|
|
102b87e |
diff --git a/checkpolicy/checkmodule.8 b/checkpolicy/checkmodule.8
|
|
|
102b87e |
index 473f642..40f73c5 100644
|
|
|
102b87e |
--- a/checkpolicy/checkmodule.8
|
|
|
102b87e |
+++ b/checkpolicy/checkmodule.8
|
|
|
102b87e |
@@ -53,7 +53,7 @@ $ checkmodule -M -m httpd.te -o httpd.mod
|
|
|
102b87e |
|
|
|
102b87e |
.SH "SEE ALSO"
|
|
|
102b87e |
.B semodule(8), semodule_package(8)
|
|
|
102b87e |
-SELinux documentation at http://www.nsa.gov/selinux,
|
|
|
102b87e |
+SELinux documentation at http://www.nsa.gov/research/selinux,
|
|
|
102b87e |
especially "Configuring the SELinux Policy".
|
|
|
102b87e |
|
|
|
102b87e |
|
|
|
102b87e |
diff --git a/checkpolicy/checkpolicy.8 b/checkpolicy/checkpolicy.8
|
|
|
102b87e |
index f79239e..6826938 100644
|
|
|
102b87e |
--- a/checkpolicy/checkpolicy.8
|
|
|
102b87e |
+++ b/checkpolicy/checkpolicy.8
|
|
|
102b87e |
@@ -46,7 +46,7 @@ Show version information.
|
|
|
102b87e |
Show usage information.
|
|
|
102b87e |
|
|
|
102b87e |
.SH "SEE ALSO"
|
|
|
102b87e |
-SELinux documentation at http://www.nsa.gov/selinux,
|
|
|
102b87e |
+SELinux documentation at http://www.nsa.gov/research/selinux,
|
|
|
102b87e |
especially "Configuring the SELinux Policy".
|
|
|
102b87e |
|
|
|
102b87e |
|
|
|
5ea3e82 |
diff --git a/checkpolicy/policy_define.c b/checkpolicy/policy_define.c
|
|
|
ab9a334 |
index d19fc61..a86c6b3 100644
|
|
|
5ea3e82 |
--- a/checkpolicy/policy_define.c
|
|
|
5ea3e82 |
+++ b/checkpolicy/policy_define.c
|
|
|
ab9a334 |
@@ -351,6 +351,102 @@ static int read_classes(ebitmap_t *e_classes)
|
|
|
ab9a334 |
return 0;
|
|
|
1e7f3c9 |
}
|
|
|
1e7f3c9 |
|
|
|
5ea3e82 |
+int define_default_user(int which)
|
|
|
5ea3e82 |
+{
|
|
|
5ea3e82 |
+ char *id;
|
|
|
5ea3e82 |
+ class_datum_t *cladatum;
|
|
|
5ea3e82 |
+
|
|
|
5ea3e82 |
+ if (pass == 1) {
|
|
|
5ea3e82 |
+ while ((id = queue_remove(id_queue)))
|
|
|
5ea3e82 |
+ free(id);
|
|
|
5ea3e82 |
+ return 0;
|
|
|
5ea3e82 |
+ }
|
|
|
5ea3e82 |
+
|
|
|
5ea3e82 |
+ while ((id = queue_remove(id_queue))) {
|
|
|
5ea3e82 |
+ if (!is_id_in_scope(SYM_CLASSES, id)) {
|
|
|
5ea3e82 |
+ yyerror2("class %s is not within scope", id);
|
|
|
5ea3e82 |
+ return -1;
|
|
|
5ea3e82 |
+ }
|
|
|
5ea3e82 |
+ cladatum = hashtab_search(policydbp->p_classes.table, id);
|
|
|
5ea3e82 |
+ if (!cladatum) {
|
|
|
5ea3e82 |
+ yyerror2("unknown class %s", id);
|
|
|
5ea3e82 |
+ return -1;
|
|
|
5ea3e82 |
+ }
|
|
|
5ea3e82 |
+ if (cladatum->default_user && cladatum->default_user != which) {
|
|
|
5ea3e82 |
+ yyerror2("conflicting default user information for class %s", id);
|
|
|
5ea3e82 |
+ return -1;
|
|
|
5ea3e82 |
+ }
|
|
|
5ea3e82 |
