On Thu, Jul 21, 2022 at 11:11 AM Christian Göttsche
<cgzones@xxxxxxxxxxxxxx> wrote:
>
> Support the compile time constraint with the following syntax:
>
> (segregateattributes (attr1 attr2 [...]))
Not a list. The vast majority of the cases are going to be that a type
can be either one or another.
(typesdisjoint attr1 attr2)
Keep it simple.
>
> and reports like:
>
> ...
> Qualifying Names
> Compile post process
> Building policy binary
> Checking Neverallows
> Checking Segregate Attributes
> Segregate Attributes violation, type test_type associated with attributes attr1 attr2
> Checking User Bounds
> Checking Role Bounds
> Checking Type Bounds
> Failed to generate binary
> Failed to build policydb
>
> Signed-off-by: Christian Göttsche <cgzones@xxxxxxxxxxxxxx>
> ---
> libsepol/cil/src/cil.c | 17 +++++++
> libsepol/cil/src/cil_binary.c | 75 ++++++++++++++++++++++++++++++
> libsepol/cil/src/cil_build_ast.c | 58 +++++++++++++++++++++++
> libsepol/cil/src/cil_build_ast.h | 2 +
> libsepol/cil/src/cil_copy_ast.c | 18 +++++++
> libsepol/cil/src/cil_flavor.h | 1 +
> libsepol/cil/src/cil_internal.h | 8 ++++
> libsepol/cil/src/cil_policy.c | 26 +++++++++++
> libsepol/cil/src/cil_reset_ast.c | 8 ++++
> libsepol/cil/src/cil_resolve_ast.c | 38 +++++++++++++++
> libsepol/cil/src/cil_resolve_ast.h | 1 +
> libsepol/cil/src/cil_write_ast.c | 11 +++++
> libsepol/src/kernel_to_cil.c | 32 +++++++++++++
> secilc/docs/README.md | 1 +
> secilc/docs/cil_type_statements.md | 50 ++++++++++++++++++++
> 15 files changed, 346 insertions(+)
>
> diff --git a/libsepol/cil/src/cil.c b/libsepol/cil/src/cil.c
> index 38edcf8e..cc6adb90 100644
> --- a/libsepol/cil/src/cil.c
> +++ b/libsepol/cil/src/cil.c
> @@ -225,6 +225,7 @@ char *CIL_KEY_SRC_CIL;
> char *CIL_KEY_SRC_HLL_LMS;
> char *CIL_KEY_SRC_HLL_LMX;
> char *CIL_KEY_SRC_HLL_LME;
> +char *CIL_KEY_SEGREGATEATTRIBUTES;
>
> static void cil_init_keys(void)
> {
> @@ -394,6 +395,7 @@ static void cil_init_keys(void)
> CIL_KEY_SRC_HLL_LMS = cil_strpool_add("lms");
> CIL_KEY_SRC_HLL_LMX = cil_strpool_add("lmx");
> CIL_KEY_SRC_HLL_LME = cil_strpool_add("lme");
> + CIL_KEY_SEGREGATEATTRIBUTES = cil_strpool_add("segregateattributes");
> }
>
> void cil_db_init(struct cil_db **db)
> @@ -426,6 +428,7 @@ void cil_db_init(struct cil_db **db)
> cil_list_init(&(*db)->userprefixes, CIL_LIST_ITEM);
> cil_list_init(&(*db)->selinuxusers, CIL_LIST_ITEM);
> cil_list_init(&(*db)->names, CIL_LIST_ITEM);
> + cil_list_init(&(*db)->segregateattributes, CIL_LIST_ITEM);
>
> cil_type_init(&(*db)->selftype);
> (*db)->selftype->datum.name = CIL_KEY_SELF;
> @@ -481,6 +484,7 @@ void cil_db_destroy(struct cil_db **db)
> cil_list_destroy(&(*db)->userprefixes, CIL_FALSE);
> cil_list_destroy(&(*db)->selinuxusers, CIL_FALSE);
> cil_list_destroy(&(*db)->names, CIL_TRUE);
> + cil_list_destroy(&(*db)->segregateattributes, CIL_FALSE);
>
> cil_destroy_type((*db)->selftype);
>
> @@ -1005,6 +1009,9 @@ void cil_destroy_data(void **data, enum cil_flavor flavor)
> case CIL_SRC_INFO:
> cil_destroy_src_info(*data);
> break;
> + case CIL_SEGREGATEATTRIBUTES:
> + cil_destroy_segregateattributes(*data);
> + break;
> case CIL_OP:
> case CIL_CONS_OPERAND:
> break;
> @@ -1413,6 +1420,8 @@ const char * cil_node_to_string(struct cil_tree_node *node)
