On Thu, Feb 27, 2020 at 2:51 PM Dominick Grift <dac.override@xxxxxxxxx> wrote:
>
> James Carter <jwcart2@xxxxxxxxx> writes:
>
> > Sorry, email problems has made life a bit difficult over the past
> > week. Steve had to forward this to me.
> >
> > So far, I am unable to duplicate what you are seeing.
>
> You can try it with my dssp3 policy:
>
> git clone git://defensec.nl/dssp3.git
> cd dssp3
> [kcinimod@brutus dssp3 (master=)]$ secilc `find . -name "*.cil"`
> [kcinimod@brutus dssp3 (master=)]$ sesearch policy.32 -T | grep sudo | grep tmp
> type_transition sudo.subj file.log:file pam.faillog.log btmp;
> type_transition sudo.subj file.tmp:file sudo.tmp;
> [kcinimod@brutus dssp3 (master=)]$ sed -i 's/(call obj_type_transition_tmp_fixme (subj file))/(call obj_type_transition_tmp (subj file "*"))/' poli
> cy/app/s/sudo.cil
> [kcinimod@brutus dssp3 (master *=)]$ secilc `find . -name "*.cil"`
> [kcinimod@brutus dssp3 (master *=)]$ sesearch policy.32 -T | grep sudo | grep tmp
> type_transition sudo.subj file.log:file pam.faillog.log btmp;
> type_transition sudo.subj file.tmp:file sudo.tmp ARG3;
>
> Note the "ARG3" in the latter result
>
I found the problem. In dssp3/policy/user/user_runtimeuser.cil there
is the following macro definition.
(macro obj_type_transition_runtimeuser ((type ARG1)(class ARG2)(name ARG2))
(call .file.runtimeuser_obj_type_transition
(ARG1 runtimeuser ARG2 ARG3)))
Notice that ARG2 is used twice and ARG3 is not actually an argument
and is taken as a name.
There are a couple of bugs here. First, CIL should give an error for
the duplicate argument names and, second, CIL should be checking if a
name is actually a macro parameter before it checks whether that name
is already in the name symbol table.
You were seeing what you saw because the macro above is never called
but it does put ARG3 into the symbol table so that it is not
recognized as a parameter later.
Jim
