Re: [PATCH v2] checkpolicy: add option to skip checking neverallow rules

[Petr Lautrbach <lautrbach@redhat.com>]

James Carter <jwcart2@gmail.com> writes:

> On Fri, May 12, 2023 at 5:59 AM Christian Göttsche
> <cgzones@googlemail.com> wrote:
>>
>> Add the command line argument `-N/--disable-neverallow`, similar to
>> secilc(8), to checkpolicy(8) and checkmodule(8) to skip the check of
>> neverallow rule violations.
>>
>> This is mainly useful in development, e.g. to quickly add rules to a
>> policy without fulfilling all neverallow rules or build policies with
>> known violations.
>>
>> Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
>
> Acked-by: James Carter <jwcart2@gmail.com>

merged, thanks


>> ---
>> v2:
>>    invert variable logic from check_neverallow to disable_neverallow
>> ---
>>  checkpolicy/checkmodule.8 |  5 ++++-
>>  checkpolicy/checkmodule.c | 13 +++++++++----
>>  checkpolicy/checkpolicy.8 |  5 ++++-
>>  checkpolicy/checkpolicy.c | 12 ++++++++----
>>  4 files changed, 25 insertions(+), 10 deletions(-)
>>
>> diff --git a/checkpolicy/checkmodule.8 b/checkpolicy/checkmodule.8
>> index 1061a6f2..ed9efd4c 100644
>> --- a/checkpolicy/checkmodule.8
>> +++ b/checkpolicy/checkmodule.8
>> @@ -3,7 +3,7 @@
>>  checkmodule \- SELinux policy module compiler
>>  .SH SYNOPSIS
>>  .B checkmodule
>> -.I "[\-h] [\-b] [\-c policy_version] [\-C] [\-E] [\-m] [\-M] [\-U handle_unknown] [\-V] [\-o output_file] [input_file]"
>> +.I "[\-h] [\-b] [\-c policy_version] [\-C] [\-E] [\-m] [\-M] [\-N] [\-U handle_unknown] [\-V] [\-o output_file] [input_file]"
>>  .SH "DESCRIPTION"
>>  This manual page describes the
>>  .BR checkmodule
>> @@ -43,6 +43,9 @@ Generate a non-base policy module.
>>  .B \-M,\-\-mls
>>  Enable the MLS/MCS support when checking and compiling the policy module.
>>  .TP
>> +.B \-N,\-\-disable-neverallow
>> +Do not check neverallow rules.
>> +.TP
>>  .B \-V,\-\-version
>>  Show policy versions created by this program.
>>  .TP
>> diff --git a/checkpolicy/checkmodule.c b/checkpolicy/checkmodule.c
>> index 3432608b..14e6c891 100644
>> --- a/checkpolicy/checkmodule.c
>> +++ b/checkpolicy/checkmodule.c
>> @@ -123,7 +123,7 @@ static int write_binary_policy(policydb_t * p, FILE *outfp)
>>
>>  static __attribute__((__noreturn__)) void usage(const char *progname)
>>  {
>> -       printf("usage:  %s [-h] [-V] [-b] [-C] [-E] [-U handle_unknown] [-m] [-M] [-o FILE] [-c VERSION] [INPUT]\n", progname);
>> +       printf("usage:  %s [-h] [-V] [-b] [-C] [-E] [-U handle_unknown] [-m] [-M] [-N] [-o FILE] [-c VERSION] [INPUT]\n", progname);
>>         printf("Build base and policy modules.\n");
>>         printf("Options:\n");
>>         printf("  INPUT      build module from INPUT (else read from \"%s\")\n",
>> @@ -139,6 +139,7 @@ static __attribute__((__noreturn__)) void usage(const char *progname)
>>         printf("               allow: Allow unknown kernel checks\n");
>>         printf("  -m         build a policy module instead of a base module\n");
>>         printf("  -M         enable MLS policy\n");
>> +       printf("  -N         do not check neverallow rules\n");
>>         printf("  -o FILE    write module to FILE (else just check syntax)\n");
>>         printf("  -c VERSION build a policy module targeting a modular policy version (%d-%d)\n",
>>                MOD_POLICYDB_VERSION_MIN, MOD_POLICYDB_VERSION_MAX);
>> @@ -148,7 +149,7 @@ static __attribute__((__noreturn__)) void usage(const char *progname)
>>  int main(int argc, char **argv)
>>  {
>>         const char *file = txtfile, *outfile = NULL;
>> -       unsigned int binary = 0, cil = 0;
>> +       unsigned int binary = 0, cil = 0, disable_neverallow = 0;
>>         int ch;
>>         int show_version = 0;
>>         policydb_t modpolicydb;
>> @@ -159,12 +160,13 @@ int main(int argc, char **argv)
>>                 {"version", no_argument, NULL, 'V'},
>>                 {"handle-unknown", required_argument, NULL, 'U'},
>>                 {"mls", no_argument, NULL, 'M'},
>> +               {"disable-neverallow", no_argument, NULL, 'N'},
>>                 {"cil", no_argument, NULL, 'C'},
>>                 {"werror", no_argument, NULL, 'E'},
>>                 {NULL, 0, NULL, 0}
>>         };
>>
>> -       while ((ch = getopt_long(argc, argv, "ho:bVEU:mMCc:", long_options, NULL)) != -1) {
>> +       while ((ch = getopt_long(argc, argv, "ho:bVEU:mMNCc:", long_options, NULL)) != -1) {
>>                 switch (ch) {
>>                 case 'h':
>>                         usage(argv[0]);
>> @@ -202,6 +204,9 @@ int main(int argc, char **argv)
>>                 case 'M':
>>                         mlspol = 1;
>>                         break;
>> +               case 'N':
>> +                       disable_neverallow = 1;