+ cladatum->default_user = which;
|
|
|
5ea3e82 |
+ free(id);
|
|
|
5ea3e82 |
+ }
|
|
|
5ea3e82 |
+
|
|
|
5ea3e82 |
+ return 0;
|
|
|
5ea3e82 |
+}
|
|
|
5ea3e82 |
+
|
|
|
5ea3e82 |
+int define_default_role(int which)
|
|
|
5ea3e82 |
+{
|
|
|
5ea3e82 |
+ char *id;
|
|
|
5ea3e82 |
+ class_datum_t *cladatum;
|
|
|
5ea3e82 |
+
|
|
|
5ea3e82 |
+ if (pass == 1) {
|
|
|
5ea3e82 |
+ while ((id = queue_remove(id_queue)))
|
|
|
5ea3e82 |
+ free(id);
|
|
|
5ea3e82 |
+ return 0;
|
|
|
5ea3e82 |
+ }
|
|
|
5ea3e82 |
+
|
|
|
5ea3e82 |
+ while ((id = queue_remove(id_queue))) {
|
|
|
5ea3e82 |
+ if (!is_id_in_scope(SYM_CLASSES, id)) {
|
|
|
5ea3e82 |
+ yyerror2("class %s is not within scope", id);
|
|
|
5ea3e82 |
+ return -1;
|
|
|
5ea3e82 |
+ }
|
|
|
5ea3e82 |
+ cladatum = hashtab_search(policydbp->p_classes.table, id);
|
|
|
5ea3e82 |
+ if (!cladatum) {
|
|
|
5ea3e82 |
+ yyerror2("unknown class %s", id);
|
|
|
5ea3e82 |
+ return -1;
|
|
|
5ea3e82 |
+ }
|
|
|
5ea3e82 |
+ if (cladatum->default_role && cladatum->default_role != which) {
|
|
|
5ea3e82 |
+ yyerror2("conflicting default role information for class %s", id);
|
|
|
5ea3e82 |
+ return -1;
|
|
|
5ea3e82 |
+ }
|
|
|
5ea3e82 |
+ cladatum->default_role = which;
|
|
|
5ea3e82 |
+ free(id);
|
|
|
5ea3e82 |
+ }
|
|
|
5ea3e82 |
+
|
|
|
5ea3e82 |
+ return 0;
|
|
|
5ea3e82 |
+}
|
|
|
5ea3e82 |
+
|
|
|
5ea3e82 |
+int define_default_range(int which)
|
|
|
5ea3e82 |
+{
|
|
|
5ea3e82 |
+ char *id;
|
|
|
5ea3e82 |
+ class_datum_t *cladatum;
|
|
|
5ea3e82 |
+
|
|
|
5ea3e82 |
+ if (pass == 1) {
|
|
|
5ea3e82 |
+ while ((id = queue_remove(id_queue)))
|
|
|
5ea3e82 |
+ free(id);
|
|
|
5ea3e82 |
+ return 0;
|
|
|
5ea3e82 |
+ }
|
|
|
5ea3e82 |
+
|
|
|
5ea3e82 |
+ while ((id = queue_remove(id_queue))) {
|
|
|
5ea3e82 |
+ if (!is_id_in_scope(SYM_CLASSES, id)) {
|
|
|
5ea3e82 |
+ yyerror2("class %s is not within scope", id);
|
|
|
5ea3e82 |
+ return -1;
|
|
|
5ea3e82 |
+ }
|
|
|
5ea3e82 |
+ cladatum = hashtab_search(policydbp->p_classes.table, id);
|
|
|
5ea3e82 |
+ if (!cladatum) {
|
|
|
5ea3e82 |
+ yyerror2("unknown class %s", id);
|
|
|
5ea3e82 |
+ return -1;
|
|
|
5ea3e82 |
+ }
|
|
|
5ea3e82 |
+ if (cladatum->default_range && cladatum->default_range != which) {
|
|
|
5ea3e82 |
+ yyerror2("conflicting default range information for class %s", id);
|
|
|
5ea3e82 |
+ return -1;
|
|
|
5ea3e82 |
+ }
|
|
|
5ea3e82 |
+ cladatum->default_range = which;
|
|
|
5ea3e82 |
+ free(id);
|
|
|
5ea3e82 |
+ }
|
|
|
5ea3e82 |
+
|
|
|
5ea3e82 |
+ return 0;
|
|
|
5ea3e82 |
+}
|
|
|
5ea3e82 |
+
|
|
|
5ea3e82 |
int define_common_perms(void)
|
|
|
1e7f3c9 |
{
|
|
|
5ea3e82 |
char *id = 0, *perm = 0;
|
|
|
5ea3e82 |
