From patchwork Fri Jan 17 08:58:32 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ondrej Mosnacek X-Patchwork-Id: 11338573 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 7399D138D for ; Fri, 17 Jan 2020 08:58:44 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 52A242082F for ; Fri, 17 Jan 2020 08:58:44 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="h1ljZPkH" Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1728512AbgAQI6o (ORCPT ); Fri, 17 Jan 2020 03:58:44 -0500 Received: from us-smtp-1.mimecast.com ([205.139.110.61]:20218 "EHLO us-smtp-delivery-1.mimecast.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1727531AbgAQI6n (ORCPT ); Fri, 17 Jan 2020 03:58:43 -0500 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1579251522; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=9lIemL6brFPUCAYSBZWFrUpZJZjzccOl0mn5RZzFkss=; b=h1ljZPkHlke3SKs59nidJcJqpzcjfFDPW3JOeCNlchXCmBBu42uV1g63w1jP2/Xi7PXW0F sf1x/noFkquouLeW1SeyXM4YFDjfCz6zpPPdtynJhRv80BoBVs+IXdiKx48dREynQcYey9 PekOOUZmIyUGZkbevgwuB8Q6x0luNtE= Received: from mail-wr1-f70.google.com (mail-wr1-f70.google.com [209.85.221.70]) (Using TLS) by relay.mimecast.com with ESMTP id us-mta-418-3xDkwnjiNo-JJug9I3lUXA-1; Fri, 17 Jan 2020 03:58:41 -0500 X-MC-Unique: 3xDkwnjiNo-JJug9I3lUXA-1 Received: by mail-wr1-f70.google.com with SMTP id h30so10262131wrh.5 for ; Fri, 17 Jan 2020 00:58:41 -0800 (PST) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=9lIemL6brFPUCAYSBZWFrUpZJZjzccOl0mn5RZzFkss=; b=E70xRM+Yu4+u19bNF78qJ7xHdX20JJYZkJNqtgRbYT9+aaoL3MEt0WDwxHLZED8t1D YzEu2BN3jCM/OpbdNGUOLrQ/2UhSWpQ7B/ucJPiGR+sR4poP/D5nsLNQ78elvoNWO4qh JjNl1Nn1JlJtuPSogcyj0ydJtvqC2aebVbFQXol3p/yUx4Tp9Jehmt8iBUGTN0IZvnmt nxYXvYjMXogBwV6nh23vYmHRO2XUiCdr36EKrxVzeLnGD+xz2KQk6QaM/0uiYiJW+mzP j+W0tyX3D+n6ix3ZO+QyBvRtjG/QdUkdPLb4+4jN/yvq3hga5z5uEUVQVjxsG22MRzBK G2zw== X-Gm-Message-State: APjAAAVSpqyivsbC2VU0I09QCbR/0mKEhiOzgpnSJo8M1j1n0GkS4QMb ZxGYJbXO8VnfjSGwdCHT3j0T0vB64sRYOFZ4qr2D3xfHa5m0RPHuvIj+t8Q3DQUEgWynEEHPnmK Rjl3mXWcn8wbVn7L3QQ== X-Received: by 2002:a05:600c:2117:: with SMTP id u23mr3589246wml.106.1579251520004; Fri, 17 Jan 2020 00:58:40 -0800 (PST) X-Google-Smtp-Source: APXvYqzboKo2vEDKRPDvsJaByWcGMwdbDjM3HBAQn2a1IHqAZvsp2swrCNAsvUSALW5U9H1i7s+B6A== X-Received: by 2002:a05:600c:2117:: with SMTP id u23mr3589231wml.106.1579251519816; Fri, 17 Jan 2020 00:58:39 -0800 (PST) Received: from omos.redhat.com (nat-pool-brq-t.redhat.com. [213.175.37.10]) by smtp.gmail.com with ESMTPSA id x18sm33391312wrr.75.2020.01.17.00.58.39 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 17 Jan 2020 00:58:39 -0800 (PST) From: Ondrej Mosnacek To: selinux@vger.kernel.org, Paul Moore Cc: Stephen Smalley Subject: [PATCH v2 1/5] selinux: simplify evaluate_cond_node() Date: Fri, 17 Jan 2020 09:58:32 +0100 Message-Id: <20200117085836.445797-2-omosnace@redhat.com> X-Mailer: git-send-email 2.24.1 In-Reply-To: <20200117085836.445797-1-omosnace@redhat.com> References: <20200117085836.445797-1-omosnace@redhat.com> MIME-Version: 1.0 Sender: selinux-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: selinux@vger.kernel.org It never fails, so it can just return void. Signed-off-by: Ondrej Mosnacek Reviewed-by: Stephen Smalley --- security/selinux/ss/conditional.c | 3 +-- security/selinux/ss/conditional.h | 2 +- security/selinux/ss/services.c | 14 ++++---------- 3 files changed, 6 insertions(+), 13 deletions(-) diff --git a/security/selinux/ss/conditional.c b/security/selinux/ss/conditional.c index 70c378ee1a2f..04593062008d 100644 --- a/security/selinux/ss/conditional.c +++ b/security/selinux/ss/conditional.c @@ -85,7 +85,7 @@ static int cond_evaluate_expr(struct policydb *p, struct cond_expr *expr) * list appropriately. If the result of the expression is undefined * all of the rules are disabled for safety. */ -int evaluate_cond_node(struct policydb *p, struct cond_node *node) +void evaluate_cond_node(struct policydb *p, struct cond_node *node) { int new_state; struct cond_av_list *cur; @@ -111,7 +111,6 @@ int evaluate_cond_node(struct policydb *p, struct cond_node *node) cur->node->key.specified |= AVTAB_ENABLED; } } - return 0; } int cond_policydb_init(struct policydb *p) diff --git a/security/selinux/ss/conditional.h b/security/selinux/ss/conditional.h index ec846e45904c..d86ef286ca84 100644 --- a/security/selinux/ss/conditional.h +++ b/security/selinux/ss/conditional.h @@ -75,6 +75,6 @@ void cond_compute_av(struct avtab *ctab, struct avtab_key *key, struct av_decision *avd, struct extended_perms *xperms); void cond_compute_xperms(struct avtab *ctab, struct avtab_key *key, struct extended_perms_decision *xpermd); -int evaluate_cond_node(struct policydb *p, struct cond_node *node); +void evaluate_cond_node(struct policydb *p, struct cond_node *node); #endif /* _CONDITIONAL_H_ */ diff --git a/security/selinux/ss/services.c b/security/selinux/ss/services.c index 216ce602a2b5..ff43a35bb874 100644 --- a/security/selinux/ss/services.c +++ b/security/selinux/ss/services.c @@ -2958,11 +2958,8 @@ int security_set_bools(struct selinux_state *state, int len, int *values) policydb->bool_val_to_struct[i]->state = 0; } - for (cur = policydb->cond_list; cur; cur = cur->next) { - rc = evaluate_cond_node(policydb, cur); - if (rc) - goto out; - } + for (cur = policydb->cond_list; cur; cur = cur->next) + evaluate_cond_node(policydb, cur); seqno = ++state->ss->latest_granting; rc = 0; @@ -3015,11 +3012,8 @@ static int security_preserve_bools(struct selinux_state *state, if (booldatum) booldatum->state = bvalues[i]; } - for (cur = policydb->cond_list; cur; cur = cur->next) { - rc = evaluate_cond_node(policydb, cur); - if (rc) - goto out; - } + for (cur = policydb->cond_list; cur; cur = cur->next) + evaluate_cond_node(policydb, cur); out: if (bnames) { From patchwork Fri Jan 17 08:58:33 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ondrej Mosnacek X-Patchwork-Id: 11338575 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 5AF88138D for ; Fri, 17 Jan 2020 08:58:46 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 26306214AF for ; Fri, 17 Jan 2020 08:58:46 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="f7c15FOY" Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1729108AbgAQI6p (ORCPT ); Fri, 17 Jan 2020 03:58:45 -0500 Received: from us-smtp-delivery-1.mimecast.com ([205.139.110.120]:60435 "EHLO us-smtp-1.mimecast.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1727531AbgAQI6p (ORCPT ); Fri, 17 Jan 2020 03:58:45 -0500 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1579251524; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=s5R2hwkPTRu7nSKz6MV/Xxfsv8HJ6kYjkaluZXGX/fY=; b=f7c15FOYCcHXO/7UHF5uQJPelrXu/FD7grjDywO1Sk4pXKCCwD6QQIXyLA/sDrH5uOb7Wq nwjc9SPQsFtUDoaMxIRJu3mqQwksjlNY0N3YaJIAEkO85t8QRZyWl15ng21HhOAd/xVqFH jil2/S8ldYft10HXkzF6jdrmPNk8kmU= Received: from mail-wm1-f72.google.com (mail-wm1-f72.google.com [209.85.128.72]) (Using TLS) by relay.mimecast.com with ESMTP id us-mta-186-Wxvt4d0jPdyD6ZCz1WGpbA-1; Fri, 17 Jan 2020 03:58:42 -0500 X-MC-Unique: Wxvt4d0jPdyD6ZCz1WGpbA-1 Received: by mail-wm1-f72.google.com with SMTP id t4so2013495wmf.2 for ; Fri, 17 Jan 2020 00:58:42 -0800 (PST) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=s5R2hwkPTRu7nSKz6MV/Xxfsv8HJ6kYjkaluZXGX/fY=; b=LbFvx90Y/w2WzB5rjWzsjx4wnukhr5IpMPQjKToClPfk5lXEyxoMR+8t7TuNjDJkqK R4jhRb46ejhFvstr0JjyarWKJ9eR1/z6fWqx8BLegfUK/Nu/WOK3zPgmSLFWHDutu5KS 837AeLeHAAJAK9VRnYBT9PABXvoAAxNf3hyMkhBONx38aJOC6sBFJPUym/lWXjQanjsU yH48+PnP9/7Mo+KvHaHuwVdKPtItwuiR4L3rMyQoy6A26YUnu+KbL87k+DUCUJ+eOcWi LoKd7sjyLEHGlP/0Gz58JaVbN6PzgK0+khzjnn7FxAY/5eViMA67+fhZCf/Lo4JivY9K tHzQ== X-Gm-Message-State: APjAAAVo3HGQ8YQ18a25Fnt0Gel4RqyA74Wh4A5a6MvGfYI9wK/W0V9a g0YBQpl4c7h9h+mhbFJfH7ucGVl9+HePl4ss5I+2vsjXp1TRMg+1F+Jsmv+G0zCQosqAzsvWA7t LMV5AqxigQYgxAmlhgQ== X-Received: by 2002:adf:c446:: with SMTP id a6mr1896729wrg.218.1579251521397; Fri, 17 Jan 2020 00:58:41 -0800 (PST) X-Google-Smtp-Source: APXvYqxjb3rwutMcfXNPRRQSP+4uOoOP8d50wAHdno1u3BSWYeQf3u58/DkzRXnj7t9KoM22t+oIXg== X-Received: by 2002:adf:c446:: with SMTP id a6mr1896703wrg.218.1579251520976; Fri, 17 Jan 2020 00:58:40 -0800 (PST) Received: from omos.redhat.com (nat-pool-brq-t.redhat.com. [213.175.37.10]) by smtp.gmail.com with ESMTPSA id x18sm33391312wrr.75.2020.01.17.00.58.39 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 17 Jan 2020 00:58:40 -0800 (PST) From: Ondrej Mosnacek To: selinux@vger.kernel.org, Paul Moore Cc: Stephen Smalley Subject: [PATCH v2 2/5] selinux: convert cond_list to array Date: Fri, 17 Jan 2020 09:58:33 +0100 Message-Id: <20200117085836.445797-3-omosnace@redhat.com> X-Mailer: git-send-email 2.24.1 In-Reply-To: <20200117085836.445797-1-omosnace@redhat.com> References: <20200117085836.445797-1-omosnace@redhat.com> MIME-Version: 1.0 Sender: selinux-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: selinux@vger.kernel.org Since it is fixed-size after allocation and we know the size beforehand, using a plain old array is simpler and more efficient. While there, also fix signedness of some related variables/parameters. Signed-off-by: Ondrej Mosnacek Reviewed-by: Stephen Smalley --- security/selinux/include/conditional.h | 6 +-- security/selinux/selinuxfs.c | 4 +- security/selinux/ss/conditional.c | 54 ++++++++++---------------- security/selinux/ss/conditional.h | 3 +- security/selinux/ss/policydb.c | 2 +- security/selinux/ss/policydb.h | 3 +- security/selinux/ss/services.c | 28 ++++++------- 7 files changed, 43 insertions(+), 57 deletions(-) diff --git a/security/selinux/include/conditional.h b/security/selinux/include/conditional.h index 0ab316f61da0..ffb9a33341f8 100644 --- a/security/selinux/include/conditional.h +++ b/security/selinux/include/conditional.h @@ -14,12 +14,12 @@ #include "security.h" int security_get_bools(struct selinux_state *state, - int *len, char ***names, int **values); + u32 *len, char ***names, int **values); int security_set_bools(struct selinux_state *state, - int len, int *values); + u32 len, int *values); int security_get_bool_value(struct selinux_state *state, - int index); + u32 index); #endif diff --git a/security/selinux/selinuxfs.c b/security/selinux/selinuxfs.c index 79c710911a3c..296ce86e8b1f 100644 --- a/security/selinux/selinuxfs.c +++ b/security/selinux/selinuxfs.c @@ -1327,14 +1327,14 @@ static void sel_remove_entries(struct dentry *de) static int sel_make_bools(struct selinux_fs_info *fsi) { - int i, ret; + int ret; ssize_t len; struct dentry *dentry = NULL; struct dentry *dir = fsi->bool_dir; struct inode *inode = NULL; struct inode_security_struct *isec; char **names = NULL, *page; - int num; + u32 i, num; int *values = NULL; u32 sid; diff --git a/security/selinux/ss/conditional.c b/security/selinux/ss/conditional.c index 04593062008d..c8a02c9b23ee 100644 --- a/security/selinux/ss/conditional.c +++ b/security/selinux/ss/conditional.c @@ -119,6 +119,7 @@ int cond_policydb_init(struct policydb *p) p->bool_val_to_struct = NULL; p->cond_list = NULL; + p->cond_list_len = 0; rc = avtab_init(&p->te_cond_avtab); if (rc) @@ -147,27 +148,22 @@ static void cond_node_destroy(struct cond_node *node) } cond_av_list_destroy(node->true_list); cond_av_list_destroy(node->false_list); - kfree(node); } -static void cond_list_destroy(struct cond_node *list) +static void cond_list_destroy(struct policydb *p) { - struct cond_node *next, *cur; + u32 i; - if (list == NULL) - return; - - for (cur = list; cur; cur = next) { - next = cur->next; - cond_node_destroy(cur); - } + for (i = 0; i < p->cond_list_len; i++) + cond_node_destroy(&p->cond_list[i]); + kfree(p->cond_list); } void cond_policydb_destroy(struct policydb *p) { kfree(p->bool_val_to_struct); avtab_destroy(&p->te_cond_avtab); - cond_list_destroy(p->cond_list); + cond_list_destroy(p); } int cond_init_bool_indexes(struct policydb *p) @@ -447,7 +443,6 @@ err: int cond_read_list(struct policydb *p, void *fp) { - struct cond_node *node, *last = NULL; __le32 buf[1]; u32 i, len; int rc; @@ -458,29 +453,24 @@ int cond_read_list(struct policydb *p, void *fp) len = le32_to_cpu(buf[0]); + p->cond_list = kcalloc(len, sizeof(*p->cond_list), GFP_KERNEL); + if (!p->cond_list) + return rc; + rc = avtab_alloc(&(p->te_cond_avtab), p->te_avtab.nel); if (rc) goto err; for (i = 0; i < len; i++) { - rc = -ENOMEM; - node = kzalloc(sizeof(*node), GFP_KERNEL); - if (!node) - goto err; - - rc = cond_read_node(p, node, fp); + rc = cond_read_node(p, &p->cond_list[i], fp); if (rc) goto err; - - if (i == 0) - p->cond_list = node; - else - last->next = node; - last = node; } + + p->cond_list_len = len; return 0; err: - cond_list_destroy(p->cond_list); + cond_list_destroy(p); p->cond_list = NULL; return rc; } @@ -585,23 +575,19 @@ static int cond_write_node(struct policydb *p, struct cond_node *node, return 0; } -int cond_write_list(struct policydb *p, struct cond_node *list, void *fp) +int cond_write_list(struct policydb *p, void *fp) { - struct cond_node *cur; - u32 len; + u32 i; __le32 buf[1]; int rc; - len = 0; - for (cur = list; cur != NULL; cur = cur->next) - len++; - buf[0] = cpu_to_le32(len); + buf[0] = cpu_to_le32(p->cond_list_len); rc = put_entry(buf, sizeof(u32), 1, fp); if (rc) return rc; - for (cur = list; cur != NULL; cur = cur->next) { - rc = cond_write_node(p, cur, fp); + for (i = 0; i < p->cond_list_len; i++) { + rc = cond_write_node(p, &p->cond_list[i], fp); if (rc) return rc; } diff --git a/security/selinux/ss/conditional.h b/security/selinux/ss/conditional.h index d86ef286ca84..e474bdd3a0ed 100644 --- a/security/selinux/ss/conditional.h +++ b/security/selinux/ss/conditional.h @@ -55,7 +55,6 @@ struct cond_node { struct cond_expr *expr; struct cond_av_list *true_list; struct cond_av_list *false_list; - struct cond_node *next; }; int cond_policydb_init(struct policydb *p); @@ -69,7 +68,7 @@ int cond_index_bool(void *key, void *datum, void *datap); int cond_read_bool(struct policydb *p, struct hashtab *h, void *fp); int cond_read_list(struct policydb *p, void *fp); int cond_write_bool(void *key, void *datum, void *ptr); -int cond_write_list(struct policydb *p, struct cond_node *list, void *fp); +int cond_write_list(struct policydb *p, void *fp); void cond_compute_av(struct avtab *ctab, struct avtab_key *key, struct av_decision *avd, struct extended_perms *xperms); diff --git a/security/selinux/ss/policydb.c b/security/selinux/ss/policydb.c index 2aa7f2e1a8e7..8ac9b9ffc83c 100644 --- a/security/selinux/ss/policydb.c +++ b/security/selinux/ss/policydb.c @@ -3483,7 +3483,7 @@ int policydb_write(struct policydb *p, void *fp) if (rc) return rc; - rc = cond_write_list(p, p->cond_list, fp); + rc = cond_write_list(p, fp); if (rc) return rc; diff --git a/security/selinux/ss/policydb.h b/security/selinux/ss/policydb.h index 69b24191fa38..6459616f8487 100644 --- a/security/selinux/ss/policydb.h +++ b/security/selinux/ss/policydb.h @@ -272,8 +272,9 @@ struct policydb { struct cond_bool_datum **bool_val_to_struct; /* type enforcement conditional access vectors and transitions */ struct avtab te_cond_avtab; - /* linked list indexing te_cond_avtab by conditional */ + /* array indexing te_cond_avtab by conditional */ struct cond_node *cond_list; + u32 cond_list_len; /* role allows */ struct role_allow *role_allow; diff --git a/security/selinux/ss/services.c b/security/selinux/ss/services.c index ff43a35bb874..8fc8ec317bb6 100644 --- a/security/selinux/ss/services.c +++ b/security/selinux/ss/services.c @@ -2868,10 +2868,11 @@ out: } int security_get_bools(struct selinux_state *state, - int *len, char ***names, int **values) + u32 *len, char ***names, int **values) { struct policydb *policydb; - int i, rc; + u32 i; + int rc; if (!selinux_initialized(state)) { *len = 0; @@ -2925,12 +2926,11 @@ err: } -int security_set_bools(struct selinux_state *state, int len, int *values) +int security_set_bools(struct selinux_state *state, u32 len, int *values) { struct policydb *policydb; - int i, rc; - int lenp, seqno = 0; - struct cond_node *cur; + int rc; + u32 i, lenp, seqno = 0; write_lock_irq(&state->ss->policy_rwlock); @@ -2958,8 +2958,8 @@ int security_set_bools(struct selinux_state *state, int len, int *values) policydb->bool_val_to_struct[i]->state = 0; } - for (cur = policydb->cond_list; cur; cur = cur->next) - evaluate_cond_node(policydb, cur); + for (i = 0; i < policydb->cond_list_len; i++) + evaluate_cond_node(policydb, &policydb->cond_list[i]); seqno = ++state->ss->latest_granting; rc = 0; @@ -2975,11 +2975,11 @@ out: } int security_get_bool_value(struct selinux_state *state, - int index) + u32 index) { struct policydb *policydb; int rc; - int len; + u32 len; read_lock(&state->ss->policy_rwlock); @@ -2999,10 +2999,10 @@ out: static int security_preserve_bools(struct selinux_state *state, struct policydb *policydb) { - int rc, nbools = 0, *bvalues = NULL, i; + int rc, *bvalues = NULL; char **bnames = NULL; struct cond_bool_datum *booldatum; - struct cond_node *cur; + u32 i, nbools = 0; rc = security_get_bools(state, &nbools, &bnames, &bvalues); if (rc) @@ -3012,8 +3012,8 @@ static int security_preserve_bools(struct selinux_state *state, if (booldatum) booldatum->state = bvalues[i]; } - for (cur = policydb->cond_list; cur; cur = cur->next) - evaluate_cond_node(policydb, cur); + for (i = 0; i < policydb->cond_list_len; i++) + evaluate_cond_node(policydb, &policydb->cond_list[i]); out: if (bnames) { From patchwork Fri Jan 17 08:58:34 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ondrej Mosnacek X-Patchwork-Id: 11338581 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id F2A7F17EA for ; Fri, 17 Jan 2020 08:58:48 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id BDAC92082F for ; Fri, 17 Jan 2020 08:58:48 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="MJsoZ9Lg" Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1727531AbgAQI6s (ORCPT ); Fri, 17 Jan 2020 03:58:48 -0500 Received: from us-smtp-2.mimecast.com ([205.139.110.61]:31788 "EHLO us-smtp-delivery-1.mimecast.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1729447AbgAQI6s (ORCPT ); Fri, 17 Jan 2020 03:58:48 -0500 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1579251526; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=nGCEq82ehTrsFPHPtbf/4Nawb3kcxvSSNiHX55gJpWw=; b=MJsoZ9LgE5/wph31uXR4b9WFZhMB2f1BN+9Ssn6phHQjneYT4E3RFReuHLq9SndjzWmVqA QozaWlgYsD/mfgJhHmUJDh8II1wi2ac1I3KzO9wN+BzO+UvBjT2xb5rW6qo79ID/tTAVI/ kJwj6USKY85YdGvnNEg3SFPBwUufOUY= Received: from mail-wm1-f71.google.com (mail-wm1-f71.google.com [209.85.128.71]) (Using TLS) by relay.mimecast.com with ESMTP id us-mta-364-H6JgMEEdPXKwStNvYahaxQ-1; Fri, 17 Jan 2020 03:58:43 -0500 X-MC-Unique: H6JgMEEdPXKwStNvYahaxQ-1 Received: by mail-wm1-f71.google.com with SMTP id s25so997941wmj.3 for ; Fri, 17 Jan 2020 00:58:43 -0800 (PST) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=nGCEq82ehTrsFPHPtbf/4Nawb3kcxvSSNiHX55gJpWw=; b=RCGrjExVaIJwuiqHcQgNhk42necyFF4Gk3GfqNPYHTuagLRsxIrx8ro5lP+OFopAsf 4ph568xJ/kjpDiYhdjhuarh0ToHuxvQlUI+2nHj6dxM7SobLDLgFtA5f/oInB+T4MbVQ 2fz5Ht9BJPm6Z/oN2kbI5R+7Cb8aLq67+QugLWvpATjQkMSmJS3S5iSSqOnM8AO0MVnm Vt+Nt6koUA2I9Fc1l9x4Gv+oGrkdYJim8QR4NvS686E5jbjhn43SEzJwvwpBLAEQSf23 16W8c+XwBJmDqZbZzrHXDBo4ZE9RaON/Z+SxYYCdeHdRlaZ57XmV2+7Lj4g6tz6lwwi6 NAtg== X-Gm-Message-State: APjAAAU354IZSu3SFcfZihyxaGDFN6X522GvIOAxxir7Gl+qgA6Tyw6o de2KTIngQiCBErnGDriYd8wjiXLX+xI32akLqk15AqpPtaT7iK97AYKoB42SaQ0QSuSg9UK3tkE lvrqjL7LlYK+CF2A9bw== X-Received: by 2002:adf:fac1:: with SMTP id a1mr1818514wrs.376.1579251522190; Fri, 17 Jan 2020 00:58:42 -0800 (PST) X-Google-Smtp-Source: APXvYqw5lG8Nvw6ZyL+Aoy455GDRrNsHGgDOv3xrBCly1T3H0eeafk87aeTdEaQgAAmUYBsBG62ysw== X-Received: by 2002:adf:fac1:: with SMTP id a1mr1818499wrs.376.1579251521880; Fri, 17 Jan 2020 00:58:41 -0800 (PST) Received: from omos.redhat.com (nat-pool-brq-t.redhat.com. [213.175.37.10]) by smtp.gmail.com with ESMTPSA id x18sm33391312wrr.75.2020.01.17.00.58.41 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 17 Jan 2020 00:58:41 -0800 (PST) From: Ondrej Mosnacek To: selinux@vger.kernel.org, Paul Moore Cc: Stephen Smalley Subject: [PATCH v2 3/5] selinux: convert cond_av_list to array Date: Fri, 17 Jan 2020 09:58:34 +0100 Message-Id: <20200117085836.445797-4-omosnace@redhat.com> X-Mailer: git-send-email 2.24.1 In-Reply-To: <20200117085836.445797-1-omosnace@redhat.com> References: <20200117085836.445797-1-omosnace@redhat.com> MIME-Version: 1.0 Sender: selinux-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: selinux@vger.kernel.org Since it is fixed-size after allocation and we know the size beforehand, using a plain old array is simpler and more efficient. Signed-off-by: Ondrej Mosnacek Reviewed-by: Stephen Smalley --- security/selinux/ss/conditional.c | 125 ++++++++++++------------------ security/selinux/ss/conditional.h | 8 +- 2 files changed, 53 insertions(+), 80 deletions(-) diff --git a/security/selinux/ss/conditional.c b/security/selinux/ss/conditional.c index c8a02c9b23ee..b847fd2a6a51 100644 --- a/security/selinux/ss/conditional.c +++ b/security/selinux/ss/conditional.c @@ -87,8 +87,9 @@ static int cond_evaluate_expr(struct policydb *p, struct cond_expr *expr) */ void evaluate_cond_node(struct policydb *p, struct cond_node *node) { + struct avtab_node *avnode; int new_state; - struct cond_av_list *cur; + u32 i; new_state = cond_evaluate_expr(p, node->expr); if (new_state != node->cur_state) { @@ -96,19 +97,21 @@ void evaluate_cond_node(struct policydb *p, struct cond_node *node) if (new_state == -1) pr_err("SELinux: expression result was undefined - disabling all rules.\n"); /* turn the rules on or off */ - for (cur = node->true_list; cur; cur = cur->next) { + for (i = 0; i < node->true_list.len; i++) { + avnode = node->true_list.nodes[i]; if (new_state <= 0) - cur->node->key.specified &= ~AVTAB_ENABLED; + avnode->key.specified &= ~AVTAB_ENABLED; else - cur->node->key.specified |= AVTAB_ENABLED; + avnode->key.specified |= AVTAB_ENABLED; } - for (cur = node->false_list; cur; cur = cur->next) { + for (i = 0; i < node->false_list.len; i++) { + avnode = node->false_list.nodes[i]; /* -1 or 1 */ if (new_state) - cur->node->key.specified &= ~AVTAB_ENABLED; + avnode->key.specified &= ~AVTAB_ENABLED; else - cur->node->key.specified |= AVTAB_ENABLED; + avnode->key.specified |= AVTAB_ENABLED; } } } @@ -128,16 +131,6 @@ int cond_policydb_init(struct policydb *p) return 0; } -static void cond_av_list_destroy(struct cond_av_list *list) -{ - struct cond_av_list *cur, *next; - for (cur = list; cur; cur = next) { - next = cur->next; - /* the avtab_ptr_t node is destroy by the avtab */ - kfree(cur); - } -} - static void cond_node_destroy(struct cond_node *node) { struct cond_expr *cur_expr, *next_expr; @@ -146,8 +139,9 @@ static void cond_node_destroy(struct cond_node *node) next_expr = cur_expr->next; kfree(cur_expr); } - cond_av_list_destroy(node->true_list); - cond_av_list_destroy(node->false_list); + /* the avtab_ptr_t nodes are destroyed by the avtab */ + kfree(node->true_list.nodes); + kfree(node->false_list.nodes); } static void cond_list_destroy(struct policydb *p) @@ -255,19 +249,17 @@ err: struct cond_insertf_data { struct policydb *p; + struct avtab_node **dst; struct cond_av_list *other; - struct cond_av_list *head; - struct cond_av_list *tail; }; static int cond_insertf(struct avtab *a, struct avtab_key *k, struct avtab_datum *d, void *ptr) { struct cond_insertf_data *data = ptr; struct policydb *p = data->p; - struct cond_av_list *other = data->other, *list, *cur; struct avtab_node *node_ptr; - u8 found; - int rc = -EINVAL; + u32 i; + bool found; /* * For type rules we have to make certain there aren't any @@ -277,7 +269,7 @@ static int cond_insertf(struct avtab *a, struct avtab_key *k, struct avtab_datum if (k->specified & AVTAB_TYPE) { if (avtab_search(&p->te_avtab, k)) { pr_err("SELinux: type rule already exists outside of a conditional.\n"); - goto err; + return -EINVAL; } /* * If we are reading the false list other will be a pointer to @@ -287,29 +279,29 @@ static int cond_insertf(struct avtab *a, struct avtab_key *k, struct avtab_datum * If we are reading the true list (other == NULL) there shouldn't * be any other entries. */ - if (other) { + if (data->other) { node_ptr = avtab_search_node(&p->te_cond_avtab, k); if (node_ptr) { if (avtab_search_node_next(node_ptr, k->specified)) { pr_err("SELinux: too many conflicting type rules.\n"); - goto err; + return -EINVAL; } - found = 0; - for (cur = other; cur; cur = cur->next) { - if (cur->node == node_ptr) { - found = 1; + found = false; + for (i = 0; i < data->other->len; i++) { + if (data->other->nodes[i] == node_ptr) { + found = true; break; } } if (!found) { pr_err("SELinux: conflicting type rules.\n"); - goto err; + return -EINVAL; } } } else { if (avtab_search(&p->te_cond_avtab, k)) { pr_err("SELinux: conflicting type rules when adding type rule for true.\n"); - goto err; + return -EINVAL; } } } @@ -317,39 +309,22 @@ static int cond_insertf(struct avtab *a, struct avtab_key *k, struct avtab_datum node_ptr = avtab_insert_nonunique(&p->te_cond_avtab, k, d); if (!node_ptr) { pr_err("SELinux: could not insert rule.\n"); - rc = -ENOMEM; - goto err; - } - - list = kzalloc(sizeof(*list), GFP_KERNEL); - if (!list) { - rc = -ENOMEM; - goto err; + return -ENOMEM; } - list->node = node_ptr; - if (!data->head) - data->head = list; - else - data->tail->next = list; - data->tail = list; + *data->dst = node_ptr; return 0; - -err: - cond_av_list_destroy(data->head); - data->head = NULL; - return rc; } -static int cond_read_av_list(struct policydb *p, void *fp, struct cond_av_list **ret_list, struct cond_av_list *other) +static int cond_read_av_list(struct policydb *p, void *fp, + struct cond_av_list *list, + struct cond_av_list *other) { - int i, rc; + int rc; __le32 buf[1]; - u32 len; + u32 i, len; struct cond_insertf_data data; - *ret_list = NULL; - rc = next_entry(buf, fp, sizeof(u32)); if (rc) return rc; @@ -358,18 +333,24 @@ static int cond_read_av_list(struct policydb *p, void *fp, struct cond_av_list * if (len == 0) return 0; + list->nodes = kcalloc(len, sizeof(*list->nodes), GFP_KERNEL); + if (!list->nodes) + return -ENOMEM; + data.p = p; data.other = other; - data.head = NULL; - data.tail = NULL; for (i = 0; i < len; i++) { + data.dst = &list->nodes[i]; rc = avtab_read_item(&p->te_cond_avtab, fp, p, cond_insertf, &data); - if (rc) + if (rc) { + kfree(list->nodes); + list->nodes = NULL; return rc; + } } - *ret_list = data.head; + list->len = len; return 0; } @@ -432,7 +413,7 @@ static int cond_read_node(struct policydb *p, struct cond_node *node, void *fp) rc = cond_read_av_list(p, fp, &node->true_list, NULL); if (rc) goto err; - rc = cond_read_av_list(p, fp, &node->false_list, node->true_list); + rc = cond_read_av_list(p, fp, &node->false_list, &node->true_list); if (rc) goto err; return 0; @@ -511,24 +492,16 @@ static int cond_write_av_list(struct policydb *p, struct cond_av_list *list, struct policy_file *fp) { __le32 buf[1]; - struct cond_av_list *cur_list; - u32 len; + u32 i; int rc; - len = 0; - for (cur_list = list; cur_list != NULL; cur_list = cur_list->next) - len++; - - buf[0] = cpu_to_le32(len); + buf[0] = cpu_to_le32(list->len); rc = put_entry(buf, sizeof(u32), 1, fp); if (rc) return rc; - if (len == 0) - return 0; - - for (cur_list = list; cur_list != NULL; cur_list = cur_list->next) { - rc = avtab_write_item(p, cur_list->node, fp); + for (i = 0; i < list->len; i++) { + rc = avtab_write_item(p, list->nodes[i], fp); if (rc) return rc; } @@ -565,10 +538,10 @@ static int cond_write_node(struct policydb *p, struct cond_node *node, return rc; } - rc = cond_write_av_list(p, node->true_list, fp); + rc = cond_write_av_list(p, &node->true_list, fp); if (rc) return rc; - rc = cond_write_av_list(p, node->false_list, fp); + rc = cond_write_av_list(p, &node->false_list, fp); if (rc) return rc; diff --git a/security/selinux/ss/conditional.h b/security/selinux/ss/conditional.h index e474bdd3a0ed..5f97f678440e 100644 --- a/security/selinux/ss/conditional.h +++ b/security/selinux/ss/conditional.h @@ -39,8 +39,8 @@ struct cond_expr { * struct is for that list. */ struct cond_av_list { - struct avtab_node *node; - struct cond_av_list *next; + struct avtab_node **nodes; + u32 len; }; /* @@ -53,8 +53,8 @@ struct cond_av_list { struct cond_node { int cur_state; struct cond_expr *expr; - struct cond_av_list *true_list; - struct cond_av_list *false_list; + struct cond_av_list true_list; + struct cond_av_list false_list; }; int cond_policydb_init(struct policydb *p); From patchwork Fri Jan 17 08:58:35 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ondrej Mosnacek X-Patchwork-Id: 11338579 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 8BAC714B4 for ; Fri, 17 Jan 2020 08:58:48 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 608F52082F for ; Fri, 17 Jan 2020 08:58:48 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="IJL5BLXz" Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726479AbgAQI6s (ORCPT ); Fri, 17 Jan 2020 03:58:48 -0500 Received: from us-smtp-delivery-1.mimecast.com ([207.211.31.120]:42581 "EHLO us-smtp-1.mimecast.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1727531AbgAQI6r (ORCPT ); Fri, 17 Jan 2020 03:58:47 -0500 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1579251526; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=Gs2FevhIY5qg7ix5NuxjTRi08FFlGqxkkVWx8ba6YMo=; b=IJL5BLXzrVbxHC35GDNkRIE7BNIm8tjeRoqkZWhTYhRN6bfTr0KcjKFMaQ/eZj8BjN2Z+U 0iXXq0VLwjCDDeKhQ6imzAcARfjwUFof5fI0m6UG441AAKB3Aj6RKGD8bM92y4zEwUhz5g oXg9Xwu/RsKCuVrZ/H33Gs1fR4j9n0o= Received: from mail-wm1-f71.google.com (mail-wm1-f71.google.com [209.85.128.71]) (Using TLS) by relay.mimecast.com with ESMTP id us-mta-347-btSc0Lc3POSps82pZpa5rA-1; Fri, 17 Jan 2020 03:58:44 -0500 X-MC-Unique: btSc0Lc3POSps82pZpa5rA-1 Received: by mail-wm1-f71.google.com with SMTP id w205so2008391wmb.5 for ; Fri, 17 Jan 2020 00:58:44 -0800 (PST) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=Gs2FevhIY5qg7ix5NuxjTRi08FFlGqxkkVWx8ba6YMo=; b=RWxsmdchzheidV9qVsWiNyeG3eTZbiHrt2PX0b4M2MR4YZsql0BjP5/EMqQkue5Kb4 Qrhf2dY5g0AwCzwJW1wVs6FTv4Ld2UB6meU0eaxiAqXHucPq55jQtZadakoYWHT3L3Hr 9V3L13sbEb0HOlgJsCPPke9GjocLLG2cUZ2A4zL1z07bhWgaEZ54lteW+6ovXDvxFgly TrzO9Rj3KBGB2B0l6Y3jEn2ShBWnIq7HzcriRJux2PWBnakJr1ifUoSfEAaKawO/Hkwt 5vAKOprN/aCt6l6m/FA4eqYJY3m3fP6AvVmp4dc98UqnNCRER3AaCm1R7D/rvlPTx6hY nNgQ== X-Gm-Message-State: APjAAAXO+N/kM/I+6H9GWDYz94YkIAKi427ggx7z6maopajI7wwZLSOc qyqr+dr0lCrOJ/Q8sQZ72zat391QgCiBsziVmHe+GKif5ygFDEJb+RVjXuCGx5x7d02v7HeuTq3 lFlhkxXE3P0ldWITFmg== X-Received: by 2002:a5d:4392:: with SMTP id i18mr1893995wrq.199.1579251522985; Fri, 17 Jan 2020 00:58:42 -0800 (PST) X-Google-Smtp-Source: APXvYqzYHejBI3iBWw1v7IURq4ggQWjjruo4vzVSx0H2g0l5CAc473oHbhgx6ZsfSUrUWu2PGjceVQ== X-Received: by 2002:a5d:4392:: with SMTP id i18mr1893979wrq.199.1579251522700; Fri, 17 Jan 2020 00:58:42 -0800 (PST) Received: from omos.redhat.com (nat-pool-brq-t.redhat.com. [213.175.37.10]) by smtp.gmail.com with ESMTPSA id x18sm33391312wrr.75.2020.01.17.00.58.41 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 17 Jan 2020 00:58:42 -0800 (PST) From: Ondrej Mosnacek To: selinux@vger.kernel.org, Paul Moore Cc: Stephen Smalley Subject: [PATCH v2 4/5] selinux: convert cond_expr to array Date: Fri, 17 Jan 2020 09:58:35 +0100 Message-Id: <20200117085836.445797-5-omosnace@redhat.com> X-Mailer: git-send-email 2.24.1 In-Reply-To: <20200117085836.445797-1-omosnace@redhat.com> References: <20200117085836.445797-1-omosnace@redhat.com> MIME-Version: 1.0 Sender: selinux-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: selinux@vger.kernel.org Since it is fixed-size after allocation and we know the size beforehand, using a plain old array is simpler and more efficient. Signed-off-by: Ondrej Mosnacek Reviewed-by: Stephen Smalley --- security/selinux/ss/conditional.c | 62 ++++++++++++------------------- security/selinux/ss/conditional.h | 14 ++++--- 2 files changed, 33 insertions(+), 43 deletions(-) diff --git a/security/selinux/ss/conditional.c b/security/selinux/ss/conditional.c index b847fd2a6a51..8f9f2f3c86a0 100644 --- a/security/selinux/ss/conditional.c +++ b/security/selinux/ss/conditional.c @@ -23,18 +23,19 @@ */ static int cond_evaluate_expr(struct policydb *p, struct cond_expr *expr) { - - struct cond_expr *cur; + u32 i; int s[COND_EXPR_MAXDEPTH]; int sp = -1; - for (cur = expr; cur; cur = cur->next) { - switch (cur->expr_type) { + for (i = 0; i < expr->len; i++) { + struct cond_expr_node *node = &expr->nodes[i]; + + switch (node->expr_type) { case COND_BOOL: if (sp == (COND_EXPR_MAXDEPTH - 1)) return -1; sp++; - s[sp] = p->bool_val_to_struct[cur->bool - 1]->state; + s[sp] = p->bool_val_to_struct[node->bool - 1]->state; break; case COND_NOT: if (sp < 0) @@ -91,7 +92,7 @@ void evaluate_cond_node(struct policydb *p, struct cond_node *node) int new_state; u32 i; - new_state = cond_evaluate_expr(p, node->expr); + new_state = cond_evaluate_expr(p, &node->expr); if (new_state != node->cur_state) { node->cur_state = new_state; if (new_state == -1) @@ -133,12 +134,7 @@ int cond_policydb_init(struct policydb *p) static void cond_node_destroy(struct cond_node *node) { - struct cond_expr *cur_expr, *next_expr; - - for (cur_expr = node->expr; cur_expr; cur_expr = next_expr) { - next_expr = cur_expr->next; - kfree(cur_expr); - } + kfree(node->expr.nodes); /* the avtab_ptr_t nodes are destroyed by the avtab */ kfree(node->true_list.nodes); kfree(node->false_list.nodes); @@ -354,7 +350,7 @@ static int cond_read_av_list(struct policydb *p, void *fp, return 0; } -static int expr_isvalid(struct policydb *p, struct cond_expr *expr) +static int expr_node_isvalid(struct policydb *p, struct cond_expr_node *expr) { if (expr->expr_type <= 0 || expr->expr_type > COND_LAST) { pr_err("SELinux: conditional expressions uses unknown operator.\n"); @@ -371,43 +367,37 @@ static int expr_isvalid(struct policydb *p, struct cond_expr *expr) static int cond_read_node(struct policydb *p, struct cond_node *node, void *fp) { __le32 buf[2]; - u32 len, i; + u32 i, len; int rc; - struct cond_expr *expr = NULL, *last = NULL; rc = next_entry(buf, fp, sizeof(u32) * 2); if (rc) - goto err; + return rc; node->cur_state = le32_to_cpu(buf[0]); /* expr */ len = le32_to_cpu(buf[1]); + node->expr.nodes = kcalloc(len, sizeof(*node->expr.nodes), GFP_KERNEL); + if (!node->expr.nodes) + return -ENOMEM; + + node->expr.len = len; for (i = 0; i < len; i++) { + struct cond_expr_node *expr = &node->expr.nodes[i]; + rc = next_entry(buf, fp, sizeof(u32) * 2); if (rc) goto err; - rc = -ENOMEM; - expr = kzalloc(sizeof(*expr), GFP_KERNEL); - if (!expr) - goto err; - expr->expr_type = le32_to_cpu(buf[0]); expr->bool = le32_to_cpu(buf[1]); - if (!expr_isvalid(p, expr)) { + if (!expr_node_isvalid(p, expr)) { rc = -EINVAL; - kfree(expr); goto err; } - - if (i == 0) - node->expr = expr; - else - last->next = expr; - last = expr; } rc = cond_read_av_list(p, fp, &node->true_list, NULL); @@ -512,27 +502,23 @@ static int cond_write_av_list(struct policydb *p, static int cond_write_node(struct policydb *p, struct cond_node *node, struct policy_file *fp) { - struct cond_expr *cur_expr; __le32 buf[2]; int rc; - u32 len = 0; + u32 i; buf[0] = cpu_to_le32(node->cur_state); rc = put_entry(buf, sizeof(u32), 1, fp); if (rc) return rc; - for (cur_expr = node->expr; cur_expr != NULL; cur_expr = cur_expr->next) - len++; - - buf[0] = cpu_to_le32(len); + buf[0] = cpu_to_le32(node->expr.len); rc = put_entry(buf, sizeof(u32), 1, fp); if (rc) return rc; - for (cur_expr = node->expr; cur_expr != NULL; cur_expr = cur_expr->next) { - buf[0] = cpu_to_le32(cur_expr->expr_type); - buf[1] = cpu_to_le32(cur_expr->bool); + for (i = 0; i < node->expr.len; i++) { + buf[0] = cpu_to_le32(node->expr.nodes[i].expr_type); + buf[1] = cpu_to_le32(node->expr.nodes[i].bool); rc = put_entry(buf, sizeof(u32), 2, fp); if (rc) return rc; diff --git a/security/selinux/ss/conditional.h b/security/selinux/ss/conditional.h index 5f97f678440e..4677c6ff7450 100644 --- a/security/selinux/ss/conditional.h +++ b/security/selinux/ss/conditional.h @@ -19,7 +19,7 @@ * A conditional expression is a list of operators and operands * in reverse polish notation. */ -struct cond_expr { +struct cond_expr_node { #define COND_BOOL 1 /* plain bool */ #define COND_NOT 2 /* !bool */ #define COND_OR 3 /* bool || bool */ @@ -28,9 +28,13 @@ struct cond_expr { #define COND_EQ 6 /* bool == bool */ #define COND_NEQ 7 /* bool != bool */ #define COND_LAST COND_NEQ - __u32 expr_type; - __u32 bool; - struct cond_expr *next; + u32 expr_type; + u32 bool; +}; + +struct cond_expr { + struct cond_expr_node *nodes; + u32 len; }; /* @@ -52,7 +56,7 @@ struct cond_av_list { */ struct cond_node { int cur_state; - struct cond_expr *expr; + struct cond_expr expr; struct cond_av_list true_list; struct cond_av_list false_list; }; From patchwork Fri Jan 17 08:58:36 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ondrej Mosnacek X-Patchwork-Id: 11338577 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id D5D14138D for ; Fri, 17 Jan 2020 08:58:47 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id B3D752082F for ; Fri, 17 Jan 2020 08:58:47 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="QluMUZxA" Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1729451AbgAQI6r (ORCPT ); Fri, 17 Jan 2020 03:58:47 -0500 Received: from us-smtp-1.mimecast.com ([205.139.110.61]:32108 "EHLO us-smtp-delivery-1.mimecast.