* [PATCH 1/7 v2] libsepol: Changes to ebitmap.h to fix compiler warnings
2023-08-09 20:40 [PATCH 0/7 v2] Add support for notself and other to CIL James Carter
@ 2023-08-09 20:40 ` James Carter
2023-08-09 20:40 ` [PATCH 2/7 v2] libsepol/cil: Do not call ebitmap_init twice for an ebitmap James Carter
` (5 subsequent siblings)
6 siblings, 0 replies; 8+ messages in thread
From: James Carter @ 2023-08-09 20:40 UTC (permalink / raw)
To: selinux; +Cc: dburgener, cgzones, James Carter
When compiling with the "-Wnull-dereference" flag, the compiler is
not smart enough to realize that anytime the ebitmap_t node field is
NULL, the highbit field will equal 0. This causes false positive
warnings to be generated.
Change the ebitmap_is_empty() and ebitmap_length() macros to check
for the node being NULL instead of just relying on the value of
highbit to eliminate these false warnings.
Signed-off-by: James Carter <jwcart2@gmail.com>
---
libsepol/include/sepol/policydb/ebitmap.h | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/libsepol/include/sepol/policydb/ebitmap.h b/libsepol/include/sepol/policydb/ebitmap.h
index c434c4ba..7e19c301 100644
--- a/libsepol/include/sepol/policydb/ebitmap.h
+++ b/libsepol/include/sepol/policydb/ebitmap.h
@@ -39,8 +39,8 @@ typedef struct ebitmap {
uint32_t highbit; /* highest position in the total bitmap */
} ebitmap_t;
-#define ebitmap_is_empty(e) (((e)->highbit) == 0)
-#define ebitmap_length(e) ((e)->highbit)
+#define ebitmap_is_empty(e) (((e)->node) == NULL)
+#define ebitmap_length(e) ((e)->node ? (e)->highbit : 0)
#define ebitmap_startbit(e) ((e)->node ? (e)->node->startbit : 0)
#define ebitmap_startnode(e) ((e)->node)
--
2.41.0
^ permalink raw reply related [flat|nested] 8+ messages in thread* [PATCH 2/7 v2] libsepol/cil: Do not call ebitmap_init twice for an ebitmap
2023-08-09 20:40 [PATCH 0/7 v2] Add support for notself and other to CIL James Carter
2023-08-09 20:40 ` [PATCH 1/7 v2] libsepol: Changes to ebitmap.h to fix compiler warnings James Carter
@ 2023-08-09 20:40 ` James Carter
2023-08-09 20:40 ` [PATCH 3/7 v2] libsepol/cil: Add notself and other support to CIL James Carter
` (4 subsequent siblings)
6 siblings, 0 replies; 8+ messages in thread
From: James Carter @ 2023-08-09 20:40 UTC (permalink / raw)
To: selinux; +Cc: dburgener, cgzones, James Carter
While it does no harm to call ebitmap_init() twice for an ebitmap,
since it is just memsetting the ebitmap to 0, it is poor practice.
In the function cil_type_matches() in cil_find.c, either ebitmap_and()
or ebitmap_set_bit() will be called. The function ebitmap_and() will
call ebitmap_init() on the destination ebitmap, but ebitmap_set_bit()
does not.
Instead of calling ebitmap_init() before the call to cil_type_matches(),
let cil_type_matches() make the call if it is going to call
ebitmap_set_bit(). It can also call ebitmap_destroy() on an error.
Since we are removing the call to ebitmap_init() in cil_self_match_any(),
cleanup some other things in the function (like using the FLAVOR()
macro and using ebitmap_is_empty()).
Signed-off-by: James Carter <jwcart2@gmail.com>
---
libsepol/cil/src/cil_find.c | 60 +++++++++++++++++++------------------
1 file changed, 31 insertions(+), 29 deletions(-)
diff --git a/libsepol/cil/src/cil_find.c b/libsepol/cil/src/cil_find.c
index 8b755277..0246d133 100644
--- a/libsepol/cil/src/cil_find.c
+++ b/libsepol/cil/src/cil_find.c
@@ -85,29 +85,34 @@ static int cil_type_matches(ebitmap_t *matches, struct cil_symtab_datum *d1, str
enum cil_flavor f1 = FLAVOR(d1);
enum cil_flavor f2 = FLAVOR(d2);
- if (f1 != CIL_TYPEATTRIBUTE && f2 != CIL_TYPEATTRIBUTE) {
- struct cil_type *t1 = (struct cil_type *)d1;
- struct cil_type *t2 = (struct cil_type *)d2;
- if (t1->value == t2->value) {
- ebitmap_set_bit(matches, t1->value, 1);
- }
- } else if (f1 == CIL_TYPEATTRIBUTE && f2 != CIL_TYPEATTRIBUTE) {
- struct cil_typeattribute *a = (struct cil_typeattribute *)d1;
- struct cil_type *t = (struct cil_type *)d2;
- if (ebitmap_get_bit(a->types, t->value)) {
- ebitmap_set_bit(matches, t->value, 1);
- }
- } else if (f1 != CIL_TYPEATTRIBUTE && f2 == CIL_TYPEATTRIBUTE) {
- struct cil_type *t = (struct cil_type *)d1;
- struct cil_typeattribute *a = (struct cil_typeattribute *)d2;
- if (ebitmap_get_bit(a->types, t->value)) {
- ebitmap_set_bit(matches, t->value, 1);
- }
- } else {
- /* Both are attributes */
+ if (f1 == CIL_TYPEATTRIBUTE && f2 == CIL_TYPEATTRIBUTE) {
struct cil_typeattribute *a1 = (struct cil_typeattribute *)d1;
struct cil_typeattribute *a2 = (struct cil_typeattribute *)d2;
rc = ebitmap_and(matches, a1->types, a2->types);
+ } else {
+ ebitmap_init(matches);
+ if (f1 != CIL_TYPEATTRIBUTE && f2 != CIL_TYPEATTRIBUTE) {
+ struct cil_type *t1 = (struct cil_type *)d1;
+ struct cil_type *t2 = (struct cil_type *)d2;
+ if (t1->value == t2->value) {
+ rc = ebitmap_set_bit(matches, t1->value, 1);
+ }
+ } else if (f1 == CIL_TYPEATTRIBUTE && f2 != CIL_TYPEATTRIBUTE) {
+ struct cil_typeattribute *a = (struct cil_typeattribute *)d1;
+ struct cil_type *t = (struct cil_type *)d2;
+ if (ebitmap_get_bit(a->types, t->value)) {
+ rc = ebitmap_set_bit(matches, t->value, 1);
+ }
+ } else { // f1 != CIL_TYPEATTRIBUTE && f2 == CIL_TYPEATTRIBUTE
+ struct cil_type *t = (struct cil_type *)d1;
+ struct cil_typeattribute *a = (struct cil_typeattribute *)d2;
+ if (ebitmap_get_bit(a->types, t->value)) {
+ rc = ebitmap_set_bit(matches, t->value, 1);
+ }
+ }