> return CIL_KEY_CONS_H1;
> case CIL_CONS_H2:
> return CIL_KEY_CONS_H2;
> + case CIL_SEGREGATEATTRIBUTES:
> + return CIL_KEY_SEGREGATEATTRIBUTES;
>
> default:
> break;
> @@ -2904,3 +2913,11 @@ void cil_src_info_init(struct cil_src_info **info)
> (*info)->hll_line = 0;
> (*info)->path = NULL;
> }
> +
> +void cil_segregateattributes_init(struct cil_segregateattributes **sattrs)
> +{
> + *sattrs = cil_malloc(sizeof(**sattrs));
> +
> + (*sattrs)->str_expr = NULL;
> + (*sattrs)->datum_expr = NULL;
> +}
> diff --git a/libsepol/cil/src/cil_binary.c b/libsepol/cil/src/cil_binary.c
> index 40615db2..0301d739 100644
> --- a/libsepol/cil/src/cil_binary.c
> +++ b/libsepol/cil/src/cil_binary.c
> @@ -3818,6 +3818,38 @@ exit:
> return SEPOL_ERR;
> }
>
> +static int cil_segregateattributes_to_policydb(policydb_t *pdb, const struct cil_segregateattributes *sattrs)
> +{
> + segregate_attributes_rule_t *sattr;
> + struct cil_list_item *curr;
> + type_datum_t *sepol_type;
> + int rc = SEPOL_ERR;
> +
> + sattr = cil_malloc(sizeof(segregate_attributes_rule_t));
> + ebitmap_init(&sattr->attrs);
> +
> + cil_list_for_each(curr, sattrs->datum_expr) {
> + rc = __cil_get_sepol_type_datum(pdb, DATUM(curr->data), &sepol_type);
> + if (rc != SEPOL_OK) goto exit;
> +
> + if (ebitmap_set_bit(&sattr->attrs, sepol_type->s.value - 1, 1)) {
> + goto exit;
> + }
> + }
> +
> + sattr->next = pdb->segregate_attributes;
> + pdb->segregate_attributes = sattr;
> +
> + return SEPOL_OK;
> +
> +exit:
> + if (sattr) {
> + ebitmap_destroy(&sattr->attrs);
> + free(sattr);
> + }
> + return rc;
> +}
> +
> static int __cil_node_to_policydb(struct cil_tree_node *node, void *extra_args)
> {
> int rc = SEPOL_OK;
> @@ -3960,6 +3992,9 @@ static int __cil_node_to_policydb(struct cil_tree_node *node, void *extra_args)
> case CIL_DEFAULTRANGE:
> rc = cil_defaultrange_to_policydb(pdb, node->data);
> break;
> + case CIL_SEGREGATEATTRIBUTES:
> + rc = cil_segregateattributes_to_policydb(pdb, node->data);
> + break;
> default:
> break;
> }
> @@ -4890,6 +4925,42 @@ exit:
> return rc;
> }
>
> +static int cil_check_segregateattributes(const policydb_t *pdb, int *violation)
> +{
> + const segregate_attributes_rule_t *sattr;
> +
> + for (sattr = pdb->segregate_attributes; sattr; sattr = sattr->next) {
> + ebitmap_node_t *first_node;
> + unsigned int first_bit;
> +
> + ebitmap_for_each_positive_bit(&sattr->attrs, first_node, first_bit) {
> + ebitmap_node_t *second_node;
> + unsigned int second_bit;
> +
> + ebitmap_for_each_positive_bit_after(&sattr->attrs, second_node, second_bit, first_node, first_bit) {
> + ebitmap_t attr_union;
> + ebitmap_node_t *type_node;
> + unsigned int type_bit;
> +
> + if (ebitmap_and(&attr_union, &pdb->attr_type_map[first_bit], &pdb->attr_type_map[second_bit]))
> + return SEPOL_ERR;
> +
> + ebitmap_for_each_positive_bit(&attr_union, type_node, type_bit) {
> + cil_log(CIL_ERR, "Segregate Attributes violation, type %s associated with attributes %s and %s\n",
> + pdb->p_type_val_to_name[type_bit],
> + pdb->p_type_val_to_name[first_bit],
> + pdb->p_type_val_to_name[second_bit]);
> + *violation = CIL_TRUE;
It needs to report the file and linenumber of the violation. This is
the case for checkpolicy as well. There is a reason that we carry that
information for neverallow rules.
