>-----Original Message----- >From: Dominick Grift [mailto:dac.override@xxxxxxxxx] >Sent: Thursday, September 10, 2015 1:03 PM >To: Yuli Khodorkovskiy >Cc: selinux@xxxxxxxxxxxxx >Subject: Re: [PATCH] libsepol/cil: Add userattribute{set} functionality > >-----BEGIN PGP SIGNED MESSAGE----- >Hash: SHA512 > >On Thu, Sep 10, 2015 at 12:56:05PM -0400, Yuli Khodorkovskiy wrote: >> This adds a userattribute statement that may be used in userroles and >> constraints. The syntax is the same as typeattributset. >> >> Also, disallow roleattributes where roles are accepted in contexts. > >what does this mean? There was a bug where we allowed roleattributes in contexts when we should have only accepted roles. We now check for this in cil_resolve. > >> >> Specify a userattribute >> >> (userattribute foo) >> >> Add users to the set foo >> >> (userattributeset foo (u1 u2)) >> >> Signed-off-by: Yuli Khodorkovskiy <ykhodorkovskiy@xxxxxxxxxx> >> --- >> libsepol/cil/src/cil.c | 36 ++++++ >> libsepol/cil/src/cil_binary.c | 99 +++++++++++----- >> libsepol/cil/src/cil_binary.h | 7 +- >> libsepol/cil/src/cil_build_ast.c | 129 ++++++++++++++++++++- >> libsepol/cil/src/cil_build_ast.h | 4 + >> libsepol/cil/src/cil_copy_ast.c | 41 +++++++ >> libsepol/cil/src/cil_copy_ast.h | 2 + >> libsepol/cil/src/cil_flavor.h | 2 + >> libsepol/cil/src/cil_internal.h | 23 +++- >> libsepol/cil/src/cil_policy.c | 5 - >> libsepol/cil/src/cil_post.c | 182 >++++++++++++++++++++++++++++++ >> libsepol/cil/src/cil_reset_ast.c | 33 +++++- >> libsepol/cil/src/cil_resolve_ast.c | 114 +++++++++++++++++-- >> libsepol/cil/src/cil_resolve_ast.h | 1 + >> libsepol/cil/src/cil_tree.c | 22 +++- >> libsepol/cil/src/cil_verify.c | 12 +- >> secilc/docs/cil_constraint_statements.xml | 8 +- >> secilc/docs/cil_user_statements.xml | 110 +++++++++++++++++- >> secilc/test/policy.cil | 22 +++- >> 19 files changed, 786 insertions(+), 66 deletions(-) >> >> diff --git a/libsepol/cil/src/cil.c b/libsepol/cil/src/cil.c >> index a89c585..8716deb 100644 >> --- a/libsepol/cil/src/cil.c >> +++ b/libsepol/cil/src/cil.c >> @@ -122,6 +122,8 @@ static void cil_init_keys(void) >> CIL_KEY_TYPE = cil_strpool_add("type"); >> CIL_KEY_ROLE = cil_strpool_add("role"); >> CIL_KEY_USER = cil_strpool_add("user"); >> + CIL_KEY_USERATTRIBUTE = cil_strpool_add("userattribute"); >> + CIL_KEY_USERATTRIBUTESET = cil_strpool_add("userattributeset"); >> CIL_KEY_SENSITIVITY = cil_strpool_add("sensitivity"); >> CIL_KEY_CATEGORY = cil_strpool_add("category"); >> CIL_KEY_CATSET = cil_strpool_add("categoryset"); >> @@ -266,9 +268,11 @@ void cil_db_init(struct cil_db **db) >> (*db)->num_classes = 0; >> (*db)->num_types = 0; >> (*db)->num_roles = 0; >> + (*db)->num_users = 0; >> (*db)->num_cats = 0; >> (*db)->val_to_type = NULL; >> (*db)->val_to_role = NULL; >> + (*db)->val_to_user = NULL; >> >> (*db)->disable_dontaudit = CIL_FALSE; >> (*db)->disable_neverallow = CIL_FALSE; >> @@ -311,6 +315,7 @@ void cil_db_destroy(struct cil_db **db) >> cil_strpool_destroy(); >> free((*db)->val_to_type); >> free((*db)->val_to_role); >> + free((*db)->val_to_user); >> >> free(*db); >> *db = NULL; >> @@ -552,6 +557,12 @@ void cil_destroy_data(void **data, enum >cil_flavor flavor) >> case CIL_USER: >> cil_destroy_user(*data); >> break; >> + case CIL_USERATTRIBUTE: >> + cil_destroy_userattribute(*data); >> + break; >> + case CIL_USERATTRIBUTESET: >> + cil_destroy_userattributeset(*data); >> + break; >> case CIL_USERPREFIX: >> cil_destroy_userprefix(*data); >> break; >> @@ -794,6 +805,7 @@ int cil_flavor_to_symtab_index(enum cil_flavor >flavor, enum cil_sym_index *sym_i >> *sym_index = CIL_SYM_CLASSPERMSETS; >> break; >> case CIL_USER: >> + case CIL_USERATTRIBUTE: >> *sym_index = CIL_SYM_USERS; >> break; >> case CIL_ROLE: >> @@ -924,6 +936,10 @@ const char * cil_node_to_string(struct >cil_tree_node *node) >> return CIL_KEY_CLASSPERMISSIONSET; >> case CIL_USER: >> return CIL_KEY_USER; >> + case CIL_USERATTRIBUTE: >> + return CIL_KEY_USERATTRIBUTE; >> + case CIL_USERATTRIBUTESET: >> + return CIL_KEY_USERATTRIBUTESET; >> case CIL_USERPREFIX: >> return CIL_KEY_USERPREFIX; >> case CIL_USERROLE: >> @@ -2379,6 +2395,26 @@ void cil_user_init(struct cil_user **user) >> (*user)->roles = NULL; >> (*user)->dftlevel = NULL; >> (*user)->range = NULL; >> + (*user)->value = 0; >> +} >> + >> +void cil_userattribute_init(struct cil_userattribute **attr) >> +{ >> + *attr = cil_malloc(sizeof(**attr)); >> + >> + cil_symtab_datum_init(&(*attr)->datum); >> + >> + (*attr)->expr_list = NULL; >> + (*attr)->users = NULL; >> +} >> + >> +void cil_userattributeset_init(struct cil_userattributeset **attrset) >> +{ >> + *attrset = cil_malloc(sizeof(**attrset)); >> + >> + (*attrset)->attr_str = NULL; >> + (*attrset)->str_expr = NULL; >> + (*attrset)->datum_expr = NULL; >> } >> >> void cil_userlevel_init(struct cil_userlevel **usrlvl) >> diff --git a/libsepol/cil/src/cil_binary.c b/libsepol/cil/src/cil_binary.c >> index 52ce067..32304e2 100644 >> --- a/libsepol/cil/src/cil_binary.c >> +++ b/libsepol/cil/src/cil_binary.c >> @@ -144,6 +144,34 @@ static int >__cil_get_sepol_level_datum(policydb_t *pdb, struct cil_symtab_datum >> return SEPOL_OK; >> } >> >> +static int __cil_expand_user(struct cil_symtab_datum *datum, >ebitmap_t *new) >> +{ >> + struct cil_tree_node *node = datum->nodes->head->data; >> + struct cil_user *user = NULL; >> + struct cil_userattribute *attr = NULL; >> + >> + if (node->flavor == CIL_USERATTRIBUTE) { >> + attr = (struct cil_userattribute *)datum; >> + if (ebitmap_cpy(new, attr->users)) { >> + cil_log(CIL_ERR, "Failed to copy user bits\n"); >> + goto exit; >> + } >> + } else { >> + user = (struct cil_user *)datum; >> + ebitmap_init(new); >> + if (ebitmap_set_bit(new, user->value, 1)) { >> + cil_log(CIL_ERR, "Failed to set user bit\n"); >> + ebitmap_destroy(new); >> + goto exit; >> + } >> + } >> + >> + return SEPOL_OK; >> + >> +exit: >> + return SEPOL_ERR; >> +} >> + >> static int __cil_expand_role(struct cil_symtab_datum *datum, >ebitmap_t *new) >> { >> struct cil_tree_node *node = datum->nodes->head->data; >> @@ -746,43 +774,41 @@ exit: >> return SEPOL_ERR; >> } >> >> -int cil_userrole_to_policydb(policydb_t *pdb, const struct cil_db *db, >struct cil_userrole *userrole) >> +int cil_userrole_to_policydb(policydb_t *pdb, const struct cil_db *db, >struct cil_user *user) >> { >> int rc = SEPOL_ERR; >> user_datum_t *sepol_user = NULL; >> role_datum_t *sepol_role = NULL; >> - ebitmap_t role_bitmap; >> - ebitmap_node_t *rnode; >> + ebitmap_node_t *rnode = NULL; >> unsigned int i; >> >> - rc = __cil_get_sepol_user_datum(pdb, DATUM(userrole->user), >&sepol_user); >> - if (rc != SEPOL_OK) goto exit; >> - >> - rc = __cil_expand_role(userrole->role, &role_bitmap); >> - if (rc != SEPOL_OK) goto exit; >> - >> - ebitmap_for_each_bit(&role_bitmap, rnode, i) { >> - if (!ebitmap_get_bit(&role_bitmap, i)) continue; >> + if (user->roles) { >> + rc = __cil_get_sepol_user_datum(pdb, DATUM(user), >&sepol_user); >> + if (rc != SEPOL_OK) { >> + goto exit; >> + } >> >> - rc = __cil_get_sepol_role_datum(pdb, DATUM(db- >>val_to_role[i]), &sepol_role); >> - if (rc != SEPOL_OK) goto exit; >> + ebitmap_for_each_bit(user->roles, rnode, i) { >> + if (!ebitmap_get_bit(user->roles, i)) { >> + continue; >> + } >> >> - if (sepol_role->s.value == 1) { >> - // role is object_r, ignore it since it is implicitly >associated >> - // with all users >> - continue; >> - } >> + rc = __cil_get_sepol_role_datum(pdb, DATUM(db- >>val_to_role[i]), &sepol_role); >> + if (rc != SEPOL_OK) { >> + goto exit; >> + } >> >> - if (ebitmap_set_bit(&sepol_user->roles.roles, sepol_role- >>s.value - 1, 1)) { >> - cil_log(CIL_INFO, "Failed to set role bit for user\n"); >> - goto exit; >> + if (ebitmap_set_bit(&sepol_user->roles.roles, >sepol_role->s.value - 1, 1)) { >> + cil_log(CIL_INFO, "Failed to set role bit for >user\n"); >> + rc = SEPOL_ERR; >> + goto exit; >> + } >> } >> } >> >> rc = SEPOL_OK; >> >> exit: >> - ebitmap_destroy(&role_bitmap); >> return rc; >> } >> >> @@ -2183,12 +2209,30 @@ int >__cil_constrain_expr_datum_to_sepol_expr(policydb_t *pdb, const struct >cil_d >> >> if (expr_flavor == CIL_USER) { >> user_datum_t *sepol_user = NULL; >> - rc = __cil_get_sepol_user_datum(pdb, item->data, >&sepol_user); >> + ebitmap_t user_bitmap; >> + ebitmap_node_t *unode; >> + unsigned int i; >> + >> + rc = __cil_expand_user(item->data, &user_bitmap); >> if (rc != SEPOL_OK) goto exit; >> >> - if (ebitmap_set_bit(&expr->names, sepol_user->s.value - 1, >1)) { >> - goto exit; >> + ebitmap_for_each_bit(&user_bitmap, unode, i) { >> + if (!ebitmap_get_bit(&user_bitmap, i)) { >> + continue; >> + } >> + >> + rc = __cil_get_sepol_user_datum(pdb, DATUM(db- >>val_to_user[i]), &sepol_user); >> + if (rc != SEPOL_OK) { >> + ebitmap_destroy(&user_bitmap); >> + goto exit; >> + } >> + >> + if (ebitmap_set_bit(&expr->names, sepol_user- >>s.value - 1, 1)) { >> + ebitmap_destroy(&user_bitmap); >> + goto exit; >> + } >> } >> + ebitmap_destroy(&user_bitmap); >> } else if (expr_flavor == CIL_ROLE) { >> role_datum_t *sepol_role = NULL; >> ebitmap_t role_bitmap; >> @@ -3374,9 +3418,10 @@ int __cil_node_to_policydb(struct >cil_tree_node *node, void *extra_args) >> if (rc != SEPOL_OK) goto exit; >> if (pdb->mls == CIL_TRUE) { >> rc = >cil_userlevel_userrange_to_policydb(pdb, node->data); >> + if (rc != SEPOL_OK) { >> + goto exit; >> + } >> } >> - break; >> - case CIL_USERROLE: >> rc = cil_userrole_to_policydb(pdb, db, node- >>data); >> break; >> case CIL_TYPE_RULE: >> diff --git a/libsepol/cil/src/cil_binary.h b/libsepol/cil/src/cil_binary.h >> index 33b43f9..c59b1e3 100644 >> --- a/libsepol/cil/src/cil_binary.h >> +++ b/libsepol/cil/src/cil_binary.h >> @@ -184,12 +184,13 @@ int cil_user_to_policydb(policydb_t *pdb, >struct cil_user *cil_user); >> /** >> * Insert cil userrole structure into sepol policydb. >> * >> - * @param[in] pdb THe policy database to insert the userrole into. >> - * @param[in] datum The cil_userrole datum. >> + * @param[in] pdb The policy database to insert the userrole into. >> + * @param[in] db The cil database >> + * @param[in] datum The cil_user >> * >> * @return SEPOL_OK upon success or SEPOL_ERR otherwise. >> */ >> -int cil_userrole_to_policydb(policydb_t *pdb, const struct cil_db *db, >struct cil_userrole *userrole); >> +int cil_userrole_to_policydb(policydb_t *pdb, const struct cil_db *db, >struct cil_user *user); >> >> /** >> * Insert cil bool structure into sepol policydb. >> diff --git a/libsepol/cil/src/cil_build_ast.c b/libsepol/cil/src/cil_build_ast.c >> index 32ebee1..861b606 100644 >> --- a/libsepol/cil/src/cil_build_ast.c >> +++ b/libsepol/cil/src/cil_build_ast.c >> @@ -1196,10 +1196,132 @@ void cil_destroy_user(struct cil_user *user) >> } >> >> cil_symtab_datum_destroy(&user->datum); >> - cil_list_destroy(&user->roles, CIL_FALSE); >> + ebitmap_destroy(user->roles); >> + free(user->roles); >> free(user); >> } >> >> +int cil_gen_userattribute(__attribute__((unused)) struct cil_db *db, >struct cil_tree_node *parse_current, struct cil_tree_node *ast_node) >> +{ >> + enum cil_syntax syntax[] = { >> + CIL_SYN_STRING, >> + CIL_SYN_STRING, >> + CIL_SYN_END >> + }; >> + int syntax_len = sizeof(syntax)/sizeof(*syntax); >> + char *key = NULL; >> + struct cil_userattribute *attr = NULL; >> + int rc = SEPOL_ERR; >> + >> + if (parse_current == NULL || ast_node == NULL) { >> + goto exit; >> + } >> + >> + rc = __cil_verify_syntax(parse_current, syntax, syntax_len); >> + if (rc != SEPOL_OK) { >> + goto exit; >> + } >> + >> + cil_userattribute_init(&attr); >> + >> + key = parse_current->next->data; >> + rc = cil_gen_node(db, ast_node, (struct cil_symtab_datum*)attr, >(hashtab_key_t)key, CIL_SYM_USERS, CIL_USERATTRIBUTE); >> + if (rc != SEPOL_OK) { >> + goto exit; >> + } >> + >> + return SEPOL_OK; >> +exit: >> + cil_log(CIL_ERR, "Bad userattribute declaration at line %d of %s\n", >> + parse_current->line, parse_current->path); >> + cil_destroy_userattribute(attr); >> + cil_clear_node(ast_node); >> + return rc; >> +} >> + >> +void cil_destroy_userattribute(struct cil_userattribute *attr) >> +{ >> + struct cil_list_item *expr = NULL; >> + struct cil_list_item *next = NULL; >> + >> + if (attr == NULL) { >> + return; >> + } >> + >> + if (attr->expr_list != NULL) { >> + /* we don't want to destroy the expression stacks (cil_list) >inside >> + * this list cil_list_destroy destroys sublists, so we need to >do it >> + * manually */ >> + expr = attr->expr_list->head; >> + while (expr != NULL) { >> + next = expr->next; >> + cil_list_item_destroy(&expr, CIL_FALSE); >> + expr = next; >> + } >> + free(attr->expr_list); >> + attr->expr_list = NULL; >> + } >> + >> + cil_symtab_datum_destroy(&attr->datum); >> + ebitmap_destroy(attr->users); >> + free(attr->users); >> + free(attr); >> +} >> + >> +int cil_gen_userattributeset(__attribute__((unused)) struct cil_db *db, >struct cil_tree_node *parse_current, struct cil_tree_node *ast_node) >> +{ >> + enum cil_syntax syntax[] = { >> + CIL_SYN_STRING, >> + CIL_SYN_STRING, >> + CIL_SYN_STRING | CIL_SYN_LIST, >> + CIL_SYN_END >> + }; >> + int syntax_len = sizeof(syntax)/sizeof(*syntax); >> + struct cil_userattributeset *attrset = NULL; >> + int rc = SEPOL_ERR; >> + >> + if (db == NULL || parse_current == NULL || ast_node == NULL) { >> + goto exit; >> + } >> + >> + rc = __cil_verify_syntax(parse_current, syntax, syntax_len); >> + if (rc != SEPOL_OK) { >> + goto exit; >> + } >> + >> + cil_userattributeset_init(&attrset); >> + >> + attrset->attr_str = parse_current->next->data; >> + >> + rc = cil_gen_expr(parse_current->next->next, CIL_USER, &attrset- >>str_expr); >> + if (rc != SEPOL_OK) { >> + goto exit; >> + } >> + ast_node->data = attrset; >> + ast_node->flavor = CIL_USERATTRIBUTESET; >> + >> + return SEPOL_OK; >> + >> +exit: >> + cil_log(CIL_ERR, "Bad userattributeset declaration at line %d of >%s\n", >> + parse_current->line, parse_current->path); >> + cil_destroy_userattributeset(attrset); >> + >> + return rc; >> +} >> + >> +void cil_destroy_userattributeset(struct cil_userattributeset *attrset) >> +{ >> + if (attrset == NULL) { >> + return; >> + } >> + >> + cil_list_destroy(&attrset->str_expr, CIL_TRUE); >> + cil_list_destroy(&attrset->datum_expr, CIL_FALSE); >> + >> + free(attrset); >> +} >> + >> int cil_gen_userlevel(__attribute__((unused)) struct cil_db *db, struct >cil_tree_node *parse_current, struct cil_tree_node *ast_node) >> { >> enum cil_syntax syntax[] = { >> @@ -5855,6 +5977,11 @@ int __cil_build_ast_node_helper(struct >cil_tree_node *parse_current, uint32_t *f >> *finished = CIL_TREE_SKIP_NEXT; >> } else if (parse_current->data == CIL_KEY_USER) { >> rc = cil_gen_user(db, parse_current, ast_node); >> + } else if (parse_current->data == CIL_KEY_USERATTRIBUTE) { >> + rc = cil_gen_userattribute(db, parse_current, ast_node); >> + } else if (parse_current->data == CIL_KEY_USERATTRIBUTESET) { >> + rc = cil_gen_userattributeset(db, parse_current, ast_node); >> + *finished = CIL_TREE_SKIP_NEXT; >> } else if (parse_current->data == CIL_KEY_USERLEVEL) { >> rc = cil_gen_userlevel(db, parse_current, ast_node); >> *finished = CIL_TREE_SKIP_NEXT; >> diff --git a/libsepol/cil/src/cil_build_ast.h >b/libsepol/cil/src/cil_build_ast.h >> index 1b40ae5..11f51f5 100644 >> --- a/libsepol/cil/src/cil_build_ast.h >> +++ b/libsepol/cil/src/cil_build_ast.h >> @@ -80,6 +80,10 @@ int cil_gen_sidorder(struct cil_db *db, struct >cil_tree_node *parse_current, str >> void cil_destroy_sidorder(struct cil_sidorder *sidorder); >> int cil_gen_user(struct cil_db *db, struct cil_tree_node *parse_current, >struct cil_tree_node *ast_node); >> void cil_destroy_user(struct cil_user *user); >> +int cil_gen_userattribute(struct cil_db *db, struct cil_tree_node >*parse_current, struct cil_tree_node *ast_node); >> +void cil_destroy_userattribute(struct cil_userattribute *attr); >> +int cil_gen_userattributeset(struct cil_db *db, struct cil_tree_node >*parse_current, struct cil_tree_node *ast_node); >> +void cil_destroy_userattributeset(struct cil_userattributeset *attrset); >> int cil_gen_userlevel(struct cil_db *db, struct cil_tree_node >*parse_current, struct cil_tree_node *ast_node); >> void cil_destroy_userlevel(struct cil_userlevel *usrlvl); >> int cil_gen_userrange(struct cil_db *db, struct cil_tree_node >*parse_current, struct cil_tree_node *ast_node); >> diff --git a/libsepol/cil/src/cil_copy_ast.c b/libsepol/cil/src/cil_copy_ast.c >> index d488870..8c50ff0 100644 >> --- a/libsepol/cil/src/cil_copy_ast.c >> +++ b/libsepol/cil/src/cil_copy_ast.c >> @@ -392,6 +392,41 @@ int cil_copy_user(__attribute__((unused)) struct >cil_db *db, void *data, void ** >> return SEPOL_OK; >> } >> >> +int cil_copy_userattribute(__attribute__((unused)) struct cil_db *db, >void *data, void **copy, symtab_t *symtab) >> +{ >> + struct cil_userattribute *orig = data; >> + struct cil_userattribute *new = NULL; >> + char *key = orig->datum.name; >> + struct cil_symtab_datum *datum = NULL; >> + >> + cil_symtab_get_datum(symtab, key, &datum); >> + if (datum == NULL) { >> + cil_userattribute_init(&new); >> + *copy = new; >> + } else { >> + *copy = datum; >> + } >> + >> + return SEPOL_OK; >> +} >> + >> +int cil_copy_userattributeset(struct cil_db *db, void *data, void **copy, >__attribute__((unused)) symtab_t *symtab) >> +{ >> + struct cil_userattributeset *orig = data; >> + struct cil_userattributeset *new = NULL; >> + >> + cil_userattributeset_init(&new); >> + >> + new->attr_str = orig->attr_str; >> + >> + cil_copy_expr(db, orig->str_expr, &new->str_expr); >> + cil_copy_expr(db, orig->datum_expr, &new->datum_expr); >> + >> + *copy = new; >> + >> + return SEPOL_OK; >> +} >> + >> int cil_copy_userrole(__attribute__((unused)) struct cil_db *db, void >*data, void **copy, __attribute__((unused)) symtab_t *symtab) >> { >> struct cil_userrole *orig = data; >> @@ -1717,6 +1752,12 @@ int __cil_copy_node_helper(struct >cil_tree_node *orig, __attribute__((unused)) u >> case CIL_USER: >> copy_func = &cil_copy_user; >> break; >> + case CIL_USERATTRIBUTE: >> + copy_func = &cil_copy_userattribute; >> + break; >> + case CIL_USERATTRIBUTESET: >> + copy_func = &cil_copy_userattributeset; >> + break; >> case CIL_USERROLE: >> copy_func = &cil_copy_userrole; >> break; >> diff --git a/libsepol/cil/src/cil_copy_ast.h b/libsepol/cil/src/cil_copy_ast.h >> index bd3a231..78c34b8 100644 >> --- a/libsepol/cil/src/cil_copy_ast.h >> +++ b/libsepol/cil/src/cil_copy_ast.h >> @@ -57,6 +57,8 @@ int cil_copy_sid(struct cil_db *db, void *data, void >**copy, symtab_t *symtab); >> int cil_copy_sidcontext(struct cil_db *db, void *data, void **copy, >symtab_t *symtab); >> int cil_copy_sidorder(struct cil_db *db, void *data, void **copy, >symtab_t *symtab); >> int cil_copy_user(struct cil_db *db, void *data, void **copy, symtab_t >*symtab); >> +int cil_copy_userattribute(struct cil_db *db, void *data, void **copy, >symtab_t *symtab); >> +int cil_copy_userattributeset(struct cil_db *db, void *data, void **copy, >symtab_t *symtab); >> int cil_copy_userrole(struct cil_db *db, void *data, void **copy, >symtab_t *symtab); >> int cil_copy_userlevel(struct cil_db *db, void *data, void **copy, >symtab_t *symtab); >> int cil_copy_userrange(struct cil_db *db, void *data, void **copy, >symtab_t *symtab); >> diff --git a/libsepol/cil/src/cil_flavor.h b/libsepol/cil/src/cil_flavor.h >> index 79483c7..9fb5083 100644 >> --- a/libsepol/cil/src/cil_flavor.h >> +++ b/libsepol/cil/src/cil_flavor.h >> @@ -63,6 +63,7 @@ enum cil_flavor { >> CIL_CLASSPERMISSIONSET, >> CIL_USERPREFIX, >> CIL_USERROLE, >> + CIL_USERATTRIBUTESET, >> CIL_USERLEVEL, >> CIL_USERRANGE, >> CIL_USERBOUNDS, >> @@ -164,6 +165,7 @@ enum cil_flavor { >> CIL_MAP_CLASS, >> CIL_CLASSPERMISSION, >> CIL_USER, >> + CIL_USERATTRIBUTE, >> CIL_ROLE, >> CIL_ROLEATTRIBUTE, >> CIL_TYPE, >> diff --git a/libsepol/cil/src/cil_internal.h b/libsepol/cil/src/cil_internal.h >> index e596ab5..a736eff 100644 >> --- a/libsepol/cil/src/cil_internal.h >> +++ b/libsepol/cil/src/cil_internal.h >> @@ -127,6 +127,8 @@ char *CIL_KEY_TRANS; >> char *CIL_KEY_TYPE; >> char *CIL_KEY_ROLE; >> char *CIL_KEY_USER; >> +char *CIL_KEY_USERATTRIBUTE; >> +char *CIL_KEY_USERATTRIBUTESET; >> char *CIL_KEY_SENSITIVITY; >> char *CIL_KEY_CATEGORY; >> char *CIL_KEY_CATSET; >> @@ -290,8 +292,10 @@ struct cil_db { >> int num_cats; >> int num_types; >> int num_roles; >> + int num_users; >> struct cil_type **val_to_type; >> struct cil_role **val_to_role; >> + struct cil_user **val_to_user; >> int disable_dontaudit; >> int disable_neverallow; >> int preserve_tunables; >> @@ -418,14 +422,27 @@ struct cil_sidorder { >> struct cil_user { >> struct cil_symtab_datum datum; >> struct cil_user *bounds; >> - struct cil_list *roles; >> + ebitmap_t *roles; >> struct cil_level *dftlevel; >> struct cil_levelrange *range; >> + int value; >> +}; >> + >> +struct cil_userattribute { >> + struct cil_symtab_datum datum; >> + struct cil_list *expr_list; >> + ebitmap_t *users; >> +}; >> + >> +struct cil_userattributeset { >> + char *attr_str; >> + struct cil_list *str_expr; >> + struct cil_list *datum_expr; >> }; >> >> struct cil_userrole { >> char *user_str; >> - struct cil_user *user; >> + void *user; >> char *role_str; >> void *role; >> }; >> @@ -1002,5 +1019,7 @@ void cil_default_init(struct cil_default **def); >> void cil_defaultrange_init(struct cil_defaultrange **def); >> void cil_handleunknown_init(struct cil_handleunknown **unk); >> void cil_mls_init(struct cil_mls **mls); >> +void cil_userattribute_init(struct cil_userattribute **attribute); >> +void cil_userattributeset_init(struct cil_userattributeset **attrset); >> >> #endif >> diff --git a/libsepol/cil/src/cil_policy.c b/libsepol/cil/src/cil_policy.c >> index eefcbc1..a9e2426 100644 >> --- a/libsepol/cil/src/cil_policy.c >> +++ b/libsepol/cil/src/cil_policy.c >> @@ -1155,11 +1155,6 @@ int __cil_gen_policy_node_helper(struct >cil_tree_node *node, uint32_t *finished, >> case CIL_USER: >> cil_multimap_insert(users, node->data, NULL, >CIL_USERROLE, CIL_NONE); >> break; >> - case CIL_USERROLE: { >> - struct cil_userrole *userrole = node->data; >> - cil_multimap_insert(users, &userrole->user- >>datum, (struct cil_symtab_datum *)userrole->role, CIL_USERROLE, >CIL_ROLE); >> - } >> - break; >> case CIL_CATALIAS: { >> struct cil_alias *alias = node->data; >> struct cil_symtab_datum *datum = alias->actual; >> diff --git a/libsepol/cil/src/cil_post.c b/libsepol/cil/src/cil_post.c >> index c4ea66a..8050bbb 100644 >> --- a/libsepol/cil/src/cil_post.c >> +++ b/libsepol/cil/src/cil_post.c >> @@ -375,6 +375,17 @@ static int __cil_post_db_count_helper(struct >cil_tree_node *node, uint32_t *fini >> } >> break; >> } >> + case CIL_USER: { >> + struct cil_user *user = node->data; >> + if (user->datum.nodes->head->data == node) { >> + // multiple AST nodes can point to the same >cil_user data (like if >> + // copied from a macro). This check ensures we >only count the >> + // duplicates once >> + user->value = db->num_users; >> + db->num_users++; >> + } >> + break; >> + } >> case CIL_NETIFCON: >> db->netifcon->count++; >> break; >> @@ -446,6 +457,14 @@ static int __cil_post_db_array_helper(struct >cil_tree_node *node, __attribute__( >> db->val_to_role[role->value] = role; >> break; >> } >> + case CIL_USER: { >> + struct cil_user *user= node->data; >> + if (db->val_to_user == NULL) { >> + db->val_to_user = cil_malloc(sizeof(*db- >>val_to_user) * db->num_users); >> + } >> + db->val_to_user[user->value] = user; >> + break; >> + } >> case CIL_USERPREFIX: { >> cil_list_append(db->userprefixes, CIL_USERPREFIX, node- >>data); >> break; >> @@ -638,6 +657,54 @@ exit: >> return rc; >> } >> >> +static int __evaluate_user_expression(struct cil_userattribute *attr, >struct cil_db *db) >> +{ >> + int rc; >> + >> + attr->users = cil_malloc(sizeof(*attr->users)); >> + rc = __cil_expr_list_to_bitmap(attr->expr_list, attr->users, db- >>num_users, db); >> + if (rc != SEPOL_OK) { >> + cil_log(CIL_ERR, "Failed to expand user attribute to >bitmap\n"); >> + ebitmap_destroy(attr->users); >> + free(attr->users); >> + attr->users = NULL; >> + } >> + return rc; >> +} >> + >> +static int __cil_user_to_bitmap(struct cil_symtab_datum *datum, >ebitmap_t *bitmap, struct cil_db *db) >> +{ >> + int rc = SEPOL_ERR; >> + struct cil_tree_node *node = datum->nodes->head->data; >> + struct cil_userattribute *attr = NULL; >> + struct cil_user *user = NULL; >> + >> + ebitmap_init(bitmap); >> + >> + if (node->flavor == CIL_USERATTRIBUTE) { >> + attr = (struct cil_userattribute *)datum; >> + if (attr->users == NULL) { >> + rc = __evaluate_user_expression(attr, db); >> + if (rc != SEPOL_OK) { >> + goto exit; >> + } >> + } >> + ebitmap_union(bitmap, attr->users); >> + } else { >> + user = (struct cil_user *)datum; >> + if (ebitmap_set_bit(bitmap, user->value, 1)) { >> + cil_log(CIL_ERR, "Failed to set user bit\n"); >> + ebitmap_destroy(bitmap); >> + goto exit; >> + } >> + } >> + >> + return SEPOL_OK; >> + >> +exit: >> + return rc; >> +} >> + >> static int __evaluate_role_expression(struct cil_roleattribute *attr, >struct cil_db *db) >> { >> int rc; >> @@ -941,6 +1008,9 @@ static int __cil_expr_to_bitmap_helper(struct >cil_list_item *curr, enum cil_flav >> case CIL_ROLE: >> rc = __cil_role_to_bitmap(curr->data, bitmap, db); >> break; >> + case CIL_USER: >> + rc = __cil_user_to_bitmap(curr->data, bitmap, db); >> + break; >> case CIL_PERM: >> rc = __cil_perm_to_bitmap(curr->data, bitmap, >db); >> break; >> @@ -1163,6 +1233,16 @@ static int __cil_post_db_attr_helper(struct >cil_tree_node *node, __attribute__(( >> if (rc != SEPOL_OK) goto exit; >> break; >> } >> + case CIL_USERATTRIBUTE: { >> + struct cil_userattribute *attr = node->data; >> + if (attr->users == NULL) { >> + rc = __evaluate_user_expression(attr, db); >> + if (rc != SEPOL_OK) { >> + goto exit; >> + } >> + } >> + break; >> + } >> default: >> break; >> } >> @@ -1268,6 +1348,102 @@ exit: >> return rc; >> } >> >> +static int __cil_user_assign_roles(struct cil_user *user, struct >cil_symtab_datum *datum) >> +{ >> + struct cil_tree_node *node = datum->nodes->head->data; >> + struct cil_role *role = NULL; >> + struct cil_roleattribute *attr = NULL; >> + >> + if (user->roles == NULL) { >> + user->roles = cil_malloc(sizeof(*user->roles)); >> + ebitmap_init(user->roles); >> + } >> + >> + if (node->flavor == CIL_ROLE) { >> + role = (struct cil_role *)datum; >> + if (ebitmap_set_bit(user->roles, role->value, 1)) { >> + cil_log(CIL_INFO, "Failed to set bit in user roles >bitmap\n"); >> + goto exit; >> + } >> + } else if (node->flavor == CIL_ROLEATTRIBUTE) { >> + attr = (struct cil_roleattribute *)datum; >> + ebitmap_union(user->roles, attr->roles); >> + } >> + >> + return SEPOL_OK; >> + >> +exit: >> + return