From patchwork Fri Mar 31 17:34:40 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: =?utf-8?q?Christian_G=C3=B6ttsche?= X-Patchwork-Id: 13196422 X-Patchwork-Delegate: plautrba@redhat.com Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 8CB10C761A6 for ; Fri, 31 Mar 2023 17:35:09 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230336AbjCaRfI (ORCPT ); Fri, 31 Mar 2023 13:35:08 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:60036 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229967AbjCaRfH (ORCPT ); Fri, 31 Mar 2023 13:35:07 -0400 Received: from mail-ed1-x52f.google.com (mail-ed1-x52f.google.com [IPv6:2a00:1450:4864:20::52f]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 4180B1E718 for ; Fri, 31 Mar 2023 10:35:06 -0700 (PDT) Received: by mail-ed1-x52f.google.com with SMTP id h8so92601323ede.8 for ; Fri, 31 Mar 2023 10:35:06 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=googlemail.com; s=20210112; t=1680284105; h=content-transfer-encoding:mime-version:message-id:date:subject:to :from:from:to:cc:subject:date:message-id:reply-to; bh=gWIzJNhIhCHy8SJIB0mB5mC6ccpzgVRifADrYuM4Tb4=; b=N/b3Jzlvdg4jxOO+ZD3wNCosxdVakJgZJvDw9+urUfxm/fGaaVA13Yg6/29U0HfiOe 7bXSmHzDR3eIBLjX34lbMhZFnOoQOnO3B4aJN/Sltdl1r+mZDmA5fEyC2QNe8uldfDoa n7UJUFXQJYA94Oroyo+HqWXeBma/Q5Ldkoie5lBHMWRyORZ3oHovi6et8j+guUrZ+fmN PivY6Spd0TrHVlynYbEFHjDHPVJKGnbM+4PZrkLn8he+RnDorm44deOCs69VZpW3GVOF NNRUs/DeXul6MTMbRBmEIuusM+cx624cWGgXZy1j1Rvu1QaNk7Z5y0+d3/V21sDtJurY tYGA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; t=1680284105; h=content-transfer-encoding:mime-version:message-id:date:subject:to :from:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=gWIzJNhIhCHy8SJIB0mB5mC6ccpzgVRifADrYuM4Tb4=; b=mgDUmJj16jLsLkh8yi3+WkLjT9/RM5zN5IqA5PqEG2uZZXdJhDIBEeuufkHK2RNyry 47qPArGEvWrxL1ITrS+pNLeOGIuUsaf0qLg9YTUXafbby0H3GvLGtUUR+/D0HdnK06wa Ju4k0zDjB3V5Je9JoHi59lNGmz2aOZEDZEdhsfXSO9yRMfcFZosl9KZlssd3K9Ht75W0 Gzo+jxqLu2lKyd6KSx1epotE8MDxUeAWG+18/6KCIdZg+SQMpao7oI7jC55Jh1kZXwRT /acpsoN3UyM1XBNwE7RO6DTnwIZrN92CV1iLJubyWvMMDY409efytBYdXhTeXZVDmlOx MFBw== X-Gm-Message-State: AAQBX9cW0CEMc842WRsoYOJbYyhlje2oYTX/ldJ7/UaguHJoov0u2lza eI4JsCvn+9n14s37vqnI9pobyN5Gd/Lph3qV X-Google-Smtp-Source: AKy350bx1PgtUzcpyHBbvIC2cvTLTbrg9aCmIk493o8Kc7Zcu9otIvs/wmqOe/wldG8qUGIsz+XGXQ== X-Received: by 2002:a17:906:2b8e:b0:946:c022:8979 with SMTP id m14-20020a1709062b8e00b00946c0228979mr15912962ejg.21.1680284104675; Fri, 31 Mar 2023 10:35:04 -0700 (PDT) Received: from debianHome.localdomain (dynamic-077-010-126-250.77.10.pool.telefonica.de. [77.10.126.250]) by smtp.gmail.com with ESMTPSA id h5-20020a50c385000000b004ad601533a3sm1303138edf.55.2023.03.31.10.35.04 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 31 Mar 2023 10:35:04 -0700 (PDT) From: =?utf-8?q?Christian_G=C3=B6ttsche?