Thanks,
Jim
> + }
> +
> + ebitmap_destroy(&attr_union);
> + }
> + }
> + }
> +
> + return SEPOL_OK;
> +}
> +
> static struct cil_list *cil_classperms_from_sepol(policydb_t *pdb, uint16_t class, uint32_t data, struct cil_class *class_value_to_cil[], struct cil_perm **perm_value_to_cil[])
> {
> struct cil_classperms *cp;
> @@ -5160,6 +5231,10 @@ int cil_binary_create_allocated_pdb(const struct cil_db *db, sepol_policydb_t *p
> rc = cil_check_neverallows(db, pdb, neverallows, &violation);
> if (rc != SEPOL_OK) goto exit;
>
> + cil_log(CIL_INFO, "Checking Segregate Attributes\n");
> + rc = cil_check_segregateattributes(pdb, &violation);
> + if (rc != SEPOL_OK) goto exit;
> +
> cil_log(CIL_INFO, "Checking User Bounds\n");
> rc = bounds_check_users(NULL, pdb);
> if (rc) {
> diff --git a/libsepol/cil/src/cil_build_ast.c b/libsepol/cil/src/cil_build_ast.c
> index 4177c9f6..611aade8 100644
> --- a/libsepol/cil/src/cil_build_ast.c
> +++ b/libsepol/cil/src/cil_build_ast.c
> @@ -6164,6 +6164,62 @@ void cil_destroy_src_info(struct cil_src_info *info)
> free(info);
> }
>
> +int cil_gen_segregateattributes(struct cil_db *db, struct cil_tree_node *parse_current, struct cil_tree_node *ast_node)
> +{
> + enum cil_syntax syntax[] = {
> + CIL_SYN_STRING,
> + CIL_SYN_LIST,
> + CIL_SYN_END
> + };
> + size_t syntax_len = sizeof(syntax)/sizeof(*syntax);
> + struct cil_segregateattributes *sattrs = NULL;
> + int rc = SEPOL_ERR;
> +
> + if (db == NULL || parse_current == NULL || ast_node == NULL) {
> + goto exit;
> + }
> +
> + rc = __cil_verify_syntax(parse_current, syntax, syntax_len);
> + if (rc != SEPOL_OK) {
> + goto exit;
> + }
> +
> + cil_segregateattributes_init(&sattrs);
> +
> + rc = cil_gen_expr(parse_current->next, CIL_TYPEATTRIBUTE, &sattrs->str_expr);
> + if (rc != SEPOL_OK) {
> + goto exit;
> + }
> +
> + /* require at least two attributes */
> + if (sattrs->str_expr->head == sattrs->str_expr->tail) {
> + rc = SEPOL_ERR;
> + goto exit;
> + }
> +
> + ast_node->data = sattrs;
> + ast_node->flavor = CIL_SEGREGATEATTRIBUTES;
> +
> + return SEPOL_OK;
> +
> +exit:
> + cil_tree_log(parse_current, CIL_ERR, "Bad segregate attributes declaration");
> + cil_destroy_segregateattributes(sattrs);
> + return rc;
> +}
> +
> +void cil_destroy_segregateattributes(struct cil_segregateattributes *sattrs)
> +{
> + if (sattrs == NULL) {
> + return;
> + }
> +
> + cil_list_destroy(&sattrs->str_expr, CIL_TRUE);
> + cil_list_destroy(&sattrs->datum_expr, CIL_FALSE);
> +
> + free(sattrs);
> +}
> +
> static int check_for_illegal_statement(struct cil_tree_node *parse_current, struct cil_args_build *args)
> {
> if (args->tunif != NULL) {
> @@ -6455,6 +6511,8 @@ static struct cil_tree_node * parse_statement(struct cil_db *db, struct cil_tree
> rc = cil_gen_mls(parse_current, new_ast_node);
> } else if (parse_current->data == CIL_KEY_SRC_INFO) {
> rc = cil_gen_src_info(parse_current, new_ast_node);