diff --git a/checkpolicy/policy_define.h b/checkpolicy/policy_define.h
|
|
|
5ea3e82 |
index 92a9be7..ccbe56f 100644
|
|
|
5ea3e82 |
--- a/checkpolicy/policy_define.h
|
|
|
5ea3e82 |
+++ b/checkpolicy/policy_define.h
|
|
|
5ea3e82 |
@@ -24,6 +24,9 @@ int define_av_perms(int inherits);
|
|
|
5ea3e82 |
int define_bool_tunable(int is_tunable);
|
|
|
5ea3e82 |
int define_category(void);
|
|
|
5ea3e82 |
int define_class(void);
|
|
|
5ea3e82 |
+int define_default_user(int which);
|
|
|
5ea3e82 |
+int define_default_role(int which);
|
|
|
5ea3e82 |
+int define_default_range(int which);
|
|
|
5ea3e82 |
int define_common_perms(void);
|
|
|
5ea3e82 |
int define_compute_type(int which);
|
|
|
5ea3e82 |
int define_conditional(cond_expr_t *expr, avrule_t *t_list, avrule_t *f_list );
|
|
|
5ea3e82 |
diff --git a/checkpolicy/policy_parse.y b/checkpolicy/policy_parse.y
|
|
|
228c1db |
index d808111..d92cc32 100644
|
|
|
5ea3e82 |
--- a/checkpolicy/policy_parse.y
|
|
|
5ea3e82 |
+++ b/checkpolicy/policy_parse.y
|
|
|
5ea3e82 |
@@ -143,6 +143,8 @@ typedef int (* require_func_t)();
|
|
|
5ea3e82 |
%token POLICYCAP
|
|
|
5ea3e82 |
%token PERMISSIVE
|
|
|
5ea3e82 |
%token FILESYSTEM
|
|
|
5ea3e82 |
+%token DEFAULT_USER DEFAULT_ROLE DEFAULT_RANGE
|
|
|
5ea3e82 |
+%token LOW_HIGH LOW HIGH
|
|
|
1e7f3c9 |
|
|
|
5ea3e82 |
%left OR
|
|
|
5ea3e82 |
%left XOR
|
|
|
5ea3e82 |
@@ -157,7 +159,7 @@ base_policy : { if (define_policy(pass, 0) == -1) return -1; }
|
|
|
5ea3e82 |
classes initial_sids access_vectors
|
|
|
5ea3e82 |
{ if (pass == 1) { if (policydb_index_classes(policydbp)) return -1; }
|
|
|
5ea3e82 |
else if (pass == 2) { if (policydb_index_others(NULL, policydbp, 0)) return -1; }}
|
|
|
5ea3e82 |
- opt_mls te_rbac users opt_constraints
|
|
|
228c1db |
+ opt_default_rules opt_mls te_rbac users opt_constraints
|
|
|
5ea3e82 |
{ if (pass == 1) { if (policydb_index_bools(policydbp)) return -1;}
|
|
|
5ea3e82 |
else if (pass == 2) { if (policydb_index_others(NULL, policydbp, 0)) return -1;}}
|
|
|
5ea3e82 |
initial_sid_contexts opt_fs_contexts opt_fs_uses opt_genfs_contexts net_contexts opt_dev_contexts
|
|
|
228c1db |
@@ -195,6 +197,39 @@ av_perms_def : CLASS identifier '{' identifier_list '}'
|
|
|
5ea3e82 |
| CLASS identifier INHERITS identifier '{' identifier_list '}'
|
|
|
5ea3e82 |
{if (define_av_perms(TRUE)) return -1;}
|
|
|
5ea3e82 |
;
|
|
|
228c1db |
+opt_default_rules : default_rules
|
|
|
228c1db |
+ |
|
|
|
228c1db |
+ ;
|
|
|
5ea3e82 |
+default_rules : default_user_def
|
|
|
5ea3e82 |
+ | default_role_def
|
|
|
5ea3e82 |
+ | default_range_def
|
|
|
5ea3e82 |
+ | default_rules default_user_def
|
|
|
5ea3e82 |
