* [PATCH] libsepol: Produce more meaningful error messages for conflicting type rules
@ 2016-08-27 12:44 Guido Trentalancia
2016-09-06 14:20 ` Guido Trentalancia
0 siblings, 1 reply; 3+ messages in thread
From: Guido Trentalancia @ 2016-08-27 12:44 UTC (permalink / raw)
To: selinux
Produce more meaningful error messages when conflicting type
rules are found by libsepol.
Fixes Debian bug #832331 (https://bugs.debian.org/832331).
Signed-off-by: Guido Trentalancia <guido@trentalancia.net>
---
cil/src/cil_binary.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
--- libsepol-2.5/cil/src/cil_binary.c 2016-02-23 17:31:41.000000000 +0100
+++ libsepol-2.5-conflicting_type_rules/cil/src/cil_binary.c 2016-08-27 14:31:44.307988662 +0200
@@ -973,7 +973,7 @@ avtab_datum_t *cil_cond_av_list_search(a
return NULL;
}
-int __cil_insert_type_rule(policydb_t *pdb, uint32_t kind, uint32_t src, uint32_t tgt, uint32_t obj, uint32_t res, cond_node_t *cond_node, enum cil_flavor cond_flavor)
+int __cil_insert_type_rule(policydb_t *pdb, uint32_t kind, uint32_t src, uint32_t tgt, uint32_t obj, uint32_t res, struct cil_type_rule *cil_rule, cond_node_t *cond_node, enum cil_flavor cond_flavor)
{
int rc = SEPOL_OK;
avtab_key_t avtab_key;
@@ -1008,7 +1008,7 @@ int __cil_insert_type_rule(policydb_t *p
* non-duplicate rule using the same key.
*/
if (existing->datum.data != res) {
- cil_log(CIL_ERR, "Conflicting type rules\n");
+ cil_log(CIL_ERR, "Conflicting type rules (scontext=%s tcontext=%s tclass=%s result=%s)\n", cil_rule->src_str, cil_rule->tgt_str, cil_rule->obj_str, cil_rule->result_str);
rc = SEPOL_ERR;
}
goto exit;
@@ -1034,7 +1034,7 @@ int __cil_insert_type_rule(policydb_t *p
search_datum = cil_cond_av_list_search(&avtab_key, other_list);
if (search_datum == NULL) {
if (existing->datum.data != res) {
- cil_log(CIL_ERR, "Conflicting type rules\n");
+ cil_log(CIL_ERR, "Conflicting type rules (scontext=%s tcontext=%s tclass=%s result=%s)\n", cil_rule->src_str, cil_rule->tgt_str, cil_rule->obj_str, cil_rule->result_str);
rc = SEPOL_ERR;
goto exit;
}
@@ -1093,7 +1093,7 @@ int __cil_type_rule_to_avtab(policydb_t
rc = __cil_get_sepol_class_datum(pdb, DATUM(c->data), &sepol_obj);
if (rc != SEPOL_OK) goto exit;
- rc = __cil_insert_type_rule(pdb, kind, sepol_src->s.value, sepol_tgt->s.value, sepol_obj->s.value, sepol_result->s.value, cond_node, cond_flavor);
+ rc = __cil_insert_type_rule(pdb, kind, sepol_src->s.value, sepol_tgt->s.value, sepol_obj->s.value, sepol_result->s.value, cil_rule, cond_node, cond_flavor);
if (rc != SEPOL_OK) goto exit;
}
}
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH] libsepol: Produce more meaningful error messages for conflicting type rules
2016-08-27 12:44 [PATCH] libsepol: Produce more meaningful error messages for conflicting type rules Guido Trentalancia
@ 2016-09-06 14:20 ` Guido Trentalancia
2016-09-06 17:54 ` James Carter
0 siblings, 1 reply; 3+ messages in thread
From: Guido Trentalancia @ 2016-09-06 14:20 UTC (permalink / raw)
To: selinux
Hello.
I received no feedback on this.
I still believe it is a very useful patch, because at the moment it is
very hard to track down the error from the error message.
Guido
On Sat, 27/08/2016 at 14.44 +0200, Guido Trentalancia wrote:
> Produce more meaningful error messages when conflicting type
> rules are found by libsepol.