= To: selinux@vger.kernel.org Subject: [PATCH 1/3] checkpolicy: add option to skip checking neverallow rules Date: Fri, 31 Mar 2023 19:34:40 +0200 Message-Id: <20230331173442.101678-1-cgzones@googlemail.com> X-Mailer: git-send-email 2.40.0 MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: selinux@vger.kernel.org Add the command line argument `-N/--disable-neverallow`, similar to secilc(8), to checkpolicy(8) and checkmodule(8) to skip the check of neverallow rule violations. This is mainly useful in development, e.g. to quickly add rules to a policy without fulfilling all neverallow rules or build policies with known violations. Signed-off-by: Christian Göttsche --- checkpolicy/checkmodule.8 | 5 ++++- checkpolicy/checkmodule.c | 13 +++++++++---- checkpolicy/checkpolicy.8 | 5 ++++- checkpolicy/checkpolicy.c | 12 ++++++++---- 4 files changed, 25 insertions(+), 10 deletions(-) diff --git a/checkpolicy/checkmodule.8 b/checkpolicy/checkmodule.8 index 1061a6f2..ed9efd4c 100644 --- a/checkpolicy/checkmodule.8 +++ b/checkpolicy/checkmodule.8 @@ -3,7 +3,7 @@ checkmodule \- SELinux policy module compiler .SH SYNOPSIS .B checkmodule -.I "[\-h] [\-b] [\-c policy_version] [\-C] [\-E] [\-m] [\-M] [\-U handle_unknown] [\-V] [\-o output_file] [input_file]" +.I "[\-h] [\-b] [\-c policy_version] [\-C] [\-E] [\-m] [\-M] [\-N] [\-U handle_unknown] [\-V] [\-o output_file] [input_file]" .SH "DESCRIPTION" This manual page describes the .BR checkmodule @@ -43,6 +43,9 @@ Generate a non-base policy module. .B \-M,\-\-mls Enable the MLS/MCS support when checking and compiling the policy module. .TP +.B \-N,\-\-disable-neverallow +Do not check neverallow rules. +.TP .B \-V,\-\-version Show policy versions created by this program. .TP diff --git a/checkpolicy/checkmodule.c b/checkpolicy/checkmodule.c index 3432608b..4f0d7bbe 100644 --- a/checkpolicy/checkmodule.c +++ b/checkpolicy/checkmodule.c @@ -123,7 +123,7 @@ static int write_binary_policy(policydb_t * p, FILE *outfp) static __attribute__((__noreturn__)) void usage(const char *progname) { - printf("usage: %s [-h] [-V] [-b] [-C] [-E] [-U handle_unknown] [-m] [-M] [-o FILE] [-c VERSION] [INPUT]\n", progname); + printf("usage: %s [-h] [-V] [-b] [-C] [-E] [-U handle_unknown] [-m] [-M] [-N] [-o FILE] [-c VERSION] [INPUT]\n", progname); printf("Build base and policy modules.\n"); printf("Options:\n"); printf(" INPUT build module from INPUT (else read from \"%s\")\n", @@ -139,6 +139,7 @@ static __attribute__((__noreturn__)) void usage(const char *progname) printf(" allow: Allow unknown kernel checks\n"); printf(" -m build a policy module instead of a base module\n"); printf(" -M enable MLS policy\n"); + printf(" -N do not check neverallow rules\n"); printf(" -o FILE write module to FILE (else just check syntax)\n"); printf(" -c VERSION build a policy module targeting a modular policy version (%d-%d)\n", MOD_POLICYDB_VERSION_MIN, MOD_POLICYDB_VERSION_MAX); @@ -148,7 +149,7 @@ static __attribute__((__noreturn__)) void usage(const char *progname) int main(int argc, char **argv) { const char *file = txtfile, *outfile = NULL; - unsigned int binary = 0, cil = 0; + unsigned int binary = 0, cil = 0, check_neverallow = 1; int ch; int show_version = 0; policydb_t modpolicydb; @@ -159,12 +160,13 @@ int main(int argc, char **argv) {"version", no_argument, NULL, 'V'}, {"handle-unknown", required_argument, NULL, 'U'}, {"mls", no_argument, NULL, 'M'}, + {"disable-neverallow", no_argument, NULL, 'N'}, {"cil", no_argument, NULL, 'C'}, {"werror", no_argument, NULL, 'E'}, {NULL, 0, NULL, 0} }; - while ((ch = getopt_long(argc, argv, "ho:bVEU:mMCc:", long_options, NULL)) != -1) { + while ((ch = getopt_long(argc, argv, "ho:bVEU:mMNCc:", long_options, NULL)) != -1) { switch (ch) { case 'h': usage(argv[0]); @@ -202,6 +204,9 @@ int main(int argc, char **argv) case 'M': mlspol = 1; break; + case 'N': + check_neverallow = 0; + break; case 'C': cil = 1; break; @@ -317,7 +322,7 @@ int main(int argc, char **argv) fprintf(stderr, "%s: link modules failed\n", argv[0]); exit(1); } - if (expand_module(NULL, &modpolicydb, &kernpolicydb, 0, 1)) { + if (expand_module(NULL, &modpolicydb, &kernpolicydb, /*verbose=*/0, check_neverallow)) { fprintf(stderr, "%s: expand module failed\n", argv[0]); exit(1); } diff --git a/checkpolicy/checkpolicy.8 b/checkpolicy/checkpolicy.8 index 2984c238..c66e084b 100644 --- a/checkpolicy/checkpolicy.8 +++ b/checkpolicy/checkpolicy.8 @@ -3,7 +3,7 @@ checkpolicy \- SELinux policy compiler .SH SYNOPSIS .B checkpolicy -.I "[\-b[F]] [\-C] [\-d] [\-U handle_unknown (allow,deny,reject)] [\-M] [\-c policyvers] [\-o output_file|\-] [\-S] [\-t target_platform (selinux,xen)] [\-O] [\-E] [\-V] [input_file]" +.I "[\-b[F]] [\-C] [\-d] [\-U handle_unknown (allow,deny,reject)] [\-M] [\-N] [\-c policyvers] [\-o output_file|\-] [\-S] [\-t target_platform (selinux,xen)] [\-O] [\-E] [\-V] [input_file]" .br .SH "DESCRIPTION" This manual page describes the @@ -38,6 +38,9 @@ Specify how the kernel should handle unknown classes or permissions (deny, allow .B \-M,\-\-mls Enable the MLS policy when checking and compiling the policy. .TP +.B \-N,\-\-disable-neverallow +Do not check neverallow rules. +.TP .B \-c policyvers Specify the policy version, defaults to the latest. .TP diff --git a/checkpolicy/checkpolicy.c b/checkpolicy/checkpolicy.c index 48c31261..209f36d8 100644 --- a/checkpolicy/checkpolicy.c +++ b/checkpolicy/checkpolicy.c @@ -109,7 +109,7 @@ static __attribute__((__noreturn__)) void usage(const char *progname) { printf ("usage: %s [-b[F]] [-C] [-d] [-U handle_unknown (allow,deny,reject)] [-M] " - "[-c policyvers (%d-%d)] [-o output_file|-] [-S] [-O] " + "[-N] [-c policyvers (%d-%d)] [-o output_file|-] [-S] [-O] " "[-t target_platform (selinux,xen)] [-E] [-V] [input_file]\n", progname, POLICYDB_VERSION_MIN, POLICYDB_VERSION_MAX); exit(1); @@ -393,7 +393,7 @@ int main(int argc, char **argv) size_t scontext_len, pathlen; unsigned int i; unsigned int protocol, port; - unsigned int binary = 0, debug = 0, sort = 0, cil = 0, conf = 0, optimize = 0; + unsigned int binary = 0, debug = 0, sort = 0, cil = 0, conf = 0, optimize = 0, check_neverallow = 1; struct val_to_name v; int ret, ch, fd, target = SEPOL_TARGET_SELINUX; unsigned int nel, uret; @@ -415,6 +415,7 @@ int main(int argc, char **argv) {"version", no_argument, NULL, 'V'}, {"handle-unknown", required_argument, NULL, 'U'}, {"mls", no_argument, NULL, 'M'}, + {"disable-neverallow", no_argument, NULL, 'N'}, {"cil", no_argument, NULL, 'C'}, {"conf",no_argument, NULL, 'F'}, {"sort", no_argument, NULL, 'S'}, @@ -424,7 +425,7 @@ int main(int argc, char **argv) {NULL, 0, NULL, 0} }; - while ((ch = getopt_long(argc, argv, "o:t:dbU:MCFSVc:OEh", long_options, NULL)) != -1) { + while ((ch = getopt_long(argc, argv, "o:t:dbU:MNCFSVc:OEh", long_options, NULL)) != -1) { switch (ch) { case 'o': outfile = optarg; @@ -473,6 +474,9 @@ int main(int argc, char **argv) case 'M': mlspol = 1; break; + case 'N': + check_neverallow = 0; + break; case 'C': cil = 1; break; @@ -630,7 +634,7 @@ int main(int argc, char **argv) fprintf(stderr, "%s: policydb_init failed\n", argv[0]); exit(1); } - if (expand_module(NULL, policydbp, &policydb, 0, 1)) { + if (expand_module(NULL, policydbp, &policydb, /*verbose=*/0, check_neverallow)) { fprintf(stderr, "Error while expanding policy\n"); exit(1); } From patchwork Fri Mar 31 17:34:41 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: =?utf-8?q?Christian_G=C3=B6ttsche?= X-Patchwork-Id: 13196423 X-Patchwork-Delegate: plautrba@redhat.com Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 20032C76196 for ; Fri, 31 Mar 2023 17:35:10 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229967AbjCaRfJ (ORCPT ); Fri, 31 Mar 2023 13:35:09 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:60068 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S230064AbjCaRfI (ORCPT ); Fri, 31 Mar 2023 13:35:08 -0400 Received: from mail-ed1-x534.google.com (mail-ed1-x534.google.com [IPv6:2a00:1450:4864:20::534]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id CD8CD1DFB7 for ; Fri, 31 Mar 2023 10:35:06 -0700 (PDT) Received: by mail-ed1-x534.google.com with SMTP id y4so92667213edo.2 for ; Fri, 31 Mar 2023 10:35:06 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=googlemail.com; s=20210112; t=1680284105; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to; bh=UogeGrUFgYor9PoY7iEhaLf4O71b3PRPDiz838AXgWo=; b=qfd4CzQZYTHqkPAtZXugBtC7zFiQ5EnRrMSKjh7Y4yTkZqFCFEF3GEOWSpqpkYF7Aq YuCFxBICBdiWSnd1ycITGO0infFFXiJ2d+aiHFXEGRk4vy4zu7uatujWYcasCgzSiFHf 0Jyzsz0Qs9F4vcuS/hAHNAElDgfOeODushed2Xr4UJ2EdlzBRfap8rsIUyIXbeRJh89A 0u5j1tGI8Mk83gIDDH26oIt5YFedh+IZaAidciQ9tHRFEihnAc4BWduM7kBJrEx+8VUX 4wsdbNYrS4D4drj1JD8AzmTqtRcnYJ8vBInobUZBQAvvUQmFl9nOiU0Z7mxdIdZcLcTH +7Jw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; t=1680284105; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=UogeGrUFgYor9PoY7iEhaLf4O71b3PRPDiz838AXgWo=; b=DuS0RygJKgAWrgN2Kh7pMk6hsAyyjKOap8L6i+7YPKMY6c2pP6e66dGzV6EhA0XFXy