|
 |
02871fc |
diff --git libsepol-2.7/cil/include/cil/cil.h libsepol-2.7/cil/include/cil/cil.h
|
|
|
02871fc |
index 86117f2..f8cfc3b 100644
|
|
|
02871fc |
--- libsepol-2.7/cil/include/cil/cil.h
|
|
|
02871fc |
+++ libsepol-2.7/cil/include/cil/cil.h
|
|
|
02871fc |
@@ -50,6 +50,7 @@ extern int cil_userprefixes_to_string(cil_db_t *db, char **out, size_t *size);
|
|
|
02871fc |
extern int cil_selinuxusers_to_string(cil_db_t *db, char **out, size_t *size);
|
|
|
02871fc |
extern int cil_filecons_to_string(cil_db_t *db, char **out, size_t *size);
|
|
|
02871fc |
extern void cil_set_disable_dontaudit(cil_db_t *db, int disable_dontaudit);
|
|
|
02871fc |
+extern void cil_set_multiple_decls(cil_db_t *db, int multiple_decls);
|
|
|
02871fc |
extern void cil_set_disable_neverallow(cil_db_t *db, int disable_neverallow);
|
|
|
02871fc |
extern void cil_set_preserve_tunables(cil_db_t *db, int preserve_tunables);
|
|
|
02871fc |
extern int cil_set_handle_unknown(cil_db_t *db, int handle_unknown);
|
|
|
02871fc |
diff --git libsepol-2.7/cil/src/cil.c libsepol-2.7/cil/src/cil.c
|
|
|
02871fc |
index c02a41a..3fe68af 100644
|
|
|
02871fc |
--- libsepol-2.7/cil/src/cil.c
|
|
|
02871fc |
+++ libsepol-2.7/cil/src/cil.c
|
|
|
02871fc |
@@ -1691,6 +1691,11 @@ void cil_set_mls(struct cil_db *db, int mls)
|
|
|
02871fc |
db->mls = mls;
|
|
|
02871fc |
}
|
|
|
02871fc |
|
|
|
02871fc |
+void cil_set_multiple_decls(struct cil_db *db, int multiple_decls)
|
|
|
02871fc |
+{
|
|
|
02871fc |
+ db->multiple_decls = multiple_decls;
|
|
|
02871fc |
+}
|
|
|
02871fc |
+
|
|
|
02871fc |
void cil_set_target_platform(struct cil_db *db, int target_platform)
|
|
|
02871fc |
{
|
|
|
02871fc |
db->target_platform = target_platform;
|
|
|
02871fc |
diff --git libsepol-2.7/cil/src/cil_build_ast.c libsepol-2.7/cil/src/cil_build_ast.c
|
|
|
02871fc |
index 04492e5..e84336b 100644
|
|
|
02871fc |
--- libsepol-2.7/cil/src/cil_build_ast.c
|
|
|
02871fc |
+++ libsepol-2.7/cil/src/cil_build_ast.c
|
|
|
02871fc |
@@ -82,10 +82,33 @@ exit:
|
|
|
02871fc |
return rc;
|
|
|
02871fc |
}
|
|
|
02871fc |
|
|
|
02871fc |
-int cil_gen_node(__attribute__((unused)) struct cil_db *db, struct cil_tree_node *ast_node, struct cil_symtab_datum *datum, hashtab_key_t key, enum cil_sym_index sflavor, enum cil_flavor nflavor)
|
|
|
02871fc |
+/*
|
|
|
02871fc |
+ * Determine whether or not multiple declarations of the same key can share a
|
|
|
02871fc |
+ * datum, given the new datum and the one already present in a given symtab.
