Skip to content

Commit cb0e340

Browse files
masatakemasatake
committed
SELinuxTypeEnforcement: fill typeref: field for alias kind objects
"aliased" role is added to the "type" kind. Signed-off-by: Masatake YAMATO <yamato@redhat.com>
1 parent 7171fc2 commit cb0e340

File tree

3 files changed

+52
-20
lines changed

3 files changed

+52
-20
lines changed

‎Units/parser-selinux-type-enforcement.r/simple.d/expected.tags

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -3,20 +3,20 @@ dbusd_unconfined input.te /^attribute dbusd_unconfined;$/;" T
33
system_bus_type input.te /^attribute system_bus_type;$/;" T
44
dbusd_etc_t input.te /^type dbusd_etc_t;$/;" t
55
dbusd_exec_t input.te /^type dbusd_exec_t;$/;" t
6-
system_dbusd_exec_t input.te /^typealias dbusd_exec_t alias system_dbusd_exec_t;$/;" a
6+
system_dbusd_exec_t input.te /^typealias dbusd_exec_t alias system_dbusd_exec_t;$/;" a typeref:type:dbusd_exec_t
77
session_dbusd_tmp_t input.te /^type session_dbusd_tmp_t;$/;" t
8-
user_dbusd_tmp_t input.te /^typealias session_dbusd_tmp_t alias { user_dbusd_tmp_t staff_dbusd_tmp_t sysadm_dbusd_tmp_t };$/;" a
9-
staff_dbusd_tmp_t input.te /^typealias session_dbusd_tmp_t alias { user_dbusd_tmp_t staff_dbusd_tmp_t sysadm_dbusd_tmp_t };$/;" a
10-
sysadm_dbusd_tmp_t input.te /^typealias session_dbusd_tmp_t alias { user_dbusd_tmp_t staff_dbusd_tmp_t sysadm_dbusd_tmp_t };$/;" a
11-
auditadm_dbusd_tmp_t input.te /^typealias session_dbusd_tmp_t alias { auditadm_dbusd_tmp_t secadm_dbusd_tmp_t };$/;" a
12-
secadm_dbusd_tmp_t input.te /^typealias session_dbusd_tmp_t alias { auditadm_dbusd_tmp_t secadm_dbusd_tmp_t };$/;" a
8+
user_dbusd_tmp_t input.te /^typealias session_dbusd_tmp_t alias { user_dbusd_tmp_t staff_dbusd_tmp_t sysadm_dbusd_tmp_t };$/;" a typeref:type:session_dbusd_tmp_t
9+
staff_dbusd_tmp_t input.te /^typealias session_dbusd_tmp_t alias { user_dbusd_tmp_t staff_dbusd_tmp_t sysadm_dbusd_tmp_t };$/;" a typeref:type:session_dbusd_tmp_t
10+
sysadm_dbusd_tmp_t input.te /^typealias session_dbusd_tmp_t alias { user_dbusd_tmp_t staff_dbusd_tmp_t sysadm_dbusd_tmp_t };$/;" a typeref:type:session_dbusd_tmp_t
11+
auditadm_dbusd_tmp_t input.te /^typealias session_dbusd_tmp_t alias { auditadm_dbusd_tmp_t secadm_dbusd_tmp_t };$/;" a typeref:type:session_dbusd_tmp_t
12+
secadm_dbusd_tmp_t input.te /^typealias session_dbusd_tmp_t alias { auditadm_dbusd_tmp_t secadm_dbusd_tmp_t };$/;" a typeref:type:session_dbusd_tmp_t
1313
system_r input.te /^role system_r types system_bus_type;$/;" r
1414
git_sys_content_t input.te /^type git_sys_content_t alias git_system_content_t;$/;" t
15-
git_system_content_t input.te /^type git_sys_content_t alias git_system_content_t;$/;" a
15+
git_system_content_t input.te /^type git_sys_content_t alias git_system_content_t;$/;" a typeref:type:git_sys_content_t
1616
kmod_t input.te /^type kmod_t alias { update_modules_t depmod_t insmod_t };$/;" t
17-
update_modules_t input.te /^type kmod_t alias { update_modules_t depmod_t insmod_t };$/;" a
18-
depmod_t input.te /^type kmod_t alias { update_modules_t depmod_t insmod_t };$/;" a
19-
insmod_t input.te /^type kmod_t alias { update_modules_t depmod_t insmod_t };$/;" a
17+
update_modules_t input.te /^type kmod_t alias { update_modules_t depmod_t insmod_t };$/;" a typeref:type:kmod_t
18+
depmod_t input.te /^type kmod_t alias { update_modules_t depmod_t insmod_t };$/;" a typeref:type:kmod_t
19+
insmod_t input.te /^type kmod_t alias { update_modules_t depmod_t insmod_t };$/;" a typeref:type:kmod_t
2020
system_r input.te /^role system_r types anaconda_t;$/;" r
2121
install_roles input.te /^attribute_role install_roles;$/;" R
2222
antivirus_can_scan_system input.te /^gen_tunable(antivirus_can_scan_system, false)$/;" b

