All of lore.kernel.org
 help / color / mirror / Atom feed
From: James Carter <jwcart2@gmail.com>
To: selinux@vger.kernel.org
Cc: cgzones@googlemail.com, James Carter <jwcart2@gmail.com>
Subject: [PATCH 14/16 v2] libsepol: The src and tgt must be the same if neverallow uses self
Date: Tue, 11 Jan 2022 16:54:44 -0500	[thread overview]
Message-ID: <20220111215446.595516-15-jwcart2@gmail.com> (raw)
In-Reply-To: <20220111215446.595516-1-jwcart2@gmail.com>

When checking for violations of neverallow rules, if the neverallow
uses self, then the src and tgt must be the same when checking
extended permissions and when reporting violations.

Example:
  allow attr attr : CLASS PERM;
  neverallow attr self : CLASS PERM;

If the types t1 and t2 have attribute attr, then the violations
that would be reported would be:
  allow t1 t1 : CLASS PERM;
  allow t1 t2 : CLASS PERM;
  allow t2 t1 : CLASS PERM;
  allow t2 t2 : CLASS PERM;
instead of:
  allow t1 t1 : CLASS PERM;
  allow t2 t2 : CLASS PERM;

Signed-off-by: James Carter <jwcart2@gmail.com>
---
 libsepol/src/assertion.c | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/libsepol/src/assertion.c b/libsepol/src/assertion.c
index 93c57061..1c69f4d9 100644
--- a/libsepol/src/assertion.c
+++ b/libsepol/src/assertion.c
@@ -213,6 +213,7 @@ static int report_assertion_avtab_matches(avtab_key_t *k, avtab_datum_t *d, void
 	ebitmap_t src_matches, tgt_matches, self_matches;
 	ebitmap_node_t *snode, *tnode;
 	unsigned int i, j;
+	const int is_avrule_self = (avrule->flags & RULE_SELF) != 0;
 
 	if ((k->specified & AVTAB_ALLOWED) == 0)
 		return 0;
@@ -236,7 +237,7 @@ static int report_assertion_avtab_matches(avtab_key_t *k, avtab_datum_t *d, void
 	if (rc < 0)
 		goto oom;
 
-	if (avrule->flags == RULE_SELF) {
+	if (is_avrule_self) {
 		rc = ebitmap_and(&self_matches, &src_matches, &p->attr_type_map[k->target_type - 1]);
 		if (rc < 0)
 			goto oom;
@@ -260,6 +261,8 @@ static int report_assertion_avtab_matches(avtab_key_t *k, avtab_datum_t *d, void
 
 		ebitmap_for_each_positive_bit(&src_matches, snode, i) {
 			ebitmap_for_each_positive_bit(&tgt_matches, tnode, j) {
+				if (is_avrule_self && i != j)
+					continue;
 				if (avrule->specified == AVRULE_XPERMS_NEVERALLOW) {
 					a->errors += report_assertion_extended_permissions(handle,p, avrule,
 											i, j, cp, perms, k, avtab);
@@ -368,6 +371,7 @@ static int check_assertion_extended_permissions(avrule_t *avrule, avtab_t *avtab
 	ebitmap_t src_matches, tgt_matches, self_matches;
 	unsigned int i, j;
 	ebitmap_node_t *snode, *tnode;
+	const int is_avrule_self = (avrule->flags & RULE_SELF) != 0;
 	int rc;
 
 	ebitmap_init(&src_matches);
@@ -389,7 +393,7 @@ static int check_assertion_extended_permissions(avrule_t *avrule, avtab_t *avtab
 	if (rc < 0)
 		goto oom;
 
-	if (avrule->flags == RULE_SELF) {
+	if (is_avrule_self) {
 		rc = ebitmap_and(&self_matches, &src_matches, &p->attr_type_map[k->target_type - 1]);
 		if (rc < 0)
 			goto oom;
@@ -408,6 +412,8 @@ static int check_assertion_extended_permissions(avrule_t *avrule, avtab_t *avtab
 
 	ebitmap_for_each_positive_bit(&src_matches, snode, i) {
 		ebitmap_for_each_positive_bit(&tgt_matches, tnode, j) {
+			if (is_avrule_self && i != j)
+				continue;
 			if (check_assertion_extended_permissions_avtab(avrule, avtab, i, j, k, p)) {
 				rc = 1;
 				goto exit;
-- 
2.31.1


  parent reply	other threads:[~2022-01-11 21:55 UTC|newest]

Thread overview: 19+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2022-01-11 21:54 [PATCH 00/16 v2] Refactor and fix assertion checking James Carter
2022-01-11 21:54 ` [PATCH 01/16 v2] libsepol: Return an error if check_assertion() returns an error James Carter
2022-01-11 21:54 ` [PATCH 02/16 v2] libsepol: Change label in check_assertion_avtab_match() James Carter
2022-01-11 21:54 ` [PATCH 03/16 v2] libsepol: Remove uneeded error messages in assertion checking James Carter
2022-01-11 21:54 ` [PATCH 04/16 v2] libsepol: Check for error from check_assertion_extended_permissions() James Carter
2022-01-11 21:54 ` [PATCH 05/16 v2] libsepol: Use consistent return checking style James Carter
2022-01-11 21:54 ` [PATCH 06/16 v2] libsepol: Move check of target types to before check for self James Carter
2022-01-11 21:54 ` [PATCH 07/16 v2] libsepol: Create function check_assertion_self_match() and use it James Carter
2022-01-11 21:54 ` [PATCH 08/16 v2] libsepol: Use (rc < 0) instead of (rc) when calling ebitmap functions James Carter
2022-01-11 21:54 ` [PATCH 09/16 v2] libsepol: Remove unnessesary check for matching class James Carter
2022-01-11 21:54 ` [PATCH 10/16 v2] libsepol: Move assigning outer loop index out of inner loop James Carter
2022-01-11 21:54 ` [PATCH 11/16 v2] libsepol: Make use of previously created ebitmap when checking self James Carter
2022-01-11 21:54 ` [PATCH 12/16 v2] libsepol: Refactor match_any_class_permissions() to be clearer James Carter
2022-01-11 21:54 ` [PATCH 13/16 v2] libsepol: Make return value clearer when reporting neverallowx errors James Carter
2022-01-11 21:54 ` James Carter [this message]
2022-01-11 21:54 ` [PATCH 15/16 v2] libsepol: Set args avtab pointer when reporting assertion violations James Carter
2022-01-11 21:54 ` [PATCH 16/16 v2] libsepol: Fix two problems with neverallowxperm reporting James Carter
2022-02-18 21:16 ` [PATCH 00/16 v2] Refactor and fix assertion checking James Carter
2022-02-24 21:07   ` James Carter

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20220111215446.595516-15-jwcart2@gmail.com \
    --to=jwcart2@gmail.com \
    --cc=cgzones@googlemail.com \
    --cc=selinux@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.