+ if (rc != SEPOL_OK) {
+ ebitmap_destroy(matches);
+ }
}
return rc;
@@ -115,31 +120,28 @@ static int cil_type_matches(ebitmap_t *matches, struct cil_symtab_datum *d1, str
/* s1 is the src type that is matched with a self
* s2, and t2 are the source and type of the other rule
+ * Assumes there is a match between s1 and s2
*/
static int cil_self_match_any(struct cil_symtab_datum *s1, struct cil_symtab_datum *s2, struct cil_symtab_datum *t2)
{
int rc;
- struct cil_tree_node *n1 = NODE(s1);
- if (n1->flavor != CIL_TYPEATTRIBUTE) {
+
+ if (FLAVOR(s1) != CIL_TYPEATTRIBUTE) {
rc = cil_type_match_any(s1, t2);
} else {
struct cil_typeattribute *a = (struct cil_typeattribute *)s1;
ebitmap_t map;
- ebitmap_init(&map);
rc = cil_type_matches(&map, s2, t2);
if (rc < 0) {
- ebitmap_destroy(&map);
- goto exit;
+ return rc;
}
- if (map.node == NULL) {
- rc = CIL_FALSE;
- goto exit;
+ if (ebitmap_is_empty(&map)) {
+ return CIL_FALSE;
}
rc = ebitmap_match_any(&map, a->types);
ebitmap_destroy(&map);
}
-exit:
return rc;
}
--
2.41.0
^ permalink raw reply related [flat|nested] 8+ messages in thread* [PATCH 3/7 v2] libsepol/cil: Add notself and other support to CIL
2023-08-09 20:40 [PATCH 0/7 v2] Add support for notself and other to CIL James Carter
2023-08-09 20:40 ` [PATCH 1/7 v2] libsepol: Changes to ebitmap.h to fix compiler warnings James Carter
2023-08-09 20:40 ` [PATCH 2/7 v2] libsepol/cil: Do not call ebitmap_init twice for an ebitmap James Carter
@ 2023-08-09 20:40 ` James Carter
2023-08-09 20:40 ` [PATCH 4/7 v2] libsepol: update CIL generation for trivial not-self rules James Carter
` (3 subsequent siblings)
6 siblings, 0 replies; 8+ messages in thread
From: James Carter @ 2023-08-09 20:40 UTC (permalink / raw)
To: selinux; +Cc: dburgener, cgzones, James Carter
Like "self", both of these reserved words can be used as a target
in an access vector rule. "notself" means all types other than
the source type. "other" is meant to be used with an attribute and
its use results in the rule being expanded with each type of the
attribute being used as the source type with each of the other types
being used as the target type. Using "other" with just a type will
result in no rule.
Example 1
(allow TYPE1 notself (CLASS (PERM)))
This rule is expanded to a number of rules with TYPE1 as the source
and every type except for TYPE1 as the target.
Example 2
(allow ATTR1 notself (CLASS (PERM)))
Like Example 1, this rule will be expanded to each type in ATTR1
being the source with every type except for the type used as the
source being the target.
Example 3
(allow TYPE1 other (CLASS (PERM)))
This expands to no rule.
Example 4
(allow ATTR1 other (CLASS (PERM)))
Like Example 2, but the target types will be limited to the types
in the attribute ATTR1 instead of all types. So if ATTR1 has the
type t1, t2, and t3, then this rule expands to the following rules.
(allow t1 t2 (CLASS (PERM)))
(allow t1 t3 (CLASS (PERM)))
(allow t2 t1 (CLASS (PERM)))
(allow t2 t3 (CLASS (PERM)))
(allow t3 t1 (CLASS (PERM)))
(allow t3 t2 (CLASS (PERM)))
Signed-off-by: James Carter <jwcart2@gmail.com>
---
libsepol/cil/src/cil.c | 12 ++
libsepol/cil/src/cil_binary.c | 91 +++++++++++++-
libsepol/cil/src/cil_build_ast.c | 10 +-
libsepol/cil/src/cil_find.c | 188 ++++++++++++++++++++++++++---
libsepol/cil/src/cil_internal.h | 4 +
libsepol/cil/src/cil_resolve_ast.c | 4 +
libsepol/cil/src/cil_verify.c | 3 +-
7 files changed, 289 insertions(+), 23 deletions(-)
diff --git a/libsepol/cil/src/cil.c b/libsepol/cil/src/cil.c
index 38edcf8e..ed97ff44 100644
--- a/libsepol/cil/src/cil.c
+++ b/libsepol/cil/src/cil.c
@@ -84,6 +84,8 @@ char *CIL_KEY_CONS_INCOMP;
char *CIL_KEY_CONDTRUE;
char *CIL_KEY_CONDFALSE;
char *CIL_KEY_SELF;
+char *CIL_KEY_NOTSELF;
+char *CIL_KEY_OTHER;
char *CIL_KEY_OBJECT_R;
char *CIL_KEY_STAR;
char *CIL_KEY_TCP;
@@ -253,6 +255,8 @@ static void cil_init_keys(void)
CIL_KEY_CONDTRUE = cil_strpool_add("true");
CIL_KEY_CONDFALSE = cil_strpool_add("false");
CIL_KEY_SELF = cil_strpool_add("self");
+ CIL_KEY_NOTSELF = cil_strpool_add("notself");
+ CIL_KEY_OTHER = cil_strpool_add("other");
CIL_KEY_OBJECT_R = cil_strpool_add("object_r");
CIL_KEY_STAR = cil_strpool_add("*");
CIL_KEY_UDP = cil_strpool_add("udp");
@@ -430,6 +434,12 @@ void cil_db_init(struct cil_db **db)
cil_type_init(&(*db)->selftype);
(*db)->selftype->datum.name = CIL_KEY_SELF;
(*db)->selftype->datum.fqn = CIL_KEY_SELF;
+ cil_type_init(&(*db)->notselftype);
+ (*db)->notselftype->datum.name = CIL_KEY_NOTSELF;
+ (*db)->notselftype->datum.fqn = CIL_KEY_NOTSELF;
+ cil_type_init(&(*db)->othertype);
+ (*db)->othertype->datum.name = CIL_KEY_OTHER;
+ (*db)->othertype->datum.fqn = CIL_KEY_OTHER;
(*db)->num_types_and_attrs = 0;
(*db)->num_classes = 0;
(*db)->num_types = 0;
@@ -483,6 +493,8 @@ void cil_db_destroy(struct cil_db **db)
cil_list_destroy(&(*db)->names, CIL_TRUE);
cil_destroy_type((*db)->selftype);
+ cil_destroy_type((*db)->notselftype);
+ cil_destroy_type((*db)->othertype);
cil_strpool_destroy();
free((*db)->val_to_type);
diff --git a/libsepol/cil/src/cil_binary.c b/libsepol/cil/src/cil_binary.c
index c4ee2380..a8e3616a 100644
--- a/libsepol/cil/src/cil_binary.c
+++ b/libsepol/cil/src/cil_binary.c
@@ -1519,6 +1519,46 @@ static int __cil_avrule_to_avtab(policydb_t *pdb, const struct cil_db *db, struc
}
}
ebitmap_destroy(&src_bitmap);
+ } else if (tgt->fqn == CIL_KEY_NOTSELF) {
+ rc = __cil_expand_type(src, &src_bitmap);
+ if (rc != SEPOL_OK) {
