* [PATCH 1/9] libsepol/cil: Use struct cil_db * instead of void *
2023-09-27 19:00 [PATCH 0/9] CIL Cleanups and Improved Argument handling James Carter
@ 2023-09-27 19:00 ` James Carter
2023-09-27 19:27 ` Daniel Burgener
2023-09-27 19:00 ` [PATCH 2/9] libsepol/cil: Refactor and improve handling of order rules James Carter
` (7 subsequent siblings)
8 siblings, 1 reply; 16+ messages in thread
From: James Carter @ 2023-09-27 19:00 UTC (permalink / raw)
To: selinux; +Cc: James Carter
In the CIL AST resolve phase, the functions all take a void *
and struct cil_args_resolve * is passed in to them. But in almost
all cases, only the cil_db is needed.
Modify the functions to take struct cil_db * and pass in extra
arguments in the few cases where something more is needed.
Signed-off-by: James Carter <jwcart2@gmail.com>
---
libsepol/cil/src/cil_resolve_ast.c | 631 +++++++++++++----------------
libsepol/cil/src/cil_resolve_ast.h | 124 +++---
2 files changed, 350 insertions(+), 405 deletions(-)
diff --git a/libsepol/cil/src/cil_resolve_ast.c b/libsepol/cil/src/cil_resolve_ast.c
index 33b9d321..595bd2b9 100644
--- a/libsepol/cil/src/cil_resolve_ast.c
+++ b/libsepol/cil/src/cil_resolve_ast.c
@@ -156,7 +156,7 @@ exit:
return rc;
}
-int cil_resolve_classperms(struct cil_tree_node *current, struct cil_classperms *cp, void *extra_args)
+int cil_resolve_classperms(struct cil_tree_node *current, struct cil_classperms *cp, struct cil_db *db)
{
int rc = SEPOL_ERR;
struct cil_symtab_datum *datum = NULL;
@@ -167,7 +167,7 @@ int cil_resolve_classperms(struct cil_tree_node *current, struct cil_classperms
return SEPOL_OK;
}
- rc = cil_resolve_name(current, cp->class_str, CIL_SYM_CLASSES, extra_args, &datum);
+ rc = cil_resolve_name(current, cp->class_str, CIL_SYM_CLASSES, db, &datum);
if (rc != SEPOL_OK) {
goto exit;
}
@@ -191,12 +191,12 @@ exit:
return rc;
}
-static int cil_resolve_classperms_set(struct cil_tree_node *current, struct cil_classperms_set *cp_set, void *extra_args)
+static int cil_resolve_classperms_set(struct cil_tree_node *current, struct cil_classperms_set *cp_set, struct cil_db *db)
{
int rc = SEPOL_ERR;
struct cil_symtab_datum *datum = NULL;
- rc = cil_resolve_name(current, cp_set->set_str, CIL_SYM_CLASSPERMSETS, extra_args, &datum);
+ rc = cil_resolve_name(current, cp_set->set_str, CIL_SYM_CLASSPERMSETS, db, &datum);
if (rc != SEPOL_OK) {
goto exit;
}
@@ -204,7 +204,7 @@ static int cil_resolve_classperms_set(struct cil_tree_node *current, struct cil_
/* This could be an anonymous classpermission */
if (datum->name == NULL) {
- rc = cil_resolve_classperms_list(current, cp_set->set->classperms, extra_args);
+ rc = cil_resolve_classperms_list(current, cp_set->set->classperms, db);
if (rc != SEPOL_OK) {
goto exit;
}
@@ -216,19 +216,19 @@ exit:
return rc;
}
-int cil_resolve_classperms_list(struct cil_tree_node *current, struct cil_list *cp_list, void *extra_args)
+int cil_resolve_classperms_list(struct cil_tree_node *current, struct cil_list *cp_list, struct cil_db *db)
{
int rc = SEPOL_ERR;
struct cil_list_item *curr;
cil_list_for_each(curr, cp_list) {
if (curr->flavor == CIL_CLASSPERMS) {
- rc = cil_resolve_classperms(current, curr->data, extra_args);
+ rc = cil_resolve_classperms(current, curr->data, db);
if (rc != SEPOL_OK) {
goto exit;
}
} else {
- rc = cil_resolve_classperms_set(current, curr->data, extra_args);
+ rc = cil_resolve_classperms_set(current, curr->data, db);
if (rc != SEPOL_OK) {
goto exit;
}
@@ -241,20 +241,19 @@ exit:
return rc;
}
-int cil_resolve_classpermissionset(struct cil_tree_node *current, struct cil_classpermissionset *cps, void *extra_args)
+int cil_resolve_classpermissionset(struct cil_tree_node *current, struct cil_classpermissionset *cps, struct cil_db *db)
{
int rc = SEPOL_ERR;
- struct cil_args_resolve *args = extra_args;
struct cil_list_item *curr;
struct cil_symtab_datum *datum;
struct cil_classpermission *cp;
- rc = cil_resolve_name(current, cps->set_str, CIL_SYM_CLASSPERMSETS, args, &datum);
+ rc = cil_resolve_name(current, cps->set_str, CIL_SYM_CLASSPERMSETS, db, &datum);
if (rc != SEPOL_OK) {
goto exit;
}
- rc = cil_resolve_classperms_list(current, cps->classperms, extra_args);
+ rc = cil_resolve_classperms_list(current, cps->classperms, db);
if (rc != SEPOL_OK) {
goto exit;
}
@@ -292,12 +291,12 @@ static void cil_type_used(struct cil_symtab_datum *datum, int used)
}
}
-static int cil_resolve_permissionx(struct cil_tree_node *current, struct cil_permissionx *permx, void *extra_args)
+static int cil_resolve_permissionx(struct cil_tree_node *current, struct cil_permissionx *permx, struct cil_db *db)
{
struct cil_symtab_datum *obj_datum = NULL;
int rc = SEPOL_ERR;
- rc = cil_resolve_name(current, permx->obj_str, CIL_SYM_CLASSES, extra_args, &obj_datum);
+ rc = cil_resolve_name(current, permx->obj_str, CIL_SYM_CLASSES, db, &obj_datum);
if (rc != SEPOL_OK) {
goto exit;
}
@@ -309,11 +308,8 @@ exit:
return rc;
}
-int cil_resolve_avrule(struct cil_tree_node *current, void *extra_args)
+int cil_resolve_avrule(struct cil_tree_node *current, struct cil_db *db)
{
- struct cil_args_resolve *args = extra_args;
- struct cil_db *db = NULL;
-
struct cil_avrule *rule = current->data;
struct cil_symtab_datum *src_datum = NULL;
struct cil_symtab_datum *tgt_datum = NULL;
@@ -321,11 +317,7 @@ int cil_resolve_avrule(struct cil_tree_node *current, void *extra_args)
int used;
int rc = SEPOL_ERR;
- if (args != NULL) {
- db = args->db;
- }
-
- rc = cil_resolve_name(current, rule->src_str, CIL_SYM_TYPES, args, &src_datum);
+ rc = cil_resolve_name(current, rule->src_str, CIL_SYM_TYPES, db, &src_datum);
if (rc != SEPOL_OK) {
goto exit;
}
@@ -338,7 +330,7 @@ int cil_resolve_avrule(struct cil_tree_node *current, void *extra_args)
} else if (rule->tgt_str == CIL_KEY_OTHER) {
rule->tgt = db->othertype;
} else {
- rc = cil_resolve_name(current, rule->tgt_str, CIL_SYM_TYPES, args, &tgt_datum);
+ rc = cil_resolve_name(current, rule->tgt_str, CIL_SYM_TYPES, db, &tgt_datum);
if (rc != SEPOL_OK) {
goto exit;
}
@@ -350,19 +342,19 @@ int cil_resolve_avrule(struct cil_tree_node *current, void *extra_args)
}
if (!rule->is_extended) {
- rc = cil_resolve_classperms_list(current, rule->perms.classperms, extra_args);
+ rc = cil_resolve_classperms_list(current, rule->perms.classperms, db);
if (rc != SEPOL_OK) {
goto exit;
}
} else {
if (rule->perms.x.permx_str != NULL) {
- rc = cil_resolve_name(current, rule->perms.x.permx_str, CIL_SYM_PERMX, args, &permx_datum);
+ rc = cil_resolve_name(current, rule->perms.x.permx_str, CIL_SYM_PERMX, db, &permx_datum);
if (rc != SEPOL_OK) {
goto exit;
}
rule->perms.x.permx = (struct cil_permissionx*)permx_datum;
} else {
- rc = cil_resolve_permissionx(current, rule->perms.x.permx, extra_args);
+ rc = cil_resolve_permissionx(current, rule->perms.x.permx, db);
if (rc != SEPOL_OK) {
goto exit;
}
@@ -375,21 +367,14 @@ exit:
return rc;
}
-int cil_resolve_deny_rule(struct cil_tree_node *current, void *extra_args)
+int cil_resolve_deny_rule(struct cil_tree_node *current, struct cil_db *db)
{
- struct cil_args_resolve *args = extra_args;
- struct cil_db *db = NULL;
-
struct cil_deny_rule *rule = current->data;
struct cil_symtab_datum *src_datum = NULL;
struct cil_symtab_datum *tgt_datum = NULL;
int rc = SEPOL_ERR;
- if (args != NULL) {
- db = args->db;
- }
-
- rc = cil_resolve_name(current, rule->src_str, CIL_SYM_TYPES, args, &src_datum);
+ rc = cil_resolve_name(current, rule->src_str, CIL_SYM_TYPES, db, &src_datum);
if (rc != SEPOL_OK) {
goto exit;
}
@@ -402,14 +387,14 @@ int cil_resolve_deny_rule(struct cil_tree_node *current, void *extra_args)
} else if (rule->tgt_str == CIL_KEY_OTHER) {
rule->tgt = db->othertype;
} else {
- rc = cil_resolve_name(current, rule->tgt_str, CIL_SYM_TYPES, args, &tgt_datum);
+ rc = cil_resolve_name(current, rule->tgt_str, CIL_SYM_TYPES, db, &tgt_datum);
if (rc != SEPOL_OK) {
goto exit;
}
rule->tgt = tgt_datum;
}
- rc = cil_resolve_classperms_list(current, rule->classperms, extra_args);
+ rc = cil_resolve_classperms_list(current, rule->classperms, db);
if (rc != SEPOL_OK) {
goto exit;
}
@@ -420,9 +405,8 @@ exit:
return rc;
}
-int cil_resolve_type_rule(struct cil_tree_node *current, void *extra_args)
+int cil_resolve_type_rule(struct cil_tree_node *current, struct cil_db *db)
{
- struct cil_args_resolve *args = extra_args;
struct cil_type_rule *rule = current->data;
struct cil_symtab_datum *src_datum = NULL;
struct cil_symtab_datum *tgt_datum = NULL;
@@ -431,29 +415,29 @@ int cil_resolve_type_rule(struct cil_tree_node *current, void *extra_args)
struct cil_tree_node *result_node = NULL;
int rc = SEPOL_ERR;
- rc = cil_resolve_name(current, rule->src_str, CIL_SYM_TYPES, extra_args, &src_datum);
+ rc = cil_resolve_name(current, rule->src_str, CIL_SYM_TYPES, db, &src_datum);
if (rc != SEPOL_OK) {
goto exit;
}
rule->src = src_datum;
if (rule->tgt_str == CIL_KEY_SELF) {
- rule->tgt = args->db->selftype;
+ rule->tgt = db->selftype;
} else {
- rc = cil_resolve_name(current, rule->tgt_str, CIL_SYM_TYPES, extra_args, &tgt_datum);
+ rc = cil_resolve_name(current, rule->tgt_str, CIL_SYM_TYPES, db, &tgt_datum);
if (rc != SEPOL_OK) {
goto exit;
}
rule->tgt = tgt_datum;
}
- rc = cil_resolve_name(current, rule->obj_str, CIL_SYM_CLASSES, extra_args, &obj_datum);
+ rc = cil_resolve_name(current, rule->obj_str, CIL_SYM_CLASSES, db, &obj_datum);
if (rc != SEPOL_OK) {
goto exit;
}
rule->obj = (struct cil_class*)obj_datum;
- rc = cil_resolve_name(current, rule->result_str, CIL_SYM_TYPES, extra_args, &result_datum);
+ rc = cil_resolve_name(current, rule->result_str, CIL_SYM_TYPES, db, &result_datum);
if (rc != SEPOL_OK) {
goto exit;
}
@@ -473,7 +457,7 @@ exit:
return rc;
}
-int cil_resolve_typeattributeset(struct cil_tree_node *current, void *extra_args)
+int cil_resolve_typeattributeset(struct cil_tree_node *current, struct cil_db *db)
{
struct cil_typeattributeset *attrtypes = current->data;
struct cil_symtab_datum *attr_datum = NULL;
@@ -481,7 +465,7 @@ int cil_resolve_typeattributeset(struct cil_tree_node *current, void *extra_args
struct cil_typeattribute *attr = NULL;
int rc = SEPOL_ERR;
- rc = cil_resolve_name(current, attrtypes->attr_str, CIL_SYM_TYPES, extra_args, &attr_datum);
+ rc = cil_resolve_name(current, attrtypes->attr_str, CIL_SYM_TYPES, db, &attr_datum);
if (rc != SEPOL_OK) {
goto exit;
}
@@ -496,7 +480,7 @@ int cil_resolve_typeattributeset(struct cil_tree_node *current, void *extra_args
attr = (struct cil_typeattribute*)attr_datum;
- rc = cil_resolve_expr(CIL_TYPEATTRIBUTESET, attrtypes->str_expr, &attrtypes->datum_expr, current, extra_args);
+ rc = cil_resolve_expr(CIL_TYPEATTRIBUTESET, attrtypes->str_expr, &attrtypes->datum_expr, current, db);
if (rc != SEPOL_OK) {
goto exit;
}
@@ -513,7 +497,7 @@ exit:
return rc;
}
-static int cil_resolve_expandtypeattribute(struct cil_tree_node *current, void *extra_args)
+static int cil_resolve_expandtypeattribute(struct cil_tree_node *current, struct cil_db *db)
{
struct cil_expandtypeattribute *expandattr = current->data;
struct cil_symtab_datum *attr_datum = NULL;
@@ -525,7 +509,7 @@ static int cil_resolve_expandtypeattribute(struct cil_tree_node *current, void *
cil_list_init(&expandattr->attr_datums, CIL_TYPE);
cil_list_for_each(curr, expandattr->attr_strs) {
- rc = cil_resolve_name(current, (char *)curr->data, CIL_SYM_TYPES, extra_args, &attr_datum);
+ rc = cil_resolve_name(current, (char *)curr->data, CIL_SYM_TYPES, db, &attr_datum);
if (rc != SEPOL_OK) {
goto exit;
}
@@ -547,7 +531,7 @@ exit:
return rc;
}
-static int cil_resolve_aliasactual(struct cil_tree_node *current, void *extra_args, enum cil_flavor flavor, enum cil_flavor alias_flavor)
+static int cil_resolve_aliasactual(struct cil_tree_node *current, struct cil_db *db, enum cil_flavor flavor, enum cil_flavor alias_flavor)
{
int rc = SEPOL_ERR;
enum cil_sym_index sym_index;
@@ -561,7 +545,7 @@ static int cil_resolve_aliasactual(struct cil_tree_node *current, void *extra_ar
goto exit;
}
- rc = cil_resolve_name_keep_aliases(current, aliasactual->alias_str, sym_index, extra_args, &alias_datum);
+ rc = cil_resolve_name_keep_aliases(current, aliasactual->alias_str, sym_index, db, &alias_datum);
if (rc != SEPOL_OK) {
goto exit;
}
@@ -571,7 +555,7 @@ static int cil_resolve_aliasactual(struct cil_tree_node *current, void *extra_ar
goto exit;
}
- rc = cil_resolve_name(current, aliasactual->actual_str, sym_index, extra_args, &actual_datum);
+ rc = cil_resolve_name(current, aliasactual->actual_str, sym_index, db, &actual_datum);
if (rc != SEPOL_OK) {
goto exit;
}
@@ -646,14 +630,14 @@ static int cil_resolve_alias_to_actual(struct cil_tree_node *current, enum cil_f
return SEPOL_OK;
}
-int cil_resolve_typepermissive(struct cil_tree_node *current, void *extra_args)
+int cil_resolve_typepermissive(struct cil_tree_node *current, struct cil_db *db)
{
struct cil_typepermissive *typeperm = current->data;
struct cil_symtab_datum *type_datum = NULL;
struct cil_tree_node *type_node = NULL;
int rc = SEPOL_ERR;
- rc = cil_resolve_name(current, typeperm->type_str, CIL_SYM_TYPES, extra_args, &type_datum);
+ rc = cil_resolve_name(current, typeperm->type_str, CIL_SYM_TYPES, db, &type_datum);
if (rc != SEPOL_OK) {
goto exit;
}
@@ -674,9 +658,8 @@ exit:
return rc;
}
-int cil_resolve_nametypetransition(struct cil_tree_node *current, void *extra_args)
+int cil_resolve_nametypetransition(struct cil_tree_node *current, struct cil_db *db)
{
- struct cil_args_resolve *args = extra_args;
struct cil_nametypetransition *nametypetrans = current->data;
struct cil_symtab_datum *src_datum = NULL;
struct cil_symtab_datum *tgt_datum = NULL;
@@ -686,38 +669,38 @@ int cil_resolve_nametypetransition(struct cil_tree_node *current, void *extra_ar
struct cil_tree_node *result_node = NULL;
int rc = SEPOL_ERR;
- rc = cil_resolve_name(current, nametypetrans->src_str, CIL_SYM_TYPES, extra_args, &src_datum);
+ rc = cil_resolve_name(current, nametypetrans->src_str, CIL_SYM_TYPES, db, &src_datum);
if (rc != SEPOL_OK) {
goto exit;
}
nametypetrans->src = src_datum;
if (nametypetrans->tgt_str == CIL_KEY_SELF) {
- nametypetrans->tgt = args->db->selftype;
+ nametypetrans->tgt = db->selftype;
} else {
- rc = cil_resolve_name(current, nametypetrans->tgt_str, CIL_SYM_TYPES, extra_args, &tgt_datum);
+ rc = cil_resolve_name(current, nametypetrans->tgt_str, CIL_SYM_TYPES, db, &tgt_datum);
if (rc != SEPOL_OK) {
goto exit;
}
nametypetrans->tgt = tgt_datum;
}
- rc = cil_resolve_name(current, nametypetrans->obj_str, CIL_SYM_CLASSES, extra_args, &obj_datum);
+ rc = cil_resolve_name(current, nametypetrans->obj_str, CIL_SYM_CLASSES, db, &obj_datum);
if (rc != SEPOL_OK) {
goto exit;
}
nametypetrans->obj = (struct cil_class*)obj_datum;
- nametypetrans->name = __cil_insert_name(args->db, nametypetrans->name_str, current);
+ nametypetrans->name = __cil_insert_name(db, nametypetrans->name_str, current);
if (nametypetrans->name == NULL) {
- rc = cil_resolve_name(current, nametypetrans->name_str, CIL_SYM_NAMES, extra_args, &name_datum);
+ rc = cil_resolve_name(current, nametypetrans->name_str, CIL_SYM_NAMES, db, &name_datum);
if (rc != SEPOL_OK) {
goto exit;
}
nametypetrans->name = (struct cil_name *)name_datum;
}
- rc = cil_resolve_name(current, nametypetrans->result_str, CIL_SYM_TYPES, extra_args, &result_datum);
+ rc = cil_resolve_name(current, nametypetrans->result_str, CIL_SYM_TYPES, db, &result_datum);
if (rc != SEPOL_OK) {
goto exit;
}
@@ -737,7 +720,7 @@ exit:
return rc;
}
-int cil_resolve_rangetransition(struct cil_tree_node *current, void *extra_args)
+int cil_resolve_rangetransition(struct cil_tree_node *current, struct cil_db *db)
{
struct cil_rangetransition *rangetrans = current->data;
struct cil_symtab_datum *src_datum = NULL;
@@ -746,26 +729,26 @@ int cil_resolve_rangetransition(struct cil_tree_node *current, void *extra_args)
struct cil_symtab_datum *range_datum = NULL;
int rc = SEPOL_ERR;
- rc = cil_resolve_name(current, rangetrans->src_str, CIL_SYM_TYPES, extra_args, &src_datum);
+ rc = cil_resolve_name(current, rangetrans->src_str, CIL_SYM_TYPES, db, &src_datum);
if (rc != SEPOL_OK) {
goto exit;
}
rangetrans->src = src_datum;
- rc = cil_resolve_name(current, rangetrans->exec_str, CIL_SYM_TYPES, extra_args, &exec_datum);
+ rc = cil_resolve_name(current, rangetrans->exec_str, CIL_SYM_TYPES, db, &exec_datum);
if (rc != SEPOL_OK) {
goto exit;
}
rangetrans->exec = exec_datum;
- rc = cil_resolve_name(current, rangetrans->obj_str, CIL_SYM_CLASSES, extra_args, &obj_datum);
+ rc = cil_resolve_name(current, rangetrans->obj_str, CIL_SYM_CLASSES, db, &obj_datum);
if (rc != SEPOL_OK) {
goto exit;
}
rangetrans->obj = (struct cil_class*)obj_datum;
if (rangetrans->range_str != NULL) {
- rc = cil_resolve_name(current, rangetrans->range_str, CIL_SYM_LEVELRANGES, extra_args, &range_datum);
+ rc = cil_resolve_name(current, rangetrans->range_str, CIL_SYM_LEVELRANGES, db, &range_datum);
if (rc != SEPOL_OK) {
goto exit;
}
@@ -773,13 +756,13 @@ int cil_resolve_rangetransition(struct cil_tree_node *current, void *extra_args)
/* This could still be an anonymous levelrange even if range_str is set, if range_str is a param_str*/
if (rangetrans->range->datum.name == NULL) {
- rc = cil_resolve_levelrange(current, rangetrans->range, extra_args);
+ rc = cil_resolve_levelrange(current, rangetrans->range, db);
if (rc != SEPOL_OK) {
goto exit;
}
}
} else {
- rc = cil_resolve_levelrange(current, rangetrans->range, extra_args);
+ rc = cil_resolve_levelrange(current, rangetrans->range, db);
if (rc != SEPOL_OK) {
goto exit;
}
@@ -800,7 +783,7 @@ static int __class_update_perm_values(__attribute__((unused)) hashtab_key_t k, h
return SEPOL_OK;
}
-int cil_resolve_classcommon(struct cil_tree_node *current, void *extra_args)
+int cil_resolve_classcommon(struct cil_tree_node *current, struct cil_db *db)
{
struct cil_class *class = NULL;
struct cil_class *common = NULL;
@@ -809,7 +792,7 @@ int cil_resolve_classcommon(struct cil_tree_node *current, void *extra_args)
struct cil_symtab_datum *common_datum = NULL;
int rc = SEPOL_ERR;
- rc = cil_resolve_name(current, clscom->class_str, CIL_SYM_CLASSES, extra_args, &class_datum);
+ rc = cil_resolve_name(current, clscom->class_str, CIL_SYM_CLASSES, db, &class_datum);
if (rc != SEPOL_OK) {
goto exit;
}
@@ -819,7 +802,7 @@ int cil_resolve_classcommon(struct cil_tree_node *current, void *extra_args)
goto exit;
}
- rc = cil_resolve_name(current, clscom->common_str, CIL_SYM_COMMONS, extra_args, &common_datum);
+ rc = cil_resolve_name(current, clscom->common_str, CIL_SYM_COMMONS, db, &common_datum);
if (rc != SEPOL_OK) {
goto exit;
}
@@ -849,7 +832,7 @@ exit:
return rc;
}
-int cil_resolve_classmapping(struct cil_tree_node *current, void *extra_args)
+int cil_resolve_classmapping(struct cil_tree_node *current, struct cil_db *db)
