From 982ec302b67f3c7f8df667dadb67352b1e4a6d18 Mon Sep 17 00:00:00 2001 From: James Carter Date: Tue, 15 Jun 2021 10:40:20 -0400 Subject: [PATCH] libsepol/cil: Account for anonymous category sets in an expression It is possible for anonymous category sets to be in a category expression if the expression has a macro parameter in it. Unfortunately, anonymous category sets are not looked for when resolving category expressions and a segfault will occur during later processing if there was one. As an example, consider the following portion of a policy. (macro m1 ((categoryset cs)) (userlevel USER (s0 (cs))) ) (call m1 ((c0 c1))) This policy will cause a segault, because the categoryset datum for the parameter cs is not seen as a categoryset and is treated as a plain category. When resolving an expression, check whether or not the datum that is found is actually an anonymous category set associated with a macro parameter. If it is, then resolve the category set if it has not already been resolved and treat its categories as a sub expression. Signed-off-by: James Carter Acked-by: Nicolas Iooss --- libsepol/cil/src/cil_resolve_ast.c | 24 +++++++++++++++++------- 1 file changed, 17 insertions(+), 7 deletions(-) diff --git a/libsepol/cil/src/cil_resolve_ast.c b/libsepol/cil/src/cil_resolve_ast.c index 16c8c7533ce3..42a58468ed36 100644 --- a/libsepol/cil/src/cil_resolve_ast.c +++ b/libsepol/cil/src/cil_resolve_ast.c @@ -3346,6 +3346,7 @@ int cil_resolve_expr(enum cil_flavor expr_type, struct cil_list *str_expr, struc struct cil_list_item *curr; struct cil_symtab_datum *res_datum = NULL; enum cil_sym_index sym_index = CIL_SYM_UNKNOWN; + struct cil_list *datum_sub_expr; switch (str_expr->flavor) { case CIL_BOOL: @@ -3379,18 +3380,26 @@ int cil_resolve_expr(enum cil_flavor expr_type, struct cil_list *str_expr, struc if (rc != SEPOL_OK) { goto exit; } - - if (sym_index == CIL_SYM_TYPES && (expr_type == CIL_CONSTRAIN || expr_type == CIL_VALIDATETRANS)) { - cil_type_used(res_datum, CIL_ATTR_CONSTRAINT); + if (sym_index == CIL_SYM_CATS && NODE(res_datum)->flavor == CIL_CATSET) { + struct cil_catset *catset = (struct cil_catset *)res_datum; + if (!catset->cats->datum_expr) { + rc = cil_resolve_expr(expr_type, catset->cats->str_expr, &catset->cats->datum_expr, parent, extra_args); + if (rc != SEPOL_OK) { + goto exit; + } + } + cil_copy_list(catset->cats->datum_expr, &datum_sub_expr); + cil_list_append(*datum_expr, CIL_LIST, datum_sub_expr); + } else { + if (sym_index == CIL_SYM_TYPES && (expr_type == CIL_CONSTRAIN || expr_type == CIL_VALIDATETRANS)) { + cil_type_used(res_datum, CIL_ATTR_CONSTRAINT); + } + cil_list_append(*datum_expr, CIL_DATUM, res_datum); } - - cil_list_append(*datum_expr, CIL_DATUM, res_datum); break; case CIL_LIST: { - struct cil_list *datum_sub_expr; rc = cil_resolve_expr(expr_type, curr->data, &datum_sub_expr, parent, extra_args); if (rc != SEPOL_OK) { - cil_list_destroy(&datum_sub_expr, CIL_TRUE); goto exit; } cil_list_append(*datum_expr, CIL_LIST, datum_sub_expr); @@ -3404,6 +3413,7 @@ int cil_resolve_expr(enum cil_flavor expr_type, struct cil_list *str_expr, struc return SEPOL_OK; exit: + cil_list_destroy(datum_expr, CIL_FALSE); return rc; } -- 2.32.0