* [PATCH] libsepol/cil: handle SID without assigned context when writing policy.conf
@ 2021-02-20 19:08 Christian Göttsche
2021-02-22 20:09 ` James Carter
2021-02-23 13:09 ` [PATCH v2] " Christian Göttsche
0 siblings, 2 replies; 5+ messages in thread
From: Christian Göttsche @ 2021-02-20 19:08 UTC (permalink / raw)
To: selinux
CIL permits not assigning a context to a SID, e.g. to an unused initial
SID, e.g. 'any_socket'.
When using the example policy from the SELinux Notebook,
https://github.com/SELinuxProject/selinux-notebook/blob/main/src/notebook-examples/cil-policy/cil-policy.cil,
secilc logs:
No context assigned to SID any_socket, omitting from policy at cil-policy.cil:166
But secil2conf segfaults when writing the policy.conf:
../cil/src/cil_policy.c:274:2: runtime error: member access within null pointer of type 'struct cil_context'
Only print the assigned context if actually available.
Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
---
libsepol/cil/src/cil_policy.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/libsepol/cil/src/cil_policy.c b/libsepol/cil/src/cil_policy.c
index 30d507f1..863636c7 100644
--- a/libsepol/cil/src/cil_policy.c
+++ b/libsepol/cil/src/cil_policy.c
@@ -1661,7 +1661,9 @@ static void cil_sid_contexts_to_policy(FILE *out, struct cil_list *sids, int mls
cil_list_for_each(i1, sids) {
sid = i1->data;
fprintf(out, "sid %s ", sid->datum.fqn);
- cil_context_to_policy(out, sid->context, mls);
+ if (sid->context) {
+ cil_context_to_policy(out, sid->context, mls);
+ }
fprintf(out,"\n");
}
}
--
2.30.1
^ permalink raw reply related [flat|nested] 5+ messages in thread* Re: [PATCH] libsepol/cil: handle SID without assigned context when writing policy.conf
2021-02-20 19:08 [PATCH] libsepol/cil: handle SID without assigned context when writing policy.conf Christian Göttsche
@ 2021-02-22 20:09 ` James Carter
2021-02-23 13:09 ` [PATCH v2] " Christian Göttsche
1 sibling, 0 replies; 5+ messages in thread
From: James Carter @ 2021-02-22 20:09 UTC (permalink / raw)
To: Christian Göttsche; +Cc: SElinux list
On Sat, Feb 20, 2021 at 2:13 PM Christian Göttsche
<cgzones@googlemail.com> wrote:
>
> CIL permits not assigning a context to a SID, e.g. to an unused initial
> SID, e.g. 'any_socket'.
>
> When using the example policy from the SELinux Notebook,
> https://github.com/SELinuxProject/selinux-notebook/blob/main/src/notebook-examples/cil-policy/cil-policy.cil,
> secilc logs:
>
> No context assigned to SID any_socket, omitting from policy at cil-policy.cil:166
>
> But secil2conf segfaults when writing the policy.conf:
>
> ../cil/src/cil_policy.c:274:2: runtime error: member access within null pointer of type 'struct cil_context'
>
> Only print the assigned context if actually available.
>
> Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
Acked-by: James Carter <jwcart2@gmail.com>
> ---
> libsepol/cil/src/cil_policy.c | 4 +++-
> 1 file changed, 3 insertions(+), 1 deletion(-)
>
> diff --git a/libsepol/cil/src/cil_policy.c b/libsepol/cil/src/cil_policy.c
> index 30d507f1..863636c7 100644
> --- a/libsepol/cil/src/cil_policy.c
> +++ b/libsepol/cil/src/cil_policy.c
> @@ -1661,7 +1661,9 @@ static void cil_sid_contexts_to_policy(FILE *out, struct cil_list *sids, int mls
> cil_list_for_each(i1, sids) {
> sid = i1->data;
> fprintf(out, "sid %s ", sid->datum.fqn);
> - cil_context_to_policy(out, sid->context, mls);
> + if (sid->context) {
> + cil_context_to_policy(out, sid->context, mls);
> + }
> fprintf(out,"\n");
> }
> }
> --
> 2.30.1
>
^ permalink raw reply [flat|nested] 5+ messages in thread* [PATCH v2] libsepol/cil: handle SID without assigned context when writing policy.conf
2021-02-20 19:08 [PATCH] libsepol/cil: handle SID without assigned context when writing policy.conf Christian Göttsche
2021-02-22 20:09 ` James Carter
@ 2021-02-23 13:09 ` Christian Göttsche
2021-02-23 15:33 ` James Carter
1 sibling, 1 reply; 5+ messages in thread
From: Christian Göttsche @ 2021-02-23 13:09 UTC (permalink / raw)
To: selinux; +Cc: Christian Göttsche
CIL permits not assigning a context to a SID, e.g. to an unused initial
SID, e.g. 'any_socket'.
