SELinux Archive on lore.kernel.org
 help / color / Atom feed
* [PATCH 1/2] Revert "mcstransd select correct colour range."
@ 2019-07-02 12:09 Vit Mojzis
  2019-07-02 12:09 ` [PATCH 2/2] Fix mcstrans secolor examples Vit Mojzis
  0 siblings, 1 reply; 4+ messages in thread
From: Vit Mojzis @ 2019-07-02 12:09 UTC (permalink / raw)
  To: selinux

This reverts commit fe17b3d2d924018750386c5ee74f12ca4b054136.

MLS ranges should be compared based on dominance.

This fixes mlscolor-test on mcstrans examples.

Eg. mlscolor-test using /usr/share/mcstrans/examples/urcsts when executed on mls
machine fails as follows:

\#pushd /usr/share/mcstrans/examples/urcsts
\#cp -f secolor.conf /etc/selinux/mls/secolor.conf
\#cp -f setrans.conf /etc/selinux/mls/setrans.conf
\#systemctl restart mcstransd
\#python3 /usr/share/mcstrans/util/mlscolor-test urcsts.color
For 'system_u:system_r:inetd_t:SystemLow' got
	'#000000 #000000 #000000 #000000 #000000 #000000 #000000 #000000' expected
	'#000000 #000000 #000000 #000000 #000000 #000000 #000000 #008000'
...
mlscolor-test done with 19 errors

Signed-off-by: Vit Mojzis <vmojzis@redhat.com>
---
 mcstrans/src/mcscolor.c | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/mcstrans/src/mcscolor.c b/mcstrans/src/mcscolor.c
index 6ea1aa97..d597e0df 100644
--- a/mcstrans/src/mcscolor.c
+++ b/mcstrans/src/mcscolor.c
@@ -134,12 +134,12 @@ static const secolor_t *find_color(int idx, const char *component,
 	}
 
 	while (ptr) {
-		if (fnmatch(ptr->pattern, component, 0) == 0) {
-			if (idx == COLOR_RANGE) {
-			    if (check_dominance(ptr->pattern, raw) == 0)
-					return &ptr->color;
-			} else 
-				return &ptr->color;
+		if (idx == COLOR_RANGE) {
+		    if (check_dominance(ptr->pattern, raw) == 0)
+			return &ptr->color;
+		} else {
+		    if (fnmatch(ptr->pattern, component, 0) == 0)
+			return &ptr->color;
 		}
 		ptr = ptr->next;
 	}
-- 
2.17.2


^ permalink raw reply	[flat|nested] 4+ messages in thread

* [PATCH 2/2] Fix mcstrans secolor examples
  2019-07-02 12:09 [PATCH 1/2] Revert "mcstransd select correct colour range." Vit Mojzis
@ 2019-07-02 12:09 ` Vit Mojzis
  2019-07-29 21:41   ` Nicolas Iooss
  0 siblings, 1 reply; 4+ messages in thread
From: Vit Mojzis @ 2019-07-02 12:09 UTC (permalink / raw)
  To: selinux

According to "check_dominance" function:
Range defined as "s15:c0.c1023" does not dominate any other range than
 "s15:c0.c1023" (does not dominate "s15", "s15:c0.c200", etc.).
While range defined as "s15-s15:c0.c1023" dominates all of the above.

This is either a bug, or "s15:c0.c1023" should not be used in the
examples.

Signed-off-by: Vit Mojzis <vmojzis@redhat.com>
---
 libselinux/man/man5/secolor.conf.5                      | 4 ++--
 libselinux/man/ru/man5/secolor.conf.5                   | 4 ++--
 mcstrans/share/examples/urcsts-via-include/secolor.conf | 2 +-
 mcstrans/share/examples/urcsts/secolor.conf             | 2 +-
 4 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/libselinux/man/man5/secolor.conf.5 b/libselinux/man/man5/secolor.conf.5
index b834577a..a3bf2da1 100644
--- a/libselinux/man/man5/secolor.conf.5
+++ b/libselinux/man/man5/secolor.conf.5
@@ -123,7 +123,7 @@ range s7\-s7:c0.c1023 = black red
 .br
 range s9\-s9:c0.c1023 = black orange
 .br
-range s15:c0.c1023   = black yellow
+range s15\-s15:c0.c1023   = black yellow
 .RE
 