SEPOL_ERR; >> +} >> + >> +static int __cil_post_db_userrole_helper(struct cil_tree_node *node, >__attribute__((unused)) uint32_t *finished, void *extra_args) >> +{ >> + int rc = SEPOL_ERR; >> + struct cil_db *db = extra_args; >> + struct cil_block *blk = NULL; >> + struct cil_userrole *userrole = NULL; >> + struct cil_symtab_datum *user_datum = NULL; >> + struct cil_symtab_datum *role_datum = NULL; >> + struct cil_tree_node *user_node = NULL; >> + struct cil_userattribute *u_attr = NULL; >> + unsigned int i; >> + struct cil_user *user = NULL; >> + ebitmap_node_t *unode = NULL; >> + >> + switch (node->flavor) { >> + case CIL_BLOCK: { >> + blk = node->data; >> + if (blk->is_abstract == CIL_TRUE) { >> + *finished = CIL_TREE_SKIP_HEAD; >> + } >> + break; >> + } >> + case CIL_MACRO: { >> + *finished = CIL_TREE_SKIP_HEAD; >> + break; >> + } >> + case CIL_USERROLE: { >> + userrole = node->data; >> + user_datum = userrole->user; >> + role_datum = userrole->role; >> + user_node = user_datum->nodes->head->data; >> + >> + if (user_node->flavor == CIL_USERATTRIBUTE) { >> + u_attr = userrole->user; >> + >> + ebitmap_for_each_bit(u_attr->users, unode, i) { >> + if (!ebitmap_get_bit(u_attr->users, i)) { >> + continue; >> + } >> + >> + user = db->val_to_user[i]; >> + >> + rc = __cil_user_assign_roles(user, >role_datum); >> + if (rc != SEPOL_OK) { >> + goto exit; >> + } >> + } >> + } else { >> + user = userrole->user; >> + >> + rc = __cil_user_assign_roles(user, role_datum); >> + if (rc != SEPOL_OK) { >> + goto exit; >> + } >> + } >> + >> + break; >> + } >> + default: >> + break; >> + } >> + >> + return SEPOL_OK; >> +exit: >> + cil_log(CIL_INFO, "cil_post_db_userrole_helper failed\n"); >> + return rc; >> +} >> + >> static int __evaluate_level_expression(struct cil_level *level, struct >cil_db *db) >> { >> if (level->cats != NULL) { >> @@ -1739,6 +1915,12 @@ static int cil_post_db(struct cil_db *db) >> goto exit; >> } >> >> + rc = cil_tree_walk(db->ast->root, __cil_post_db_userrole_helper, >NULL, NULL, db); >> + if (rc != SEPOL_OK) { >> + cil_log(CIL_INFO, "Failed during userrole association\n"); >> + goto exit; >> + } >> + >> rc = cil_tree_walk(db->ast->root, __cil_post_db_classperms_helper, >NULL, NULL, db); >> if (rc != SEPOL_OK) { >> cil_log(CIL_INFO, "Failed to evaluate class mapping >permissions expressions\n"); >> diff --git a/libsepol/cil/src/cil_reset_ast.c b/libsepol/cil/src/cil_reset_ast.c >> index 92f7720..09cff05 100644 >> --- a/libsepol/cil/src/cil_reset_ast.c >> +++ b/libsepol/cil/src/cil_reset_ast.c >> @@ -99,7 +99,32 @@ static void cil_reset_user(struct cil_user *user) >> user->bounds = NULL; >> user->dftlevel = NULL; >> user->range = NULL; >> - cil_list_destroy(&user->roles, CIL_FALSE); >> +} >> + >> +static void cil_reset_userattr(struct cil_userattribute *attr) >> +{ >> + struct cil_list_item *expr = NULL; >> + struct cil_list_item *next = NULL; >> + >> + /* during a re-resolve, we need to reset the lists of expression >stacks associated with this attribute from a userattribute statement */ >> + if (attr->expr_list != NULL) { >> + /* we don't want to destroy the expression stacks (cil_list) >inside >> + * this list cil_list_destroy destroys sublists, so we need to >do it >> + * manually */ >> + expr = attr->expr_list->head; >> + while (expr != NULL) { >> + next = expr->next; >> + cil_list_item_destroy(&expr, CIL_FALSE); >> + expr = next; >> + } >> + free(attr->expr_list); >> + attr->expr_list = NULL; >> + } >> +} >> + >> +static void cil_reset_userattributeset(struct cil_userattributeset *uas) >> +{ >> + cil_list_destroy(&uas->datum_expr, CIL_FALSE); >> } >> >> static void cil_reset_selinuxuser(struct cil_selinuxuser *selinuxuser) >> @@ -403,6 +428,12 @@ int __cil_reset_node(struct cil_tree_node >*node, __attribute__((unused)) uint32 >> case CIL_USER: >> cil_reset_user(node->data); >> break; >> + case CIL_USERATTRIBUTE: >> + cil_reset_userattr(node->data); >> + break; >> + case CIL_USERATTRIBUTESET: >> + cil_reset_userattributeset(node->data); >> + break; >> case CIL_SELINUXUSERDEFAULT: >> case CIL_SELINUXUSER: >> cil_reset_selinuxuser(node->data); >> diff --git a/libsepol/cil/src/cil_resolve_ast.c >b/libsepol/cil/src/cil_resolve_ast.c >> index 5ff4534..0df5c63 100644 >> --- a/libsepol/cil/src/cil_resolve_ast.c >> +++ b/libsepol/cil/src/cil_resolve_ast.c >> @@ -820,12 +820,6 @@ int cil_resolve_userrole(struct cil_tree_node >*current, void *extra_args) >> } >> userrole->role = role_datum; >> >> - if (userrole->user->roles == NULL) { >> - cil_list_init(&userrole->user->roles, CIL_LIST_ITEM); >> - } >> - >> - cil_list_append(userrole->user->roles, CIL_ROLE, userrole->role); >> - >> return SEPOL_OK; >> >> exit: >> @@ -838,12 +832,22 @@ int cil_resolve_userlevel(struct cil_tree_node >*current, void *extra_args) >> struct cil_symtab_datum *user_datum = NULL; >> struct cil_symtab_datum *lvl_datum = NULL; >> struct cil_user *user = NULL; >> + struct cil_tree_node *user_node = NULL; >> int rc = SEPOL_ERR; >> >> rc = cil_resolve_name(current, usrlvl->user_str, CIL_SYM_USERS, >extra_args, &user_datum); >> if (rc != SEPOL_OK) { >> goto exit; >> } >> + >> + user_node = user_datum->nodes->head->data; >> + >> + if (user_node->flavor != CIL_USER) { >> + cil_log(CIL_ERR, "Userlevel must be a user\n"); >> + rc = SEPOL_ERR; >> + goto exit; >> + } >> + >> user = (struct cil_user*)user_datum; >> >> if (usrlvl->level_str != NULL) { >> @@ -881,12 +885,22 @@ int cil_resolve_userrange(struct cil_tree_node >*current, void *extra_args) >> struct cil_symtab_datum *user_datum = NULL; >> struct cil_symtab_datum *range_datum = NULL; >> struct cil_user *user = NULL; >> + struct cil_tree_node *user_node = NULL; >> int rc = SEPOL_ERR; >> >> rc = cil_resolve_name(current, userrange->user_str, >CIL_SYM_USERS, extra_args, &user_datum); >> if (rc != SEPOL_OK) { >> goto exit; >> } >> + >> + user_node = user_datum->nodes->head->data; >> + >> + if (user_node->flavor != CIL_USER) { >> + cil_log(CIL_ERR, "Userrange must be a user: %s\n", >user_datum->fqn); >> + rc = SEPOL_ERR; >> + goto exit; >> + } >> + >> user = (struct cil_user*)user_datum; >> >> if (userrange->range_str != NULL) { >> @@ -922,12 +936,22 @@ int cil_resolve_userprefix(struct cil_tree_node >*current, void *extra_args) >> { >> struct cil_userprefix *userprefix = current->data; >> struct cil_symtab_datum *user_datum = NULL; >> + struct cil_tree_node *user_node = NULL; >> int rc = SEPOL_ERR; >> >> rc = cil_resolve_name(current, userprefix->user_str, >CIL_SYM_USERS, extra_args, &user_datum); >> if (rc != SEPOL_OK) { >> goto exit; >> } >> + >> + user_node = user_datum->nodes->head->data; >> + >> + if (user_node->flavor != CIL_USER) { >> + cil_log(CIL_ERR, "Userprefix