All of lore.kernel.org
 help / color / mirror / Atom feed
* [PATCH v3 1/2] libsepol/cil: Initialize the multiple_decls field of the cil db
@ 2020-05-26 18:50 James Carter
  2020-05-26 18:50 ` [PATCH v3 2/2] libsepol/cil: Return error when identifier declared as both type and attribute James Carter
  0 siblings, 1 reply; 6+ messages in thread
From: James Carter @ 2020-05-26 18:50 UTC (permalink / raw)
  To: selinux; +Cc: James Carter, Stephen Smalley

Initialize the multiple_decls field when intializing the structure
cil_db.

Fixes: fafe4c212bf6c32c ("libsepol: cil: Add ability to redeclare types[attributes]")
Reported-by: Topi Miettinen <toiwoton@gmail.com
Acked-by: Stephen Smalley <stephen.smalley.work@gmail.com>
Signed-off-by: James Carter <jwcart2@gmail.com>
---
 libsepol/cil/src/cil.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/libsepol/cil/src/cil.c b/libsepol/cil/src/cil.c
index 4a77aa9c..a3c6a293 100644
--- a/libsepol/cil/src/cil.c
+++ b/libsepol/cil/src/cil.c
@@ -459,6 +459,7 @@ void cil_db_init(struct cil_db **db)
 	(*db)->preserve_tunables = CIL_FALSE;
 	(*db)->handle_unknown = -1;
 	(*db)->mls = -1;
+	(*db)->multiple_decls = CIL_FALSE;
 	(*db)->target_platform = SEPOL_TARGET_SELINUX;
 	(*db)->policy_version = POLICYDB_VERSION_MAX;
 }
-- 
2.25.4


^ permalink raw reply related	[flat|nested] 6+ messages in thread
* [PATCH v3 2/2] libsepol/cil: Return error when identifier declared as both type and attribute
  2020-05-26 18:50 [PATCH v3 1/2] libsepol/cil: Initialize the multiple_decls field of the cil db James Carter
@ 2020-05-26 18:50 ` James Carter
  2020-05-27  7:02   ` Topi Miettinen
  2020-05-27 13:16   ` Stephen Smalley
  0 siblings, 2 replies; 6+ messages in thread
From: James Carter @ 2020-05-26 18:50 UTC (permalink / raw)
  To: selinux; +Cc: James Carter, Topi Miettinen

CIL allows a type to be redeclared when using the multiple declarations
option ("-m" or "--muliple-decls"), but make it an error for an identifier
to be declared as both a type and an attribute.

Change the error message so that it always gives the location and flavor
of both declarations. The flavors will be the same in all other cases,
but in this case they explain why there is an error even if multiple
declartions are allowed.

Fixes: Commit fafe4c212bf6c32c ("libsepol: cil: Add ability to redeclare types[attributes]")
Reported-by: Topi Miettinen <toiwoton@gmail.com>
Signed-off-by: James Carter <jwcart2@gmail.com>
---
v2: Added these changes
v3: Removed the error message about not creating a node

 libsepol/cil/src/cil_build_ast.c | 28 ++++++++++++++++------------
 1 file changed, 16 insertions(+), 12 deletions(-)