+ goto exit;
+ }
+
+ ebitmap_for_each_positive_bit(&src_bitmap, snode, s) {
+ src = DATUM(db->val_to_type[s]);
+ for (t = 0; t < (unsigned int)db->num_types; t++) {
+ if (s != t) {
+ tgt = DATUM(db->val_to_type[t]);
+ rc = __cil_avrule_expand(pdb, kind, src, tgt, classperms, cond_node, cond_flavor);
+ if (rc != SEPOL_OK) {
+ ebitmap_destroy(&src_bitmap);
+ goto exit;
+ }
+ }
+ }
+ }
+ ebitmap_destroy(&src_bitmap);
+ } else if (tgt->fqn == CIL_KEY_OTHER) {
+ rc = __cil_expand_type(src, &src_bitmap);
+ if (rc != SEPOL_OK) {
+ goto exit;
+ }
+
+ ebitmap_for_each_positive_bit(&src_bitmap, snode, s) {
+ src = DATUM(db->val_to_type[s]);
+ ebitmap_for_each_positive_bit(&src_bitmap, tnode, t) {
+ if (s != t) {
+ tgt = DATUM(db->val_to_type[t]);
+ rc = __cil_avrule_expand(pdb, kind, src, tgt, classperms, cond_node, cond_flavor);
+ if (rc != SEPOL_OK) {
+ ebitmap_destroy(&src_bitmap);
+ goto exit;
+ }
+ }
+ }
+ }
+ ebitmap_destroy(&src_bitmap);
} else {
int expand_src = __cil_should_expand_attribute(db, src);
int expand_tgt = __cil_should_expand_attribute(db, tgt);
@@ -1875,10 +1915,51 @@ static int cil_avrulex_to_hashtable(policydb_t *pdb, const struct cil_db *db, st
src = DATUM(db->val_to_type[s]);
rc = __cil_avrulex_to_hashtable_helper(pdb, kind, src, src, cil_avrulex->perms.x.permx, args);
if (rc != SEPOL_OK) {
+ ebitmap_destroy(&src_bitmap);
goto exit;
}
}
ebitmap_destroy(&src_bitmap);
+ } else if (tgt->fqn == CIL_KEY_NOTSELF) {
+ rc = __cil_expand_type(src, &src_bitmap);
+ if (rc != SEPOL_OK) {
+ goto exit;
+ }
+
+ ebitmap_for_each_positive_bit(&src_bitmap, snode, s) {
+ src = DATUM(db->val_to_type[s]);
+ for (t = 0; t < (unsigned int)db->num_types; t++) {
+ if (s != t) {
+ tgt = DATUM(db->val_to_type[t]);
+ rc = __cil_avrulex_to_hashtable_helper(pdb, kind, src, tgt, cil_avrulex->perms.x.permx, args);
+ if (rc != SEPOL_OK) {
+ ebitmap_destroy(&src_bitmap);
+ goto exit;
+ }
+ }
+ }
+ }
+ ebitmap_destroy(&src_bitmap);
+ } else if (tgt->fqn == CIL_KEY_OTHER) {
+ rc = __cil_expand_type(src, &src_bitmap);
+ if (rc != SEPOL_OK) {
+ goto exit;
+ }
+
+ ebitmap_for_each_positive_bit(&src_bitmap, snode, s) {
+ src = DATUM(db->val_to_type[s]);
+ ebitmap_for_each_positive_bit(&src_bitmap, tnode, t) {
+ if (s != t) {
+ tgt = DATUM(db->val_to_type[t]);
+ rc = __cil_avrulex_to_hashtable_helper(pdb, kind, src, tgt, cil_avrulex->perms.x.permx, args);
+ if (rc != SEPOL_OK) {
+ ebitmap_destroy(&src_bitmap);
+ goto exit;
+ }
+ }
+ }
+ }
+ ebitmap_destroy(&src_bitmap);
} else {
int expand_src = __cil_should_expand_attribute(db, src);
int expand_tgt = __cil_should_expand_attribute(db, tgt);
@@ -4813,8 +4894,16 @@ static int cil_check_neverallow(const struct cil_db *db, policydb_t *pdb, struct
if (tgt->fqn == CIL_KEY_SELF) {
rule->flags = RULE_SELF;
+ } else if (tgt->fqn == CIL_KEY_NOTSELF) {
+ rule->flags = RULE_NOTSELF;
+ } else if (tgt->fqn == CIL_KEY_OTHER) {
+ rule->flags = RULE_NOTSELF;
+ rc = __cil_add_sepol_type(pdb, db, cil_rule->src, &rule->ttypes.types);
+ if (rc != SEPOL_OK) {
+ goto exit;
+ }
} else {
- rc = __cil_add_sepol_type(pdb, db, cil_rule->tgt, &rule->ttypes.types);
+ rc = __cil_add_sepol_type(pdb, db, tgt, &rule->ttypes.types);
if (rc != SEPOL_OK) {
goto exit;
}
diff --git a/libsepol/cil/src/cil_build_ast.c b/libsepol/cil/src/cil_build_ast.c
index 4177c9f6..ca9f80c7 100644
--- a/libsepol/cil/src/cil_build_ast.c
+++ b/libsepol/cil/src/cil_build_ast.c
@@ -3126,9 +3126,13 @@ int cil_gen_aliasactual(struct cil_db *db, struct cil_tree_node *parse_current,
goto exit;
}
- if ((flavor == CIL_TYPEALIAS && parse_current->next->data == CIL_KEY_SELF) || parse_current->next->next->data == CIL_KEY_SELF) {
- cil_log(CIL_ERR, "The keyword '%s' is reserved\n", CIL_KEY_SELF);
- rc = SEPOL_ERR;
+ rc = cil_verify_name(db, parse_current->next->data, flavor);
+ if (rc != SEPOL_OK) {
+ goto exit;
+ }
+
+ rc = cil_verify_name(db, parse_current->next->next->data, flavor);
+ if (rc != SEPOL_OK) {
goto exit;
}
diff --git a/libsepol/cil/src/cil_find.c b/libsepol/cil/src/cil_find.c
index 0246d133..11aa296e 100644
--- a/libsepol/cil/src/cil_find.c
+++ b/libsepol/cil/src/cil_find.c
@@ -145,6 +145,132 @@ static int cil_self_match_any(struct cil_symtab_datum *s1, struct cil_symtab_dat
return rc;
}
+/* s1 is the src type that is matched with a notself
+ * s2 and t2 are the source and type of the other rule
+ * Assumes there is a match between s1 and s2
+ */
+static int cil_notself_match_any(struct cil_symtab_datum *s1, struct cil_symtab_datum *s2, struct cil_symtab_datum *t2)
+{
+ int rc;
+ ebitmap_node_t *snode, *tnode;
+ unsigned int s,t;
+
+ if (FLAVOR(s1) != CIL_TYPEATTRIBUTE) {
+ struct cil_type *ts1 = (struct cil_type *)s1;
+ if (FLAVOR(t2) != CIL_TYPEATTRIBUTE) {
+ struct cil_type *tt2 = (struct cil_type *)t2;
+ if (ts1->value != tt2->value) {
+ return CIL_TRUE;
+ }
+ } else {
+ struct cil_typeattribute *at2 = (struct cil_typeattribute *)t2;
+ ebitmap_for_each_positive_bit(at2->types, tnode, t) {
+ if (t != (unsigned int)ts1->value) {
+ return CIL_TRUE;
+ }
+ }
+ }
+ } else {
+ ebitmap_t smap;
+ rc = cil_type_matches(&smap, s1, s2);
+ if (rc < 0) {
+ return rc;
+ }
+ if (ebitmap_is_empty(&smap)) {
+ return CIL_FALSE;
+ }
+ if (FLAVOR(t2) != CIL_TYPEATTRIBUTE) {
+ struct cil_type *tt2 = (struct cil_type *)t2;
+ ebitmap_for_each_positive_bit(&smap, snode, s) {
+ if (s != (unsigned int)tt2->value) {
+ ebitmap_destroy(&smap);
+ return CIL_TRUE;
+ }
+ }
