rpms
/
setools
2
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity
setools/0006-Changes-to-support-nam...

1506 lines
46 KiB
Diff
Raw Permalink Blame History

From 287f507657e162bc09b5c186bbd580901fbc942a Mon Sep 17 00:00:00 2001
From: Dan Walsh <dwalsh@redhat.com>
Date: Tue, 20 Sep 2011 15:47:28 -0400
Subject: [PATCH 6/6] Changes to support named file_trans rules
---
libapol/include/apol/ftrule-query.h | 198 +++++++++++++++++++
libapol/include/apol/policy-query.h | 1 +
libapol/src/Makefile.am | 1 +
libapol/src/ftrule-query.c | 363 +++++++++++++++++++++++++++++++++++
libapol/src/libapol.map | 1 +
libqpol/include/qpol/ftrule_query.h | 116 +++++++++++
libqpol/include/qpol/policy.h | 1 +
libqpol/src/Makefile.am | 1 +
libqpol/src/ftrule_query.c | 277 ++++++++++++++++++++++++++
libqpol/src/libqpol.map | 1 +
libqpol/src/module_compiler.c | 12 ++
libqpol/src/policy_define.c | 186 ++++++++++++++++++-
libqpol/src/policy_parse.y | 13 +-
libqpol/src/policy_scan.l | 1 +
secmds/sesearch.c | 101 ++++++++++
15 files changed, 1270 insertions(+), 3 deletions(-)
create mode 100644 libapol/include/apol/ftrule-query.h
create mode 100644 libapol/src/ftrule-query.c
create mode 100644 libqpol/include/qpol/ftrule_query.h
create mode 100644 libqpol/src/ftrule_query.c
diff --git a/libapol/include/apol/ftrule-query.h b/libapol/include/apol/ftrule-query.h
new file mode 100644
index 0000000..119c52f
--- /dev/null
+++ b/libapol/include/apol/ftrule-query.h
@@ -0,0 +1,198 @@
+/**
+ * @file
+ *
+ * Routines to query filename_transition rules of a
+ * policy.
+ *
+ * @author Jeremy A. Mowery jmowery@tresys.com
+ * @author Jason Tang jtang@tresys.com
+ *
+ * Copyright (C) 2006-2007 Tresys Technology, LLC
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2.1 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA
+ */
+
+#ifndef APOL_FILENAMERULE_QUERY_H
+#define APOL_FILENAMERULE_QUERY_H
+
+#ifdef __cplusplus
+extern "C"
+{
+#endif
+
+#include "policy.h"
+#include "vector.h"
+#include <qpol/policy.h>
+
+ typedef struct apol_filename_trans_query apol_filename_trans_query_t;
+
+
+/******************** filename_transition queries ********************/
+
+/**
+ * Execute a query against all filename_transition rules within the
+ * policy.
+ *
+ * @param p Policy within which to look up filename_transition rules.
+ * @param r Structure containing parameters for query. If this is
+ * NULL then return all filename_transition rules.
+ * @param v Reference to a vector of qpol_filename_trans_t. The vector
+ * will be allocated by this function. The caller must call
+ * apol_vector_destroy() afterwards. This will be set to NULL upon no
+ * results or upon error.
+ *
+ * @return 0 on success (including none found), negative on error.
+ */
+ extern int apol_filename_trans_get_by_query(const apol_policy_t * p, const apol_filename_trans_query_t * r, apol_vector_t ** v);
+
+/**
+ * Allocate and return a new filename trans query structure. All fields
+ * are initialized, such that running this blank query results in
+ * returning all filename_transitions within the policy. The caller must
+ * call apol_filename_trans_query_destroy() upon the return value
+ * afterwards.
+ *
+ * @return An initialized filename trans query structure, or NULL upon
+ * error.
+ */
+ extern apol_filename_trans_query_t *apol_filename_trans_query_create(void);
+
+/**
+ * Deallocate all memory associated with the referenced filename trans
+ * query, and then set it to NULL. This function does nothing if the
+ * query is already NULL.
+ *
+ * @param r Reference to a filename trans query structure to destroy.
+ */
+ extern void apol_filename_trans_query_destroy(apol_filename_trans_query_t ** r);
+
+/**
+ * Set a filename_trans query to return rules whose source symbol matches
+ * symbol. Symbol may be a type or attribute; if it is an alias then
+ * the query will convert it to its primary prior to searching. If
+ * is_indirect is non-zero then the search will be done indirectly.
+ * If the symbol is a type, then the query matches rules with one of
+ * the type's attributes. If the symbol is an attribute, then it
+ * matches rule with any of the attribute's types.
+ *
+ * @param p Policy handler, to report errors.
+ * @param t TE rule query to set.
+ * @param symbol Limit query to rules with this symbol as their
+ * source, or NULL to unset this field.
+ * @param is_indirect If non-zero, perform indirect matching.
+ *
+ * @return 0 on success, negative on error.
+ */
+ extern int apol_filename_trans_query_set_source(const apol_policy_t * p, apol_filename_trans_query_t * t, const char *symbol,
+ int is_indirect);
+
+/**
+ * Set a filename trans query to return rules with a particular target
+ * symbol. Symbol may be a type or attribute; if it is an alias then
+ * the query will convert it to its primary prior to searching. If
+ * is_indirect is non-zero then the search will be done indirectly.
+ * If the symbol is a type, then the query matches rules with one of
+ * the type's attributes. If the symbol is an attribute, then it
+ * matches rule with any of the attribute's types.
+ *
+ * @param p Policy handler, to report errors.
+ * @param r Role trans query to set.
+ * @param symbol Limit query to rules with this type or attribute as
+ * their target, or NULL to unset this field.
+ * @param is_indirect If non-zero, perform indirect matching.
+ *
+ * @return 0 on success, negative on error.
+ */
+ extern int apol_filename_trans_query_set_target(const apol_policy_t * p, apol_filename_trans_query_t * r, const char *symbol,
+ int is_indirect);
+
+/**
+ * Set a filename trans query to return rules with a particular default
+ * filename. This field is ignored if
+ * apol_filename_trans_query_set_source_any() is set to non-zero.
+ *
+ * @param p Policy handler, to report errors.
+ * @param r Role trans query to set.
+ * @param filename Limit query to rules with this filename as their default, or
+ * NULL to unset this field.
+ *
+ * @return 0 on success, negative on error.
+ */
+ extern int apol_filename_trans_query_set_default(const apol_policy_t * p, apol_filename_trans_query_t * r, const char *filename);
+
+/**
+ * Set at filename_trans query to return rules with this object (non-common)
+ * class. If more than one class are appended to the query, the
+ * rule's class must be one of those appended. (I.e., the rule's
+ * class must be a member of the query's classes.) Pass a NULL to
+ * clear all classes. Note that this performs straight string
+ * comparison, ignoring the regex flag.