|
|
|
02871fc |
+ */
|
|
|
02871fc |
+int cil_is_datum_multiple_decl(__attribute__((unused)) struct cil_symtab_datum *cur,
|
|
|
02871fc |
+ __attribute__((unused)) struct cil_symtab_datum *old,
|
|
|
02871fc |
+ enum cil_flavor f)
|
|
|
02871fc |
+{
|
|
|
02871fc |
+ int rc = CIL_FALSE;
|
|
|
02871fc |
+
|
|
|
02871fc |
+ switch (f) {
|
|
|
02871fc |
+ case CIL_TYPE:
|
|
|
02871fc |
+ case CIL_TYPEATTRIBUTE:
|
|
|
02871fc |
+ /* type and typeattribute statements insert empty datums, ret true */
|
|
|
02871fc |
+ rc = CIL_TRUE;
|
|
|
02871fc |
+ break;
|
|
|
02871fc |
+ default:
|
|
|
02871fc |
+ break;
|
|
|
02871fc |
+ }
|
|
|
02871fc |
+ return rc;
|
|
|
02871fc |
+}
|
|
|
02871fc |
+
|
|
|
02871fc |
+int cil_gen_node(struct cil_db *db, struct cil_tree_node *ast_node, struct cil_symtab_datum *datum, hashtab_key_t key, enum cil_sym_index sflavor, enum cil_flavor nflavor)
|
|
|
02871fc |
{
|
|
|
02871fc |
int rc = SEPOL_ERR;
|
|
|
02871fc |
symtab_t *symtab = NULL;
|
|
|
02871fc |
+ struct cil_symtab_datum *prev;
|
|
|
02871fc |
|
|
|
02871fc |
rc = __cil_verify_name((const char*)key);
|
|
|
02871fc |
if (rc != SEPOL_OK) {
|
|
|
02871fc |
@@ -103,15 +126,26 @@ int cil_gen_node(__attribute__((unused)) struct cil_db *db, struct cil_tree_node
|
|
|
02871fc |
if (symtab != NULL) {
|
|
|
02871fc |
rc = cil_symtab_insert(symtab, (hashtab_key_t)key, datum, ast_node);
|
|
|
02871fc |
if (rc == SEPOL_EEXIST) {
|
|
|
02871fc |
- cil_log(CIL_ERR, "Re-declaration of %s %s\n",
|
|
|
02871fc |
- cil_node_to_string(ast_node), key);
|
|
|
02871fc |
- if (cil_symtab_get_datum(symtab, key, &datum) == SEPOL_OK) {
|
|
|
02871fc |
- if (sflavor == CIL_SYM_BLOCKS) {
|
|
|
02871fc |
- struct cil_tree_node *node = datum->nodes->head->data;
|
|
|
02871fc |
- cil_tree_log(node, CIL_ERR, "Previous declaration");
|
|
|
02871fc |
+ if (!db->multiple_decls ||
|
|
|
02871fc |
+ cil_symtab_get_datum(symtab, (hashtab_key_t)key, &prev) != SEPOL_OK ||
|
|
|
02871fc |
+ !cil_is_datum_multiple_decl(datum, prev, nflavor)) {
|
|
|
02871fc |
+
|
|
|
02871fc |
+ /* multiple_decls not ok, ret error */
|
|
|
02871fc |
+ cil_log(CIL_ERR, "Re-declaration of %s %s\n",
|
|
|
02871fc |
+ cil_node_to_string(ast_node), key);
|
|
|
02871fc |
+ if (cil_symtab_get_datum(symtab, key, &datum) == SEPOL_OK) {
|
|
|
02871fc |
+ if (sflavor == CIL_SYM_BLOCKS) {
|
|
|
02871fc |
+ struct cil_tree_node *node = datum->nodes->head->data;
|
|
|
02871fc |
+ cil_tree_log(node, CIL_ERR, "Previous declaration");
|
|
|
02871fc |
+ }
|
|
|
02871fc |
}
|
|
|
02871fc |
+ goto exit;
|
|
|
02871fc |
}
|
|
|
02871fc |
- goto exit;
|
|
|
02871fc |
+ /* multiple_decls is enabled and works for this datum type, add node */
|
|
|
02871fc |
+ cil_list_append(prev->nodes, CIL_NODE, ast_node);
|
|
|
02871fc |
+ ast_node->data = prev;
|
|
|
02871fc |
+ cil_symtab_datum_destroy(datum);
|
|
|
02871fc |
+ free(datum);
|
|
|
02871fc |
}
|
|
|
02871fc |
}