+ } else {
+ struct cil_typeattribute *at2 = (struct cil_typeattribute *)t2;
+ ebitmap_for_each_positive_bit(&smap, snode, s) {
+ ebitmap_for_each_positive_bit(at2->types, tnode, t) {
+ if (s != t) {
+ ebitmap_destroy(&smap);
+ return CIL_TRUE;
+ }
+ }
+ }
+ }
+ ebitmap_destroy(&smap);
+ }
+
+ return CIL_FALSE;
+}
+
+/* s1 is the src type that is matched with an other
+ * s2, and t2 are the source and type of the other rule
+ * Assumes there is a match between s1 and s2
+ */
+static int cil_other_match_any(struct cil_symtab_datum *s1, struct cil_symtab_datum *s2, struct cil_symtab_datum *t2)
+{
+ int rc;
+ ebitmap_t smap, tmap;
+ ebitmap_node_t *snode, *tnode;
+ unsigned int s,t;
+
+ if (FLAVOR(s1) != CIL_TYPEATTRIBUTE) {
+ return CIL_FALSE;
+ }
+
+ rc = cil_type_matches(&smap, s1, s2);
+ if (rc < 0) {
+ return rc;
+ }
+
+ if (ebitmap_is_empty(&smap)) {
+ return CIL_FALSE;
+ }
+
+ rc = cil_type_matches(&tmap, s1, t2);
+ if (rc < 0) {
+ ebitmap_destroy(&smap);
+ return rc;
+ }
+
+ if (ebitmap_is_empty(&tmap)) {
+ ebitmap_destroy(&smap);
+ return CIL_FALSE;
+ }
+
+ ebitmap_for_each_positive_bit(&smap, snode, s) {
+ ebitmap_for_each_positive_bit(&tmap, tnode, t) {
+ if (s != t) {
+ rc = CIL_TRUE;
+ goto exit;
+ }
+ }
+ }
+
+ rc = CIL_FALSE;
+
+exit:
+ ebitmap_destroy(&smap);
+ ebitmap_destroy(&tmap);
+ return rc;
+}
+
+/* s2 is the src type that is matched with an other
+ * Assumes there is a match between s1 and s2
+ * s1 is not needed, since it is known that there is a match
+ */
+static int cil_notself_other_match_any(struct cil_symtab_datum *s2)
+{
+ if (FLAVOR(s2) == CIL_TYPEATTRIBUTE) {
+ struct cil_typeattribute *as2 = (struct cil_typeattribute *)s2;
+ if (ebitmap_cardinality(as2->types) > 1) {
+ return CIL_TRUE;
+ }
+ }
+ return CIL_FALSE;
+}
+
static int cil_classperms_match_any(struct cil_classperms *cp1, struct cil_classperms *cp2)
{
struct cil_class *c1 = cp1->class;
@@ -310,30 +436,56 @@ static int cil_find_matching_avrule(struct cil_tree_node *node, struct cil_avrul
if (!cil_type_match_any(s1, s2)) goto exit;
- if (t1->fqn != CIL_KEY_SELF && t2->fqn != CIL_KEY_SELF) {
- if (!cil_type_match_any(t1, t2)) goto exit;
- } else {
- if (t1->fqn == CIL_KEY_SELF && t2->fqn == CIL_KEY_SELF) {
+ if (t1->fqn == CIL_KEY_SELF) {
+ if (t2->fqn == CIL_KEY_SELF) {
/* The earlier check whether s1 and s2 matches is all that is needed */
- } else if (t1->fqn == CIL_KEY_SELF) {
+ rc = CIL_TRUE;
+ } else if (t2->fqn == CIL_KEY_NOTSELF || t2->fqn == CIL_KEY_OTHER) {
+ rc = CIL_FALSE;
+ } else {
rc = cil_self_match_any(s1, s2, t2);
- if (rc < 0) {
- goto exit;
- } else if (rc == CIL_FALSE) {
- rc = SEPOL_OK;
- goto exit;
- }
- } else if (t2->fqn == CIL_KEY_SELF) {
+ }
+ } else if (t1->fqn == CIL_KEY_NOTSELF) {
+ if (t2->fqn == CIL_KEY_SELF) {
+ rc = CIL_FALSE;
+ } else if (t2->fqn == CIL_KEY_NOTSELF) {
+ /* The earlier check whether s1 and s2 matches is all that is needed */
+ rc = CIL_TRUE;
+ } else if (t2->fqn == CIL_KEY_OTHER) {
+ rc = cil_notself_other_match_any(s2);
+ } else {
+ rc = cil_notself_match_any(s1, s2, t2);
+ }
+ } else if (t1->fqn == CIL_KEY_OTHER) {
+ if (t2->fqn == CIL_KEY_SELF) {
+ rc = CIL_FALSE;
+ } else if (t2->fqn == CIL_KEY_NOTSELF) {
+ rc = cil_notself_other_match_any(s1);
+ } else if (t2->fqn == CIL_KEY_OTHER) {
+ /* The earlier check whether s1 and s2 matches is all that is needed */
+ rc = CIL_TRUE;
+ } else {
+ rc = cil_other_match_any(s1, s2, t2);
+ }
+ } else {
+ if (t2->fqn == CIL_KEY_SELF) {
rc = cil_self_match_any(s2, s1, t1);
- if (rc < 0) {
- goto exit;
- } else if (rc == CIL_FALSE) {
- rc = SEPOL_OK;
- goto exit;
- }
+ } else if (t2->fqn == CIL_KEY_NOTSELF) {
+ rc = cil_notself_match_any(s2, s1, t1);
+ } else if (t2->fqn == CIL_KEY_OTHER) {
+ rc = cil_other_match_any(s2, s1, t1);
+ } else {
+ rc = cil_type_match_any(t1, t2);
}
}
+ if (rc < 0) {
+ goto exit;
+ } else if (rc == CIL_FALSE) {
+ rc = SEPOL_OK;
+ goto exit;
+ }
+
if (!target->is_extended) {
if (cil_classperms_list_match_any(avrule->perms.classperms, target->perms.classperms)) {
cil_list_append(matching, CIL_NODE, node);
diff --git a/libsepol/cil/src/cil_internal.h b/libsepol/cil/src/cil_internal.h
index a7604762..d727c352 100644
--- a/libsepol/cil/src/cil_internal.h
+++ b/libsepol/cil/src/cil_internal.h
@@ -101,6 +101,8 @@ extern char *CIL_KEY_CONS_INCOMP;
extern char *CIL_KEY_CONDTRUE;
extern char *CIL_KEY_CONDFALSE;
extern char *CIL_KEY_SELF;
+extern char *CIL_KEY_NOTSELF;
+extern char *CIL_KEY_OTHER;
extern char *CIL_KEY_OBJECT_R;
extern char *CIL_KEY_STAR;
extern char *CIL_KEY_TCP;
@@ -289,6 +291,8 @@ struct cil_db {
struct cil_tree *parse;
struct cil_tree *ast;
struct cil_type *selftype;
+ struct cil_type *notselftype;
+ struct cil_type *othertype;
struct cil_list *sidorder;
struct cil_list *classorder;
struct cil_list *catorder;
diff --git a/libsepol/cil/src/cil_resolve_ast.c b/libsepol/cil/src/cil_resolve_ast.c
index d2bfdc81..96dd4054 100644
--- a/libsepol/cil/src/cil_resolve_ast.c
+++ b/libsepol/cil/src/cil_resolve_ast.c
@@ -333,6 +333,10 @@ int cil_resolve_avrule(struct cil_tree_node *current, void *extra_args)
if (rule->tgt_str == CIL_KEY_SELF) {
rule->tgt = db->selftype;
+ } else if (rule->tgt_str == CIL_KEY_NOTSELF) {
+ rule->tgt = db->notselftype;
+ } else if (rule->tgt_str == CIL_KEY_OTHER) {
+ rule->tgt = db->othertype;
} else {
rc = cil_resolve_name(current, rule->tgt_str, CIL_SYM_TYPES, args, &tgt_datum);
if (rc != SEPOL_OK) {