must be a user: %s\n", >user_datum->fqn); >> + rc = SEPOL_ERR; >> + goto exit; >> + } >> + >> userprefix->user = (struct cil_user*)user_datum; >> >> exit: >> @@ -939,12 +963,22 @@ int cil_resolve_selinuxuser(struct cil_tree_node >*current, void *extra_args) >> struct cil_selinuxuser *selinuxuser = current->data; >> struct cil_symtab_datum *user_datum = NULL; >> struct cil_symtab_datum *lvlrange_datum = NULL; >> + struct cil_tree_node *user_node = NULL; >> int rc = SEPOL_ERR; >> >> rc = cil_resolve_name(current, selinuxuser->user_str, >CIL_SYM_USERS, extra_args, &user_datum); >> if (rc != SEPOL_OK) { >> goto exit; >> } >> + >> + user_node = user_datum->nodes->head->data; >> + >> + if (user_node->flavor != CIL_USER) { >> + cil_log(CIL_ERR, "Selinuxuser must be a user: %s\n", >user_datum->fqn); >> + rc = SEPOL_ERR; >> + goto exit; >> + } >> + >> selinuxuser->user = (struct cil_user*)user_datum; >> >> if (selinuxuser->range_str != NULL) { >> @@ -1715,7 +1749,7 @@ int cil_resolve_context(struct cil_tree_node >*current, struct cil_context *conte >> struct cil_symtab_datum *user_datum = NULL; >> struct cil_symtab_datum *role_datum = NULL; >> struct cil_symtab_datum *type_datum = NULL; >> - struct cil_tree_node *type_node = NULL; >> + struct cil_tree_node *node = NULL; >> struct cil_symtab_datum *lvlrange_datum = NULL; >> >> int rc = SEPOL_ERR; >> @@ -1724,12 +1758,29 @@ int cil_resolve_context(struct cil_tree_node >*current, struct cil_context *conte >> if (rc != SEPOL_OK) { >> goto exit; >> } >> + >> + node = user_datum->nodes->head->data; >> + >> + if (node->flavor != CIL_USER) { >> + cil_log(CIL_ERR, "Context user must be a user: %s\n", >user_datum->fqn); >> + rc = SEPOL_ERR; >> + goto exit; >> + } >> + >> context->user = (struct cil_user*)user_datum; >> >> rc = cil_resolve_name(current, context->role_str, CIL_SYM_ROLES, >extra_args, &role_datum); >> if (rc != SEPOL_OK) { >> goto exit; >> } >> + >> + node = role_datum->nodes->head->data; >> + if (node->flavor != CIL_ROLE) { >> + rc = SEPOL_ERR; >> + cil_log(CIL_ERR, "Context role not a role: %s\n", >role_datum->fqn); >> + goto exit; >> + } >> + >> context->role = (struct cil_role*)role_datum; >> >> rc = cil_resolve_name(current, context->type_str, CIL_SYM_TYPES, >extra_args, &type_datum); >> @@ -1737,9 +1788,9 @@ int cil_resolve_context(struct cil_tree_node >*current, struct cil_context *conte >> goto exit; >> } >> >> - type_node = type_datum->nodes->head->data; >> + node = type_datum->nodes->head->data; >> >> - if (type_node->flavor != CIL_TYPE && type_node->flavor != >CIL_TYPEALIAS) { >> + if (node->flavor != CIL_TYPE && node->flavor != CIL_TYPEALIAS) { >> rc = SEPOL_ERR; >> cil_log(CIL_ERR, "Type not a type or type alias\n"); >> goto exit; >> @@ -3036,6 +3087,48 @@ exit: >> return rc; >> } >> >> +int cil_resolve_userattributeset(struct cil_tree_node *current, void >*extra_args) >> +{ >> + int rc = SEPOL_ERR; >> + struct cil_userattributeset *attrusers = current->data; >> + struct cil_symtab_datum *attr_datum = NULL; >> + struct cil_tree_node *attr_node = NULL; >> + struct cil_userattribute *attr = NULL; >> + >> + rc = cil_resolve_name(current, attrusers->attr_str, CIL_SYM_USERS, >extra_args, &attr_datum); >> + if (rc != SEPOL_OK) { >> + goto exit; >> + } >> + attr_node = attr_datum->nodes->head->data; >> + >> + if (attr_node->flavor != CIL_USERATTRIBUTE) { >> + rc = SEPOL_ERR; >> + cil_log(CIL_ERR, "Attribute user not an attribute\n"); >> + goto exit; >> + } >> + attr = (struct cil_userattribute*)attr_datum; >> + >> + rc = cil_resolve_expr(CIL_USERATTRIBUTESET, attrusers->str_expr, >&attrusers->datum_expr, current, extra_args); >> + if (rc != SEPOL_OK) { >> + goto exit; >> + } >> + >> + rc = cil_verify_no_self_reference(attr_datum, attrusers- >>datum_expr); >> + if (rc != SEPOL_OK) { >> + goto exit; >> + } >> + >> + if (attr->expr_list == NULL) { >> + cil_list_init(&attr->expr_list, CIL_USERATTRIBUTE); >> + } >> + >> + cil_list_append(attr->expr_list, CIL_LIST, attrusers->datum_expr); >> + >> + return SEPOL_OK; >> + >> +exit: >> + return rc; >> +} >> >> int __cil_resolve_ast_node(struct cil_tree_node *node, void *extra_args) >> { >> @@ -3296,6 +3389,9 @@ int __cil_resolve_ast_node(struct >cil_tree_node *node, void *extra_args) >> case CIL_DEFAULTRANGE: >> rc = cil_resolve_defaultrange(node, args); >> break; >> + case CIL_USERATTRIBUTESET: >> + rc = cil_resolve_userattributeset(node, args); >> + break; >> default: >> break; >> } >> diff --git a/libsepol/cil/src/cil_resolve_ast.h >b/libsepol/cil/src/cil_resolve_ast.h >> index e99f0a4..1175f97 100644 >> --- a/libsepol/cil/src/cil_resolve_ast.h >> +++ b/libsepol/cil/src/cil_resolve_ast.h >> @@ -54,6 +54,7 @@ int cil_resolve_userlevel(struct cil_tree_node >*current, void *extra_args); >> int cil_resolve_userrange(struct cil_tree_node *current, void >*extra_args); >> int cil_resolve_userbounds(struct cil_tree_node *current, void >*extra_args); >> int cil_resolve_userprefix(struct cil_tree_node *current, void >*extra_args); >> +int cil_resolve_userattributeset(struct cil_tree_node *current, void >*extra_args); >> int cil_resolve_selinuxuser(struct cil_tree_node *current, void >*extra_args); >> int cil_resolve_roletype(struct cil_tree_node *current, void *extra_args); >> int cil_resolve_roletransition(struct cil_tree_node *current, void >*extra_args); >> diff --git a/libsepol/cil/src/cil_tree.c b/libsepol/cil/src/cil_tree.c >> index 6a731f2..f641baa 100644 >> --- a/libsepol/cil/src/cil_tree.c >> +++ b/libsepol/cil/src/cil_tree.c >> @@ -640,15 +640,18 @@ void cil_tree_print_node(struct cil_tree_node >*node) >> case CIL_USERROLE: { >> struct cil_userrole *userrole = node->data; >> cil_log(CIL_INFO, "USERROLE:"); >> + struct cil_symtab_datum *datum = NULL; >> >> if (userrole->user != NULL) { >> - cil_log(CIL_INFO, " %s", userrole->user- >>datum.name); >> + datum = userrole->user; >> + cil_log(CIL_INFO, " %s", datum->name); >> } else if (userrole->user_str != NULL) { >> cil_log(CIL_INFO, " %s", userrole->user_str); >> } >> >> if (userrole->role != NULL) { >> - cil_log(CIL_INFO, " %s", ((struct >cil_symtab_datum *)userrole->role)->name); >> + datum = userrole->role; >> + cil_log(CIL_INFO, " %s", datum->name); >> } else if (userrole->role_str != NULL) { >> cil_log(CIL_INFO, " %s", userrole->role_str); >> } >> @@ -785,6 +788,21 @@ void cil_tree_print_node(struct cil_tree_node >*node) >> cil_log(CIL_INFO, "ROLEATTRIBUTE: %s\n", attr- >>datum.name); >> return; >> } >> + case CIL_USERATTRIBUTESET: { >> + struct cil_userattributeset *attr = node->data; >> + >> + cil_log(CIL_INFO, "(USERATTRIBUTESET %s ", attr- >>attr_str); >> + >> + cil_tree_print_expr(attr->datum_expr, attr- >>str_expr); >> + >> + cil_log(CIL_INFO, "\n"); >> + return; >> + } >> + case CIL_USERATTRIBUTE: { >> + struct cil_userattribute *attr = node->data; >> + cil_log(CIL_INFO, "USERATTRIBUTE: %s\n", attr- >>datum.name); >> + return; >> + } >> case CIL_ROLEBOUNDS: { >> struct cil_bounds *bnds = node->data; >> cil_log(CIL_INFO, "ROLEBOUNDS: role: %s, bounds: >%s\n", bnds->parent_str, bnds->child_str); >> diff --git a/libsepol/cil/src/cil_verify.c b/libsepol/cil/src/cil_verify.c >> index 065de88..9ebfa81 100644 >> --- a/libsepol/cil/src/cil_verify.c >> +++ b/libsepol/cil/src/cil_verify.c >> @@ -737,16 +737,8 @@ int __cil_verify_context(struct cil_db *db, struct >cil_context *ctx) >> int found = CIL_FALSE; >> >> if (user->roles != NULL) { >> - cil_list_for_each(curr, user->roles) { >> - struct cil_role *userrole = curr->data; >> - if (userrole == role) { >> - break; >> - } >> - } >> - >> - if (curr == NULL) { >> - cil_log(CIL_ERR, "Role %s is invalid for user %s\n", >> - ctx->role_str, ctx->user_str); >> + if (!ebitmap_get_bit(user->roles, role->value)) { >> + cil_log(CIL_ERR, "Role %s is invalid for user %s\n", >ctx->role_str, ctx->user_str); >> rc = SEPOL_ERR; >> goto exit; >> } >> diff --git a/secilc/docs/cil_constraint_statements.xml >b/secilc/docs/cil_constraint_statements.xml >> index 6f5d9c6..8ef1642 100644 >> --- a/secilc/docs/cil_constraint_statements.xml >> +++ b/secilc/docs/cil_constraint_statements.xml >> @@ -51,7 +51,7 @@ >> <simpara>and:</simpara> >> <simpara><literal> op : eq neq</literal></simpara> >> <simpara><literal> role_op : eq neq dom domby >incomp</literal></simpara> >> - <simpara><literal> user_id : A single <link >linkend="user">user</link> identifier.</literal></simpara> >> + <simpara><literal> user_id : A single <link >linkend="user">user</link> or <link >linkend="userattribute">userattribute</link> >identifier.</literal></simpara> >> <simpara><literal> role_id : A single <link >linkend="role">role</link> or <link >linkend="roleattribute">roleattribute</link> >identifier.</literal></simpara> >> <simpara><literal> type_id : A single <link >linkend="type">type</link>, <link linkend="typealias">typealias</link> or ><link linkend="typeattribute">typeattribute</link> >identifier.</literal></simpara> >> </entry> >> @@ -154,7 +154,7 @@ >> <simpara>and:</simpara> >> <simpara><literal> op : eq neq</literal></simpara> >> <simpara><literal> role_op : eq neq dom domby >incomp</literal></simpara> >> - <simpara><literal> user_id : A single <link >linkend="user">user</link> identifier.</literal></simpara> >> + <simpara><literal> user_id : A single <link >linkend="user">user</link> or <link >linkend="userattribute">userattribute</link> >identifier.</literal></simpara> >> <simpara><literal> role_id : A single <link >linkend="role">role</link> or <link >linkend="roleattribute">roleattribute</link> >identifier.</literal></simpara> >> <simpara><literal> type_id : A single <link >linkend="type">type</link>, <link linkend="typealias">typealias</link> or ><link linkend="typeattribute">typeattribute</link> >identifier.</literal></simpara> >> </entry> >> @@ -236,7 +236,7 @@ >> <simpara>and:</simpara> >> <simpara><literal> op : eq neq</literal></simpara> >> <simpara><literal> mls_role_op : eq neq dom domby >incomp</literal></simpara> >> - <simpara><literal> user_id : A single <link >linkend="user">user</link> identifier.</literal></simpara> >> + <simpara><literal> user_id : A single <link >linkend="user">user</link> or <link >linkend="userattribute">userattribute</link> >identifier.</literal></simpara> >> <simpara><literal> role_id : A single <link >linkend="role">role</link> or <link >linkend="roleattribute">roleattribute</link> >identifier.</literal></simpara> >> <simpara><literal> type_id : A single <link >linkend="type">type</link>, <link linkend="typealias">typealias</link> or ><link linkend="typeattribute">typeattribute</link> >identifier.</literal></simpara> >> </entry> >> @@ -332,7 +332,7 @@ >> <simpara>and:</simpara> >> <simpara><literal> op : eq neq</literal></simpara> >> <simpara><literal> mls_role_op : eq neq dom domby >incomp</literal></simpara> >> - <simpara><literal> user_id : A single <link >linkend="user">user</link> identifier.</literal></simpara> >> + <simpara><literal> user_id : A single <link >linkend="user">user</link> or <link >linkend="userattribute">userattribute</link> >identifier.</literal></simpara> >> <simpara><literal> role_id : A single <link >linkend="role">role</link> or <link >linkend="roleattribute">roleattribute</link> >identifier.</literal></simpara> >> <simpara><literal> type_id : A single <link >linkend="type">type</link>, <link linkend="typealias">typealias</link> or ><link linkend="typeattribute">typeattribute</link> >identifier.</literal></simpara> >> </entry> >> diff --git a/secilc/docs/cil_user_statements.xml >b/secilc/docs/cil_user_statements.xml >> index 9fa1a51..38a7d6e 100644 >> --- a/secilc/docs/cil_user_statements.xml >> +++ b/secilc/docs/cil_user_statements.xml >> @@ -66,7 +66,7 @@ >> <para><literal>user_id</literal></para> >> </entry> >> <entry> >> - <para>A previously declared SELinux <literal><link >linkend="user">user</link></literal> identifier.</para> >> + <para>A previously declared SELinux <literal><link >linkend="user">user</link></literal> or <literal><link >linkend="userattribute">userattribute</link></literal> identifier.</para> >> </entry> >> </row> >> <row> >> @@ -91,6 +91,114 @@ >> </programlisting> >> </sect2> >> >> + <sect2 id="userattribute"> >> + <title>userattribute</title> >> + <para>Declares a user attribute identifier in the current >namespace. The identifier may have zero or more <literal><link >linkend="user">user</link></literal> and <literal><link >linkend="userattribute">userattribute</link></literal> identifiers >associated to it via the <literal><link >linkend="userattributeset">userattributeset</link></literal> >statement.</para> >> + <para><emphasis role="bold">Statement >definition:</emphasis></para> >> + <programlisting><![CDATA[(userattribute >userattribute_id)]]></programlisting> >> + <para><emphasis role="bold">Where:</emphasis></para> >> + <informaltable frame="all"> >> + <tgroup cols="2"> >> + <colspec colwidth="2 *"/> >> + <colspec colwidth="6 *"/> >> + <tbody> >> + <row> >> + <entry> >> + <para><literal>userattribute</literal></para> >> + </entry> >> + <entry> >> + <para>The <literal>userattribute</literal> keyword.</para> >> + </entry> >> + </row> >> + <row> >> + <entry> >> + <para><literal>userattribute_id</literal></para> >> + </entry> >> + <entry> >> + <para>The <literal>userattribute</literal> >identifier.