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1729144AbgAQI6r (ORCPT ); Fri, 17 Jan 2020 03:58:47 -0500 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1579251526; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=BV+b/JM1TawckUWa4ei0v6xN0KrVd4heK2kZffGLI4I=; b=QluMUZxAWeUneq3GMT1fUUt5oZW9dbsxo5aZ2Y+VL4UH+vNjFU5ENEBc5J2/uFm2mAfogY RdQiQ4UUq01zQ6q0mXRcVBYWc6f+NgiuSdwAi/z1RzY3wyqm4LUT8NTn3rwanK2I8s6H9L 0lgo3sCwodZ61YgTPX05qlSQawaE6xI= Received: from mail-wr1-f71.google.com (mail-wr1-f71.google.com [209.85.221.71]) (Using TLS) by relay.mimecast.com with ESMTP id us-mta-398-XCJg3UAVOweuz8oaTNQLcw-1; Fri, 17 Jan 2020 03:58:45 -0500 X-MC-Unique: XCJg3UAVOweuz8oaTNQLcw-1 Received: by mail-wr1-f71.google.com with SMTP id u12so10272658wrt.15 for ; Fri, 17 Jan 2020 00:58:44 -0800 (PST) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=BV+b/JM1TawckUWa4ei0v6xN0KrVd4heK2kZffGLI4I=; b=W1CmKa77Gf1I06XbDxl8Vh70M46vYYRaJ1CFJPXAc32AzqFDocjLHxY+iNS9F4duJa r6mPTL50kza/FVoXviBEflby1X2m4t8T13KwboAwBLZWgl0wjJkB6DdeFfSEqRb8KxR1 qdhUp09dyVAe0RPM53j+7Q11SywL8SX96lENmm9sG4ixyIorj1qNXLBxgVmeaCYmU+i9 qpwhz7ZfdhJ3/tvoIFdlfCPuWBH5sKRKSzWL2OpRMEpxWpd0VuD2mIE2bxA8k4D7HqOv zeO8JKCeeifUz42lmZV2U0f0+4+P13FCMQVZWCGxHgtxh3rqUt09P9RL+J6nQ1M0KyS8 q9kg== X-Gm-Message-State: APjAAAVAK6ZMcAxRqbJ0pHSvXvgYhOMHMl+YPc7/ABI29p/hSRXkL9qr us7u/pR5HLBcyYp4fEAa7MfSPVlo5sVahcsc4BaL3kzDR5nXbpubdyJnwwbYDT4qIZnDVn9x1fj 3uGOGnsawZniaSWAsRw== X-Received: by 2002:a7b:c851:: with SMTP id c17mr3377843wml.71.1579251523663; Fri, 17 Jan 2020 00:58:43 -0800 (PST) X-Google-Smtp-Source: APXvYqwqYbo3vulC7PBlXtb8d3NEz4+QQpdGiWBTscLRpEgcaG24k5Gp4/wrLcxpH0XUvrDO7/bfbA== X-Received: by 2002:a7b:c851:: with SMTP id c17mr3377828wml.71.1579251523474; Fri, 17 Jan 2020 00:58:43 -0800 (PST) Received: from omos.redhat.com (nat-pool-brq-t.redhat.com. [213.175.37.10]) by smtp.gmail.com with ESMTPSA id x18sm33391312wrr.75.2020.01.17.00.58.42 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 17 Jan 2020 00:58:43 -0800 (PST) From: Ondrej Mosnacek To: selinux@vger.kernel.org, Paul Moore Cc: Stephen Smalley Subject: [PATCH v2 5/5] selinux: generalize evaluate_cond_node() Date: Fri, 17 Jan 2020 09:58:36 +0100 Message-Id: <20200117085836.445797-6-omosnace@redhat.com> X-Mailer: git-send-email 2.24.1 In-Reply-To: <20200117085836.445797-1-omosnace@redhat.com> References: <20200117085836.445797-1-omosnace@redhat.com> MIME-Version: 1.0 Sender: selinux-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: selinux@vger.kernel.org Both callers iterate the cond_list and call it for each node - turn it into evaluate_cond_nodes(), which does the iteration for them. Signed-off-by: Ondrej Mosnacek Reviewed-by: Stephen Smalley --- security/selinux/ss/conditional.c | 10 +++++++++- security/selinux/ss/conditional.h | 2 +- security/selinux/ss/services.c | 6 ++---- 3 files changed, 12 insertions(+), 6 deletions(-) diff --git a/security/selinux/ss/conditional.c b/security/selinux/ss/conditional.c index 8f9f2f3c86a0..ad709ccea036 100644 --- a/security/selinux/ss/conditional.c +++ b/security/selinux/ss/conditional.c @@ -86,7 +86,7 @@ static int cond_evaluate_expr(struct policydb *p, struct cond_expr *expr) * list appropriately. If the result of the expression is undefined * all of the rules are disabled for safety. */ -void evaluate_cond_node(struct policydb *p, struct cond_node *node) +static void evaluate_cond_node(struct policydb *p, struct cond_node *node) { struct avtab_node *avnode; int new_state; @@ -117,6 +117,14 @@ void evaluate_cond_node(struct policydb *p, struct cond_node *node) } } +void evaluate_cond_nodes(struct policydb *p) +{ + u32 i; + + for (i = 0; i < p->cond_list_len; i++) + evaluate_cond_node(p, &p->cond_list[i]); +} + int cond_policydb_init(struct policydb *p) { int rc; diff --git a/security/selinux/ss/conditional.h b/security/selinux/ss/conditional.h index 4677c6ff7450..b9eb888ffa76 100644 --- a/security/selinux/ss/conditional.h +++ b/security/selinux/ss/conditional.h @@ -78,6 +78,6 @@ void cond_compute_av(struct avtab *ctab, struct avtab_key *key, struct av_decision *avd, struct extended_perms *xperms); void cond_compute_xperms(struct avtab *ctab, struct avtab_key *key, struct extended_perms_decision *xpermd); -void evaluate_cond_node(struct policydb *p, struct cond_node *node); +void evaluate_cond_nodes(struct policydb *p); #endif /* _CONDITIONAL_H_ */ diff --git a/security/selinux/ss/services.c b/security/selinux/ss/services.c index 8fc8ec317bb6..7fb7f2efe566 100644 --- a/security/selinux/ss/services.c +++ b/security/selinux/ss/services.c @@ -2958,8 +2958,7 @@ int security_set_bools(struct selinux_state *state, u32 len, int *values) policydb->bool_val_to_struct[i]->state = 0; } - for (i = 0; i < policydb->cond_list_len; i++) - evaluate_cond_node(policydb, &policydb->cond_list[i]); + evaluate_cond_nodes(policydb); seqno = ++state->ss->latest_granting; rc = 0; @@ -3012,8 +3011,7 @@ static int security_preserve_bools(struct selinux_state *state, if (booldatum) booldatum->state = bvalues[i]; } - for (i = 0; i < policydb->cond_list_len; i++) - evaluate_cond_node(policydb, &policydb->cond_list[i]); + evaluate_cond_nodes(policydb); out: if (bnames) {