diff --git a/libsepol/cil/src/cil_verify.c b/libsepol/cil/src/cil_verify.c
index 3f58969d..8b37d2a7 100644
--- a/libsepol/cil/src/cil_verify.c
+++ b/libsepol/cil/src/cil_verify.c
@@ -68,7 +68,8 @@ static int __cil_is_reserved_name(const char *name, enum cil_flavor flavor)
case CIL_TYPE:
case CIL_TYPEATTRIBUTE:
case CIL_TYPEALIAS:
- if ((name == CIL_KEY_ALL) || (name == CIL_KEY_SELF))
+ if ((name == CIL_KEY_ALL) || (name == CIL_KEY_SELF) || (name == CIL_KEY_NOTSELF)
+ || (name == CIL_KEY_OTHER))
return CIL_TRUE;
break;
case CIL_CAT:
--
2.41.0
^ permalink raw reply related [flat|nested] 8+ messages in thread* [PATCH 4/7 v2] libsepol: update CIL generation for trivial not-self rules
2023-08-09 20:40 [PATCH 0/7 v2] Add support for notself and other to CIL James Carter
` (2 preceding siblings ...)
2023-08-09 20:40 ` [PATCH 3/7 v2] libsepol/cil: Add notself and other support to CIL James Carter
@ 2023-08-09 20:40 ` James Carter
2023-08-09 20:40 ` [PATCH 5/7 v2] libsepol: Use ERR() instead of log_err() James Carter
` (2 subsequent siblings)
6 siblings, 0 replies; 8+ messages in thread
From: James Carter @ 2023-08-09 20:40 UTC (permalink / raw)
To: selinux; +Cc: dburgener, cgzones
From: Christian Göttsche <cgzones@googlemail.com>
Convert trivial not-self neverallow rules to CIL, e.g.
neverallow TYPE1 ~self:CLASS1 PERM1;
into
(neverallow TYPE1 notself (CLASS1 (PERM1)))
More complex targets are not yet supported in CIL and will fail to
convert, e.g.:
neverallow TYPE1 ~{ self ATTR1 } : CLASS1 PERM1;
neverallow TYPE2 { ATTR2 -self } : CLASS2 PERM2;
Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
---
libsepol/src/module_to_cil.c | 30 ++++++++++++++++++++++++++----
1 file changed, 26 insertions(+), 4 deletions(-)
diff --git a/libsepol/src/module_to_cil.c b/libsepol/src/module_to_cil.c
index a6b6d66f..3e168285 100644
--- a/libsepol/src/module_to_cil.c
+++ b/libsepol/src/module_to_cil.c
@@ -1188,10 +1188,23 @@ static int avrule_list_to_cil(int indent, struct policydb *pdb, struct avrule *a
goto exit;
}
- ts = &avrule->ttypes;
- rc = process_typeset(pdb, ts, attr_list, &tnames, &num_tnames);
- if (rc != 0) {
- goto exit;
+ if (avrule->flags & RULE_NOTSELF) {
+ if (!ebitmap_is_empty(&avrule->ttypes.types) || !ebitmap_is_empty(&avrule->ttypes.negset)) {
+ if (avrule->source_filename) {
+ log_err("%s:%lu: Non-trivial neverallow rules with targets containing not or minus self not yet supported",
+ avrule->source_filename, avrule->source_line);
+ } else {
+ log_err("Non-trivial neverallow rules with targets containing not or minus self not yet supported");
+ }
+ rc = -1;
+ goto exit;
+ }
+ } else {
+ ts = &avrule->ttypes;
+ rc = process_typeset(pdb, ts, attr_list, &tnames, &num_tnames);
+ if (rc != 0) {
+ goto exit;
+ }
}
for (s = 0; s < num_snames; s++) {
@@ -1215,6 +1228,15 @@ static int avrule_list_to_cil(int indent, struct policydb *pdb, struct avrule *a
if (rc != 0) {
goto exit;
}
+ } else if (avrule->flags & RULE_NOTSELF) {
+ if (avrule->specified & AVRULE_XPERMS) {
+ rc = avrulex_to_cil(indent, pdb, avrule->specified, snames[s], "notself", avrule->perms, avrule->xperms);
+ } else {
+ rc = avrule_to_cil(indent, pdb, avrule->specified, snames[s], "notself", avrule->perms);
+ }
+ if (rc != 0) {
+ goto exit;
+ }
}
}
--
2.41.0
^ permalink raw reply related [flat|nested] 8+ messages in thread* [PATCH 5/7 v2] libsepol: Use ERR() instead of log_err()
2023-08-09 20:40 [PATCH 0/7 v2] Add support for notself and other to CIL James Carter
` (3 preceding siblings ...)
2023-08-09 20:40 ` [PATCH 4/7 v2] libsepol: update CIL generation for trivial not-self rules James Carter
@ 2023-08-09 20:40 ` James Carter
2023-08-09 20:40 ` [PATCH 6/7 v2] secilc/docs: Add notself and other keywords to CIL documentation James Carter
2023-08-09 20:40 ` [PATCH 7/7 v2] secilc/test: Add notself and other tests James Carter
6 siblings, 0 replies; 8+ messages in thread
From: James Carter @ 2023-08-09 20:40 UTC (permalink / raw)
To: selinux; +Cc: dburgener, cgzones, James Carter
Since log_err() has been removed, use ERR() instead of log_err() in
module_to_cil.c.
Signed-off-by: James Carter <jwcart2@gmail.com>
---
libsepol/src/module_to_cil.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/libsepol/src/module_to_cil.c b/libsepol/src/module_to_cil.c
index 3e168285..d2868019 100644
--- a/libsepol/src/module_to_cil.c
+++ b/libsepol/src/module_to_cil.c
@@ -1191,10 +1191,10 @@ static int avrule_list_to_cil(int indent, struct policydb *pdb, struct avrule *a
if (avrule->flags & RULE_NOTSELF) {
if (!ebitmap_is_empty(&avrule->ttypes.types) || !ebitmap_is_empty(&avrule->ttypes.negset)) {
if (avrule->source_filename) {
- log_err("%s:%lu: Non-trivial neverallow rules with targets containing not or minus self not yet supported",
+ ERR(NULL, "%s:%lu: Non-trivial neverallow rules with targets containing not or minus self not yet supported",
avrule->source_filename, avrule->source_line);
} else {
- log_err("Non-trivial neverallow rules with targets containing not or minus self not yet supported");
+ ERR(NULL, "Non-trivial neverallow rules with targets containing not or minus self not yet supported");
}
rc = -1;
goto exit;
--
2.41.0
^ permalink raw reply related [flat|nested] 8+ messages in thread* [PATCH 6/7 v2] secilc/docs: Add notself and other keywords to CIL documentation
2023-08-09 20:40 [PATCH 0/7 v2] Add support for notself and other to CIL James Carter
` (4 preceding siblings ...)