>
> Fixes Debian bug #832331 (https://bugs.debian.org/832331).
>
> Signed-off-by: Guido Trentalancia <guido@trentalancia.net>
> ---
> cil/src/cil_binary.c | 8 ++++----
> 1 file changed, 4 insertions(+), 4 deletions(-)
>
> --- libsepol-2.5/cil/src/cil_binary.c 2016-02-23
> 17:31:41.000000000 +0100
> +++ libsepol-2.5-conflicting_type_rules/cil/src/cil_binary.c 2
> 016-08-27 14:31:44.307988662 +0200
> @@ -973,7 +973,7 @@ avtab_datum_t *cil_cond_av_list_search(a
> return NULL;
> }
>
> -int __cil_insert_type_rule(policydb_t *pdb, uint32_t kind, uint32_t
> src, uint32_t tgt, uint32_t obj, uint32_t res, cond_node_t
> *cond_node, enum cil_flavor cond_flavor)
> +int __cil_insert_type_rule(policydb_t *pdb, uint32_t kind, uint32_t
> src, uint32_t tgt, uint32_t obj, uint32_t res, struct cil_type_rule
> *cil_rule, cond_node_t *cond_node, enum cil_flavor cond_flavor)
> {
> int rc = SEPOL_OK;
> avtab_key_t avtab_key;
> @@ -1008,7 +1008,7 @@ int __cil_insert_type_rule(policydb_t *p
> * non-duplicate rule using the same key.
> */
> if (existing->datum.data != res) {
> - cil_log(CIL_ERR, "Conflicting type
> rules\n");
> + cil_log(CIL_ERR, "Conflicting type rules
> (scontext=%s tcontext=%s tclass=%s result=%s)\n", cil_rule->src_str,
> cil_rule->tgt_str, cil_rule->obj_str, cil_rule->result_str);
> rc = SEPOL_ERR;
> }
> goto exit;
> @@ -1034,7 +1034,7 @@ int __cil_insert_type_rule(policydb_t *p
> search_datum =
> cil_cond_av_list_search(&avtab_key, other_list);
> if (search_datum == NULL) {
> if (existing->datum.data != res) {
> - cil_log(CIL_ERR,
> "Conflicting type rules\n");
> + cil_log(CIL_ERR,
> "Conflicting type rules (scontext=%s tcontext=%s tclass=%s
> result=%s)\n", cil_rule->src_str, cil_rule->tgt_str, cil_rule-
> >obj_str, cil_rule->result_str);
> rc = SEPOL_ERR;
> goto exit;
> }
> @@ -1093,7 +1093,7 @@ int __cil_type_rule_to_avtab(policydb_t
> rc =
> __cil_get_sepol_class_datum(pdb, DATUM(c->data), &sepol_obj);
> if (rc != SEPOL_OK) goto exit;
>
> - rc = __cil_insert_type_rule(pdb,
> kind, sepol_src->s.value, sepol_tgt->s.value, sepol_obj->s.value,
> sepol_result->s.value, cond_node, cond_flavor);
> + rc = __cil_insert_type_rule(pdb,
> kind, sepol_src->s.value, sepol_tgt->s.value, sepol_obj->s.value,
> sepol_result->s.value, cil_rule, cond_node, cond_flavor);
> if (rc != SEPOL_OK) goto exit;
> }
> }
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH] libsepol: Produce more meaningful error messages for conflicting type rules
2016-09-06 14:20 ` Guido Trentalancia
@ 2016-09-06 17:54 ` James Carter
0 siblings, 0 replies; 3+ messages in thread
From: James Carter @ 2016-09-06 17:54 UTC (permalink / raw)
To: Guido Trentalancia, selinux
On 09/06/2016 10:20 AM, Guido Trentalancia wrote:
> Hello.
>
> I received no feedback on this.
>
> I still believe it is a very useful patch, because at the moment it is
> very hard to track down the error from the error message.
>
> Guido
>
> On Sat, 27/08/2016 at 14.44 +0200, Guido Trentalancia wrote:
>> Produce more meaningful error messages when conflicting type
>> rules are found by libsepol.