> + } else if (parse_current->data == CIL_KEY_SEGREGATEATTRIBUTES) {
> + rc = cil_gen_segregateattributes(db, parse_current, new_ast_node);
> } else {
> cil_log(CIL_ERR, "Error: Unknown keyword %s\n", (char *)parse_current->data);
> rc = SEPOL_ERR;
> diff --git a/libsepol/cil/src/cil_build_ast.h b/libsepol/cil/src/cil_build_ast.h
> index fd9053ce..d815a22f 100644
> --- a/libsepol/cil/src/cil_build_ast.h
> +++ b/libsepol/cil/src/cil_build_ast.h
> @@ -225,6 +225,8 @@ int cil_gen_defaultrange(struct cil_tree_node *parse_current, struct cil_tree_no
> void cil_destroy_defaultrange(struct cil_defaultrange *def);
> int cil_gen_src_info(struct cil_tree_node *parse_current, struct cil_tree_node *ast_node);
> void cil_destroy_src_info(struct cil_src_info *info);
> +int cil_gen_segregateattributes(struct cil_db *db, struct cil_tree_node *parse_current, struct cil_tree_node *ast_node);
> +void cil_destroy_segregateattributes(struct cil_segregateattributes *sattrs);
>
> int cil_fill_cats(struct cil_tree_node *curr, struct cil_cats **cats);
> void cil_destroy_cats(struct cil_cats *cats);
> diff --git a/libsepol/cil/src/cil_copy_ast.c b/libsepol/cil/src/cil_copy_ast.c
> index 17f05021..e0f3ba4f 100644
> --- a/libsepol/cil/src/cil_copy_ast.c
> +++ b/libsepol/cil/src/cil_copy_ast.c
> @@ -1697,6 +1697,21 @@ static int cil_copy_src_info(__attribute__((unused)) struct cil_db *db, void *da
> return SEPOL_OK;
> }
>
> +static int cil_copy_segregateattributes(__attribute__((unused)) struct cil_db *db, void *data, void **copy, __attribute__((unused)) symtab_t *symtab)
> +{
> + struct cil_segregateattributes *orig = data;
> + struct cil_segregateattributes *new = NULL;
> +
> + cil_segregateattributes_init(&new);
> +
> + cil_copy_expr(db, orig->str_expr, &new->str_expr);
> + cil_copy_expr(db, orig->datum_expr, &new->datum_expr);
> +
> + *copy = new;
> +
> + return SEPOL_OK;
> +}
> +
> static int __cil_copy_node_helper(struct cil_tree_node *orig, uint32_t *finished, void *extra_args)
> {
> int rc = SEPOL_ERR;
> @@ -1990,6 +2005,9 @@ static int __cil_copy_node_helper(struct cil_tree_node *orig, uint32_t *finished
> case CIL_SRC_INFO:
> copy_func = &cil_copy_src_info;
> break;
> + case CIL_SEGREGATEATTRIBUTES:
> + copy_func = &cil_copy_segregateattributes;
> + break;
> default:
> goto exit;
> }
> diff --git a/libsepol/cil/src/cil_flavor.h b/libsepol/cil/src/cil_flavor.h
> index c2f0cee7..ffbd5877 100644
> --- a/libsepol/cil/src/cil_flavor.h
> +++ b/libsepol/cil/src/cil_flavor.h
> @@ -115,6 +115,7 @@ enum cil_flavor {
> CIL_SRC_INFO,
> CIL_IBPKEYCON,
> CIL_IBENDPORTCON,
> + CIL_SEGREGATEATTRIBUTES,
>
> /*
> * boolean constraint set catset
> diff --git a/libsepol/cil/src/cil_internal.h b/libsepol/cil/src/cil_internal.h
> index a7604762..e22c2f87 100644
> --- a/libsepol/cil/src/cil_internal.h
> +++ b/libsepol/cil/src/cil_internal.h
> @@ -242,6 +242,7 @@ extern char *CIL_KEY_SRC_CIL;
> extern char *CIL_KEY_SRC_HLL_LMS;