2023-08-09 20:40 ` [PATCH 5/7 v2] libsepol: Use ERR() instead of log_err() James Carter
@ 2023-08-09 20:40 ` James Carter
2023-08-09 20:40 ` [PATCH 7/7 v2] secilc/test: Add notself and other tests James Carter
6 siblings, 0 replies; 8+ messages in thread
From: James Carter @ 2023-08-09 20:40 UTC (permalink / raw)
To: selinux; +Cc: dburgener, cgzones, James Carter
Also reorganize the access vector rules section to minimize duplication
explanation of the parts of access vector rules.
Signed-off-by: James Carter <jwcart2@gmail.com>
---
secilc/docs/README.md | 1 -
secilc/docs/cil_access_vector_rules.md | 244 +++----------------------
secilc/docs/cil_reference_guide.md | 9 -
secilc/docs/secil.xml | 2 +
4 files changed, 32 insertions(+), 224 deletions(-)
diff --git a/secilc/docs/README.md b/secilc/docs/README.md
index efab2a71..5e00fc3b 100644
--- a/secilc/docs/README.md
+++ b/secilc/docs/README.md
@@ -17,7 +17,6 @@ CIL (Common Intermediate Language)
* [Global Namespace](cil_reference_guide.md#global-namespace)
* [Expressions](cil_reference_guide.md#expressions)
* [Name String](cil_reference_guide.md#name-string)
- * [self](cil_reference_guide.md#self)
* [Example CIL Policy](../test/policy.cil)
* [Access Vector Rules](cil_access_vector_rules.md#access-vector-rules)
diff --git a/secilc/docs/cil_access_vector_rules.md b/secilc/docs/cil_access_vector_rules.md
index f0ba4a90..034185da 100644
--- a/secilc/docs/cil_access_vector_rules.md
+++ b/secilc/docs/cil_access_vector_rules.md
@@ -1,15 +1,12 @@
Access Vector Rules
===================
-allow
------
-
-Specifies the access allowed between a source and target type. Note that access may be refined by constraint rules based on the source, target and class ([`validatetrans`](cil_constraint_statements.md#validatetrans) or [`mlsvalidatetrans`](cil_constraint_statements.md#mlsvalidatetrans)) or source, target class and permissions ([`constrain`](cil_constraint_statements.md#constrain) or [`mlsconstrain`](cil_constraint_statements.md#mlsconstrain) statements).
+Rules involving a source type, a target type, and class permissions or extended permissions.
**Rule definition:**
```secil
- (allow source_id target_id|self classpermissionset_id ...)
+ (av_flavor source_id target_id|self|notself|other classpermission_id|permissionx_id)
```
**Where:**
@@ -21,9 +18,8 @@ Specifies the access allowed between a source and target type. Note that access
</colgroup>
<tbody>
<tr class="odd">
-<td align="left"><p><code>allow</code></p></td>
-<td align="left"><p>The <code>allow</code> keyword.</p></td>
-</tr>
+<td align="left"><p><code>av_flavor</code></p></td>
+<td align="left"><p>The flavor of access vector rule. Possible flavors are <code>allow</code>, <code>auditallow</code>, <code>dontaudit</code>, <code>neverallow</code>, <code>allowx</code>, <code>auditallowx</code>, <code>dontauditx</code>, <code>neverallowx</code>.</p></td>
<tr class="even">
<td align="left"><p><code>source_id</code></p></td>
<td align="left"><p>A single previously defined source <code>type</code>, <code>typealias</code> or <code>typeattribute</code> identifier.</p></td>
@@ -31,15 +27,31 @@ Specifies the access allowed between a source and target type. Note that access
<tr class="odd">
<td align="left"><p><code>target_id</code></p></td>
<td align="left"><p>A single previously defined target <code>type</code>, <code>typealias</code> or <code>typeattribute</code> identifier.</p>
-<p>The <code>self</code> keyword may be used instead to signify that source and target are the same.</p></td>
+<p> Instead it can be one of the special keywords <code>self</code>, <code>notself</code> or <code>other</code>.</p>
+<p>The <code>self</code> keyword may be used to signify that source and target are the same. If the source is an attribute, each type of the source will be paired with itself as the target. The <code>notself</code> keyword may be used to signify that the target is all types except for the types of the source. The <code>other</code> keyword may be used as a short-hand way of writing a rule for each type of the source where it is paired with all of the other types of the source as the target.</p></td>
</tr>
<tr class="even">
-<td align="left"><p><code>classpermissionset_id</code></p></td>
-<td align="left"><p>A single named or anonymous <code>classpermissionset</code> or a single set of <code>classmap</code>/<code>classmapping</code> identifiers.</p></td>
+<td align="left"><p><code>classpermission_id</code></p></td>
+<td align="left"><p>A single named or anonymous <code>classpermissionset</code> or a single set of <code>classmap</code>/<code>classmapping</code> identifiers. Used for <code>allow</code>, <code>auditallow</code>, <code>dontaudit</code>, <code>neverallow</code> rules.</p></td>
+</tr>
+<tr class="odd">
+<td align="left"><p><code>permissionx_id</code></p></td>
+<td align="left"><p>A single named or anonymous <code>permissionx</code>. Used for <code>allowx</code>, <code>auditallowx</code>, <code>dontauditx</code>, <code>neverallowx</code> rules.</p></td>
</tr>
</tbody>
</table>
+allow
+-----
+
+Specifies the access allowed between a source and target type. Note that access may be refined by constraint rules based on the source, target and class ([`validatetrans`](cil_constraint_statements.md#validatetrans) or [`mlsvalidatetrans`](cil_constraint_statements.md#mlsvalidatetrans)) or source, target class and permissions ([`constrain`](cil_constraint_statements.md#constrain) or [`mlsconstrain`](cil_constraint_statements.md#mlsconstrain) statements).
+
+**Rule definition:**
+
+```secil
+ (allow source_id target_id|self|notself|other classpermissionset_id ...)
+```
+
**Examples:**
These examples show a selection of possible permutations of [`allow`](cil_access_vector_rules.md#allow) rules:
@@ -97,37 +109,9 @@ Audit the access rights defined if there is a valid allow rule. Note: It does NO
**Rule definition:**
```secil
- (auditallow source_id target_id|self classpermissionset_id ...)