 .sp
@@ -165,7 +165,7 @@ type xguest_t     = black green
 .br
 user sysadm_u     = white black
 .br
-range s0:c0.c1023 = black white
+range s0-s0:c0.c1023 = black white
 .br
 user *            = black white
 .br
diff --git a/libselinux/man/ru/man5/secolor.conf.5 b/libselinux/man/ru/man5/secolor.conf.5
index 4c1236ae..bcae80c1 100644
--- a/libselinux/man/ru/man5/secolor.conf.5
+++ b/libselinux/man/ru/man5/secolor.conf.5
@@ -121,7 +121,7 @@ range s7\-s7:c0.c1023 = black red
 .br
 range s9\-s9:c0.c1023 = black orange
 .br
-range s15:c0.c1023   = black yellow
+range s15\-s15:c0.c1023   = black yellow
 .RE
 
 .sp
@@ -163,7 +163,7 @@ type xguest_t     = black green
 .br
 user sysadm_u     = white black
 .br
-range s0:c0.c1023 = black white
+range s0\-s0:c0.c1023 = black white
 .br
 user *            = black white
 .br
diff --git a/mcstrans/share/examples/urcsts-via-include/secolor.conf b/mcstrans/share/examples/urcsts-via-include/secolor.conf
index d35b3c67..3b3f5430 100644
--- a/mcstrans/share/examples/urcsts-via-include/secolor.conf
+++ b/mcstrans/share/examples/urcsts-via-include/secolor.conf
@@ -17,5 +17,5 @@ range s3-s3:c0.c1023 = black tan
 range s5-s5:c0.c1023 = white blue
 range s7-s7:c0.c1023 = black red
 range s9-s9:c0.c1023 = black orange
-range s15:c0.c1023 = black yellow
+range s15-s15:c0.c1023 = black yellow
 
diff --git a/mcstrans/share/examples/urcsts/secolor.conf b/mcstrans/share/examples/urcsts/secolor.conf
index d35b3c67..3b3f5430 100644
--- a/mcstrans/share/examples/urcsts/secolor.conf
+++ b/mcstrans/share/examples/urcsts/secolor.conf
@@ -17,5 +17,5 @@ range s3-s3:c0.c1023 = black tan
 range s5-s5:c0.c1023 = white blue
 range s7-s7:c0.c1023 = black red
 range s9-s9:c0.c1023 = black orange
-range s15:c0.c1023 = black yellow
+range s15-s15:c0.c1023 = black yellow
 
-- 
2.17.2


^ permalink raw reply	[flat|nested] 4+ messages in thread

* Re: [PATCH 2/2] Fix mcstrans secolor examples
  2019-07-02 12:09 ` [PATCH 2/2] Fix mcstrans secolor examples Vit Mojzis
@ 2019-07-29 21:41   ` Nicolas Iooss
  2019-07-31  5:15     ` Chad Hanson
  0 siblings, 1 reply; 4+ messages in thread
From: Nicolas Iooss @ 2019-07-29 21:41 UTC (permalink / raw)
  To: Vit Mojzis, selinux

On Tue, Jul 2, 2019 at 2:09 PM Vit Mojzis <vmojzis@redhat.com> wrote:
>
> According to "check_dominance" function:
> Range defined as "s15:c0.c1023" does not dominate any other range than
>  "s15:c0.c1023" (does not dominate "s15", "s15:c0.c200", etc.).
> While range defined as "s15-s15:c0.c1023" dominates all of the above.
>
> This is either a bug, or "s15:c0.c1023" should not be used in the
> examples.

Hello,
I am not familiar with the concepts about range dominance, so I do not
know whether this is a bug that should be fixed or if updating the
examples is better. Can someone please review this?