{
int rc = SEPOL_ERR;
struct cil_classmapping *mapping = current->data;
@@ -858,7 +841,7 @@ int cil_resolve_classmapping(struct cil_tree_node *current, void *extra_args)
struct cil_symtab_datum *datum = NULL;
struct cil_list_item *curr;
- rc = cil_resolve_name(current, mapping->map_class_str, CIL_SYM_CLASSES, extra_args, &datum);
+ rc = cil_resolve_name(current, mapping->map_class_str, CIL_SYM_CLASSES, db, &datum);
if (rc != SEPOL_OK) {
goto exit;
}
@@ -871,7 +854,7 @@ int cil_resolve_classmapping(struct cil_tree_node *current, void *extra_args)
mp = (struct cil_perm*)datum;
- rc = cil_resolve_classperms_list(current, mapping->classperms, extra_args);
+ rc = cil_resolve_classperms_list(current, mapping->classperms, db);
if (rc != SEPOL_OK) {
goto exit;
}
@@ -890,20 +873,20 @@ exit:
return rc;
}
-int cil_resolve_userrole(struct cil_tree_node *current, void *extra_args)
+int cil_resolve_userrole(struct cil_tree_node *current, struct cil_db *db)
{
struct cil_userrole *userrole = current->data;
struct cil_symtab_datum *user_datum = NULL;
struct cil_symtab_datum *role_datum = NULL;
int rc = SEPOL_ERR;
- rc = cil_resolve_name(current, userrole->user_str, CIL_SYM_USERS, extra_args, &user_datum);
+ rc = cil_resolve_name(current, userrole->user_str, CIL_SYM_USERS, db, &user_datum);
if (rc != SEPOL_OK) {
goto exit;
}
userrole->user = (struct cil_user*)user_datum;
- rc = cil_resolve_name(current, userrole->role_str, CIL_SYM_ROLES, extra_args, &role_datum);
+ rc = cil_resolve_name(current, userrole->role_str, CIL_SYM_ROLES, db, &role_datum);
if (rc != SEPOL_OK) {
goto exit;
}
@@ -915,7 +898,7 @@ exit:
return rc;
}
-int cil_resolve_userlevel(struct cil_tree_node *current, void *extra_args)
+int cil_resolve_userlevel(struct cil_tree_node *current, struct cil_db *db)
{
struct cil_userlevel *usrlvl = current->data;
struct cil_symtab_datum *user_datum = NULL;
@@ -924,7 +907,7 @@ int cil_resolve_userlevel(struct cil_tree_node *current, void *extra_args)
struct cil_tree_node *user_node = NULL;
int rc = SEPOL_ERR;
- rc = cil_resolve_name(current, usrlvl->user_str, CIL_SYM_USERS, extra_args, &user_datum);
+ rc = cil_resolve_name(current, usrlvl->user_str, CIL_SYM_USERS, db, &user_datum);
if (rc != SEPOL_OK) {
goto exit;
}
@@ -940,7 +923,7 @@ int cil_resolve_userlevel(struct cil_tree_node *current, void *extra_args)
user = (struct cil_user*)user_datum;
if (usrlvl->level_str != NULL) {
- rc = cil_resolve_name(current, usrlvl->level_str, CIL_SYM_LEVELS, extra_args, &lvl_datum);
+ rc = cil_resolve_name(current, usrlvl->level_str, CIL_SYM_LEVELS, db, &lvl_datum);
if (rc != SEPOL_OK) {
goto exit;
}
@@ -949,13 +932,13 @@ int cil_resolve_userlevel(struct cil_tree_node *current, void *extra_args)
/* This could still be an anonymous level even if level_str is set, if level_str is a param_str*/
if (user->dftlevel->datum.name == NULL) {
- rc = cil_resolve_level(current, user->dftlevel, extra_args);
+ rc = cil_resolve_level(current, user->dftlevel, db);
if (rc != SEPOL_OK) {
goto exit;
}
}
} else if (usrlvl->level != NULL) {
- rc = cil_resolve_level(current, usrlvl->level, extra_args);
+ rc = cil_resolve_level(current, usrlvl->level, db);
if (rc != SEPOL_OK) {
goto exit;
}
@@ -968,7 +951,7 @@ exit:
return rc;
}
-int cil_resolve_userrange(struct cil_tree_node *current, void *extra_args)
+int cil_resolve_userrange(struct cil_tree_node *current, struct cil_db *db)
{
struct cil_userrange *userrange = current->data;
struct cil_symtab_datum *user_datum = NULL;
@@ -977,7 +960,7 @@ int cil_resolve_userrange(struct cil_tree_node *current, void *extra_args)
struct cil_tree_node *user_node = NULL;
int rc = SEPOL_ERR;
- rc = cil_resolve_name(current, userrange->user_str, CIL_SYM_USERS, extra_args, &user_datum);
+ rc = cil_resolve_name(current, userrange->user_str, CIL_SYM_USERS, db, &user_datum);
if (rc != SEPOL_OK) {
goto exit;
}
@@ -993,7 +976,7 @@ int cil_resolve_userrange(struct cil_tree_node *current, void *extra_args)
user = (struct cil_user*)user_datum;
if (userrange->range_str != NULL) {
- rc = cil_resolve_name(current, userrange->range_str, CIL_SYM_LEVELRANGES, extra_args, &range_datum);
+ rc = cil_resolve_name(current, userrange->range_str, CIL_SYM_LEVELRANGES, db, &range_datum);
if (rc != SEPOL_OK) {
goto exit;
}
@@ -1002,13 +985,13 @@ int cil_resolve_userrange(struct cil_tree_node *current, void *extra_args)
/* This could still be an anonymous levelrange even if levelrange_str is set, if levelrange_str is a param_str*/
if (user->range->datum.name == NULL) {
- rc = cil_resolve_levelrange(current, user->range, extra_args);
+ rc = cil_resolve_levelrange(current, user->range, db);
if (rc != SEPOL_OK) {
goto exit;
}
}
} else if (userrange->range != NULL) {
- rc = cil_resolve_levelrange(current, userrange->range, extra_args);
+ rc = cil_resolve_levelrange(current, userrange->range, db);
if (rc != SEPOL_OK) {
goto exit;
}
@@ -1021,14 +1004,14 @@ exit:
return rc;
}
-int cil_resolve_userprefix(struct cil_tree_node *current, void *extra_args)
+int cil_resolve_userprefix(struct cil_tree_node *current, struct cil_db *db)
{
struct cil_userprefix *userprefix = current->data;
struct cil_symtab_datum *user_datum = NULL;
struct cil_tree_node *user_node = NULL;
int rc = SEPOL_ERR;
- rc = cil_resolve_name(current, userprefix->user_str, CIL_SYM_USERS, extra_args, &user_datum);
+ rc = cil_resolve_name(current, userprefix->user_str, CIL_SYM_USERS, db, &user_datum);
if (rc != SEPOL_OK) {
goto exit;
}
@@ -1047,7 +1030,7 @@ exit:
return rc;
}
-int cil_resolve_selinuxuser(struct cil_tree_node *current, void *extra_args)
+int cil_resolve_selinuxuser(struct cil_tree_node *current, struct cil_db *db)
{
struct cil_selinuxuser *selinuxuser = current->data;
struct cil_symtab_datum *user_datum = NULL;
@@ -1055,7 +1038,7 @@ int cil_resolve_selinuxuser(struct cil_tree_node *current, void *extra_args)
struct cil_tree_node *user_node = NULL;
int rc = SEPOL_ERR;
- rc = cil_resolve_name(current, selinuxuser->user_str, CIL_SYM_USERS, extra_args, &user_datum);
+ rc = cil_resolve_name(current, selinuxuser->user_str, CIL_SYM_USERS, db, &user_datum);
if (rc != SEPOL_OK) {
goto exit;
}
@@ -1071,7 +1054,7 @@ int cil_resolve_selinuxuser(struct cil_tree_node *current, void *extra_args)
selinuxuser->user = (struct cil_user*)user_datum;
if (selinuxuser->range_str != NULL) {
- rc = cil_resolve_name(current, selinuxuser->range_str, CIL_SYM_LEVELRANGES, extra_args, &lvlrange_datum);
+ rc = cil_resolve_name(current, selinuxuser->range_str, CIL_SYM_LEVELRANGES, db, &lvlrange_datum);
if (rc != SEPOL_OK) {
goto exit;
}
@@ -1079,13 +1062,13 @@ int cil_resolve_selinuxuser(struct cil_tree_node *current, void *extra_args)
/* This could still be an anonymous levelrange even if range_str is set, if range_str is a param_str*/
if (selinuxuser->range->datum.name == NULL) {
- rc = cil_resolve_levelrange(current, selinuxuser->range, extra_args);
+ rc = cil_resolve_levelrange(current, selinuxuser->range, db);
if (rc != SEPOL_OK) {
goto exit;
}
}
} else if (selinuxuser->range != NULL) {
- rc = cil_resolve_levelrange(current, selinuxuser->range, extra_args);
+ rc = cil_resolve_levelrange(current, selinuxuser->range, db);
if (rc != SEPOL_OK) {
goto exit;
}
@@ -1096,20 +1079,20 @@ exit:
return rc;
}
-int cil_resolve_roletype(struct cil_tree_node *current, void *extra_args)
+int cil_resolve_roletype(struct cil_tree_node *current, struct cil_db *db)
{
struct cil_roletype *roletype = current->data;
struct cil_symtab_datum *role_datum = NULL;
struct cil_symtab_datum *type_datum = NULL;
int rc = SEPOL_ERR;
- rc = cil_resolve_name(current, roletype->role_str, CIL_SYM_ROLES, extra_args, &role_datum);
+ rc = cil_resolve_name(current, roletype->role_str, CIL_SYM_ROLES, db, &role_datum);
if (rc != SEPOL_OK) {
goto exit;
}
roletype->role = (struct cil_role*)role_datum;
- rc = cil_resolve_name(current, roletype->type_str, CIL_SYM_TYPES, extra_args, &type_datum);
+ rc = cil_resolve_name(current, roletype->type_str, CIL_SYM_TYPES, db, &type_datum);
if (rc != SEPOL_OK) {
goto exit;
}
@@ -1121,7 +1104,7 @@ exit:
return rc;
}
-int cil_resolve_roletransition(struct cil_tree_node *current, void *extra_args)
+int cil_resolve_roletransition(struct cil_tree_node *current, struct cil_db *db)
{
struct cil_roletransition *roletrans = current->data;
struct cil_symtab_datum *src_datum = NULL;
@@ -1131,25 +1114,25 @@ int cil_resolve_roletransition(struct cil_tree_node *current, void *extra_args)
struct cil_tree_node *node = NULL;
int rc = SEPOL_ERR;
- rc = cil_resolve_name(current, roletrans->src_str, CIL_SYM_ROLES, extra_args, &src_datum);
+ rc = cil_resolve_name(current, roletrans->src_str, CIL_SYM_ROLES, db, &src_datum);
if (rc != SEPOL_OK) {
goto exit;
}
roletrans->src = (struct cil_role*)src_datum;
- rc = cil_resolve_name(current, roletrans->tgt_str, CIL_SYM_TYPES, extra_args, &tgt_datum);
+ rc = cil_resolve_name(current, roletrans->tgt_str, CIL_SYM_TYPES, db, &tgt_datum);
if (rc != SEPOL_OK) {
goto exit;
}
roletrans->tgt = tgt_datum;
- rc = cil_resolve_name(current, roletrans->obj_str, CIL_SYM_CLASSES, extra_args, &obj_datum);
+ rc = cil_resolve_name(current, roletrans->obj_str, CIL_SYM_CLASSES, db, &obj_datum);
if (rc != SEPOL_OK) {
goto exit;
}
roletrans->obj = (struct cil_class*)obj_datum;
- rc = cil_resolve_name(current, roletrans->result_str, CIL_SYM_ROLES, extra_args, &result_datum);
+ rc = cil_resolve_name(current, roletrans->result_str, CIL_SYM_ROLES, db, &result_datum);
if (rc != SEPOL_OK) {
goto exit;
}
@@ -1167,20 +1150,20 @@ exit:
return rc;
}
-int cil_resolve_roleallow(struct cil_tree_node *current, void *extra_args)
+int cil_resolve_roleallow(struct cil_tree_node *current, struct cil_db *db)
{
struct cil_roleallow *roleallow = current->data;
struct cil_symtab_datum *src_datum = NULL;
struct cil_symtab_datum *tgt_datum = NULL;
int rc = SEPOL_ERR;
- rc = cil_resolve_name(current, roleallow->src_str, CIL_SYM_ROLES, extra_args, &src_datum);
+ rc = cil_resolve_name(current, roleallow->src_str, CIL_SYM_ROLES, db, &src_datum);
if (rc != SEPOL_OK) {
goto exit;
}
roleallow->src = (struct cil_role*)src_datum;
- rc = cil_resolve_name(current, roleallow->tgt_str, CIL_SYM_ROLES, extra_args, &tgt_datum);
+ rc = cil_resolve_name(current, roleallow->tgt_str, CIL_SYM_ROLES, db, &tgt_datum);
if (rc != SEPOL_OK) {
goto exit;
}
@@ -1192,7 +1175,7 @@ exit:
return rc;
}
-int cil_resolve_roleattributeset(struct cil_tree_node *current, void *extra_args)
+int cil_resolve_roleattributeset(struct cil_tree_node *current, struct cil_db *db)
{
int rc = SEPOL_ERR;
struct cil_roleattributeset *attrroles = current->data;
@@ -1200,7 +1183,7 @@ int cil_resolve_roleattributeset(struct cil_tree_node *current, void *extra_args
struct cil_tree_node *attr_node = NULL;
struct cil_roleattribute *attr = NULL;
- rc = cil_resolve_name(current, attrroles->attr_str, CIL_SYM_ROLES, extra_args, &attr_datum);
+ rc = cil_resolve_name(current, attrroles->attr_str, CIL_SYM_ROLES, db, &attr_datum);
if (rc != SEPOL_OK) {
goto exit;
}
@@ -1213,7 +1196,7 @@ int cil_resolve_roleattributeset(struct cil_tree_node *current, void *extra_args
}
attr = (struct cil_roleattribute*)attr_datum;
- rc = cil_resolve_expr(CIL_ROLEATTRIBUTESET, attrroles->str_expr, &attrroles->datum_expr, current, extra_args);
+ rc = cil_resolve_expr(CIL_ROLEATTRIBUTESET, attrroles->str_expr, &attrroles->datum_expr, current, db);
if (rc != SEPOL_OK) {
goto exit;
}
@@ -1523,11 +1506,8 @@ exit:
return NULL;
}
-int cil_resolve_classorder(struct cil_tree_node *current, void *extra_args)
+int cil_resolve_classorder(struct cil_tree_node *current, struct cil_db *db, struct cil_list *classorder_list, struct cil_list *unordered_classorder_list)
{
- struct cil_args_resolve *args = extra_args;
- struct cil_list *classorder_list = args->classorder_lists;
- struct cil_list *unordered_classorder_list = args->unordered_classorder_lists;
struct cil_classorder *classorder = current->data;
struct cil_list *new = NULL;
struct cil_list_item *curr = NULL;
@@ -1544,7 +1524,7 @@ int cil_resolve_classorder(struct cil_tree_node *current, void *extra_args)
continue;
}
- rc = cil_resolve_name(current, (char *)curr->data, CIL_SYM_CLASSES, extra_args, &datum);
+ rc = cil_resolve_name(current, (char *)curr->data, CIL_SYM_CLASSES, db, &datum);
if (rc != SEPOL_OK) {
cil_log(CIL_ERR, "Failed to resolve class %s in classorder\n", (char *)curr->data);
rc = SEPOL_ERR;
@@ -1574,10 +1554,8 @@ exit:
return rc;
}
-int cil_resolve_sidorder(struct cil_tree_node *current, void *extra_args)
+int cil_resolve_sidorder(struct cil_tree_node *current, struct cil_db *db, struct cil_list *sidorder_list)
{
- struct cil_args_resolve *args = extra_args;
- struct cil_list *sidorder_list = args->sidorder_lists;
struct cil_sidorder *sidorder = current->data;
struct cil_list *new = NULL;
struct cil_list_item *curr = NULL;
@@ -1588,7 +1566,7 @@ int cil_resolve_sidorder(struct cil_tree_node *current, void *extra_args)
cil_list_init(&new, CIL_SIDORDER);
cil_list_for_each(curr, sidorder->sid_list_str) {
- rc = cil_resolve_name(current, (char *)curr->data, CIL_SYM_SIDS, extra_args, &datum);
+ rc = cil_resolve_name(current, (char *)curr->data, CIL_SYM_SIDS, db, &datum);
if (rc != SEPOL_OK) {
cil_log(CIL_ERR, "Failed to resolve sid %s in sidorder\n", (char *)curr->data);
goto exit;
@@ -1628,10 +1606,8 @@ static void cil_set_cat_values(struct cil_list *ordered_cats, struct cil_db *db)
db->num_cats = v;
}
-int cil_resolve_catorder(struct cil_tree_node *current, void *extra_args)
+int cil_resolve_catorder(struct cil_tree_node *current, struct cil_db *db, struct cil_list *catorder_list)
{
- struct cil_args_resolve *args = extra_args;
- struct cil_list *catorder_list = args->catorder_lists;
struct cil_catorder *catorder = current->data;
struct cil_list *new = NULL;
struct cil_list_item *curr = NULL;
@@ -1644,7 +1620,7 @@ int cil_resolve_catorder(struct cil_tree_node *current, void *extra_args)
cil_list_for_each(curr, catorder->cat_list_str) {
struct cil_tree_node *node = NULL;
- rc = cil_resolve_name(current, (char *)curr->data, CIL_SYM_CATS, extra_args, &cat_datum);
+ rc = cil_resolve_name(current, (char *)curr->data, CIL_SYM_CATS, db, &cat_datum);
if (rc != SEPOL_OK) {
cil_log(CIL_ERR, "Failed to resolve category %s in categoryorder\n", (char *)curr->data);
goto exit;
@@ -1671,10 +1647,8 @@ exit:
return rc;
}
-int cil_resolve_sensitivityorder(struct cil_tree_node *current, void *extra_args)
+int cil_resolve_sensitivityorder(struct cil_tree_node *current, struct cil_db *db, struct cil_list *sensitivityorder_list)
{
- struct cil_args_resolve *args = extra_args;
- struct cil_list *sensitivityorder_list = args->sensitivityorder_lists;
struct cil_sensorder *sensorder = current->data;
struct cil_list *new = NULL;
struct cil_list_item *curr = NULL;
@@ -1685,7 +1659,7 @@ int cil_resolve_sensitivityorder(struct cil_tree_node *current, void *extra_args
cil_list_init(&new, CIL_LIST_ITEM);
cil_list_for_each(curr, sensorder->sens_list_str) {
- rc = cil_resolve_name(current, (char *)curr->data, CIL_SYM_SENS, extra_args, &datum);
+ rc = cil_resolve_name(current, (char *)curr->data, CIL_SYM_SENS, db, &datum);
if (rc != SEPOL_OK) {
cil_log(CIL_ERR, "Failed to resolve sensitivity %s in sensitivityorder\n", (char *)curr->data);
goto exit;
@@ -1710,11 +1684,11 @@ exit:
return rc;
}
-static int cil_resolve_cats(struct cil_tree_node *current, struct cil_cats *cats, void *extra_args)
+static int cil_resolve_cats(struct cil_tree_node *current, struct cil_cats *cats, struct cil_db *db)
{
int rc = SEPOL_ERR;
- rc = cil_resolve_expr(CIL_CATSET, cats->str_expr, &cats->datum_expr, current, extra_args);
+ rc = cil_resolve_expr(CIL_CATSET, cats->str_expr, &cats->datum_expr, current, db);
if (rc != SEPOL_OK) {
goto exit;
}
@@ -1726,25 +1700,25 @@ exit:
}
-int cil_resolve_catset(struct cil_tree_node *current, struct cil_catset *catset, void *extra_args)
+int cil_resolve_catset(struct cil_tree_node *current, struct cil_catset *catset, struct cil_db *db)
{
- return cil_resolve_cats(current, catset->cats, extra_args);
+ return cil_resolve_cats(current, catset->cats, db);
}
-int cil_resolve_senscat(struct cil_tree_node *current, void *extra_args)
+int cil_resolve_senscat(struct cil_tree_node *current, struct cil_db *db)
{
int rc = SEPOL_ERR;
struct cil_senscat *senscat = current->data;
struct cil_symtab_datum *sens_datum;
struct cil_sens *sens = NULL;
- rc = cil_resolve_name(current, (char*)senscat->sens_str, CIL_SYM_SENS, extra_args, &sens_datum);
+ rc = cil_resolve_name(current, (char*)senscat->sens_str, CIL_SYM_SENS, db, &sens_datum);
if (rc != SEPOL_OK) {
cil_log(CIL_ERR, "Failed to find sensitivity\n");
goto exit;
}
- rc = cil_resolve_cats(current, senscat->cats, extra_args);
+ rc = cil_resolve_cats(current, senscat->cats, db);
if (rc != SEPOL_OK) {
goto exit;
}
@@ -1763,7 +1737,7 @@ exit:
return rc;
}
-int cil_resolve_level(struct cil_tree_node *current, struct cil_level *level, void *extra_args)
+int cil_resolve_level(struct cil_tree_node *current, struct cil_level *level, struct cil_db *db)
{
struct cil_symtab_datum *sens_datum = NULL;
int rc = SEPOL_ERR;
@@ -1772,7 +1746,7 @@ int cil_resolve_level(struct cil_tree_node *current, struct cil_level *level, vo
return SEPOL_OK;
}
- rc = cil_resolve_name(current, (char*)level->sens_str, CIL_SYM_SENS, extra_args, &sens_datum);
+ rc = cil_resolve_name(current, (char*)level->sens_str, CIL_SYM_SENS, db, &sens_datum);
if (rc != SEPOL_OK) {
cil_log(CIL_ERR, "Failed to find sensitivity\n");
goto exit;
@@ -1781,7 +1755,7 @@ int cil_resolve_level(struct cil_tree_node *current, struct cil_level *level, vo
level->sens = (struct cil_sens *)sens_datum;
if (level->cats != NULL) {
- rc = cil_resolve_cats(current, level->cats, extra_args);
+ rc = cil_resolve_cats(current, level->cats, db);
if (rc != SEPOL_OK) {
goto exit;
}
@@ -1793,14 +1767,14 @@ exit:
return rc;
}
-int cil_resolve_levelrange(struct cil_tree_node *current, struct cil_levelrange *lvlrange, void *extra_args)
+int cil_resolve_levelrange(struct cil_tree_node *current, struct cil_levelrange *lvlrange, struct cil_db *db)
{
struct cil_symtab_datum *low_datum = NULL;
struct cil_symtab_datum *high_datum = NULL;
int rc = SEPOL_ERR;
if (lvlrange->low_str != NULL) {
- rc = cil_resolve_name(current, lvlrange->low_str, CIL_SYM_LEVELS, extra_args, &low_datum);
+ rc = cil_resolve_name(current, lvlrange->low_str, CIL_SYM_LEVELS, db, &low_datum);
if (rc != SEPOL_OK) {
goto exit;
}
@@ -1808,20 +1782,20 @@ int cil_resolve_levelrange(struct cil_tree_node *current, struct cil_levelrange
/* This could still be an anonymous level even if low_str is set, if low_str is a param_str */
if (lvlrange->low->datum.name == NULL) {
- rc = cil_resolve_level(current, lvlrange->low, extra_args);
