[PATCH 2/2] libsepol: Remove junk permissions before optimzing the policy

[James Carter <jwcart2@gmail.com>]

In older policy compilers, a wildcard or complement would cause
all the bits higher than those corresponding to the class's declared
permissions to be set. These junk bits must be removed before
optimization is done to avoid a situation where the only bits left
for an access vector are one or more of these junk bits. If a policy
does not have at least one actual permission bit set, it will fail
validation.

Signed-off-by: James Carter <jwcart2@gmail.com>
---
 libsepol/src/optimize.c | 29 +++++++++++++++++++++++++++++
 1 file changed, 29 insertions(+)

diff --git a/libsepol/src/optimize.c b/libsepol/src/optimize.c
index eeffee7d..1efd3832 100644
--- a/libsepol/src/optimize.c
+++ b/libsepol/src/optimize.c
@@ -446,6 +446,32 @@ static void optimize_cond_avtab(policydb_t *p, const struct type_vec *type_map)
 	}
 }
 
+/*
+ * Older policy compilers could set bits higher than any of the permissions
+ * in the class. These junk bits must be removed before optimization to keep
+ * redundant rules from being kept because of junk bits and to prevent the
+ * failure of policy validation because no actual permission bit is set. 
+ */
+static int remove_junk_permissions(avtab_key_t *k, avtab_datum_t *d, void *args)
+{
+	const policydb_t *p = args;
+	const class_datum_t *tclass;
+	uint32_t mask;
+
+	if (!(k->specified & AVTAB_AV))
+		return 0;
+
+	tclass = p->class_val_to_struct[k->target_class - 1];
+	mask = PERMISSION_MASK(tclass->permissions.nprim);
+
+	if ((k->specified & ~AVTAB_ENABLED) == AVTAB_AUDITDENY)
+		d->data |= ~mask;
+	else
+		d->data &= mask;
+
+	return 0;
+}
+
 int policydb_optimize(policydb_t *p)
 {
 	struct type_vec *type_map;
@@ -453,6 +479,9 @@ int policydb_optimize(policydb_t *p)
 	if (p->policy_type != POLICY_KERN)
 		return -1;
 
+	avtab_map(&p->te_avtab, remove_junk_permissions, p);
+	avtab_map(&p->te_cond_avtab, remove_junk_permissions, p);
+
 	type_map = build_type_map(p);
 	if (!type_map)
 		return -1;
-- 
2.55.0