+ (auditallow source_id target_id|self|notself|other classpermissionset_id)
```
-**Where:**
-
-<table>
-<colgroup>
-<col width="29%" />
-<col width="70%" />
-</colgroup>
-<tbody>
-<tr class="odd">
-<td align="left"><p><code>auditallow</code></p></td>
-<td align="left"><p>The <code>auditallow</code> keyword.</p></td>
-</tr>
-<tr class="even">
-<td align="left"><p><code>source_id</code></p></td>
-<td align="left"><p>A single previously defined source <code>type</code>, <code>typealias</code> or <code>typeattribute</code> identifier.</p></td>
-</tr>
-<tr class="odd">
-<td align="left"><p><code>target_id</code></p></td>
-<td align="left"><p>A single previously defined target <code>type</code>, <code>typealias</code> or <code>typeattribute</code> identifier.</p>
-<p>The <code>self</code> keyword may be used instead to signify that source and target are the same.</p></td>
-</tr>
-<tr class="even">
-<td align="left"><p><code>classpermissionset_id</code></p></td>
-<td align="left"><p>A single named or anonymous <code>classpermissionset</code> or a single set of <code>classmap</code>/<code>classmapping</code> identifiers.</p></td>
-</tr>
-</tbody>
-</table>
-
**Example:**
This example will log an audit event whenever the corresponding [`allow`](cil_access_vector_rules.md#allow) rule grants access to the specified permissions:
@@ -148,37 +132,9 @@ Note that these rules can be omitted by the CIL compiler command line parameter
**Rule definition:**
```secil
- (dontaudit source_id target_id|self classpermissionset_id ...)
+ (dontaudit source_id target_id|self|notself|other classpermissionset_id ...)
```
-**Where:**
-
-<table>
-<colgroup>
-<col width="27%" />
-<col width="72%" />
-</colgroup>
-<tbody>
-<tr class="odd">
-<td align="left"><p><code>dontaudit</code></p></td>
-<td align="left"><p>The <code>dontaudit</code> keyword.</p></td>
-</tr>
-<tr class="even">
-<td align="left"><p><code>source_id</code></p></td>
-<td align="left"><p>A single previously defined source <code>type</code>, <code>typealias</code> or <code>typeattribute</code> identifier.</p></td>
-</tr>
-<tr class="odd">
-<td align="left"><p><code>target_id</code></p></td>
-<td align="left"><p>A single previously defined target <code>type</code>, <code>typealias</code> or <code>typeattribute</code> identifier.</p>
-<p>The <code>self</code> keyword may be used instead to signify that source and target are the same.</p></td>
-</tr>
-<tr class="even">
-<td align="left"><p><code>classpermissionset_id</code></p></td>
-<td align="left"><p>A single named or anonymous <code>classpermissionset</code> or a single set of <code>classmap</code>/<code>classmapping</code> identifiers.</p></td>
-</tr>
-</tbody>
-</table>
-
**Example:**
This example will not audit the denied access:
@@ -197,37 +153,9 @@ Note that these rules can be over-ridden by the CIL compiler command line parame
**Rule definition:**
```secil
- (neverallow source_id target_id|self classpermissionset_id ...)
+ (neverallow source_id target_id|self|notself|other classpermissionset_id ...)
```
-**Where:**
-
-<table>
-<colgroup>
-<col width="27%" />
-<col width="72%" />
-</colgroup>
-<tbody>
-<tr class="odd">
-<td align="left"><p><code>neverallow</code></p></td>
-<td align="left"><p>The <code>neverallow</code> keyword.</p></td>
-</tr>
-<tr class="even">
-<td align="left"><p><code>source_id</code></p></td>
-<td align="left"><p>A single previously defined source <code>type</code>, <code>typealias</code> or <code>typeattribute</code> identifier.</p></td>
-</tr>
-<tr class="odd">
-<td align="left"><p><code>target_id</code></p></td>
-<td align="left"><p>A single previously defined target <code>type</code>, <code>typealias</code> or <code>typeattribute</code> identifier.</p>
-<p>The <code>self</code> keyword may be used instead to signify that source and target are the same.</p></td>
-</tr>
-<tr class="even">
-<td align="left"><p><code>classpermissionset_id</code></p></td>
-<td align="left"><p>A single named or anonymous <code>classpermissionset</code> or a single set of <code>classmap</code>/<code>classmapping</code> identifiers.</p></td>
-</tr>
-</tbody>
-</table>
-
**Example:**
This example will not compile as `type_3` is not allowed to be a source type for the [`allow`](cil_access_vector_rules.md#allow) rule:
@@ -258,37 +186,9 @@ Note that for this to work there must *also* be valid equivalent [`allow`](cil_a
**Rule definition:**
```secil
- (allowx source_id target_id|self permissionx_id)
+ (allowx source_id target_id|self|notself|other permissionx_id)
```
-**Where:**
-
-<table>
-<colgroup>
-<col width="27%" />
-<col width="72%" />
-</colgroup>
-<tbody>
-<tr class="odd">
-<td align="left"><p><code>allowx</code></p></td>
-<td align="left"><p>The <code>allowx</code> keyword.</p></td>
-</tr>
-<tr class="even">
-<td align="left"><p><code>source_id</code></p></td>
-<td align="left"><p>A single previously defined source <code>type</code>, <code>typealias</code>, or <code>typeattribute</code> identifier.</p></td>
-</tr>
-<tr class="odd">
-<td align="left"><p><code>target_id</code></p></td>
-<td align="left"><p>A single previously defined target <code>type</code>, <code>typealias</code>, or <code>typeattribute</code> identifier.</p>
-<p>The <code>self</code> keyword may be used instead to signify that source and target are the same.</p></td>
-</tr>
-<tr class="even">
-<td align="left"><p><code>permissionx_id</code></p></td>
-<td align="left"><p>A single named or anonymous <code>permissionx</code>.</p></td>
-</tr>
-</tbody>
-</table>
-
**Examples:**
These examples show a selection of possible permutations of [`allowx`](cil_access_vector_rules.md#allowx) rules:
@@ -313,37 +213,9 @@ Note that for this to work there must *also* be valid equivalent [`auditallow`](
**Rule definition:**
```secil
- (auditallowx source_id target_id|self permissionx_id)
+ (auditallowx source_id target_id|self|notself|other permissionx_id)
```
-**Where:**
-
-<table>
-<colgroup>
-<col width="27%" />
-<col width="72%" />
-</colgroup>
-<tbody>
-<tr class="odd">
-<td align="left"><p><code>auditallowx</code></p></td>
-<td align="left"><p>The <code>auditallowx</code> keyword.</p></td>
-</tr>
-<tr class="even">
-<td align="left"><p><code>source_id</code></p></td>
-<td align="left"><p>A single previously defined source <code>type</code>, <code>typealias</code> or <code>typeattribute</code> identifier.</p></td>
-</tr>
-<tr class="odd">
-<td align="left"><p><code>target_id</code></p></td>
-<td align="left"><p>A single previously defined target <code>type</code>, <code>typealias</code> or <code>typeattribute</code> identifier.</p>
-<p>The <code>self</code> keyword may be used instead to signify that source and target are the same.</p></td>
