This is the last RFC patch. Once the notself patches are merged, I will work on a new set of patches that includes support for notself and other. This series of patches implements a deny rule in CIL. A deny rule will remove the stated permissions in it from the policy. CIL does this by searching for allow rules that match the deny rule and then writing new allow rules that correspond to the matched allow rule with the permissions from the deny rule removed. The rule uses the same syntax as an allow rule, but with "deny" instead of "allow". (deny SRC TGT (CLASS (PERMS))) Deny rules are processed during post processing (after the AST is resolved, but before the binary policy is written). This means that neverallow checking is done after deny rules are resolved. Deny rules are complimentary to neverallow checking. When an allow rule is found that matches, a deny rule removes permissions while a neverallow rule reports an error. Patch 4 is biggest and most complex since it is the one doing the processing. Changes for v2 - Renamed cil_tree_remove_node() as cil_tree_node_remove() to fit the naming convention in cil_tree.c - Have cil_tree_node_remove() call cil_tree_node_destroy() to destroy the node after it has been removed as suggested by Daniel Burgener. - Renamed cil_classperms_match() to cil_classperms_match_any() - Renamed cil_classperms_list_match() cil_classperms_list_match_any() - Added function cil_classperms_match_all() - Added function cil_classperms_list_match_all() - Updated cil_classperms_andnot() to use the cil_classperms_match_any() and cil_classperms_list_match_any() functions. - Added function cil_classperms_and() - Added function cil_classperms_map_and() - Added function cil_classperms_set_and() - Added function cil_classperms_list_and() - Fixed problem in error handling in cil_create_and_insert_attribute_and_set() that was found by Daniel Burgener. - Fixed problem in error handling in cil_create_attribute_d1_and_not_d2() that was found by Daniel Burgener. - Change cil_create_and_add_avrule() to copy the classperms list, so the caller doesn't have to do it. - Completely changed the logic of cil_remove_permissions_from_rule() to eliminate the problem of excessive overlap in the new rules that was found by Daniel Burgener. - Changed and added deny rule tests. - Fixed the formating problems in the CIL documenation of the deny rule that was found by Daniel Burgener. James Carter (9): libsepol/cil: Parse and add deny rule to AST, but do not process libsepol/cil: Add cil_list_is_empty macro libsepol/cil: Add cil_tree_node_remove function libsepol/cil: Process deny rules libsepol/cil: Add cil_write_post_ast function libsepol: Export the cil_write_post_ast function secilc/secil2tree: Add option to write CIL AST after post processing secilc/test: Add deny rule tests secilc/docs: Add deny rule to CIL documentation libsepol/cil/include/cil/cil.h | 1 + libsepol/cil/src/cil.c | 68 ++ libsepol/cil/src/cil_build_ast.c | 56 ++ libsepol/cil/src/cil_build_ast.h | 2 + libsepol/cil/src/cil_copy_ast.c | 19 + libsepol/cil/src/cil_copy_ast.h | 1 + libsepol/cil/src/cil_deny.c | 1132 ++++++++++++++++++++++++ libsepol/cil/src/cil_deny.h | 36 + libsepol/cil/src/cil_flavor.h | 1 + libsepol/cil/src/cil_internal.h | 10 + libsepol/cil/src/cil_list.h | 3 + libsepol/cil/src/cil_post.c | 7 + libsepol/cil/src/cil_reset_ast.c | 8 + libsepol/cil/src/cil_resolve_ast.c | 44 + libsepol/cil/src/cil_resolve_ast.h | 1 + libsepol/cil/src/cil_tree.c | 28 + libsepol/cil/src/cil_tree.h | 1 + libsepol/cil/src/cil_verify.c | 9 + libsepol/cil/src/cil_write_ast.c | 10 + libsepol/cil/src/cil_write_ast.h | 1 + libsepol/src/libsepol.map.in | 5 + secilc/docs/cil_access_vector_rules.md | 67 ++ secilc/secil2tree.c | 8 +- secilc/test/deny_rule_test.cil | 946 ++++++++++++++++++++ 24 files changed, 2463 insertions(+), 1 deletion(-) create mode 100644 libsepol/cil/src/cil_deny.c create mode 100644 libsepol/cil/src/cil_deny.h create mode 100644 secilc/test/deny_rule_test.cil -- 2.39.2
