[RFC PATCH 1/3] libsepol: export initial SIDs

[RFC PATCH 1/3] libsepol: export initial SIDs

[Christian Göttsche]

Export initial SIDs, so they can be used for example in checkpolicy.

Add helper functions for name lookup.

Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
---
 libsepol/include/sepol/policydb/initialsids.h | 89 +++++++++++++++++++
 libsepol/include/sepol/policydb/policydb.h    |  2 +-
 libsepol/src/kernel_to_cil.c                  |  1 +
 libsepol/src/kernel_to_common.h               | 53 -----------
 libsepol/src/kernel_to_conf.c                 |  1 +
 libsepol/src/module_to_cil.c                  |  1 +
 6 files changed, 93 insertions(+), 54 deletions(-)
 create mode 100644 libsepol/include/sepol/policydb/initialsids.h

diff --git a/libsepol/include/sepol/policydb/initialsids.h b/libsepol/include/sepol/policydb/initialsids.h
new file mode 100644
index 00000000..7b2fe021
--- /dev/null
+++ b/libsepol/include/sepol/policydb/initialsids.h
@@ -0,0 +1,89 @@
+#ifndef _SEPOL_POLICYDB_INITIALSIDS_H_
+#define _SEPOL_POLICYDB_INITIALSIDS_H_
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+// initial sid names aren't actually stored in the pp files, need to a have
+// a mapping, taken from the linux kernel
+static const char * const selinux_sid_to_str[] = {
+	"null",
+	"kernel",
+	"security",
+	"unlabeled",
+	"fs",
+	"file",
+	"file_labels",
+	"init",
+	"any_socket",
+	"port",
+	"netif",
+	"netmsg",
+	"node",
+	"igmp_packet",
+	"icmp_socket",
+	"tcp_socket",
+	"sysctl_modprobe",
+	"sysctl",
+	"sysctl_fs",
+	"sysctl_kernel",
+	"sysctl_net",
+	"sysctl_net_unix",
+	"sysctl_vm",
+	"sysctl_dev",
+	"kmod",
+	"policy",
+	"scmp_packet",
+	"devnull",
+};
+
+#define SELINUX_SID_SZ (sizeof(selinux_sid_to_str)/sizeof(selinux_sid_to_str[0]))
+
+static inline unsigned int selinux_str_to_sid(const char *name)
+{
+	unsigned i;
+
+	for (i = 1; i < SELINUX_SID_SZ; i++) {
+		if (strcmp(name, selinux_sid_to_str[i]) == 0)
+			return i;
+	}
+
+	return 0;
+}
+
+static const char * const xen_sid_to_str[] = {
+	"null",
+	"xen",
+	"dom0",
+	"domio",
+	"domxen",
+	"unlabeled",
+	"security",
+	"ioport",
+	"iomem",
+	"irq",
+	"device",
+	"domU",
+	"domDM",
+};
+
+#define XEN_SID_SZ (sizeof(xen_sid_to_str)/sizeof(xen_sid_to_str[0]))
+
+static inline unsigned int xen_str_to_sid(const char *name)
+{
+	unsigned i;
+
+	for (i = 1; i < XEN_SID_SZ; i++) {
+		if (strcmp(name, xen_sid_to_str[i]) == 0)
+			return i;
+	}
+
+	return 0;
+}
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif				/* _SEPOL_POLICYDB_INITIALSIDS_H_ */
diff --git a/libsepol/include/sepol/policydb/policydb.h b/libsepol/include/sepol/policydb/policydb.h
index de0068a6..2ce4da5d 100644
--- a/libsepol/include/sepol/policydb/policydb.h
+++ b/libsepol/include/sepol/policydb/policydb.h
@@ -340,7 +340,7 @@ typedef struct range_trans_rule {
  */
 typedef struct ocontext {
 	union {
-		char *name;	/* name of initial SID, fs, netif, fstype, path */
+		char *name;	/* name of initial SID (not saved in binary policy), fs, netif, fstype, path */
 		struct {
 			uint8_t protocol;
 			uint16_t low_port;
diff --git a/libsepol/src/kernel_to_cil.c b/libsepol/src/kernel_to_cil.c
index 9128ac55..42251684 100644
--- a/libsepol/src/kernel_to_cil.c
+++ b/libsepol/src/kernel_to_cil.c
@@ -20,6 +20,7 @@
 #include <sepol/policydb/avtab.h>
 #include <sepol/policydb/conditional.h>
 #include <sepol/policydb/hashtab.h>
+#include <sepol/policydb/initialsids.h>
 #include <sepol/policydb/polcaps.h>
 #include <sepol/policydb/policydb.h>
 #include <sepol/policydb/services.h>
diff --git a/libsepol/src/kernel_to_common.h b/libsepol/src/kernel_to_common.h
index 159c4289..5e8482bf 100644
--- a/libsepol/src/kernel_to_common.h
+++ b/libsepol/src/kernel_to_common.h
@@ -10,59 +10,6 @@
 #define DEFAULT_LEVEL "systemlow"
 #define DEFAULT_OBJECT "object_r"
 