-</tr>
-<tr class="even">
-<td align="left"><p><code>permissionx_id</code></p></td>
-<td align="left"><p>A single named or anonymous <code>permissionx</code>.</p></td>
-</tr>
-</tbody>
-</table>
-
**Examples:**
This example will log an audit event whenever the corresponding [`allowx`](cil_access_vector_rules.md#allowx) rule grants access to the specified extended permissions:
@@ -367,37 +239,9 @@ Note that these rules can be omitted by the CIL compiler command line parameter
**Rule definition:**
```secil
- (dontauditx source_id target_id|self permissionx_id)
+ (dontauditx source_id target_id|self|notself|other permissionx_id)
```
-**Where:**
-
-<table>
-<colgroup>
-<col width="27%" />
-<col width="72%" />
-</colgroup>
-<tbody>
-<tr class="odd">
-<td align="left"><p><code>dontauditx</code></p></td>
-<td align="left"><p>The <code>dontauditx</code> keyword.</p></td>
-</tr>
-<tr class="even">
-<td align="left"><p><code>source_id</code></p></td>
-<td align="left"><p>A single previously defined source <code>type</code>, <code>typealias</code> or <code>typeattribute</code> identifier.</p></td>
-</tr>
-<tr class="odd">
-<td align="left"><p><code>target_id</code></p></td>
-<td align="left"><p>A single previously defined target <code>type</code>, <code>typealias</code> or <code>typeattribute</code> identifier.</p>
-<p>The <code>self</code> keyword may be used instead to signify that source and target are the same.</p></td>
-</tr>
-<tr class="even">
-<td align="left"><p><code>permissionx_id</code></p></td>
-<td align="left"><p>A single named or anonymous <code>permissionx</code>.</p></td>
-</tr>
-</tbody>
-</table>
-
**Examples:**
This example will not audit the denied access:
@@ -416,37 +260,9 @@ Note that these rules can be over-ridden by the CIL compiler command line parame
**Rule definition:**
```secil
- (neverallowx source_id target_id|self permissionx_id)
+ (neverallowx source_id target_id|self|notself|other permissionx_id)
```
-**Where:**
-
-<table>
-<colgroup>
-<col width="27%" />
-<col width="72%" />
-</colgroup>
-<tbody>
-<tr class="odd">
-<td align="left"><p><code>neverallowx</code></p></td>
-<td align="left"><p>The <code>neverallowx</code> keyword.</p></td>
-</tr>
-<tr class="even">
-<td align="left"><p><code>source_id</code></p></td>
-<td align="left"><p>A single previously defined source <code>type</code>, <code>typealias</code> or <code>typeattribute</code> identifier.</p></td>
-</tr>
-<tr class="odd">
-<td align="left"><p><code>target_id</code></p></td>
-<td align="left"><p>A single previously defined target <code>type</code>, <code>typealias</code> or <code>typeattribute</code> identifier.</p>
-<p>The <code>self</code> keyword may be used instead to signify that source and target are the same.</p></td>
-</tr>
-<tr class="even">
-<td align="left"><p><code>permissionx_id</code></p></td>
-<td align="left"><p>A single named or anonymous <code>permissionx</code>.</p></td>
-</tr>
-</tbody>
-</table>
-
**Examples:**
This example will not compile as `type_3` is not allowed to be a source type and ioctl range for the [`allowx`](cil_access_vector_rules.md#allowx) rule:
diff --git a/secilc/docs/cil_reference_guide.md b/secilc/docs/cil_reference_guide.md
index ac800b12..d1d3ff16 100644
--- a/secilc/docs/cil_reference_guide.md
+++ b/secilc/docs/cil_reference_guide.md
@@ -316,12 +316,3 @@ Alternatively:
(typetransition audit.process device.device chr_file ARG1 device.klog_device)
)
```
-
-self
-----
-
-The [`self`](cil_reference_guide.md#self) keyword may be used as the target in AVC rule statements, and means that the target is the same as the source as shown in the following example:.
-
-```secil
- (allow unconfined.process self (file (read write)))
-```
diff --git a/secilc/docs/secil.xml b/secilc/docs/secil.xml
index 38d7b030..60314e9a 100644
--- a/secilc/docs/secil.xml
+++ b/secilc/docs/secil.xml
@@ -145,6 +145,8 @@
<item>r3</item>
<item>sctp</item>
<item>self</item>
+ <item>notself</item>
+ <item>other</item>
<item>t1</item>
<item>t2</item>
<item>t3</item>
--
2.41.0
^ permalink raw reply related [flat|nested] 8+ messages in thread* [PATCH 7/7 v2] secilc/test: Add notself and other tests
2023-08-09 20:40 [PATCH 0/7 v2] Add support for notself and other to CIL James Carter
` (5 preceding siblings ...)
2023-08-09 20:40 ` [PATCH 6/7 v2] secilc/docs: Add notself and other keywords to CIL documentation James Carter
@ 2023-08-09 20:40 ` James Carter
6 siblings, 0 replies; 8+ messages in thread
From: James Carter @ 2023-08-09 20:40 UTC (permalink / raw)
To: selinux; +Cc: dburgener, cgzones, James Carter
Signed-off-by: James Carter <jwcart2@gmail.com>
---
secilc/test/notself_and_other.cil | 65 +++++++++++++++++++++++++++++++
1 file changed, 65 insertions(+)
create mode 100644 secilc/test/notself_and_other.cil
diff --git a/secilc/test/notself_and_other.cil b/secilc/test/notself_and_other.cil
new file mode 100644
index 00000000..9b33bfcb
--- /dev/null
+++ b/secilc/test/notself_and_other.cil
@@ -0,0 +1,65 @@
+(class CLASS (PERM))
+(class C1 (p1a p1b p1c p1d p1e))
+(classorder (CLASS C1))
+(sid SID)
+(sidorder (SID))
+(user USER)
+(role ROLE)
+(type TYPE)
+(category CAT)
+(categoryorder (CAT))
+(sensitivity SENS)
+(sensitivityorder (SENS))
+(sensitivitycategory SENS (CAT))
+(allow TYPE self (CLASS (PERM)))
+(roletype ROLE TYPE)
+(userrole USER ROLE)
+(userlevel USER (SENS))
+(userrange USER ((SENS)(SENS (CAT))))
+(sidcontext SID (USER ROLE TYPE ((SENS)(SENS))))
+
+(type ta)
+(type tb)
+(type tc)
+(type td)
+
+(typeattribute aab)
+(typeattributeset aab (ta tb))
+
+(typeattribute aac)
+(typeattributeset aac (ta tc))
+
+(typeattribute abc)
+(typeattributeset abc (tb tc))
+
+(typeattribute aabc)
+(typeattributeset aabc (ta tb tc))
+
+(typeattribute a_all_not_ta)
+(typeattributeset a_all_not_ta (and (all) (not ta)))
+
+(typeattribute a_all_not_aab)
+(typeattributeset a_all_not_aab (and (all) (not aab)))
+
+; Test 01
+(allow ta notself (C1 (p1a)))
+; (neverallow ta a_all_not_ta (C1 (p1a))) ; This check should fail
+
+; Test 02
+(allow aab notself (C1 (p1b)))
+; (neverallow aab a_all_not_aab (C1 (p1b))) ; This check should fail
+
+; Test 03
+(allow aab other (C1 (p1c)))
+; (neverallow ta tb (C1 (p1c))) ; This check should fail
+; (neverallow tb ta (C1 (p1c))) ; This check should fail
+
+; Test 04
+(allow aabc other (C1 (p1d)))
+; (neverallow ta abc (C1 (p1d))) ; This check should fail
+; (neverallow tb aac (C1 (p1d))) ; This check should fail
+; (neverallow tc aab (C1 (p1d))) ; This check should fail
+
+; Test 05
+(allow ta other (C1 (p1e))) ; other used with a single type results in no rule
+(neverallow ta a_all_not_ta (C1 (p1e)))
--
2.41.0
^ permalink raw reply related [flat|nested] 8+ messages in thread