G1FhKwuSCiAmLJaWGEEizBTVZ5A10WCb0KupS6Xi0A1EzmxPzOro6/VSJHr8Pm6dwPpx rVt4JGdp1aSEp59fBTg954MXkHV2NcOXO88BnPI+8nhUC9p3/vJCmmJq05vYTotBBg7F VvOTLFiwYfa4GcgRKRlPvfYjnJCApYI1yAeflxnSS4FbonAnWhNLJTxNBIUGeF+6b0nV GEIKjTKxaP8tgntHngwj95REFbKqFgs/BEVzpLEos7detfYpCODXbGl27u/SgkOXMsVZ dczg== X-Gm-Message-State: AAQBX9fYMDOmXxiq+Lb71BxJ6BjSJIaCXv3J9Yo2Inf9afHVzN88pO5A Wy8qX65j+UNaGOD67Buc7lHJWPeJ33mR05HO X-Google-Smtp-Source: AKy350YGdlNGFlrnX21lz68W3ZbYpt79/ZQe8/ySvzCD/v7nHvv3scdoBpRmn0fbgS7Wq8F5LF1RKw== X-Received: by 2002:a50:fb11:0:b0:4fb:5291:13bb with SMTP id d17-20020a50fb11000000b004fb529113bbmr28699303edq.39.1680284105206; Fri, 31 Mar 2023 10:35:05 -0700 (PDT) Received: from debianHome.localdomain (dynamic-077-010-126-250.77.10.pool.telefonica.de. [77.10.126.250]) by smtp.gmail.com with ESMTPSA id h5-20020a50c385000000b004ad601533a3sm1303138edf.55.2023.03.31.10.35.04 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 31 Mar 2023 10:35:04 -0700 (PDT) From: =?utf-8?q?Christian_G=C3=B6ttsche?= To: selinux@vger.kernel.org Subject: [PATCH 2/3] checkpolicy/dispol: add output functions Date: Fri, 31 Mar 2023 19:34:41 +0200 Message-Id: <20230331173442.101678-2-cgzones@googlemail.com> X-Mailer: git-send-email 2.40.0 In-Reply-To: <20230331173442.101678-1-cgzones@googlemail.com> References: <20230331173442.101678-1-cgzones@googlemail.com> MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: selinux@vger.kernel.org Add the ability to show booleans, classes, roles, types and type attributes of policies. Signed-off-by: Christian Göttsche Acked-by: James Carter --- Almost all of the time seinfo(8) is a superior tool and several policy details are still not supported, e.g. genfscon, ocontexts and class constraints. dispol was however useful in the past to analyze some OSS-Fuzz generated policies, since seinfo trips over non-ascii identifier names. --- checkpolicy/test/dispol.c | 94 +++++++++++++++++++++++++++++++++++++++ 1 file changed, 94 insertions(+) diff --git a/checkpolicy/test/dispol.c b/checkpolicy/test/dispol.c index 36a3362c..adac2370 100644 --- a/checkpolicy/test/dispol.c +++ b/checkpolicy/test/dispol.c @@ -274,6 +274,18 @@ static int change_bool(char *name, int state, policydb_t * p, FILE * fp) return 0; } +static int display_booleans(policydb_t * p, FILE *fp) +{ + uint32_t i; + + fprintf(fp, "booleans:\n"); + for (i = 0; i < p->p_bools.nprim; i++) { + fprintf(fp, "\t%s : %d\n", p->p_bool_val_to_name[i], + p->bool_val_to_struct[i]->state); + } + return 0; +} + static void display_policycaps(policydb_t * p, FILE * fp) { ebitmap_node_t *node; @@ -292,6 +304,20 @@ static void display_policycaps(policydb_t * p, FILE * fp) } } +static int display_classes(policydb_t * p, FILE *fp) +{ + uint32_t i; + + fprintf(fp, "classes:\n"); + for (i = 0; i < p->p_classes.nprim; i++) { + if (!p->p_class_val_to_name[i]) + continue; + + fprintf(fp, "\t%s\n", p->p_class_val_to_name[i]); + } + return 0; +} + static void