+ rc = cil_resolve_level(current, lvlrange->low, db);
if (rc != SEPOL_OK) {
goto exit;
}
}
} else if (lvlrange->low != NULL) {
- rc = cil_resolve_level(current, lvlrange->low, extra_args);
+ rc = cil_resolve_level(current, lvlrange->low, db);
if (rc != SEPOL_OK) {
goto exit;
}
}
if (lvlrange->high_str != NULL) {
- rc = cil_resolve_name(current, lvlrange->high_str, CIL_SYM_LEVELS, extra_args, &high_datum);
+ rc = cil_resolve_name(current, lvlrange->high_str, CIL_SYM_LEVELS, db, &high_datum);
if (rc != SEPOL_OK) {
goto exit;
}
@@ -1829,13 +1803,13 @@ int cil_resolve_levelrange(struct cil_tree_node *current, struct cil_levelrange
/* This could still be an anonymous level even if high_str is set, if high_str is a param_str */
if (lvlrange->high->datum.name == NULL) {
- rc = cil_resolve_level(current, lvlrange->high, extra_args);
+ rc = cil_resolve_level(current, lvlrange->high, db);
if (rc != SEPOL_OK) {
goto exit;
}
}
} else if (lvlrange->high != NULL) {
- rc = cil_resolve_level(current, lvlrange->high, extra_args);
+ rc = cil_resolve_level(current, lvlrange->high, db);
if (rc != SEPOL_OK) {
goto exit;
}
@@ -1847,17 +1821,17 @@ exit:
return rc;
}
-int cil_resolve_constrain(struct cil_tree_node *current, void *extra_args)
+int cil_resolve_constrain(struct cil_tree_node *current, struct cil_db *db)
{
struct cil_constrain *cons = current->data;
int rc = SEPOL_ERR;
- rc = cil_resolve_classperms_list(current, cons->classperms, extra_args);
+ rc = cil_resolve_classperms_list(current, cons->classperms, db);
if (rc != SEPOL_OK) {
goto exit;
}
- rc = cil_resolve_expr(CIL_CONSTRAIN, cons->str_expr, &cons->datum_expr, current, extra_args);
+ rc = cil_resolve_expr(CIL_CONSTRAIN, cons->str_expr, &cons->datum_expr, current, db);
if (rc != SEPOL_OK) {
goto exit;
}
@@ -1868,20 +1842,19 @@ exit:
return rc;
}
-int cil_resolve_validatetrans(struct cil_tree_node *current, void *extra_args)
+int cil_resolve_validatetrans(struct cil_tree_node *current, struct cil_db *db)
{
struct cil_validatetrans *validtrans = current->data;
- struct cil_args_resolve *args = extra_args;
struct cil_symtab_datum *class_datum = NULL;
int rc = SEPOL_ERR;
- rc = cil_resolve_name(current, validtrans->class_str, CIL_SYM_CLASSES, args, &class_datum);
+ rc = cil_resolve_name(current, validtrans->class_str, CIL_SYM_CLASSES, db, &class_datum);
if (rc != SEPOL_OK) {
goto exit;
}
validtrans->class = (struct cil_class*)class_datum;
- rc = cil_resolve_expr(CIL_VALIDATETRANS, validtrans->str_expr, &validtrans->datum_expr, current, extra_args);
+ rc = cil_resolve_expr(CIL_VALIDATETRANS, validtrans->str_expr, &validtrans->datum_expr, current, db);
if (rc != SEPOL_OK) {
goto exit;
}
@@ -1892,7 +1865,7 @@ exit:
return rc;
}
-int cil_resolve_context(struct cil_tree_node *current, struct cil_context *context, void *extra_args)
+int cil_resolve_context(struct cil_tree_node *current, struct cil_context *context, struct cil_db *db)
{
struct cil_symtab_datum *user_datum = NULL;
struct cil_symtab_datum *role_datum = NULL;
@@ -1902,7 +1875,7 @@ int cil_resolve_context(struct cil_tree_node *current, struct cil_context *conte
int rc = SEPOL_ERR;
- rc = cil_resolve_name(current, context->user_str, CIL_SYM_USERS, extra_args, &user_datum);
+ rc = cil_resolve_name(current, context->user_str, CIL_SYM_USERS, db, &user_datum);
if (rc != SEPOL_OK) {
goto exit;
}
@@ -1917,7 +1890,7 @@ int cil_resolve_context(struct cil_tree_node *current, struct cil_context *conte
context->user = (struct cil_user*)user_datum;
- rc = cil_resolve_name(current, context->role_str, CIL_SYM_ROLES, extra_args, &role_datum);
+ rc = cil_resolve_name(current, context->role_str, CIL_SYM_ROLES, db, &role_datum);
if (rc != SEPOL_OK) {
goto exit;
}
@@ -1931,7 +1904,7 @@ int cil_resolve_context(struct cil_tree_node *current, struct cil_context *conte
context->role = (struct cil_role*)role_datum;
- rc = cil_resolve_name(current, context->type_str, CIL_SYM_TYPES, extra_args, &type_datum);
+ rc = cil_resolve_name(current, context->type_str, CIL_SYM_TYPES, db, &type_datum);
if (rc != SEPOL_OK) {
goto exit;
}
@@ -1946,7 +1919,7 @@ int cil_resolve_context(struct cil_tree_node *current, struct cil_context *conte
context->type = type_datum;
if (context->range_str != NULL) {
- rc = cil_resolve_name(current, context->range_str, CIL_SYM_LEVELRANGES, extra_args, &lvlrange_datum);
+ rc = cil_resolve_name(current, context->range_str, CIL_SYM_LEVELRANGES, db, &lvlrange_datum);
if (rc != SEPOL_OK) {
goto exit;
}
@@ -1954,13 +1927,13 @@ int cil_resolve_context(struct cil_tree_node *current, struct cil_context *conte
/* This could still be an anonymous levelrange even if levelrange_str is set, if levelrange_str is a param_str*/
if (context->range->datum.name == NULL) {
- rc = cil_resolve_levelrange(current, context->range, extra_args);
+ rc = cil_resolve_levelrange(current, context->range, db);
if (rc != SEPOL_OK) {
goto exit;
}
}
} else if (context->range != NULL) {
- rc = cil_resolve_levelrange(current, context->range, extra_args);
+ rc = cil_resolve_levelrange(current, context->range, db);
if (rc != SEPOL_OK) {
goto exit;
}
@@ -1972,20 +1945,20 @@ exit:
return rc;
}
-int cil_resolve_filecon(struct cil_tree_node *current, void *extra_args)
+int cil_resolve_filecon(struct cil_tree_node *current, struct cil_db *db)
{
struct cil_filecon *filecon = current->data;
struct cil_symtab_datum *context_datum = NULL;
int rc = SEPOL_ERR;
if (filecon->context_str != NULL) {
- rc = cil_resolve_name(current, filecon->context_str, CIL_SYM_CONTEXTS, extra_args, &context_datum);
+ rc = cil_resolve_name(current, filecon->context_str, CIL_SYM_CONTEXTS, db, &context_datum);
if (rc != SEPOL_OK) {
return rc;
}
filecon->context = (struct cil_context*)context_datum;
} else if (filecon->context != NULL) {
- rc = cil_resolve_context(current, filecon->context, extra_args);
+ rc = cil_resolve_context(current, filecon->context, db);
if (rc != SEPOL_OK) {
return rc;
}
@@ -1994,20 +1967,20 @@ int cil_resolve_filecon(struct cil_tree_node *current, void *extra_args)
return SEPOL_OK;
}
-int cil_resolve_ibpkeycon(struct cil_tree_node *current, void *extra_args)
+int cil_resolve_ibpkeycon(struct cil_tree_node *current, struct cil_db *db)
{
struct cil_ibpkeycon *ibpkeycon = current->data;
struct cil_symtab_datum *context_datum = NULL;
int rc = SEPOL_ERR;
if (ibpkeycon->context_str) {
- rc = cil_resolve_name(current, ibpkeycon->context_str, CIL_SYM_CONTEXTS, extra_args, &context_datum);
+ rc = cil_resolve_name(current, ibpkeycon->context_str, CIL_SYM_CONTEXTS, db, &context_datum);
if (rc != SEPOL_OK)
goto exit;
ibpkeycon->context = (struct cil_context *)context_datum;
} else {
- rc = cil_resolve_context(current, ibpkeycon->context, extra_args);
+ rc = cil_resolve_context(current, ibpkeycon->context, db);
if (rc != SEPOL_OK)
goto exit;
}
@@ -2018,20 +1991,20 @@ exit:
return rc;
}
-int cil_resolve_portcon(struct cil_tree_node *current, void *extra_args)
+int cil_resolve_portcon(struct cil_tree_node *current, struct cil_db *db)
{
struct cil_portcon *portcon = current->data;
struct cil_symtab_datum *context_datum = NULL;
int rc = SEPOL_ERR;
if (portcon->context_str != NULL) {
- rc = cil_resolve_name(current, portcon->context_str, CIL_SYM_CONTEXTS, extra_args, &context_datum);
+ rc = cil_resolve_name(current, portcon->context_str, CIL_SYM_CONTEXTS, db, &context_datum);
if (rc != SEPOL_OK) {
goto exit;
}
portcon->context = (struct cil_context*)context_datum;
} else {
- rc = cil_resolve_context(current, portcon->context, extra_args);
+ rc = cil_resolve_context(current, portcon->context, db);
if (rc != SEPOL_OK) {
goto exit;
}
@@ -2043,20 +2016,20 @@ exit:
return rc;
}
-int cil_resolve_genfscon(struct cil_tree_node *current, void *extra_args)
+int cil_resolve_genfscon(struct cil_tree_node *current, struct cil_db *db)
{
struct cil_genfscon *genfscon = current->data;
struct cil_symtab_datum *context_datum = NULL;
int rc = SEPOL_ERR;
if (genfscon->context_str != NULL) {
- rc = cil_resolve_name(current, genfscon->context_str, CIL_SYM_CONTEXTS, extra_args, &context_datum);
+ rc = cil_resolve_name(current, genfscon->context_str, CIL_SYM_CONTEXTS, db, &context_datum);
if (rc != SEPOL_OK) {
goto exit;
}
genfscon->context = (struct cil_context*)context_datum;
} else {
- rc = cil_resolve_context(current, genfscon->context, extra_args);
+ rc = cil_resolve_context(current, genfscon->context, db);
if (rc != SEPOL_OK) {
goto exit;
}
@@ -2068,7 +2041,7 @@ exit:
return rc;
}
-int cil_resolve_nodecon(struct cil_tree_node *current, void *extra_args)
+int cil_resolve_nodecon(struct cil_tree_node *current, struct cil_db *db)
{
struct cil_nodecon *nodecon = current->data;
struct cil_symtab_datum *addr_datum = NULL;
@@ -2077,7 +2050,7 @@ int cil_resolve_nodecon(struct cil_tree_node *current, void *extra_args)
int rc = SEPOL_ERR;
if (nodecon->addr_str != NULL) {
- rc = cil_resolve_name(current, nodecon->addr_str, CIL_SYM_IPADDRS, extra_args, &addr_datum);
+ rc = cil_resolve_name(current, nodecon->addr_str, CIL_SYM_IPADDRS, db, &addr_datum);
if (rc != SEPOL_OK) {
goto exit;
}
@@ -2085,7 +2058,7 @@ int cil_resolve_nodecon(struct cil_tree_node *current, void *extra_args)
}
if (nodecon->mask_str != NULL) {
- rc = cil_resolve_name(current, nodecon->mask_str, CIL_SYM_IPADDRS, extra_args, &mask_datum);
+ rc = cil_resolve_name(current, nodecon->mask_str, CIL_SYM_IPADDRS, db, &mask_datum);
if (rc != SEPOL_OK) {
goto exit;
}
@@ -2093,13 +2066,13 @@ int cil_resolve_nodecon(struct cil_tree_node *current, void *extra_args)
}
if (nodecon->context_str != NULL) {
- rc = cil_resolve_name(current, nodecon->context_str, CIL_SYM_CONTEXTS, extra_args, &context_datum);
+ rc = cil_resolve_name(current, nodecon->context_str, CIL_SYM_CONTEXTS, db, &context_datum);
if (rc != SEPOL_OK) {
goto exit;
}
nodecon->context = (struct cil_context*)context_datum;
} else {
- rc = cil_resolve_context(current, nodecon->context, extra_args);
+ rc = cil_resolve_context(current, nodecon->context, db);
if (rc != SEPOL_OK) {
goto exit;
}
@@ -2118,7 +2091,7 @@ exit:
return rc;
}
-int cil_resolve_netifcon(struct cil_tree_node *current, void *extra_args)
+int cil_resolve_netifcon(struct cil_tree_node *current, struct cil_db *db)
{
struct cil_netifcon *netifcon = current->data;
struct cil_symtab_datum *ifcon_datum = NULL;
@@ -2127,26 +2100,26 @@ int cil_resolve_netifcon(struct cil_tree_node *current, void *extra_args)
int rc = SEPOL_ERR;
if (netifcon->if_context_str != NULL) {
- rc = cil_resolve_name(current, netifcon->if_context_str, CIL_SYM_CONTEXTS, extra_args, &ifcon_datum);
+ rc = cil_resolve_name(current, netifcon->if_context_str, CIL_SYM_CONTEXTS, db, &ifcon_datum);
if (rc != SEPOL_OK) {
goto exit;
}
netifcon->if_context = (struct cil_context*)ifcon_datum;
} else {
- rc = cil_resolve_context(current, netifcon->if_context, extra_args);
+ rc = cil_resolve_context(current, netifcon->if_context, db);
if (rc != SEPOL_OK) {
goto exit;
}
}
if (netifcon->packet_context_str != NULL) {
- rc = cil_resolve_name(current, netifcon->packet_context_str, CIL_SYM_CONTEXTS, extra_args, &packcon_datum);
+ rc = cil_resolve_name(current, netifcon->packet_context_str, CIL_SYM_CONTEXTS, db, &packcon_datum);
if (rc != SEPOL_OK) {
goto exit;
}
netifcon->packet_context = (struct cil_context*)packcon_datum;
} else {
- rc = cil_resolve_context(current, netifcon->packet_context, extra_args);
+ rc = cil_resolve_context(current, netifcon->packet_context, db);
if (rc != SEPOL_OK) {
goto exit;
}
@@ -2157,7 +2130,7 @@ exit:
return rc;
}
-int cil_resolve_ibendportcon(struct cil_tree_node *current, void *extra_args)
+int cil_resolve_ibendportcon(struct cil_tree_node *current, struct cil_db *db)
{
struct cil_ibendportcon *ibendportcon = current->data;
struct cil_symtab_datum *con_datum = NULL;
@@ -2165,13 +2138,13 @@ int cil_resolve_ibendportcon(struct cil_tree_node *current, void *extra_args)
int rc = SEPOL_ERR;
if (ibendportcon->context_str) {
- rc = cil_resolve_name(current, ibendportcon->context_str, CIL_SYM_CONTEXTS, extra_args, &con_datum);
+ rc = cil_resolve_name(current, ibendportcon->context_str, CIL_SYM_CONTEXTS, db, &con_datum);
if (rc != SEPOL_OK)
goto exit;
ibendportcon->context = (struct cil_context *)con_datum;
} else {
- rc = cil_resolve_context(current, ibendportcon->context, extra_args);
+ rc = cil_resolve_context(current, ibendportcon->context, db);
if (rc != SEPOL_OK)
goto exit;
}
@@ -2182,20 +2155,20 @@ exit:
return rc;
}
-int cil_resolve_pirqcon(struct cil_tree_node *current, void *extra_args)
+int cil_resolve_pirqcon(struct cil_tree_node *current, struct cil_db *db)
{
struct cil_pirqcon *pirqcon = current->data;
struct cil_symtab_datum *context_datum = NULL;
int rc = SEPOL_ERR;
if (pirqcon->context_str != NULL) {
- rc = cil_resolve_name(current, pirqcon->context_str, CIL_SYM_CONTEXTS, extra_args, &context_datum);
+ rc = cil_resolve_name(current, pirqcon->context_str, CIL_SYM_CONTEXTS, db, &context_datum);
if (rc != SEPOL_OK) {
goto exit;
}
pirqcon->context = (struct cil_context*)context_datum;
} else {
- rc = cil_resolve_context(current, pirqcon->context, extra_args);
+ rc = cil_resolve_context(current, pirqcon->context, db);
if (rc != SEPOL_OK) {
goto exit;
}
@@ -2207,20 +2180,20 @@ exit:
return rc;
}
-int cil_resolve_iomemcon(struct cil_tree_node *current, void *extra_args)
+int cil_resolve_iomemcon(struct cil_tree_node *current, struct cil_db *db)
{
struct cil_iomemcon *iomemcon = current->data;
struct cil_symtab_datum *context_datum = NULL;
int rc = SEPOL_ERR;
if (iomemcon->context_str != NULL) {
- rc = cil_resolve_name(current, iomemcon->context_str, CIL_SYM_CONTEXTS, extra_args, &context_datum);
+ rc = cil_resolve_name(current, iomemcon->context_str, CIL_SYM_CONTEXTS, db, &context_datum);
if (rc != SEPOL_OK) {
goto exit;
}
iomemcon->context = (struct cil_context*)context_datum;
} else {
- rc = cil_resolve_context(current, iomemcon->context, extra_args);
+ rc = cil_resolve_context(current, iomemcon->context, db);
if (rc != SEPOL_OK) {
goto exit;
}
@@ -2232,20 +2205,20 @@ exit:
return rc;
}
-int cil_resolve_ioportcon(struct cil_tree_node *current, void *extra_args)
+int cil_resolve_ioportcon(struct cil_tree_node *current, struct cil_db *db)
{
struct cil_ioportcon *ioportcon = current->data;
struct cil_symtab_datum *context_datum = NULL;
int rc = SEPOL_ERR;
if (ioportcon->context_str != NULL) {
- rc = cil_resolve_name(current, ioportcon->context_str, CIL_SYM_CONTEXTS, extra_args, &context_datum);
+ rc = cil_resolve_name(current, ioportcon->context_str, CIL_SYM_CONTEXTS, db, &context_datum);
if (rc != SEPOL_OK) {
goto exit;
}
ioportcon->context = (struct cil_context*)context_datum;
} else {
- rc = cil_resolve_context(current, ioportcon->context, extra_args);
+ rc = cil_resolve_context(current, ioportcon->context, db);
if (rc != SEPOL_OK) {
goto exit;
}
@@ -2257,20 +2230,20 @@ exit:
return rc;
}
-int cil_resolve_pcidevicecon(struct cil_tree_node *current, void *extra_args)
+int cil_resolve_pcidevicecon(struct cil_tree_node *current, struct cil_db *db)
{
struct cil_pcidevicecon *pcidevicecon = current->data;
struct cil_symtab_datum *context_datum = NULL;
int rc = SEPOL_ERR;
if (pcidevicecon->context_str != NULL) {
- rc = cil_resolve_name(current, pcidevicecon->context_str, CIL_SYM_CONTEXTS, extra_args, &context_datum);
+ rc = cil_resolve_name(current, pcidevicecon->context_str, CIL_SYM_CONTEXTS, db, &context_datum);
if (rc != SEPOL_OK) {
goto exit;
}
pcidevicecon->context = (struct cil_context*)context_datum;
} else {
- rc = cil_resolve_context(current, pcidevicecon->context, extra_args);
+ rc = cil_resolve_context(current, pcidevicecon->context, db);
if (rc != SEPOL_OK) {
goto exit;
}
@@ -2282,20 +2255,20 @@ exit:
return rc;
}
-static int cil_resolve_devicetreecon(struct cil_tree_node *current, void *extra_args)
+static int cil_resolve_devicetreecon(struct cil_tree_node *current, struct cil_db *db)
{
struct cil_devicetreecon *devicetreecon = current->data;
struct cil_symtab_datum *context_datum = NULL;
int rc = SEPOL_ERR;
if (devicetreecon->context_str != NULL) {
- rc = cil_resolve_name(current, devicetreecon->context_str, CIL_SYM_CONTEXTS, extra_args, &context_datum);
+ rc = cil_resolve_name(current, devicetreecon->context_str, CIL_SYM_CONTEXTS, db, &context_datum);
if (rc != SEPOL_OK) {
goto exit;
}
devicetreecon->context = (struct cil_context*)context_datum;
} else {
- rc = cil_resolve_context(current, devicetreecon->context, extra_args);
+ rc = cil_resolve_context(current, devicetreecon->context, db);
if (rc != SEPOL_OK) {
goto exit;
}
@@ -2307,20 +2280,20 @@ exit:
return rc;
}
-int cil_resolve_fsuse(struct cil_tree_node *current, void *extra_args)
+int cil_resolve_fsuse(struct cil_tree_node *current, struct cil_db *db)
{
struct cil_fsuse *fsuse = current->data;
struct cil_symtab_datum *context_datum = NULL;
int rc = SEPOL_ERR;
if (fsuse->context_str != NULL) {
- rc = cil_resolve_name(current, fsuse->context_str, CIL_SYM_CONTEXTS, extra_args, &context_datum);
+ rc = cil_resolve_name(current, fsuse->context_str, CIL_SYM_CONTEXTS, db, &context_datum);
if (rc != SEPOL_OK) {
goto exit;
}
fsuse->context = (struct cil_context*)context_datum;
} else {
- rc = cil_resolve_context(current, fsuse->context, extra_args);
+ rc = cil_resolve_context(current, fsuse->context, db);
if (rc != SEPOL_OK) {
goto exit;
}
@@ -2332,7 +2305,7 @@ exit:
return rc;
}
-int cil_resolve_sidcontext(struct cil_tree_node *current, void *extra_args)
+int cil_resolve_sidcontext(struct cil_tree_node *current, struct cil_db *db)
{
struct cil_sidcontext *sidcon = current->data;
struct cil_symtab_datum *sid_datum = NULL;
@@ -2341,20 +2314,20 @@ int cil_resolve_sidcontext(struct cil_tree_node *current, void *extra_args)
int rc = SEPOL_ERR;
- rc = cil_resolve_name(current, sidcon->sid_str, CIL_SYM_SIDS, extra_args, &sid_datum);
+ rc = cil_resolve_name(current, sidcon->sid_str, CIL_SYM_SIDS, db, &sid_datum);
if (rc != SEPOL_OK) {
goto exit;
}
sid = (struct cil_sid*)sid_datum;
if (sidcon->context_str != NULL) {
- rc = cil_resolve_name(current, sidcon->context_str, CIL_SYM_CONTEXTS, extra_args, &context_datum);
+ rc = cil_resolve_name(current, sidcon->context_str, CIL_SYM_CONTEXTS, db, &context_datum);
if (rc != SEPOL_OK) {
goto exit;
}
sidcon->context = (struct cil_context*)context_datum;
} else if (sidcon->context != NULL) {
- rc = cil_resolve_context(current, sidcon->context, extra_args);
+ rc = cil_resolve_context(current, sidcon->context, db);
if (rc != SEPOL_OK) {
goto exit;
}
@@ -2374,14 +2347,14 @@ exit:
return rc;
}
-static int cil_resolve_blockinherit_link(struct cil_tree_node *current, void *extra_args)
+static int cil_resolve_blockinherit_link(struct cil_tree_node *current, struct cil_db *db)
{
struct cil_blockinherit *inherit = current->data;
