| Message ID | 20221125154952.20910-4-cgzones@googlemail.com (mailing list archive) |
|---|---|
| State | Accepted |
| Commit | 6f7b0ee6c4ab |
| Delegated to: | Petr Lautrbach |
| Headers | show |
| Series | not-self neverallow support | expand |
On Fri, Nov 25, 2022 at 10:51 AM Christian Göttsche <cgzones@googlemail.com> wrote: > > Add support for using negated or complemented self in the target type of > neverallow rules. > > Some Refpolicy examples: > > neverallow * ~self:{ capability cap_userns capability2 cap2_userns } *; > neverallow domain { domain -self -dockerc_t }:dir create; > # no violations > > neverallow domain { domain -dockerc_t }:file ~{ append read_file_perms write }; > > libsepol.report_failure: neverallow on line 584 of policy/modules/kernel/kernel.te (or line 31357 of policy.conf) violated by allow sysadm_t httpd_bugzilla_script_t:file { create setattr relabelfrom relabelto unlink link rename }; > libsepol.report_failure: neverallow on line 584 of policy/modules/kernel/kernel.te (or line 31357 of policy.conf) violated by allow spc_t spc_t:file { create }; > libsepol.report_failure: neverallow on line 584 of policy/modules/kernel/kernel.te (or line 31357 of policy.conf) violated by allow container_t container_t:file { create }; > libsepol.report_failure: neverallow on line 584 of policy/modules/kernel/kernel.te (or line 31357 of policy.conf) violated by allow chromium_t chromium_t:file { create }; > libsepol.report_failure: neverallow on line 584 of policy/modules/kernel/kernel.te (or line 31357 of policy.conf) violated by allow spc_user_t spc_user_t:file { create }; > libsepol.report_failure: neverallow on line 582 of policy/modules/kernel/kernel.te (or line 31355 of policy.conf) violated by allow sysadm_t httpd_bugzilla_script_t:dir { create }; > > neverallow domain { domain -self -dockerc_t }:file ~{ append read_file_perms write }; > > libsepol.report_failure: neverallow on line 583 of policy/modules/kernel/kernel.te (or line 31356 of policy.conf) violated by allow sysadm_t httpd_bugzilla_script_t:file { create setattr relabelfrom relabelto unlink link rename }; > libsepol.report_failure: neverallow on line 582 of policy/modules/kernel/kernel.te (or line 31355 of policy.conf) violated by allow sysadm_t httpd_bugzilla_script_t:dir { create }; > > Using negated self in a complement, `~{ domain -self }`, is not > supported. > > Signed-off-by: Christian Göttsche <cgzones@googlemail.com> Acked-by: James Carter <jwcart2@gmail.com> > --- > checkpolicy/policy_define.c | 46 ++++++++++++++++++++++++++++++++----- > checkpolicy/test/dismod.c | 6 ++++- > 2 files changed, 45 insertions(+), 7 deletions(-) > > diff --git a/checkpolicy/policy_define.c b/checkpolicy/policy_define.c > index 41e44631..74f882bb 100644 > --- a/checkpolicy/policy_define.c > +++ b/checkpolicy/policy_define.c > @@ -2075,12 +2075,17 @@ static int define_te_avtab_xperms_helper(int which, avrule_t ** rule) > while ((id = queue_remove(id_queue))) { > if (strcmp(id, "self") == 0) { > free(id); > - if (add == 0) { > - yyerror("-self is not supported"); > + if (add == 0 && which != AVRULE_XPERMS_NEVERALLOW) { > + yyerror("-self is only supported in neverallow and neverallowxperm rules"); > + ret = -1; > + goto out; > + } > + avrule->flags |= (add ? RULE_SELF : RULE_NOTSELF); > + if ((avrule->flags & RULE_SELF) && (avrule->flags & RULE_NOTSELF)) { > + yyerror("self and -self are mutual exclusive"); > ret = -1; > goto out; > } > - avrule->flags |= RULE_SELF; > continue; > } > if (set_types > @@ -2091,6 +2096,18 @@ static int define_te_avtab_xperms_helper(int which, avrule_t ** rule) > } > } > > + if ((avrule->ttypes.flags & TYPE_COMP)) { > + if (avrule->flags & RULE_NOTSELF) { > + yyerror("-self is not supported in complements"); > + ret = -1; > + goto out; > + } > + if (avrule->flags & RULE_SELF) { > + avrule->flags &= ~RULE_SELF; > + avrule->flags |= RULE_NOTSELF; > + } > + } > + > ebitmap_init(&tclasses); > ret = read_classes(&tclasses); > if (ret) > @@ -2537,12 +2554,17 @@ static int define_te_avtab_helper(int which, avrule_t ** rule) > while ((id = queue_remove(id_queue))) { > if (strcmp(id, "self") == 0) { > free(id); > - if (add == 0) { > - yyerror("-self is not supported"); > + if (add == 0 && which != AVRULE_NEVERALLOW) { > + yyerror("-self is only supported in neverallow and neverallowxperm rules"); > + ret = -1; > + goto out; > + } > + avrule->flags |= (add ? RULE_SELF : RULE_NOTSELF); > + if ((avrule->flags & RULE_SELF) && (avrule->flags & RULE_NOTSELF)) { > + yyerror("self and -self are mutual exclusive"); > ret = -1; > goto out; > } > - avrule->flags |= RULE_SELF; > continue; > } > if (set_types > @@ -2553,6 +2575,18 @@ static int define_te_avtab_helper(int which, avrule_t ** rule) > } > } > > + if ((avrule->ttypes.flags & TYPE_COMP)) { > + if (avrule->flags & RULE_NOTSELF) { > + yyerror("-self is not supported in complements"); > + ret = -1; > + goto out; > + } > + if (avrule->flags & RULE_SELF) { > + avrule->flags &= ~RULE_SELF; > + avrule->flags |= RULE_NOTSELF; > + } > + } > + > ebitmap_init(&tclasses); > ret = read_classes(&tclasses); > if (ret) > diff --git a/checkpolicy/test/dismod.c b/checkpolicy/test/dismod.c > index ec2a3e9a..a2d74d42 100644 > --- a/checkpolicy/test/dismod.c > +++ b/checkpolicy/test/dismod.c > @@ -124,7 +124,7 @@ static int display_type_set(type_set_t * set, uint32_t flags, policydb_t * polic > } > > num_types = 0; > - if (flags & RULE_SELF) { > + if (flags & (RULE_SELF | RULE_NOTSELF)) { > num_types++; > } > > @@ -169,6 +169,10 @@ static int display_type_set(type_set_t * set, uint32_t flags, policydb_t * polic > fprintf(fp, " self"); > } > > + if (flags & RULE_NOTSELF) { > + fprintf(fp, " -self"); > + } > + > if (num_types > 1) > fprintf(fp, " }"); > > -- > 2.38.1 >
On Wed, Mar 1, 2023 at 9:32 AM James Carter <jwcart2@gmail.com> wrote: > > On Fri, Nov 25, 2022 at 10:51 AM Christian Göttsche > <cgzones@googlemail.com> wrote: > > > > Add support for using negated or complemented self in the target type of > > neverallow rules. > > > > Some Refpolicy examples: > > > > neverallow * ~self:{ capability cap_userns capability2 cap2_userns } *; > > neverallow domain { domain -self -dockerc_t }:dir create; > > # no violations > > > > neverallow domain { domain -dockerc_t }:file ~{ append read_file_perms write }; > > > > libsepol.report_failure: neverallow on line 584 of policy/modules/kernel/kernel.te (or line 31357 of policy.conf) violated by allow sysadm_t httpd_bugzilla_script_t:file { create setattr relabelfrom relabelto unlink link rename }; > > libsepol.report_failure: neverallow on line 584 of policy/modules/kernel/kernel.te (or line 31357 of policy.conf) violated by allow spc_t spc_t:file { create }; > > libsepol.report_failure: neverallow on line 584 of policy/modules/kernel/kernel.te (or line 31357 of policy.conf) violated by allow container_t container_t:file { create }; > > libsepol.report_failure: neverallow on line 584 of policy/modules/kernel/kernel.te (or line 31357 of policy.conf) violated by allow chromium_t chromium_t:file { create }; > > libsepol.report_failure: neverallow on line 584 of policy/modules/kernel/kernel.te (or line 31357 of policy.conf) violated by allow spc_user_t spc_user_t:file { create }; > > libsepol.report_failure: neverallow on line 582 of policy/modules/kernel/kernel.te (or line 31355 of policy.conf) violated by allow sysadm_t httpd_bugzilla_script_t:dir { create }; > > > > neverallow domain { domain -self -dockerc_t }:file ~{ append read_file_perms write }; > > > > libsepol.report_failure: neverallow on line 583 of policy/modules/kernel/kernel.te (or line 31356 of policy.conf) violated by allow sysadm_t httpd_bugzilla_script_t:file { create setattr relabelfrom relabelto unlink link rename }; > > libsepol.report_failure: neverallow on line 582 of policy/modules/kernel/kernel.te (or line 31355 of policy.conf) violated by allow sysadm_t httpd_bugzilla_script_t:dir { create }; > > > > Using negated self in a complement, `~{ domain -self }`, is not > > supported. > > > > Signed-off-by: Christian Göttsche <cgzones@googlemail.com> > > Acked-by: James Carter <jwcart2@gmail.com> > Merged. Thanks, Jim > > --- > > checkpolicy/policy_define.c | 46 ++++++++++++++++++++++++++++++++----- > > checkpolicy/test/dismod.c | 6 ++++- > > 2 files changed, 45 insertions(+), 7 deletions(-) > > > > diff --git a/checkpolicy/policy_define.c b/checkpolicy/policy_define.c > > index 41e44631..74f882bb 100644 > > --- a/checkpolicy/policy_define.c > > +++ b/checkpolicy/policy_define.c > > @@ -2075,12 +2075,17 @@ static int define_te_avtab_xperms_helper(int which, avrule_t ** rule) > > while ((id = queue_remove(id_queue))) { > > if (strcmp(id, "self") == 0) { > > free(id); > > - if (add == 0) { > > - yyerror("-self is not supported"); > > + if (add == 0 && which != AVRULE_XPERMS_NEVERALLOW) { > > + yyerror("-self is only supported in neverallow and neverallowxperm rules"); > > + ret = -1; > > + goto out; > > + } > > + avrule->flags |= (add ? RULE_SELF : RULE_NOTSELF); > > + if ((avrule->flags & RULE_SELF) && (avrule->flags & RULE_NOTSELF)) { > > + yyerror("self and -self are mutual exclusive"); > > ret = -1; > > goto out; > > } > > - avrule->flags |= RULE_SELF; > > continue; > > } > > if (set_types > > @@ -2091,6 +2096,18 @@ static int define_te_avtab_xperms_helper(int which, avrule_t ** rule) > > } > > } > > > > + if ((avrule->ttypes.flags & TYPE_COMP)) { > > + if (avrule->flags & RULE_NOTSELF) { > > + yyerror("-self is not supported in complements"); > > + ret = -1; > > + goto out; > > + } > > + if (avrule->flags & RULE_SELF) { > > + avrule->flags &= ~RULE_SELF; > > + avrule->flags |= RULE_NOTSELF; > > + } > > + } > > + > > ebitmap_init(&tclasses); > > ret = read_classes(&tclasses); > > if (ret) > > @@ -2537,12 +2554,17 @@ static int define_te_avtab_helper(int which, avrule_t ** rule) > > while ((id = queue_remove(id_queue))) { > > if (strcmp(id, "self") == 0) { > > free(id); > > - if (add == 0) { > > - yyerror("-self is not supported"); > > + if (add == 0 && which != AVRULE_NEVERALLOW) { > > + yyerror("-self