+
+ *
+ * @param p Policy handler, to report errors.
+ * @param t TE rule query to set.
+ * @param obj_class Name of object class to add to search set.
+ *
+ * @return 0 on success, negative on error.
+ */
+ extern int apol_filename_trans_query_append_class(const apol_policy_t * p, apol_filename_trans_query_t * t, const char *obj_class);
+
+/**
+ * Set a filename trans query to treat the source filename as any. That is,
+ * use the same symbol for either source or default of a
+ * filename_transition rule. This flag does nothing if the source filename is
+ * not set. Note that a filename_transition's target is a type, so thus
+ * this flag does not affect its searching.
+ *
+ * @param p Policy handler, to report errors.
+ * @param r Role trans query to set.
+ * @param is_any Non-zero to use source symbol for source or default
+ * field, 0 to keep source as only source.
+ *
+ * @return Always 0.
+ */
+ extern int apol_filename_trans_query_set_source_any(const apol_policy_t * p, apol_filename_trans_query_t * r, int is_any);
+
+/**
+ * Set a filename trans query to use regular expression searching for
+ * source, target, and default fields. Strings will be treated as
+ * regexes instead of literals. For the target type, matching will
+ * occur against the type name or any of its aliases.
+ *
+ * @param p Policy handler, to report errors.
+ * @param r Role trans query to set.
+ * @param is_regex Non-zero to enable regex searching, 0 to disable.
+ *
+ * @return Always 0.
+ */
+ extern int apol_filename_trans_query_set_regex(const apol_policy_t * p, apol_filename_trans_query_t * r, int is_regex);
+
+/**
+ * Render a filename_transition rule to a string.
+ *
+ * @param policy Policy handler, to report errors.
+ * @param rule The rule to render.
+ *
+ * @return A newly malloc()'d string representation of the rule, or NULL on
+ * failure; if the call fails, errno will be set. The caller is responsible
+ * for calling free() on the returned string.
+ */
+ extern char *apol_filename_trans_render(const apol_policy_t * policy, const qpol_filename_trans_t * rule);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif
diff --git a/libapol/include/apol/policy-query.h b/libapol/include/apol/policy-query.h
index 315f70e..665e4cb 100644
--- a/libapol/include/apol/policy-query.h
+++ b/libapol/include/apol/policy-query.h
@@ -71,6 +71,7 @@ extern "C"
#include "terule-query.h"
#include "condrule-query.h"
#include "rbacrule-query.h"
+#include "ftrule-query.h"
#include "range_trans-query.h"
#include "constraint-query.h"
diff --git a/libapol/src/Makefile.am b/libapol/src/Makefile.am
index 3fa4f06..baaa4f6 100644
--- a/libapol/src/Makefile.am
+++ b/libapol/src/Makefile.am
@@ -40,6 +40,7 @@ libapol_a_SOURCES = \
render.c \
role-query.c \
terule-query.c \
+ ftrule-query.c \
type-query.c \
types-relation-analysis.c \
user-query.c \
diff --git a/libapol/src/ftrule-query.c b/libapol/src/ftrule-query.c
new file mode 100644
index 0000000..dc248de
--- /dev/null
+++ b/libapol/src/ftrule-query.c
@@ -0,0 +1,363 @@
+/**
+ * @file
+ *
+ * Provides a way for setools to make queries about type enforcement
+ * filename_transs within a policy. The caller obtains a query object, fills in
+ * its parameters, and then runs the query; it obtains a vector of
+ * results. Searches are conjunctive -- all fields of the search
+ * query must match for a datum to be added to the results query.
+ *
+ * @author Jeremy A. Mowery jmowery@tresys.com
+ * @author Jason Tang jtang@tresys.com
+ *
+ * Copyright (C) 2006-2007 Tresys Technology, LLC
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2.1 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA
+ */
+
+#include "policy-query-internal.h"
+
+#include <errno.h>
+#include <string.h>
+
+struct apol_filename_trans_query
+{
+ char *source, *target, *default_type, *name;
+ apol_vector_t *classes;
+ unsigned int flags;
+};
+
+
+/******************** filename_transition queries ********************/
+
+int apol_filename_trans_get_by_query(const apol_policy_t * p, const apol_filename_trans_query_t * t, apol_vector_t ** v)
+{
+ apol_vector_t *source_list = NULL, *target_list = NULL, *class_list = NULL, *default_list = NULL;
+ int retval = -1, source_as_any = 0, is_regex = 0, append_filename_trans;
+ char *bool_name = NULL;
+ *v = NULL;
+ unsigned int flags = 0;
+ qpol_iterator_t *iter = NULL, *type_iter = NULL;
+
+ if (t != NULL) {
+ flags = t->flags;
+ is_regex = t->flags & APOL_QUERY_REGEX;
+ if (t->source != NULL &&
+ (source_list =
+ apol_query_create_candidate_type_list(p, t->source, is_regex,
+ t->flags & APOL_QUERY_SOURCE_INDIRECT,
+ ((t->flags & (APOL_QUERY_SOURCE_TYPE | APOL_QUERY_SOURCE_ATTRIBUTE)) /
+ APOL_QUERY_SOURCE_TYPE))) == NULL) {
+ goto cleanup;
+ }
+
+ if ((t->flags & APOL_QUERY_SOURCE_AS_ANY) && t->source != NULL) {
+ default_list = target_list = source_list;
+ source_as_any = 1;
+ } else {
+ if (t->target != NULL &&
+ (target_list =
+ apol_query_create_candidate_type_list(p, t->target, is_regex,
+ t->flags & APOL_QUERY_TARGET_INDIRECT,
+ ((t->
+ flags & (APOL_QUERY_TARGET_TYPE | APOL_QUERY_TARGET_ATTRIBUTE))
+ / APOL_QUERY_TARGET_TYPE))) == NULL) {
+ goto cleanup;
+ }
+ if (t->default_type != NULL &&
+ (default_list =
+ apol_query_create_candidate_type_list(p, t->default_type, is_regex, 0,
+ APOL_QUERY_SYMBOL_IS_TYPE)) == NULL) {
+ goto cleanup;
+ }
+ }
+ if (t->classes != NULL &&
+ apol_vector_get_size(t->classes) > 0 &&
+ (class_list = apol_query_create_candidate_class_list(p, t->classes)) == NULL) {
+ goto cleanup;
+ }
+ }
+