> extern char *CIL_KEY_SRC_HLL_LMX;
> extern char *CIL_KEY_SRC_HLL_LME;
> +extern char *CIL_KEY_SEGREGATEATTRIBUTES;
>
> /*
> Symbol Table Array Indices
> @@ -309,6 +310,7 @@ struct cil_db {
> struct cil_list *userprefixes;
> struct cil_list *selinuxusers;
> struct cil_list *names;
> + struct cil_list *segregateattributes;
> int num_types_and_attrs;
> int num_classes;
> int num_cats;
> @@ -975,6 +977,11 @@ struct cil_src_info {
> char *path;
> };
>
> +struct cil_segregateattributes {
> + struct cil_list *str_expr;
> + struct cil_list *datum_expr;
> +};
> +
> void cil_db_init(struct cil_db **db);
> void cil_db_destroy(struct cil_db **db);
>
> @@ -1085,5 +1092,6 @@ void cil_mls_init(struct cil_mls **mls);
> void cil_src_info_init(struct cil_src_info **info);
> void cil_userattribute_init(struct cil_userattribute **attribute);
> void cil_userattributeset_init(struct cil_userattributeset **attrset);
> +void cil_segregateattributes_init(struct cil_segregateattributes **sattrs);
>
> #endif
> diff --git a/libsepol/cil/src/cil_policy.c b/libsepol/cil/src/cil_policy.c
> index 7c543c47..36f6780d 100644
> --- a/libsepol/cil/src/cil_policy.c
> +++ b/libsepol/cil/src/cil_policy.c
> @@ -69,6 +69,7 @@ enum cil_statement_list {
> CIL_LIST_USER,
> CIL_LIST_CONSTRAINT,
> CIL_LIST_VALIDATETRANS,
> + CIL_LIST_SEGREGATEATTRIBUTES,
> CIL_LIST_NUM_LISTS
> };
>
> @@ -168,6 +169,9 @@ static int __cil_gather_statements_helper(struct cil_tree_node *node, uint32_t *
> case CIL_VALIDATETRANS:
> kind = CIL_LIST_VALIDATETRANS;
> break;
> + case CIL_SEGREGATEATTRIBUTES:
> + kind = CIL_LIST_SEGREGATEATTRIBUTES;
> + break;
> default:
> break;
> }
> @@ -1911,6 +1915,27 @@ static void cil_devicetreecons_to_policy(FILE *out, struct cil_sort *devicetreec
> }
> }
>
> +static void cil_segregateattributes_to_policy(FILE *out, struct cil_list *sattrs_list)
> +{
> + struct cil_list_item *curr_sattrs, *curr_attr;
> + struct cil_segregateattributes *sattrs;
> + int first = 1;
> +
> + cil_list_for_each(curr_sattrs, sattrs_list) {
> + sattrs = curr_sattrs->data;
> + fprintf(out, "segregate_attriutes ");
> + cil_list_for_each(curr_attr, sattrs->datum_expr) {
> + if (!first) {
> + first = 0;
> + } else {
> + fprintf(out, ", ");
> + }
> + fprintf(out, "%s", DATUM(curr_attr->data)->fqn);
> + }
> + fprintf(out, ";\n");
> + }
> +}
> +
> void cil_gen_policy(FILE *out, struct cil_db *db)
> {
> unsigned i;
> @@ -1956,6 +1981,7 @@ void cil_gen_policy(FILE *out, struct cil_db *db)
> cil_typebounds_to_policy(out, lists[CIL_LIST_TYPE]);
> cil_typeattributes_to_policy(out, lists[CIL_LIST_TYPE], lists[CIL_LIST_TYPEATTRIBUTE]);
> cil_te_rules_to_policy(out, head, db->mls);
> + cil_segregateattributes_to_policy(out, db->segregateattributes);
>
> cil_roles_to_policy(out, lists[CIL_LIST_ROLE]);
> cil_role_types_to_policy(out, lists[CIL_LIST_ROLE], lists[CIL_LIST_TYPE]);
> diff --git a/libsepol/cil/src/cil_reset_ast.c b/libsepol/cil/src/cil_reset_ast.c