-// initial sid names aren't actually stored in the pp files, need to a have
-// a mapping, taken from the linux kernel
-static const char * const selinux_sid_to_str[] = {
-	"null",
-	"kernel",
-	"security",
-	"unlabeled",
-	"fs",
-	"file",
-	"file_labels",
-	"init",
-	"any_socket",
-	"port",
-	"netif",
-	"netmsg",
-	"node",
-	"igmp_packet",
-	"icmp_socket",
-	"tcp_socket",
-	"sysctl_modprobe",
-	"sysctl",
-	"sysctl_fs",
-	"sysctl_kernel",
-	"sysctl_net",
-	"sysctl_net_unix",
-	"sysctl_vm",
-	"sysctl_dev",
-	"kmod",
-	"policy",
-	"scmp_packet",
-	"devnull",
-};
-
-#define SELINUX_SID_SZ (sizeof(selinux_sid_to_str)/sizeof(selinux_sid_to_str[0]))
-
-static const char * const xen_sid_to_str[] = {
-	"null",
-	"xen",
-	"dom0",
-	"domio",
-	"domxen",
-	"unlabeled",
-	"security",
-	"ioport",
-	"iomem",
-	"irq",
-	"device",
-	"domU",
-	"domDM",
-};
-
-#define XEN_SID_SZ (sizeof(xen_sid_to_str)/sizeof(xen_sid_to_str[0]))
-
 static const uint32_t avtab_flavors[] = {
 	AVTAB_ALLOWED,
 	AVTAB_AUDITALLOW,
diff --git a/libsepol/src/kernel_to_conf.c b/libsepol/src/kernel_to_conf.c
index 63dffd9b..51a8270d 100644
--- a/libsepol/src/kernel_to_conf.c
+++ b/libsepol/src/kernel_to_conf.c
@@ -19,6 +19,7 @@
 #include <sepol/policydb/avtab.h>
 #include <sepol/policydb/conditional.h>
 #include <sepol/policydb/hashtab.h>
+#include <sepol/policydb/initialsids.h>
 #include <sepol/policydb/polcaps.h>
 #include <sepol/policydb/policydb.h>
 #include <sepol/policydb/services.h>
diff --git a/libsepol/src/module_to_cil.c b/libsepol/src/module_to_cil.c
index b35bf055..1945b369 100644
--- a/libsepol/src/module_to_cil.c
+++ b/libsepol/src/module_to_cil.c
@@ -47,6 +47,7 @@
 #include <sepol/module_to_cil.h>
 #include <sepol/policydb/conditional.h>
 #include <sepol/policydb/hashtab.h>
+#include <sepol/policydb/initialsids.h>
 #include <sepol/policydb/polcaps.h>
 #include <sepol/policydb/policydb.h>
 #include <sepol/policydb/services.h>
-- 
2.36.1

