[RFC,0/9,v2] Add CIL Deny Rule

Message

James Carter March 9, 2023, 9:51 p.m. UTC

This is the last RFC patch. Once the notself patches are merged, I will work on
a new set of patches that includes support for notself and other.
 
This series of patches implements a deny rule in CIL. A deny rule will remove
the stated permissions in it from the policy. CIL does this by searching for
allow rules that match the deny rule and then writing new allow rules that
correspond to the matched allow rule with the permissions from the deny rule
removed. The rule uses the same syntax as an allow rule, but with "deny"
instead of "allow".

  (deny SRC TGT (CLASS (PERMS)))

Deny rules are processed during post processing (after the AST is resolved,
but before the binary policy is written). This means that neverallow checking
is done after deny rules are resolved. Deny rules are complimentary to
neverallow checking. When an allow rule is found that matches, a deny rule
removes permissions while a neverallow rule reports an error.

Patch 4 is biggest and most complex since it is the one doing the processing.

Changes for v2
- Renamed cil_tree_remove_node() as cil_tree_node_remove() to fit the naming
  convention in cil_tree.c
- Have cil_tree_node_remove() call cil_tree_node_destroy() to destroy the
  node after it has been removed as suggested by Daniel Burgener.
- Renamed cil_classperms_match() to cil_classperms_match_any()
- Renamed cil_classperms_list_match() cil_classperms_list_match_any()
- Added function cil_classperms_match_all()
- Added function cil_classperms_list_match_all()
- Updated cil_classperms_andnot() to use the cil_classperms_match_any() and
  cil_classperms_list_match_any() functions.
- Added function cil_classperms_and()
- Added function cil_classperms_map_and()
- Added function cil_classperms_set_and()
- Added function cil_classperms_list_and()
- Fixed problem in error handling in cil_create_and_insert_attribute_and_set()
  that was found by Daniel Burgener.
- Fixed problem in error handling in cil_create_attribute_d1_and_not_d2()
  that was found by Daniel Burgener.
- Change cil_create_and_add_avrule() to copy the classperms list, so the
  caller doesn't have to do it.
- Completely changed the logic of cil_remove_permissions_from_rule() to
  eliminate the problem of excessive overlap in the new rules that was
  found by Daniel Burgener.
- Changed and added deny rule tests.
- Fixed the formating problems in the CIL documenation of the deny rule
  that was found by Daniel Burgener.


James Carter (9):
  libsepol/cil: Parse and add deny rule to AST, but do not process
  libsepol/cil: Add cil_list_is_empty macro
  libsepol/cil: Add cil_tree_node_remove function
  libsepol/cil: Process deny rules
  libsepol/cil: Add cil_write_post_ast function
  libsepol: Export the cil_write_post_ast function
  secilc/secil2tree: Add option to write CIL AST after post processing
  secilc/test: Add deny rule tests
  secilc/docs: Add deny rule to CIL documentation

 libsepol/cil/include/cil/cil.h         |    1 +
 libsepol/cil/src/cil.c                 |   68 ++
 libsepol/cil/src/cil_build_ast.c       |   56 ++
 libsepol/cil/src/cil_build_ast.h       |    2 +
 libsepol/cil/src/cil_copy_ast.c        |   19 +
 libsepol/cil/src/cil_copy_ast.h        |    1 +
 libsepol/cil/src/cil_deny.c            | 1132 ++++++++++++++++++++++++
 libsepol/cil/src/cil_deny.h            |   36 +
 libsepol/cil/src/cil_flavor.h          |    1 +
 libsepol/cil/src/cil_internal.h        |   10 +
 libsepol/cil/src/cil_list.h            |    3 +
 libsepol/cil/src/cil_post.c            |    7 +
 libsepol/cil/src/cil_reset_ast.c       |    8 +
 libsepol/cil/src/cil_resolve_ast.c     |   44 +
 libsepol/cil/src/cil_resolve_ast.h     |    1 +
 libsepol/cil/src/cil_tree.c            |   28 +
 libsepol/cil/src/cil_tree.h            |    1 +
 libsepol/cil/src/cil_verify.c          |    9 +
 libsepol/cil/src/cil_write_ast.c       |   10 +
 libsepol/cil/src/cil_write_ast.h       |    1 +
 libsepol/src/libsepol.map.in           |    5 +
 secilc/docs/cil_access_vector_rules.md |   67 ++
 secilc/secil2tree.c                    |    8 +-
 secilc/test/deny_rule_test.cil         |  946 ++++++++++++++++++++
 24 files changed, 2463 insertions(+), 1 deletion(-)
 create mode 100644 libsepol/cil/src/cil_deny.c
 create mode 100644 libsepol/cil/src/cil_deny.h
 create mode 100644 secilc/test/deny_rule_test.cil