Cheers,
Nicolas

> Signed-off-by: Vit Mojzis <vmojzis@redhat.com>
> ---
>  libselinux/man/man5/secolor.conf.5                      | 4 ++--
>  libselinux/man/ru/man5/secolor.conf.5                   | 4 ++--
>  mcstrans/share/examples/urcsts-via-include/secolor.conf | 2 +-
>  mcstrans/share/examples/urcsts/secolor.conf             | 2 +-
>  4 files changed, 6 insertions(+), 6 deletions(-)
>
> diff --git a/libselinux/man/man5/secolor.conf.5 b/libselinux/man/man5/secolor.conf.5
> index b834577a..a3bf2da1 100644
> --- a/libselinux/man/man5/secolor.conf.5
> +++ b/libselinux/man/man5/secolor.conf.5
> @@ -123,7 +123,7 @@ range s7\-s7:c0.c1023 = black red
>  .br
>  range s9\-s9:c0.c1023 = black orange
>  .br
> -range s15:c0.c1023   = black yellow
> +range s15\-s15:c0.c1023   = black yellow
>  .RE
>
>  .sp
> @@ -165,7 +165,7 @@ type xguest_t     = black green
>  .br
>  user sysadm_u     = white black
>  .br
> -range s0:c0.c1023 = black white
> +range s0-s0:c0.c1023 = black white
>  .br
>  user *            = black white
>  .br
> diff --git a/libselinux/man/ru/man5/secolor.conf.5 b/libselinux/man/ru/man5/secolor.conf.5
> index 4c1236ae..bcae80c1 100644
> --- a/libselinux/man/ru/man5/secolor.conf.5
> +++ b/libselinux/man/ru/man5/secolor.conf.5
> @@ -121,7 +121,7 @@ range s7\-s7:c0.c1023 = black red
>  .br
>  range s9\-s9:c0.c1023 = black orange
>  .br
> -range s15:c0.c1023   = black yellow
> +range s15\-s15:c0.c1023   = black yellow
>  .RE
>
>  .sp
> @@ -163,7 +163,7 @@ type xguest_t     = black green
>  .br
>  user sysadm_u     = white black
>  .br
> -range s0:c0.c1023 = black white
> +range s0\-s0:c0.c1023 = black white
>  .br
>  user *            = black white
>  .br
> diff --git a/mcstrans/share/examples/urcsts-via-include/secolor.conf b/mcstrans/share/examples/urcsts-via-include/secolor.conf
> index d35b3c67..3b3f5430 100644
> --- a/mcstrans/share/examples/urcsts-via-include/secolor.conf
> +++ b/mcstrans/share/examples/urcsts-via-include/secolor.conf
> @@ -17,5 +17,5 @@ range s3-s3:c0.c1023 = black tan
>  range s5-s5:c0.c1023 = white blue
>  range s7-s7:c0.c1023 = black red
>  range s9-s9:c0.c1023 = black orange
> -range s15:c0.c1023 = black yellow
> +range s15-s15:c0.c1023 = black yellow
>
> diff --git a/mcstrans/share/examples/urcsts/secolor.conf b/mcstrans/share/examples/urcsts/secolor.conf
> index d35b3c67..3b3f5430 100644
> --- a/mcstrans/share/examples/urcsts/secolor.conf
> +++ b/mcstrans/share/examples/urcsts/secolor.conf
> @@ -17,5 +17,5 @@ range s3-s3:c0.c1023 = black tan
>  range s5-s5:c0.c1023 = white blue
>  range s7-s7:c0.c1023 = black red
>  range s9-s9:c0.c1023 = black orange
> -range s15:c0.c1023 = black yellow
> +range s15-s15:c0.c1023 = black yellow
>
> --
> 2.17.2
>


^ permalink raw reply	[flat|nested] 4+ messages in thread

* Re: [PATCH 2/2] Fix mcstrans secolor examples
  2019-07-29 21:41   ` Nicolas Iooss
@ 2019-07-31  5:15     ` Chad Hanson
  0 siblings, 0 replies; 4+ messages in thread
From: Chad Hanson @ 2019-07-31  5:15 UTC (permalink / raw)
  To: Nicolas Iooss; +Cc: Vit Mojzis, selinux

I agree the secolor configuration file is lacking consistency. From a
historical MLS perspective, there were two special labels in many MLS
systems: SystemLow and SystemHigh.  This would be "s0" (lowest
level/no categories)  and "s15:c0.c1023" (highest level/all
categories) respectively.  At these special  levels, there was
traditionally no other category usage.

I concur we either do the proposed change in this patch or just change
the "s0:c0.c1023" lines to just "s0" (SystemLow) to be consistent with
the "s15:c0.c1023" (SystemHigh) range that exists currently. They will
both provide the desired results.

