[RFC PATCH v3 5/5] libsepol: pass avtab to report function

From: "Christian Göttsche" <cgzones@googlemail.com>
To: selinux@vger.kernel.org
Cc: James Carter <jwcart2@gmail.com>
Subject: [RFC PATCH v3 5/5] libsepol: pass avtab to report function
Date: Sat,  4 Dec 2021 11:35:16 +0100	[thread overview]
Message-ID: <20211204103516.17375-5-cgzones@googlemail.com> (raw)
In-Reply-To: <20211204103516.17375-1-cgzones@googlemail.com>

Populate the avtab member before passing as argument to the report
function. Without the avtab avtab_search_node() is unable to find
allowxperm rules and this results in false-positive reports, e.g. on:

    allow TATTR1 TATTR1 : CLASS1 ioctl;
    allowxperm TATTR1 TATTR1 : CLASS1 ioctl 0x9501;
    neverallowxperm TYPE1 ~self : CLASS1 0x9501;

Reported-by: James Carter <jwcart2@gmail.com>
Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
---
 libsepol/src/assertion.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/libsepol/src/assertion.c b/libsepol/src/assertion.c
index 4600be41..a0eebb93 100644
--- a/libsepol/src/assertion.c
+++ b/libsepol/src/assertion.c
@@ -304,10 +304,12 @@ static int report_assertion_failures(sepol_handle_t *handle, policydb_t *p, avru
 	args.avrule = avrule;
 	args.errors = 0;
 
+	args.avtab = &p->te_avtab;
 	rc = avtab_map(&p->te_avtab, report_assertion_avtab_matches, &args);
 	if (rc)
 		goto oom;
 
+	args.avtab = &p->te_cond_avtab;
 	rc = avtab_map(&p->te_cond_avtab, report_assertion_avtab_matches, &args);
 	if (rc)
 		goto oom;
-- 
2.34.1

