[PATCH 1/1] role_fix_callback skips out-of-scope roles during expansion.

[PATCH 1/1] role_fix_callback skips out-of-scope roles during expansion.

[Harry Ciao]

If a role identifier is out of scope it would be skipped over during
expansion, accordingly, be it a role attribute, it should be skipped
over as well when role_fix_callback tries to propagate its capability
to all its sub-roles.

BTW, it's worthwhile to note that the symtab and rules of an optional
block in a loadable module will be written to its pp. However, for the
base module the entire optional block will be omitted if its exterior
dependency cannot be properly satisfied.

Signed-off-by: Harry Ciao <qingtao.cao@windriver.com>
---
 libsepol/src/expand.c |    5 +++++
 1 files changed, 5 insertions(+), 0 deletions(-)

diff --git a/libsepol/src/expand.c b/libsepol/src/expand.c
index 493e478..befb720 100644
--- a/libsepol/src/expand.c
+++ b/libsepol/src/expand.c
@@ -688,6 +688,11 @@ static int role_fix_callback(hashtab_key_t key, hashtab_datum_t datum,
 		return 0;
 	}
 
+	if (!is_id_enabled(id, state->base, SYM_ROLES)) {
+		/* identifier's scope is not enabled */
+		return 0;
+	}
+
 	if (role->flavor != ROLE_ATTRIB)
 		return 0;
 
-- 
1.7.0.4


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: [PATCH 1/1] role_fix_callback skips out-of-scope roles during expansion.

[Christopher J. PeBenito]

On 02/24/12 02:12, Harry Ciao wrote:
> If a role identifier is out of scope it would be skipped over during
> expansion, accordingly, be it a role attribute, it should be skipped
> over as well when role_fix_callback tries to propagate its capability
> to all its sub-roles.
> 
> BTW, it's worthwhile to note that the symtab and rules of an optional
> block in a loadable module will be written to its pp. However, for the
> base module the entire optional block will be omitted if its exterior
> dependency cannot be properly satisfied.

This doesn't sound correct.  If optionals don't exist in the base module, then that would be a significant problem for current policy.

-- 
Chris PeBenito
Tresys Technology, LLC
www.tresys.com | oss.tresys.com

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: [PATCH 1/1] role_fix_callback skips out-of-scope roles during expansion.

[Harry Ciao]

On 02/24/2012 10:17 PM, Christopher J. PeBenito wrote:
> On 02/24/12 02:12, Harry Ciao wrote:
>> If a role identifier is out of scope it would be skipped over during
>> expansion, accordingly, be it a role attribute, it should be skipped
>> over as well when role_fix_callback tries to propagate its capability
>> to all its sub-roles.
>>
>> BTW, it's worthwhile to note that the symtab and rules of an optional
>> block in a loadable module will be written to its pp. However, for the
>> base module the entire optional block will be omitted if its exterior
>> dependency cannot be properly satisfied.
> This doesn't sound correct.  If optionals don't exist in the base module, then that would be a significant problem for current policy.

Ok, even the second part of this patch header doesn't sound correct, the 
patch itself is a must-have so that during expansion role_fix_callback 
will skip the same out-of-scope roles as skipped by role_copy_callback. 
Otherwise the logic won't be consistent.

I will send a v1 patch without the second part of header, it's not 
directly related with the patch anyway.

However, from my testing with the simple x.te came up by Martin Orr in 
another recent thread, if an optional block contains an out-of-scope 
symbol, then that symbol won't be expanded from the base module to the 
out module during expansion, that's why the current assertion in 
role_fix_callback is failed and made me come up this patch to make 
role_fix_callback skip those out-of-scope roles as well.

 From the source code, is_id_enabled will be called by various 
xxx_copy_callback during expansion, which returns 0 if it fails to find 
at least one scope_datum_t with the type of SCOPE_DECL for the current 
symbol, which is right the out-of-scope symbol that has just been 
required but not declared yet.

Did I miss anything?

Thanks,
Harry




--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.