struct cil_symtab_datum *block_datum = NULL;
struct cil_tree_node *node = NULL;
int rc = SEPOL_ERR;
- rc = cil_resolve_name(current, inherit->block_str, CIL_SYM_BLOCKS, extra_args, &block_datum);
+ rc = cil_resolve_name(current, inherit->block_str, CIL_SYM_BLOCKS, db, &block_datum);
if (rc != SEPOL_OK) {
goto exit;
}
@@ -2407,11 +2380,9 @@ exit:
return rc;
}
-static int cil_resolve_blockinherit_copy(struct cil_tree_node *current, void *extra_args)
+static int cil_resolve_blockinherit_copy(struct cil_tree_node *current, struct cil_db *db)
{
struct cil_block *block = current->data;
- struct cil_args_resolve *args = extra_args;
- struct cil_db *db = NULL;
struct cil_list_item *item = NULL;
int rc = SEPOL_ERR;
@@ -2421,8 +2392,6 @@ static int cil_resolve_blockinherit_copy(struct cil_tree_node *current, void *ex
goto exit;
}
- db = args->db;
-
// Make sure this is the original block and not a merged block from a blockinherit
if (current != block->datum.nodes->head->data) {
rc = SEPOL_OK;
@@ -2456,15 +2425,14 @@ static void cil_mark_subtree_abstract(struct cil_tree_node *node)
}
}
-static int cil_resolve_blockabstract(struct cil_tree_node *current, void *extra_args)
+static int cil_resolve_blockabstract(struct cil_tree_node *current, struct cil_db *db, struct cil_list *abstract_blocks)
{
struct cil_blockabstract *abstract = current->data;
struct cil_symtab_datum *block_datum = NULL;
struct cil_tree_node *block_node = NULL;
- struct cil_args_resolve *args = extra_args;
int rc = SEPOL_ERR;
- rc = cil_resolve_name(current, abstract->block_str, CIL_SYM_BLOCKS, extra_args, &block_datum);
+ rc = cil_resolve_name(current, abstract->block_str, CIL_SYM_BLOCKS, db, &block_datum);
if (rc != SEPOL_OK) {
goto exit;
}
@@ -2476,7 +2444,7 @@ static int cil_resolve_blockabstract(struct cil_tree_node *current, void *extra_
goto exit;
}
- cil_list_append(args->abstract_blocks, CIL_NODE, block_node);
+ cil_list_append(abstract_blocks, CIL_NODE, block_node);
return SEPOL_OK;
@@ -2484,20 +2452,14 @@ exit:
return rc;
}
-int cil_resolve_in(struct cil_tree_node *current, void *extra_args)
+int cil_resolve_in(struct cil_tree_node *current, struct cil_db *db)
{
struct cil_in *in = current->data;
- struct cil_args_resolve *args = extra_args;
- struct cil_db *db = NULL;
struct cil_symtab_datum *block_datum = NULL;
struct cil_tree_node *block_node = NULL;
int rc = SEPOL_ERR;
- if (args != NULL) {
- db = args->db;
- }
-
- rc = cil_resolve_name(current, in->block_str, CIL_SYM_BLOCKS, extra_args, &block_datum);
+ rc = cil_resolve_name(current, in->block_str, CIL_SYM_BLOCKS, db, &block_datum);
if (rc != SEPOL_OK) {
goto exit;
}
@@ -2527,7 +2489,7 @@ exit:
return rc;
}
-static int cil_resolve_in_list(struct cil_list *in_list, void *extra_args)
+static int cil_resolve_in_list(struct cil_list *in_list, struct cil_db *db)
{
struct cil_list_item *curr = NULL;
struct cil_tree_node *node = NULL;
@@ -2550,12 +2512,12 @@ static int cil_resolve_in_list(struct cil_list *in_list, void *extra_args)
node = curr->data;
in = node->data;
- rc = cil_resolve_name(node, in->block_str, CIL_SYM_BLOCKS, extra_args, &block_datum);
+ rc = cil_resolve_name(node, in->block_str, CIL_SYM_BLOCKS, db, &block_datum);
if (rc != SEPOL_OK) {
unresolved++;
last_failed_node = node;
} else {
- rc = cil_resolve_in(node, extra_args);
+ rc = cil_resolve_in(node, db);
if (rc != SEPOL_OK) {
goto exit;
}
@@ -2581,7 +2543,7 @@ exit:
}
-static int cil_resolve_bounds(struct cil_tree_node *current, void *extra_args, enum cil_flavor flavor, enum cil_flavor attr_flavor)
+static int cil_resolve_bounds(struct cil_tree_node *current, struct cil_db *db, enum cil_flavor flavor, enum cil_flavor attr_flavor)
{
int rc = SEPOL_ERR;
struct cil_bounds *bounds = current->data;
@@ -2594,7 +2556,7 @@ static int cil_resolve_bounds(struct cil_tree_node *current, void *extra_args, e
goto exit;
}
- rc = cil_resolve_name(current, bounds->parent_str, index, extra_args, &parent_datum);
+ rc = cil_resolve_name(current, bounds->parent_str, index, db, &parent_datum);
if (rc != SEPOL_OK) {
goto exit;
}
@@ -2605,7 +2567,7 @@ static int cil_resolve_bounds(struct cil_tree_node *current, void *extra_args, e
}
- rc = cil_resolve_name(current, bounds->child_str, index, extra_args, &child_datum);
+ rc = cil_resolve_name(current, bounds->child_str, index, db, &child_datum);
if (rc != SEPOL_OK) {
goto exit;
}
@@ -2663,7 +2625,7 @@ exit:
return rc;
}
-static int cil_resolve_default(struct cil_tree_node *current, void *extra_args)
+static int cil_resolve_default(struct cil_tree_node *current, struct cil_db *db)
{
int rc = SEPOL_ERR;
struct cil_default *def = current->data;
@@ -2673,7 +2635,7 @@ static int cil_resolve_default(struct cil_tree_node *current, void *extra_args)
cil_list_init(&def->class_datums, def->flavor);
cil_list_for_each(curr, def->class_strs) {
- rc = cil_resolve_name(current, (char *)curr->data, CIL_SYM_CLASSES, extra_args, &datum);
+ rc = cil_resolve_name(current, (char *)curr->data, CIL_SYM_CLASSES, db, &datum);
if (rc != SEPOL_OK) {
goto exit;
}
@@ -2686,7 +2648,7 @@ exit:
return rc;
}
-static int cil_resolve_defaultrange(struct cil_tree_node *current, void *extra_args)
+static int cil_resolve_defaultrange(struct cil_tree_node *current, struct cil_db *db)
{
int rc = SEPOL_ERR;
struct cil_defaultrange *def = current->data;
@@ -2696,7 +2658,7 @@ static int cil_resolve_defaultrange(struct cil_tree_node *current, void *extra_a
cil_list_init(&def->class_datums, CIL_DEFAULTRANGE);
cil_list_for_each(curr, def->class_strs) {
- rc = cil_resolve_name(current, (char *)curr->data, CIL_SYM_CLASSES, extra_args, &datum);
+ rc = cil_resolve_name(current, (char *)curr->data, CIL_SYM_CLASSES, db, &datum);
if (rc != SEPOL_OK) {
goto exit;
}
@@ -2781,9 +2743,8 @@ exit:
return rc;
}
-static int cil_build_call_args(struct cil_tree_node *call_node, struct cil_call *call, struct cil_macro *macro, void *extra_args)
+static int cil_build_call_args(struct cil_tree_node *call_node, struct cil_call *call, struct cil_macro *macro, struct cil_db *db)
{
- struct cil_args_resolve *args = extra_args;
struct cil_list_item *item;
struct cil_args *arg = NULL;
struct cil_tree_node *arg_node = NULL;
@@ -2830,7 +2791,7 @@ static int cil_build_call_args(struct cil_tree_node *call_node, struct cil_call
rc = SEPOL_ERR;
goto exit;
}
- name = __cil_insert_name(args->db, arg_node->data, call_node);
+ name = __cil_insert_name(db, arg_node->data, call_node);
if (name != NULL) {
arg->arg = (struct cil_symtab_datum *)name;
} else {
@@ -3080,10 +3041,9 @@ exit:
return rc;
}
-static int cil_resolve_call(struct cil_tree_node *current, void *extra_args)
+static int cil_resolve_call(struct cil_tree_node *current, struct cil_db *db)
{
struct cil_call *call = current->data;
- struct cil_args_resolve *args = extra_args;
struct cil_tree_node *macro_node = NULL;
struct cil_symtab_datum *macro_datum = NULL;
int rc = SEPOL_ERR;
@@ -3092,7 +3052,7 @@ static int cil_resolve_call(struct cil_tree_node *current, void *extra_args)
return SEPOL_OK;
}
- rc = cil_resolve_name(current, call->macro_str, CIL_SYM_BLOCKS, extra_args, ¯o_datum);
+ rc = cil_resolve_name(current, call->macro_str, CIL_SYM_BLOCKS, db, ¯o_datum);
if (rc != SEPOL_OK) {
goto exit;
}
@@ -3106,7 +3066,7 @@ static int cil_resolve_call(struct cil_tree_node *current, void *extra_args)
}
call->macro = (struct cil_macro*)macro_datum;
- rc = cil_build_call_args(current, call, call->macro, extra_args);
+ rc = cil_build_call_args(current, call, call->macro, db);
if (rc != SEPOL_OK) {
goto exit;
}
@@ -3116,7 +3076,7 @@ static int cil_resolve_call(struct cil_tree_node *current, void *extra_args)
goto exit;
}
- rc = cil_copy_ast(args->db, macro_node, current);
+ rc = cil_copy_ast(db, macro_node, current);
if (rc != SEPOL_OK) {
cil_tree_log(current, CIL_ERR, "Failed to copy macro %s to call", macro_datum->name);
goto exit;
@@ -3130,7 +3090,7 @@ exit:
return rc;
}
-static int cil_resolve_call_args(struct cil_tree_node *current, void *extra_args)
+static int cil_resolve_call_args(struct cil_tree_node *current, struct cil_db *db)
{
struct cil_call *call = current->data;
int rc = SEPOL_ERR;
@@ -3227,7 +3187,7 @@ static int cil_resolve_call_args(struct cil_tree_node *current, void *extra_args
if (sym_index != CIL_SYM_UNKNOWN) {
struct cil_symtab_datum *datum;
struct cil_tree_node *n;
- rc = cil_resolve_name(current, arg->arg_str, sym_index, extra_args, &datum);
+ rc = cil_resolve_name(current, arg->arg_str, sym_index, db, &datum);
if (rc != SEPOL_OK) {
cil_tree_log(current, CIL_ERR, "Failed to resolve %s in call argument list", arg->arg_str);
goto exit;
@@ -3242,7 +3202,7 @@ static int cil_resolve_call_args(struct cil_tree_node *current, void *extra_args
* the call.
*/
cil_symtab_remove_datum(datum);
- rc = cil_resolve_name(current, arg->arg_str, sym_index, extra_args, &(arg->arg));
+ rc = cil_resolve_name(current, arg->arg_str, sym_index, db, &(arg->arg));
if (rc != SEPOL_OK) {
cil_tree_log(current, CIL_ERR, "Failed to resolve %s in call argument list", arg->arg_str);
goto exit;
@@ -3297,7 +3257,7 @@ exit:
return rc;
}
-int cil_resolve_expr(enum cil_flavor expr_type, struct cil_list *str_expr, struct cil_list **datum_expr, struct cil_tree_node *parent, void *extra_args)
+int cil_resolve_expr(enum cil_flavor expr_type, struct cil_list *str_expr, struct cil_list **datum_expr, struct cil_tree_node *parent, struct cil_db *db)
{
int rc = SEPOL_ERR;
struct cil_list_item *curr;
@@ -3334,7 +3294,7 @@ int cil_resolve_expr(enum cil_flavor expr_type, struct cil_list *str_expr, struc
cil_list_for_each(curr, str_expr) {
switch (curr->flavor) {
case CIL_STRING:
- rc = cil_resolve_name(parent, curr->data, sym_index, extra_args, &res_datum);
+ rc = cil_resolve_name(parent, curr->data, sym_index, db, &res_datum);
if (rc != SEPOL_OK) {
goto exit;
}
@@ -3348,7 +3308,7 @@ int cil_resolve_expr(enum cil_flavor expr_type, struct cil_list *str_expr, struc
if (!res_datum->name) {
/* Anonymous category sets need to be resolved when encountered */
if (!catset->cats->datum_expr) {
- rc = cil_resolve_expr(expr_type, catset->cats->str_expr, &catset->cats->datum_expr, parent, extra_args);
+ rc = cil_resolve_expr(expr_type, catset->cats->str_expr, &catset->cats->datum_expr, parent, db);
if (rc != SEPOL_OK) {
goto exit;
}
@@ -3366,7 +3326,7 @@ int cil_resolve_expr(enum cil_flavor expr_type, struct cil_list *str_expr, struc
}
break;
case CIL_LIST: {
- rc = cil_resolve_expr(expr_type, curr->data, &datum_sub_expr, parent, extra_args);
+ rc = cil_resolve_expr(expr_type, curr->data, &datum_sub_expr, parent, db);
if (rc != SEPOL_OK) {
goto exit;
}
@@ -3388,12 +3348,12 @@ exit:
return rc;
}
-int cil_resolve_boolif(struct cil_tree_node *current, void *extra_args)
+int cil_resolve_boolif(struct cil_tree_node *current, struct cil_db *db)
{
int rc = SEPOL_ERR;
struct cil_booleanif *bif = (struct cil_booleanif*)current->data;
- rc = cil_resolve_expr(CIL_BOOLEANIF, bif->str_expr, &bif->datum_expr, current, extra_args);
+ rc = cil_resolve_expr(CIL_BOOLEANIF, bif->str_expr, &bif->datum_expr, current, db);
if (rc != SEPOL_OK) {
goto exit;
}
@@ -3453,10 +3413,8 @@ static int __cil_evaluate_tunable_expr(struct cil_list_item *curr)
}
}
-int cil_resolve_tunif(struct cil_tree_node *current, void *extra_args)
+int cil_resolve_tunif(struct cil_tree_node *current, struct cil_db *db)
{
- struct cil_args_resolve *args = extra_args;
- struct cil_db *db = NULL;
int rc = SEPOL_ERR;
struct cil_tunableif *tif = (struct cil_tunableif*)current->data;
uint16_t result = CIL_FALSE;
@@ -3464,11 +3422,7 @@ int cil_resolve_tunif(struct cil_tree_node *current, void *extra_args)
struct cil_tree_node *false_node = NULL;
struct cil_condblock *cb = NULL;
- if (args != NULL) {
- db = args->db;
- }
-
- rc = cil_resolve_expr(CIL_TUNABLEIF, tif->str_expr, &tif->datum_expr, current, extra_args);
+ rc = cil_resolve_expr(CIL_TUNABLEIF, tif->str_expr, &tif->datum_expr, current, db);
if (rc != SEPOL_OK) {
goto exit;
}
@@ -3519,7 +3473,7 @@ exit:
return rc;
}
-int cil_resolve_userattributeset(struct cil_tree_node *current, void *extra_args)
+int cil_resolve_userattributeset(struct cil_tree_node *current, struct cil_db *db)
{
int rc = SEPOL_ERR;
struct cil_userattributeset *attrusers = current->data;
@@ -3527,7 +3481,7 @@ int cil_resolve_userattributeset(struct cil_tree_node *current, void *extra_args
struct cil_tree_node *attr_node = NULL;
struct cil_userattribute *attr = NULL;
- rc = cil_resolve_name(current, attrusers->attr_str, CIL_SYM_USERS, extra_args, &attr_datum);
+ rc = cil_resolve_name(current, attrusers->attr_str, CIL_SYM_USERS, db, &attr_datum);
if (rc != SEPOL_OK) {
goto exit;
}
@@ -3540,7 +3494,7 @@ int cil_resolve_userattributeset(struct cil_tree_node *current, void *extra_args
}
attr = (struct cil_userattribute*)attr_datum;
- rc = cil_resolve_expr(CIL_USERATTRIBUTESET, attrusers->str_expr, &attrusers->datum_expr, current, extra_args);
+ rc = cil_resolve_expr(CIL_USERATTRIBUTESET, attrusers->str_expr, &attrusers->datum_expr, current, db);
if (rc != SEPOL_OK) {
goto exit;
}
@@ -3661,21 +3615,17 @@ static int cil_check_for_bad_inheritance(struct cil_tree_node *node)
return rc;
}
-static int __cil_resolve_ast_node(struct cil_tree_node *node, void *extra_args)
+static int __cil_resolve_ast_node(struct cil_tree_node *node, struct cil_args_resolve *args)
{
int rc = SEPOL_OK;
- struct cil_args_resolve *args = extra_args;
+ struct cil_db *db = args->db;
enum cil_pass pass = 0;
- if (node == NULL || args == NULL) {
- goto exit;
- }
-
pass = args->pass;
switch (pass) {
case CIL_PASS_TIF:
if (node->flavor == CIL_TUNABLEIF) {
- rc = cil_resolve_tunif(node, args);
+ rc = cil_resolve_tunif(node, db);
}
break;
case CIL_PASS_IN_BEFORE:
@@ -3690,17 +3640,17 @@ static int __cil_resolve_ast_node(struct cil_tree_node *node, void *extra_args)
break;
case CIL_PASS_BLKIN_LINK:
if (node->flavor == CIL_BLOCKINHERIT) {
- rc = cil_resolve_blockinherit_link(node, args);
+ rc = cil_resolve_blockinherit_link(node, db);
}
break;
case CIL_PASS_BLKIN_COPY:
if (node->flavor == CIL_BLOCK) {
- rc = cil_resolve_blockinherit_copy(node, args);
+ rc = cil_resolve_blockinherit_copy(node, db);
}
break;
case CIL_PASS_BLKABS:
if (node->flavor == CIL_BLOCKABSTRACT) {
- rc = cil_resolve_blockabstract(node, args);
+ rc = cil_resolve_blockabstract(node, db, args->abstract_blocks);
}
break;
case CIL_PASS_IN_AFTER:
@@ -3715,24 +3665,24 @@ static int __cil_resolve_ast_node(struct cil_tree_node *node, void *extra_args)
break;
case CIL_PASS_CALL1:
if (node->flavor == CIL_CALL && args->macro == NULL) {
- rc = cil_resolve_call(node, args);
+ rc = cil_resolve_call(node, db);
}
break;
case CIL_PASS_CALL2:
if (node->flavor == CIL_CALL && args->macro == NULL) {
- rc = cil_resolve_call_args(node, args);
+ rc = cil_resolve_call_args(node, db);
}
break;
case CIL_PASS_ALIAS1:
switch (node->flavor) {
case CIL_TYPEALIASACTUAL:
- rc = cil_resolve_aliasactual(node, args, CIL_TYPE, CIL_TYPEALIAS);
+ rc = cil_resolve_aliasactual(node, db, CIL_TYPE, CIL_TYPEALIAS);
break;
case CIL_SENSALIASACTUAL:
- rc = cil_resolve_aliasactual(node, args, CIL_SENS, CIL_SENSALIAS);
+ rc = cil_resolve_aliasactual(node, db, CIL_SENS, CIL_SENSALIAS);
break;
case CIL_CATALIASACTUAL:
- rc = cil_resolve_aliasactual(node, args, CIL_CAT, CIL_CATALIAS);
+ rc = cil_resolve_aliasactual(node, db, CIL_CAT, CIL_CATALIAS);
break;
default:
break;
@@ -3756,19 +3706,19 @@ static int __cil_resolve_ast_node(struct cil_tree_node *node, void *extra_args)
case CIL_PASS_MISC1:
switch (node->flavor) {
case CIL_SIDORDER:
- rc = cil_resolve_sidorder(node, args);
+ rc = cil_resolve_sidorder(node, db, args->sidorder_lists);
break;
case CIL_CLASSORDER:
- rc = cil_resolve_classorder(node, args);
+ rc = cil_resolve_classorder(node, db, args->classorder_lists, args->unordered_classorder_lists);
break;
case CIL_CATORDER:
- rc = cil_resolve_catorder(node, args);
+ rc = cil_resolve_catorder(node, db, args->catorder_lists);
break;
case CIL_SENSITIVITYORDER:
- rc = cil_resolve_sensitivityorder(node, args);
+ rc = cil_resolve_sensitivityorder(node, db, args->sensitivityorder_lists);
break;
case CIL_BOOLEANIF:
- rc = cil_resolve_boolif(node, args);
+ rc = cil_resolve_boolif(node, db);
break;
default:
break;
@@ -3777,7 +3727,7 @@ static int __cil_resolve_ast_node(struct cil_tree_node *node, void *extra_args)
case CIL_PASS_MLS:
switch (node->flavor) {
case CIL_CATSET:
- rc = cil_resolve_catset(node, (struct cil_catset*)node->data, args);
+ rc = cil_resolve_catset(node, (struct cil_catset*)node->data, db);
break;
default:
break;
@@ -3786,10 +3736,10 @@ static int __cil_resolve_ast_node(struct cil_tree_node *node, void *extra_args)
case CIL_PASS_MISC2:
switch (node->flavor) {
case CIL_SENSCAT:
- rc = cil_resolve_senscat(node, args);
+ rc = cil_resolve_senscat(node, db);
break;
case CIL_CLASSCOMMON:
- rc = cil_resolve_classcommon(node, args);
+ rc = cil_resolve_classcommon(node, db);
break;
default:
break;
@@ -3798,147 +3748,147 @@ static int __cil_resolve_ast_node(struct cil_tree_node *node, void *extra_args)
case CIL_PASS_MISC3:
switch (node->flavor) {
case CIL_TYPEATTRIBUTESET:
- rc = cil_resolve_typeattributeset(node, args);
+ rc = cil_resolve_typeattributeset(node, db);
break;
case CIL_EXPANDTYPEATTRIBUTE:
- rc = cil_resolve_expandtypeattribute(node, args);
+ rc = cil_resolve_expandtypeattribute(node, db);
break;
case CIL_TYPEBOUNDS:
- rc = cil_resolve_bounds(node, args, CIL_TYPE, CIL_TYPEATTRIBUTE);
+ rc = cil_resolve_bounds(node, db, CIL_TYPE, CIL_TYPEATTRIBUTE);
break;
case CIL_TYPEPERMISSIVE:
- rc = cil_resolve_typepermissive(node, args);
+ rc = cil_resolve_typepermissive(node, db);
break;
case CIL_NAMETYPETRANSITION:
- rc = cil_resolve_nametypetransition(node, args);
+ rc = cil_resolve_nametypetransition(node, db);
break;
case CIL_RANGETRANSITION:
- rc = cil_resolve_rangetransition(node, args);
+ rc = cil_resolve_rangetransition(node, db);
break;
case CIL_CLASSPERMISSIONSET:
- rc = cil_resolve_classpermissionset(node, (struct cil_classpermissionset*)node->data, args);
+ rc = cil_resolve_classpermissionset(node, (struct cil_classpermissionset*)node->data, db);
break;
case CIL_CLASSMAPPING:
- rc = cil_resolve_classmapping(node, args);
+ rc = cil_resolve_classmapping(node, db);
break;
case CIL_AVRULE:
case CIL_AVRULEX:
- rc = cil_resolve_avrule(node, args);
+ rc = cil_resolve_avrule(node, db);
break;
case CIL_PERMISSIONX:
- rc = cil_resolve_permissionx(node, (struct cil_permissionx*)node->data, args);
+ rc = cil_resolve_permissionx(node, (struct cil_permissionx*)node->data, db);
break;
case CIL_DENY_RULE:
- rc = cil_resolve_deny_rule(node, args);
+ rc = cil_resolve_deny_rule(node, db);
break;
case CIL_TYPE_RULE:
- rc = cil_resolve_type_rule(node, args);
+ rc = cil_resolve_type_rule(node, db);
break;
case CIL_USERROLE:
- rc = cil_resolve_userrole(node, args);
+ rc = cil_resolve_userrole(node, db);
break;
case CIL_USERLEVEL:
- rc = cil_resolve_userlevel(node, args);
+ rc = cil_resolve_userlevel(node, db);
break;
case CIL_USERRANGE:
- rc = cil_resolve_userrange(node, args);
+ rc = cil_resolve_userrange(node, db);
break;
case CIL_USERBOUNDS:
- rc = cil_resolve_bounds(node, args, CIL_USER, CIL_USERATTRIBUTE);
+ rc = cil_resolve_bounds(node, db, CIL_USER, CIL_USERATTRIBUTE);
break;
case CIL_USERPREFIX:
- rc = cil_resolve_userprefix(node, args);
+ rc = cil_resolve_userprefix(node, db);
break;
case CIL_SELINUXUSER:
case CIL_SELINUXUSERDEFAULT:
- rc = cil_resolve_selinuxuser(node, args);
+ rc = cil_resolve_selinuxuser(node, db);
break;
case CIL_ROLEATTRIBUTESET:
- rc = cil_resolve_roleattributeset(node, args);
+ rc = cil_resolve_roleattributeset(node, db);
break;
case CIL_ROLETYPE:
- rc = cil_resolve_roletype(node, args);
+ rc = cil_resolve_roletype(node, db);
break;
case CIL_ROLETRANSITION:
- rc = cil_resolve_roletransition(node, args);
+ rc = cil_resolve_roletransition(node, db);
break;
case CIL_ROLEALLOW:
- rc = cil_resolve_roleallow(node, args);
+ rc = cil_resolve_roleallow(node, db);
break;
case CIL_ROLEBOUNDS:
- rc = cil_resolve_bounds(node, args, CIL_ROLE, CIL_ROLEATTRIBUTE);
+ rc = cil_resolve_bounds(node, db, CIL_ROLE, CIL_ROLEATTRIBUTE);
break;
case CIL_LEVEL:
- rc = cil_resolve_level(node, (struct cil_level*)node->data, args);
+ rc = cil_resolve_level(node, (struct cil_level*)node->data, db);
break;
case CIL_LEVELRANGE:
- rc = cil_resolve_levelrange(node, (struct cil_levelrange*)node->data, args);
+ rc = cil_resolve_levelrange(node, (struct cil_levelrange*)node->data, db);
break;
case CIL_CONSTRAIN:
- rc = cil_resolve_constrain(node, args);
+ rc = cil_resolve_constrain(node, db);
break;
case CIL_MLSCONSTRAIN:
- rc = cil_resolve_constrain(node, args);
+ rc = cil_resolve_constrain(node, db);
break;
case CIL_VALIDATETRANS:
case CIL_MLSVALIDATETRANS:
- rc = cil_resolve_validatetrans(node, args);
+ rc = cil_resolve_validatetrans(node, db);
break;
case CIL_CONTEXT:
- rc = cil_resolve_context(node, (struct cil_context*)node->data, args);
+ rc = cil_resolve_context(node, (struct cil_context*)node->data, db);
break;
case CIL_FILECON:
- rc = cil_resolve_filecon(node, args);
+ rc = cil_resolve_filecon(node, db);
break;
case CIL_IBPKEYCON:
- rc = cil_resolve_ibpkeycon(node, args);
+ rc = cil_resolve_ibpkeycon(node, db);
break;
case CIL_PORTCON:
- rc = cil_resolve_portcon(node, args);
+ rc = cil_resolve_portcon(node, db);
break;
case CIL_NODECON:
- rc = cil_resolve_nodecon(node, args);
+ rc = cil_resolve_nodecon(node, db);
break;
case CIL_GENFSCON:
- rc = cil_resolve_genfscon(node, args);
+ rc = cil_resolve_genfscon(node, db);
break;
case CIL_NETIFCON:
- rc = cil_resolve_netifcon(node, args);
+ rc = cil_resolve_netifcon(node, db);
break;
case CIL_IBENDPORTCON:
- rc = cil_resolve_ibendportcon(node, args);
+ rc = cil_resolve_ibendportcon(node, db);
break;
case CIL_PIRQCON:
- rc = cil_resolve_pirqcon(node, args);
+ rc = cil_resolve_pirqcon(node, db);
break;
case CIL_IOMEMCON:
- rc = cil_resolve_iomemcon(node, args);
+ rc = cil_resolve_iomemcon(node, db);
break;
case CIL_IOPORTCON:
- rc = cil_resolve_ioportcon(node, args);
+ rc = cil_resolve_ioportcon(node, db);
break;
case CIL_PCIDEVICECON:
- rc = cil_resolve_pcidevicecon(node, args);
+ rc = cil_resolve_pcidevicecon(node, db);
break;
case CIL_DEVICETREECON:
- rc = cil_resolve_devicetreecon(node, args);
+ rc = cil_resolve_devicetreecon(node, db);
break;
case CIL_FSUSE:
- rc = cil_resolve_fsuse(node, args);
+ rc = cil_resolve_fsuse(node, db);
break;
case CIL_SIDCONTEXT:
- rc = cil_resolve_sidcontext(node, args);
+ rc = cil_resolve_sidcontext(node, db);
break;
case CIL_DEFAULTUSER:
case CIL_DEFAULTROLE:
case CIL_DEFAULTTYPE:
- rc = cil_resolve_default(node, args);
+ rc = cil_resolve_default(node, db);
break;
case CIL_DEFAULTRANGE:
- rc = cil_resolve_defaultrange(node, args);
+ rc = cil_resolve_defaultrange(node, db);
break;
case CIL_USERATTRIBUTESET:
- rc = cil_resolve_userattributeset(node, args);
+ rc = cil_resolve_userattributeset(node, db);
break;
default:
break;
@@ -3949,9 +3899,6 @@ static int __cil_resolve_ast_node(struct cil_tree_node *node, void *extra_args)
}
return rc;
-
-exit:
- return rc;
}
static int __cil_resolve_ast_node_helper(struct cil_tree_node *node, uint32_t *finished, void *extra_args)
@@ -4040,7 +3987,7 @@ static int __cil_resolve_ast_node_helper(struct cil_tree_node *node, uint32_t *f
goto exit;
}
- rc = __cil_resolve_ast_node(node, extra_args);
+ rc = __cil_resolve_ast_node(node, args);
if (rc == SEPOL_ENOENT) {
if (optional == NULL) {
cil_tree_log(node, CIL_ERR, "Failed to resolve %s statement", cil_node_to_string(node));
@@ -4186,13 +4133,13 @@ int cil_resolve_ast(struct cil_db *db, struct cil_tree_node *current)
}
if (pass == CIL_PASS_IN_BEFORE) {
- rc = cil_resolve_in_list(extra_args.in_list_before, &extra_args);
+ rc = cil_resolve_in_list(extra_args.in_list_before, db);
if (rc != SEPOL_OK) {
goto exit;
}
cil_list_destroy(&extra_args.in_list_before, CIL_FALSE);
} else if (pass == CIL_PASS_IN_AFTER) {
- rc = cil_resolve_in_list(extra_args.in_list_after, &extra_args);
+ rc = cil_resolve_in_list(extra_args.in_list_after, db);
if (rc != SEPOL_OK) {
goto exit;
}
@@ -4413,12 +4360,12 @@ static int __cil_resolve_name_helper(struct cil_db *db, struct cil_tree_node *no
return rc;
}
-int cil_resolve_name(struct cil_tree_node *ast_node, char *name, enum cil_sym_index sym_index, void *extra_args, struct cil_symtab_datum **datum)
+int cil_resolve_name(struct cil_tree_node *ast_node, char *name, enum cil_sym_index sym_index, struct cil_db *db, struct cil_symtab_datum **datum)
{
int rc = SEPOL_ERR;
struct cil_tree_node *node = NULL;
- rc = cil_resolve_name_keep_aliases(ast_node, name, sym_index, extra_args, datum);
+ rc = cil_resolve_name_keep_aliases(ast_node, name, sym_index, db, datum);
if (rc != SEPOL_OK) {
goto exit;
}
@@ -4441,11 +4388,9 @@ exit:
return rc;
}
-int cil_resolve_name_keep_aliases(struct cil_tree_node *ast_node, char *name, enum cil_sym_index sym_index, void *extra_args, struct cil_symtab_datum **datum)
+int cil_resolve_name_keep_aliases(struct cil_tree_node *ast_node, char *name, enum cil_sym_index sym_index, struct cil_db *db, struct cil_symtab_datum **datum)
{
int rc = SEPOL_ERR;
- struct cil_args_resolve *args = extra_args;
- struct cil_db *db = args->db;
struct cil_tree_node *node = NULL;
if (name == NULL) {
diff --git a/libsepol/cil/src/cil_resolve_ast.h b/libsepol/cil/src/cil_resolve_ast.h
index 78357993..2f6b7e86 100644
--- a/libsepol/cil/src/cil_resolve_ast.h
+++ b/libsepol/cil/src/cil_resolve_ast.h
@@ -35,71 +35,71 @@
#include "cil_internal.h"
#include "cil_tree.h"
-int cil_resolve_classorder(struct cil_tree_node *current, void *extra_args);
-int cil_resolve_classperms(struct cil_tree_node *current, struct cil_classperms *cp, void *extra_args);
-int cil_resolve_classpermissionset(struct cil_tree_node *current, struct cil_classpermissionset *cps, void *extra_args);
-int cil_resolve_classperms_list(struct cil_tree_node *current, struct cil_list *cp_list, void *extra_args);
-int cil_resolve_avrule(struct cil_tree_node *current, void *extra_args);
-int cil_resolve_deny_rule(struct cil_tree_node *current, void *extra_args);
-int cil_resolve_type_rule(struct cil_tree_node *current, void *extra_args);
-int cil_resolve_typeattributeset(struct cil_tree_node *current, void *extra_args);
-int cil_resolve_typealias(struct cil_tree_node *current, void *extra_args);
-int cil_resolve_typebounds(struct cil_tree_node *current, void *extra_args);
-int cil_resolve_typepermissive(struct cil_tree_node *current, void *extra_args);
-int cil_resolve_nametypetransition(struct cil_tree_node *current, void *extra_args);
-int cil_resolve_rangetransition(struct cil_tree_node *current, void *extra_args);
-int cil_resolve_classcommon(struct cil_tree_node *current, void *extra_args);
-int cil_resolve_classmapping(struct cil_tree_node *current, void *extra_args);
-int cil_resolve_userrole(struct cil_tree_node *current, void *extra_args);
-int cil_resolve_userlevel(struct cil_tree_node *current, void *extra_args);
-int cil_resolve_userrange(struct cil_tree_node *current, void *extra_args);
-int cil_resolve_userbounds(struct cil_tree_node *current, void *extra_args);
-int cil_resolve_userprefix(struct cil_tree_node *current, void *extra_args);
-int cil_resolve_userattributeset(struct cil_tree_node *current, void *extra_args);
-int cil_resolve_selinuxuser(struct cil_tree_node *current, void *extra_args);
-int cil_resolve_roletype(struct cil_tree_node *current, void *extra_args);
-int cil_resolve_roletransition(struct cil_tree_node *current, void *extra_args);
-int cil_resolve_roleallow(struct cil_tree_node *current, void *extra_args);
-int cil_resolve_roleattributeset(struct cil_tree_node *current, void *extra_args);
-int cil_resolve_rolebounds(struct cil_tree_node *current, void *extra_args);
-int cil_resolve_sensalias(struct cil_tree_node *current, void *extra_args);
-int cil_resolve_catalias(struct cil_tree_node *current, void *extra_args);
-int cil_resolve_catorder(struct cil_tree_node *current, void *extra_args);
-int cil_resolve_sensitivityorder(struct cil_tree_node *current, void *extra_args);
-int cil_resolve_cat_list(struct cil_tree_node *current, struct cil_list *cat_list, struct cil_list *res_cat_list, void *extra_args);
-int cil_resolve_catset(struct cil_tree_node *current, struct cil_catset *catset, void *extra_args);
-int cil_resolve_senscat(struct cil_tree_node *current, void *extra_args);
-int cil_resolve_level(struct cil_tree_node *current, struct cil_level *level, void *extra_args);
-int cil_resolve_levelrange(struct cil_tree_node *current, struct cil_levelrange *levelrange, void *extra_args);
-int cil_resolve_constrain(struct cil_tree_node *current, void *extra_args);
-int cil_resolve_validatetrans(struct cil_tree_node *current, void *extra_args);
-int cil_resolve_context(struct cil_tree_node *current, struct cil_context *context, void *extra_args);
-int cil_resolve_filecon(struct cil_tree_node *current, void *extra_args);
-int cil_resolve_ibpkeycon(struct cil_tree_node *current, void *extra_args);
-int cil_resolve_ibendportcon(struct cil_tree_node *current, void *extra_args);
-int cil_resolve_portcon(struct cil_tree_node *current, void *extra_args);
-int cil_resolve_genfscon(struct cil_tree_node *current, void *extra_args);
-int cil_resolve_nodecon(struct cil_tree_node *current, void *extra_args);
-int cil_resolve_netifcon(struct cil_tree_node *current, void *extra_args);
-int cil_resolve_pirqcon(struct cil_tree_node *current, void *extra_args);
-int cil_resolve_iomemcon(struct cil_tree_node *current, void *extra_args);
-int cil_resolve_ioportcon(struct cil_tree_node *current, void *extra_args);
-int cil_resolve_pcidevicecon(struct cil_tree_node *current, void *extra_args);
-int cil_resolve_fsuse(struct cil_tree_node *current, void *extra_args);
-int cil_resolve_sidcontext(struct cil_tree_node *current, void *extra_args);
-int cil_resolve_sidorder(struct cil_tree_node *current, void *extra_args);
-int cil_resolve_blockinherit(struct cil_tree_node *current, void *extra_args);
-int cil_resolve_in(struct cil_tree_node *current, void *extra_args);
-int cil_resolve_call1(struct cil_tree_node *current, void *extra_args);
-int cil_resolve_call2(struct cil_tree_node *, void *extra_args);
+int cil_resolve_classorder(struct cil_tree_node *current, struct cil_db *db, struct cil_list *classorder_list, struct cil_list *unordered_classorder_list);
+int cil_resolve_classperms(struct cil_tree_node *current, struct cil_classperms *cp, struct cil_db *db);
+int cil_resolve_classpermissionset(struct cil_tree_node *current, struct cil_classpermissionset *cps, struct cil_db *db);
+int cil_resolve_classperms_list(struct cil_tree_node *current, struct cil_list *cp_list, struct cil_db *db);
+int cil_resolve_avrule(struct cil_tree_node *current, struct cil_db *db);
+int cil_resolve_deny_rule(struct cil_tree_node *current, struct cil_db *db);
+int cil_resolve_type_rule(struct cil_tree_node *current, struct cil_db *db);
+int cil_resolve_typeattributeset(struct cil_tree_node *current, struct cil_db *db);
+int cil_resolve_typealias(struct cil_tree_node *current, struct cil_db *db);
+int cil_resolve_typebounds(struct cil_tree_node *current, struct cil_db *db);
+int cil_resolve_typepermissive(struct cil_tree_node *current, struct cil_db *db);
+int cil_resolve_nametypetransition(struct cil_tree_node *current, struct cil_db *db);
+int cil_resolve_rangetransition(struct cil_tree_node *current, struct cil_db *db);
+int cil_resolve_classcommon(struct cil_tree_node *current, struct cil_db *db);
+int cil_resolve_classmapping(struct cil_tree_node *current, struct cil_db *db);
+int cil_resolve_userrole(struct cil_tree_node *current, struct cil_db *db);
+int cil_resolve_userlevel(struct cil_tree_node *current, struct cil_db *db);
+int cil_resolve_userrange(struct cil_tree_node *current, struct cil_db *db);
+int cil_resolve_userbounds(struct cil_tree_node *current, struct cil_db *db);
+int cil_resolve_userprefix(struct cil_tree_node *current, struct cil_db *db);
+int cil_resolve_userattributeset(struct cil_tree_node *current, struct cil_db *db);
+int cil_resolve_selinuxuser(struct cil_tree_node *current, struct cil_db *db);
+int cil_resolve_roletype(struct cil_tree_node *current, struct cil_db *db);
+int cil_resolve_roletransition(struct cil_tree_node *current, struct cil_db *db);
+int cil_resolve_roleallow(struct cil_tree_node *current, struct cil_db *db);
+int cil_resolve_roleattributeset(struct cil_tree_node *current, struct cil_db *db);
+int cil_resolve_rolebounds(struct cil_tree_node *current, struct cil_db *db);
+int cil_resolve_sensalias(struct cil_tree_node *current, struct cil_db *db);
+int cil_resolve_catalias(struct cil_tree_node *current, struct cil_db *db);
+int cil_resolve_catorder(struct cil_tree_node *current, struct cil_db *db, struct cil_list *catorder_list);
+int cil_resolve_sensitivityorder(struct cil_tree_node *current, struct cil_db *db, struct cil_list *sensitivityorder_list);
+int cil_resolve_cat_list(struct cil_tree_node *current, struct cil_list *cat_list, struct cil_list *res_cat_list, struct cil_db *db);
+int cil_resolve_catset(struct cil_tree_node *current, struct cil_catset *catset, struct cil_db *db);
+int cil_resolve_senscat(struct cil_tree_node *current, struct cil_db *db);
+int cil_resolve_level(struct cil_tree_node *current, struct cil_level *level, struct cil_db *db);
+int cil_resolve_levelrange(struct cil_tree_node *current, struct cil_levelrange *levelrange, struct cil_db *db);
+int cil_resolve_constrain(struct cil_tree_node *current, struct cil_db *db);
+int cil_resolve_validatetrans(struct cil_tree_node *current, struct cil_db *db);
+int cil_resolve_context(struct cil_tree_node *current, struct cil_context *context, struct cil_db *db);
+int cil_resolve_filecon(struct cil_tree_node *current, struct cil_db *db);
+int cil_resolve_ibpkeycon(struct cil_tree_node *current, struct cil_db *db);
+int cil_resolve_ibendportcon(struct cil_tree_node *current, struct cil_db *db);
+int cil_resolve_portcon(struct cil_tree_node *current, struct cil_db *db);
+int cil_resolve_genfscon(struct cil_tree_node *current, struct cil_db *db);
+int cil_resolve_nodecon(struct cil_tree_node *current, struct cil_db *db);
+int cil_resolve_netifcon(struct cil_tree_node *current, struct cil_db *db);
+int cil_resolve_pirqcon(struct cil_tree_node *current, struct cil_db *db);
+int cil_resolve_iomemcon(struct cil_tree_node *current, struct cil_db *db);
+int cil_resolve_ioportcon(struct cil_tree_node *current, struct cil_db *db);
+int cil_resolve_pcidevicecon(struct cil_tree_node *current, struct cil_db *db);
+int cil_resolve_fsuse(struct cil_tree_node *current, struct cil_db *db);
+int cil_resolve_sidcontext(struct cil_tree_node *current, struct cil_db *db);
+int cil_resolve_sidorder(struct cil_tree_node *current, struct cil_db *db, struct cil_list *sidorder_list);
+int cil_resolve_blockinherit(struct cil_tree_node *current, struct cil_db *db);
+int cil_resolve_in(struct cil_tree_node *current, struct cil_db *db);
+int cil_resolve_call1(struct cil_tree_node *current, struct cil_db *db);
+int cil_resolve_call2(struct cil_tree_node *, struct cil_db *db);
int cil_resolve_name_call_args(struct cil_call *call, char *name, enum cil_sym_index sym_index, struct cil_symtab_datum **datum);
-int cil_resolve_expr(enum cil_flavor expr_type, struct cil_list *str_expr, struct cil_list **datum_expr, struct cil_tree_node *parent, void *extra_args);
-int cil_resolve_boolif(struct cil_tree_node *current, void *extra_args);
+int cil_resolve_expr(enum cil_flavor expr_type, struct cil_list *str_expr, struct cil_list **datum_expr, struct cil_tree_node *parent, struct cil_db *db);
+int cil_resolve_boolif(struct cil_tree_node *current, struct cil_db *db);
int cil_evaluate_expr(struct cil_list *datum_expr, uint16_t *result);
-int cil_resolve_tunif(struct cil_tree_node *current, void *extra_args);
+int cil_resolve_tunif(struct cil_tree_node *current, struct cil_db *db);
int cil_resolve_ast(struct cil_db *db, struct cil_tree_node *current);
-int cil_resolve_name(struct cil_tree_node *ast_node, char *name, enum cil_sym_index sym_index, void *extra_args, struct cil_symtab_datum **datum);
-int cil_resolve_name_keep_aliases(struct cil_tree_node *ast_node, char *name, enum cil_sym_index sym_index, void *extra_args, struct cil_symtab_datum **datum);
+int cil_resolve_name(struct cil_tree_node *ast_node, char *name, enum cil_sym_index sym_index, struct cil_db *db, struct cil_symtab_datum **datum);
+int cil_resolve_name_keep_aliases(struct cil_tree_node *ast_node, char *name, enum cil_sym_index sym_index, struct cil_db *db, struct cil_symtab_datum **datum);
#endif /* CIL_RESOLVE_AST_H_ */
--
2.41.0
^ permalink raw reply related [flat|nested] 16+ messages in thread* [PATCH 2/9] libsepol/cil: Refactor and improve handling of order rules
2023-09-27 19:00 [PATCH 0/9] CIL Cleanups and Improved Argument handling James Carter
2023-09-27 19:00 ` [PATCH 1/9] libsepol/cil: Use struct cil_db * instead of void * James Carter
@ 2023-09-27 19:00 ` James Carter
2023-09-27 19:00 ` [PATCH 3/9] libsepol/cil: Allow IP address and mask values to be directly written James Carter
` (6 subsequent siblings)
8 siblings, 0 replies; 16+ messages in thread
From: James Carter @ 2023-09-27 19:00 UTC (permalink / raw)
To: selinux; +Cc: James Carter
Use the same common structure for the ordering rules (classorder,
sidorder, sensitivityorder, and categoryorder). This removes code
duplication and makes it easier to write out the CIL AST.