> index 0864d7ef..c5ac83c8 100644
> --- a/libsepol/cil/src/cil_reset_ast.c
> +++ b/libsepol/cil/src/cil_reset_ast.c
> @@ -475,6 +475,11 @@ static void cil_reset_booleanif(struct cil_booleanif *bif)
> cil_list_destroy(&bif->datum_expr, CIL_FALSE);
> }
>
> +static void cil_reset_segregateattributes(struct cil_segregateattributes *sattrs)
> +{
> + cil_list_destroy(&sattrs->datum_expr, CIL_FALSE);
> +}
> +
> static int __cil_reset_node(struct cil_tree_node *node, __attribute__((unused)) uint32_t *finished, __attribute__((unused)) void *extra_args)
> {
> switch (node->flavor) {
> @@ -630,6 +635,9 @@ static int __cil_reset_node(struct cil_tree_node *node, __attribute__((unused))
> case CIL_BOOLEANIF:
> cil_reset_booleanif(node->data);
> break;
> + case CIL_SEGREGATEATTRIBUTES:
> + cil_reset_segregateattributes(node->data);
> + break;
> case CIL_TUNABLEIF:
> case CIL_CALL:
> break; /* Not effected by optional block disabling */
> diff --git a/libsepol/cil/src/cil_resolve_ast.c b/libsepol/cil/src/cil_resolve_ast.c
> index f5e22c97..36a96199 100644
> --- a/libsepol/cil/src/cil_resolve_ast.c
> +++ b/libsepol/cil/src/cil_resolve_ast.c
> @@ -3265,6 +3265,7 @@ int cil_resolve_expr(enum cil_flavor expr_type, struct cil_list *str_expr, struc
> sym_index = CIL_SYM_TUNABLES;
> break;
> case CIL_TYPE:
> + case CIL_TYPEATTRIBUTE:
> sym_index = CIL_SYM_TYPES;
> break;
> case CIL_ROLE:
> @@ -3312,6 +3313,13 @@ int cil_resolve_expr(enum cil_flavor expr_type, struct cil_list *str_expr, struc
> } else {
> if (sym_index == CIL_SYM_TYPES && (expr_type == CIL_CONSTRAIN || expr_type == CIL_VALIDATETRANS)) {
> cil_type_used(res_datum, CIL_ATTR_CONSTRAINT);
> + } else if (expr_type == CIL_SEGREGATEATTRIBUTES) {
> + if (FLAVOR(res_datum) != CIL_TYPEATTRIBUTE) {
> + cil_tree_log(parent, CIL_ERR, "Type or type alias not supported in segregate attributes declaration");
> + rc = SEPOL_ERR;
> + goto exit;
> + }
> + cil_type_used(res_datum, CIL_ATTR_NEVERALLOW);
> }
> cil_list_append(*datum_expr, CIL_DATUM, res_datum);
> }
> @@ -3508,6 +3516,33 @@ exit:
> return rc;
> }
>
> +int cil_resolve_segregateattributes(struct cil_tree_node *current, void *extra_args)
> +{
> + struct cil_segregateattributes *sattrs = current->data;
> + struct cil_list_item *first, *second;
> + int rc;
> +
> + rc = cil_resolve_expr(CIL_SEGREGATEATTRIBUTES, sattrs->str_expr, &sattrs->datum_expr, current, extra_args);
> + if (rc != SEPOL_OK) {
> + goto exit;
> + }
> +
> + cil_list_for_each(first, sattrs->datum_expr) {
> + for (second = first->next; second; second = second->next) {
> + if (first->data == second->data) {
> + cil_tree_log(current, CIL_ERR, "Repeated attribute in segregate attributes declaration");
> + rc = SEPOL_ERR;
> + goto exit;
> + }
> + }
> + }
> +
> + return SEPOL_OK;
> +
> +exit:
> + return rc;
> +}
> +
> /*
> * Degenerate inheritance leads to exponential growth of the policy
> * It can take many forms, but here is one example.
