Menu
▾
▴
[Selinux-commits] SF.net SVN: selinux: [2856] trunk/checkpolicy
|
From: <ssm...@us...> - 2008-03-24 20:19:05
|
Revision: 2856
http://selinux.svn.sourceforge.net/selinux/?rev=2856&view=rev
Author: ssmalley
Date: 2008-03-24 13:18:16 -0700 (Mon, 24 Mar 2008)
Log Message:
-----------
Author: Eric Paris
Email: ep...@re...
Subject: checkpolicy: support for permissive types
Date: Mon, 24 Mar 2008 10:11:20 -0400
This patch adds support for permissive domains.
A very simple module to make httpd_t a permissive domain would be:
policy_module(permissiveapache, 1.0)
gen_require(`
type httpd_t;
')
permissive httpd_t;
Obviously this syntax can be used in both the base policy and in a
policy module.
Signed-off-by: Eric Paris <ep...@re...>
Acked-by: Stephen Smalley <sd...@ty...>
Modified Paths:
--------------
trunk/checkpolicy/policy_define.c
trunk/checkpolicy/policy_define.h
trunk/checkpolicy/policy_parse.y
trunk/checkpolicy/policy_scan.l
trunk/checkpolicy/test/dismod.c
trunk/checkpolicy/test/dispol.c
Modified: trunk/checkpolicy/policy_define.c
===================================================================
--- trunk/checkpolicy/policy_define.c 2008-03-24 20:17:15 UTC (rev 2855)
+++ trunk/checkpolicy/policy_define.c 2008-03-24 20:18:16 UTC (rev 2856)
@@ -195,6 +195,49 @@
return -1;
}
+int define_permissive(void)
+{
+ char *type = NULL;
+ struct type_datum *t;
+ int rc = 0;
+
+ type = queue_remove(id_queue);
+
+ if (!type) {
+ yyerror2("forgot to include type in permissive definition?");
+ rc = -1;
+ goto out;
+ }
+
+ if (pass == 1)
+ goto out;
+
+ if (!is_id_in_scope(SYM_TYPES, type)) {
+ yyerror2("type %s is not within scope", type);
+ rc = -1;
+ goto out;
+ }
+
+ t = hashtab_search(policydbp->p_types.table, type);
+ if (!t) {
+ yyerror2("type is not defined: %s", type);
+ rc = -1;
+ goto out;
+ }
+
+ if (t->flavor == TYPE_ATTRIB) {
+ yyerror2("attributes may not be permissive: %s\n", type);
+ rc = -1;
+ goto out;
+ }
+
+ t->flags |= TYPE_FLAGS_PERMISSIVE;
+
+out:
+ free(type);
+ return rc;
+}
+
int define_polcap(void)
{
char *id = 0;
Modified: trunk/checkpolicy/policy_define.h
===================================================================
--- trunk/checkpolicy/policy_define.h 2008-03-24 20:17:15 UTC (rev 2855)
+++ trunk/checkpolicy/policy_define.h 2008-03-24 20:18:16 UTC (rev 2856)
@@ -36,6 +36,7 @@
int define_ipv6_node_context(void);
int define_level(void);
int define_netif_context(void);
+int define_permissive(void);
int define_polcap(void);
int define_port_context(unsigned int low, unsigned int high);
int define_range_trans(int class_specified);
Modified: trunk/checkpolicy/policy_parse.y
===================================================================
--- trunk/checkpolicy/policy_parse.y 2008-03-24 20:17:15 UTC (rev 2855)
+++ trunk/checkpolicy/policy_parse.y 2008-03-24 20:18:16 UTC (rev 2856)
@@ -135,6 +135,7 @@
%token IPV6_ADDR
%token MODULE VERSION_IDENTIFIER REQUIRE OPTIONAL
%token POLICYCAP
+%token PERMISSIVE
%left OR
%left XOR
@@ -261,6 +262,7 @@
| transition_def
| range_trans_def
| te_avtab_def
+ | permissive_def
;
attribute_def : ATTRIBUTE identifier ';'
{ if (define_attrib()) return -1;}
@@ -706,6 +708,8 @@
policycap_def : POLICYCAP identifier ';'
{if (define_polcap()) return -1;}
;
+permissive_def : PERMISSIVE identifier ';'
+ {if (define_permissive()) return -1;}
/*********** module grammar below ***********/
Modified: trunk/checkpolicy/policy_scan.l
===================================================================
--- trunk/checkpolicy/policy_scan.l 2008-03-24 20:17:15 UTC (rev 2855)
+++ trunk/checkpolicy/policy_scan.l 2008-03-24 20:18:16 UTC (rev 2856)
@@ -202,7 +202,9 @@
h2 |
H2 { return(H2); }
policycap |
-POLICYCAP { return(POLICYCAP);}
+POLICYCAP { return(POLICYCAP); }
+permissive |
+PERMISSIVE { return(PERMISSIVE); }
"/"({alnum}|[_.-/])* { return(PATH); }
{letter}({alnum}|[_-])*([.]?({alnum}|[_-]))* { return(IDENTIFIER); }
{digit}+ { return(NUMBER); }
Modified: trunk/checkpolicy/test/dismod.c
===================================================================
--- trunk/checkpolicy/test/dismod.c 2008-03-24 20:17:15 UTC (rev 2855)
+++ trunk/checkpolicy/test/dismod.c 2008-03-24 20:18:16 UTC (rev 2856)
@@ -323,7 +323,7 @@
fprintf(fp, "alias for type");
display_id(&policydb, fp, SYM_TYPES, type->s.value - 1, "");
}
- fprintf(fp, "\n");
+ fprintf(fp, " flags:%x\n", type->flags);
return 0;
}
Modified: trunk/checkpolicy/test/dispol.c
===================================================================
--- trunk/checkpolicy/test/dispol.c 2008-03-24 20:17:15 UTC (rev 2855)
+++ trunk/checkpolicy/test/dispol.c 2008-03-24 20:18:16 UTC (rev 2856)
@@ -319,6 +319,28 @@
}
}
+static void display_id(policydb_t *p, FILE *fp, uint32_t symbol_type,
+ uint32_t symbol_value, char *prefix)
+{
+ char *id = p->sym_val_to_name[symbol_type][symbol_value];
+ fprintf(fp, " %s%s", prefix, id);
+}
+
+static void display_permissive(policydb_t *p, FILE *fp)
+{
+ ebitmap_node_t *node;
+ int i;
+
+ fprintf(fp, "permissive sids:\n");
+ ebitmap_for_each_bit(&p->permissive_map, node, i) {
+ if (ebitmap_node_get_bit(node, i)) {
+ fprintf(fp, "\t");
+ display_id(p, fp, SYM_TYPES, i - 1, "");
+ fprintf(fp, "\n");
+ }
+ }
+}
+
int menu()
{
printf("\nSelect a command:\n");
@@ -331,6 +353,7 @@
printf("7) change a boolean value\n");
printf("\n");
printf("c) display policy capabilities\n");
+ printf("p) display the list of permissive types\n");
printf("u) display unknown handling setting\n");
printf("f) set output file\n");
printf("m) display menu\n");
@@ -447,6 +470,9 @@
case 'c':
display_policycaps(&policydb, out_fp);
break;
+ case 'p':
+ display_permissive(&policydb, out_fp);
+ break;
case 'u':
case 'U':
display_handle_unknown(&policydb, out_fp);
This was sent by the SourceForge.net collaborative development platform, the world's largest Open Source development site.
|