+ if (qpol_policy_get_filename_trans_iter(p->p, &iter) < 0) {
+ return -1;
+ }
+
+ if ((*v = apol_vector_create(NULL)) == NULL) {
+ ERR(p, "%s", strerror(errno));
+ goto cleanup;
+ }
+
+ for (; !qpol_iterator_end(iter); qpol_iterator_next(iter)) {
+ qpol_filename_trans_t *filename_trans;
+ if (qpol_iterator_get_item(iter, (void **)&filename_trans) < 0) {
+ goto cleanup;
+ }
+ int match_source = 0, match_target = 0, match_default = 0, match_bool = 0;
+ size_t i;
+
+ if (source_list == NULL) {
+ match_source = 1;
+ } else {
+ const qpol_type_t *source_type;
+ if (qpol_filename_trans_get_source_type(p->p, filename_trans, &source_type) < 0) {
+ goto cleanup;
+ }
+ if (apol_vector_get_index(source_list, source_type, NULL, NULL, &i) == 0) {
+ match_source = 1;
+ }
+ }
+
+ /* if source did not match, but treating source symbol
+ * as any field, then delay rejecting this filename_trans until
+ * the target and default have been checked */
+ if (!source_as_any && !match_source) {
+ continue;
+ }
+
+ if (target_list == NULL || (source_as_any && match_source)) {
+ match_target = 1;
+ } else {
+ const qpol_type_t *target_type;
+ if (qpol_filename_trans_get_target_type(p->p, filename_trans, &target_type) < 0) {
+ goto cleanup;
+ }
+ if (apol_vector_get_index(target_list, target_type, NULL, NULL, &i) == 0) {
+ match_target = 1;
+ }
+ }
+
+ if (!source_as_any && !match_target) {
+ continue;
+ }
+
+ if (default_list == NULL || (source_as_any && match_source) || (source_as_any && match_target)) {
+ match_default = 1;
+ } else {
+ const qpol_type_t *default_type;
+ if (qpol_filename_trans_get_default_type(p->p, filename_trans, &default_type) < 0) {
+ goto cleanup;
+ }
+ if (apol_vector_get_index(default_list, default_type, NULL, NULL, &i) == 0) {
+ match_default = 1;
+ }
+ }
+
+ if (!source_as_any && !match_default) {
+ continue;
+ }
+ /* at least one thing must match if source_as_any was given */
+ if (source_as_any && (!match_source && !match_target && !match_default)) {
+ continue;
+ }
+
+ if (class_list != NULL) {
+ const qpol_class_t *obj_class;
+ if (qpol_filename_trans_get_object_class(p->p, filename_trans, &obj_class) < 0) {
+ goto cleanup;
+ }
+ if (apol_vector_get_index(class_list, obj_class, NULL, NULL, &i) < 0) {
+ continue;
+ }
+ }
+
+ if (apol_vector_append(*v, filename_trans)) {
+ ERR(p, "%s", strerror(ENOMEM));
+ goto cleanup;
+ }
+ }
+
+ retval = 0;
+ cleanup:
+ if (retval != 0) {
+ apol_vector_destroy(v);
+ }
+ apol_vector_destroy(&source_list);
+ if (!source_as_any) {
+ apol_vector_destroy(&target_list);
+ apol_vector_destroy(&default_list);
+ }
+ apol_vector_destroy(&class_list);
+ return retval;
+}
+
+apol_filename_trans_query_t *apol_filename_trans_query_create(void)
+{
+ apol_filename_trans_query_t *t = calloc(1, sizeof(apol_filename_trans_query_t));
+ if (t != NULL) {
+ t->flags =
+ (APOL_QUERY_SOURCE_TYPE | APOL_QUERY_SOURCE_ATTRIBUTE | APOL_QUERY_TARGET_TYPE |
+ APOL_QUERY_TARGET_ATTRIBUTE);
+ }
+ return t;
+}
+
+void apol_filename_trans_query_destroy(apol_filename_trans_query_t ** r)
+{
+ if (r != NULL && *r != NULL) {
+ free((*r)->source);
+ free((*r)->target);
+ free((*r)->default_type);
+ free((*r)->name);
+ free(*r);
+ *r = NULL;
+ }
+}
+
+int apol_filename_trans_query_set_source(const apol_policy_t * p, apol_filename_trans_query_t * t, const char *filename, int is_indirect)
+{
+ apol_query_set_flag(p, &t->flags, is_indirect, APOL_QUERY_TARGET_INDIRECT);
+ return apol_query_set(p, &t->source, NULL, filename);
+}
+
+int apol_filename_trans_query_set_target(const apol_policy_t * p, apol_filename_trans_query_t * t, const char *type, int is_indirect)
+{
+ apol_query_set_flag(p, &t->flags, is_indirect, APOL_QUERY_TARGET_INDIRECT);
+ return apol_query_set(p, &t->target, NULL, type);
+}
+
+int apol_filename_trans_query_set_default(const apol_policy_t * p, apol_filename_trans_query_t * t, const char *symbol)
+{
+ return apol_query_set(p, &t->default_type, NULL, symbol);
+}
+
+int apol_filename_trans_query_append_class(const apol_policy_t * p, apol_filename_trans_query_t * t, const char *obj_class)
+{
+ char *s = NULL;
+ if (obj_class == NULL) {
+ apol_vector_destroy(&t->classes);
+ } else if ((s = strdup(obj_class)) == NULL || (t->classes == NULL && (t->classes = apol_vector_create(free)) == NULL)
+ || apol_vector_append(t->classes, s) < 0) {
+ ERR(p, "%s", strerror(errno));
+ free(s);
+ return -1;
+ }
+ return 0;
+}
+
+int apol_filename_trans_query_set_name(const apol_policy_t * p, apol_filename_trans_query_t * t, const char *filename)
+{
+ return apol_query_set(p, &t->name, NULL, filename);
+}
+
+int apol_filename_trans_query_set_source_any(const apol_policy_t * p, apol_filename_trans_query_t * t, int is_any)
+{
+ return apol_query_set_flag(p, &t->flags, is_any, APOL_QUERY_SOURCE_AS_ANY);
+}
+
+int apol_filename_trans_query_set_regex(const apol_policy_t * p, apol_filename_trans_query_t * t, int is_regex)
+{
+ return apol_query_set_regex(p, &t->flags, is_regex);
+}
+
+char *apol_filename_trans_render(const apol_policy_t * policy, const qpol_filename_trans_t * filename_trans)
+{
+ char *tmp = NULL;
+ const char *tmp_name = NULL;
+ const char *filename_trans_type_str;
+ int error = 0;
+ size_t tmp_sz = 0;
+ uint32_t filename_trans_type = 0;
+ const qpol_type_t *type = NULL;
+ const qpol_class_t *obj_class = NULL;
+
+ if (!policy || !filename_trans) {
+ ERR(policy, "%s", strerror(EINVAL));
+ errno = EINVAL;
+ return NULL;
+ }
+
+ /* source type */
+ if (qpol_filename_trans_get_source_type(policy->p, filename_trans, &type)) {
+ error = errno;