|
|
|
02871fc |
|
|
|
02871fc |
diff --git libsepol-2.7/cil/src/cil_internal.h libsepol-2.7/cil/src/cil_internal.h
|
|
|
02871fc |
index 6d6a7d9..136a004 100644
|
|
|
02871fc |
--- libsepol-2.7/cil/src/cil_internal.h
|
|
|
02871fc |
+++ libsepol-2.7/cil/src/cil_internal.h
|
|
|
02871fc |
@@ -316,6 +316,7 @@ struct cil_db {
|
|
|
02871fc |
int preserve_tunables;
|
|
|
02871fc |
int handle_unknown;
|
|
|
02871fc |
int mls;
|
|
|
02871fc |
+ int multiple_decls;
|
|
|
02871fc |
int target_platform;
|
|
|
02871fc |
int policy_version;
|
|
|
02871fc |
};
|
|
|
02871fc |
diff --git libsepol-2.7/cil/src/cil_policy.c libsepol-2.7/cil/src/cil_policy.c
|
|
|
02871fc |
index 729b6e0..6d4987c 100644
|
|
|
02871fc |
--- libsepol-2.7/cil/src/cil_policy.c
|
|
|
02871fc |
+++ libsepol-2.7/cil/src/cil_policy.c
|
|
|
02871fc |
@@ -775,7 +775,7 @@ static void cil_classes_to_policy(FILE *out, struct cil_list *classorder)
|
|
|
02871fc |
}
|
|
|
02871fc |
}
|
|
|
02871fc |
|
|
|
02871fc |
-static void cil_defaults_to_policy(FILE *out, struct cil_list *defaults, char *kind)
|
|
|
02871fc |
+static void cil_defaults_to_policy(FILE *out, struct cil_list *defaults, const char *kind)
|
|
|
02871fc |
{
|
|
|
02871fc |
struct cil_list_item *i1, *i2, *i3;
|
|
|
02871fc |
struct cil_default *def;
|
|
|
02871fc |
diff --git libsepol-2.7/cil/src/cil_post.c libsepol-2.7/cil/src/cil_post.c
|
|
|
02871fc |
index ad073e8..3e013c9 100644
|
|
|
02871fc |
--- libsepol-2.7/cil/src/cil_post.c
|
|
|
02871fc |
+++ libsepol-2.7/cil/src/cil_post.c
|
|
|
02871fc |
@@ -1297,6 +1297,55 @@ static int cil_typeattribute_used(struct cil_typeattribute *attr, struct cil_db
|
|
|
02871fc |
return CIL_TRUE;
|
|
|
02871fc |
}
|
|
|
02871fc |
|
|
|
02871fc |
+static void __mark_neverallow_attrs(struct cil_list *expr_list)
|
|
|
02871fc |
+{
|
|
|
02871fc |
+ struct cil_list_item *curr;
|
|
|
02871fc |
+
|
|
|
02871fc |
+ cil_list_for_each(curr, expr_list) {
|
|
|
02871fc |
+ if (curr->flavor == CIL_DATUM) {
|
|
|
02871fc |
+ if (NODE(curr->data)->flavor == CIL_TYPEATTRIBUTE) {
|
|
|
02871fc |
+ struct cil_typeattribute *attr = curr->data;
|
|
|
02871fc |
+ if (strstr(DATUM(attr)->name, TYPEATTR_INFIX)) {
|
|
|
02871fc |
+ __mark_neverallow_attrs(attr->expr_list);
|
|
|
02871fc |
+ } else {
|
|
|
02871fc |
+ attr->used |= CIL_ATTR_NEVERALLOW;
|
|
|
02871fc |
+ }
|
|
|
02871fc |
+ }
|
|
|
02871fc |
+ } else if (curr->flavor == CIL_LIST) {
|
|
|
02871fc |
+ __mark_neverallow_attrs(curr->data);
|
|
|
02871fc |
+ }
|
|
|
02871fc |
+ }
|
|
|
02871fc |
+}
|
|
|
02871fc |
+
|
|
|
02871fc |
+static int __cil_post_db_neverallow_attr_helper(struct cil_tree_node *node, uint32_t *finished, __attribute__((unused)) void *extra_args)
|
|
|
02871fc |
+{
|
|
|
02871fc |
+ switch (node->flavor) {
|
|
|
02871fc |
+ case CIL_BLOCK: {
|
|
|
02871fc |
+ struct cil_block *blk = node->data;
|
|
|
02871fc |
+ if (blk->is_abstract == CIL_TRUE) {
|
|
|