+ | default_rules default_role_def
|
|
|
5ea3e82 |
+ | default_rules default_range_def
|
|
|
5ea3e82 |
+ ;
|
|
|
5ea3e82 |
+default_user_def : DEFAULT_USER names SOURCE ';'
|
|
|
5ea3e82 |
+ {if (define_default_user(DEFAULT_SOURCE)) return -1; }
|
|
|
5ea3e82 |
+ | DEFAULT_USER names TARGET ';'
|
|
|
5ea3e82 |
+ {if (define_default_user(DEFAULT_TARGET)) return -1; }
|
|
|
5ea3e82 |
+ ;
|
|
|
5ea3e82 |
+default_role_def : DEFAULT_ROLE names SOURCE ';'
|
|
|
5ea3e82 |
+ {if (define_default_role(DEFAULT_SOURCE)) return -1; }
|
|
|
5ea3e82 |
+ | DEFAULT_ROLE names TARGET ';'
|
|
|
5ea3e82 |
+ {if (define_default_role(DEFAULT_TARGET)) return -1; }
|
|
|
5ea3e82 |
+ ;
|
|
|
5ea3e82 |
+default_range_def : DEFAULT_RANGE names SOURCE LOW ';'
|
|
|
5ea3e82 |
+ {if (define_default_range(DEFAULT_SOURCE_LOW)) return -1; }
|
|
|
5ea3e82 |
+ | DEFAULT_RANGE names SOURCE HIGH ';'
|
|
|
5ea3e82 |
+ {if (define_default_range(DEFAULT_SOURCE_HIGH)) return -1; }
|
|
|
5ea3e82 |
+ | DEFAULT_RANGE names SOURCE LOW_HIGH ';'
|
|
|
5ea3e82 |
+ {if (define_default_range(DEFAULT_SOURCE_LOW_HIGH)) return -1; }
|
|
|
5ea3e82 |
+ | DEFAULT_RANGE names TARGET LOW ';'
|
|
|
5ea3e82 |
+ {if (define_default_range(DEFAULT_TARGET_LOW)) return -1; }
|
|
|
5ea3e82 |
+ | DEFAULT_RANGE names TARGET HIGH ';'
|
|
|
5ea3e82 |
+ {if (define_default_range(DEFAULT_TARGET_HIGH)) return -1; }
|
|
|
5ea3e82 |
+ | DEFAULT_RANGE names TARGET LOW_HIGH ';'
|
|
|
5ea3e82 |
+ {if (define_default_range(DEFAULT_TARGET_LOW_HIGH)) return -1; }
|
|
|
5ea3e82 |
+ ;
|
|
|
5ea3e82 |
opt_mls : mls
|
|
|
5ea3e82 |
|
|
|
|
5ea3e82 |
;
|
|
|
5ea3e82 |
diff --git a/checkpolicy/policy_scan.l b/checkpolicy/policy_scan.l
|
|
|
5ea3e82 |
index 9b24db5..e767b5f 100644
|
|
|
5ea3e82 |
--- a/checkpolicy/policy_scan.l
|
|
|
5ea3e82 |
+++ b/checkpolicy/policy_scan.l
|
|
|
5ea3e82 |
@@ -221,6 +221,18 @@ policycap |
|
|
|
5ea3e82 |
POLICYCAP { return(POLICYCAP); }
|
|
|
5ea3e82 |
permissive |
|
|
|
5ea3e82 |
PERMISSIVE { return(PERMISSIVE); }
|
|
|
5ea3e82 |
+default_user |
|
|
|
5ea3e82 |
+DEFAULT_USER { return(DEFAULT_USER); }
|
|
|
5ea3e82 |
+default_role |
|
|
|
5ea3e82 |
+DEFAULT_ROLE { return(DEFAULT_ROLE); }
|
|
|
5ea3e82 |
+default_range |
|
|
|
5ea3e82 |
+DEFAULT_RANGE { return(DEFAULT_RANGE); }
|
|
|
5ea3e82 |
+low-high |
|
|
|
5ea3e82 |
+LOW-HIGH { return(LOW_HIGH); }
|
|
|
5ea3e82 |
+high |
|
|
|
5ea3e82 |
+HIGH { return(HIGH); }
|
|
|
5ea3e82 |
+low |
|
|
|
5ea3e82 |
+LOW { return(LOW); }
|
|
|
5ea3e82 |
"/"({alnum}|[_\.\-/])* { return(PATH); }
|
|
|
5ea3e82 |
\"({alnum}|[_\.\-\~])+\" { return(FILENAME); }
|
|
|
5ea3e82 |
{letter}({alnum}|[_\-])*([\.]?({alnum}|[_\-]))* { return(IDENTIFIER); }
|