[RFC PATCH 2/3] libsepol: validate initial SIDs

[Christian Göttsche]

Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
---
 libsepol/src/policydb_validate.c | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/libsepol/src/policydb_validate.c b/libsepol/src/policydb_validate.c
index da18282b..fcd3154a 100644
--- a/libsepol/src/policydb_validate.c
+++ b/libsepol/src/policydb_validate.c
@@ -1,6 +1,7 @@
 
 #include <sepol/policydb/conditional.h>
 #include <sepol/policydb/ebitmap.h>
+#include <sepol/policydb/initialsids.h>
 #include <sepol/policydb/policydb.h>
 #include <sepol/policydb/services.h>
 
@@ -1041,6 +1042,10 @@ static int validate_ocontexts(sepol_handle_t *handle, policydb_t *p, validate_t
 
 			if (p->target_platform == SEPOL_TARGET_SELINUX) {
 				switch (i) {
+				case OCON_ISID:
+					if (octx->sid[0] < 1 || octx->sid[0] >= SELINUX_SID_SZ)
+						goto bad;
+					break;
 				case OCON_FS:
 				case OCON_NETIF:
 					if (validate_context(&octx->context[1], flavors, p->mls))
@@ -1057,6 +1062,14 @@ static int validate_ocontexts(sepol_handle_t *handle, policydb_t *p, validate_t
 					}
 				}
 			}
+			if (p->target_platform == SEPOL_TARGET_XEN) {
+				switch (i) {
+				case OCON_XEN_ISID:
+					if (octx->sid[0] < 1 || octx->sid[0] >= XEN_SID_SZ)
+						goto bad;
+					break;
+				}
+			}
 		}
 	}
 
-- 
2.36.1

[RFC PATCH 3/3] checkpolicy: rework initial SID handling

[Christian Göttsche]

The kernel removed [1] some unused initial SIDs.  Also libsepol got
support for omitting unused ones [2].

Currently in traditional policy all initial SIDs have to be defined and
also the order of declarations has to follow the order of the libsepol
internal representation.  Support omitting unused initial SIDs in the
traditional policy and do not require a specific order of declarations.

[1]: https://github.com/SELinuxProject/selinux-kernel/commit/e3e0b582c321aefd72db0e7083a0adfe285e96b5
[2]: https://github.com/SELinuxProject/selinux/commit/8677ce5e8f592950ae6f14cea1b68a20ddc1ac25

Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
---
 checkpolicy/policy_define.c | 39 ++++++++++++++++++++++++-------------
 1 file changed, 26 insertions(+), 13 deletions(-)

diff --git a/checkpolicy/policy_define.c b/checkpolicy/policy_define.c
index 8bf36859..8f55650d 100644
--- a/checkpolicy/policy_define.c
+++ b/checkpolicy/policy_define.c
@@ -54,6 +54,7 @@
 #include <sepol/policydb/services.h>
 #include <sepol/policydb/conditional.h>
 #include <sepol/policydb/hierarchy.h>
+#include <sepol/policydb/initialsids.h>
 #include <sepol/policydb/polcaps.h>
 #include "queue.h"
 #include "checkpolicy.h"
@@ -287,6 +288,7 @@ int define_polcap(void)
 int define_initial_sid(void)
 {
 	char *id = 0;
+	sepol_security_id_t sid;
 	ocontext_t *newc = 0, *c, *head;
 
 	if (pass == 2) {
@@ -300,28 +302,30 @@ int define_initial_sid(void)
 		yyerror("no sid name for SID definition?");
 		return -1;
 	}
-	newc = (ocontext_t *) malloc(sizeof(ocontext_t));
-	if (!newc) {
-		yyerror("out of memory");
+
+	sid = selinux_str_to_sid(id);
+	if (sid == 0) {
+		yyerror2("invalid initial SID %s", id);
 		goto bad;
 	}
-	memset(newc, 0, sizeof(ocontext_t));
-	newc->u.name = id;
-	context_init(&newc->context[0]);
-	head = policydbp->ocontexts[OCON_ISID];
 