-Chad


On Mon, Jul 29, 2019 at 5:41 PM Nicolas Iooss <nicolas.iooss@m4x.org> wrote:
>
> On Tue, Jul 2, 2019 at 2:09 PM Vit Mojzis <vmojzis@redhat.com> wrote:
> >
> > According to "check_dominance" function:
> > Range defined as "s15:c0.c1023" does not dominate any other range than
> >  "s15:c0.c1023" (does not dominate "s15", "s15:c0.c200", etc.).
> > While range defined as "s15-s15:c0.c1023" dominates all of the above.
> >
> > This is either a bug, or "s15:c0.c1023" should not be used in the
> > examples.
>
> Hello,
> I am not familiar with the concepts about range dominance, so I do not
> know whether this is a bug that should be fixed or if updating the
> examples is better. Can someone please review this?
>
> Cheers,
> Nicolas
>
> > Signed-off-by: Vit Mojzis <vmojzis@redhat.com>
> > ---
> >  libselinux/man/man5/secolor.conf.5                      | 4 ++--
> >  libselinux/man/ru/man5/secolor.conf.5                   | 4 ++--
> >  mcstrans/share/examples/urcsts-via-include/secolor.conf | 2 +-
> >  mcstrans/share/examples/urcsts/secolor.conf             | 2 +-
> >  4 files changed, 6 insertions(+), 6 deletions(-)
> >
> > diff --git a/libselinux/man/man5/secolor.conf.5 b/libselinux/man/man5/secolor.conf.5
> > index b834577a..a3bf2da1 100644
> > --- a/libselinux/man/man5/secolor.conf.5
> > +++ b/libselinux/man/man5/secolor.conf.5
> > @@ -123,7 +123,7 @@ range s7\-s7:c0.c1023 = black red
> >  .br
> >  range s9\-s9:c0.c1023 = black orange
> >  .br
> > -range s15:c0.c1023   = black yellow
> > +range s15\-s15:c0.c1023   = black yellow
> >  .RE
> >
> >  .sp
> > @@ -165,7 +165,7 @@ type xguest_t     = black green
> >  .br
> >  user sysadm_u     = white black
> >  .br
> > -range s0:c0.c1023 = black white
> > +range s0-s0:c0.c1023 = black white
> >  .br
> >  user *            = black white
> >  .br
> > diff --git a/libselinux/man/ru/man5/secolor.conf.5 b/libselinux/man/ru/man5/secolor.conf.5
> > index 4c1236ae..bcae80c1 100644
> > --- a/libselinux/man/ru/man5/secolor.conf.5
> > +++ b/libselinux/man/ru/man5/secolor.conf.5
> > @@ -121,7 +121,7 @@ range s7\-s7:c0.c1023 = black red
> >  .br
> >  range s9\-s9:c0.c1023 = black orange
> >  .br
> > -range s15:c0.c1023   = black yellow
> > +range s15\-s15:c0.c1023   = black yellow
> >  .RE
> >
> >  .sp
> > @@ -163,7 +163,7 @@ type xguest_t     = black green
> >  .br
> >  user sysadm_u     = white black
> >  .br
> > -range s0:c0.c1023 = black white
> > +range s0\-s0:c0.c1023 = black white
> >  .br
> >  user *            = black white
> >  .br
> > diff --git a/mcstrans/share/examples/urcsts-via-include/secolor.conf b/mcstrans/share/examples/urcsts-via-include/secolor.conf
> > index d35b3c67..3b3f5430 100644
> > --- a/mcstrans/share/examples/urcsts-via-include/secolor.conf
> > +++ b/mcstrans/share/examples/urcsts-via-include/secolor.conf
> > @@ -17,5 +17,5 @@ range s3-s3:c0.c1023 = black tan
> >  range s5-s5:c0.c1023 = white blue
> >  range s7-s7:c0.c1023 = black red
> >  range s9-s9:c0.c1023 = black orange
> > -range s15:c0.c1023 = black yellow
> > +range s15-s15:c0.c1023 = black yellow
> >
> > diff --git a/mcstrans/share/examples/urcsts/secolor.conf b/mcstrans/share/examples/urcsts/secolor.conf
> > index d35b3c67..3b3f5430 100644
> > --- a/mcstrans/share/examples/urcsts/secolor.conf
> > +++ b/mcstrans/share/examples/urcsts/secolor.conf
> > @@ -17,5 +17,5 @@ range s3-s3:c0.c1023 = black tan
> >  range s5-s5:c0.c1023 = white blue
> >  range s7-s7:c0.c1023 = black red
> >  range s9-s9:c0.c1023 = black orange
> > -range s15:c0.c1023 = black yellow
> > +range s15-s15:c0.c1023 = black yellow
> >
> > --
> > 2.17.2
> >
>

^ permalink raw reply	[flat|nested] 4+ messages in thread

end of thread, back to index

Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2019-07-02 12:09 [PATCH 1/2] Revert "mcstransd select correct colour range." Vit Mojzis
2019-07-02 12:09 ` [PATCH 2/2] Fix mcstrans secolor examples Vit Mojzis
2019-07-29 21:41   ` Nicolas Iooss
2019-07-31  5:15     ` Chad Hanson

SELinux Archive on lore.kernel.org

Archives are clonable:
	git clone --mirror https://lore.kernel.org/selinux/0 selinux/git/0.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 selinux selinux/ https://lore.kernel.org/selinux \
		selinux@vger.kernel.org selinux@archiver.kernel.org
	public-inbox-index selinux


Newsgroup available over NNTP:
	nntp://nntp.lore.kernel.org/org.kernel.vger.selinux


AGPL code for this site: git clone https://public-inbox.org/ public-inbox