>> +                       break;
>>                 case 'C':
>>                         cil = 1;
>>                         break;
>> @@ -317,7 +322,7 @@ int main(int argc, char **argv)
>>                         fprintf(stderr, "%s:  link modules failed\n", argv[0]);
>>                         exit(1);
>>                 }
>> -               if (expand_module(NULL, &modpolicydb, &kernpolicydb, 0, 1)) {
>> +               if (expand_module(NULL, &modpolicydb, &kernpolicydb, /*verbose=*/0, !disable_neverallow)) {
>>                         fprintf(stderr, "%s:  expand module failed\n", argv[0]);
>>                         exit(1);
>>                 }
>> diff --git a/checkpolicy/checkpolicy.8 b/checkpolicy/checkpolicy.8
>> index 2984c238..c66e084b 100644
>> --- a/checkpolicy/checkpolicy.8
>> +++ b/checkpolicy/checkpolicy.8
>> @@ -3,7 +3,7 @@
>>  checkpolicy \- SELinux policy compiler
>>  .SH SYNOPSIS
>>  .B checkpolicy
>> -.I "[\-b[F]] [\-C] [\-d] [\-U handle_unknown (allow,deny,reject)] [\-M] [\-c policyvers] [\-o output_file|\-] [\-S] [\-t target_platform (selinux,xen)] [\-O] [\-E] [\-V] [input_file]"
>> +.I "[\-b[F]] [\-C] [\-d] [\-U handle_unknown (allow,deny,reject)] [\-M] [\-N] [\-c policyvers] [\-o output_file|\-] [\-S] [\-t target_platform (selinux,xen)] [\-O] [\-E] [\-V] [input_file]"
>>  .br
>>  .SH "DESCRIPTION"
>>  This manual page describes the
>> @@ -38,6 +38,9 @@ Specify how the kernel should handle unknown classes or permissions (deny, allow
>>  .B \-M,\-\-mls
>>  Enable the MLS policy when checking and compiling the policy.
>>  .TP
>> +.B \-N,\-\-disable-neverallow
>> +Do not check neverallow rules.
>> +.TP
>>  .B \-c policyvers
>>  Specify the policy version, defaults to the latest.
>>  .TP
>> diff --git a/checkpolicy/checkpolicy.c b/checkpolicy/checkpolicy.c
>> index 2485142d..623ba8b2 100644
>> --- a/checkpolicy/checkpolicy.c
>> +++ b/checkpolicy/checkpolicy.c
>> @@ -109,7 +109,7 @@ static __attribute__((__noreturn__)) void usage(const char *progname)
>>  {
>>         printf
>>             ("usage:  %s [-b[F]] [-C] [-d] [-U handle_unknown (allow,deny,reject)] [-M] "
>> -            "[-c policyvers (%d-%d)] [-o output_file|-] [-S] [-O] "
>> +            "[-N] [-c policyvers (%d-%d)] [-o output_file|-] [-S] [-O] "
>>              "[-t target_platform (selinux,xen)] [-E] [-V] [input_file]\n",
>>              progname, POLICYDB_VERSION_MIN, POLICYDB_VERSION_MAX);
>>         exit(1);
>> @@ -393,7 +393,7 @@ int main(int argc, char **argv)
>>         size_t scontext_len, pathlen;
>>         unsigned int i;
>>         unsigned int protocol, port;
>> -       unsigned int binary = 0, debug = 0, sort = 0, cil = 0, conf = 0, optimize = 0;
>> +       unsigned int binary = 0, debug = 0, sort = 0, cil = 0, conf = 0, optimize = 0, disable_neverallow = 0;
>>         struct val_to_name v;
>>         int ret, ch, fd, target = SEPOL_TARGET_SELINUX;
>>         unsigned int nel, uret;
>> @@ -415,6 +415,7 @@ int main(int argc, char **argv)
>>                 {"version", no_argument, NULL, 'V'},
>>                 {"handle-unknown", required_argument, NULL, 'U'},
>>                 {"mls", no_argument, NULL, 'M'},
>> +               {"disable-neverallow", no_argument, NULL, 'N'},
>>                 {"cil", no_argument, NULL, 'C'},
>>                 {"conf",no_argument, NULL, 'F'},
>>                 {"sort", no_argument, NULL, 'S'},
>> @@ -424,7 +425,7 @@ int main(int argc, char **argv)
>>                 {NULL, 0, NULL, 0}
>>         };
>>
>> -       while ((ch = getopt_long(argc, argv, "o:t:dbU:MCFSVc:OEh", long_options, NULL)) != -1) {
>> +       while ((ch = getopt_long(argc, argv, "o:t:dbU:MNCFSVc:OEh", long_options, NULL)) != -1) {
>>                 switch (ch) {
>>                 case 'o':
>>                         outfile = optarg;
>> @@ -473,6 +474,9 @@ int main(int argc, char **argv)
>>                 case 'M':
>>                         mlspol = 1;
>>                         break;
>> +               case 'N':
>> +                       disable_neverallow = 1;
>> +                       break;
>>                 case 'C':
>>                         cil = 1;
>>                         break;
>> @@ -630,7 +634,7 @@ int main(int argc, char **argv)
>>                                 fprintf(stderr, "%s:  policydb_init failed\n", argv[0]);
>>                                 exit(1);
>>                         }
>> -                       if (expand_module(NULL, policydbp, &policydb, 0, 1)) {
>> +                       if (expand_module(NULL, policydbp, &policydb, /*verbose=*/0, !disable_neverallow)) {
>>                                 fprintf(stderr, "Error while expanding policy\n");
>>                                 exit(1);
>>                         }
>> --
>> 2.40.1
>>