‎optlib/selinux-type-enforcement.c

Lines changed: 25 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -37,10 +37,16 @@ static void initializeSELinuxTypeEnforcementParser (const langType language)
3737
"\\1", "m", "", NULL);
3838
addLanguageTagMultiTableRegex (language, "main",
3939
"^type[[:blank:]]+([a-zA-Z0-9_]+)[[:blank:]]*",
40-
"\\1", "t", "{tenter=typedef}", NULL);
40+
"\\1", "t", "{tenter=typedef}"
41+
"{{\n"
42+
" .\n"
43+
"}}", NULL);
4144
addLanguageTagMultiTableRegex (language, "main",
4245
"^typealias[[:blank:]]+([a-zA-Z0-9_]+)[[:blank:]]*",
43-
"", "", "{tenter=typedef}", NULL);
46+
"\\1", "t", "{_role=aliased}{tenter=typedef}"
47+
"{{\n"
48+
" .\n"
49+
"}}", NULL);
4450
addLanguageTagMultiTableRegex (language, "main",
4551
"^attribute[[:blank:]]+([a-zA-Z0-9_]+)[[:blank:]]*[^;]*;",
4652
"\\1", "T", "", NULL);
@@ -73,7 +79,10 @@ static void initializeSELinuxTypeEnforcementParser (const langType language)
7379
"", "", "{tenter=alias}", NULL);
7480
addLanguageTagMultiTableRegex (language, "typedef",
7581
"^;",
76-
"", "", "{tleave}", NULL);
82+
"", "", "{tleave}"
83+
"{{\n"
84+
" pop\n"
85+
"}}", NULL);
7786
addLanguageTagMultiTableRegex (language, "typedef",
7887
"^.",
7988
"", "", "", NULL);
@@ -82,7 +91,10 @@ static void initializeSELinuxTypeEnforcementParser (const langType language)
8291
"", "", "", NULL);
8392
addLanguageTagMultiTableRegex (language, "alias",
8493
"^([a-zA-Z0-9_]+)[[:space:]]*",
85-
"\\1", "a", "{tleave}", NULL);
94+
"\\1", "a", "{tleave}"
95+
"{{\n"
96+
" dup :name . exch [ (type) 3 -1 roll ] typeref:\n"
97+
"}}", NULL);
8698
addLanguageTagMultiTableRegex (language, "alias",
8799
"^\\{[[:space:]]*",
88100
"", "", "{tenter=compoundalias}", NULL);
@@ -97,7 +109,10 @@ static void initializeSELinuxTypeEnforcementParser (const langType language)
97109
"", "", "", NULL);
98110
addLanguageTagMultiTableRegex (language, "compoundalias",
99111
"^([a-zA-Z0-9_]+)[[:space:]]*",
100-
"\\1", "a", "", NULL);
112+
"\\1", "a", ""
113+
"{{\n"
114+
" dup :name . exch [ (type) 3 -1 roll ] typeref:\n"
115+
"}}", NULL);
101116
addLanguageTagMultiTableRegex (language, "compoundalias",
102117
"^\\}[[:space:]]*",
103118
"", "", "{tleave}{_advanceTo=0start}", NULL);
@@ -133,12 +148,16 @@ extern parserDefinition* SELinuxTypeEnforcementParser (void)
133148
NULL
134149
};
135150

151+
static roleDefinition SELinuxTypeEnforcementTypeRoleTable [] = {
152+
{ true, "aliased", "aliased" },
153+
};
136154
static kindDefinition SELinuxTypeEnforcementKindTable [] = {
137155
{
138156
true, 'm', "module", "policy modules",
139157
},
140158
{
141159
true, 't', "type", "types",
160+
ATTACH_ROLES(SELinuxTypeEnforcementTypeRoleTable),
142161
},
143162
{
144163
true, 'a', "alias", "type aliases",
@@ -169,6 +188,7 @@ extern parserDefinition* SELinuxTypeEnforcementParser (void)
169188
def->patterns = patterns;
170189
def->aliases = aliases;
171190
def->method = METHOD_NOT_CRAFTED|METHOD_REGEX;
191+
def->useCork = CORK_QUEUE;
172192
def->kindTable = SELinuxTypeEnforcementKindTable;
173193
def->kindCount = ARRAY_SIZE(SELinuxTypeEnforcementKindTable);
174194
def->initialize = initializeSELinuxTypeEnforcementParser;

‎optlib/selinux-type-enforcement.ctags

Lines changed: 17 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,8 @@
2222
--kinddef-SELinuxTypeEnforcement=u,user,users
2323
# TODO: sensitivity, category, sid, class
2424

25+
--_roledef-SELinuxTypeEnforcement.{type}=aliased,aliased
26+
2527
--_tabledef-SELinuxTypeEnforcement=main
2628
--_tabledef-SELinuxTypeEnforcement=typedef
2729
--_tabledef-SELinuxTypeEnforcement=alias
@@ -39,8 +41,12 @@
3941
--_mtable-regex-SELinuxTypeEnforcement=main/policy_module\([[:blank:]]*([^,[:space:]\)]+)[^\)]*\)/\1/m/
4042
--_mtable-regex-SELinuxTypeEnforcement=main/module[[:blank:]]+([a-zA-Z0-9_]+)[[:blank:]]*[^;]*;/\1/m/
4143

42-
--_mtable-regex-SELinuxTypeEnforcement=main/type[[:blank:]]+([a-zA-Z0-9_]+)[[:blank:]]*/\1/t/{tenter=typedef}
43-
--_mtable-regex-SELinuxTypeEnforcement=main/typealias[[:blank:]]+([a-zA-Z0-9_]+)[[:blank:]]*//{tenter=typedef}
44+
--_mtable-regex-SELinuxTypeEnforcement=main/type[[:blank:]]+([a-zA-Z0-9_]+)[[:blank:]]*/\1/t/{tenter=typedef}{{
45+
.
46+
}}
47+
--_mtable-regex-SELinuxTypeEnforcement=main/typealias[[:blank:]]+([a-zA-Z0-9_]+)[[:blank:]]*/\1/t/{_role=aliased}{tenter=typedef}{{
48+
.
49+
}}
4450
--_mtable-regex-SELinuxTypeEnforcement=main/attribute[[:blank:]]+([a-zA-Z0-9_]+)[[:blank:]]*[^;]*;/\1/T/
4551

4652
--_mtable-regex-SELinuxTypeEnforcement=main/role[[:blank:]]+([a-zA-Z0-9_]+)[[:blank:]]*[^;]*;/\1/r/
@@ -59,14 +65,18 @@
5965
#
6066
--_mtable-regex-SELinuxTypeEnforcement=typedef/[[:space:]]+//
6167
--_mtable-regex-SELinuxTypeEnforcement=typedef/alias[[:space:]]+//{tenter=alias}
62-
--_mtable-regex-SELinuxTypeEnforcement=typedef/;//{tleave}
68+
--_mtable-regex-SELinuxTypeEnforcement=typedef/;//{tleave}{{
69+
pop
70+
}}
6371
--_mtable-regex-SELinuxTypeEnforcement=typedef/.//
6472

6573
#
6674
# alias
6775
#
6876
--_mtable-regex-SELinuxTypeEnforcement=alias/[[:space:]]+//
69-
--_mtable-regex-SELinuxTypeEnforcement=alias/([a-zA-Z0-9_]+)[[:space:]]*/\1/a/{tleave}
77+
--_mtable-regex-SELinuxTypeEnforcement=alias/([a-zA-Z0-9_]+)[[:space:]]*/\1/a/{tleave}{{
78+
dup :name . exch [ (type) 3 -1 roll ] typeref:
79+
}}
7080
--_mtable-regex-SELinuxTypeEnforcement=alias/\{[[:space:]]*//{tenter=compoundalias}
7181
--_mtable-regex-SELinuxTypeEnforcement=alias/\}[[:space:]]*//{tleave}
7282
--_mtable-regex-SELinuxTypeEnforcement=alias/.//
@@ -75,7 +85,9 @@
7585
# compoundalias
7686
#
7787
--_mtable-regex-SELinuxTypeEnforcement=compoundalias/[[:space:]]+//
78-
--_mtable-regex-SELinuxTypeEnforcement=compoundalias/([a-zA-Z0-9_]+)[[:space:]]*/\1/a/
88+
--_mtable-regex-SELinuxTypeEnforcement=compoundalias/([a-zA-Z0-9_]+)[[:space:]]*/\1/a/{{
89+
dup :name . exch [ (type) 3 -1 roll ] typeref:
90+
}}
7991
--_mtable-regex-SELinuxTypeEnforcement=compoundalias/\}[[:space:]]*//{tleave}{_advanceTo=0start}
8092
--_mtable-regex-SELinuxTypeEnforcement=compoundalias/.//
8193

0 commit comments

Comments
 (0)