02871fc |
+ *finished = CIL_TREE_SKIP_HEAD;
|
|
|
02871fc |
+ }
|
|
|
02871fc |
+ break;
|
|
|
02871fc |
+ }
|
|
|
02871fc |
+ case CIL_MACRO: {
|
|
|
02871fc |
+ *finished = CIL_TREE_SKIP_HEAD;
|
|
|
02871fc |
+ break;
|
|
|
02871fc |
+ }
|
|
|
02871fc |
+ case CIL_TYPEATTRIBUTE: {
|
|
|
02871fc |
+ struct cil_typeattribute *attr = node->data;
|
|
|
02871fc |
+ if ((attr->used & CIL_ATTR_NEVERALLOW) &&
|
|
|
02871fc |
+ strstr(DATUM(attr)->name, TYPEATTR_INFIX)) {
|
|
|
02871fc |
+ __mark_neverallow_attrs(attr->expr_list);
|
|
|
02871fc |
+ }
|
|
|
02871fc |
+ break;
|
|
|
02871fc |
+ }
|
|
|
02871fc |
+ default:
|
|
|
02871fc |
+ break;
|
|
|
02871fc |
+ }
|
|
|
02871fc |
+
|
|
|
02871fc |
+ return SEPOL_OK;
|
|
|
02871fc |
+}
|
|
|
02871fc |
+
|
|
|
02871fc |
static int __cil_post_db_attr_helper(struct cil_tree_node *node, uint32_t *finished, void *extra_args)
|
|
|
02871fc |
{
|
|
|
02871fc |
int rc = SEPOL_ERR;
|
|
|
02871fc |
@@ -2031,6 +2080,12 @@ static int cil_post_db(struct cil_db *db)
|
|
|
02871fc |
goto exit;
|
|
|
02871fc |
}
|
|
|
02871fc |
|
|
|
02871fc |
+ rc = cil_tree_walk(db->ast->root, __cil_post_db_neverallow_attr_helper, NULL, NULL, db);
|
|
|
02871fc |
+ if (rc != SEPOL_OK) {
|
|
|
02871fc |
+ cil_log(CIL_INFO, "Failed to mark attributes used by generated attributes used in neverallow rules\n");
|
|
|
02871fc |
+ goto exit;
|
|
|
02871fc |
+ }
|
|
|
02871fc |
+
|
|
|
02871fc |
rc = cil_tree_walk(db->ast->root, __cil_post_db_attr_helper, NULL, NULL, db);
|
|
|
02871fc |
if (rc != SEPOL_OK) {
|
|
|
02871fc |
cil_log(CIL_INFO, "Failed to create attribute bitmaps\n");
|
|
|
02871fc |
diff --git libsepol-2.7/cil/src/cil_strpool.c libsepol-2.7/cil/src/cil_strpool.c
|
|
|
02871fc |
index b1396d2..97d4c4b 100644
|
|
|
02871fc |
--- libsepol-2.7/cil/src/cil_strpool.c
|
|
|
02871fc |
+++ libsepol-2.7/cil/src/cil_strpool.c
|
|
|
02871fc |
@@ -119,6 +119,7 @@ void cil_strpool_destroy(void)
|
|
|
02871fc |
if (cil_strpool_readers == 0) {
|
|
|
02871fc |
hashtab_map(cil_strpool_tab, cil_strpool_entry_destroy, NULL);
|
|
|
02871fc |
hashtab_destroy(cil_strpool_tab);
|
|
|
02871fc |
+ cil_strpool_tab = NULL;
|
|
|
02871fc |
}
|
|
|
02871fc |
pthread_mutex_unlock(&cil_strpool_mutex);
|
|
|
02871fc |
}
|
|
|
02871fc |
diff --git libsepol-2.7/include/sepol/policydb/avtab.h libsepol-2.7/include/sepol/policydb/avtab.h
|
|
|
02871fc |
index 958848e..10ecde9 100644
|
|
|
02871fc |
--- libsepol-2.7/include/sepol/policydb/avtab.h
|
|
|
02871fc |
+++ libsepol-2.7/include/sepol/policydb/avtab.h
|
|
|
02871fc |
@@ -1,5 +1,5 @@
|
|
|
02871fc |
|
|
|
02871fc |
-/* Author : Stephen Smalley, <sds@epoch.ncsc.mil> */
|
|
|
02871fc |
+/* Author : Stephen Smalley, <sds@tycho.nsa.gov> */
|
|
|
02871fc |
|
|
|
02871fc |
/*
|
|
|
02871fc |
* Updated: Yuichi Nakamura <ynakam@hitachisoft.jp>
|
|
|
02871fc |
diff --git libsepol-2.7/include/sepol/policydb/constraint.h libsepol-2.7/include/sepol/policydb/constraint.h