>>
>> Fixes Debian bug #832331 (https://bugs.debian.org/832331).
>>
>> Signed-off-by: Guido Trentalancia <guido@trentalancia.net>
Sorry for the delay, but applied now.
Thanks,
Jim
>> ---
>> cil/src/cil_binary.c | 8 ++++----
>> 1 file changed, 4 insertions(+), 4 deletions(-)
>>
>> --- libsepol-2.5/cil/src/cil_binary.c 2016-02-23
>> 17:31:41.000000000 +0100
>> +++ libsepol-2.5-conflicting_type_rules/cil/src/cil_binary.c 2
>> 016-08-27 14:31:44.307988662 +0200
>> @@ -973,7 +973,7 @@ avtab_datum_t *cil_cond_av_list_search(a
>> return NULL;
>> }
>>
>> -int __cil_insert_type_rule(policydb_t *pdb, uint32_t kind, uint32_t
>> src, uint32_t tgt, uint32_t obj, uint32_t res, cond_node_t
>> *cond_node, enum cil_flavor cond_flavor)
>> +int __cil_insert_type_rule(policydb_t *pdb, uint32_t kind, uint32_t
>> src, uint32_t tgt, uint32_t obj, uint32_t res, struct cil_type_rule
>> *cil_rule, cond_node_t *cond_node, enum cil_flavor cond_flavor)
>> {
>> int rc = SEPOL_OK;
>> avtab_key_t avtab_key;
>> @@ -1008,7 +1008,7 @@ int __cil_insert_type_rule(policydb_t *p
>> * non-duplicate rule using the same key.
>> */
>> if (existing->datum.data != res) {
>> - cil_log(CIL_ERR, "Conflicting type
>> rules\n");
>> + cil_log(CIL_ERR, "Conflicting type rules
>> (scontext=%s tcontext=%s tclass=%s result=%s)\n", cil_rule->src_str,
>> cil_rule->tgt_str, cil_rule->obj_str, cil_rule->result_str);
>> rc = SEPOL_ERR;
>> }
>> goto exit;
>> @@ -1034,7 +1034,7 @@ int __cil_insert_type_rule(policydb_t *p
>> search_datum =
>> cil_cond_av_list_search(&avtab_key, other_list);
>> if (search_datum == NULL) {
>> if (existing->datum.data != res) {
>> - cil_log(CIL_ERR,
>> "Conflicting type rules\n");
>> + cil_log(CIL_ERR,
>> "Conflicting type rules (scontext=%s tcontext=%s tclass=%s
>> result=%s)\n", cil_rule->src_str, cil_rule->tgt_str, cil_rule-
>>> obj_str, cil_rule->result_str);
>> rc = SEPOL_ERR;
>> goto exit;
>> }
>> @@ -1093,7 +1093,7 @@ int __cil_type_rule_to_avtab(policydb_t
>> rc =
>> __cil_get_sepol_class_datum(pdb, DATUM(c->data), &sepol_obj);
>> if (rc != SEPOL_OK) goto exit;
>>
>> - rc = __cil_insert_type_rule(pdb,
>> kind, sepol_src->s.value, sepol_tgt->s.value, sepol_obj->s.value,
>> sepol_result->s.value, cond_node, cond_flavor);
>> + rc = __cil_insert_type_rule(pdb,
>> kind, sepol_src->s.value, sepol_tgt->s.value, sepol_obj->s.value,
>> sepol_result->s.value, cil_rule, cond_node, cond_flavor);
>> if (rc != SEPOL_OK) goto exit;
>> }
>> }
>
> _______________________________________________
> Selinux mailing list
> Selinux@tycho.nsa.gov
> To unsubscribe, send email to Selinux-leave@tycho.nsa.gov.
> To get help, send an email containing "help" to Selinux-request@tycho.nsa.gov.
>
--
James Carter <jwcart2@tycho.nsa.gov>
National Security Agency
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2016-09-06 17:54 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2016-08-27 12:44 [PATCH] libsepol: Produce more meaningful error messages for conflicting type rules Guido Trentalancia
2016-09-06 14:20 ` Guido Trentalancia
2016-09-06 17:54 ` James Carter
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.