+	head = policydbp->ocontexts[OCON_ISID];
 	for (c = head; c; c = c->next) {
-		if (!strcmp(newc->u.name, c->u.name)) {
+		if (sid == c->sid[0]) {
 			yyerror2("duplicate initial SID %s", id);
 			goto bad;
 		}
 	}
 
-	if (head) {
-		newc->sid[0] = head->sid[0] + 1;
-	} else {
-		newc->sid[0] = 1;
+	newc = (ocontext_t *) malloc(sizeof(ocontext_t));
+	if (!newc) {
+		yyerror("out of memory");
+		goto bad;
 	}
+	memset(newc, 0, sizeof(ocontext_t));
+	newc->u.name = id;
+	context_init(&newc->context[0]);
+	newc->sid[0] = sid;
 	newc->next = head;
 	policydbp->ocontexts[OCON_ISID] = newc;
 
@@ -4567,6 +4571,7 @@ static int parse_security_context(context_struct_t * c)
 int define_initial_sid_context(void)
 {
 	char *id;
+	sepol_security_id_t sid;
 	ocontext_t *c, *head;
 
 	if (pass == 1) {
@@ -4581,9 +4586,17 @@ int define_initial_sid_context(void)
 		yyerror("no sid name for SID context definition?");
 		return -1;
 	}
+
+	sid = selinux_str_to_sid(id);
+	if (sid == 0) {
+		yyerror2("invalid initial SID %s", id);
+		free(id);
+		return -1;
+	}
+
 	head = policydbp->ocontexts[OCON_ISID];
 	for (c = head; c; c = c->next) {
-		if (!strcmp(id, c->u.name))
+		if (sid == c->sid[0])
 			break;
 	}
 
-- 
2.36.1

Re: [RFC PATCH 1/3] libsepol: export initial SIDs

[James Carter]

On Tue, Jun 7, 2022 at 3:02 PM Christian Göttsche
<cgzones@googlemail.com> wrote:
>
> Export initial SIDs, so they can be used for example in checkpolicy.
>

We don't want to export the initial SID names. See commit 8677ce5e
"libsepol,checkpolicy: support omitting unused initial sid contexts"
and https://github.com/SELinuxProject/selinux-kernel/issues/12 for
more information. Eventually, we want to go to a dynamic discovery of
initial SIDs. The initial SID names are in kernel_to_common.h as a
hack because the name is not stored in the binary policy, but we don't
want to encourage more use.