is only supported in neverallow and neverallowxperm rules"); > > + ret = -1; > > + goto out; > > + } > > + avrule->flags |= (add ? RULE_SELF : RULE_NOTSELF); > > + if ((avrule->flags & RULE_SELF) && (avrule->flags & RULE_NOTSELF)) { > > + yyerror("self and -self are mutual exclusive"); > > ret = -1; > > goto out; > > } > > - avrule->flags |= RULE_SELF; > > continue; > > } > > if (set_types > > @@ -2553,6 +2575,18 @@ static int define_te_avtab_helper(int which, avrule_t ** rule) > > } > > } > > > > + if ((avrule->ttypes.flags & TYPE_COMP)) { > > + if (avrule->flags & RULE_NOTSELF) { > > + yyerror("-self is not supported in complements"); > > + ret = -1; > > + goto out; > > + } > > + if (avrule->flags & RULE_SELF) { > > + avrule->flags &= ~RULE_SELF; > > + avrule->flags |= RULE_NOTSELF; > > + } > > + } > > + > > ebitmap_init(&tclasses); > > ret = read_classes(&tclasses); > > if (ret) > > diff --git a/checkpolicy/test/dismod.c b/checkpolicy/test/dismod.c > > index ec2a3e9a..a2d74d42 100644 > > --- a/checkpolicy/test/dismod.c > > +++ b/checkpolicy/test/dismod.c > > @@ -124,7 +124,7 @@ static int display_type_set(type_set_t * set, uint32_t flags, policydb_t * polic > > } > > > > num_types = 0; > > - if (flags & RULE_SELF) { > > + if (flags & (RULE_SELF | RULE_NOTSELF)) { > > num_types++; > > } > > > > @@ -169,6 +169,10 @@ static int display_type_set(type_set_t * set, uint32_t flags, policydb_t * polic > > fprintf(fp, " self"); > > } > > > > + if (flags & RULE_NOTSELF) { > > + fprintf(fp, " -self"); > > + } > > + > > if (num_types > 1) > > fprintf(fp, " }"); > > > > -- > > 2.38.1 > >
diff --git a/checkpolicy/policy_define.c b/checkpolicy/policy_define.c index 41e44631..74f882bb 100644 --- a/checkpolicy/policy_define.c +++ b/checkpolicy/policy_define.c @@ -2075,12 +2075,17 @@ static int define_te_avtab_xperms_helper(int which, avrule_t ** rule) while ((id = queue_remove(id_queue))) { if (strcmp(id, "self") == 0) { free(id); - if (add == 0) { - yyerror("-self is not supported"); + if (add == 0 && which != AVRULE_XPERMS_NEVERALLOW) { + yyerror("-self is only supported in neverallow and neverallowxperm rules"); + ret = -1; + goto out; + } + avrule->flags |= (add ? RULE_SELF : RULE_NOTSELF); + if ((avrule->flags & RULE_SELF) && (avrule->flags & RULE_NOTSELF)) { + yyerror("self and -self are mutual exclusive"); ret = -1; goto out; } - avrule->flags |= RULE_SELF; continue; } if (set_types @@ -2091,6 +2096,18 @@ static int define_te_avtab_xperms_helper(int which, avrule_t ** rule) } } + if ((avrule->ttypes.flags & TYPE_COMP)) { + if (avrule->flags & RULE_NOTSELF) { + yyerror("-self is not supported in complements"); + ret = -1; + goto out; + } + if (avrule->flags & RULE_SELF) { + avrule->flags &= ~RULE_SELF; + avrule->flags |= RULE_NOTSELF; + } + } + ebitmap_init(&tclasses); ret = read_classes(&tclasses); if (ret) @@ -2537,12 +2554,17 @@ static int define_te_avtab_helper(int which, avrule_t ** rule) while ((id = queue_remove(id_queue))) { if (strcmp(id, "self") == 0) { free(id); - if (add == 0) { - yyerror("-self is not supported"); + if (add == 0 && which != AVRULE_NEVERALLOW) { + yyerror("-self is only supported in neverallow and neverallowxperm rules"); + ret = -1; + goto out; + } + avrule->flags |= (add ? RULE_SELF : RULE_NOTSELF); + if ((avrule->flags & RULE_SELF) && (avrule->flags & RULE_NOTSELF)) { + yyerror("self