Valid setrans.conf entries?

[Michael C Thompson <thompsmc@us.ibm.com>]

So, in order to do some testing on the "robustness" of the label 
translation system, we have tried the follow set of entries in setrans.conf:

s2:c1-s15:c0.c1023=Secret:B-SystemHigh
s2:c0,c1-s15:c0.c1023=Secret:AB-SystemHigh
s0:c1,c3=&*!?_-+=<>[]{áñÃ}
s0:c1,c3=&*!?_-+=<>[]{áñÃ}

These last two entries are causing the chcat utility to bomb (and 
possibly others, I haven't checked them all). The root of the error for 
this particular problem is that in /usr/bin/chcat, the line (314):
     print "%-30s %s" % tuple(rec)

Is resulting in a 3-tuple and error that looks like:
('s0:c1,c3', '&*!?_-+', '<>[]{\xc3\xa1\xc3\xb1\xc3\x9f}')
Traceback (most recent call last):
   File "/usr/bin/chcat", line 378, in ?
     sys.exit(listcats())
   File "/usr/bin/chcat", line 314, in listcats
     print "%-30s %s" % tuple(rec)
TypeError: not all arguments converted during string formatting

The normal behaviour is a 2-tuple like this:
('s2:c0,c1-s15:c0.c1023', 'Secret:AB-SystemHigh')
s2:c0,c1-s15:c0.c1023          Secret:AB-SystemHigh

The question is, should the equals sign '=' be a valid character for the 
  translated label? If so, then it would be possible to adjust the 
parsing logic in chcat. If not, then nothing really needs to change, 
although it might be nice to have a more robust check done regardless?

A really simple, quick patch added to give an idea of an additional check...

Thanks,
Mike

-----

--- /usr/bin/chcat.orig 2006-11-14 05:16:06.000000000 -0600
+++ /usr/bin/chcat      2006-11-14 05:18:52.000000000 -0600
@@ -304,12 +304,18 @@
         sys.exit(1)

  def listcats():
+    count = 0
      fd = open(selinux.selinux_translations_path())
      for l in fd.read().split("\n"):
+        count = count + 1
          if l.startswith("#"):
              continue
          if l.find("=") != -1:
              rec = l.split("=")
+            if (len(rec) > 2):
+                print _("Invalid line: %s") % l
+                print _("Error: equals (=) is not a label character 
(line %d)") % count
+                return 1
              print "%-30s %s" % tuple(rec)
      fd.close()
      return 0


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.