Thanks,
Jim

> Add helper functions for name lookup.
>
> Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
> ---
>  libsepol/include/sepol/policydb/initialsids.h | 89 +++++++++++++++++++
>  libsepol/include/sepol/policydb/policydb.h    |  2 +-
>  libsepol/src/kernel_to_cil.c                  |  1 +
>  libsepol/src/kernel_to_common.h               | 53 -----------
>  libsepol/src/kernel_to_conf.c                 |  1 +
>  libsepol/src/module_to_cil.c                  |  1 +
>  6 files changed, 93 insertions(+), 54 deletions(-)
>  create mode 100644 libsepol/include/sepol/policydb/initialsids.h
>
> diff --git a/libsepol/include/sepol/policydb/initialsids.h b/libsepol/include/sepol/policydb/initialsids.h
> new file mode 100644
> index 00000000..7b2fe021
> --- /dev/null
> +++ b/libsepol/include/sepol/policydb/initialsids.h
> @@ -0,0 +1,89 @@
> +#ifndef _SEPOL_POLICYDB_INITIALSIDS_H_
> +#define _SEPOL_POLICYDB_INITIALSIDS_H_
> +
> +#ifdef __cplusplus
> +extern "C" {
> +#endif
> +
> +// initial sid names aren't actually stored in the pp files, need to a have
> +// a mapping, taken from the linux kernel
> +static const char * const selinux_sid_to_str[] = {
> +       "null",
> +       "kernel",
> +       "security",
> +       "unlabeled",
> +       "fs",
> +       "file",
> +       "file_labels",
> +       "init",
> +       "any_socket",
> +       "port",
> +       "netif",
> +       "netmsg",
> +       "node",
> +       "igmp_packet",
> +       "icmp_socket",
> +       "tcp_socket",
> +       "sysctl_modprobe",
> +       "sysctl",
> +       "sysctl_fs",
> +       "sysctl_kernel",
> +       "sysctl_net",
> +       "sysctl_net_unix",
> +       "sysctl_vm",
> +       "sysctl_dev",
> +       "kmod",
> +       "policy",
> +       "scmp_packet",
> +       "devnull",
> +};
> +
> +#define SELINUX_SID_SZ (sizeof(selinux_sid_to_str)/sizeof(selinux_sid_to_str[0]))
> +
> +static inline unsigned int selinux_str_to_sid(const char *name)
> +{
> +       unsigned i;
> +
> +       for (i = 1; i < SELINUX_SID_SZ; i++) {
> +               if (strcmp(name, selinux_sid_to_str[i]) == 0)
> +                       return i;
> +       }
> +
> +       return 0;
> +}
> +
> +static const char * const xen_sid_to_str[] = {
> +       "null",
> +       "xen",
> +       "dom0",
> +       "domio",
> +       "domxen",
> +       "unlabeled",
> +       "security",
> +       "ioport",
> +       "iomem",
> +       "irq",
> +       "device",
> +       "domU",
> +       "domDM",
> +};
> +
> +#define XEN_SID_SZ (sizeof(xen_sid_to_str)/sizeof(xen_sid_to_str[0]))
> +
> +static inline unsigned int xen_str_to_sid(const char *name)
> +{
> +       unsigned i;
> +
> +       for (i = 1; i < XEN_SID_SZ; i++) {
> +               if (strcmp(name, xen_sid_to_str[i]) == 0)
> +                       return i;
> +       }
> +
> +       return 0;
> +}
> +
> +#ifdef __cplusplus
> +}
> +#endif
> +
> +#endif                         /* _SEPOL_POLICYDB_INITIALSIDS_H_ */
> diff --git a/libsepol/include/sepol/policydb/policydb.h b/libsepol/include/sepol/policydb/policydb.h
> index de0068a6..2ce4da5d 100644
> --- a/libsepol/include/sepol/policydb/policydb.h
> +++ b/libsepol/include/sepol/policydb/policydb.h
> @@ -340,7 +340,7 @@ typedef struct range_trans_rule {
>   */
>  typedef struct ocontext {
>         union {
> -               char *name;     /* name of initial SID, fs, netif, fstype, path */