When using the example policy from the SELinux Notebook,
https://github.com/SELinuxProject/selinux-notebook/blob/main/src/notebook-examples/cil-policy/cil-policy.cil,
secilc logs:
No context assigned to SID any_socket, omitting from policy at cil-policy.cil:166
But secil2conf segfaults when writing the policy.conf:
../cil/src/cil_policy.c:274:2: runtime error: member access within null pointer of type 'struct cil_context'
Only print the sid context statement if a context was actually assigned.
The sid declaration is still included via cil_sid_decls_to_policy().
Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
---
v2:
Drop the statement completely in cil_sid_contexts_to_policy(),
cause cil_sid_decls_to_policy() will have printed the context less
declaration already.
libsepol/cil/src/cil_policy.c | 8 +++++---
1 file changed, 5 insertions(+), 3 deletions(-)
diff --git a/libsepol/cil/src/cil_policy.c b/libsepol/cil/src/cil_policy.c
index 74edb345..91e767b7 100644
--- a/libsepol/cil/src/cil_policy.c
+++ b/libsepol/cil/src/cil_policy.c
@@ -1660,9 +1660,11 @@ static void cil_sid_contexts_to_policy(FILE *out, struct cil_list *sids, int mls
cil_list_for_each(i1, sids) {
sid = i1->data;
- fprintf(out, "sid %s ", sid->datum.fqn);
- cil_context_to_policy(out, sid->context, mls);
- fprintf(out,"\n");
+ if (sid->context) {
+ fprintf(out, "sid %s ", sid->datum.fqn);
+ cil_context_to_policy(out, sid->context, mls);
+ fprintf(out,"\n");
+ }
}
}
--
2.30.1
^ permalink raw reply related [flat|nested] 5+ messages in thread* Re: [PATCH v2] libsepol/cil: handle SID without assigned context when writing policy.conf
2021-02-23 13:09 ` [PATCH v2] " Christian Göttsche
@ 2021-02-23 15:33 ` James Carter
2021-02-24 10:59 ` Petr Lautrbach
0 siblings, 1 reply; 5+ messages in thread
From: James Carter @ 2021-02-23 15:33 UTC (permalink / raw)
To: Christian Göttsche; +Cc: SElinux list
On Tue, Feb 23, 2021 at 8:13 AM Christian Göttsche
<cgzones@googlemail.com> wrote:
>
> CIL permits not assigning a context to a SID, e.g. to an unused initial
> SID, e.g. 'any_socket'.
>
> When using the example policy from the SELinux Notebook,
> https://github.com/SELinuxProject/selinux-notebook/blob/main/src/notebook-examples/cil-policy/cil-policy.cil,
> secilc logs:
>
> No context assigned to SID any_socket, omitting from policy at cil-policy.cil:166
>
> But secil2conf segfaults when writing the policy.conf:
>
> ../cil/src/cil_policy.c:274:2: runtime error: member access within null pointer of type 'struct cil_context'
>
> Only print the sid context statement if a context was actually assigned.
> The sid declaration is still included via cil_sid_decls_to_policy().
>
> Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
Oops, I should have noticed that. I was too focused on the segfault.
Acked-by: James Carter <jwcart2@gmail.com>
> ---
> v2:
> Drop the statement completely in cil_sid_contexts_to_policy(),
> cause cil_sid_decls_to_policy() will have printed the context less
> declaration already.