display_id(policydb_t *p, FILE *fp, uint32_t symbol_type, uint32_t symbol_value, const char *prefix) { @@ -312,6 +338,54 @@ static void display_permissive(policydb_t *p, FILE *fp) } } +static int display_roles(policydb_t * p, FILE *fp) +{ + uint32_t i; + + fprintf(fp, "roles:\n"); + for (i = 0; i < p->p_roles.nprim; i++) { + if (!p->p_role_val_to_name[i]) + continue; + + fprintf(fp, "\t%s\n", p->p_role_val_to_name[i]); + } + return 0; +} + +static int display_types(policydb_t * p, FILE *fp) +{ + uint32_t i; + + fprintf(fp, "types:\n"); + for (i = 0; i < p->p_types.nprim; i++) { + if (!p->p_type_val_to_name[i]) + continue; + + if (p->type_val_to_struct[i]->flavor == TYPE_ATTRIB) + continue; + + fprintf(fp, "\t%s\n", p->p_type_val_to_name[i]); + } + return 0; +} + +static int display_attributes(policydb_t * p, FILE *fp) +{ + uint32_t i; + + fprintf(fp, "attributes:\n"); + for (i = 0; i < p->p_types.nprim; i++) { + if (!p->p_type_val_to_name[i]) + continue; + + if (p->type_val_to_struct[i]->flavor != TYPE_ATTRIB) + continue; + + fprintf(fp, "\t%s\n", p->p_type_val_to_name[i]); + } + return 0; +} + static void display_role_trans(policydb_t *p, FILE *fp) { role_trans_t *rt; @@ -381,6 +455,11 @@ static int menu(void) printf("8) display role transitions\n"); printf("\n"); printf("c) display policy capabilities\n"); + printf("b) display booleans\n"); + printf("C) display classes\n"); + printf("r) display roles\n"); + printf("t) display types\n"); + printf("a) display type attributes\n"); printf("p) display the list of permissive types\n"); printf("u) display unknown handling setting\n"); printf("F) display filename_trans rules\n"); @@ -511,12 +590,27 @@ int main(int argc, char **argv) case '8': display_role_trans(&policydb, out_fp); break; + case 'a': + display_attributes(&policydb, out_fp); + break; + case 'b': + display_booleans(&policydb, out_fp); + break; case 'c': display_policycaps(&policydb, out_fp); break; + case 'C': + display_classes(&policydb, out_fp); + break; case 'p': display_permissive(&policydb, out_fp); break; + case 'r': + display_roles(&policydb, out_fp); + break; + case 't': + display_types(&policydb, out_fp); + break; case 'u': case 'U': display_handle_unknown(&policydb, out_fp); From patchwork Fri Mar 31 17:34:42 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: =?utf-8?q?Christian_G=C3=B6ttsche?= X-Patchwork-Id: 13196424 X-Patchwork-Delegate: plautrba@redhat.com Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 8334AC77B60 for ; Fri, 31 Mar 2023 17:35:10 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230064AbjCaRfJ (ORCPT ); Fri, 31 Mar 2023 13:35:09 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:60036 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S230208AbjCaRfI (ORCPT ); Fri, 31 Mar 2023 13:35:08 -0400 Received: from mail-ed1-x534.google.com (mail-ed1-x534.google.com [IPv6:2a00:1450:4864:20::534]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 