topjohnwu/selinux
1
0
Fork 0
mirror of https://github.com/topjohnwu/selinux.git synced 2024-12-04 01:20:52 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

libsepol: Treat types like an attribute in the attr_type_map.

Browse Source 
Types are treated as attributes that contain only themselves. This
is how types are already treated in the type_attr_map.

Treating types this way makes finding rules that apply to a given
type much easier. This simplifies the implementation of neverallow
checking in assertion.c and bounds checking in hierarchy.c.

Signed-off-by: James Carter <jwcart2@tycho.nsa.gov>
This commit is contained in:
James Carter 2015-06-09 10:15:17 -04:00
parent 49f7ebb04c
commit 88d09b6979
2 changed files with 20 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

24
libsepol/src/expand.c
View File

@ -2311,25 +2311,33 @@ static int type_attr_map(hashtab_key_t key
policydb_t *p = state->out;
unsigned int i;
ebitmap_node_t *tnode;
int value;
type = (type_datum_t *) datum;
value = type->s.value;
if (type->flavor == TYPE_ATTRIB) {
if (ebitmap_cpy(&p->attr_type_map[type->s.value - 1],
&type->types)) {
ERR(state->handle, "Out of memory!");
return -1;
if (ebitmap_cpy(&p->attr_type_map[value - 1], &type->types)) {
goto oom;
}
ebitmap_for_each_bit(&type->types, tnode, i) {
if (!ebitmap_node_get_bit(tnode, i))
continue;
if (ebitmap_set_bit(&p->type_attr_map[i],
type->s.value - 1, 1)) {
ERR(state->handle, "Out of memory!");
return -1;
if (ebitmap_set_bit(&p->type_attr_map[i], value - 1, 1)) {
goto oom;
}
}
} else {
if (ebitmap_set_bit(&p->attr_type_map[value - 1], value - 1, 1)) {
goto oom;
}
}
return 0;
oom:
ERR(state->handle, "Out of memory!");
return -1;
}
/* converts typeset using typemap and expands into ebitmap_t types using the attributes in the passed in policy.

4
libsepol/src/policydb.c
View File

@ -3936,6 +3936,10 @@ int policydb_read(policydb_t * p, struct policy_file *fp, unsigned verbose)
/* add the type itself as the degenerate case */
if (ebitmap_set_bit(&p->type_attr_map[i], i, 1))
goto bad;
if (p->type_val_to_struct[i]->flavor != TYPE_ATTRIB) {
if (ebitmap_set_bit(&p->attr_type_map[i], i, 1))
goto bad;
}
}
}