|
|
|
02871fc |
index 927bdc0..b91fc4e 100644
|
|
|
02871fc |
--- libsepol-2.7/include/sepol/policydb/constraint.h
|
|
|
02871fc |
+++ libsepol-2.7/include/sepol/policydb/constraint.h
|
|
|
02871fc |
@@ -1,4 +1,4 @@
|
|
|
02871fc |
-/* Author : Stephen Smalley, <sds@epoch.ncsc.mil> */
|
|
|
02871fc |
+/* Author : Stephen Smalley, <sds@tycho.nsa.gov> */
|
|
|
02871fc |
|
|
|
02871fc |
/* FLASK */
|
|
|
02871fc |
|
|
|
02871fc |
diff --git libsepol-2.7/include/sepol/policydb/context.h libsepol-2.7/include/sepol/policydb/context.h
|
|
|
02871fc |
index 2eaa686..c27c334 100644
|
|
|
02871fc |
--- libsepol-2.7/include/sepol/policydb/context.h
|
|
|
02871fc |
+++ libsepol-2.7/include/sepol/policydb/context.h
|
|
|
02871fc |
@@ -1,4 +1,4 @@
|
|
|
02871fc |
-/* Author : Stephen Smalley, <sds@epoch.ncsc.mil> */
|
|
|
02871fc |
+/* Author : Stephen Smalley, <sds@tycho.nsa.gov> */
|
|
|
02871fc |
|
|
|
02871fc |
/* FLASK */
|
|
|
02871fc |
|
|
|
02871fc |
diff --git libsepol-2.7/include/sepol/policydb/ebitmap.h libsepol-2.7/include/sepol/policydb/ebitmap.h
|
|
|
02871fc |
index e90371e..94fb7ef 100644
|
|
|
02871fc |
--- libsepol-2.7/include/sepol/policydb/ebitmap.h
|
|
|
02871fc |
+++ libsepol-2.7/include/sepol/policydb/ebitmap.h
|
|
|
02871fc |
@@ -1,4 +1,4 @@
|
|
|
02871fc |
-/* Author : Stephen Smalley, <sds@epoch.ncsc.mil> */
|
|
|
02871fc |
+/* Author : Stephen Smalley, <sds@tycho.nsa.gov> */
|
|
|
02871fc |
|
|
|
02871fc |
/* FLASK */
|
|
|
02871fc |
|
|
|
02871fc |
diff --git libsepol-2.7/include/sepol/policydb/flask_types.h libsepol-2.7/include/sepol/policydb/flask_types.h
|
|
|
02871fc |
index e01669c..714176f 100644
|
|
|
02871fc |
--- libsepol-2.7/include/sepol/policydb/flask_types.h
|
|
|
02871fc |
+++ libsepol-2.7/include/sepol/policydb/flask_types.h
|
|
|
02871fc |
@@ -1,7 +1,7 @@
|
|
|
02871fc |
/* -*- linux-c -*- */
|
|
|
02871fc |
|
|
|
02871fc |
/*
|
|
|
02871fc |
- * Author : Stephen Smalley, <sds@epoch.ncsc.mil>
|
|
|
02871fc |
+ * Author : Stephen Smalley, <sds@tycho.nsa.gov>
|
|
|
02871fc |
*/
|
|
|
02871fc |
|
|
|
02871fc |
#ifndef _SEPOL_POLICYDB_FLASK_TYPES_H_
|
|
|
02871fc |
diff --git libsepol-2.7/include/sepol/policydb/hashtab.h libsepol-2.7/include/sepol/policydb/hashtab.h
|
|
|
02871fc |
index ae5674a..ef1bb67 100644
|
|
|
02871fc |
--- libsepol-2.7/include/sepol/policydb/hashtab.h
|
|
|
02871fc |
+++ libsepol-2.7/include/sepol/policydb/hashtab.h
|
|
|
02871fc |
@@ -1,4 +1,4 @@
|
|
|
02871fc |
-/* Author : Stephen Smalley, <sds@epoch.ncsc.mil> */
|
|
|
02871fc |
+/* Author : Stephen Smalley, <sds@tycho.nsa.gov> */
|
|
|
02871fc |
|
|
|
02871fc |
/* FLASK */
|
|
|
02871fc |
|
|
|
02871fc |
diff --git libsepol-2.7/include/sepol/policydb/mls_types.h libsepol-2.7/include/sepol/policydb/mls_types.h
|
|
|
02871fc |
index 568386c..a06723b 100644
|
|
|
02871fc |
--- libsepol-2.7/include/sepol/policydb/mls_types.h
|
|
|
02871fc |