> @@ -3888,6 +3923,9 @@ static int __cil_resolve_ast_node(struct cil_tree_node *node, void *extra_args)
> case CIL_USERATTRIBUTESET:
> rc = cil_resolve_userattributeset(node, args);
> break;
> + case CIL_SEGREGATEATTRIBUTES:
> + rc = cil_resolve_segregateattributes(node, args);
> + break;
> default:
> break;
> }
> diff --git a/libsepol/cil/src/cil_resolve_ast.h b/libsepol/cil/src/cil_resolve_ast.h
> index 1d971fd6..31594954 100644
> --- a/libsepol/cil/src/cil_resolve_ast.h
> +++ b/libsepol/cil/src/cil_resolve_ast.h
> @@ -96,6 +96,7 @@ int cil_resolve_expr(enum cil_flavor expr_type, struct cil_list *str_expr, struc
> int cil_resolve_boolif(struct cil_tree_node *current, void *extra_args);
> int cil_evaluate_expr(struct cil_list *datum_expr, uint16_t *result);
> int cil_resolve_tunif(struct cil_tree_node *current, void *extra_args);
> +int cil_resolve_segregateattributes(struct cil_tree_node *current, void *extra_args);
>
> int cil_resolve_ast(struct cil_db *db, struct cil_tree_node *current);
> int cil_resolve_name(struct cil_tree_node *ast_node, char *name, enum cil_sym_index sym_index, void *extra_args, struct cil_symtab_datum **datum);
> diff --git a/libsepol/cil/src/cil_write_ast.c b/libsepol/cil/src/cil_write_ast.c
> index b75784ef..d0fb555b 100644
> --- a/libsepol/cil/src/cil_write_ast.c
> +++ b/libsepol/cil/src/cil_write_ast.c
> @@ -1474,7 +1474,18 @@ void cil_write_ast_node(FILE *out, struct cil_tree_node *node)
> fprintf(out, "(ipaddr %s %s)\n", datum_to_str(&ipaddr->datum), buf);
> break;
> }
> + case CIL_SEGREGATEATTRIBUTES: {
> + struct cil_segregateattributes *sattrs = node->data;
> + fprintf(out, "(segregateattributes ");
> + if (sattrs->datum_expr)
> + write_expr(out, sattrs->datum_expr);
> + else
> + write_expr(out, sattrs->str_expr);
> + fprintf(out, ")\n");
> + break;
> + }
> default :
> + cil_log(CIL_ERR, "Unsupported flavor: %d\n", node->flavor);
> fprintf(out, "(<?RULE:%s>)\n", cil_node_to_string(node));
> break;
> }
> diff --git a/libsepol/src/kernel_to_cil.c b/libsepol/src/kernel_to_cil.c
> index 9128ac55..4b99208d 100644
> --- a/libsepol/src/kernel_to_cil.c
> +++ b/libsepol/src/kernel_to_cil.c
> @@ -1906,6 +1906,33 @@ static int map_filename_trans_to_str(hashtab_key_t key, void *data, void *arg)
> return 0;
> }
>
> +static int write_segregate_attributes_to_cil(FILE *out, const struct policydb *pdb)
> +{
> + const segregate_attributes_rule_t *sattr;
> +
> + for (sattr = pdb->segregate_attributes; sattr; sattr = sattr->next) {
> + struct ebitmap_node *node;
> + unsigned int bit;
> + int first = 1;
> +
> + sepol_printf(out, "(segregateattributes (");
> +
> + ebitmap_for_each_positive_bit(&sattr->attrs, node, bit) {
> + if (first) {
> + first = 0;
> + } else {
> + sepol_printf(out, " ");
> + }
> +
> + sepol_printf(out, "%s", pdb->p_type_val_to_name[bit - 1]);
> + }
> +
> + sepol_printf(out, "))\n");