Simplify the merging of multiple order rules.
Add a verification that checks that the final merged ordering is
fully specified and without ambiguity.
Signed-off-by: James Carter <jwcart2@gmail.com>
---
libsepol/cil/src/cil.c | 44 ++--
libsepol/cil/src/cil_build_ast.c | 333 +++++++----------------------
libsepol/cil/src/cil_build_ast.h | 10 +-
libsepol/cil/src/cil_copy_ast.c | 86 ++------
libsepol/cil/src/cil_copy_ast.h | 5 +-
libsepol/cil/src/cil_internal.h | 27 +--
libsepol/cil/src/cil_reset_ast.c | 16 +-
libsepol/cil/src/cil_resolve_ast.c | 315 ++++++++++-----------------
libsepol/cil/src/cil_verify.c | 72 +++++++
libsepol/cil/src/cil_verify.h | 1 +
libsepol/cil/src/cil_write_ast.c | 32 ++-
11 files changed, 347 insertions(+), 594 deletions(-)
diff --git a/libsepol/cil/src/cil.c b/libsepol/cil/src/cil.c
index 2021187d..46477d0e 100644
--- a/libsepol/cil/src/cil.c
+++ b/libsepol/cil/src/cil.c
@@ -837,7 +837,7 @@ void cil_destroy_data(void **data, enum cil_flavor flavor)
cil_destroy_class(*data);
break;
case CIL_CLASSORDER:
- cil_destroy_classorder(*data);
+ cil_destroy_ordered(*data);
break;
case CIL_CLASSPERMISSION:
cil_destroy_classpermission(*data);
@@ -934,7 +934,7 @@ void cil_destroy_data(void **data, enum cil_flavor flavor)
cil_destroy_aliasactual(*data);
break;
case CIL_SENSITIVITYORDER:
- cil_destroy_sensitivityorder(*data);
+ cil_destroy_ordered(*data);
break;
case CIL_SENSCAT:
cil_destroy_senscat(*data);
@@ -952,7 +952,7 @@ void cil_destroy_data(void **data, enum cil_flavor flavor)
cil_destroy_aliasactual(*data);
break;
case CIL_CATORDER:
- cil_destroy_catorder(*data);
+ cil_destroy_ordered(*data);
break;
case CIL_LEVEL:
cil_destroy_level(*data);
@@ -964,7 +964,7 @@ void cil_destroy_data(void **data, enum cil_flavor flavor)
cil_destroy_sid(*data);
break;
case CIL_SIDORDER:
- cil_destroy_sidorder(*data);
+ cil_destroy_ordered(*data);
break;
case CIL_NAME:
cil_destroy_name(*data);
@@ -2164,6 +2164,14 @@ void cil_sort_destroy(struct cil_sort **sort)
*sort = NULL;
}
+void cil_ordered_init(struct cil_ordered **ordered)
+{
+ *ordered = cil_malloc(sizeof(**ordered));
+ (*ordered)->merged = CIL_FALSE;
+ (*ordered)->strs = NULL;
+ (*ordered)->datums = NULL;
+}
+
void cil_netifcon_init(struct cil_netifcon **netifcon)
{
*netifcon = cil_malloc(sizeof(**netifcon));
@@ -2281,13 +2289,6 @@ void cil_class_init(struct cil_class **class)
(*class)->ordered = CIL_FALSE;
}
-void cil_classorder_init(struct cil_classorder **classorder)
-{
- *classorder = cil_malloc(sizeof(**classorder));
-
- (*classorder)->class_list_str = NULL;
-}
-
void cil_classcommon_init(struct cil_classcommon **classcommon)
{
*classcommon = cil_malloc(sizeof(**classcommon));
@@ -2315,13 +2316,6 @@ void cil_sidcontext_init(struct cil_sidcontext **sidcontext)
(*sidcontext)->context = NULL;
}
-void cil_sidorder_init(struct cil_sidorder **sidorder)
-{
- *sidorder = cil_malloc(sizeof(**sidorder));
-
- (*sidorder)->sid_list_str = NULL;
-}
-
void cil_userrole_init(struct cil_userrole **userrole)
{
*userrole = cil_malloc(sizeof(**userrole));
@@ -2877,20 +2871,6 @@ void cil_cat_init(struct cil_cat **cat)
(*cat)->value = 0;
}
-void cil_catorder_init(struct cil_catorder **catorder)
-{
- *catorder = cil_malloc(sizeof(**catorder));
-
- (*catorder)->cat_list_str = NULL;
-}
-
-void cil_sensorder_init(struct cil_sensorder **sensorder)
-{
- *sensorder = cil_malloc(sizeof(**sensorder));
-
- (*sensorder)->sens_list_str = NULL;
-}
-
void cil_args_init(struct cil_args **args)
{
*args = cil_malloc(sizeof(**args));
diff --git a/libsepol/cil/src/cil_build_ast.c b/libsepol/cil/src/cil_build_ast.c
index 8976c254..efe1601c 100644
--- a/libsepol/cil/src/cil_build_ast.c
+++ b/libsepol/cil/src/cil_build_ast.c
@@ -186,6 +186,83 @@ static void cil_clear_node(struct cil_tree_node *ast_node)
ast_node->flavor = CIL_NONE;
}
+int cil_gen_ordered(struct cil_db *db, struct cil_tree_node *parse_current, struct cil_tree_node *ast_node, enum cil_flavor flavor)
+{
+ enum cil_syntax syntax[] = {
+ CIL_SYN_STRING,
+ CIL_SYN_LIST,
+ CIL_SYN_END
+ };
+ size_t syntax_len = sizeof(syntax)/sizeof(*syntax);
+ struct cil_ordered *ordered = NULL;
+ struct cil_list_item *curr = NULL;
+
+ int rc = SEPOL_ERR;
+
+ if (db == NULL || parse_current == NULL || ast_node == NULL) {
+ goto exit;
+ }
+
+ rc = __cil_verify_syntax(parse_current, syntax, syntax_len);
+ if (rc != SEPOL_OK) {
+ goto exit;
+ }
+
+ cil_ordered_init(&ordered);
+
+ rc = cil_fill_list(parse_current->next->cl_head, flavor, &ordered->strs);
+ if (rc != SEPOL_OK) {
+ goto exit;
+ }
+
+ cil_list_for_each(curr, ordered->strs) {
+ if (curr->data == CIL_KEY_UNORDERED) {
+ if (flavor == CIL_CLASSORDER) {
+ if (curr == ordered->strs->head && curr->next == NULL) {
+ cil_log(CIL_ERR, "classorder 'unordered' keyword must be followed by one or more class.\n");
+ rc = SEPOL_ERR;
+ goto exit;
+ } else if (curr != ordered->strs->head) {
+ cil_log(CIL_ERR, "classorder can only use 'unordered' keyword as the first item in the list.\n");
+ rc = SEPOL_ERR;
+ goto exit;
+ }
+ } else {
+ cil_log(CIL_ERR, "The 'unordered' keyword can only be used with classorder rules.\n");
+ rc = SEPOL_ERR;
+ goto exit;
+ }
+ }
+ }
+
+ ast_node->data = ordered;
+ ast_node->flavor = flavor;
+
+ return SEPOL_OK;
+
+exit:
+ cil_tree_log(parse_current, CIL_ERR, "Bad ordered declaration");
+ cil_destroy_ordered(ordered);
+ return rc;
+}
+
+void cil_destroy_ordered(struct cil_ordered *ordered)
+{
+ if (ordered == NULL) {
+ return;
+ }
+
+ if (ordered->strs != NULL) {
+ cil_list_destroy(&ordered->strs, CIL_FALSE);
+ }
+ if (ordered->datums != NULL) {
+ cil_list_destroy(&ordered->datums, CIL_FALSE);
+ }
+
+ free(ordered);
+}
+
+
int cil_gen_block(struct cil_db *db, struct cil_tree_node *parse_current, struct cil_tree_node *ast_node, uint16_t is_abstract)
{
enum cil_syntax syntax[] = {
@@ -510,74 +587,6 @@ void cil_destroy_class(struct cil_class *class)
free(class);
}
-int cil_gen_classorder(struct cil_db *db, struct cil_tree_node *parse_current, struct cil_tree_node *ast_node)
-{
- enum cil_syntax syntax[] = {
- CIL_SYN_STRING,
- CIL_SYN_LIST,
- CIL_SYN_END
- };
- size_t syntax_len = sizeof(syntax)/sizeof(*syntax);
- struct cil_classorder *classorder = NULL;
- struct cil_list_item *curr = NULL;
- struct cil_list_item *head = NULL;
- int rc = SEPOL_ERR;
-
- if (db == NULL || parse_current == NULL || ast_node == NULL) {
- goto exit;
- }
-
- rc = __cil_verify_syntax(parse_current, syntax, syntax_len);
- if (rc != SEPOL_OK) {
- goto exit;
- }
-
- cil_classorder_init(&classorder);
-
- rc = cil_fill_list(parse_current->next->cl_head, CIL_CLASSORDER, &classorder->class_list_str);
- if (rc != SEPOL_OK) {
- goto exit;
- }
-
- head = classorder->class_list_str->head;
- cil_list_for_each(curr, classorder->class_list_str) {
- if (curr->data == CIL_KEY_UNORDERED) {
- if (curr == head && curr->next == NULL) {
- cil_log(CIL_ERR, "Classorder 'unordered' keyword must be followed by one or more class.\n");
- rc = SEPOL_ERR;
- goto exit;
- } else if (curr != head) {
- cil_log(CIL_ERR, "Classorder can only use 'unordered' keyword as the first item in the list.\n");
- rc = SEPOL_ERR;
- goto exit;
- }
- }
- }
-
- ast_node->data = classorder;
- ast_node->flavor = CIL_CLASSORDER;
-
- return SEPOL_OK;
-
-exit:
- cil_tree_log(parse_current, CIL_ERR, "Bad classorder declaration");
- cil_destroy_classorder(classorder);
- return rc;
-}
-
-void cil_destroy_classorder(struct cil_classorder *classorder)
-{
- if (classorder == NULL) {
- return;
- }
-
- if (classorder->class_list_str != NULL) {
- cil_list_destroy(&classorder->class_list_str, 1);
- }
-
- free(classorder);
-}
-
int cil_gen_perm(struct cil_db *db, struct cil_tree_node *parse_current, struct cil_tree_node *ast_node, enum cil_flavor flavor, unsigned int *num_perms)
{
char *key = NULL;
@@ -1220,66 +1229,6 @@ void cil_destroy_sidcontext(struct cil_sidcontext *sidcon)
free(sidcon);
}
-int cil_gen_sidorder(struct cil_db *db, struct cil_tree_node *parse_current, struct cil_tree_node *ast_node)
-{
- enum cil_syntax syntax[] = {
- CIL_SYN_STRING,
- CIL_SYN_LIST,
- CIL_SYN_END
- };
- size_t syntax_len = sizeof(syntax)/sizeof(*syntax);
- struct cil_sidorder *sidorder = NULL;
- struct cil_list_item *curr = NULL;
- int rc = SEPOL_ERR;
-
- if (db == NULL || parse_current == NULL || ast_node == NULL) {
- goto exit;
- }
-
- rc = __cil_verify_syntax(parse_current, syntax, syntax_len);
- if (rc != SEPOL_OK) {
- goto exit;
- }
-
- cil_sidorder_init(&sidorder);
-
- rc = cil_fill_list(parse_current->next->cl_head, CIL_SIDORDER, &sidorder->sid_list_str);
- if (rc != SEPOL_OK) {
- goto exit;
- }
-
- cil_list_for_each(curr, sidorder->sid_list_str) {
- if (curr->data == CIL_KEY_UNORDERED) {
- cil_log(CIL_ERR, "Sidorder cannot be unordered.\n");
- rc = SEPOL_ERR;
- goto exit;
- }
- }
-
- ast_node->data = sidorder;
- ast_node->flavor = CIL_SIDORDER;
-
- return SEPOL_OK;
-
-exit:
- cil_tree_log(parse_current, CIL_ERR, "Bad sidorder declaration");
- cil_destroy_sidorder(sidorder);
- return rc;
-}
-
-void cil_destroy_sidorder(struct cil_sidorder *sidorder)
-{
- if (sidorder == NULL) {
- return;
- }
-
- if (sidorder->sid_list_str != NULL) {
- cil_list_destroy(&sidorder->sid_list_str, 1);
- }
-
- free(sidorder);
-}
-
int cil_gen_user(struct cil_db *db, struct cil_tree_node *parse_current, struct cil_tree_node *ast_node)
{
enum cil_syntax syntax[] = {
@@ -3699,126 +3648,6 @@ void cil_destroy_catset(struct cil_catset *catset)
free(catset);
}
-int cil_gen_catorder(struct cil_db *db, struct cil_tree_node *parse_current, struct cil_tree_node *ast_node)
-{
- enum cil_syntax syntax[] = {
- CIL_SYN_STRING,
- CIL_SYN_LIST,
- CIL_SYN_END
- };
- size_t syntax_len = sizeof(syntax)/sizeof(*syntax);
- struct cil_catorder *catorder = NULL;
- struct cil_list_item *curr = NULL;
- int rc = SEPOL_ERR;
-
- if (db == NULL || parse_current == NULL || ast_node == NULL) {
- goto exit;
- }
-
- rc = __cil_verify_syntax(parse_current, syntax, syntax_len);
- if (rc != SEPOL_OK) {
- goto exit;
- }
-
- cil_catorder_init(&catorder);
-
- rc = cil_fill_list(parse_current->next->cl_head, CIL_CATORDER, &catorder->cat_list_str);
- if (rc != SEPOL_OK) {
- goto exit;
- }
-
- cil_list_for_each(curr, catorder->cat_list_str) {
- if (curr->data == CIL_KEY_UNORDERED) {
- cil_log(CIL_ERR, "Category order cannot be unordered.\n");
- rc = SEPOL_ERR;
- goto exit;
- }
- }
-
- ast_node->data = catorder;
- ast_node->flavor = CIL_CATORDER;
-
- return SEPOL_OK;
-
-exit:
- cil_tree_log(parse_current, CIL_ERR, "Bad categoryorder declaration");
- cil_destroy_catorder(catorder);
- return rc;
-}
-
-void cil_destroy_catorder(struct cil_catorder *catorder)
-{
- if (catorder == NULL) {
- return;
- }
-
- if (catorder->cat_list_str != NULL) {
- cil_list_destroy(&catorder->cat_list_str, 1);
- }
-
- free(catorder);
-}
-
-int cil_gen_sensitivityorder(struct cil_db *db, struct cil_tree_node *parse_current, struct cil_tree_node *ast_node)
-{
- enum cil_syntax syntax[] = {
- CIL_SYN_STRING,
- CIL_SYN_LIST,
- CIL_SYN_END
- };
- size_t syntax_len = sizeof(syntax)/sizeof(*syntax);
- struct cil_sensorder *sensorder = NULL;
- struct cil_list_item *curr = NULL;
- int rc = SEPOL_ERR;
-
- if (db == NULL || parse_current == NULL || ast_node == NULL) {
- goto exit;
- }
-
- rc = __cil_verify_syntax(parse_current, syntax, syntax_len);
- if (rc != SEPOL_OK) {
- goto exit;
- }
-
- cil_sensorder_init(&sensorder);
-
- rc = cil_fill_list(parse_current->next->cl_head, CIL_SENSITIVITYORDER, &sensorder->sens_list_str);
- if (rc != SEPOL_OK) {
- goto exit;
- }
-
- cil_list_for_each(curr, sensorder->sens_list_str) {
- if (curr->data == CIL_KEY_UNORDERED) {
- cil_log(CIL_ERR, "Sensitivity order cannot be unordered.\n");
- rc = SEPOL_ERR;
- goto exit;
- }
- }
-
- ast_node->data = sensorder;
- ast_node->flavor = CIL_SENSITIVITYORDER;
-
- return SEPOL_OK;
-
-exit:
- cil_tree_log(parse_current, CIL_ERR, "Bad sensitivityorder declaration");
- cil_destroy_sensitivityorder(sensorder);
- return rc;
-}
-
-void cil_destroy_sensitivityorder(struct cil_sensorder *sensorder)
-{
- if (sensorder == NULL) {
- return;
- }
-
- if (sensorder->sens_list_str != NULL) {
- cil_list_destroy(&sensorder->sens_list_str, CIL_TRUE);
- }
-
- free(sensorder);
-}
-
int cil_gen_senscat(struct cil_db *db, struct cil_tree_node *parse_current, struct cil_tree_node *ast_node)
{
enum cil_syntax syntax[] = {
@@ -6314,7 +6143,7 @@ static struct cil_tree_node * parse_statement(struct cil_db *db, struct cil_tree
} else if (parse_current->data == CIL_KEY_CLASS) {
rc = cil_gen_class(db, parse_current, new_ast_node);
} else if (parse_current->data == CIL_KEY_CLASSORDER) {
- rc = cil_gen_classorder(db, parse_current, new_ast_node);
+ rc = cil_gen_ordered(db, parse_current, new_ast_node, CIL_CLASSORDER);
} else if (parse_current->data == CIL_KEY_MAP_CLASS) {
rc = cil_gen_map_class(db, parse_current, new_ast_node);
} else if (parse_current->data == CIL_KEY_CLASSMAPPING) {
@@ -6332,7 +6161,7 @@ static struct cil_tree_node * parse_statement(struct cil_db *db, struct cil_tree
} else if (parse_current->data == CIL_KEY_SIDCONTEXT) {
rc = cil_gen_sidcontext(db, parse_current, new_ast_node);
} else if (parse_current->data == CIL_KEY_SIDORDER) {
- rc = cil_gen_sidorder(db, parse_current, new_ast_node);
+ rc = cil_gen_ordered(db, parse_current, new_ast_node, CIL_SIDORDER);
} else if (parse_current->data == CIL_KEY_USER) {
rc = cil_gen_user(db, parse_current, new_ast_node);
} else if (parse_current->data == CIL_KEY_USERATTRIBUTE) {
@@ -6446,9 +6275,9 @@ static struct cil_tree_node * parse_statement(struct cil_db *db, struct cil_tree
} else if (parse_current->data == CIL_KEY_CATSET) {
rc = cil_gen_catset(db, parse_current, new_ast_node);
} else if (parse_current->data == CIL_KEY_CATORDER) {
- rc = cil_gen_catorder(db, parse_current, new_ast_node);
+ rc = cil_gen_ordered(db, parse_current, new_ast_node, CIL_CATORDER);
} else if (parse_current->data == CIL_KEY_SENSITIVITYORDER) {
- rc = cil_gen_sensitivityorder(db, parse_current, new_ast_node);
+ rc = cil_gen_ordered(db, parse_current, new_ast_node, CIL_SENSITIVITYORDER);
} else if (parse_current->data == CIL_KEY_SENSCAT) {
rc = cil_gen_senscat(db, parse_current, new_ast_node);
} else if (parse_current->data == CIL_KEY_LEVEL) {
diff --git a/libsepol/cil/src/cil_build_ast.h b/libsepol/cil/src/cil_build_ast.h
index aca84b24..96af3c91 100644
--- a/libsepol/cil/src/cil_build_ast.h
+++ b/libsepol/cil/src/cil_build_ast.h
@@ -42,6 +42,8 @@ int cil_add_decl_to_symtab(struct cil_db *db, symtab_t *symtab, hashtab_key_t ke
int cil_gen_node(struct cil_db *db, struct cil_tree_node *ast_node, struct cil_symtab_datum *datum, hashtab_key_t key, enum cil_sym_index sflavor, enum cil_flavor nflavor);
int cil_parse_to_list(struct cil_tree_node *parse_cl_head, struct cil_list *ast_cl, enum cil_flavor flavor);
+int cil_gen_ordered(struct cil_db *db, struct cil_tree_node *parse_current, struct cil_tree_node *ast_node, enum cil_flavor flavor);
+void cil_destroy_ordered(struct cil_ordered *ordered);
int cil_gen_block(struct cil_db *db, struct cil_tree_node *parse_current, struct cil_tree_node *ast_node, uint16_t is_abstract);
void cil_destroy_block(struct cil_block *block);
int cil_gen_blockinherit(struct cil_db *db, struct cil_tree_node *parse_current, struct cil_tree_node *ast_node);
@@ -52,8 +54,6 @@ int cil_gen_in(struct cil_db *db, struct cil_tree_node *parse_current, struct ci
void cil_destroy_in(struct cil_in *in);
int cil_gen_class(struct cil_db *db, struct cil_tree_node *parse_current, struct cil_tree_node *ast_node);
void cil_destroy_class(struct cil_class *class);
-int cil_gen_classorder(struct cil_db *db, struct cil_tree_node *parse_current, struct cil_tree_node *ast_node);
-void cil_destroy_classorder(struct cil_classorder *classorder);
int cil_gen_perm(struct cil_db *db, struct cil_tree_node *parse_current, struct cil_tree_node *ast_node, enum cil_flavor flavor, unsigned int *num_perms);
void cil_destroy_perm(struct cil_perm *perm);
int cil_gen_perm_nodes(struct cil_db *db, struct cil_tree_node *current_perm, struct cil_tree_node *ast_node, enum cil_flavor flavor, unsigned int *num_perms);
@@ -78,8 +78,6 @@ int cil_gen_sid(struct cil_db *db, struct cil_tree_node *parse_current, struct c
void cil_destroy_sid(struct cil_sid *sid);
int cil_gen_sidcontext(struct cil_db *db, struct cil_tree_node *parse_current, struct cil_tree_node *ast_node);
void cil_destroy_sidcontext(struct cil_sidcontext *sidcon);
-int cil_gen_sidorder(struct cil_db *db, struct cil_tree_node *parse_current, struct cil_tree_node *ast_node);
-void cil_destroy_sidorder(struct cil_sidorder *sidorder);
int cil_gen_user(struct cil_db *db, struct cil_tree_node *parse_current, struct cil_tree_node *ast_node);
void cil_destroy_user(struct cil_user *user);
int cil_gen_userattribute(struct cil_db *db, struct cil_tree_node *parse_current, struct cil_tree_node *ast_node);
@@ -158,10 +156,6 @@ int cil_gen_category(struct cil_db *db, struct cil_tree_node *parse_current, str