</para> >> + </entry> >> + </row> >> + </tbody></tgroup> >> + </informaltable> >> + >> + <para><emphasis role="bold">Example:</emphasis></para> >> + <para>This example will declare a user attribute ><literal>users.user_holder</literal> that will have an empty set:</para> >> + <programlisting><![CDATA[ >> +(block users >> + (userattribute user_holder) >> +)]]> >> + </programlisting> >> + </sect2> >> + >> + <sect2 id="userattributeset"> >> + <title>userattributeset</title> >> + <para>Allows the association of one or more previously declared ><literal><link linkend="user">user</link></literal> or <literal><link >linkend="userattribute">userattribute</link></literal> identifiers to a ><literal><link linkend="userattribute">userattribute</link></literal> >identifier. Expressions may be used to refine the associations as shown in >the examples.</para> >> + <para><emphasis role="bold">Statement >definition:</emphasis></para> >> + <programlisting><![CDATA[(userattributeset userattribute_id >(user_id ... | expr ...))]]></programlisting> >> + <para><emphasis role="bold">Where:</emphasis></para> >> + <informaltable frame="all"> >> + <tgroup cols="2"> >> + <colspec colwidth="2 *"/> >> + <colspec colwidth="6 *"/> >> + <tbody> >> + <row> >> + <entry> >> + <para><literal>userattributeset</literal></para> >> + </entry> >> + <entry> >> + <para>The <literal>userattributeset</literal> >keyword.</para> >> + </entry> >> + </row> >> + <row> >> + <entry> >> + <para><literal>userattribute_id</literal></para> >> + </entry> >> + <entry> >> + <para>A single previously declared <literal><link >linkend="roleattribute">userattribute</link></literal> identifier.</para> >> + </entry> >> + </row> >> + <row> >> + <entry> >> + <para><literal>user_id</literal></para> >> + </entry> >> + <entry> >> + <para>Zero or more previously declared <literal><link >linkend="role">user</link></literal> or <literal><link >linkend="userattribute">userattribute</link></literal> identifiers.</para> >> + <para>Note that there must be at least one ><literal>user_id</literal> or <literal>expr</literal> parameter >declared.</para> >> + </entry> >> + </row> >> + <row> >> + <entry> >> + <para><literal>expr</literal></para> >> + </entry> >> + <entry> >> + <para>Zero or more <literal>expr</literal>'s, the valid >operators and syntax are:</para> >> + <simpara><literal> (and (user_id ...) (user_id >...))</literal></simpara> >> + <simpara><literal> (or (user_id ...) (user_id >...))</literal></simpara> >> + <simpara><literal> (xor (user_id ...) (user_id >...))</literal></simpara> >> + <simpara><literal> (not (user_id ...))</literal></simpara> >> + <simpara><literal> (all)</literal></simpara> >> + </entry> >> + </row> >> + </tbody></tgroup> >> + </informaltable> >> + >> + <para><emphasis role="bold">Example:</emphasis></para> >> + <para>This example will declare three users and two user >attributes, then associate all the users to them as shown:</para> >> + <programlisting><![CDATA[ >> +(block users >> + (user user_1) >> + (user user_2) >> + (user user_3) >> + >> + (userattribute user_holder) >> + (userattributeset user_holder (user_1 user_2 user_3)) >> + >> + (userattribute user_holder_all) >> + (userattributeset user_holder_all (all)) >> +)]]> >> + </programlisting> >> + </sect2> >> + >> <sect2 id="userlevel"> >> <title>userlevel</title> >> <para>Associates a previously declared <literal><link >linkend="user">user</link></literal> identifier with a previously declared ><literal><link linkend="level">level</link></literal> identifier. The ><literal><link linkend="level">level</link></literal> may be named or >anonymous.</para> >> diff --git a/secilc/test/policy.cil b/secilc/test/policy.cil >> index 0b532a9..69103d1 100644 >> --- a/secilc/test/policy.cil >> +++ b/secilc/test/policy.cil >> @@ -124,7 +124,9 @@ >> (roleattribute foo_role) >> (roleattribute bar_role) >> (roleattribute baz_role) >> + (roleattribute foo_role_a) >> (roleattributeset exec_role (or user_r system_r)) >> + (roleattributeset foo_role_a (baz_r user_r system_r)) >> (roleattributeset foo_role (and exec_role system_r)) >> (roleattributeset bar_role (xor exec_role foo_role)) >> (roleattributeset baz_role (not user_r)) >> @@ -194,6 +196,7 @@ >> >> (role system_r) >> (role user_r) >> + (role baz_r) >> >> (roletype system_r bin_t) >> (roletype system_r kernel_t) >> @@ -207,6 +210,23 @@ >> >> (userrole foo_u foo_role) >> (userlevel foo_u low) >> + >> + (userattribute ua1) >> + (userattribute ua2) >> + (userattribute ua3) >> + (userattribute ua4) >> + (userattributeset ua1 (user_u system_u)) >> + (userattributeset ua2 (foo_u system_u)) >> + (userattributeset ua3 (and ua1 ua2)) >> + (user u5) >> + (user u6) >> + (userlevel u5 low) >> + (userlevel u6 low) >> + (userrange u5 low_high) >> + (userrange u6 low_high) >> + (userattributeset ua4 (u5 u6)) >> + (userrole ua4 foo_role_a) >> + >> (userrange foo_u low_high) >> >> (userrole system_u system_r) >> @@ -253,7 +273,7 @@ >> (constrain (files (read)) (not (or (and (eq t1 exec_t) (eq t2 bin_t)) >(eq r1 r2)))) >> (constrain char_w (not (or (and (eq t1 exec_t) (eq t2 bin_t)) (eq r1 >r2)))) >> >> - (constrain (file (read)) (or (and (eq t1 exec_t) (neq t2 bin_t) ) (eq u1 >u2) ) ) >> + (constrain (file (read)) (or (and (eq t1 exec_t) (neq t2 bin_t) ) (eq u1 >ua4) ) ) >> (constrain (file (open)) (dom r1 r2)) >> (constrain (file (open)) (domby r1 r2)) >> (constrain (file (open)) (incomp r1 r2)) >> -- >> 1.9.3 >> >> _______________________________________________ >> Selinux mailing list >> Selinux@xxxxxxxxxxxxx >> To unsubscribe, send email to Selinux-leave@xxxxxxxxxxxxx. >> To get help, send an email containing "help" to Selinux- >request@xxxxxxxxxxxxx. > >- -- >02DFF788 >4D30 903A 1CF3 B756 FB48 1514 3148 83A2 02DF F788 >https://sks- >keyservers.net/pks/lookup?op=get&search=0x314883A202DFF788 >Dominick Grift >-----BEGIN PGP SIGNATURE----- >Version: GnuPG v2 > >iQGcBAEBCgAGBQJV8beiAAoJENAR6kfG5xmcVKAMAK5tAZRQnq2gIOzRv1fnc >iOc >k91ABlOqm5j+ongchsRSJJj+mleKnzCVqPA/dtKbV3Nw5fWsrdgz4rLQpI9w+rCi >qiSewA+xDSgsxuBgASprIycRB3X1Hxg4T6e6qSyM95hT6LFsYpPhG078Td85q6 >w9 >lJ5zhvAKS8BIYOy3RZkR+ejEox9w/AxA6fCP66+vvQhqCwhmLTqH8X8l9+KHIM >m+ >0o81Ooa4vE/6BIU+dTctvqUJ69rkwVoau7IT0/qYDzcEepQoF9Ynb3I+JOamut >Mh >79DPB7bjuDf9p0GC7kusimsZtAmvvJSS5qB3oVAFhHaB/DNJpTYoJyhWIY/iErP >x >OTjinbzq2gr1ya9eXsqhcR2+AxagvKC7NEkivO9h6JESIjlPzmJfe0uAUeqtirXt >nvlU/5yckmF1TtxvI/HQGfH7SRy1S1zODMx5VkNhlycDo2EbPUyq9aqHKkK9wE >XP >rvo73IJBIyAt0iaCvKJTM+pGjBjMsJOu7/Liq3JnaQ== >=ZuJf >-----END PGP SIGNATURE----- _______________________________________________ Selinux mailing list Selinux@xxxxxxxxxxxxx To unsubscribe, send email to Selinux-leave@xxxxxxxxxxxxx. To get help, send an email containing "help" to Selinux-request@xxxxxxxxxxxxx.