> +               char *name;     /* name of initial SID (not saved in binary policy), fs, netif, fstype, path */
>                 struct {
>                         uint8_t protocol;
>                         uint16_t low_port;
> diff --git a/libsepol/src/kernel_to_cil.c b/libsepol/src/kernel_to_cil.c
> index 9128ac55..42251684 100644
> --- a/libsepol/src/kernel_to_cil.c
> +++ b/libsepol/src/kernel_to_cil.c
> @@ -20,6 +20,7 @@
>  #include <sepol/policydb/avtab.h>
>  #include <sepol/policydb/conditional.h>
>  #include <sepol/policydb/hashtab.h>
> +#include <sepol/policydb/initialsids.h>
>  #include <sepol/policydb/polcaps.h>
>  #include <sepol/policydb/policydb.h>
>  #include <sepol/policydb/services.h>
> diff --git a/libsepol/src/kernel_to_common.h b/libsepol/src/kernel_to_common.h
> index 159c4289..5e8482bf 100644
> --- a/libsepol/src/kernel_to_common.h
> +++ b/libsepol/src/kernel_to_common.h
> @@ -10,59 +10,6 @@
>  #define DEFAULT_LEVEL "systemlow"
>  #define DEFAULT_OBJECT "object_r"
>
> -// initial sid names aren't actually stored in the pp files, need to a have
> -// a mapping, taken from the linux kernel
> -static const char * const selinux_sid_to_str[] = {
> -       "null",
> -       "kernel",
> -       "security",
> -       "unlabeled",
> -       "fs",
> -       "file",
> -       "file_labels",
> -       "init",
> -       "any_socket",
> -       "port",
> -       "netif",
> -       "netmsg",
> -       "node",
> -       "igmp_packet",
> -       "icmp_socket",
> -       "tcp_socket",
> -       "sysctl_modprobe",
> -       "sysctl",
> -       "sysctl_fs",
> -       "sysctl_kernel",
> -       "sysctl_net",
> -       "sysctl_net_unix",
> -       "sysctl_vm",
> -       "sysctl_dev",
> -       "kmod",
> -       "policy",
> -       "scmp_packet",
> -       "devnull",
> -};
> -
> -#define SELINUX_SID_SZ (sizeof(selinux_sid_to_str)/sizeof(selinux_sid_to_str[0]))
> -
> -static const char * const xen_sid_to_str[] = {
> -       "null",
> -       "xen",
> -       "dom0",
> -       "domio",
> -       "domxen",
> -       "unlabeled",
> -       "security",
> -       "ioport",
> -       "iomem",
> -       "irq",
> -       "device",
> -       "domU",
> -       "domDM",
> -};
> -
> -#define XEN_SID_SZ (sizeof(xen_sid_to_str)/sizeof(xen_sid_to_str[0]))
> -
>  static const uint32_t avtab_flavors[] = {
>         AVTAB_ALLOWED,
>         AVTAB_AUDITALLOW,
> diff --git a/libsepol/src/kernel_to_conf.c b/libsepol/src/kernel_to_conf.c
> index 63dffd9b..51a8270d 100644
> --- a/libsepol/src/kernel_to_conf.c
> +++ b/libsepol/src/kernel_to_conf.c
> @@ -19,6 +19,7 @@
>  #include <sepol/policydb/avtab.h>
>  #include <sepol/policydb/conditional.h>
>  #include <sepol/policydb/hashtab.h>
> +#include <sepol/policydb/initialsids.h>
>  #include <sepol/policydb/polcaps.h>
>  #include <sepol/policydb/policydb.h>
>  #include <sepol/policydb/services.h>
> diff --git a/libsepol/src/module_to_cil.c b/libsepol/src/module_to_cil.c
> index b35bf055..1945b369 100644
> --- a/libsepol/src/module_to_cil.c
> +++ b/libsepol/src/module_to_cil.c
> @@ -47,6 +47,7 @@
>  #include <sepol/module_to_cil.h>
>  #include <sepol/policydb/conditional.h>
>  #include <sepol/policydb/hashtab.h>
> +#include <sepol/policydb/initialsids.h>
>  #include <sepol/policydb/polcaps.h>
>  #include <sepol/policydb/policydb.h>
>  #include <sepol/policydb/services.h>
> --
> 2.36.1
>

