[PATCH] secilc: resolve conflicts in expandattribute.

Discussion:

Tri Vo

2018-03-14 22:17:28 UTC

When Android combines multiple .cil files from system.img and vendor.img
it's possible to have conflicting expandattribute statements, e.g.
expandattribute hal_audio true;
expandattribute hal_audio false;

This change deals with scenario be resolving the value of the
corresponding expandattribute to false. The rationale behind this
override is that true is used for reduce run-time lookups, while
false is used for tests which must pass.
---
libsepol/cil/src/cil_resolve_ast.c | 12 ++++--------
1 file changed, 4 insertions(+), 8 deletions(-)

diff --git a/libsepol/cil/src/cil_resolve_ast.c b/libsepol/cil/src/cil_resolve_ast.c
index d1a5ed87..5c66f663 100644
--- a/libsepol/cil/src/cil_resolve_ast.c
+++ b/libsepol/cil/src/cil_resolve_ast.c
@@ -271,7 +271,6 @@ exit:

int cil_type_used(struct cil_symtab_datum *datum, int used)
{
- int rc = SEPOL_ERR;
struct cil_typeattribute *attr = NULL;

if (FLAVOR(datum) == CIL_TYPEATTRIBUTE) {
@@ -279,16 +278,13 @@ int cil_type_used(struct cil_symtab_datum *datum, int used)
attr->used |= used;
if ((attr->used & CIL_ATTR_EXPAND_TRUE) &&
(attr->used & CIL_ATTR_EXPAND_FALSE)) {
- cil_log(CIL_ERR, "Conflicting use of expandtypeattribute. "
- "Expandtypeattribute may be set to true or false "
- "but not both. \n");
- goto exit;
+ cil_log(CIL_WARN, "Conflicting use of expandtypeattribute. "
+ "Expandtypeattribute was set to both true or false for %s. "
+ "Resolving to false. \n", attr->datum.name);
+ attr->used ^= CIL_ATTR_EXPAND_TRUE;
}
}
-
return SEPOL_OK;
-exit:
- return rc;
}

int cil_resolve_permissionx(struct cil_tree_node *current, struct cil_permissionx *permx, void *extra_args)

--
2.16.2.804.g6dcf76e118-goog

William Roberts

2018-03-14 23:05:28 UTC

Permalink

Post by Tri Vo
When Android combines multiple .cil files from system.img and vendor.img
it's possible to have conflicting expandattribute statements, e.g.
expandattribute hal_audio true;
expandattribute hal_audio false;

Isn't this the policy.conf version? I thought cil files had:
expandtypeattribute, am I wrong here?

Post by Tri Vo
This change deals with scenario be resolving the value of the
corresponding expandattribute to false. The rationale behind this
override is that true is used for reduce run-time lookups, while
false is used for tests which must pass.

So in a conflict, it's always forced to false, which prevents expansion.
That seems reasonable. I would imagine this should also update some
document somewhere that describes this behavior, does one exist?
I couldn't find anything, but not sure if it's on some external webpage.
Stephen do you know?

Post by Tri Vo
---
libsepol/cil/src/cil_resolve_ast.c | 12 ++++--------
1 file changed, 4 insertions(+), 8 deletions(-)
diff --git a/libsepol/cil/src/cil_resolve_ast.c b/libsepol/cil/src/cil_resolve_ast.c
index d1a5ed87..5c66f663 100644
--- a/libsepol/cil/src/cil_resolve_ast.c
+++ b/libsepol/cil/src/cil_resolve_ast.c
int cil_type_used(struct cil_symtab_datum *datum, int used)
{
- int rc = SEPOL_ERR;
struct cil_typeattribute *attr = NULL;
if (FLAVOR(datum) == CIL_TYPEATTRIBUTE) {
@@ -279,16 +278,13 @@ int cil_type_used(struct cil_symtab_datum *datum, int used)
attr->used |= used;
if ((attr->used & CIL_ATTR_EXPAND_TRUE) &&
(attr->used & CIL_ATTR_EXPAND_FALSE)) {
- cil_log(CIL_ERR, "Conflicting use of expandtypeattribute. "
- "Expandtypeattribute may be set to true or false "
- "but not both. \n");
- goto exit;
+ cil_log(CIL_WARN, "Conflicting use of expandtypeattribute. "
+ "Expandtypeattribute was set to both true or false for %s. "
+ "Resolving to false. \n", attr->datum.name);
+ attr->used ^= CIL_ATTR_EXPAND_TRUE;

Sure, this saves an operation, but:

attr->used &= ~CIL_ATTR_EXPAND_TRUE;

Is less fragile and the usual unset idiom. I won't request this changed unless
either you agree or someone else has the same opinion as me.

One could always argue that conditional code that relies on the entry
condition is the whole
point of conditional code :-P

Post by Tri Vo
}
}
-
return SEPOL_OK;
- return rc;
}
int cil_resolve_permissionx(struct cil_tree_node *current, struct cil_permissionx *permx, void *extra_args)
--
2.16.2.804.g6dcf76e118-goog

Jeffrey Vander Stoep via Selinux

2018-03-15 04:49:46 UTC

Permalink

On Wed, Mar 14, 2018 at 4:05 PM, William Roberts

Post by William Roberts

expandtypeattribute, am I wrong here?

You'll need to fix checkpolicy too for consistency. See
https://github.com/SELinuxProject/selinux/blob/master/checkpolicy/policy_define.c#L1185

Post by William Roberts

Change from int to void. The return value is no longer useful.

Post by William Roberts

Post by Tri Vo
{
- int rc = SEPOL_ERR;
struct cil_typeattribute *attr = NULL;
if (FLAVOR(datum) == CIL_TYPEATTRIBUTE) {
@@ -279,16 +278,13 @@ int cil_type_used(struct cil_symtab_datum *datum, int used)
attr->used |= used;
if ((attr->used & CIL_ATTR_EXPAND_TRUE) &&
(attr->used & CIL_ATTR_EXPAND_FALSE)) {
- cil_log(CIL_ERR, "Conflicting use of expandtypeattribute. "
- "Expandtypeattribute may be set to true or false "
- "but not both. \n");
- goto exit;
+ cil_log(CIL_WARN, "Conflicting use of expandtypeattribute. "
+ "Expandtypeattribute was set to both true or false for %s. "
+ "Resolving to false. \n", attr->datum.name);
+ attr->used ^= CIL_ATTR_EXPAND_TRUE;

attr->used &= ~CIL_ATTR_EXPAND_TRUE;

Post by William Roberts
Is less fragile and the usual unset idiom. I won't request this changed unless
either you agree or someone else has the same opinion as me.
One could always argue that conditional code that relies on the entry
condition is the whole
point of conditional code :-P

Post by Tri Vo
}
}
-
return SEPOL_OK;
- return rc;
}
int cil_resolve_permissionx(struct cil_tree_node *current, struct cil_permissionx *permx, void *extra_args)
--
2.16.2.804.g6dcf76e118-goog