From patchwork Tue May 11 20:02:57 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: James Carter X-Patchwork-Id: 12251999 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-15.8 required=3.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,FREEMAIL_FORGED_FROMDOMAIN,FREEMAIL_FROM, HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER,INCLUDES_PATCH, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id C4203C433ED for ; Tue, 11 May 2021 20:03:14 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 8C26061376 for ; Tue, 11 May 2021 20:03:14 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229716AbhEKUEU (ORCPT ); Tue, 11 May 2021 16:04:20 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:40464 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229996AbhEKUEU (ORCPT ); Tue, 11 May 2021 16:04:20 -0400 Received: from mail-qt1-x82a.google.com (mail-qt1-x82a.google.com [IPv6:2607:f8b0:4864:20::82a]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 31A89C06175F for ; Tue, 11 May 2021 13:03:13 -0700 (PDT) Received: by mail-qt1-x82a.google.com with SMTP id f8so11406318qth.6 for ; Tue, 11 May 2021 13:03:13 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=6sTiAwv2m1hvS3tWmgbGDvK+yUsIAboN9EEOmEZL710=; b=iRfRnyOVO52pFy6+0IVQeS6VTVWX93JQbwce4fuiwbxvzS3OTixTqKxydQfKloSVPJ xIfNFhkUS/5ymned6pYtOUK6QGeos2SAs8GEqOTfcZ3/9ALNHJoSQRQThYnT3GbO7DHh D/k61eYgSGHcD1OBBtO3Gw6dbo1RoXQVvaDtMUr58YXEJWLN93Itxx+3uwr6J0naqw0c nr9TrdbaYDxzGroU0jlD6jcyXgJ0rBME1xtxAJx0VXL5EupEaT0+y4kNzjK46C4AXFQZ HhGeiWbf/kHGGI2lsBjkxHinUJhMsvrF5UYsu0MwoPksdMkNzKqSoxEllaS92Xe6n52R GiMw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=6sTiAwv2m1hvS3tWmgbGDvK+yUsIAboN9EEOmEZL710=; b=L6bCViCUEXEIfABGQxRkcCcby5eapA0oEbBQO/dN7YQu2VMYJhH943S021uQ5x6SxC Riiax/8ePdpdHxXW0sy2EjzCTx2ho/RiK0oJV8LgdFJEE6833qJhn5By0ol830SEQ16S 64xnZR1ZWjfChFfsXzJUUmh5iOsrYjN/ENzrxbqnGvH79mphaDah+CUUoxoU0vyUNw0s 793iJipngCqfKaAvqeu006FV9sBFTBAAqYah3w3jKNTll5KP5i04F8rg40oC2I49z4Zd P2lvIGAlR6y2gI8ICR2kCVAEd81+LOI+LohbMLNzGt53RUFqKtz1dH9DbivAS/inIMXT BrKg== X-Gm-Message-State: AOAM530cDDjEKxlAQWmKQNnS41Uh+54yZfCMrS+AtrPUIZSQxLyShNeI Js4wIrK/sJyLaAFOHECGyb+8/Lf84CDNmA== X-Google-Smtp-Source: ABdhPJw6+riWyM6eiZULmAPAISks18AVXmcQG8UF5beVY7onwFy4KrCyhaQqvU4qObFuVJddj5rumw== X-Received: by 2002:ac8:6c22:: with SMTP id k2mr28890627qtu.303.1620763392306; Tue, 11 May 2021 13:03:12 -0700 (PDT) Received: from localhost.localdomain (c-73-200-157-122.hsd1.md.comcast.net. [73.200.157.122]) by smtp.gmail.com with ESMTPSA id z9sm4642533qtf.10.2021.05.11.13.03.11 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 11 May 2021 13:03:11 -0700 (PDT) From: James Carter To: selinux@vger.kernel.org Cc: James Carter Subject: [PATCH 1/5 v2] libsepol/cil: Make name resolution in macros work as documented Date: Tue, 11 May 2021 16:02:57 -0400 Message-Id: <20210511200301.407855-2-jwcart2@gmail.com> X-Mailer: git-send-email 2.26.3 In-Reply-To: <20210511200301.407855-1-jwcart2@gmail.com> References: <20210511200301.407855-1-jwcart2@gmail.com> MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: selinux@vger.kernel.org The CIL Reference Guide specifies how name resolution is suppose to work within an expanded macro. 1. Items defined inside the macro 2. Items passed into the macro as arguments 3. Items defined in the same namespace of the macro 4. Items defined in the caller's namespace 5. Items defined in the global namespace But Lorenzo Ceragioli found that the first step is not done. So the following policy: (block A (type a) (macro m () (type a) (allow a self (CLASS (PERM))) ) ) (block B (call A.m) ) will result in: (allow A.a self (CLASS (PERM))) instead of the expected: (allow B.a self (CLASS (PERM))) Now when an expanded call is found, the macro's namespace is checked first. If the name is found, then the name was declared in the macro and it is declared in the expanded call, so only the namespace of the call up to and including the global namespace will be searched. If the name is not found in the macro's namespace then name resolution continues with steps 2-5 above. Signed-off-by: James Carter --- libsepol/cil/src/cil_resolve_ast.c | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-) diff --git a/libsepol/cil/src/cil_resolve_ast.c b/libsepol/cil/src/cil_resolve_ast.c index f251ed15..bbe86e22 100644 --- a/libsepol/cil/src/cil_resolve_ast.c +++ b/libsepol/cil/src/cil_resolve_ast.c @@ -4224,10 +4224,18 @@ static int __cil_resolve_name_with_parents(struct cil_tree_node *node, char *nam break; case CIL_CALL: { struct cil_call *call = node->data; - rc = cil_resolve_name_call_args(call, name, sym_index, datum); - if (rc != SEPOL_OK) { - /* Continue search in macro's parent */ - rc = __cil_resolve_name_with_parents(NODE(call->macro)->parent, name, sym_index, datum); + struct cil_macro *macro = call->macro; + symtab = ¯o->symtab[sym_index]; + rc = cil_symtab_get_datum(symtab, name, datum); + if (rc == SEPOL_OK) { + /* If the name was declared in the macro, just look on the call side */ + rc = SEPOL_ERR; + } else { + rc = cil_resolve_name_call_args(call, name, sym_index, datum); + if (rc != SEPOL_OK) { + /* Continue search in macro's parent */ + rc = __cil_resolve_name_with_parents(NODE(call->macro)->parent, name, sym_index, datum); + } } } break; From patchwork Tue May 11 20:02:58 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: James Carter X-Patchwork-Id: 12252001 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-15.8 required=3.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,FREEMAIL_FORGED_FROMDOMAIN,FREEMAIL_FROM, HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER,INCLUDES_PATCH, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 663E2C43461 for ; Tue, 11 May 2021 20:03:15 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 3426561433 for ; Tue, 11 May 2021 20:03:15 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229996AbhEKUEV (ORCPT ); Tue, 11 May 2021 16:04:21 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:40466 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229954AbhEKUEV (ORCPT ); Tue, 11 May 2021 16:04:21 -0400 Received: from mail-qv1-xf34.google.com (mail-qv1-xf34.google.com [IPv6:2607:f8b0:4864:20::f34]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id AD776C061574 for ; Tue, 11 May 2021 13:03:13 -0700 (PDT) Received: by mail-qv1-xf34.google.com with SMTP id v18so721706qvx.10 for ; Tue, 11 May 2021 13:03:13 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=nRv4lluFvEhFuCRxbLh2jT6/HShoE4a4pAjtmzmzleI=; b=SB44Q+q1FGfZc78i3AUIEvv7W1fSwrUzPVIf2RlAU+IfI/A1yrQf+T8vP5xtLgoFbx w6VuU/O7+D3W8vPruil1dggSHBnefeZ6/XYCqfv5IDcCGX11k9y/+/3qHyRdctj09GoU YPOwtO0ItsPfCj/r3oaupGDYYfXWnvKEUrO/b0O4lyfmcSr1S3Tv1tIeglagte4mQtXh lnFIXKuC/B/nwR6C6QlGihmAQ9MLvBjtUgIylhf3iMyTzaaTMt/2DVG++v7qQAMvWbCk C2Jo8Hjoj+Qi8K3XoHtkV2n7cS1XpB7YuX2b+JMzLpKDlU84Meho+xSYC3Wv7D1qK1nh vNyw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=nRv4lluFvEhFuCRxbLh2jT6/HShoE4a4pAjtmzmzleI=; b=t6GRZfnPv7D985gfR3+yx18zkktT/YlJR1oj6qy2OhPU4U4M/LEPNBcUb7fOHCuDo9 TiOrff/hwm1zp1ewqFeIGz6EmvrSvP9/JOCV026iLxQnDG8X78NRu18RmDMgUEIti/FG zhyK601Cra6YgDJPXck0AJmA7VQVsu0A+/MEZOwvp5VpZ4Yu2a6eUcsWt8+9pY/rKh64 y1JGRVw2wN3UlUm9G4kCUYHQa2C+dm60yIBCR8wVxXelUt89tB5MI18+aazhCYyuWKe6 8s4VXjUSO3+DXmcgrge3Zc16pP7d9oqiSpjzEG6J7ceZAHwmqIq+E13XXBYkcBVIlw13 9gMA== X-Gm-Message-State: AOAM5303NsuHDPduGxzmOnj+VBkcH236Hd1OFZFTn5uomc4B2OIuc+Of dXRBAT1q62JzRrN9pcvvv58zJjkY89ZhBw== X-Google-Smtp-Source: ABdhPJyHoIhN3os6FKpjxv9kXlECVkVRmpl/BTFfCcHw9j+tr/WGkWyQuXfKy6XEjoaWKz0vDVm5XQ== X-Received: by 2002:ad4:4729:: with SMTP id l9mr31470185qvz.30.1620763392852; Tue, 11 May 2021 13:03:12 -0700 (PDT) Received: from localhost.localdomain (c-73-200-157-122.hsd1.md.comcast.net. [73.200.157.122]) by smtp.gmail.com with ESMTPSA id z9sm4642533qtf.10.2021.05.11.13.03.12 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 11 May 2021 13:03:12 -0700 (PDT) From: James Carter To: selinux@vger.kernel.org Cc: James Carter Subject: [PATCH 2/5 v2] libsepol/cil: Do not add NULL node when inserting key into symtab Date: Tue, 11 May 2021 16:02:58 -0400 Message-Id: <20210511200301.407855-3-jwcart2@gmail.com> X-Mailer: git-send-email 2.26.3 In-Reply-To: <20210511200301.407855-1-jwcart2@gmail.com> References: <20210511200301.407855-1-jwcart2@gmail.com> MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: selinux@vger.kernel.org Allow inserting a key without providing a node. This will make it easier to properly resolve call arguments where a key might need to be temporarily removed to search for a datum that is not declared within the call. Since the node is already in the node list, re-inserting the key without this option would add another link to the node and cause problems. Also, do not add the node to the datum's node list if the result of the call to hashtab_insert() is SEPOL_EEXIST because the datum is a duplicate and will be destroyed. Signed-off-by: James Carter --- libsepol/cil/src/cil_symtab.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/libsepol/cil/src/cil_symtab.c b/libsepol/cil/src/cil_symtab.c index 579a888e..c1951560 100644 --- a/libsepol/cil/src/cil_symtab.c +++ b/libsepol/cil/src/cil_symtab.c @@ -93,10 +93,10 @@ int cil_symtab_insert(symtab_t *symtab, hashtab_key_t key, struct cil_symtab_dat datum->fqn = key; datum->symtab = symtab; symtab->nprim++; - cil_list_append(datum->nodes, CIL_NODE, node); - } else if (rc == SEPOL_EEXIST) { - cil_list_append(datum->nodes, CIL_NODE, node); - } else { + if (node) { + cil_list_append(datum->nodes, CIL_NODE, node); + } + } else if (rc != SEPOL_EEXIST) { cil_symtab_error("Failed to insert datum into hashtab\n"); } From patchwork Tue May 11 20:02:59 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: James Carter X-Patchwork-Id: 12252007 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-13.0 required=3.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,FREEMAIL_FORGED_FROMDOMAIN,FREEMAIL_FROM, HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER,INCLUDES_PATCH, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,UNWANTED_LANGUAGE_BODY, USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id CF32CC43460 for ; Tue, 11 May 2021 20:03:16 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 97EB261433 for ; Tue, 11 May 2021 20:03:16 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230124AbhEKUEW (ORCPT ); Tue, 11 May 2021 16:04:22 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:40478 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229954AbhEKUEW (ORCPT ); Tue, 11 May 2021 16:04:22 -0400 Received: from mail-qv1-xf2d.google.com (mail-qv1-xf2d.google.com [IPv6:2607:f8b0:4864:20::f2d]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id EA4BFC061574 for ; Tue, 11 May 2021 13:03:14 -0700 (PDT) Received: by mail-qv1-xf2d.google.com with SMTP id dl3so10878460qvb.3 for ; Tue, 11 May 2021 13:03:14 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=yjdqO/ymwXUGPgxx6yXUTGCdJ9WveRBNFiN5g1q5zPQ=; b=Dd4GXk+zjL7XbER1XcWhgJxawyjGpDWxhoDbVzKPSaTTI+d+m4j9Urz7YMKy1k0IoY bL4oTgsWGee2Gav4TOA3pUOOvMCOkbyUdyHI+jD52E/ft3UAxLvPGnsrH5rRGSYZ93K7 q9VID86PztJatuLi+1WtD0SqjZkNrazw5JVSMsVwoH+mLl3cwO+k6Vd4BY2OBRHYelGf NB+rzp4TpTinrNiZhjsn1XYRQpXWATCzHjIYQuE21C1SuH1qSX1YFHKIZkT/jNWvjG3T 0+yW+eyNeKiK3eaQeTOZOZ/2qM03Af+V4GlxvWZ6XaIjh6aofdWRwLW+sj9xg6WsM0wf rzsQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=yjdqO/ymwXUGPgxx6yXUTGCdJ9WveRBNFiN5g1q5zPQ=; b=KUQbbAZkh6P4gxO8HT/3Hh5PeXLhxvzkZEmwg1ovZq8s/0EEy/apQYljeK7aPUTijs JWNdjF0NcHczGPpqeB85TGjeyIke/DXOMhNPdHFUi36azdbAX1vTyIN4PvXmwP84Jd0d tpk9CnzJQ1nEit9lQCppw1TTyYOwxt7FX9vsnVTdN56C81B+BS27diB3Y3rL662Dn+v8 blewO/BUaVXSS6mxudVgwtiezAqAJ80qS4z0bf3FDZAhIwwoRXXxEfxOf2MO+GXnDAIT V+9HOKfOwYiGe9VdM2MNMvLMZ+lmXzLsIRoDpr5gIYEldL3cs9ShPP4ByfO57Xl1KlJo tcWQ== X-Gm-Message-State: AOAM532fVKvjXssCHwX8bGXBXfC3izQA2y6AdcXhcep+r4hkhX2gRR1s VADH3Bh63Z5zWfdJDVrBBDLnrB/GSAYp8g== X-Google-Smtp-Source: ABdhPJy5BNxwzDasw48w41V0hZj52Ib0W2IUuX1QCxiu/3PwCzc+3AmJ554q0d9/9NpZm7K6lDhYMQ== X-Received: by 2002:a0c:9c0f:: with SMTP id v15mr26362745qve.24.1620763393481; Tue, 11 May 2021 13:03:13 -0700 (PDT) Received: from localhost.localdomain (c-73-200-157-122.hsd1.md.comcast.net. [73.200.157.122]) by smtp.gmail.com with ESMTPSA id z9sm4642533qtf.10.2021.05.11.13.03.12 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 11 May 2021 13:03:13 -0700 (PDT) From: James Carter To: selinux@vger.kernel.org Cc: James Carter Subject: [PATCH 3/5 v2] libsepo/cil: Refactor macro call resolution Date: Tue, 11 May 2021 16:02:59 -0400 Message-Id: <20210511200301.407855-4-jwcart2@gmail.com> X-Mailer: git-send-email 2.26.3 In-Reply-To: <20210511200301.407855-1-jwcart2@gmail.com> References: <20210511200301.407855-1-jwcart2@gmail.com> MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: selinux@vger.kernel.org Rename cil_resolve_call1() as cil resolve_call() and rename cil_resolve_call2() as cil_resolve_call_args() to make it clearer what is being done in each function. Move code to build call arguments out of cil_resolve_call() and into the new function called cil_build_call_args() so that the logic of cil_resolve_call() can be seen. Exit cil_resolve_call() immediately if the call has already been copied. In __cil_resolve_ast_node(), only resolve calls outside of macros. This results in more calls to cil_copy_ast(), but slightly less rules copied overall (since no rules are copied into a macro). This also means that the CIL_PASS_MACRO pass is not needed and can be eliminated. Signed-off-by: James Carter --- libsepol/cil/src/cil_internal.h | 1 - libsepol/cil/src/cil_resolve_ast.c | 599 +++++++++++++++-------------- 2 files changed, 303 insertions(+), 297 deletions(-) diff --git a/libsepol/cil/src/cil_internal.h b/libsepol/cil/src/cil_internal.h index 74e0b34d..a77c9520 100644 --- a/libsepol/cil/src/cil_internal.h +++ b/libsepol/cil/src/cil_internal.h @@ -59,7 +59,6 @@ enum cil_pass { CIL_PASS_BLKIN_LINK, CIL_PASS_BLKIN_COPY, CIL_PASS_BLKABS, - CIL_PASS_MACRO, CIL_PASS_CALL1, CIL_PASS_CALL2, CIL_PASS_ALIAS1, diff --git a/libsepol/cil/src/cil_resolve_ast.c b/libsepol/cil/src/cil_resolve_ast.c index bbe86e22..b96118ce 100644 --- a/libsepol/cil/src/cil_resolve_ast.c +++ b/libsepol/cil/src/cil_resolve_ast.c @@ -2840,359 +2840,371 @@ exit: return rc; } -int cil_resolve_call1(struct cil_tree_node *current, void *extra_args) +static int cil_build_call_args(struct cil_tree_node *call_node, struct cil_call *call, struct cil_macro *macro, void *extra_args) { - struct cil_call *new_call = current->data; struct cil_args_resolve *args = extra_args; - struct cil_db *db = NULL; - struct cil_tree_node *macro_node = NULL; - struct cil_symtab_datum *macro_datum = NULL; + struct cil_list_item *item; + struct cil_args *arg = NULL; + struct cil_tree_node *arg_node = NULL; int rc = SEPOL_ERR; - if (args != NULL) { - db = args->db; + if (macro->params == NULL) { + if (call->args_tree == NULL) { + return SEPOL_OK; + } else { + cil_tree_log(call_node, CIL_ERR, "Unexpected arguments"); + return SEPOL_ERR;; + } } - - rc = cil_resolve_name(current, new_call->macro_str, CIL_SYM_BLOCKS, extra_args, ¯o_datum); - if (rc != SEPOL_OK) { - goto exit; + if (call->args_tree == NULL) { + cil_tree_log(call_node, CIL_ERR, "Missing arguments"); + return SEPOL_ERR; } - macro_node = NODE(macro_datum); + arg_node = call->args_tree->root->cl_head; - if (macro_node->flavor != CIL_MACRO) { - cil_tree_log(current, CIL_ERR, "Failed to resolve %s to a macro", new_call->macro_str); - rc = SEPOL_ERR; - goto exit; - } - new_call->macro = (struct cil_macro*)macro_datum; + cil_list_init(&call->args, CIL_LIST_ITEM); - if (new_call->macro->params != NULL ) { + cil_list_for_each(item, macro->params) { + enum cil_flavor flavor = ((struct cil_param*)item->data)->flavor; - struct cil_list_item *item; - struct cil_args *new_arg = NULL; - struct cil_tree_node *pc = NULL; - - if (new_call->args_tree == NULL) { - cil_tree_log(current, CIL_ERR, "Missing arguments"); + if (arg_node == NULL) { + cil_tree_log(call_node, CIL_ERR, "Missing arguments"); + rc = SEPOL_ERR; + goto exit; + } + if (item->flavor != CIL_PARAM) { rc = SEPOL_ERR; goto exit; } - pc = new_call->args_tree->root->cl_head; - - cil_list_init(&new_call->args, CIL_LIST_ITEM); - - cil_list_for_each(item, new_call->macro->params) { - enum cil_flavor flavor = ((struct cil_param*)item->data)->flavor; + cil_args_init(&arg); - if (pc == NULL) { - cil_tree_log(current, CIL_ERR, "Missing arguments"); + switch (flavor) { + case CIL_NAME: { + struct cil_name *name; + if (arg_node->data == NULL) { + cil_tree_log(call_node, CIL_ERR, "Invalid macro parameter"); + cil_destroy_args(arg); rc = SEPOL_ERR; goto exit; } - if (item->flavor != CIL_PARAM) { + name = __cil_insert_name(args->db, arg_node->data, call_node); + if (name != NULL) { + arg->arg = (struct cil_symtab_datum *)name; + } else { + arg->arg_str = arg_node->data; + } + } + break; + case CIL_TYPE: + if (arg_node->data == NULL) { + cil_tree_log(call_node, CIL_ERR, "Invalid macro parameter"); + cil_destroy_args(arg); rc = SEPOL_ERR; goto exit; } - - cil_args_init(&new_arg); - - switch (flavor) { - case CIL_NAME: { - struct cil_name *name; - if (pc->data == NULL) { - cil_tree_log(current, CIL_ERR, "Invalid macro parameter"); - cil_destroy_args(new_arg); - rc = SEPOL_ERR; - goto exit; - } - name = __cil_insert_name(args->db, pc->data, current); - if (name != NULL) { - new_arg->arg = (struct cil_symtab_datum *)name; - } else { - new_arg->arg_str = pc->data; - } + arg->arg_str = arg_node->data; + break; + case CIL_ROLE: + if (arg_node->data == NULL) { + cil_tree_log(call_node, CIL_ERR, "Invalid macro parameter"); + cil_destroy_args(arg); + rc = SEPOL_ERR; + goto exit; } - break; - case CIL_TYPE: - if (pc->data == NULL) { - cil_tree_log(current, CIL_ERR, "Invalid macro parameter"); - cil_destroy_args(new_arg); - rc = SEPOL_ERR; - goto exit; - } - new_arg->arg_str = pc->data; - break; - case CIL_ROLE: - if (pc->data == NULL) { - cil_tree_log(current, CIL_ERR, "Invalid macro parameter"); - cil_destroy_args(new_arg); - rc = SEPOL_ERR; - goto exit; - } - new_arg->arg_str = pc->data; - break; - case CIL_USER: - if (pc->data == NULL) { - cil_tree_log(current, CIL_ERR, "Invalid macro parameter"); - cil_destroy_args(new_arg); - rc = SEPOL_ERR; - goto exit; - } - new_arg->arg_str = pc->data; - break; - case CIL_SENS: - if (pc->data == NULL) { - cil_tree_log(current, CIL_ERR, "Invalid macro parameter"); - cil_destroy_args(new_arg); - rc = SEPOL_ERR; - goto exit; - } - new_arg->arg_str = pc->data; - break; - case CIL_CAT: - if (pc->data == NULL) { - cil_tree_log(current, CIL_ERR, "Invalid macro parameter"); - cil_destroy_args(new_arg); - rc = SEPOL_ERR; - goto exit; - } - new_arg->arg_str = pc->data; - break; - case CIL_BOOL: - if (pc->data == NULL) { - cil_tree_log(current, CIL_ERR, "Invalid macro parameter"); - cil_destroy_args(new_arg); - rc = SEPOL_ERR; - goto exit; - } - new_arg->arg_str = pc->data; - break; - case CIL_CATSET: { - if (pc->cl_head != NULL) { - struct cil_catset *catset = NULL; - struct cil_tree_node *cat_node = NULL; - cil_catset_init(&catset); - rc = cil_fill_cats(pc, &catset->cats); - if (rc != SEPOL_OK) { - cil_destroy_catset(catset); - cil_destroy_args(new_arg); - goto exit; - } - cil_tree_node_init(&cat_node); - cat_node->flavor = CIL_CATSET; - cat_node->data = catset; - cil_list_append(((struct cil_symtab_datum*)catset)->nodes, - CIL_LIST_ITEM, cat_node); - new_arg->arg = (struct cil_symtab_datum*)catset; - } else if (pc->data == NULL) { - cil_tree_log(current, CIL_ERR, "Invalid macro parameter"); - cil_destroy_args(new_arg); - rc = SEPOL_ERR; + arg->arg_str = arg_node->data; + break; + case CIL_USER: + if (arg_node->data == NULL) { + cil_tree_log(call_node, CIL_ERR, "Invalid macro parameter"); + cil_destroy_args(arg); + rc = SEPOL_ERR; + goto exit; + } + arg->arg_str = arg_node->data; + break; + case CIL_SENS: + if (arg_node->data == NULL) { + cil_tree_log(call_node, CIL_ERR, "Invalid macro parameter"); + cil_destroy_args(arg); + rc = SEPOL_ERR; + goto exit; + } + arg->arg_str = arg_node->data; + break; + case CIL_CAT: + if (arg_node->data == NULL) { + cil_tree_log(call_node, CIL_ERR, "Invalid macro parameter"); + cil_destroy_args(arg); + rc = SEPOL_ERR; + goto exit; + } + arg->arg_str = arg_node->data; + break; + case CIL_BOOL: + if (arg_node->data == NULL) { + cil_tree_log(call_node, CIL_ERR, "Invalid macro parameter"); + cil_destroy_args(arg); + rc = SEPOL_ERR; + goto exit; + } + arg->arg_str = arg_node->data; + break; + case CIL_CATSET: { + if (arg_node->cl_head != NULL) { + struct cil_catset *catset = NULL; + struct cil_tree_node *cat_node = NULL; + cil_catset_init(&catset); + rc = cil_fill_cats(arg_node, &catset->cats); + if (rc != SEPOL_OK) { + cil_destroy_catset(catset); + cil_destroy_args(arg); goto exit; - } else { - new_arg->arg_str = pc->data; } - - break; + cil_tree_node_init(&cat_node); + cat_node->flavor = CIL_CATSET; + cat_node->data = catset; + cil_list_append(((struct cil_symtab_datum*)catset)->nodes, + CIL_LIST_ITEM, cat_node); + arg->arg = (struct cil_symtab_datum*)catset; + } else if (arg_node->data == NULL) { + cil_tree_log(call_node, CIL_ERR, "Invalid macro parameter"); + cil_destroy_args(arg); + rc = SEPOL_ERR; + goto exit; + } else { + arg->arg_str = arg_node->data; } - case CIL_LEVEL: { - if (pc->cl_head != NULL) { - struct cil_level *level = NULL; - struct cil_tree_node *lvl_node = NULL; - cil_level_init(&level); - - rc = cil_fill_level(pc->cl_head, level); - if (rc != SEPOL_OK) { - cil_log(CIL_ERR, "Failed to create anonymous level, rc: %d\n", rc); - cil_destroy_level(level); - cil_destroy_args(new_arg); - goto exit; - } - cil_tree_node_init(&lvl_node); - lvl_node->flavor = CIL_LEVEL; - lvl_node->data = level; - cil_list_append(((struct cil_symtab_datum*)level)->nodes, - CIL_LIST_ITEM, lvl_node); - new_arg->arg = (struct cil_symtab_datum*)level; - } else if (pc->data == NULL) { - cil_tree_log(current, CIL_ERR, "Invalid macro parameter"); - cil_destroy_args(new_arg); - rc = SEPOL_ERR; + + break; + } + case CIL_LEVEL: { + if (arg_node->cl_head != NULL) { + struct cil_level *level = NULL; + struct cil_tree_node *lvl_node = NULL; + cil_level_init(&level); + + rc = cil_fill_level(arg_node->cl_head, level); + if (rc != SEPOL_OK) { + cil_log(CIL_ERR, "Failed to create anonymous level, rc: %d\n", rc); + cil_destroy_level(level); + cil_destroy_args(arg); goto exit; - } else { - new_arg->arg_str = pc->data; } - - break; + cil_tree_node_init(&lvl_node); + lvl_node->flavor = CIL_LEVEL; + lvl_node->data = level; + cil_list_append(((struct cil_symtab_datum*)level)->nodes, + CIL_LIST_ITEM, lvl_node); + arg->arg = (struct cil_symtab_datum*)level; + } else if (arg_node->data == NULL) { + cil_tree_log(call_node, CIL_ERR, "Invalid macro parameter"); + cil_destroy_args(arg); + rc = SEPOL_ERR; + goto exit; + } else { + arg->arg_str = arg_node->data; } - case CIL_LEVELRANGE: { - if (pc->cl_head != NULL) { - struct cil_levelrange *range = NULL; - struct cil_tree_node *range_node = NULL; - cil_levelrange_init(&range); - - rc = cil_fill_levelrange(pc->cl_head, range); - if (rc != SEPOL_OK) { - cil_log(CIL_ERR, "Failed to create anonymous levelrange, rc: %d\n", rc); - cil_destroy_levelrange(range); - cil_destroy_args(new_arg); - goto exit; - } - cil_tree_node_init(&range_node); - range_node->flavor = CIL_LEVELRANGE; - range_node->data = range; - cil_list_append(((struct cil_symtab_datum*)range)->nodes, - CIL_LIST_ITEM, range_node); - new_arg->arg = (struct cil_symtab_datum*)range; - } else if (pc->data == NULL) { - cil_tree_log(current, CIL_ERR, "Invalid macro parameter"); - cil_destroy_args(new_arg); - rc = SEPOL_ERR; + + break; + } + case CIL_LEVELRANGE: { + if (arg_node->cl_head != NULL) { + struct cil_levelrange *range = NULL; + struct cil_tree_node *range_node = NULL; + cil_levelrange_init(&range); + + rc = cil_fill_levelrange(arg_node->cl_head, range); + if (rc != SEPOL_OK) { + cil_log(CIL_ERR, "Failed to create anonymous levelrange, rc: %d\n", rc); + cil_destroy_levelrange(range); + cil_destroy_args(arg); goto exit; - } else { - new_arg->arg_str = pc->data; } - - break; + cil_tree_node_init(&range_node); + range_node->flavor = CIL_LEVELRANGE; + range_node->data = range; + cil_list_append(((struct cil_symtab_datum*)range)->nodes, + CIL_LIST_ITEM, range_node); + arg->arg = (struct cil_symtab_datum*)range; + } else if (arg_node->data == NULL) { + cil_tree_log(call_node, CIL_ERR, "Invalid macro parameter"); + cil_destroy_args(arg); + rc = SEPOL_ERR; + goto exit; + } else { + arg->arg_str = arg_node->data; } - case CIL_IPADDR: { - if (pc->cl_head != NULL) { - struct cil_ipaddr *ipaddr = NULL; - struct cil_tree_node *addr_node = NULL; - cil_ipaddr_init(&ipaddr); - - rc = cil_fill_ipaddr(pc->cl_head, ipaddr); - if (rc != SEPOL_OK) { - cil_log(CIL_ERR, "Failed to create anonymous ip address, rc: %d\n", rc); - cil_destroy_ipaddr(ipaddr); - cil_destroy_args(new_arg); - goto exit; - } - cil_tree_node_init(&addr_node); - addr_node->flavor = CIL_IPADDR; - addr_node->data = ipaddr; - cil_list_append(((struct cil_symtab_datum*)ipaddr)->nodes, - CIL_LIST_ITEM, addr_node); - new_arg->arg = (struct cil_symtab_datum*)ipaddr; - } else if (pc->data == NULL) { - cil_tree_log(current, CIL_ERR, "Invalid macro parameter"); - cil_destroy_args(new_arg); - rc = SEPOL_ERR; + + break; + } + case CIL_IPADDR: { + if (arg_node->cl_head != NULL) { + struct cil_ipaddr *ipaddr = NULL; + struct cil_tree_node *addr_node = NULL; + cil_ipaddr_init(&ipaddr); + + rc = cil_fill_ipaddr(arg_node->cl_head, ipaddr); + if (rc != SEPOL_OK) { + cil_log(CIL_ERR, "Failed to create anonymous ip address, rc: %d\n", rc); + cil_destroy_ipaddr(ipaddr); + cil_destroy_args(arg); goto exit; - } else { - new_arg->arg_str = pc->data; } + cil_tree_node_init(&addr_node); + addr_node->flavor = CIL_IPADDR; + addr_node->data = ipaddr; + cil_list_append(((struct cil_symtab_datum*)ipaddr)->nodes, + CIL_LIST_ITEM, addr_node); + arg->arg = (struct cil_symtab_datum*)ipaddr; + } else if (arg_node->data == NULL) { + cil_tree_log(call_node, CIL_ERR, "Invalid macro parameter"); + cil_destroy_args(arg); + rc = SEPOL_ERR; + goto exit; + } else { + arg->arg_str = arg_node->data; + } - break; + break; + } + case CIL_CLASS: + if (arg_node->data == NULL) { + cil_tree_log(call_node, CIL_ERR, "Invalid macro parameter"); + cil_destroy_args(arg); + rc = SEPOL_ERR; + goto exit; } - case CIL_CLASS: - if (pc->data == NULL) { - cil_tree_log(current, CIL_ERR, "Invalid macro parameter"); - cil_destroy_args(new_arg); - rc = SEPOL_ERR; - goto exit; - } - new_arg->arg_str = pc->data; - break; - case CIL_MAP_CLASS: - if (pc->data == NULL) { - cil_tree_log(current, CIL_ERR, "Invalid macro parameter"); - cil_destroy_args(new_arg); - rc = SEPOL_ERR; - goto exit; - } - new_arg->arg_str = pc->data; - break; - case CIL_CLASSPERMISSION: { - if (pc->cl_head != NULL) { - struct cil_classpermission *cp = NULL; - struct cil_tree_node *cp_node = NULL; - - cil_classpermission_init(&cp); - rc = cil_fill_classperms_list(pc, &cp->classperms); - if (rc != SEPOL_OK) { - cil_log(CIL_ERR, "Failed to create anonymous classpermission\n"); - cil_destroy_classpermission(cp); - cil_destroy_args(new_arg); - goto exit; - } - cil_tree_node_init(&cp_node); - cp_node->flavor = CIL_CLASSPERMISSION; - cp_node->data = cp; - cil_list_append(cp->datum.nodes, CIL_LIST_ITEM, cp_node); - new_arg->arg = (struct cil_symtab_datum*)cp; - } else if (pc->data == NULL) { - cil_tree_log(current, CIL_ERR, "Invalid macro parameter"); - cil_destroy_args(new_arg); - rc = SEPOL_ERR; + arg->arg_str = arg_node->data; + break; + case CIL_MAP_CLASS: + if (arg_node->data == NULL) { + cil_tree_log(call_node, CIL_ERR, "Invalid macro parameter"); + cil_destroy_args(arg); + rc = SEPOL_ERR; + goto exit; + } + arg->arg_str = arg_node->data; + break; + case CIL_CLASSPERMISSION: { + if (arg_node->cl_head != NULL) { + struct cil_classpermission *cp = NULL; + struct cil_tree_node *cp_node = NULL; + + cil_classpermission_init(&cp); + rc = cil_fill_classperms_list(arg_node, &cp->classperms); + if (rc != SEPOL_OK) { + cil_log(CIL_ERR, "Failed to create anonymous classpermission\n"); + cil_destroy_classpermission(cp); + cil_destroy_args(arg); goto exit; - } else { - new_arg->arg_str = pc->data; } - break; - } - default: - cil_log(CIL_ERR, "Unexpected flavor: %d\n", - (((struct cil_param*)item->data)->flavor)); - cil_destroy_args(new_arg); + cil_tree_node_init(&cp_node); + cp_node->flavor = CIL_CLASSPERMISSION; + cp_node->data = cp; + cil_list_append(cp->datum.nodes, CIL_LIST_ITEM, cp_node); + arg->arg = (struct cil_symtab_datum*)cp; + } else if (arg_node->data == NULL) { + cil_tree_log(call_node, CIL_ERR, "Invalid macro parameter"); + cil_destroy_args(arg); rc = SEPOL_ERR; goto exit; + } else { + arg->arg_str = arg_node->data; } - new_arg->param_str = ((struct cil_param*)item->data)->str; - new_arg->flavor = flavor; - - cil_list_append(new_call->args, CIL_ARGS, new_arg); - - pc = pc->next; + break; } - - if (pc != NULL) { - cil_tree_log(current, CIL_ERR, "Unexpected arguments"); + default: + cil_log(CIL_ERR, "Unexpected flavor: %d\n", + (((struct cil_param*)item->data)->flavor)); + cil_destroy_args(arg); rc = SEPOL_ERR; goto exit; } - } else if (new_call->args_tree != NULL) { - cil_tree_log(current, CIL_ERR, "Unexpected arguments"); + arg->param_str = ((struct cil_param*)item->data)->str; + arg->flavor = flavor; + + cil_list_append(call->args, CIL_ARGS, arg); + + arg_node = arg_node->next; + } + + if (arg_node != NULL) { + cil_tree_log(call_node, CIL_ERR, "Unexpected arguments"); rc = SEPOL_ERR; goto exit; } - if (new_call->copied == 0) { - new_call->copied = 1; + return SEPOL_OK; - rc = cil_check_recursive_call(current, macro_node); - if (rc != SEPOL_OK) { - goto exit; - } +exit: + return rc; +} - rc = cil_copy_ast(db, macro_node, current); - if (rc != SEPOL_OK) { - cil_log(CIL_ERR, "Failed to copy macro, rc: %d\n", rc); - goto exit; - } +int cil_resolve_call(struct cil_tree_node *current, void *extra_args) +{ + struct cil_call *call = current->data; + struct cil_args_resolve *args = extra_args; + struct cil_tree_node *macro_node = NULL; + struct cil_symtab_datum *macro_datum = NULL; + int rc = SEPOL_ERR; + + if (call->copied) { + return SEPOL_OK; + } + + rc = cil_resolve_name(current, call->macro_str, CIL_SYM_BLOCKS, extra_args, ¯o_datum); + if (rc != SEPOL_OK) { + goto exit; + } + + macro_node = NODE(macro_datum); + + if (macro_node->flavor != CIL_MACRO) { + cil_tree_log(current, CIL_ERR, "Failed to resolve %s to a macro", call->macro_str); + rc = SEPOL_ERR; + goto exit; + } + call->macro = (struct cil_macro*)macro_datum; + + rc = cil_build_call_args(current, call, call->macro, extra_args); + if (rc != SEPOL_OK) { + goto exit; } + rc = cil_check_recursive_call(current, macro_node); + if (rc != SEPOL_OK) { + goto exit; + } + + rc = cil_copy_ast(args->db, macro_node, current); + if (rc != SEPOL_OK) { + cil_tree_log(current, CIL_ERR, "Failed to copy macro %s to call", macro_datum->name); + goto exit; + } + + call->copied = 1; + return SEPOL_OK; exit: return rc; } -int cil_resolve_call2(struct cil_tree_node *current, void *extra_args) +int cil_resolve_call_args(struct cil_tree_node *current, void *extra_args) { - struct cil_call *new_call = current->data; + struct cil_call *call = current->data; int rc = SEPOL_ERR; enum cil_sym_index sym_index = CIL_SYM_UNKNOWN; struct cil_list_item *item; - if (new_call->args == NULL) { + if (call->args == NULL) { rc = SEPOL_OK; goto exit; } - cil_list_for_each(item, new_call->args) { + cil_list_for_each(item, call->args) { struct cil_args *arg = item->data; if (arg->arg == NULL && arg->arg_str == NULL) { cil_log(CIL_ERR, "Arguments not created correctly\n"); @@ -3603,19 +3615,14 @@ int __cil_resolve_ast_node(struct cil_tree_node *node, void *extra_args) rc = cil_resolve_blockabstract(node, args); } break; - case CIL_PASS_MACRO: - if (node->flavor == CIL_CALL && args->macro != NULL) { - rc = cil_resolve_call1(node, args); - } - break; case CIL_PASS_CALL1: - if (node->flavor == CIL_CALL) { - rc = cil_resolve_call1(node, args); + if (node->flavor == CIL_CALL && args->macro == NULL) { + rc = cil_resolve_call(node, args); } break; case CIL_PASS_CALL2: - if (node->flavor == CIL_CALL) { - rc = cil_resolve_call2(node, args); + if (node->flavor == CIL_CALL && args->macro == NULL) { + rc = cil_resolve_call_args(node, args); } break; case CIL_PASS_ALIAS1: @@ -3919,7 +3926,7 @@ int __cil_resolve_ast_node_helper(struct cil_tree_node *node, uint32_t *finished } if (node->flavor == CIL_MACRO) { - if (pass != CIL_PASS_TIF && pass != CIL_PASS_MACRO) { + if (pass != CIL_PASS_TIF) { *finished = CIL_TREE_SKIP_HEAD; rc = SEPOL_OK; goto exit; From patchwork Tue May 11 20:03:00 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: James Carter X-Patchwork-Id: 12252003 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-15.8 required=3.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,FREEMAIL_FORGED_FROMDOMAIN,FREEMAIL_FROM, HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER,INCLUDES_PATCH, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 00ABCC43462 for ; Tue, 11 May 2021 20:03:17 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id B8CBE61376 for ; Tue, 11 May 2021 20:03:16 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229954AbhEKUEW (ORCPT ); Tue, 11 May 2021 16:04:22 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:40476 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S230097AbhEKUEW (ORCPT ); Tue, 11 May 2021 16:04:22 -0400 Received: from mail-qk1-x72f.google.com (mail-qk1-x72f.google.com [IPv6:2607:f8b0:4864:20::72f]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id EBADBC06174A for ; Tue, 11 May 2021 13:03:14 -0700 (PDT) Received: by mail-qk1-x72f.google.com with SMTP id x8so20072303qkl.2 for ; Tue, 11 May 2021 13:03:14 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=T7fqCYZsG61FPsk90V39010ZHwPFqE7pWXhqkZJPogU=; b=iTPH6Iz1+VwzOJCiM3wR+fbAmrgZuld23prxyDFzIBfPxMqj1vo9e4M7RddLM0mYmi PiaiL19+24PoKVEjL6kdeWheHAecfShG4e7A8Ne5EBrny0H1fad/s6ec7AvqBd//vmmm Du7bQW7vUwX13zjbR1Gft7HFhlLnIC8TXQT/3KhV1cVzfdUDAz96sWRHfGyfpsX7AAiV Aa1HkInF4PtTbEVBfF4WubyZ8qWwLCrrTh0Hx/DJkrRbgUOFM13tFKEmLC4+T4m58Ny1 RJVKGAG1n0IPF82s7fNszsH8lNP/H1zpynrsLlhnJ/HgKvX2/lrJU4cLKeP4aIH9vz83 ThlQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=T7fqCYZsG61FPsk90V39010ZHwPFqE7pWXhqkZJPogU=; b=i54kAssg7krN7Z2K5GPQ6vIxOm3BDTv6tT+z+5O17GYTNyYHbw0/U6amcjZ8GIdBjl XCF/51YgCMjKBJ4aLEMmaf/ugVl9VgStmu3lGE2SmlAAnrSt7DiTJfdTYa/WHeSNMNt1 9MTVVEenFRBE1MsBH9SZpH2LPhuB4Z1d1OnjNCUEmaR9rL3PnzQ7YBD1YVN4RHhqbEED LhPMjQSacQOLF/oSQGKwhMegsMD7dhwESdpxsjymOvpbTTGr3q08dlx0vAYCsT60Z2Si wTr60WK9AR/6U/QbsQszhgkrlxKDkw7up8iBSbRZWkwzmeW/zHJqfDRrbQ6lASVFi2Q5 q2qQ== X-Gm-Message-State: AOAM533vTz4GGWZLgNU0/VDyHXyVA4GM7ZqX30AbbZ6UjNNrXM45GfPl CZsAwXIKzOaelpA6IvSgxbbmOJfiCW3ErQ== X-Google-Smtp-Source: ABdhPJzvtnNSoOLxJOqEYR+ryvKjXtc1Z4DxXm28aFqO8tdfsjPesWhginMRQRnq2+EWf6f5eWSVSQ== X-Received: by 2002:ae9:e71a:: with SMTP id m26mr19980679qka.36.1620763394006; Tue, 11 May 2021 13:03:14 -0700 (PDT) Received: from localhost.localdomain (c-73-200-157-122.hsd1.md.comcast.net. [73.200.157.122]) by smtp.gmail.com with ESMTPSA id z9sm4642533qtf.10.2021.05.11.13.03.13 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 11 May 2021 13:03:13 -0700 (PDT) From: James Carter To: selinux@vger.kernel.org Cc: James Carter Subject: [PATCH 4/5 v2] libsepol/cil: Do not resolve arguments to declarations in the call Date: Tue, 11 May 2021 16:03:00 -0400 Message-Id: <20210511200301.407855-5-jwcart2@gmail.com> X-Mailer: git-send-email 2.26.3 In-Reply-To: <20210511200301.407855-1-jwcart2@gmail.com> References: <20210511200301.407855-1-jwcart2@gmail.com> MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: selinux@vger.kernel.org Lorenzo Ceragioli noted that the following policy: (type a) (block A (macro m ((type x)) (type a) (allow x x (file (read)))) ) (block B (call A.m(a)) ) results in the allow rule (allow B.a B.a (file(read))). This makes no sense because the "a" being passed as an argument has to be the global "a" and not the "a" defined in the macro. This behavior occurs because the call arguments are resolved AFTER the macro body has been copied and the declaration of "a" in the macro has been added to block B's namespace, so this is the "a" that the call argument resolves to, rather than the one in the global namespace. When resolving call arguments, check if the datum found belongs to a declaration in the call. If it does, then remove the datum from the symbol table, re-resolve the argument, and add the datum back into the symbol table. Signed-off-by: James Carter --- libsepol/cil/src/cil_resolve_ast.c | 28 +++++++++++++++++++++++++++- 1 file changed, 27 insertions(+), 1 deletion(-) diff --git a/libsepol/cil/src/cil_resolve_ast.c b/libsepol/cil/src/cil_resolve_ast.c index b96118ce..d416ce75 100644 --- a/libsepol/cil/src/cil_resolve_ast.c +++ b/libsepol/cil/src/cil_resolve_ast.c @@ -3287,11 +3287,37 @@ int cil_resolve_call_args(struct cil_tree_node *current, void *extra_args) } if (sym_index != CIL_SYM_UNKNOWN) { - rc = cil_resolve_name(current, arg->arg_str, sym_index, extra_args, &(arg->arg)); + struct cil_symtab_datum *datum; + struct cil_tree_node *n; + rc = cil_resolve_name(current, arg->arg_str, sym_index, extra_args, &datum); if (rc != SEPOL_OK) { cil_tree_log(current, CIL_ERR, "Failed to resolve %s in call argument list", arg->arg_str); goto exit; } + arg->arg = datum; + n = NODE(datum); + while (n && n->flavor != CIL_ROOT) { + if (n == current) { + symtab_t *s = datum->symtab; + /* Call arg should not resolve to declaration in the call + * Need to remove datum temporarily to resolve to a datum outside + * the call. + */ + cil_symtab_remove_datum(datum); + rc = cil_resolve_name(current, arg->arg_str, sym_index, extra_args, &(arg->arg)); + if (rc != SEPOL_OK) { + cil_tree_log(current, CIL_ERR, "Failed to resolve %s in call argument list", arg->arg_str); + goto exit; + } + rc = cil_symtab_insert(s, datum->name, datum, NULL); + if (rc != SEPOL_OK) { + cil_tree_log(current, CIL_ERR, "Failed to re-insert datum while resolving %s in call argument list", arg->arg_str); + goto exit; + } + break; + } + n = n->parent; + } } } From patchwork Tue May 11 20:03:01 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: James Carter X-Patchwork-Id: 12252005 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-15.8 required=3.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,FREEMAIL_FORGED_FROMDOMAIN,FREEMAIL_FROM, HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER,INCLUDES_PATCH, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 549E4C433ED for ; Tue, 11 May 2021 20:03:17 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 223F661376 for ; Tue, 11 May 2021 20:03:17 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230097AbhEKUEX (ORCPT ); Tue, 11 May 2021 16:04:23 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:40480 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S230129AbhEKUEX (ORCPT ); Tue, 11 May 2021 16:04:23 -0400 Received: from mail-qk1-x733.google.com (mail-qk1-x733.google.com [IPv6:2607:f8b0:4864:20::733]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 79E17C06175F for ; Tue, 11 May 2021 13:03:15 -0700 (PDT) Received: by mail-qk1-x733.google.com with SMTP id i67so20051697qkc.4 for ; Tue, 11 May 2021 13:03:15 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=Qc24INqDpH9n53QfFon6+NSiYgfprG80aEUo2dO32BE=; b=YzHl9I6HHqhj8JadwnJmtXbzKlzvjnx0JkrkbXklToFNLG+xoB+tjOR261iuZOpzrU oEWDVWT0INa+E4QSD0dsWzXOnS2oikBVuaHj24VSAa2mBI6RQLgcGsYOdU84WSCW1h2Y Y+Lb6q98j7B7JtVdL7+o6qJVoTf5LjBjaB3472S37DDVPxIZakxIjJoNwW8n3uB7DsZu TeaUM6GlhUWLkeVkWDwO2CG1yGZfTOvTkKVZfnLFMVe219tbE4XmDEfz0WOStaue8zch f4AAMchgT8fYEbmGUGhMgsypXnmNhfMFnKQH3yCZ2kh2xNxKeDOhwtsUNCVpd3U5KnIx 9gLg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=Qc24INqDpH9n53QfFon6+NSiYgfprG80aEUo2dO32BE=; b=DGRjdEvQP5bLrSnDO2iS1AW48oaCJzSJrvMq8VoBhNvupd3qkfi27kwWNz8R5IFHZP yjjBmx416BcY31fm5/rlltaCdcuhTVt/4W9bIJp+itIsKNM4Ek557j8GJxWWenZMT1SD abuZ7QJEDH0/GWKbsWCZHyLVVtGALi0O5xh/N0tcTrirjxpagaBguDyAUnooW29pYsHx OOzDEbE0vmO/quYpsEIHimdi9Giouk65aSSYIzroR6IVlElL9/1giFoM4cTj1sWXA0Ha PFnzsO6DYAXFM9XKL49rUvb5wk65W4mzin4Yez+NLS4U6vY+tJInSaz/jn0KiGlD4iUa 5VSw== X-Gm-Message-State: AOAM532NXY6Jp4V54C2PCERMfCxjIg7ANj0v/I20cWKHl/g5RXwayrQm IPGymRqNNLa8piF9R7xBAi5qMXZPvRDvNw== X-Google-Smtp-Source: ABdhPJye0DHyl1D0RjVE38Q6Fzw8odeeXDz8968Z/ehM1zTwZ1VDJh65ucDTxd8DREzuyOF24t21zA== X-Received: by 2002:a05:620a:3c3:: with SMTP id r3mr29016127qkm.35.1620763394606; Tue, 11 May 2021 13:03:14 -0700 (PDT) Received: from localhost.localdomain (c-73-200-157-122.hsd1.md.comcast.net. [73.200.157.122]) by smtp.gmail.com with ESMTPSA id z9sm4642533qtf.10.2021.05.11.13.03.14 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 11 May 2021 13:03:14 -0700 (PDT) From: James Carter To: selinux@vger.kernel.org Cc: James Carter Subject: [PATCH 5/5 v2] secilc/docs: Relocate and reword macro call name resolution order Date: Tue, 11 May 2021 16:03:01 -0400 Message-Id: <20210511200301.407855-6-jwcart2@gmail.com> X-Mailer: git-send-email 2.26.3 In-Reply-To: <20210511200301.407855-1-jwcart2@gmail.com> References: <20210511200301.407855-1-jwcart2@gmail.com> MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: selinux@vger.kernel.org The listing of the order was in the macro section, but it belongs in the call section. Move the listing of the order to the call section and provide a better explanation. Signed-off-by: James Carter --- secilc/docs/cil_call_macro_statements.md | 24 ++++++++++++------------ 1 file changed, 12 insertions(+), 12 deletions(-) diff --git a/secilc/docs/cil_call_macro_statements.md b/secilc/docs/cil_call_macro_statements.md index 352a9fb0..3cc14bf8 100644 --- a/secilc/docs/cil_call_macro_statements.md +++ b/secilc/docs/cil_call_macro_statements.md @@ -8,6 +8,18 @@ Instantiate a [macro](#macro) within the current namespace. There may be zero or Each parameter passed contains an argument to be resolved by the [macro](#macro), these can be named or anonymous but must conform to the parameter types defined in the [`macro`](cil_call_macro_statements.md#macro) statement. +Macro rules are resolved by searching in the following order: + +- The macro namespace (If found this means that the name was declared in the macro and is now declared in the namespace of one of the parents of the call.) + +- The call arguments + +- The parent namespaces of the macro being called (if any) with the exception of the global namespace. + +- The parent namespaces of the call (if any) with the exception of the global namespace. + +- The global namespace + **Statement definition:** ```secil @@ -46,18 +58,6 @@ macro Declare a macro in the current namespace with its associated parameters. The macro identifier is used by the [`call`](cil_call_macro_statements.md#call) statement to instantiate the macro and resolve any parameters. The call statement may be within the body of a macro. -When resolving macros the following places are checked in this order: - -- Items defined inside the macro - -- Items passed into the macro as arguments - -- Items defined in the same namespace of the macro - -- Items defined in the callers namespace - -- Items defined in the global namespace - [`tunable`](cil_conditional_statements.md#tunable), [`in`](cil_container_statements.md#in), [`block`](cil_container_statements.md#block), [`blockinherit`](cil_container_statements.md#blockinherit), [`blockabstract`](cil_container_statements.md#blockabstract), and other [`macro`](cil_call_macro_statements.md#macro) statements are not allowed in [`macro`](cil_call_macro_statements.md#macro) blocks. **Statement definition:**