+++ libsepol-2.7/include/sepol/policydb/mls_types.h
|
|
|
02871fc |
@@ -1,4 +1,4 @@
|
|
|
02871fc |
-/* Author : Stephen Smalley, <sds@epoch.ncsc.mil> */
|
|
|
02871fc |
+/* Author : Stephen Smalley, <sds@tycho.nsa.gov> */
|
|
|
02871fc |
/*
|
|
|
02871fc |
* Updated: Trusted Computer Solutions, Inc. <dgoeddel@trustedcs.com>
|
|
|
02871fc |
*
|
|
|
02871fc |
diff --git libsepol-2.7/include/sepol/policydb/policydb.h libsepol-2.7/include/sepol/policydb/policydb.h
|
|
|
02871fc |
index 1b2d782..f8626ef 100644
|
|
|
02871fc |
--- libsepol-2.7/include/sepol/policydb/policydb.h
|
|
|
02871fc |
+++ libsepol-2.7/include/sepol/policydb/policydb.h
|
|
|
02871fc |
@@ -1,4 +1,4 @@
|
|
|
02871fc |
-/* Author : Stephen Smalley, <sds@epoch.ncsc.mil> */
|
|
|
02871fc |
+/* Author : Stephen Smalley, <sds@tycho.nsa.gov> */
|
|
|
02871fc |
|
|
|
02871fc |
/*
|
|
|
02871fc |
* Updated: Joshua Brindle <jbrindle@tresys.com>
|
|
|
02871fc |
diff --git libsepol-2.7/include/sepol/policydb/services.h libsepol-2.7/include/sepol/policydb/services.h
|
|
|
02871fc |
index efdf7de..6ef27a8 100644
|
|
|
02871fc |
--- libsepol-2.7/include/sepol/policydb/services.h
|
|
|
02871fc |
+++ libsepol-2.7/include/sepol/policydb/services.h
|
|
|
02871fc |
@@ -2,7 +2,7 @@
|
|
|
02871fc |
/* -*- linux-c -*- */
|
|
|
02871fc |
|
|
|
02871fc |
/*
|
|
|
02871fc |
- * Author : Stephen Smalley, <sds@epoch.ncsc.mil>
|
|
|
02871fc |
+ * Author : Stephen Smalley, <sds@tycho.nsa.gov>
|
|
|
02871fc |
*/
|
|
|
02871fc |
|
|
|
02871fc |
#ifndef _SEPOL_POLICYDB_SERVICES_H_
|
|
|
02871fc |
diff --git libsepol-2.7/include/sepol/policydb/sidtab.h libsepol-2.7/include/sepol/policydb/sidtab.h
|
|
|
02871fc |
index 2df1a50..893e6f0 100644
|
|
|
02871fc |
--- libsepol-2.7/include/sepol/policydb/sidtab.h
|
|
|
02871fc |
+++ libsepol-2.7/include/sepol/policydb/sidtab.h
|
|
|
02871fc |
@@ -1,4 +1,4 @@
|
|
|
02871fc |
-/* Author : Stephen Smalley, <sds@epoch.ncsc.mil> */
|
|
|
02871fc |
+/* Author : Stephen Smalley, <sds@tycho.nsa.gov> */
|
|
|
02871fc |
|
|
|
02871fc |
/* FLASK */
|
|
|
02871fc |
|
|
|
02871fc |
diff --git libsepol-2.7/include/sepol/policydb/symtab.h libsepol-2.7/include/sepol/policydb/symtab.h
|
|
|
02871fc |
index 68b5ad4..8b9ddca 100644
|
|
|
02871fc |
--- libsepol-2.7/include/sepol/policydb/symtab.h
|
|
|
02871fc |
+++ libsepol-2.7/include/sepol/policydb/symtab.h
|
|
|
02871fc |
@@ -1,5 +1,5 @@
|
|
|
02871fc |
|
|
|
02871fc |
-/* Author : Stephen Smalley, <sds@epoch.ncsc.mil> */
|
|
|
02871fc |
+/* Author : Stephen Smalley, <sds@tycho.nsa.gov> */
|
|
|
02871fc |
|
|
|
02871fc |
/* FLASK */
|
|
|
02871fc |
|
|
|
02871fc |
diff --git libsepol-2.7/man/man3/sepol_genbools.3 libsepol-2.7/man/man3/sepol_genbools.3
|
|
|
02871fc |
index dcfb69d..5363383 100644
|
|
|
02871fc |
--- libsepol-2.7/man/man3/sepol_genbools.3
|
|
|
02871fc |
+++ libsepol-2.7/man/man3/sepol_genbools.3
|
|
|
02871fc |
@@ -1,4 +1,4 @@
|
|
|
