500, James Carter wrote:
> On Thu, Feb 27, 2020 at 2:51 PM Dominick Grift <dac.override@gmail.com> wrote:
> >
> > James Carter <jwcart2@gmail.com> writes:
> >
> > > Sorry, email problems has made life a bit difficult over the past
> > > week. Steve had to forward this to me.
> > >
> > > So far, I am unable to duplicate what you are seeing.
> >
> > You can try it with my dssp3 policy:
> >
> > git clone git://defensec.nl/dssp3.git
> > cd dssp3
> > [kcinimod@brutus dssp3 (master=)]$ secilc `find . -name "*.cil"`
> > [kcinimod@brutus dssp3 (master=)]$ sesearch policy.32 -T | grep sudo | grep tmp
> > type_transition sudo.subj file.log:file pam.faillog.log btmp;
> > type_transition sudo.subj file.tmp:file sudo.tmp;
> > [kcinimod@brutus dssp3 (master=)]$ sed -i 's/(call obj_type_transition_tmp_fixme (subj file))/(call obj_type_transition_tmp (subj file "*"))/' poli
> > cy/app/s/sudo.cil
> > [kcinimod@brutus dssp3 (master *=)]$ secilc `find . -name "*.cil"`
> > [kcinimod@brutus dssp3 (master *=)]$ sesearch policy.32 -T | grep sudo | grep tmp
> > type_transition sudo.subj file.log:file pam.faillog.log btmp;
> > type_transition sudo.subj file.tmp:file sudo.tmp ARG3;
> >
> > Note the "ARG3" in the latter result
> >
> 
> I found the problem. In dssp3/policy/user/user_runtimeuser.cil there
> is the following macro definition.

Thanks! I feel a little bad that it is a bug in my policy that brings this to light (and that I couldnt find the bug in the policy myself)
Hopefully this event will help improve things.

Thanks again

> 
>     (macro obj_type_transition_runtimeuser ((type ARG1)(class ARG2)(name ARG2))
>            (call .file.runtimeuser_obj_type_transition
>                  (ARG1 runtimeuser ARG2 ARG3)))
> 
> Notice that ARG2 is used twice and ARG3 is not actually an argument
> and is taken as a name.
> 
> There are a couple of bugs here. First, CIL should give an error for
> the duplicate argument names and, second, CIL should be checking if a
> name is actually a macro parameter before it checks whether that name
> is already in the name symbol table.
> 
> You were seeing what you saw because the macro above is never called
> but it does put ARG3 into the symbol table so that it is not
> recognized as a parameter later.
> 
> Jim

-- 
gpg --locate-keys dominick.grift@defensec.nl
Key fingerprint = FCD2 3660 5D6B 9D27 7FC6  E0FF DA7E 521F 10F6 4098
Dominick Grift

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]