void cil_destroy_category(struct cil_cat *cat);
int cil_set_to_list(struct cil_tree_node *parse_current, struct cil_list *ast_cl);
void cil_destroy_catset(struct cil_catset *catset);
-int cil_gen_catorder(struct cil_db *db, struct cil_tree_node *parse_current, struct cil_tree_node *ast_node);
-void cil_destroy_catorder(struct cil_catorder *catorder);
-int cil_gen_sensitivityorder(struct cil_db *db, struct cil_tree_node *parse_current, struct cil_tree_node *ast_node);
-void cil_destroy_sensitivityorder(struct cil_sensorder *sensorder);
int cil_gen_senscat(struct cil_db *db, struct cil_tree_node *parse_current, struct cil_tree_node *ast_node);
void cil_destroy_senscat(struct cil_senscat *senscat);
int cil_gen_level(struct cil_db *db, struct cil_tree_node *parse_current, struct cil_tree_node *ast_node);
diff --git a/libsepol/cil/src/cil_copy_ast.c b/libsepol/cil/src/cil_copy_ast.c
index bc972f03..735628df 100644
--- a/libsepol/cil/src/cil_copy_ast.c
+++ b/libsepol/cil/src/cil_copy_ast.c
@@ -97,6 +97,24 @@ static int cil_copy_node(__attribute__((unused)) struct cil_db *db, void *data,
return SEPOL_OK;
}
+int cil_copy_ordered(__attribute__((unused)) struct cil_db *db, void *data, void **copy, __attribute__((unused)) symtab_t *symtab)
+{
+ struct cil_ordered *orig = data;
+ struct cil_ordered *new = NULL;
+
+ cil_ordered_init(&new);
+ if (orig->strs != NULL) {
+ cil_copy_list(orig->strs, &new->strs);
+ }
+ if (orig->datums != NULL) {
+ cil_copy_list(orig->datums, &new->datums);
+ }
+
+ *copy = new;
+
+ return SEPOL_OK;
+}
+
int cil_copy_block(__attribute__((unused)) struct cil_db *db, void *data, void **copy, symtab_t *symtab)
{
struct cil_block *orig = data;
@@ -261,21 +279,6 @@ int cil_copy_class(__attribute__((unused)) struct cil_db *db, void *data, void *
return SEPOL_OK;
}
-int cil_copy_classorder(__attribute__((unused)) struct cil_db *db, void *data, void **copy, __attribute__((unused)) symtab_t *symtab)
-{
- struct cil_classorder *orig = data;
- struct cil_classorder *new = NULL;
-
- cil_classorder_init(&new);
- if (orig->class_list_str != NULL) {
- cil_copy_list(orig->class_list_str, &new->class_list_str);
- }
-
- *copy = new;
-
- return SEPOL_OK;
-}
-
int cil_copy_classpermission(__attribute__((unused)) struct cil_db *db, void *data, void **copy, symtab_t *symtab)
{
struct cil_classpermission *orig = data;
@@ -368,21 +371,6 @@ int cil_copy_sidcontext(struct cil_db *db, void *data, void **copy, __attribute_
return SEPOL_OK;
}
-int cil_copy_sidorder(__attribute__((unused)) struct cil_db *db, void *data, void **copy, __attribute__((unused)) symtab_t *symtab)
-{
- struct cil_sidorder *orig = data;
- struct cil_sidorder *new = NULL;
-
- cil_sidorder_init(&new);
- if (orig->sid_list_str != NULL) {
- cil_copy_list(orig->sid_list_str, &new->sid_list_str);
- }
-
- *copy = new;
-
- return SEPOL_OK;
-}
-
int cil_copy_user(__attribute__((unused)) struct cil_db *db, void *data, void **copy, symtab_t *symtab)
{
struct cil_user *orig = data;
@@ -969,36 +957,6 @@ int cil_copy_senscat(struct cil_db *db, void *data, void **copy, __attribute__((
return SEPOL_OK;
}
-int cil_copy_catorder(__attribute__((unused)) struct cil_db *db, void *data, void **copy, __attribute__((unused)) symtab_t *symtab)
-{
- struct cil_catorder *orig = data;
- struct cil_catorder *new = NULL;
-
- cil_catorder_init(&new);
- if (orig->cat_list_str != NULL) {
- cil_copy_list(orig->cat_list_str, &new->cat_list_str);
- }
-
- *copy = new;
-
- return SEPOL_OK;
-}
-
-int cil_copy_sensitivityorder(__attribute__((unused)) struct cil_db *db, void *data, void **copy, __attribute__((unused)) symtab_t *symtab)
-{
- struct cil_sensorder *orig = data;
- struct cil_sensorder *new = NULL;
-
- cil_sensorder_init(&new);
- if (orig->sens_list_str != NULL) {
- cil_copy_list(orig->sens_list_str, &new->sens_list_str);
- }
-
- *copy = new;
-
- return SEPOL_OK;
-}
-
void cil_copy_fill_level(struct cil_db *db, struct cil_level *orig, struct cil_level **new)
{
cil_level_init(new);
@@ -1768,7 +1726,7 @@ static int __cil_copy_node_helper(struct cil_tree_node *orig, uint32_t *finished
copy_func = &cil_copy_class;
break;
case CIL_CLASSORDER:
- copy_func = &cil_copy_classorder;
+ copy_func = &cil_copy_ordered;
break;
case CIL_CLASSPERMISSION:
copy_func = &cil_copy_classpermission;
@@ -1786,7 +1744,7 @@ static int __cil_copy_node_helper(struct cil_tree_node *orig, uint32_t *finished
copy_func = &cil_copy_sidcontext;
break;
case CIL_SIDORDER:
- copy_func = &cil_copy_sidorder;
+ copy_func = &cil_copy_ordered;
break;
case CIL_USER:
copy_func = &cil_copy_user;
@@ -1907,10 +1865,10 @@ static int __cil_copy_node_helper(struct cil_tree_node *orig, uint32_t *finished
copy_func = &cil_copy_senscat;
break;
case CIL_CATORDER:
- copy_func = &cil_copy_catorder;
+ copy_func = &cil_copy_ordered;
break;
case CIL_SENSITIVITYORDER:
- copy_func = &cil_copy_sensitivityorder;
+ copy_func = &cil_copy_ordered;
break;
case CIL_LEVEL:
copy_func = &cil_copy_level;
diff --git a/libsepol/cil/src/cil_copy_ast.h b/libsepol/cil/src/cil_copy_ast.h
index 9f695ec5..9e6be5ac 100644
--- a/libsepol/cil/src/cil_copy_ast.h
+++ b/libsepol/cil/src/cil_copy_ast.h
@@ -37,12 +37,12 @@
void cil_copy_list(struct cil_list *orig, struct cil_list **copy);
int cil_copy_expr(struct cil_db *db, struct cil_list *orig, struct cil_list **new);
+int cil_copy_ordered(__attribute__((unused)) struct cil_db *db, void *data, void **copy, __attribute__((unused)) symtab_t *symtab);
int cil_copy_block(struct cil_db *db, void *data, void **copy, symtab_t *symtab);
int cil_copy_blockabstract(struct cil_db *db, void *data, void **copy, symtab_t *symtab);
int cil_copy_blockinherit(struct cil_db *db, void *data, void **copy, symtab_t *symtab);
int cil_copy_perm(struct cil_db *db, void *data, void **copy, symtab_t *symtab);
int cil_copy_class(struct cil_db *db, void *data, void **copy, symtab_t *symtab);
-int cil_copy_classorder(struct cil_db *db, void *data, void **copy, symtab_t *symtab);
int cil_copy_classmapping(struct cil_db *db, void *data, void **copy, symtab_t *symtab);
int cil_copy_permset(struct cil_db *db, void *data, void **copy, symtab_t *symtab);
@@ -55,7 +55,6 @@ int cil_copy_common(struct cil_db *db, void *data, void **copy, symtab_t *symtab
int cil_copy_classcommon(struct cil_db *db, void *data, void **copy, symtab_t *symtab);
int cil_copy_sid(struct cil_db *db, void *data, void **copy, symtab_t *symtab);
int cil_copy_sidcontext(struct cil_db *db, void *data, void **copy, symtab_t *symtab);
-int cil_copy_sidorder(struct cil_db *db, void *data, void **copy, symtab_t *symtab);
int cil_copy_user(struct cil_db *db, void *data, void **copy, symtab_t *symtab);
int cil_copy_userattribute(struct cil_db *db, void *data, void **copy, symtab_t *symtab);
int cil_copy_userattributeset(struct cil_db *db, void *data, void **copy, symtab_t *symtab);
@@ -88,8 +87,6 @@ int cil_copy_cat(struct cil_db *db, void *data, void **copy, symtab_t *symtab);
int cil_copy_catalias(struct cil_db *db, void *data, void **copy, symtab_t *symtab);
int cil_copy_catset(struct cil_db *db, void *data, void **copy, symtab_t *symtab);
int cil_copy_senscat(struct cil_db *db, void *data, void **copy, symtab_t *symtab);
-int cil_copy_catorder(struct cil_db *db, void *data, void **copy, symtab_t *symtab);
-int cil_copy_sensitivityorder(struct cil_db *db, void *data, void **copy, symtab_t *symtab);
void cil_copy_fill_level(struct cil_db *db, struct cil_level *orig, struct cil_level **new);
int cil_copy_level(struct cil_db *db, void *data, void **copy, symtab_t *symtab);
void cil_copy_fill_levelrange(struct cil_db *db, struct cil_levelrange *orig, struct cil_levelrange *new);
diff --git a/libsepol/cil/src/cil_internal.h b/libsepol/cil/src/cil_internal.h
index 9e492cb9..013483c9 100644
--- a/libsepol/cil/src/cil_internal.h
+++ b/libsepol/cil/src/cil_internal.h
@@ -347,6 +347,12 @@ struct cil_sort {
void **array;
};
+struct cil_ordered {
+ int merged;
+ struct cil_list *strs;
+ struct cil_list *datums;
+};
+
struct cil_block {
struct cil_symtab_datum datum;
symtab_t symtab[CIL_SYM_NUM];
@@ -387,10 +393,6 @@ struct cil_class {
uint32_t ordered; /* Only used for kernel class */
};
-struct cil_classorder {
- struct cil_list *class_list_str;
-};
-
struct cil_classperms_set {
char *set_str;
struct cil_classpermission *set;
@@ -446,10 +448,6 @@ struct cil_sidcontext {
struct cil_context *context;
};
-struct cil_sidorder {
- struct cil_list *sid_list_str;
-};
-
struct cil_user {
struct cil_symtab_datum datum;
struct cil_user *bounds;
@@ -685,10 +683,6 @@ struct cil_sens {
uint32_t ordered;
};
-struct cil_sensorder {
- struct cil_list *sens_list_str;
-};
-
struct cil_cat {
struct cil_symtab_datum datum;
uint32_t ordered;
@@ -706,10 +700,6 @@ struct cil_catset {
struct cil_cats *cats;
};
-struct cil_catorder {
- struct cil_list *cat_list_str;
-};
-
struct cil_senscat {
char *sens_str;
struct cil_cats *cats;
@@ -1012,6 +1002,7 @@ int cil_string_to_uint64(const char *string, uint64_t *value, int base);
void cil_sort_init(struct cil_sort **sort);
void cil_sort_destroy(struct cil_sort **sort);
+void cil_ordered_init(struct cil_ordered **ordered);
void cil_netifcon_init(struct cil_netifcon **netifcon);
void cil_ibendportcon_init(struct cil_ibendportcon **ibendportcon);
void cil_context_init(struct cil_context **context);
@@ -1023,11 +1014,9 @@ void cil_blockinherit_init(struct cil_blockinherit **inherit);
void cil_blockabstract_init(struct cil_blockabstract **abstract);
void cil_in_init(struct cil_in **in);
void cil_class_init(struct cil_class **class);
-void cil_classorder_init(struct cil_classorder **classorder);
void cil_classcommon_init(struct cil_classcommon **classcommon);
void cil_sid_init(struct cil_sid **sid);
void cil_sidcontext_init(struct cil_sidcontext **sidcontext);
-void cil_sidorder_init(struct cil_sidorder **sidorder);
void cil_userrole_init(struct cil_userrole **userrole);
void cil_userprefix_init(struct cil_userprefix **userprefix);
void cil_selinuxuser_init(struct cil_selinuxuser **selinuxuser);
@@ -1083,8 +1072,6 @@ void cil_userrange_init(struct cil_userrange **userrange);
void cil_role_init(struct cil_role **role);
void cil_type_init(struct cil_type **type);
void cil_cat_init(struct cil_cat **cat);
-void cil_catorder_init(struct cil_catorder **catorder);
-void cil_sensorder_init(struct cil_sensorder **sensorder);
void cil_args_init(struct cil_args **args);
void cil_call_init(struct cil_call **call);
void cil_optional_init(struct cil_optional **optional);
diff --git a/libsepol/cil/src/cil_reset_ast.c b/libsepol/cil/src/cil_reset_ast.c
index 9069317e..fa312c6f 100644
--- a/libsepol/cil/src/cil_reset_ast.c
+++ b/libsepol/cil/src/cil_reset_ast.c
@@ -11,6 +11,12 @@ static inline void cil_reset_levelrange(struct cil_levelrange *levelrange);
static inline void cil_reset_context(struct cil_context *context);
+static void cil_reset_ordered(struct cil_ordered *ordered)
+{
+ ordered->merged = CIL_FALSE;
+ cil_list_destroy(&ordered->datums, CIL_FALSE);
+}
+
static int __class_reset_perm_values(__attribute__((unused)) hashtab_key_t k, hashtab_datum_t d, void *args)
{
struct cil_perm *perm = (struct cil_perm *)d;
@@ -638,14 +644,16 @@ static int __cil_reset_node(struct cil_tree_node *node, __attribute__((unused))
case CIL_BOOLEANIF:
cil_reset_booleanif(node->data);
break;
- case CIL_TUNABLEIF:
- case CIL_CALL:
- break; /* Not effected by optional block disabling */
- case CIL_MACRO:
case CIL_SIDORDER:
case CIL_CLASSORDER:
case CIL_CATORDER:
case CIL_SENSITIVITYORDER:
+ cil_reset_ordered(node->data);
+ break;
+ case CIL_TUNABLEIF:
+ case CIL_CALL:
+ break; /* Not effected by optional block disabling */
+ case CIL_MACRO:
break; /* Nothing to reset */
default:
break;
diff --git a/libsepol/cil/src/cil_resolve_ast.c b/libsepol/cil/src/cil_resolve_ast.c
index 595bd2b9..0172bbdd 100644
--- a/libsepol/cil/src/cil_resolve_ast.c
+++ b/libsepol/cil/src/cil_resolve_ast.c
@@ -1213,55 +1213,6 @@ exit:
return rc;
}
-struct cil_ordered_list {
- int merged;
- struct cil_list *list;
- struct cil_tree_node *node;
-};
-
-static void __cil_ordered_list_init(struct cil_ordered_list **ordered)
-{
- *ordered = cil_malloc(sizeof(**ordered));
-
- (*ordered)->merged = CIL_FALSE;
- (*ordered)->list = NULL;
- (*ordered)->node = NULL;
-}
-
-static void __cil_ordered_list_destroy(struct cil_ordered_list **ordered)
-{
- cil_list_destroy(&(*ordered)->list, CIL_FALSE);
- (*ordered)->node = NULL;
- free(*ordered);
- *ordered = NULL;
-}
-
-static void __cil_ordered_lists_destroy(struct cil_list **ordered_lists)
-{
- struct cil_list_item *item = NULL;
-
- if (ordered_lists == NULL || *ordered_lists == NULL) {
- return;
- }
-
- item = (*ordered_lists)->head;
- while (item != NULL) {
- struct cil_list_item *next = item->next;
- struct cil_ordered_list *ordered = item->data;
- __cil_ordered_list_destroy(&ordered);
- free(item);
- item = next;
- }
- free(*ordered_lists);
- *ordered_lists = NULL;
-}
-
-static void __cil_ordered_lists_reset(struct cil_list **ordered_lists)
-{
- __cil_ordered_lists_destroy(ordered_lists);
- cil_list_init(ordered_lists, CIL_LIST_ITEM);
-}
-
static struct cil_list_item *__cil_ordered_item_insert(struct cil_list *old, struct cil_list_item *curr, struct cil_list_item *item)
{
if (item->flavor == CIL_SID) {
@@ -1310,24 +1261,30 @@ static int __cil_ordered_list_insert(struct cil_list *old, struct cil_list_item
return SEPOL_OK;
}
-static struct cil_list_item *__cil_ordered_find_match(struct cil_list_item *t, struct cil_list_item *i)
+static void __cil_ordered_find_next_match(struct cil_list_item **i, struct cil_list_item **j, struct cil_list_item **p)
{
- while (i) {
- if (i->data == t->data) {
- return i;
+ struct cil_list_item *pstart = *p;
+ struct cil_list_item *jstart = *j;
+
+ while (*i) {
+ *p = pstart;
+ *j = jstart;
+ while (*j) {
+ if ((*i)->data == (*j)->data) {
+ return;
+ }
+ *p = *j;
+ *j = (*j)->next;
}
- i = i->next;
+ *i = (*i)->next;
}
- return NULL;
}
static int __cil_ordered_lists_merge(struct cil_list *old, struct cil_list *new)
{
- struct cil_list_item *omatch = NULL;
struct cil_list_item *ofirst = old->head;
struct cil_list_item *ocurr = NULL;
struct cil_list_item *oprev = NULL;
- struct cil_list_item *nmatch = NULL;
struct cil_list_item *nfirst = new->head;
struct cil_list_item *ncurr = NULL;
int rc = SEPOL_ERR;
@@ -1338,75 +1295,41 @@ static int __cil_ordered_lists_merge(struct cil_list *old, struct cil_list *new)
if (ofirst == NULL) {
/* First list added */
- rc = __cil_ordered_list_insert(old, NULL, nfirst, NULL);
- return rc;
+ return __cil_ordered_list_insert(old, NULL, nfirst, NULL);
}
- /* Find a match between the new list and the old one */
- for (nmatch = nfirst; nmatch; nmatch = nmatch->next) {
- omatch = __cil_ordered_find_match(nmatch, ofirst);
- if (omatch) {
+ ncurr = nfirst;
+ ocurr = ofirst;
+ oprev = NULL;
+ while (ncurr && ocurr) {
+ __cil_ordered_find_next_match(&ncurr, &ocurr, &oprev);
+ if (!ncurr || !ocurr) {
break;
}
- }
-
- if (!nmatch) {
- /* List cannot be merged yet */
- return SEPOL_ERR;
- }
-
- if (nmatch != nfirst && omatch != ofirst) {
- /* Potential ordering conflict--try again later */
- return SEPOL_ERR;
- }
-
- if (nmatch != nfirst) {
- /* Prepend the beginning of the new list up to the first match to the old list */
- rc = __cil_ordered_list_insert(old, NULL, nfirst, nmatch);
- if (rc != SEPOL_OK) {
- return rc;
+ if (ncurr != nfirst) {
+ rc = __cil_ordered_list_insert(old, oprev, nfirst, ncurr);
+ if (rc != SEPOL_OK) {
+ return rc;
+ }
}
+ ncurr = ncurr->next;
+ nfirst = ncurr;
+ oprev = ocurr;
+ ocurr = ocurr->next;
}
- /* In the overlapping protion, add items from the new list not in the old list */
- ncurr = nmatch->next;
- ocurr = omatch->next;
- oprev = omatch;
- while (ncurr && ocurr) {
- if (ncurr->data == ocurr->data) {
- oprev = ocurr;
- ocurr = ocurr->next;
- ncurr = ncurr->next;
+ if (!ncurr) {
+ if (!nfirst) {
+ /* Done */
+ return SEPOL_OK;
} else {
- /* Handle gap in old: old = (A C) new = (A B C) */
- nmatch = __cil_ordered_find_match(ocurr, ncurr->next);
- if (nmatch) {
- rc = __cil_ordered_list_insert(old, oprev, ncurr, nmatch);
- if (rc != SEPOL_OK) {
- return rc;
- }
- oprev = ocurr;
- ocurr = ocurr->next;
- ncurr = nmatch->next;
- continue;
- }
- /* Handle gap in new: old = (A B C) new = (A C) */
- omatch = __cil_ordered_find_match(ncurr, ocurr->next);
- if (omatch) {
- /* Nothing to insert, just skip */
- oprev = omatch;
- ocurr = omatch->next;
- ncurr = ncurr->next;
- continue;
- } else {
- return SEPOL_ERR;
- }
+ /* Can't merge yet */
+ return SEPOL_ERR;
}
}
- if (ncurr) {
- /* Add the rest of the items from the new list */
- rc = __cil_ordered_list_insert(old, old->tail, ncurr, NULL);
+ if (ncurr && !ocurr) { /* some remaining */
+ rc = __cil_ordered_list_insert(old, oprev, ncurr, NULL);
if (rc != SEPOL_OK) {
return rc;
}
@@ -1415,18 +1338,19 @@ static int __cil_ordered_lists_merge(struct cil_list *old, struct cil_list *new)
return SEPOL_OK;
}
-static int insert_unordered(struct cil_list *merged, struct cil_list *unordered)