02871fc |
-.TH "sepol_genbools" "3" "11 August 2004" "sds@epoch.ncsc.mil" "SE Linux binary policy API documentation"
|
|
|
02871fc |
+.TH "sepol_genbools" "3" "11 August 2004" "sds@tycho.nsa.gov" "SE Linux binary policy API documentation"
|
|
|
02871fc |
.SH "NAME"
|
|
|
02871fc |
sepol_genbools \- Rewrite a binary policy with different boolean settings
|
|
|
02871fc |
.SH "SYNOPSIS"
|
|
|
02871fc |
diff --git libsepol-2.7/man/man8/genpolbools.8 libsepol-2.7/man/man8/genpolbools.8
|
|
|
02871fc |
index afeaced..fc792c8 100644
|
|
|
02871fc |
--- libsepol-2.7/man/man8/genpolbools.8
|
|
|
02871fc |
+++ libsepol-2.7/man/man8/genpolbools.8
|
|
|
02871fc |
@@ -1,4 +1,4 @@
|
|
|
02871fc |
-.TH "genpolbools" "8" "11 August 2004" "sds@epoch.ncsc.mil" "SELinux Command Line documentation"
|
|
|
02871fc |
+.TH "genpolbools" "8" "11 August 2004" "sds@tycho.nsa.gov" "SELinux Command Line documentation"
|
|
|
02871fc |
.SH "NAME"
|
|
|
02871fc |
genpolbools \- Rewrite a binary policy with different boolean settings
|
|
|
02871fc |
.SH "SYNOPSIS"
|
|
|
02871fc |
diff --git libsepol-2.7/src/avtab.c libsepol-2.7/src/avtab.c
|
|
|
02871fc |
index 3854d6f..257f051 100644
|
|
|
02871fc |
--- libsepol-2.7/src/avtab.c
|
|
|
02871fc |
+++ libsepol-2.7/src/avtab.c
|
|
|
02871fc |
@@ -1,5 +1,5 @@
|
|
|
02871fc |
|
|
|
02871fc |
-/* Author : Stephen Smalley, <sds@epoch.ncsc.mil> */
|
|
|
02871fc |
+/* Author : Stephen Smalley, <sds@tycho.nsa.gov> */
|
|
|
02871fc |
|
|
|
02871fc |
/*
|
|
|
02871fc |
* Updated: Yuichi Nakamura <ynakam@hitachisoft.jp>
|
|
|
02871fc |
diff --git libsepol-2.7/src/booleans.c libsepol-2.7/src/booleans.c
|
|
|
02871fc |
index c914a28..30fcf29 100644
|
|
|
02871fc |
--- libsepol-2.7/src/booleans.c
|
|
|
02871fc |
+++ libsepol-2.7/src/booleans.c
|
|
|
02871fc |
@@ -155,6 +155,7 @@ int sepol_bool_query(sepol_handle_t * handle,
|
|
|
02871fc |
booldatum = hashtab_search(policydb->p_bools.table, name);
|
|
|
02871fc |
if (!booldatum) {
|
|
|
02871fc |
*response = NULL;
|
|
|
02871fc |
+ free(name);
|
|
|
02871fc |
return STATUS_SUCCESS;
|
|
|
02871fc |
}
|
|
|
02871fc |
|
|
|
02871fc |
diff --git libsepol-2.7/src/ebitmap.c libsepol-2.7/src/ebitmap.c
|
|
|
02871fc |
index 218adc2..76e6e41 100644
|
|
|
02871fc |
--- libsepol-2.7/src/ebitmap.c
|
|
|
02871fc |
+++ libsepol-2.7/src/ebitmap.c
|
|
|
02871fc |
@@ -1,5 +1,5 @@
|
|
|
02871fc |
|
|
|
02871fc |
-/* Author : Stephen Smalley, <sds@epoch.ncsc.mil> */
|
|
|
02871fc |
+/* Author : Stephen Smalley, <sds@tycho.nsa.gov> */
|
|
|
02871fc |
|
|
|
02871fc |
/* FLASK */
|
|
|
02871fc |
|
|
|
02871fc |
diff --git libsepol-2.7/src/hashtab.c libsepol-2.7/src/hashtab.c
|
|
|
02871fc |
index ec49c15..f5407ab 100644
|
|
|
02871fc |
--- libsepol-2.7/src/hashtab.c
|
|
|
02871fc |
+++ libsepol-2.7/src/hashtab.c
|
|
|
02871fc |
@@ -1,5 +1,5 @@
|
|
|
02871fc |
|
|
|
02871fc |
-/* Author : Stephen Smalley, <sds@epoch.ncsc.mil> */
|
|
|
02871fc |
