SELint

SELint

[Burgener, Daniel]

Hello,

We have created a tool a that I think people on this list may find very
useful as they do refpolicy related work.  It's called SELint and does
static code analysis on refpolicy style SELinux policy.  You can find
the tool on our git repo here:

https://github.com/TresysTechnology/selint

It currently has 13 checks for common policy issues, and we hope to add
more going forward.

I submitted a pull request to the refpolicy github this morning that
fixes some of the issues reported by the tool, and hope to continue
submitting more over the next few days.

-Daniel

Re: [Non-DoD Source] SELint

[jwcart2]

On 1/16/20 9:37 AM, Burgener, Daniel wrote:
> Hello,
> 
> We have created a tool a that I think people on this list may find very
> useful as they do refpolicy related work.  It's called SELint and does
> static code analysis on refpolicy style SELinux policy.  You can find
> the tool on our git repo here:
> 
> https://github.com/TresysTechnology/selint
> 
> It currently has 13 checks for common policy issues, and we hope to add
> more going forward.
> 
> I submitted a pull request to the refpolicy github this morning that
> fixes some of the issues reported by the tool, and hope to continue
> submitting more over the next few days.
> 
> -Daniel
> 

Interesting work. Some of the tests are similar to those in a tool I created in 
2018, selpoltools (https://github.com/jwcart2/selpoltools), but I did not think 
of doing a check for a potentially unescaped regex character. I like that your 
tool is written in c and that you can disable individual checks with a command 
line option.

A couple of comments (which you are probably aware of)
- You will need to teach your program about object_r at some point.

- I ran it on a Refpolicy source tree from earlier in the year and it complained 
about system_u being a non-existent user in the fc files, even though it is 
defined in users.

- I am a little bit confused by what the line out of order (C-001) wants. For 
example, I get the following two warnings

ipsec.te:       118: (C): Line out of order.  It is before line 124 that calls 
an interface located in the kernel module. (C-001)
ipsec.te:       119: (C): Line out of order.  It is before line 124 that is in a 
different section.  (This node is in the section for ipsec_mgmt_t rules and the 
other is in the section for ipsec_t rules.) (C-001)

118 corecmd_shell_domtrans(ipsec_t, ipsec_mgmt_t)
119 allow ipsec_mgmt_t ipsec_t:fd use;
. . .
124 kernel_read_kernel_sysctls(ipsec_t)
125 kernel_rw_net_sysctls(ipsec_t)
126 kernel_* ...

I am guessing that it wants the ipsec_t rules before the ipsec_mgmt_t rules?
I wonder why there aren't similar warnings referring to lines 125-134 which also 
refer to kernel interfaces. I am guessing that it recognizes line 124 as the 
start of the ipsec_t section?


All in all, it looks promising.
Jim

-- 
James Carter <jwcart2@tycho.nsa.gov>
National Security Agency