+ goto err;
+ }
+ if (qpol_type_get_name(policy->p, type, &tmp_name)) {
+ error = errno;
+ goto err;
+ }
+ if (apol_str_appendf(&tmp, &tmp_sz, "transition_type %s ", tmp_name)) {
+ error = errno;
+ ERR(policy, "%s", strerror(error));
+ goto err;
+ }
+
+ /* target type */
+ if (qpol_filename_trans_get_target_type(policy->p, filename_trans, &type)) {
+ error = errno;
+ goto err;
+ }
+ if (qpol_type_get_name(policy->p, type, &tmp_name)) {
+ error = errno;
+ goto err;
+ }
+ if (apol_str_appendf(&tmp, &tmp_sz, "%s : ", tmp_name)) {
+ error = errno;
+ ERR(policy, "%s", strerror(error));
+ goto err;
+ }
+
+ /* object class */
+ if (qpol_filename_trans_get_object_class(policy->p, filename_trans, &obj_class)) {
+ error = errno;
+ goto err;
+ }
+ if (qpol_class_get_name(policy->p, obj_class, &tmp_name)) {
+ error = errno;
+ goto err;
+ }
+ if (apol_str_appendf(&tmp, &tmp_sz, "%s ", tmp_name)) {
+ error = errno;
+ ERR(policy, "%s", strerror(error));
+ goto err;
+ }
+
+ /* default type */
+ if (qpol_filename_trans_get_default_type(policy->p, filename_trans, &type)) {
+ error = errno;
+ goto err;
+ }
+ if (qpol_type_get_name(policy->p, type, &tmp_name)) {
+ error = errno;
+ goto err;
+ }
+ if (apol_str_appendf(&tmp, &tmp_sz, "%s", tmp_name)) {
+ error = errno;
+ ERR(policy, "%s", strerror(error));
+ goto err;
+ }
+
+ if (qpol_filename_trans_get_filename(policy->p, filename_trans, &tmp_name)) {
+ error = errno;
+ goto err;
+ }
+
+ if (apol_str_appendf(&tmp, &tmp_sz, " %s", tmp_name)) {
+ error = errno;
+ ERR(policy, "%s", strerror(error));
+ goto err;
+ }
+
+ if (apol_str_appendf(&tmp, &tmp_sz, ";")) {
+ error = errno;
+ ERR(policy, "%s", strerror(error));
+ goto err;
+ }
+ return tmp;
+
+ err:
+ free(tmp);
+ errno = error;
+ return NULL;
+}
diff --git a/libapol/src/libapol.map b/libapol/src/libapol.map
index 4894374..7657a2d 100644
--- a/libapol/src/libapol.map
+++ b/libapol/src/libapol.map
@@ -34,6 +34,7 @@ VERS_4.0{
apol_protocol_to_str;
apol_qpol_context_render;
apol_range_trans_*;
+ apol_filename_trans_*;
apol_relabel_*;
apol_role_*;
apol_role_allow_*;
diff --git a/libqpol/include/qpol/ftrule_query.h b/libqpol/include/qpol/ftrule_query.h
new file mode 100644
index 0000000..1f533a4
--- /dev/null
+++ b/libqpol/include/qpol/ftrule_query.h
@@ -0,0 +1,116 @@
+/**
+ * @file
+ * Defines public interface for iterating over FTRULE rules.
+ *
+ * @author Kevin Carr kcarr@tresys.com
+ * @author Jeremy A. Mowery jmowery@tresys.com
+ * @author Jason Tang jtang@tresys.com
+ *
+ * Copyright (C) 2006-2007 Tresys Technology, LLC
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2.1 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA
+ */
+
+#ifndef QPOL_FTRULERULE_QUERY
+#define QPOL_FTRULERULE_QUERY
+
+#ifdef __cplusplus
+extern "C"
+{
+#endif
+
+#include <qpol/policy.h>
+#include <qpol/iterator.h>
+
+ typedef struct qpol_filename_trans qpol_filename_trans_t;
+
+/**
+ * Get an iterator over all filename transition rules in the policy.
+ * @param policy Policy from which to create the iterator.
+ * @param iter Iterator over items of type qpol_filename_trans_t returned.
+ * The caller is responsible for calling qpol_iterator_destroy()
+ * to free memory used by this iterator.
+ * It is important to note that this iterator is only valid as long as
+ * the policy is unmodifed.
+ * @returm 0 on success and < 0 on failure; if the call fails,
+ * errno will be set and *iter will be NULL.
+ */
+ extern int qpol_policy_get_filename_trans_iter(const qpol_policy_t * policy, qpol_iterator_t ** iter);
+
+/**
+ * Get the source type from a filename transition rule.
+ * @param policy The policy from which the rule comes.
+ * @param rule The rule from which to get the source type.
+ * @param source Pointer in which to store the source type.
+ * The caller should not free this pointer.
+ * @return 0 on success and < 0 on failure; if the call fails,
+ * errno will be set and *source will be NULL.
+ */
+ extern int qpol_filename_trans_get_source_type(const qpol_policy_t * policy, const qpol_filename_trans_t * rule,
+ const qpol_type_t ** source);
+
+/**
+ * Get the target type from a filename transition rule.
+ * @param policy The policy from which the rule comes.
+ * @param rule The rule from which to get the target type.
+ * @param target Pointer in which to store the target type.
+ * The caller should not free this pointer.
+ * @return 0 on success and < 0 on failure; if the call fails,
+ * errno will be set and *target will be NULL.
+ */
+ extern int qpol_filename_trans_get_target_type(const qpol_policy_t * policy, const qpol_filename_trans_t * rule,
+ const qpol_type_t ** target);
+
+/**
+ * Get the default type from a type rule.
+ * @param policy Policy from which the rule comes.
+ * @param rule The rule from which to get the default type.
+ * @param dflt Pointer in which to store the default type.
+ * The caller should not free this pointer.
+ * @returm 0 on success and < 0 on failure; if the call fails,
+ * errno will be set and *dflt will be NULL.
+ */
+ extern int qpol_filename_trans_get_default_type(const qpol_policy_t * policy, const qpol_filename_trans_t * rule,
+ const qpol_type_t ** dflt);
+
+/**
+ * Get the object class from a type rule.
+ * @param policy Policy from which the rule comes.
+ * @param rule The rule from which to get the object class.
+ * @param obj_class Pointer in which to store the object class.
+ * The caller should not free this pointer.
+ * @returm 0 on success and < 0 on failure; if the call fails,
+ * errno will be set and *obj_class will be NULL.
+ */
+ extern int qpol_filename_trans_get_object_class(const qpol_policy_t * policy, const qpol_filename_trans_t * rule,
+ const qpol_class_t ** obj_class);
+
+/**
+ * Get the transition filename type from a type rule.
+ * @param policy Policy from which the rule comes.
+ * @param rule The rule from which to get the transition filename.
+ * @param target Pointer in which to store the transition filename.
+ * The caller should not free this pointer.
+ * @returm 0 on success and < 0 on failure; if the call fails,
+ * errno will be set and *target will be NULL.
+ */
+ extern int qpol_filename_trans_get_filename(const qpol_policy_t * policy, const qpol_filename_trans_t * rule,
+ const char ** name);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* QPOL_FTRULERULE_QUERY */
diff --git a/libqpol/include/qpol/policy.h b/libqpol/include/qpol/policy.h
index ae4ea08..bf85718 100644
--- a/libqpol/include/qpol/policy.h
+++ b/libqpol/include/qpol/policy.h
@@ -55,6 +55,7 @@ extern "C"
#include <qpol/polcap_query.h>
#include <qpol/portcon_query.h>
#include <qpol/rbacrule_query.h>
+#include <qpol/ftrule_query.h>
#include <qpol/role_query.h>
#include <qpol/syn_rule_query.h>
#include <qpol/terule_query.h>
diff --git a/libqpol/src/Makefile.am b/libqpol/src/Makefile.am
index 34d87a6..0889a61 100644
--- a/libqpol/src/Makefile.am
+++ b/libqpol/src/Makefile.am
@@ -48,6 +48,7 @@ libqpol_a_SOURCES = \
syn_rule_internal.h \
syn_rule_query.c \
terule_query.c \
+ ftrule_query.c \
type_query.c \
user_query.c \
util.c \
diff --git a/libqpol/src/ftrule_query.c b/libqpol/src/ftrule_query.c
new file mode 100644
index 0000000..d6db848
--- /dev/null
+++ b/libqpol/src/ftrule_query.c
@@ -0,0 +1,277 @@
+/**
+ * @file
+ * Defines public interface for iterating over RBAC rules.
+ *
+ * @author Jeremy A. Mowery jmowery@tresys.com
+ * @author Jason Tang jtang@tresys.com
+ *
+ * Copyright (C) 2006-2007 Tresys Technology, LLC
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2.1 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA
+ */
+
+#include <qpol/iterator.h>
+#include <qpol/policy.h>
+#include <qpol/ftrule_query.h>
+#include <stdlib.h>
+#include "iterator_internal.h"
+#include "qpol_internal.h"
+#include <sepol/policydb/policydb.h>
+
+typedef struct filename_trans_state
+{
+ filename_trans_t *head;
+ filename_trans_t *cur;
+} filename_trans_state_t;
+
+static int filename_trans_state_end(const qpol_iterator_t * iter)
+{
+ filename_trans_state_t *fts = NULL;
+
+ if (!iter || !(fts = qpol_iterator_state(iter))) {
+ errno = EINVAL;
+ return STATUS_ERR;
+ }
+
+ return fts->cur ? 0 : 1;
+}
+
+static void *filename_trans_state_get_cur(const qpol_iterator_t * iter)
+{
+ filename_trans_state_t *fts = NULL;
+ const policydb_t *db = NULL;
+
+ if (!iter || !(fts = qpol_iterator_state(iter)) || !(db = qpol_iterator_policy(iter)) || filename_trans_state_end(iter)) {
+ errno = EINVAL;
+ return NULL;
+ }
+
+ return fts->cur;
+}
+
+static int filename_trans_state_next(qpol_iterator_t * iter)
+{
+ filename_trans_state_t *fts = NULL;
+ const policydb_t *db = NULL;
+
+ if (!iter || !(fts = qpol_iterator_state(iter)) || !(db = qpol_iterator_policy(iter))) {
+ errno = EINVAL;
+ return STATUS_ERR;
+ }
+
+ if (filename_trans_state_end(iter)) {
+ errno = ERANGE;
+ return STATUS_ERR;
+ }
+
+ fts->cur = fts->cur->next;
+
+ return STATUS_SUCCESS;
+}
+
+static size_t filename_trans_state_size(const qpol_iterator_t * iter)
+{
+ filename_trans_state_t *fts = NULL;
+ const policydb_t *db = NULL;
+ filename_trans_t *tmp = NULL;
+ size_t count = 0;
+
+ if (!iter || !(fts = qpol_iterator_state(iter)) || !(db = qpol_iterator_policy(iter))) {
+ errno = EINVAL;
+ return STATUS_ERR;
+ }
+
+ for (tmp = fts->head; tmp; tmp = tmp->next)
+ count++;
+
+ return count;
+}
+
+int qpol_policy_get_filename_trans_iter(const qpol_policy_t * policy, qpol_iterator_t ** iter)
+{
+ policydb_t *db = NULL;
+ filename_trans_state_t *fts = NULL;
+ int error = 0;
+
+ if (iter)
+ *iter = NULL;
+
+ if (!policy || !iter) {
+ ERR(policy, "%s", strerror(EINVAL));
+ errno = EINVAL;
+ return STATUS_ERR;
+ }
+
+ db = &policy->p->p;
+
+ fts = calloc(1, sizeof(filename_trans_state_t));
+ if (!fts) {
+ /* errno set by calloc */
+ ERR(policy, "%s", strerror(errno));
+ return STATUS_ERR;
+ }
+ fts->head = fts->cur = db->filename_trans;
+
+ if (qpol_iterator_create
+ (policy, (void *)fts, filename_trans_state_get_cur, filename_trans_state_next, filename_trans_state_end, filename_trans_state_size,
+ free, iter)) {
+ error = errno;
+ free(fts);
+ errno = error;
+ return STATUS_ERR;
+ }
+
+ return STATUS_SUCCESS;
+}
+
+int qpol_filename_trans_get_source_type(const qpol_policy_t * policy, const qpol_filename_trans_t * rule, const qpol_type_t ** source)
+{
+ policydb_t *db = NULL;
+ filename_trans_t *ft = NULL;
+
+ if (source) {
+ *source = NULL;
+ }
+
+ if (!policy || !rule || !source) {
+ ERR(policy, "%s", strerror(EINVAL));
+ errno = EINVAL;
+ return STATUS_ERR;
+ }
+
+ db = &policy->p->p;
+ ft = (filename_trans_t *) rule;
+
+ *source = (qpol_type_t *) db->type_val_to_struct[ft->stype - 1];
+
+ return STATUS_SUCCESS;
+}
+
+int qpol_filename_trans_get_target_type(const qpol_policy_t * policy, const qpol_filename_trans_t * rule, const qpol_type_t ** target)
+{
+ policydb_t *db = NULL;
+ filename_trans_t *ft = NULL;
+
+ if (target) {
+ *target = NULL;
+ }
+
+ if (!policy || !rule || !target) {
+ ERR(policy, "%s", strerror(EINVAL));
+ errno = EINVAL;
+ return STATUS_ERR;
+ }
+
+ db = &policy->p->p;
+ ft = (filename_trans_t *) rule;
+
+ *target = (qpol_type_t *) db->type_val_to_struct[ft->ttype - 1];
+
+ return STATUS_SUCCESS;
+}
+
+int qpol_filename_trans_get_object_class(const qpol_policy_t * policy, const qpol_filename_trans_t * rule,
+ const qpol_class_t ** obj_class)
+{
+ policydb_t *db = NULL;
+ filename_trans_t *ft = NULL;
+
+ if (obj_class) {
+ *obj_class = NULL;
+ }
+
+ if (!policy || !rule || !obj_class) {
+ ERR(policy, "%s", strerror(EINVAL));
+ errno = EINVAL;
+ return STATUS_ERR;
+ }
+
+ db = &policy->p->p;
+ ft = (filename_trans_t *) rule;
+
+ *obj_class = (qpol_class_t *) db->class_val_to_struct[ft->tclass - 1];
+
+ return STATUS_SUCCESS;
+}
+
+int qpol_filename_trans_get_trans_type(const qpol_policy_t * policy, const qpol_filename_trans_t * rule, const qpol_type_t ** output_type)
+{
+ policydb_t *db = NULL;
+ filename_trans_t *ft = NULL;
+
+ if (output_type) {
+ *output_type = NULL;
+ }
+
+ if (!policy || !rule || !output_type) {
+ ERR(policy, "%s", strerror(EINVAL));
+ errno = EINVAL;
+ return STATUS_ERR;
+ }
+
+ db = &policy->p->p;
+ ft = (filename_trans_t *) rule;
+
+ *output_type = (qpol_type_t *) db->type_val_to_struct[ft->otype - 1];
+
+ return STATUS_SUCCESS;
+}
+
+int qpol_filename_trans_get_default_type(const qpol_policy_t * policy, const qpol_filename_trans_t * rule, const qpol_type_t ** dflt)
+{
+ policydb_t *db = NULL;
+ filename_trans_t *ft = NULL;
+
+ if (dflt) {
+ *dflt = NULL;
+ }
+
+ if (!policy || !rule || !dflt) {
+ ERR(policy, "%s", strerror(EINVAL));
+ errno = EINVAL;
+ return STATUS_ERR;
+ }
+
+ db = &policy->p->p;
+ ft = (filename_trans_t *) rule;
+
+ *dflt = (qpol_type_t *) db->type_val_to_struct[ft->otype - 1];
+
+ return STATUS_SUCCESS;
+}
+
+int qpol_filename_trans_get_filename(const qpol_policy_t * policy, const qpol_filename_trans_t * rule, const char ** name)
+{
+ policydb_t *db = NULL;
+ filename_trans_t *ft = NULL;
+
+ if (name) {
+ *name = NULL;
+ }
+
+ if (!policy || !rule || !name) {
+ ERR(policy, "%s", strerror(EINVAL));
+ errno = EINVAL;
+ return STATUS_ERR;
+ }
+
+ db = &policy->p->p;
+ ft = (filename_trans_t *) rule;
+
+ *name = ft->name;
+
+ return STATUS_SUCCESS;
+}
+
diff --git a/libqpol/src/libqpol.map b/libqpol/src/libqpol.map
index dd293bc..6973cca 100644
--- a/libqpol/src/libqpol.map
+++ b/libqpol/src/libqpol.map
@@ -34,6 +34,7 @@ VERS_1.2 {
qpol_policy_reevaluate_conds;
qpol_portcon_*;
qpol_range_trans_*;
+ qpol_filename_trans_*;
qpol_role_*;
qpol_syn_avrule_*;
qpol_syn_terule_*;
diff --git a/libqpol/src/module_compiler.c b/libqpol/src/module_compiler.c
index dc19798..b06e285 100644
--- a/libqpol/src/module_compiler.c
+++ b/libqpol/src/module_compiler.c
@@ -1247,6 +1247,18 @@ void append_role_allow(role_allow_rule_t * role_allow_rules)
}
/* this doesn't actually append, but really prepends it */
+void append_filename_trans(filename_trans_rule_t * filename_trans_rules)
+{
+ avrule_decl_t *decl = stack_top->decl;
+
+ /* filename transitions are not allowed within conditionals */
+ assert(stack_top->type == 1);
+
+ filename_trans_rules->next = decl->filename_trans_rules;
+ decl->filename_trans_rules = filename_trans_rules;
+}
+
+/* this doesn't actually append, but really prepends it */
void append_range_trans(range_trans_rule_t * range_tr_rules)
{
avrule_decl_t *decl = stack_top->decl;
diff --git a/libqpol/src/policy_define.c b/libqpol/src/policy_define.c
index c94f7aa..0f3a45a 100644
--- a/libqpol/src/policy_define.c
+++ b/libqpol/src/policy_define.c
@@ -2133,7 +2133,7 @@ int define_role_trans(void)
/* This ebitmap business is just to ensure that there are not conflicting role_trans rules */
#ifdef HAVE_SEPOL_USER_ROLE_MAPPING
- if (role_set_expand(&roles, &e_roles, policydbp, NULL))
+ if (role_set_expand(&roles, &e_roles, policydbp, NULL, NULL))
#else
if (role_set_expand(&roles, &e_roles, policydbp))
#endif
@@ -2226,6 +2226,190 @@ int define_role_allow(void)
return 0;
}
+avrule_t *define_cond_filename_trans(void)
+{
+ yyerror("type transitions with a filename not allowed inside "
+ "conditionals\n");
+ return COND_ERR;
+}
+
+int define_filename_trans(void)
+{
+ char *id, *name = NULL;
+ type_set_t stypes, ttypes;
+ ebitmap_t e_stypes, e_ttypes;
+ ebitmap_t e_tclasses;
+ ebitmap_node_t *snode, *tnode, *cnode;
+ filename_trans_t *ft;
+ filename_trans_rule_t *ftr;
+ class_datum_t *cladatum;
+ type_datum_t *typdatum;
+ uint32_t otype;
+ unsigned int c, s, t;
+ int add;
+
+ if (pass == 1) {
+ /* stype */
+ while ((id = queue_remove(id_queue)))
+ free(id);
+ /* ttype */
+ while ((id = queue_remove(id_queue)))
+ free(id);
+ /* tclass */
+ while ((id = queue_remove(id_queue)))
+ free(id);
+ /* otype */
+ id = queue_remove(id_queue);
+ free(id);
+ /* name */
+ id = queue_remove(id_queue);
+ free(id);
+ return 0;
+ }
+
+
+ add = 1;
+ type_set_init(&stypes);
+ while ((id = queue_remove(id_queue))) {
+ if (set_types(&stypes, id, &add, 0))
+ goto bad;
+ }
+
+ add =1;
+ type_set_init(&ttypes);
+ while ((id = queue_remove(id_queue))) {
+ if (set_types(&ttypes, id, &add, 0))
+ goto bad;
+ }
+
+ ebitmap_init(&e_tclasses);
+ while ((id = queue_remove(id_queue))) {
+ if (!is_id_in_scope(SYM_CLASSES, id)) {
+ yyerror2("class %s is not within scope", id);
+ free(id);
+ goto bad;
+ }
+ cladatum = hashtab_search(policydbp->p_classes.table, id);
+ if (!cladatum) {
+ yyerror2("unknown class %s", id);
+ goto bad;
+ }
+ if (ebitmap_set_bit(&e_tclasses, cladatum->s.value - 1, TRUE)) {
+ yyerror("Out of memory");
+ goto bad;
+ }
+ free(id);
+ }
+
+ id = (char *)queue_remove(id_queue);
+ if (!id) {
+ yyerror("no otype in transition definition?");
+ goto bad;
+ }
+ if (!is_id_in_scope(SYM_TYPES, id)) {
+ yyerror2("type %s is not within scope", id);
+ free(id);
+ goto bad;
+ }
+ typdatum = hashtab_search(policydbp->p_types.table, id);
+ if (!typdatum) {
+ yyerror2("unknown type %s used in transition definition", id);
+ goto bad;
+ }
+ free(id);
+ otype = typdatum->s.value;
+
+ name = queue_remove(id_queue);
+ if (!name) {
+ yyerror("no pathname specified in filename_trans definition?");
+ goto bad;
+ }
+
+ /* We expand the class set into seperate rules. We expand the types
+ * just to make sure there are not duplicates. They will get turned
+ * into seperate rules later */
+ ebitmap_init(&e_stypes);
+ if (type_set_expand(&stypes, &e_stypes, policydbp, 1))
+ goto bad;
+
+ ebitmap_init(&e_ttypes);
+ if (type_set_expand(&ttypes, &e_ttypes, policydbp, 1))
+ goto bad;
+
+ ebitmap_for_each_bit(&e_tclasses, cnode, c) {
+ if (!ebitmap_node_get_bit(cnode, c))
+ continue;
+ ebitmap_for_each_bit(&e_stypes, snode, s) {
+ if (!ebitmap_node_get_bit(snode, s))
+ continue;
+ ebitmap_for_each_bit(&e_ttypes, tnode, t) {
+ if (!ebitmap_node_get_bit(tnode, t))
+ continue;
+
+ for (ft = policydbp->filename_trans; ft; ft = ft->next) {
+ if (ft->stype == (s + 1) &&
+ ft->ttype == (t + 1) &&
+ ft->tclass == (c + 1) &&
+ !strcmp(ft->name, name)) {
+ yyerror2("duplicate filename transition for: filename_trans %s %s %s:%s",
+ name,
+ policydbp->p_type_val_to_name[s],
+ policydbp->p_type_val_to_name[t],
+ policydbp->p_class_val_to_name[c]);
+ goto bad;
+ }
+ }
+
+ ft = malloc(sizeof(*ft));
+ if (!ft) {
+ yyerror("out of memory");
+ goto bad;
+ }
+ memset(ft, 0, sizeof(*ft));
+
+ ft->next = policydbp->filename_trans;
+ policydbp->filename_trans = ft;
+
+ ft->name = strdup(name);
+ if (!ft->name) {
+ yyerror("out of memory");
+ goto bad;
+ }
+ ft->stype = s + 1;
+ ft->ttype = t + 1;
+ ft->tclass = c + 1;
+ ft->otype = otype;
+ }
+ }
+
+ /* Now add the real rule since we didn't find any duplicates */
+ ftr = malloc(sizeof(*ftr));
+ if (!ftr) {
+ yyerror("out of memory");
+ goto bad;
+ }
+ filename_trans_rule_init(ftr);
+ append_filename_trans(ftr);
+
+ ftr->name = strdup(name);
+ ftr->stypes = stypes;
+ ftr->ttypes = ttypes;
+ ftr->tclass = c + 1;
+ ftr->otype = otype;
+ }
+
+ free(name);
+ ebitmap_destroy(&e_stypes);
+ ebitmap_destroy(&e_ttypes);
+ ebitmap_destroy(&e_tclasses);
+
+ return 0;
+
+bad:
+ free(name);
+ return -1;
+}
+
static constraint_expr_t *constraint_expr_clone(constraint_expr_t * expr)
{
constraint_expr_t *h = NULL, *l = NULL, *e, *newe;
diff --git a/libqpol/src/policy_parse.y b/libqpol/src/policy_parse.y
index 84f4114..dc16c6f 100644
--- a/libqpol/src/policy_parse.y
+++ b/libqpol/src/policy_parse.y
@@ -98,6 +98,7 @@ extern char *qpol_src_inputlim;/* end of data */
%type <require_func> require_decl_def
%token PATH
+%token FILENAME
%token CLONE
%token COMMON
%token CLASS
@@ -360,7 +361,10 @@ cond_rule_def : cond_transition_def
| require_block
{ $$ = NULL; }
;
-cond_transition_def : TYPE_TRANSITION names names ':' names identifier ';'
+cond_transition_def : TYPE_TRANSITION names names ':' names identifier filename ';'
+ { $$ = define_cond_filename_trans() ;
+ if ($$ == COND_ERR) return -1;}
+ | TYPE_TRANSITION names names ':' names identifier ';'
{ $$ = define_cond_compute_type(AVRULE_TRANSITION) ;
if ($$ == COND_ERR) return -1;}
| TYPE_MEMBER names names ':' names identifier ';'
@@ -395,7 +399,9 @@ cond_dontaudit_def : DONTAUDIT names names ':' names names ';'
{ $$ = define_cond_te_avtab(AVRULE_DONTAUDIT);
if ($$ == COND_ERR) return -1; }
;
-transition_def : TYPE_TRANSITION names names ':' names identifier ';'
+transition_def : TYPE_TRANSITION names names ':' names identifier filename ';'
+ {if (define_filename_trans()) return -1; }