diff --git a/libsepol/cil/src/cil_build_ast.c b/libsepol/cil/src/cil_build_ast.c
index fcecdc4f..60ecaaff 100644
--- a/libsepol/cil/src/cil_build_ast.c
+++ b/libsepol/cil/src/cil_build_ast.c
@@ -87,7 +87,7 @@ exit:
  * datum, given the new datum and the one already present in a given symtab.
  */
 int cil_is_datum_multiple_decl(__attribute__((unused)) struct cil_symtab_datum *cur,
-                               __attribute__((unused)) struct cil_symtab_datum *old,
+                               struct cil_symtab_datum *old,
                                enum cil_flavor f)
 {
 	int rc = CIL_FALSE;
@@ -95,8 +95,12 @@ int cil_is_datum_multiple_decl(__attribute__((unused)) struct cil_symtab_datum *
 	switch (f) {
 	case CIL_TYPE:
 	case CIL_TYPEATTRIBUTE:
-		/* type and typeattribute statements insert empty datums, ret true */
-		rc = CIL_TRUE;
+		if (!old || f != FLAVOR(old)) {
+			rc = CIL_FALSE;
+		} else {
+			/* type and typeattribute statements insert empty datums */
+			rc = CIL_TRUE;
+		}
 		break;
 	default:
 		break;
@@ -126,19 +130,20 @@ int cil_gen_node(struct cil_db *db, struct cil_tree_node *ast_node, struct cil_s
 	if (symtab != NULL) {
 		rc = cil_symtab_insert(symtab, (hashtab_key_t)key, datum, ast_node);
 		if (rc == SEPOL_EEXIST) {
+			rc = cil_symtab_get_datum(symtab, (hashtab_key_t)key, &prev);
+			if (rc != SEPOL_OK) {
+				cil_log(CIL_ERR, "Re-declaration of %s %s, but previous declaration could not be found\n",cil_node_to_string(ast_node), key);
+				goto exit;
+			}
 			if (!db->multiple_decls ||
-			    cil_symtab_get_datum(symtab, (hashtab_key_t)key, &prev) != SEPOL_OK ||
 			    !cil_is_datum_multiple_decl(datum, prev, nflavor)) {
-
 				/* multiple_decls not ok, ret error */
+				struct cil_tree_node *node = NODE(prev);
 				cil_log(CIL_ERR, "Re-declaration of %s %s\n",
 					cil_node_to_string(ast_node), key);
-				if (cil_symtab_get_datum(symtab, key, &datum) == SEPOL_OK) {
-					if (sflavor == CIL_SYM_BLOCKS) {
-						struct cil_tree_node *node = datum->nodes->head->data;
-						cil_tree_log(node, CIL_ERR, "Previous declaration");
-					}
-				}
+				cil_tree_log(node, CIL_ERR, "Previous declaration of %s",
+					cil_node_to_string(node));
+				rc = SEPOL_ERR;
 				goto exit;
 			}
 			/* multiple_decls is enabled and works for this datum type, add node */
@@ -169,7 +174,6 @@ int cil_gen_node(struct cil_db *db, struct cil_tree_node *ast_node, struct cil_s
 	return SEPOL_OK;
 
 exit:
-	cil_log(CIL_ERR, "Failed to create node\n");
 	return rc;
 }
 
-- 
2.25.4


^ permalink raw reply related	[flat|nested] 6+ messages in thread
* Re: [PATCH v3 2/2] libsepol/cil: Return error when identifier declared as both type and attribute
  2020-05-26 18:50 ` [PATCH v3 2/2] libsepol/cil: Return error when identifier declared as both type and attribute James Carter
@ 2020-05-27  7:02   ` Topi Miettinen
  2020-05-27 12:06     ` James Carter
  2020-05-27 13:16   ` Stephen Smalley
  1 sibling, 1 reply; 6+ messages in thread
From: Topi Miettinen @ 2020-05-27  7:02 UTC (permalink / raw)
  To: James Carter, selinux

On 26.5.2020 21.50, James Carter wrote:
> CIL allows a type to be redeclared when using the multiple declarations
> option ("-m" or "--muliple-decls"), but make it an error for an identifier
> to be declared as both a type and an attribute.
> 
> Change the error message so that it always gives the location and flavor
> of both declarations. The flavors will be the same in all other cases,
> but in this case they explain why there is an error even if multiple
> declartions are allowed.
> 
> Fixes: Commit fafe4c212bf6c32c ("libsepol: cil: Add ability to redeclare types[attributes]")
> Reported-by: Topi Miettinen <toiwoton@gmail.com>
> Signed-off-by: James Carter <jwcart2@gmail.com>

Thanks, this prevents mismatching declarations. Does this also fix the 
memory issue and prevent that buggy policy could get loaded sometimes?

-Topi

^ permalink raw reply	[flat|nested] 6+ messages in thread
* Re: [PATCH v3 2/2] libsepol/cil: Return error when identifier declared as both type and attribute
  2020-05-27  7:02   ` Topi Miettinen
@ 2020-05-27 12:06     ` James Carter
  0 siblings, 0 replies; 6+ messages in thread
From: James Carter @ 2020-05-27 12:06 UTC (permalink / raw)
  To: Topi Miettinen; +Cc: SElinux list