2E57C1E72A for ; Fri, 31 Mar 2023 10:35:07 -0700 (PDT) Received: by mail-ed1-x534.google.com with SMTP id h8so92601462ede.8 for ; Fri, 31 Mar 2023 10:35:07 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=googlemail.com; s=20210112; t=1680284105; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to; bh=duzBxFc9kKSjBG7483XjC2C2FRJYWNZxBjCwIZqXL6A=; b=p7U+3g70yL/WPrPKhB3eI1Yysdu/rk4MHqTLzwfK8TmjbigiwF+Mul7XQEZZ7/JoPd pQr4s53eHyympHoqgFpKRYa8Y1gL1lPeZEni35cc7R08BhWYWHzf4jDx/jcF8D6xUZE5 TQO/1QGJ0jrVbXTCtmi1M1yGPDIerbGdj7AF9abEvVegtXLkixf7E9jn5/g8a52T1uJu zoYUsdrgJIYowAsaLogJc8ewO4TKQVBeHW3VhlptAJ4TNzDQpwFdBtqw99zorWbNdC09 v+IOk8coPRQJ+E9H9QMvZoIPJV0LVMx6AbaHzClz3Djv3b5xijGHSXmTFDStMQHvAPYw Drow== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; t=1680284105; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=duzBxFc9kKSjBG7483XjC2C2FRJYWNZxBjCwIZqXL6A=; b=kJNUVFbUbfUyD4mODmSzGmFD8fOkcbe+hB/Tni//Ue/4OsoNsweDDVHcdeoozlWL4/ fzLTwiwKbJFr1AZXymM7/IOlZ74tGMxTh/Zy91aSu9LTqvhwD47vkOBfIrt2B2ny2mEt 1lMguXiueitQbabN9AyevsJK20g7IpNzEugr08DhUxRwCDQdtbV25dXDqj6VRWpLzxGj zflzH2i1FzdMshjd4W8edOo6wwEN7Z51Pn+dEGQlZNxzYSvMj3kdIs44qT0ENcLlCsXO zIGOiQUXqmZi7zwsCVuUrce/h8gM3oQLxdMejKz3qdJYRriPMLVJIBo3n/J3nUnzY08X i1/w== X-Gm-Message-State: AAQBX9cI7TLQMdpPOIqcYyxmoyJL/Ls5QtQ013KnRitqGr7qssJvFK2D DLQ/jotfwC/YxyTvnLNRK7O3KmmwotWDpyYn X-Google-Smtp-Source: AKy350bcjNIWdmSPlVM2Ua097btN4PlLkH7aU0ks7Rl+yn9FdyFQobaGcxe8Xhi+7mrkCeUxH6NeqA== X-Received: by 2002:aa7:d885:0:b0:4fd:2155:74ef with SMTP id u5-20020aa7d885000000b004fd215574efmr27858810edq.19.1680284105659; Fri, 31 Mar 2023 10:35:05 -0700 (PDT) Received: from debianHome.localdomain (dynamic-077-010-126-250.77.10.pool.telefonica.de. [77.10.126.250]) by smtp.gmail.com with ESMTPSA id h5-20020a50c385000000b004ad601533a3sm1303138edf.55.2023.03.31.10.35.05 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 31 Mar 2023 10:35:05 -0700 (PDT) From: =?utf-8?q?Christian_G=C3=B6ttsche?= To: selinux@vger.kernel.org Subject: [PATCH 3/3] checkpolicy/dismod: misc improvements Date: Fri, 31 Mar 2023 19:34:42 +0200 Message-Id: <20230331173442.101678-3-cgzones@googlemail.com> X-Mailer: git-send-email 2.40.0 In-Reply-To: <20230331173442.101678-1-cgzones@googlemail.com> References: <20230331173442.101678-1-cgzones@googlemail.com> MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: selinux@vger.kernel.org * fix minus self formatting in neverallow rules, avoiding `~ - self` * show neverallow and neverallowxperm rules * whitespace improvements in output - avoid duplicate whitespaces before permission list, since sepol_av_to_string() already adds a trailing one - avoid duplicate whitespace after wildcard type - unify indentation for xperm rules * drop unused global variables Signed-off-by: Christian Göttsche --- checkpolicy/test/dismod.c | 33 ++++++++++++++++++--------------- 1 file changed, 18 insertions(+), 15 deletions(-) diff --git a/checkpolicy/test/dismod.c b/checkpolicy/test/dismod.c