>
> libsepol/cil/src/cil_policy.c | 8 +++++---
> 1 file changed, 5 insertions(+), 3 deletions(-)
>
> diff --git a/libsepol/cil/src/cil_policy.c b/libsepol/cil/src/cil_policy.c
> index 74edb345..91e767b7 100644
> --- a/libsepol/cil/src/cil_policy.c
> +++ b/libsepol/cil/src/cil_policy.c
> @@ -1660,9 +1660,11 @@ static void cil_sid_contexts_to_policy(FILE *out, struct cil_list *sids, int mls
>
> cil_list_for_each(i1, sids) {
> sid = i1->data;
> - fprintf(out, "sid %s ", sid->datum.fqn);
> - cil_context_to_policy(out, sid->context, mls);
> - fprintf(out,"\n");
> + if (sid->context) {
> + fprintf(out, "sid %s ", sid->datum.fqn);
> + cil_context_to_policy(out, sid->context, mls);
> + fprintf(out,"\n");
> + }
> }
> }
>
> --
> 2.30.1
>
^ permalink raw reply [flat|nested] 5+ messages in thread* Re: [PATCH v2] libsepol/cil: handle SID without assigned context when writing policy.conf
2021-02-23 15:33 ` James Carter
@ 2021-02-24 10:59 ` Petr Lautrbach
0 siblings, 0 replies; 5+ messages in thread
From: Petr Lautrbach @ 2021-02-24 10:59 UTC (permalink / raw)
To: SElinux list, James Carter, Christian Göttsche
James Carter <jwcart2@gmail.com> writes:
> On Tue, Feb 23, 2021 at 8:13 AM Christian Göttsche
> <cgzones@googlemail.com> wrote:
>>
>> CIL permits not assigning a context to a SID, e.g. to an unused initial
>> SID, e.g. 'any_socket'.
>>
>> When using the example policy from the SELinux Notebook,
>> https://github.com/SELinuxProject/selinux-notebook/blob/main/src/notebook-examples/cil-policy/cil-policy.cil,
>> secilc logs:
>>
>> No context assigned to SID any_socket, omitting from policy at cil-policy.cil:166
>>
>> But secil2conf segfaults when writing the policy.conf:
>>
>> ../cil/src/cil_policy.c:274:2: runtime error: member access within null pointer of type 'struct cil_context'
>>
>> Only print the sid context statement if a context was actually assigned.
>> The sid declaration is still included via cil_sid_decls_to_policy().
>>
>> Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
>
> Oops, I should have noticed that. I was too focused on the segfault.
>
> Acked-by: James Carter <jwcart2@gmail.com>
Merged, thanks!
>> ---
>> v2:
>> Drop the statement completely in cil_sid_contexts_to_policy(),
>> cause cil_sid_decls_to_policy() will have printed the context less
>> declaration already.
>>
>> libsepol/cil/src/cil_policy.c | 8 +++++---
>> 1 file changed, 5 insertions(+), 3 deletions(-)
>>
>> diff --git a/libsepol/cil/src/cil_policy.c b/libsepol/cil/src/cil_policy.c
>> index 74edb345..91e767b7 100644
>> --- a/libsepol/cil/src/cil_policy.c
>> +++ b/libsepol/cil/src/cil_policy.c
>> @@ -1660,9 +1660,11 @@ static void cil_sid_contexts_to_policy(FILE *out, struct cil_list *sids, int mls
>>
>> cil_list_for_each(i1, sids) {
>> sid = i1->data;
>> - fprintf(out, "sid %s ", sid->datum.fqn);
>> - cil_context_to_policy(out, sid->context, mls);
>> - fprintf(out,"\n");
>> + if (sid->context) {
>> + fprintf(out, "sid %s ", sid->datum.fqn);
>> + cil_context_to_policy(out, sid->context, mls);
>> + fprintf(out,"\n");
>> + }
>> }
>> }
>>
>> --
>> 2.30.1
>>
^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2021-02-24 11:01 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2021-02-20 19:08 [PATCH] libsepol/cil: handle SID without assigned context when writing policy.conf Christian Göttsche
2021-02-22 20:09 ` James Carter
2021-02-23 13:09 ` [PATCH v2] " Christian Göttsche
2021-02-23 15:33 ` James Carter
2021-02-24 10:59 ` Petr Lautrbach
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox