Re: [PATCH] Fix the range_transition rule

[Joshua Brindle <jbrindle@tresys.com>]

Paul Moore wrote:

> Below is a patch to libsepol/src/expand.c to fix a problem with MLS 
> range transitions.  The problem is that the function expand_module() 
> reassigns numeric values for the types when copying them and the 
> routine used to copy the range transitions, range_trans_clone(), 
> simply copied the old type values leading to bad values in the 
> resulting policy file.
>
> This fix uses the old type value to look up the type name in the old 
> symbol table and then uses the type name to lookup the new type value.
>
> --- libsepol-1.7.9/src/expand.c.orig    2005-08-05 15:33:26.000000000 
> -0400
> +++ libsepol-1.7.9/src/expand.c 2005-08-05 16:14:18.000000000 -0400
> @@ -1349,11 +1349,21 @@ static int range_trans_clone(expand_stat
>
>          while (range != NULL) {
>                  range_trans_t *new_range;
> +                type_datum_t *type;
> +                char *type_name;
> +
>                  if ((new_range = malloc(sizeof(*new_range))) == NULL) {
>                          goto out_of_mem;
>                  }
> -                new_range->dom = range->dom;
> -                new_range->type = range->type;
> +
> +                /* convert the range_transition domain and type */
> +                type_name = 
> state->base->p_type_val_to_name[range->dom - 1];
> +                type = hashtab_search(state->out->p_types.table, 
> type_name);
> +                new_range->dom = type->value;
> +                type_name = 
> state->base->p_type_val_to_name[range->type - 1];
> +                type = hashtab_search(state->out->p_types.table, 
> type_name);
> +                new_range->type = type->value;
> +
>                  if (mls_level_clone(&new_range->range.level[0], 
> &range->range.level[0]) == -1 ||
>                      mls_level_clone(&new_range->range.level[1], 
> &range->range.level[1])) {
>                          goto out_of_mem;

Thanks, however this should probably be using the typemap that already 
does this sort of thing.
something like new_range->type = state->typemap[type->value - 1] should 
work correctly.



--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.