and -self are mutual exclusive"); ret = -1; goto out; } - avrule->flags |= RULE_SELF; continue; } if (set_types @@ -2553,6 +2575,18 @@ static int define_te_avtab_helper(int which, avrule_t ** rule) } } + if ((avrule->ttypes.flags & TYPE_COMP)) { + if (avrule->flags & RULE_NOTSELF) { + yyerror("-self is not supported in complements"); + ret = -1; + goto out; + } + if (avrule->flags & RULE_SELF) { + avrule->flags &= ~RULE_SELF; + avrule->flags |= RULE_NOTSELF; + } + } + ebitmap_init(&tclasses); ret = read_classes(&tclasses); if (ret) diff --git a/checkpolicy/test/dismod.c b/checkpolicy/test/dismod.c index ec2a3e9a..a2d74d42 100644 --- a/checkpolicy/test/dismod.c +++ b/checkpolicy/test/dismod.c @@ -124,7 +124,7 @@ static int display_type_set(type_set_t * set, uint32_t flags, policydb_t * polic } num_types = 0; - if (flags & RULE_SELF) { + if (flags & (RULE_SELF | RULE_NOTSELF)) { num_types++; } @@ -169,6 +169,10 @@ static int display_type_set(type_set_t * set, uint32_t flags, policydb_t * polic fprintf(fp, " self"); } + if (flags & RULE_NOTSELF) { + fprintf(fp, " -self"); + } + if (num_types > 1) fprintf(fp, " }");
Add support for using negated or complemented self in the target type of neverallow rules. Some Refpolicy examples: neverallow * ~self:{ capability cap_userns capability2 cap2_userns } *; neverallow domain { domain -self -dockerc_t }:dir create; # no violations neverallow domain { domain -dockerc_t }:file ~{ append read_file_perms write }; libsepol.report_failure: neverallow on line 584 of policy/modules/kernel/kernel.te (or line 31357 of policy.conf) violated by allow sysadm_t httpd_bugzilla_script_t:file { create setattr relabelfrom relabelto unlink link rename }; libsepol.report_failure: neverallow on line 584 of policy/modules/kernel/kernel.te (or line 31357 of policy.conf) violated by allow spc_t spc_t:file { create }; libsepol.report_failure: neverallow on line 584 of policy/modules/kernel/kernel.te (or line 31357 of policy.conf) violated by allow container_t container_t:file { create }; libsepol.report_failure: neverallow on line 584 of policy/modules/kernel/kernel.te (or line 31357 of policy.conf) violated by allow chromium_t chromium_t:file { create }; libsepol.report_failure: neverallow on line 584 of policy/modules/kernel/kernel.te (or line 31357 of policy.conf) violated by allow spc_user_t spc_user_t:file { create }; libsepol.report_failure: neverallow on line 582 of policy/modules/kernel/kernel.te (or line 31355 of policy.conf) violated by allow sysadm_t httpd_bugzilla_script_t:dir { create }; neverallow domain { domain -self -dockerc_t }:file ~{ append read_file_perms write }; libsepol.report_failure: neverallow on line 583 of policy/modules/kernel/kernel.te (or line 31356 of policy.conf) violated by allow sysadm_t httpd_bugzilla_script_t:file { create setattr relabelfrom relabelto unlink link rename }; libsepol.report_failure: neverallow on line 582 of policy/modules/kernel/kernel.te (or line 31355 of policy.conf) violated by allow sysadm_t httpd_bugzilla_script_t:dir { create }; Using negated self in a complement, `~{ domain -self }`, is not supported. Signed-off-by: Christian Göttsche <cgzones@googlemail.com> --- checkpolicy/policy_define.c | 46 ++++++++++++++++++++++++++++++++----- checkpolicy/test/dismod.c | 6 ++++- 2 files changed, 45 insertions(+), 7 deletions(-)