From: James Carter <jwcart2@gmail.com>
To: selinux@vger.kernel.org
Cc: bcressey@amazon.com, James Carter <jwcart2@gmail.com>
Subject: [PATCH] libsepol/cil: Check common perms when verifiying "all"
Date: Mon, 1 Apr 2024 11:09:42 -0400 [thread overview]
Message-ID: <20240401150942.549026-1-jwcart2@gmail.com> (raw)
Commit e81c466 "Fix class permission verification in CIL", added a
check for the use of "all" in a permission expression for a class
that had no permissions. Unfortunately, that change did not take
into account a class that had common permissions, so a class that
has no permmissions of its own, but inherits permissions from a
common, will fail the verification check.
If the class inherits from a common, then add those permissions to
the permmission list when verifying the permission expression.
Example/
(common co1 (cop1))
(class cl1 ())
(classcommon cl1 co1)
(classorder (CLASS cl1))
(classpermission cp1)
(classpermissionset cp1 (cl1 (all)))
(classmap cm1 (cmp1))
(classmapping cm1 cmp1 (cl1 (all)))
Previously, both the classpermissionset and the classmapping rules
would fail verification, but now they pass as expected.
Patch originally from Ben Cressey <bcressey@amazon.com>, I have
expanded the explanation.
Reported-by: Ben Cressey <bcressey@amazon.com>
Signed-off-by: James Carter <jwcart2@gmail.com>
---
libsepol/cil/src/cil_verify.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/libsepol/cil/src/cil_verify.c b/libsepol/cil/src/cil_verify.c
index 0c6d50a1..4ef2cbab 100644
--- a/libsepol/cil/src/cil_verify.c
+++ b/libsepol/cil/src/cil_verify.c
@@ -1842,6 +1842,9 @@ static int __cil_verify_perms(struct cil_class *class, struct cil_list *perms, s
int count2 = 0;
cil_list_init(&perm_list, CIL_MAP_PERM);
cil_symtab_map(&class->perms, __add_perm_to_list, perm_list);
+ if (class->common != NULL) {
+ cil_symtab_map(&class->common->perms, __add_perm_to_list, perm_list);
+ }
cil_list_for_each(j, perm_list) {
count2++;
struct cil_perm *perm = j->data;
--
2.44.0
next reply other threads:[~2024-04-01 15:09 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-04-01 15:09 James Carter [this message]
2024-04-04 16:22 ` [PATCH] libsepol/cil: Check common perms when verifiying "all" James Carter
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20240401150942.549026-1-jwcart2@gmail.com \
--to=jwcart2@gmail.com \
--cc=bcressey@amazon.com \
--cc=selinux@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).