Re: [RFC PATCH 3/3] checkpolicy: rework initial SID handling

[James Carter]

On Tue, Jun 7, 2022 at 3:01 PM Christian Göttsche
<cgzones@googlemail.com> wrote:
>
> The kernel removed [1] some unused initial SIDs.  Also libsepol got
> support for omitting unused ones [2].
>
> Currently in traditional policy all initial SIDs have to be defined and
> also the order of declarations has to follow the order of the libsepol
> internal representation.  Support omitting unused initial SIDs in the
> traditional policy and do not require a specific order of declarations.
>

I think that your goal is good, but see below.

> [1]: https://github.com/SELinuxProject/selinux-kernel/commit/e3e0b582c321aefd72db0e7083a0adfe285e96b5
> [2]: https://github.com/SELinuxProject/selinux/commit/8677ce5e8f592950ae6f14cea1b68a20ddc1ac25
>
> Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
> ---
>  checkpolicy/policy_define.c | 39 ++++++++++++++++++++++++-------------
>  1 file changed, 26 insertions(+), 13 deletions(-)
>
> diff --git a/checkpolicy/policy_define.c b/checkpolicy/policy_define.c
> index 8bf36859..8f55650d 100644
> --- a/checkpolicy/policy_define.c
> +++ b/checkpolicy/policy_define.c
> @@ -54,6 +54,7 @@
>  #include <sepol/policydb/services.h>
>  #include <sepol/policydb/conditional.h>
>  #include <sepol/policydb/hierarchy.h>
> +#include <sepol/policydb/initialsids.h>
>  #include <sepol/policydb/polcaps.h>
>  #include "queue.h"
>  #include "checkpolicy.h"
> @@ -287,6 +288,7 @@ int define_polcap(void)
>  int define_initial_sid(void)
>  {
>         char *id = 0;
> +       sepol_security_id_t sid;
>         ocontext_t *newc = 0, *c, *head;
>
>         if (pass == 2) {
> @@ -300,28 +302,30 @@ int define_initial_sid(void)
>                 yyerror("no sid name for SID definition?");
>                 return -1;
>         }
> -       newc = (ocontext_t *) malloc(sizeof(ocontext_t));
> -       if (!newc) {
> -               yyerror("out of memory");
> +
> +       sid = selinux_str_to_sid(id);
> +       if (sid == 0) {
> +               yyerror2("invalid initial SID %s", id);

We can't give an error if the name is not found. In your reference
[2], it is stated that unused SIDs can be renamed and it even suggests
using an "unamed_" prefix.

I am not sure what to suggest here. In the past, one could
theoretically use any name, because all that mattered was the
ordering. I doubt if there are any policies that use any other names,
but I don't know.

Thanks,
Jim


>                 goto bad;
>         }
> -       memset(newc, 0, sizeof(ocontext_t));
> -       newc->u.name = id;
> -       context_init(&newc->context[0]);
> -       head = policydbp->ocontexts[OCON_ISID];
>
> +       head = policydbp->ocontexts[OCON_ISID];
>         for (c = head; c; c = c->next) {
> -               if (!strcmp(newc->u.name, c->u.name)) {
> +               if (sid == c->sid[0]) {
>                         yyerror2("duplicate initial SID %s", id);
>                         goto bad;
>                 }
>         }
>
> -       if (head) {
> -               newc->sid[0] = head->sid[0] + 1;
> -       } else {
> -               newc->sid[0] = 1;
> +       newc = (ocontext_t *) malloc(sizeof(ocontext_t));
> +       if (!newc) {
> +               yyerror("out of memory");
> +               goto bad;
>         }
> +       memset(newc, 0, sizeof(ocontext_t));
> +       newc->u.name = id;
> +       context_init(&newc->context[0]);
> +       newc->sid[0] = sid;
>         newc->next = head;
>         policydbp->ocontexts[OCON_ISID] = newc;
>
> @@ -4567,6 +4571,7 @@ static int parse_security_context(context_struct_t * c)
>  int define_initial_sid_context(void)
>  {
>         char *id;
> +       sepol_security_id_t sid;
>         ocontext_t *c, *head;
>
>         if (pass == 1) {
> @@ -4581,9 +4586,17 @@ int define_initial_sid_context(void)
>                 yyerror("no sid name for SID context definition?");
>                 return -1;
>         }
> +
> +       sid = selinux_str_to_sid(id);
> +       if (sid == 0) {
> +               yyerror2("invalid initial SID %s", id);
> +               free(id);
> +               return -1;
> +       }
> +
>         head = policydbp->ocontexts[OCON_ISID];
>         for (c = head; c; c = c->next) {
> -               if (!strcmp(id, c->u.name))
> +               if (sid == c->sid[0])
>                         break;
>         }
>
> --
> 2.36.1
>