> + }
> +
> + return 0;
> +}
> +
> static int write_filename_trans_rules_to_cil(FILE *out, struct policydb *pdb)
> {
> struct map_filename_trans_args args;
> @@ -3329,6 +3356,11 @@ int sepol_kernel_policydb_to_cil(FILE *out, struct policydb *pdb)
> goto exit;
> }
>
> + rc = write_segregate_attributes_to_cil(out, pdb);
> + if (rc != 0) {
> + goto exit;
> + }
> +
> rc = write_filename_trans_rules_to_cil(out, pdb);
> if (rc != 0) {
> goto exit;
> diff --git a/secilc/docs/README.md b/secilc/docs/README.md
> index efab2a71..8f584019 100644
> --- a/secilc/docs/README.md
> +++ b/secilc/docs/README.md
> @@ -132,6 +132,7 @@ CIL (Common Intermediate Language)
> * [typemember](cil_type_statements.md#typemember)
> * [typetransition](cil_type_statements.md#typetransition)
> * [typepermissive](cil_type_statements.md#typepermissive)
> + * [segregateattributes](cil_type_statements.md#segregateattributes)
>
> * [User Statements](cil_user_statements.md#user-statements)
> * [user](cil_user_statements.md#user)
> diff --git a/secilc/docs/cil_type_statements.md b/secilc/docs/cil_type_statements.md
> index 19438417..56533eea 100644
> --- a/secilc/docs/cil_type_statements.md
> +++ b/secilc/docs/cil_type_statements.md
> @@ -601,3 +601,53 @@ This example will allow SELinux to run the `healthd.process` domain in permissiv
> (allow ...)
> )
> ```
> +
> +segregateattributes
> +-------------------
> +
> +Libsepol and secilc version 3.5 introduced the segregateattributes statement
> +to mark two or more type attributes mutual exclusive. This is a compiler
> +enforced action that will stop compilation until the offending associations
> +are modified.
> +
> +Note that these constraints can be over-ridden by the CIL compiler command
> +line parameter `-N` or `--disable-neverallow` flags.
> +
> +**Statement definition:**
> +
> +```secil
> + (segregateattributes (typeattribute_id typeattribute_id...))
> +```
> +
> +**Where:**
> +
> +<table>
> +<colgroup>
> +<col width="27%" />
> +<col width="72%" />
> +</colgroup>
> +<tbody>
> +<tr class="odd">
> +<td align="left"><p><code>segregateattributes</code></p></td>
> +<td align="left"><p>The <code>segregateattributes</code> keyword.</p></td>
> +</tr>
> +<tr class="even">
> +<td align="left"><p><code>typeattribute_id</code></p></td>
> +<td align="left"><p>At least two previously declared <code>typeattribute</code> identifier.</p>
> +<p>Note that the same <code>typeattribute</code> identifier must not be repeated.</p></td>
> +</tr>
> +</tbody>
> +</table>
> +
> +**Example:**
> +
> +This example will not compile as `type_1` is associated with type attributes `attr_1` and `attr_2`:
> +
> +```secil
> + (type type_1)
> + (typeattribute attr_1)
> + (typeattribute attr_2)
> + (typeattributeset attr_1 (type_1))
> + (typeattributeset attr_2 (type_1))
> + (segregateattributes (attr_1 attr_2))
> +```
> --
> 2.36.1
>
