| Message ID | 20231103182637.85003-1-cgzones@googlemail.com (mailing list archive) |
|---|---|
| State | Accepted |
| Commit | 4670a63081c3 |
| Delegated to: | Petr Lautrbach |
| Headers | show |
| Series | [v2,1/3] libsepol: validate default type of transition is not an attribute | expand |
On Fri, Nov 3, 2023 at 2:27 PM Christian Göttsche <cgzones@googlemail.com> wrote: > > The default type of a type transition must be a regular type, not an > attribute. > > Signed-off-by: Christian Göttsche <cgzones@googlemail.com> Acked-by: James Carter <jwcart2@gmail.com> > --- > v2: > fix build error by supplying necessary arguments to > validate_simpletype() > --- > libsepol/src/policydb_validate.c | 16 ++++++++++------ > 1 file changed, 10 insertions(+), 6 deletions(-) > > diff --git a/libsepol/src/policydb_validate.c b/libsepol/src/policydb_validate.c > index 892a0ffd..810c3263 100644 > --- a/libsepol/src/policydb_validate.c > +++ b/libsepol/src/policydb_validate.c > @@ -468,7 +468,7 @@ static int validate_role_datum_wrapper(__attribute__((unused)) hashtab_key_t k, > return validate_role_datum(margs->handle, d, margs->flavors); > } > > -static int validate_simpletype(uint32_t value, const policydb_t *p, validate_t flavors[]) > +static int validate_simpletype(uint32_t value, const policydb_t *p, const validate_t flavors[SYM_NUM]) > { > const type_datum_t *type; > > @@ -1094,7 +1094,9 @@ static int validate_filename_trans(hashtab_key_t k, hashtab_datum_t d, void *arg > { > const filename_trans_key_t *ftk = (filename_trans_key_t *)k; > const filename_trans_datum_t *ftd = d; > - validate_t *flavors = (validate_t *)args; > + const map_arg_t *margs = args; > + const validate_t *flavors = margs->flavors; > + const policydb_t *p = margs->policy; > > if (validate_value(ftk->ttype, &flavors[SYM_TYPES])) > goto bad; > @@ -1105,7 +1107,7 @@ static int validate_filename_trans(hashtab_key_t k, hashtab_datum_t d, void *arg > for (; ftd; ftd = ftd->next) { > if (validate_ebitmap(&ftd->stypes, &flavors[SYM_TYPES])) > goto bad; > - if (validate_value(ftd->otype, &flavors[SYM_TYPES])) > + if (validate_simpletype(ftd->otype, p, flavors)) > goto bad; > } > > @@ -1115,9 +1117,11 @@ bad: > return -1; > } > > -static int validate_filename_trans_hashtab(sepol_handle_t *handle, hashtab_t filename_trans, validate_t flavors[]) > +static int validate_filename_trans_hashtab(sepol_handle_t *handle, const policydb_t *p, validate_t flavors[]) > { > - if (hashtab_map(filename_trans, validate_filename_trans, flavors)) { > + map_arg_t margs = { flavors, handle, p }; > + > + if (hashtab_map(p->filename_trans, validate_filename_trans, &margs)) { > ERR(handle, "Invalid filename trans"); > return -1; > } > @@ -1555,7 +1559,7 @@ int policydb_validate(sepol_handle_t *handle, const policydb_t *p) > if (validate_role_allows(handle, p->role_allow, flavors)) > goto bad; > if (p->policyvers >= POLICYDB_VERSION_FILENAME_TRANS) > - if (validate_filename_trans_hashtab(handle, p->filename_trans, flavors)) > + if (validate_filename_trans_hashtab(handle, p, flavors)) > goto bad; > } else { > if (validate_avrule_blocks(handle, p->global, p, flavors)) > -- > 2.42.0 >
On Mon, Nov 6, 2023 at 9:33 AM James Carter <jwcart2@gmail.com> wrote: > > On Fri, Nov 3, 2023 at 2:27 PM Christian Göttsche > <cgzones@googlemail.com> wrote: > > > > The default type of a type transition must be a regular type, not an > > attribute. > > > > Signed-off-by: Christian Göttsche <cgzones@googlemail.com> > > Acked-by: James Carter <jwcart2@gmail.com> > These three patches have been merged. Thanks, Jim > > --- > > v2: > > fix build error by supplying necessary arguments to > > validate_simpletype() > > --- > > libsepol/src/policydb_validate.c | 16 ++++++++++------ > > 1 file changed, 10 insertions(+), 6 deletions(-) > > > > diff --git a/libsepol/src/policydb_validate.c b/libsepol/src/policydb_validate.c > > index 892a0ffd..810c3263 100644 > > --- a/libsepol/src/policydb_validate.c > > +++ b/libsepol/src/policydb_validate.c > > @@ -468,7 +468,7 @@ static int validate_role_datum_wrapper(__attribute__((unused)) hashtab_key_t k, > > return validate_role_datum(margs->handle, d, margs->flavors); > > } > > > > -static int validate_simpletype(uint32_t value, const policydb_t *p, validate_t flavors[]) > > +static int validate_simpletype(uint32_t value, const policydb_t *p, const validate_t flavors[SYM_NUM]) > > { > > const type_datum_t *type; > > > > @@ -1094,7 +1094,9 @@ static int validate_filename_trans(hashtab_key_t k, hashtab_datum_t d, void *arg > > { > > const filename_trans_key_t *ftk = (filename_trans_key_t *)k; > > const filename_trans_datum_t *ftd = d; > > - validate_t *flavors = (validate_t *)args; > > + const map_arg_t *margs = args; > > + const validate_t *flavors = margs->flavors; > > + const policydb_t *p = margs->policy; > > > > if (validate_value(ftk->ttype, &flavors[SYM_TYPES])) > > goto bad; > > @@ -1105,7 +1107,7 @@ static int validate_filename_trans(hashtab_key_t k, hashtab_datum_t d, void *arg > > for (; ftd; ftd = ftd->next) { > > if (validate_ebitmap(&ftd->stypes, &flavors[SYM_TYPES])) > > goto bad; > > - if (validate_value(ftd->otype, &flavors[SYM_TYPES])) > > + if (validate_simpletype(ftd->otype, p, flavors)) > > goto bad; > > } > > > > @@ -1115,9 +1117,11 @@ bad: > > return -1; > > } > > > > -static int validate_filename_trans_hashtab(sepol_handle_t *handle, hashtab_t filename_trans, validate_t flavors[]) > > +static int validate_filename_trans_hashtab(sepol_handle_t *handle, const policydb_t *p, validate_t flavors[]) > > { > > - if (hashtab_map(filename_trans, validate_filename_trans, flavors)) { > > + map_arg_t margs = { flavors, handle, p }; > > + > > + if (hashtab_map(p->filename_trans, validate_filename_trans, &margs)) { > > ERR(handle, "Invalid filename trans"); > > return -1; > > } > > @@ -1555,7 +1559,7 @@ int policydb_validate(sepol_handle_t *handle, const policydb_t *p) > > if (validate_role_allows(handle, p->role_allow, flavors)) > > goto bad; > > if (p->policyvers >= POLICYDB_VERSION_FILENAME_TRANS) > > - if (validate_filename_trans_hashtab(handle, p->filename_trans, flavors)) > > + if (validate_filename_trans_hashtab(handle, p, flavors)) > > goto bad; > > } else { > > if (validate_avrule_blocks(handle, p->global, p, flavors)) > > -- > > 2.42.0 > >
diff --git a/libsepol/src/policydb_validate.c b/libsepol/src/policydb_validate.c index 892a0ffd..810c3263 100644 --- a/libsepol/src/policydb_validate.c +++ b/libsepol/src/policydb_validate.c @@ -468,7 +468,7 @@ static int validate_role_datum_wrapper(__attribute__((unused)) hashtab_key_t k, return validate_role_datum(margs->handle, d, margs->flavors); } -static int validate_simpletype(uint32_t value, const policydb_t *p, validate_t flavors[]) +static int validate_simpletype(uint32_t value, const policydb_t *p, const validate_t flavors[SYM_NUM]) { const type_datum_t *type; @@ -1094,7 +1094,9 @@ static int validate_filename_trans(hashtab_key_t k, hashtab_datum_t d, void *arg { const filename_trans_key_t *ftk = (filename_trans_key_t *)k; const filename_trans_datum_t *ftd = d; - validate_t *flavors = (validate_t *)args; + const map_arg_t *margs = args; + const validate_t *flavors = margs->flavors; + const policydb_t *p = margs->policy; if (validate_value(ftk->ttype, &flavors[SYM_TYPES])) goto bad; @@ -1105,7 +1107,7 @@ static int validate_filename_trans(hashtab_key_t k, hashtab_datum_t d, void *arg for (; ftd; ftd = ftd->next) { if (validate_ebitmap(&ftd->stypes, &flavors[SYM_TYPES])) goto bad; - if (validate_value(ftd->otype, &flavors[SYM_TYPES])) + if (validate_simpletype(ftd->otype, p, flavors)) goto bad; } @@ -1115,9 +1117,11 @@ bad: return -1; } -static int validate_filename_trans_hashtab(sepol_handle_t *handle, hashtab_t filename_trans, validate_t flavors[]) +static int validate_filename_trans_hashtab(sepol_handle_t *handle, const policydb_t *p, validate_t flavors[]) { - if (hashtab_map(filename_trans, validate_filename_trans, flavors)) { + map_arg_t margs = { flavors, handle, p }; + + if (hashtab_map(p->filename_trans, validate_filename_trans, &margs)) { ERR(handle, "Invalid filename trans"); return -1; } @@ -1555,7 +1559,7 @@ int policydb_validate(sepol_handle_t *handle, const policydb_t *p) if (validate_role_allows(handle, p->role_allow, flavors)) goto bad; if (p->policyvers >= POLICYDB_VERSION_FILENAME_TRANS) - if (validate_filename_trans_hashtab(handle, p->filename_trans, flavors)) + if (validate_filename_trans_hashtab(handle, p, flavors)) goto bad; } else { if (validate_avrule_blocks(handle, p->global, p, flavors))
The default type of a type transition must be a regular type, not an attribute. Signed-off-by: Christian Göttsche <cgzones@googlemail.com> --- v2: fix build error by supplying necessary arguments to validate_simpletype() --- libsepol/src/policydb_validate.c | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-)