On Wed, May 27, 2020 at 3:02 AM Topi Miettinen <toiwoton@gmail.com> wrote:
>
> On 26.5.2020 21.50, James Carter wrote:
> > CIL allows a type to be redeclared when using the multiple declarations
> > option ("-m" or "--muliple-decls"), but make it an error for an identifier
> > to be declared as both a type and an attribute.
> >
> > Change the error message so that it always gives the location and flavor
> > of both declarations. The flavors will be the same in all other cases,
> > but in this case they explain why there is an error even if multiple
> > declartions are allowed.
> >
> > Fixes: Commit fafe4c212bf6c32c ("libsepol: cil: Add ability to redeclare types[attributes]")
> > Reported-by: Topi Miettinen <toiwoton@gmail.com>
> > Signed-off-by: James Carter <jwcart2@gmail.com>
>
> Thanks, this prevents mismatching declarations. Does this also fix the
> memory issue and prevent that buggy policy could get loaded sometimes?
>

Yes, the two patches together will prevent the buggy policy from being
loaded. It will always give an error now.

Jim

> -Topi

^ permalink raw reply	[flat|nested] 6+ messages in thread
* Re: [PATCH v3 2/2] libsepol/cil: Return error when identifier declared as both type and attribute
  2020-05-26 18:50 ` [PATCH v3 2/2] libsepol/cil: Return error when identifier declared as both type and attribute James Carter
  2020-05-27  7:02   ` Topi Miettinen
@ 2020-05-27 13:16   ` Stephen Smalley
  2020-05-29 12:52     ` Stephen Smalley
  1 sibling, 1 reply; 6+ messages in thread
From: Stephen Smalley @ 2020-05-27 13:16 UTC (permalink / raw)
  To: James Carter; +Cc: SElinux list, Topi Miettinen

On Tue, May 26, 2020 at 2:51 PM James Carter <jwcart2@gmail.com> wrote:
>
> CIL allows a type to be redeclared when using the multiple declarations
> option ("-m" or "--muliple-decls"), but make it an error for an identifier
> to be declared as both a type and an attribute.
>
> Change the error message so that it always gives the location and flavor
> of both declarations. The flavors will be the same in all other cases,
> but in this case they explain why there is an error even if multiple
> declartions are allowed.
>
> Fixes: Commit fafe4c212bf6c32c ("libsepol: cil: Add ability to redeclare types[attributes]")
> Reported-by: Topi Miettinen <toiwoton@gmail.com>
> Signed-off-by: James Carter <jwcart2@gmail.com>

Acked-by: Stephen Smalley <stephen.smalley.work@gmail.com>

^ permalink raw reply	[flat|nested] 6+ messages in thread
* Re: [PATCH v3 2/2] libsepol/cil: Return error when identifier declared as both type and attribute
  2020-05-27 13:16   ` Stephen Smalley
@ 2020-05-29 12:52     ` Stephen Smalley
  0 siblings, 0 replies; 6+ messages in thread
From: Stephen Smalley @ 2020-05-29 12:52 UTC (permalink / raw)
  To: James Carter; +Cc: SElinux list, Topi Miettinen

On Wed, May 27, 2020 at 9:16 AM Stephen Smalley
<stephen.smalley.work@gmail.com> wrote:
>
> On Tue, May 26, 2020 at 2:51 PM James Carter <jwcart2@gmail.com> wrote:
> >
> > CIL allows a type to be redeclared when using the multiple declarations
> > option ("-m" or "--muliple-decls"), but make it an error for an identifier
> > to be declared as both a type and an attribute.
> >
> > Change the error message so that it always gives the location and flavor
> > of both declarations. The flavors will be the same in all other cases,
> > but in this case they explain why there is an error even if multiple
> > declartions are allowed.
> >
> > Fixes: Commit fafe4c212bf6c32c ("libsepol: cil: Add ability to redeclare types[attributes]")
> > Reported-by: Topi Miettinen <toiwoton@gmail.com>
> > Signed-off-by: James Carter <jwcart2@gmail.com>
>
> Acked-by: Stephen Smalley <stephen.smalley.work@gmail.com>

Applied.

^ permalink raw reply	[flat|nested] 6+ messages in thread
end of thread, other threads:[~2020-05-29 12:52 UTC | newest]

Thread overview: 6+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-05-26 18:50 [PATCH v3 1/2] libsepol/cil: Initialize the multiple_decls field of the cil db James Carter
2020-05-26 18:50 ` [PATCH v3 2/2] libsepol/cil: Return error when identifier declared as both type and attribute James Carter
2020-05-27  7:02   ` Topi Miettinen
2020-05-27 12:06     ` James Carter
2020-05-27 13:16   ` Stephen Smalley
2020-05-29 12:52     ` Stephen Smalley

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.