+static int insert_unordered(struct cil_list *merged, struct cil_list *unordered_list)
{
+ struct cil_tree_node *node;
+ struct cil_ordered *unordered;
struct cil_list_item *curr = NULL;
- struct cil_ordered_list *unordered_list = NULL;
struct cil_list_item *item = NULL;
struct cil_list_item *ret = NULL;
int rc = SEPOL_ERR;
- cil_list_for_each(curr, unordered) {
- unordered_list = curr->data;
-
- cil_list_for_each(item, unordered_list->list) {
+ cil_list_for_each(curr, unordered_list) {
+ node = curr->data;
+ unordered = node->data;
+ cil_list_for_each(item, unordered->datums) {
if (cil_list_contains(merged, item->data)) {
/* item was declared in an ordered statement, which supersedes
* all unordered statements */
@@ -1453,40 +1377,50 @@ exit:
static struct cil_list *__cil_ordered_lists_merge_all(struct cil_list **ordered_lists, struct cil_list **unordered_lists)
{
struct cil_list *composite = NULL;
+ struct cil_tree_node *node;
+ struct cil_ordered *ordered;
struct cil_list_item *curr = NULL;
int changed = CIL_TRUE;
int waiting = 1;
int rc = SEPOL_ERR;
- cil_list_init(&composite, CIL_LIST_ITEM);
+ cil_list_init(&composite, (*ordered_lists)->flavor);
while (waiting && changed == CIL_TRUE) {
changed = CIL_FALSE;
waiting = 0;
cil_list_for_each(curr, *ordered_lists) {
- struct cil_ordered_list *ordered_list = curr->data;
- if (ordered_list->merged == CIL_FALSE) {
- rc = __cil_ordered_lists_merge(composite, ordered_list->list);
+ node = curr->data;
+ ordered = node->data;
+ if (ordered->merged == CIL_FALSE) {
+ rc = __cil_ordered_lists_merge(composite, ordered->datums);
if (rc != SEPOL_OK) {
/* Can't merge yet */
waiting++;
} else {
- ordered_list->merged = CIL_TRUE;
+ ordered->merged = CIL_TRUE;
changed = CIL_TRUE;
}
}
}
if (waiting > 0 && changed == CIL_FALSE) {
cil_list_for_each(curr, *ordered_lists) {
- struct cil_ordered_list *ordered_list = curr->data;
- if (ordered_list->merged == CIL_FALSE) {
- cil_tree_log(ordered_list->node, CIL_ERR, "Unable to merge ordered list");
+ node = curr->data;
+ ordered = node->data;
+ if (ordered->merged == CIL_FALSE) {
+ cil_tree_log(node, CIL_ERR, "Unable to merge ordered list");
}
}
goto exit;
}
}
+ rc = cil_verify_completed_ordered_list(composite, *ordered_lists);
+ if (rc != SEPOL_OK) {
+ cil_log(CIL_ERR, "Unable to validate ordering\n");
+ goto exit;
+ }
+
if (unordered_lists != NULL) {
rc = insert_unordered(composite, *unordered_lists);
if (rc != SEPOL_OK) {
@@ -1494,31 +1428,24 @@ static struct cil_list *__cil_ordered_lists_merge_all(struct cil_list **ordered_
}
}
- __cil_ordered_lists_destroy(ordered_lists);
- __cil_ordered_lists_destroy(unordered_lists);
-
return composite;
exit:
- __cil_ordered_lists_destroy(ordered_lists);
- __cil_ordered_lists_destroy(unordered_lists);
cil_list_destroy(&composite, CIL_FALSE);
return NULL;
}
int cil_resolve_classorder(struct cil_tree_node *current, struct cil_db *db, struct cil_list *classorder_list, struct cil_list *unordered_classorder_list)
{
- struct cil_classorder *classorder = current->data;
- struct cil_list *new = NULL;
+ struct cil_ordered *ordered = current->data;
struct cil_list_item *curr = NULL;
struct cil_symtab_datum *datum = NULL;
- struct cil_ordered_list *class_list = NULL;
int rc = SEPOL_ERR;
int unordered = CIL_FALSE;
- cil_list_init(&new, CIL_CLASSORDER);
+ cil_list_init(&ordered->datums, CIL_DATUM);
- cil_list_for_each(curr, classorder->class_list_str) {
+ cil_list_for_each(curr, ordered->strs) {
if (curr->data == CIL_KEY_UNORDERED) {
unordered = CIL_TRUE;
continue;
@@ -1535,37 +1462,32 @@ int cil_resolve_classorder(struct cil_tree_node *current, struct cil_db *db, str
rc = SEPOL_ERR;
goto exit;
}
- cil_list_append(new, CIL_CLASS, datum);
+ cil_list_append(ordered->datums, CIL_CLASS, datum);
}
- __cil_ordered_list_init(&class_list);
- class_list->list = new;
- class_list->node = current;
if (unordered) {
- cil_list_append(unordered_classorder_list, CIL_CLASSORDER, class_list);
+ cil_list_append(unordered_classorder_list, CIL_CLASSORDER, current);
} else {
- cil_list_append(classorder_list, CIL_CLASSORDER, class_list);
+ cil_list_append(classorder_list, CIL_CLASSORDER, current);
}
return SEPOL_OK;
exit:
- cil_list_destroy(&new, CIL_FALSE);
+ cil_list_destroy(&ordered->datums, CIL_FALSE);
return rc;
}
int cil_resolve_sidorder(struct cil_tree_node *current, struct cil_db *db, struct cil_list *sidorder_list)
{
- struct cil_sidorder *sidorder = current->data;
- struct cil_list *new = NULL;
+ struct cil_ordered *ordered = current->data;
struct cil_list_item *curr = NULL;
struct cil_symtab_datum *datum = NULL;
- struct cil_ordered_list *ordered = NULL;
int rc = SEPOL_ERR;
- cil_list_init(&new, CIL_SIDORDER);
+ cil_list_init(&ordered->datums, CIL_DATUM);
- cil_list_for_each(curr, sidorder->sid_list_str) {
+ cil_list_for_each(curr, ordered->strs) {
rc = cil_resolve_name(current, (char *)curr->data, CIL_SYM_SIDS, db, &datum);
if (rc != SEPOL_OK) {
cil_log(CIL_ERR, "Failed to resolve sid %s in sidorder\n", (char *)curr->data);
@@ -1577,18 +1499,15 @@ int cil_resolve_sidorder(struct cil_tree_node *current, struct cil_db *db, struc
goto exit;
}
- cil_list_append(new, CIL_SID, datum);
+ cil_list_append(ordered->datums, CIL_SID, datum);
}
- __cil_ordered_list_init(&ordered);
- ordered->list = new;
- ordered->node = current;
- cil_list_append(sidorder_list, CIL_SIDORDER, ordered);
+ cil_list_append(sidorder_list, CIL_SIDORDER, current);
return SEPOL_OK;
exit:
- cil_list_destroy(&new, CIL_FALSE);
+ cil_list_destroy(&ordered->datums, CIL_FALSE);
return rc;
}
@@ -1608,57 +1527,47 @@ static void cil_set_cat_values(struct cil_list *ordered_cats, struct cil_db *db)
int cil_resolve_catorder(struct cil_tree_node *current, struct cil_db *db, struct cil_list *catorder_list)
{
- struct cil_catorder *catorder = current->data;
- struct cil_list *new = NULL;
+ struct cil_ordered *ordered = current->data;
struct cil_list_item *curr = NULL;
- struct cil_symtab_datum *cat_datum;
- struct cil_cat *cat = NULL;
- struct cil_ordered_list *ordered = NULL;
+ struct cil_symtab_datum *datum;
int rc = SEPOL_ERR;
- cil_list_init(&new, CIL_CATORDER);
+ cil_list_init(&ordered->datums, CIL_DATUM);
- cil_list_for_each(curr, catorder->cat_list_str) {
- struct cil_tree_node *node = NULL;
- rc = cil_resolve_name(current, (char *)curr->data, CIL_SYM_CATS, db, &cat_datum);
+ cil_list_for_each(curr, ordered->strs) {
+ rc = cil_resolve_name(current, (char *)curr->data, CIL_SYM_CATS, db, &datum);
if (rc != SEPOL_OK) {
cil_log(CIL_ERR, "Failed to resolve category %s in categoryorder\n", (char *)curr->data);
goto exit;
}
- node = NODE(cat_datum);
- if (node->flavor != CIL_CAT) {
- cil_log(CIL_ERR, "%s is not a category. Only categories are allowed in categoryorder statements\n", cat_datum->name);
+ if (FLAVOR(datum) != CIL_CAT) {
+ cil_log(CIL_ERR, "%s is not a category. Only categories are allowed in categoryorder statements\n", datum->name);
rc = SEPOL_ERR;
goto exit;
}
- cat = (struct cil_cat *)cat_datum;
- cil_list_append(new, CIL_CAT, cat);
+
+ cil_list_append(ordered->datums, CIL_CAT, datum);
}
- __cil_ordered_list_init(&ordered);
- ordered->list = new;
- ordered->node = current;
- cil_list_append(catorder_list, CIL_CATORDER, ordered);
+ cil_list_append(catorder_list, CIL_CATORDER, current);
return SEPOL_OK;
exit:
- cil_list_destroy(&new, CIL_FALSE);
+ cil_list_destroy(&ordered->datums, CIL_FALSE);
return rc;
}
int cil_resolve_sensitivityorder(struct cil_tree_node *current, struct cil_db *db, struct cil_list *sensitivityorder_list)
{
- struct cil_sensorder *sensorder = current->data;
- struct cil_list *new = NULL;
+ struct cil_ordered *ordered = current->data;
struct cil_list_item *curr = NULL;
struct cil_symtab_datum *datum = NULL;
- struct cil_ordered_list *ordered = NULL;
int rc = SEPOL_ERR;
- cil_list_init(&new, CIL_LIST_ITEM);
+ cil_list_init(&ordered->datums, CIL_DATUM);
- cil_list_for_each(curr, sensorder->sens_list_str) {
+ cil_list_for_each(curr, ordered->strs) {
rc = cil_resolve_name(current, (char *)curr->data, CIL_SYM_SENS, db, &datum);
if (rc != SEPOL_OK) {
cil_log(CIL_ERR, "Failed to resolve sensitivity %s in sensitivityorder\n", (char *)curr->data);
@@ -1669,18 +1578,15 @@ int cil_resolve_sensitivityorder(struct cil_tree_node *current, struct cil_db *d
rc = SEPOL_ERR;
goto exit;
}
- cil_list_append(new, CIL_SENS, datum);
+ cil_list_append(ordered->datums, CIL_SENS, datum);
}
- __cil_ordered_list_init(&ordered);
- ordered->list = new;
- ordered->node = current;
- cil_list_append(sensitivityorder_list, CIL_SENSITIVITYORDER, ordered);
+ cil_list_append(sensitivityorder_list, CIL_SENSITIVITYORDER, current);
return SEPOL_OK;
exit:
- cil_list_destroy(&new, CIL_FALSE);
+ cil_list_destroy(&ordered->datums, CIL_FALSE);
return rc;
}
@@ -4115,11 +4021,11 @@ int cil_resolve_ast(struct cil_db *db, struct cil_tree_node *current)
extra_args.abstract_blocks = NULL;
cil_list_init(&extra_args.to_destroy, CIL_NODE);
- cil_list_init(&extra_args.sidorder_lists, CIL_LIST_ITEM);
- cil_list_init(&extra_args.classorder_lists, CIL_LIST_ITEM);
- cil_list_init(&extra_args.unordered_classorder_lists, CIL_LIST_ITEM);
- cil_list_init(&extra_args.catorder_lists, CIL_LIST_ITEM);
- cil_list_init(&extra_args.sensitivityorder_lists, CIL_LIST_ITEM);
+ cil_list_init(&extra_args.sidorder_lists, CIL_SIDORDER);
+ cil_list_init(&extra_args.classorder_lists, CIL_CLASSORDER);
+ cil_list_init(&extra_args.unordered_classorder_lists, CIL_CLASSORDER);
+ cil_list_init(&extra_args.catorder_lists, CIL_CATORDER);
+ cil_list_init(&extra_args.sensitivityorder_lists, CIL_SENSITIVITYORDER);
cil_list_init(&extra_args.in_list_before, CIL_IN);
cil_list_init(&extra_args.in_list_after, CIL_IN);
cil_list_init(&extra_args.abstract_blocks, CIL_NODE);
@@ -4227,11 +4133,16 @@ int cil_resolve_ast(struct cil_db *db, struct cil_tree_node *current)
cil_log(CIL_INFO, "Resetting declarations\n");
if (pass >= CIL_PASS_MISC1) {
- __cil_ordered_lists_reset(&extra_args.sidorder_lists);
- __cil_ordered_lists_reset(&extra_args.classorder_lists);
- __cil_ordered_lists_reset(&extra_args.unordered_classorder_lists);
- __cil_ordered_lists_reset(&extra_args.catorder_lists);
- __cil_ordered_lists_reset(&extra_args.sensitivityorder_lists);
+ cil_list_destroy(&extra_args.sidorder_lists, CIL_FALSE);
+ cil_list_destroy(&extra_args.classorder_lists, CIL_FALSE);
+ cil_list_destroy(&extra_args.catorder_lists, CIL_FALSE);
+ cil_list_destroy(&extra_args.sensitivityorder_lists, CIL_FALSE);
+ cil_list_destroy(&extra_args.unordered_classorder_lists, CIL_FALSE);
+ cil_list_init(&extra_args.sidorder_lists, CIL_SIDORDER);
+ cil_list_init(&extra_args.classorder_lists, CIL_CLASSORDER);
+ cil_list_init(&extra_args.unordered_classorder_lists, CIL_CLASSORDER);
+ cil_list_init(&extra_args.catorder_lists, CIL_CATORDER);
+ cil_list_init(&extra_args.sensitivityorder_lists, CIL_SENSITIVITYORDER);
cil_list_destroy(&db->sidorder, CIL_FALSE);
cil_list_destroy(&db->classorder, CIL_FALSE);
cil_list_destroy(&db->catorder, CIL_FALSE);
@@ -4263,11 +4174,11 @@ int cil_resolve_ast(struct cil_db *db, struct cil_tree_node *current)
rc = SEPOL_OK;
exit:
- __cil_ordered_lists_destroy(&extra_args.sidorder_lists);
- __cil_ordered_lists_destroy(&extra_args.classorder_lists);
- __cil_ordered_lists_destroy(&extra_args.catorder_lists);
- __cil_ordered_lists_destroy(&extra_args.sensitivityorder_lists);
- __cil_ordered_lists_destroy(&extra_args.unordered_classorder_lists);
+ cil_list_destroy(&extra_args.sidorder_lists, CIL_FALSE);
+ cil_list_destroy(&extra_args.classorder_lists, CIL_FALSE);
+ cil_list_destroy(&extra_args.catorder_lists, CIL_FALSE);
+ cil_list_destroy(&extra_args.sensitivityorder_lists, CIL_FALSE);
+ cil_list_destroy(&extra_args.unordered_classorder_lists, CIL_FALSE);
cil_list_destroy(&extra_args.to_destroy, CIL_FALSE);
cil_list_destroy(&extra_args.in_list_before, CIL_FALSE);
cil_list_destroy(&extra_args.in_list_after, CIL_FALSE);
diff --git a/libsepol/cil/src/cil_verify.c b/libsepol/cil/src/cil_verify.c
index 579e7962..45bf4689 100644
--- a/libsepol/cil/src/cil_verify.c
+++ b/libsepol/cil/src/cil_verify.c
@@ -519,6 +519,78 @@ exit:
return rc;
}
+int cil_verify_completed_ordered_list(struct cil_list *complete, struct cil_list *ordered_lists)
+{
+ struct cil_list_item *cprev, *ccurr, *cnext;
+ int found_prev, found_next;
+ int rc = SEPOL_OK;
+
+ found_prev = CIL_FALSE;
+ found_next = CIL_FALSE;
+ cprev = NULL;
+ ccurr = complete->head;
+ cnext = ccurr ? ccurr->next : NULL;
+ while (ccurr) {
+ struct cil_tree_node *node;
+ struct cil_ordered *ordered;
+ struct cil_list_item *curr_list, *oprev, *ocurr, *onext;
+ int change = CIL_FALSE;
+ cil_list_for_each(curr_list, ordered_lists) {
+ node = curr_list->data;
+ ordered = node->data;
+ oprev = NULL;
+ cil_list_for_each(ocurr, ordered->datums) {
+ onext = ocurr ? ocurr->next : NULL;
+ if (ccurr->data == ocurr->data) {
+ if (found_prev == CIL_FALSE && ((!cprev && !oprev) ||
+ (cprev && oprev && cprev->data == oprev->data))) {
+ found_prev = CIL_TRUE;
+ change = CIL_TRUE;
+ }
+ if (found_next == CIL_FALSE && ((!cnext && !onext) ||
+ (cnext && onext && cnext->data == onext->data))) {
+ found_next = CIL_TRUE;
+ change = CIL_TRUE;
+ }
+ if (found_prev && found_next) {
+ cprev = ccurr;
+ ccurr = cnext;
+ cnext = ccurr ? ccurr->next : NULL;
+ found_prev = CIL_FALSE;
+ found_next = CIL_FALSE;
+ if (!ccurr) {
+ /* Went through the whole list */
+ return rc;
+ }
+ }
+ }
+ oprev = ocurr;
+ }
+ }
+ if (!change) {
+ rc = SEPOL_ERR;
+ cil_log(CIL_ERR, "Unable to verify the order of %s\n", DATUM(ccurr->data)->fqn);
+ cil_log(CIL_ERR, "Found in the following ordering rules:\n");
+ cil_list_for_each(curr_list, ordered_lists) {
+ node = curr_list->data;
+ ordered = node->data;
+ cil_list_for_each(ocurr, ordered->datums) {
+ if (ccurr->data == ocurr->data) {
+ cil_tree_log(node, CIL_ERR, " ");
+ }
+ }
+ }
+ cprev = ccurr;
+ ccurr = cnext;
+ cnext = ccurr ? ccurr->next : NULL;
+ found_prev = CIL_FALSE;
+ found_next = CIL_FALSE;
+ }
+ }
+
+ return rc;
+}
+
struct cil_args_verify_order {
uint32_t *flavor;
};
diff --git a/libsepol/cil/src/cil_verify.h b/libsepol/cil/src/cil_verify.h
index bb1a072c..daa2f80a 100644
--- a/libsepol/cil/src/cil_verify.h
+++ b/libsepol/cil/src/cil_verify.h
@@ -64,6 +64,7 @@ int cil_verify_constraint_expr_syntax(struct cil_tree_node *current, enum cil_fl
int cil_verify_conditional_blocks(struct cil_tree_node *current);
int cil_verify_decl_does_not_shadow_macro_parameter(struct cil_macro *macro, struct cil_tree_node *node, const char *name);
int __cil_verify_ranges(struct cil_list *list);
+int cil_verify_completed_ordered_list(struct cil_list *complete, struct cil_list *ordered_lists);
int __cil_verify_ordered_node_helper(struct cil_tree_node *node, uint32_t *finished, void *extra_args);
int __cil_verify_ordered(struct cil_tree_node *current, enum cil_flavor flavor);
int __cil_verify_initsids(struct cil_list *sids);
diff --git a/libsepol/cil/src/cil_write_ast.c b/libsepol/cil/src/cil_write_ast.c
index 4da7a77c..59122a17 100644
--- a/libsepol/cil/src/cil_write_ast.c
+++ b/libsepol/cil/src/cil_write_ast.c
@@ -765,9 +765,13 @@ void cil_write_ast_node(FILE *out, struct cil_tree_node *node)
break;
}
case CIL_CLASSORDER: {
- struct cil_classorder *classorder = node->data;
+ struct cil_ordered *ordered = node->data;
fprintf(out, "(classorder ");
- write_string_list(out, classorder->class_list_str);
+ if (ordered->datums) {
+ write_datum_list(out, ordered->datums);
+ } else {
+ write_string_list(out, ordered->strs);
+ }
fprintf(out, ")\n");
break;
}
@@ -834,9 +838,13 @@ void cil_write_ast_node(FILE *out, struct cil_tree_node *node)
break;
}
case CIL_SIDORDER: {
- struct cil_sidorder *sidorder = node->data;
+ struct cil_ordered *ordered = node->data;
fprintf(out, "(sidorder ");
- write_string_list(out, sidorder->sid_list_str);
+ if (ordered->datums) {
+ write_datum_list(out, ordered->datums);
+ } else {
+ write_string_list(out, ordered->strs);
+ }
fprintf(out, ")\n");
break;
}
@@ -888,9 +896,13 @@ void cil_write_ast_node(FILE *out, struct cil_tree_node *node)
break;
}
case CIL_CATORDER: {
- struct cil_catorder *catorder = node->data;
+ struct cil_ordered *ordered = node->data;
fprintf(out, "(categoryorder ");
- write_string_list(out, catorder->cat_list_str);
+ if (ordered->datums) {
+ write_datum_list(out, ordered->datums);
+ } else {
+ write_string_list(out, ordered->strs);
+ }
fprintf(out, ")\n");
break;
}
@@ -903,9 +915,13 @@ void cil_write_ast_node(FILE *out, struct cil_tree_node *node)
break;
}
case CIL_SENSITIVITYORDER: {
- struct cil_sensorder *sensorder = node->data;
+ struct cil_ordered *ordered = node->data;
fprintf(out, "(sensitivityorder ");
- write_string_list(out, sensorder->sens_list_str);
+ if (ordered->datums) {
+ write_datum_list(out, ordered->datums);
+ } else {
+ write_string_list(out, ordered->strs);
+ }
fprintf(out, ")\n");
break;
}
--
2.41.0
^ permalink raw reply related [flat|nested] 16+ messages in thread