index a2d74d42..ebc1eec3 100644 --- a/checkpolicy/test/dismod.c +++ b/checkpolicy/test/dismod.c @@ -54,11 +54,8 @@ #define DISPLAY_AVBLOCK_FILENAME_TRANS 7 static policydb_t policydb; -extern unsigned int ss_initialized; -int policyvers = MOD_POLICYDB_VERSION_BASE; - -static const char *symbol_labels[9] = { +static const char *const symbol_labels[9] = { "commons", "classes", "roles ", "types ", "users ", "bools ", "levels ", "cats ", "attribs" @@ -86,12 +83,12 @@ static void render_access_bitmap(ebitmap_t * map, uint32_t class, { unsigned int i; char *perm; - fprintf(fp, "{"); + fprintf(fp, " {"); for (i = ebitmap_startbit(map); i < ebitmap_length(map); i++) { if (ebitmap_get_bit(map, i)) { perm = sepol_av_to_string(p, class, UINT32_C(1) << i); if (perm) - fprintf(fp, " %s", perm); + fprintf(fp, "%s", perm); } } fprintf(fp, " }"); @@ -117,7 +114,7 @@ static int display_type_set(type_set_t * set, uint32_t flags, policydb_t * polic unsigned int i, num_types; if (set->flags & TYPE_STAR) { - fprintf(fp, " * "); + fprintf(fp, " *"); return 0; } else if (set->flags & TYPE_COMP) { fprintf(fp, " ~"); @@ -149,7 +146,7 @@ static int display_type_set(type_set_t * set, uint32_t flags, policydb_t * polic } if (num_types > 1) - fprintf(fp, "{"); + fprintf(fp, " {"); for (i = ebitmap_startbit(&set->types); i < ebitmap_length(&set->types); i++) { @@ -170,7 +167,10 @@ static int display_type_set(type_set_t * set, uint32_t flags, policydb_t * polic } if (flags & RULE_NOTSELF) { - fprintf(fp, " -self"); + if (set->flags & TYPE_COMP) + fprintf(fp, " self"); + else + fprintf(fp, " -self"); } if (num_types > 1) @@ -234,6 +234,9 @@ static int display_avrule(avrule_t * avrule, policydb_t * policy, if (avrule->specified & AVRULE_DONTAUDIT) { fprintf(fp, " dontaudit"); } + if (avrule->specified & AVRULE_NEVERALLOW) { + fprintf(fp, " neverallow"); + } } else if (avrule->specified & AVRULE_TYPE) { if (avrule->specified & AVRULE_TRANSITION) { fprintf(fp, " type_transition"); @@ -244,15 +247,15 @@ static int display_avrule(avrule_t * avrule, policydb_t * policy, if (avrule->specified & AVRULE_CHANGE) { fprintf(fp, " type_change"); } - } else if (avrule->specified & AVRULE_NEVERALLOW) { - fprintf(fp, " neverallow"); } else if (avrule->specified & AVRULE_XPERMS) { if (avrule->specified & AVRULE_XPERMS_ALLOWED) - fprintf(fp, "allowxperm "); + fprintf(fp, " allowxperm"); else if (avrule->specified & AVRULE_XPERMS_AUDITALLOW) - fprintf(fp, "auditallowxperm "); + fprintf(fp, " auditallowxperm"); else if (avrule->specified & AVRULE_XPERMS_DONTAUDIT) - fprintf(fp, "dontauditxperm "); + fprintf(fp, " dontauditxperm"); + else if (avrule->specified & AVRULE_XPERMS_NEVERALLOW) + fprintf(fp, " neverallowxperm"); } else { fprintf(fp, " ERROR: no valid rule type specified\n"); return -1; @@ -560,7 +563,7 @@ static int display_scope_index(scope_index_t * indices, policydb_t * p, p, out_fp); } else { fprintf(out_fp, - ""); + " "); } } }