[PATCH] Fix the range_transition rule

[PATCH] Fix the range_transition rule

[Paul Moore]

Below is a patch to libsepol/src/expand.c to fix a problem with MLS 
range transitions.  The problem is that the function expand_module() 
reassigns numeric values for the types when copying them and the routine 
used to copy the range transitions, range_trans_clone(), simply copied 
the old type values leading to bad values in the resulting policy file.

This fix uses the old type value to look up the type name in the old 
symbol table and then uses the type name to lookup the new type value.

--- libsepol-1.7.9/src/expand.c.orig    2005-08-05 15:33:26.000000000 -0400
+++ libsepol-1.7.9/src/expand.c 2005-08-05 16:14:18.000000000 -0400
@@ -1349,11 +1349,21 @@ static int range_trans_clone(expand_stat

          while (range != NULL) {
                  range_trans_t *new_range;
+                type_datum_t *type;
+                char *type_name;
+
                  if ((new_range = malloc(sizeof(*new_range))) == NULL) {
                          goto out_of_mem;
                  }
-                new_range->dom = range->dom;
-                new_range->type = range->type;
+
+                /* convert the range_transition domain and type */
+                type_name = state->base->p_type_val_to_name[range->dom 
- 1];
+                type = hashtab_search(state->out->p_types.table, 
type_name);
+                new_range->dom = type->value;
+                type_name = state->base->p_type_val_to_name[range->type 
- 1];
+                type = hashtab_search(state->out->p_types.table, 
type_name);
+                new_range->type = type->value;
+
                  if (mls_level_clone(&new_range->range.level[0], 
&range->range.level[0]) == -1 ||
                      mls_level_clone(&new_range->range.level[1], 
&range->range.level[1])) {
                          goto out_of_mem;


-- 
. paul moore . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. paul.moore@hp.com                                      hewlett packard
. (603) 884-5056                                          linux security

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: [PATCH] Fix the range_transition rule

[Joshua Brindle]

Paul Moore wrote:

> Below is a patch to libsepol/src/expand.c to fix a problem with MLS 
> range transitions.  The problem is that the function expand_module() 
> reassigns numeric values for the types when copying them and the 
> routine used to copy the range transitions, range_trans_clone(), 
> simply copied the old type values leading to bad values in the 
> resulting policy file.
>
> This fix uses the old type value to look up the type name in the old 
> symbol table and then uses the type name to lookup the new type value.
>
> --- libsepol-1.7.9/src/expand.c.orig    2005-08-05 15:33:26.000000000 
> -0400
> +++ libsepol-1.7.9/src/expand.c 2005-08-05 16:14:18.000000000 -0400
> @@ -1349,11 +1349,21 @@ static int range_trans_clone(expand_stat
>
>          while (range != NULL) {
>                  range_trans_t *new_range;
> +                type_datum_t *type;
> +                char *type_name;
> +
>                  if ((new_range = malloc(sizeof(*new_range))) == NULL) {
>                          goto out_of_mem;
>                  }
> -                new_range->dom = range->dom;
> -                new_range->type = range->type;
> +
> +                /* convert the range_transition domain and type */
> +                type_name = 
> state->base->p_type_val_to_name[range->dom - 1];
> +                type = hashtab_search(state->out->p_types.table, 
> type_name);
> +                new_range->dom = type->value;
> +                type_name = 
> state->base->p_type_val_to_name[range->type - 1];
> +                type = hashtab_search(state->out->p_types.table, 
> type_name);
> +                new_range->type = type->value;
> +
>                  if (mls_level_clone(&new_range->range.level[0], 
> &range->range.level[0]) == -1 ||
>                      mls_level_clone(&new_range->range.level[1], 
> &range->range.level[1])) {
>                          goto out_of_mem;

Thanks, however this should probably be using the typemap that already 
does this sort of thing.
something like new_range->type = state->typemap[type->value - 1] should 
work correctly.



--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: [PATCH] Fix the range_transition rule

[Stephen Smalley]

On Sat, 2005-08-06 at 11:45 -0400, Joshua Brindle wrote:
> Thanks, however this should probably be using the typemap that already 
> does this sort of thing.
> something like new_range->type = state->typemap[type->value - 1] should 
> work correctly.

How about this patch?

Index: libsepol/src/expand.c
===================================================================
RCS file: /nfshome/pal/CVS/selinux-usr/libsepol/src/expand.c,v
retrieving revision 1.2
diff -u -p -r1.2 expand.c
--- libsepol/src/expand.c	2 Aug 2005 18:32:15 -0000	1.2
+++ libsepol/src/expand.c	8 Aug 2005 13:49:45 -0000
@@ -1352,8 +1352,8 @@ static int range_trans_clone(expand_stat
                 if ((new_range = malloc(sizeof(*new_range))) == NULL) {
                         goto out_of_mem;
                 }
-                new_range->dom = range->dom;
-                new_range->type = range->type;
+                new_range->dom = state->typemap[range->dom-1];
+                new_range->type = state->typemap[range->type-1];
                 if (mls_level_clone(&new_range->range.level[0], &range->range.level[0]) == -1 ||
                     mls_level_clone(&new_range->range.level[1], &range->range.level[1])) {
                         goto out_of_mem;

-- 
Stephen Smalley
National Security Agency


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: [PATCH] Fix the range_transition rule

[Joshua Brindle]

Stephen Smalley wrote:

>On Sat, 2005-08-06 at 11:45 -0400, Joshua Brindle wrote:
>  
>
>>Thanks, however this should probably be using the typemap that already 
>>does this sort of thing.
>>something like new_range->type = state->typemap[type->value - 1] should 
>>work correctly.
>>    
>>
>
>How about this patch?
>
>Index: libsepol/src/expand.c
>===================================================================
>RCS file: /nfshome/pal/CVS/selinux-usr/libsepol/src/expand.c,v
>retrieving revision 1.2
>diff -u -p -r1.2 expand.c
>--- libsepol/src/expand.c	2 Aug 2005 18:32:15 -0000	1.2
>+++ libsepol/src/expand.c	8 Aug 2005 13:49:45 -0000
>@@ -1352,8 +1352,8 @@ static int range_trans_clone(expand_stat
>                 if ((new_range = malloc(sizeof(*new_range))) == NULL) {
>                         goto out_of_mem;
>                 }
>-                new_range->dom = range->dom;
>-                new_range->type = range->type;
>+                new_range->dom = state->typemap[range->dom-1];
>+                new_range->type = state->typemap[range->type-1];
>                 if (mls_level_clone(&new_range->range.level[0], &range->range.level[0]) == -1 ||
>                     mls_level_clone(&new_range->range.level[1], &range->range.level[1])) {
>                         goto out_of_mem;
>
>  
>
That looks correct.

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.