[PATCH] libsepol: Do not reject all type rules in conditionals when validating

[PATCH] libsepol: Do not reject all type rules in conditionals when validating

[James Carter]

Commit 1c91bc84 ("libsepol: reject self flag in type rules in old
policies") actually rejects all type rules in conditionals in modular
policies prior to version 21 (MOD_POLICYDB_VERSION_SELF_TYPETRANS).

The problem is because of fall-through in a switch statement when
the avrule flags are 0. Instead, break rather than fall-through when
avrule flags are 0.
---
 libsepol/src/policydb_validate.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/libsepol/src/policydb_validate.c b/libsepol/src/policydb_validate.c
index 9746f562..2043e437 100644
--- a/libsepol/src/policydb_validate.c
+++ b/libsepol/src/policydb_validate.c
@@ -1076,6 +1076,7 @@ static int validate_avrules(sepol_handle_t *handle, const avrule_t *avrule, int
 
 		switch(avrule->flags) {
 		case 0:
+			break;
 		case RULE_SELF:
 			if (p->policyvers != POLICY_KERN &&
 			    p->policyvers < MOD_POLICYDB_VERSION_SELF_TYPETRANS &&
-- 
2.45.2

Re: [PATCH] libsepol: Do not reject all type rules in conditionals when validating

[Christian Göttsche]

On Fri, 14 Jun 2024 at 21:45, James Carter <jwcart2@gmail.com> wrote:
>
> Commit 1c91bc84 ("libsepol: reject self flag in type rules in old
> policies") actually rejects all type rules in conditionals in modular
> policies prior to version 21 (MOD_POLICYDB_VERSION_SELF_TYPETRANS).
>
> The problem is because of fall-through in a switch statement when
> the avrule flags are 0. Instead, break rather than fall-through when
> avrule flags are 0.

Thanks for spotting this.
I'am probably going to look to enhance the downgrade unit test for the
next validate updates...

Reviewed-by: Christian Göttsche <cgzones@googlemail.com>

> ---
>  libsepol/src/policydb_validate.c | 1 +
>  1 file changed, 1 insertion(+)
>
> diff --git a/libsepol/src/policydb_validate.c b/libsepol/src/policydb_validate.c
> index 9746f562..2043e437 100644
> --- a/libsepol/src/policydb_validate.c
> +++ b/libsepol/src/policydb_validate.c
> @@ -1076,6 +1076,7 @@ static int validate_avrules(sepol_handle_t *handle, const avrule_t *avrule, int
>
>                 switch(avrule->flags) {
>                 case 0:
> +                       break;
>                 case RULE_SELF:
>                         if (p->policyvers != POLICY_KERN &&
>                             p->policyvers < MOD_POLICYDB_VERSION_SELF_TYPETRANS &&
> --
> 2.45.2
>

Re: [PATCH] libsepol: Do not reject all type rules in conditionals when validating

[Petr Lautrbach]

Christian Göttsche <cgzones@googlemail.com> writes:

> On Fri, 14 Jun 2024 at 21:45, James Carter <jwcart2@gmail.com> wrote:
>>
>> Commit 1c91bc84 ("libsepol: reject self flag in type rules in old
>> policies") actually rejects all type rules in conditionals in modular
>> policies prior to version 21 (MOD_POLICYDB_VERSION_SELF_TYPETRANS).
>>
>> The problem is because of fall-through in a switch statement when
>> the avrule flags are 0. Instead, break rather than fall-through when
>> avrule flags are 0.
>
> Thanks for spotting this.
> I'am probably going to look to enhance the downgrade unit test for the
> next validate updates...
>
> Reviewed-by: Christian Göttsche <cgzones@googlemail.com>

Acked-by: Petr Lautrbach <lautrbach@redhat.com>



>
>> ---
>>  libsepol/src/policydb_validate.c | 1 +
>>  1 file changed, 1 insertion(+)
>>
>> diff --git a/libsepol/src/policydb_validate.c b/libsepol/src/policydb_validate.c
>> index 9746f562..2043e437 100644
>> --- a/libsepol/src/policydb_validate.c
>> +++ b/libsepol/src/policydb_validate.c
>> @@ -1076,6 +1076,7 @@ static int validate_avrules(sepol_handle_t *handle, const avrule_t *avrule, int
>>
>>                 switch(avrule->flags) {
>>                 case 0:
>> +                       break;
>>                 case RULE_SELF:
>>                         if (p->policyvers != POLICY_KERN &&
>>                             p->policyvers < MOD_POLICYDB_VERSION_SELF_TYPETRANS &&
>> --
>> 2.45.2
>>

Re: [PATCH] libsepol: Do not reject all type rules in conditionals when validating

[James Carter]

On Mon, Jun 17, 2024 at 5:10 AM Petr Lautrbach <lautrbach@redhat.com> wrote:
>
> Christian Göttsche <cgzones@googlemail.com> writes:
>
> > On Fri, 14 Jun 2024 at 21:45, James Carter <jwcart2@gmail.com> wrote:
> >>
> >> Commit 1c91bc84 ("libsepol: reject self flag in type rules in old
> >> policies") actually rejects all type rules in conditionals in modular
> >> policies prior to version 21 (MOD_POLICYDB_VERSION_SELF_TYPETRANS).
> >>
> >> The problem is because of fall-through in a switch statement when
> >> the avrule flags are 0. Instead, break rather than fall-through when
> >> avrule flags are 0.
> >
> > Thanks for spotting this.
> > I'am probably going to look to enhance the downgrade unit test for the
> > next validate updates...
> >
> > Reviewed-by: Christian Göttsche <cgzones@googlemail.com>
>
> Acked-by: Petr Lautrbach <lautrbach@redhat.com>
>

This has been merged.
Thanks,
Jim

>
>
> >
> >> ---
> >>  libsepol/src/policydb_validate.c | 1 +
> >>  1 file changed, 1 insertion(+)
> >>
> >> diff --git a/libsepol/src/policydb_validate.c b/libsepol/src/policydb_validate.c
> >> index 9746f562..2043e437 100644
> >> --- a/libsepol/src/policydb_validate.c
> >> +++ b/libsepol/src/policydb_validate.c
> >> @@ -1076,6 +1076,7 @@ static int validate_avrules(sepol_handle_t *handle, const avrule_t *avrule, int
> >>
> >>                 switch(avrule->flags) {
> >>                 case 0:
> >> +                       break;
> >>                 case RULE_SELF:
> >>                         if (p->policyvers != POLICY_KERN &&
> >>                             p->policyvers < MOD_POLICYDB_VERSION_SELF_TYPETRANS &&
> >> --
> >> 2.45.2
> >>
>