+ | TYPE_TRANSITION names names ':' names identifier ';'
{if (define_compute_type(AVRULE_TRANSITION)) return -1;}
| TYPE_MEMBER names names ':' names identifier ';'
{if (define_compute_type(AVRULE_MEMBER)) return -1;}
@@ -752,6 +758,9 @@ identifier : IDENTIFIER
path : PATH
{ if (insert_id(yytext,0)) return -1; }
;
+filename : FILENAME
+ { yytext[strlen(yytext) - 1] = '\0'; if (insert_id(yytext + 1,0)) return -1; }
+ ;
number : NUMBER
{ $$ = strtoul(yytext,NULL,0); }
;
diff --git a/libqpol/src/policy_scan.l b/libqpol/src/policy_scan.l
index 75485f3..30203cd 100644
--- a/libqpol/src/policy_scan.l
+++ b/libqpol/src/policy_scan.l
@@ -235,6 +235,7 @@ POLICYCAP { return(POLICYCAP); }
permissive |
PERMISSIVE { return(PERMISSIVE); }
"/"({alnum}|[_\.\-/])* { return(PATH); }
+\"({alnum}|[_\.\-])+\" { return(FILENAME); }
{letter}({alnum}|[_\-])*([\.]?({alnum}|[_\-]))* { return(IDENTIFIER); }
{digit}+|0x{hexval}+ { return(NUMBER); }
{digit}{1,3}(\.{digit}{1,3}){3} { return(IPV4_ADDR); }
diff --git a/secmds/sesearch.c b/secmds/sesearch.c
index ec0315f..e44b3bc 100644
--- a/secmds/sesearch.c
+++ b/secmds/sesearch.c
@@ -575,6 +575,95 @@ static void print_te_results(const apol_policy_t * policy, const options_t * opt
free(expr);
}
+static int perform_ft_query(const apol_policy_t * policy, const options_t * opt, apol_vector_t ** v)
+{
+ apol_filename_trans_query_t *ftq = NULL;
+ int error = 0;
+
+ if (!policy || !opt || !v) {
+ ERR(policy, "%s", strerror(EINVAL));
+ errno = EINVAL;
+ return -1;
+ }
+
+ if (!opt->type == QPOL_RULE_TYPE_TRANS && !opt->all) {
+ *v = NULL;
+ return 0; /* no search to do */
+ }
+
+ ftq = apol_filename_trans_query_create();
+ if (!ftq) {
+ ERR(policy, "%s", strerror(ENOMEM));
+ errno = ENOMEM;
+ return -1;
+ }
+
+ apol_filename_trans_query_set_regex(policy, ftq, opt->useregex);
+ if (opt->src_name) {
+ if (apol_filename_trans_query_set_source(policy, ftq, opt->src_name)) {
+ error = errno;
+ goto err;
+ }
+ }
+ if (opt->tgt_name) {
+ if (apol_filename_trans_query_set_target(policy, ftq, opt->tgt_name, opt->indirect)) {
+ error = errno;
+ goto err;
+ }
+ }
+
+ if (apol_filename_trans_get_by_query(policy, ftq, v)) {
+ error = errno;
+ goto err;
+ }
+
+ apol_filename_trans_query_destroy(&ftq);
+ return 0;
+
+ err:
+ apol_vector_destroy(v);
+ apol_filename_trans_query_destroy(&ftq);
+ ERR(policy, "%s", strerror(error));
+ errno = error;
+ return -1;
+}
+
+static void print_ft_results(const apol_policy_t * policy, const options_t * opt, const apol_vector_t * v)
+{
+ qpol_policy_t *q = apol_policy_get_qpol(policy);
+ size_t i, num_rules = 0;
+ const qpol_filename_trans_t *rule = NULL;
+ char *tmp = NULL, *rule_str = NULL, *expr = NULL;
+ char enable_char = ' ', branch_char = ' ';
+ qpol_iterator_t *iter = NULL;
+ const qpol_cond_t *cond = NULL;
+ uint32_t enabled = 0, list = 0;
+
+ if (!(num_rules = apol_vector_get_size(v)))
+ goto cleanup;
+
+ fprintf(stdout, "Found %zd named file transition rules:\n", num_rules);
+
+ for (i = 0; i < num_rules; i++) {
+ enable_char = branch_char = ' ';
+ if (!(rule = apol_vector_get_element(v, i)))
+ goto cleanup;
+
+ if (!(rule_str = apol_filename_trans_render(policy, rule)))
+ goto cleanup;
+ fprintf(stdout, "%s %s\n", rule_str, expr ? expr : "");
+ free(rule_str);
+ rule_str = NULL;
+ free(expr);
+ expr = NULL;
+ }
+
+ cleanup:
+ free(tmp);
+ free(rule_str);
+ free(expr);
+}
+
static int perform_ra_query(const apol_policy_t * policy, const options_t * opt, apol_vector_t ** v)
{
apol_role_allow_query_t *raq = NULL;
@@ -1128,6 +1217,18 @@ int main(int argc, char **argv)
print_te_results(policy, &cmd_opts, v);
fprintf(stdout, "\n");
}
+
+ if (cmd_opts.all || cmd_opts.type == QPOL_RULE_TYPE_TRANS) {
+ apol_vector_destroy(&v);
+ if (perform_ft_query(policy, &cmd_opts, &v)) {
+ rt = 1;
+ goto cleanup;
+ }
+
+ print_ft_results(policy, &cmd_opts, v);
+ fprintf(stdout, "\n");
+ }
+
apol_vector_destroy(&v);
if (perform_ra_query(policy, &cmd_opts, &v)) {
rt = 1;
--
1.7.6.2
diff -up setools-3.3.7/libapol/include/apol/Makefile.am.filenametrans setools-3.3.7/libapol/include/apol/Makefile.am
--- setools-3.3.7/libapol/include/apol/Makefile.am.filenametrans 2009-07-14 14:03:27.000000000 -0400
+++ setools-3.3.7/libapol/include/apol/Makefile.am 2011-10-26 16:24:59.948130442 -0400
@@ -27,6 +27,7 @@ apol_HEADERS = \
relabel-analysis.h \
render.h \
role-query.h \
+ ftrule-query.h \
terule-query.h \
type-query.h \
types-relation-analysis.h \
diff -up setools-3.3.7/libqpol/include/qpol/Makefile.am.filenametrans setools-3.3.7/libqpol/include/qpol/Makefile.am
--- setools-3.3.7/libqpol/include/qpol/Makefile.am.filenametrans 2011-10-26 16:22:28.723523155 -0400
+++ setools-3.3.7/libqpol/include/qpol/Makefile.am 2011-10-26 16:22:41.283493767 -0400
@@ -25,6 +25,7 @@ qpol_HEADERS = \
role_query.h \
syn_rule_query.h \
terule_query.h \
+ ftrule_query.h \
type_query.h \
user_query.h \
util.h
Reference in New Issue View Git Blame Copy Permalink