[PATCH] libsepol: Validate the genfs file type class

[James Carter <jwcart2@gmail.com>]

Like file contexts, genfscon rules can have an optional file type.
These file types are mapped to the value of the corresponding
security class. If no file type is given, then the value is set to
0. During validation the value is verified to be either 0 or a valid
value for a class, but not all security classes correspond to a file
type.

When validating a policy, verify that the value is either 0 or the
name of the class with that value corresponds to a file type.

Signed-off-by: James Carter <jwcart2@gmail.com>
---
 libsepol/src/policydb_validate.c | 24 ++++++++++++++++++++----
 1 file changed, 20 insertions(+), 4 deletions(-)

diff --git a/libsepol/src/policydb_validate.c b/libsepol/src/policydb_validate.c
index 5fd64b12..34182e8e 100644
--- a/libsepol/src/policydb_validate.c
+++ b/libsepol/src/policydb_validate.c
@@ -1628,6 +1628,19 @@ bad:
 	return -1;
 }
 
+static int validate_genfs_class(uint32_t sclass, const policydb_t *p)
+{
+	const char *class_name = p->p_class_val_to_name[sclass - 1];
+
+	if (strcmp(class_name, "file") && strcmp(class_name, "dir") &&
+	    strcmp(class_name, "chr_file") && strcmp(class_name, "blk_file") &&
+	    strcmp(class_name, "sock_file") &&
+	    strcmp(class_name, "fifo_file") && strcmp(class_name, "lnk_file"))
+		return -1;
+
+	return 0;
+}
+
 static int validate_genfs(sepol_handle_t *handle, const policydb_t *p,
 			  validate_t flavors[])
 {
@@ -1639,10 +1652,13 @@ static int validate_genfs(sepol_handle_t *handle, const policydb_t *p,
 			if (validate_context(&octx->context[0], flavors,
 					     p->mls))
 				goto bad;
-			if (octx->v.sclass &&
-			    validate_value(octx->v.sclass,
-					   &flavors[SYM_CLASSES]))
-				goto bad;
+			if (octx->v.sclass) {
+				if (validate_value(octx->v.sclass,
+						   &flavors[SYM_CLASSES]))
+					goto bad;
+				if (validate_genfs_class(octx->v.sclass, p))
+					goto bad;
+			}
 		}
 
 		if (validate_string_field(genfs->fstype))
-- 
2.55.0