+/* Author : Stephen Smalley, <sds@tycho.nsa.gov> */
|
|
|
02871fc |
|
|
|
02871fc |
/*
|
|
|
02871fc |
* Updated : Karl MacMillan <kmacmillan@mentalrootkit.com>
|
|
|
02871fc |
diff --git libsepol-2.7/src/kernel_to_cil.c libsepol-2.7/src/kernel_to_cil.c
|
|
|
02871fc |
index f1905a9..0055c23 100644
|
|
|
02871fc |
--- libsepol-2.7/src/kernel_to_cil.c
|
|
|
02871fc |
+++ libsepol-2.7/src/kernel_to_cil.c
|
|
|
02871fc |
@@ -2788,7 +2788,7 @@ static int write_selinux_ibpkey_rules_to_cil(FILE *out, struct policydb *pdb)
|
|
|
02871fc |
{
|
|
|
02871fc |
struct ocontext *ibpkeycon;
|
|
|
02871fc |
char subnet_prefix_str[INET6_ADDRSTRLEN];
|
|
|
02871fc |
- struct in6_addr subnet_prefix = {0};
|
|
|
02871fc |
+ struct in6_addr subnet_prefix = IN6ADDR_ANY_INIT;
|
|
|
02871fc |
uint16_t low;
|
|
|
02871fc |
uint16_t high;
|
|
|
02871fc |
char low_high_str[44]; /* 2^64 <= 20 digits so "(low high)" <= 44 chars */
|
|
|
02871fc |
diff --git libsepol-2.7/src/kernel_to_conf.c libsepol-2.7/src/kernel_to_conf.c
|
|
|
02871fc |
index a74873f..95aa92f 100644
|
|
|
02871fc |
--- libsepol-2.7/src/kernel_to_conf.c
|
|
|
02871fc |
+++ libsepol-2.7/src/kernel_to_conf.c
|
|
|
02871fc |
@@ -2649,7 +2649,7 @@ static int write_selinux_ibpkey_rules_to_conf(FILE *out, struct policydb *pdb)
|
|
|
02871fc |
{
|
|
|
02871fc |
struct ocontext *ibpkeycon;
|
|
|
02871fc |
char subnet_prefix_str[INET6_ADDRSTRLEN];
|
|
|
02871fc |
- struct in6_addr subnet_prefix = {0};
|
|
|
02871fc |
+ struct in6_addr subnet_prefix = IN6ADDR_ANY_INIT;
|
|
|
02871fc |
uint16_t low;
|
|
|
02871fc |
uint16_t high;
|
|
|
02871fc |
char low_high_str[44]; /* 2^64 <= 20 digits so "low-high" <= 44 chars */
|
|
|
02871fc |
diff --git libsepol-2.7/src/libsepol.map.in libsepol-2.7/src/libsepol.map.in
|
|
|
02871fc |
index dd1fec2..2a9996f 100644
|
|
|
02871fc |
--- libsepol-2.7/src/libsepol.map.in
|
|
|
02871fc |
+++ libsepol-2.7/src/libsepol.map.in
|
|
|
02871fc |
@@ -49,6 +49,7 @@ LIBSEPOL_1.1 {
|
|
|
02871fc |
cil_set_mls;
|
|
|
02871fc |
cil_set_attrs_expand_generated;
|
|
|
02871fc |
cil_set_attrs_expand_size;
|
|
|
02871fc |
+ cil_set_multiple_decls;
|
|
|
02871fc |
cil_write_policy_conf;
|
|
|
02871fc |
sepol_ppfile_to_module_package;
|
|
|
02871fc |
sepol_module_package_to_cil;
|
|
|
02871fc |
diff --git libsepol-2.7/src/mls.c libsepol-2.7/src/mls.c
|
|
|
02871fc |
index be85475..bf1fdbd 100644
|
|
|
02871fc |
--- libsepol-2.7/src/mls.c
|
|
|
02871fc |
+++ libsepol-2.7/src/mls.c
|
|
|
02871fc |
@@ -1,4 +1,4 @@
|
|
|
02871fc |
-/* Author : Stephen Smalley, <sds@epoch.ncsc.mil> */
|
|
|
02871fc |
+/* Author : Stephen Smalley, <sds@tycho.nsa.gov> */
|
|
|
02871fc |
/*
|
|
|
02871fc |
* Updated: Trusted Computer Solutions, Inc. <dgoeddel@trustedcs.com>
|
|
|
02871fc |
*
|
|
|
02871fc |
diff --git libsepol-2.7/src/mls.h libsepol-2.7/src/mls.h
|
|
|
02871fc |
index 98da3d3..5ca3cd5 100644
|
|
|
02871fc |
--- libsepol-2.7/src/mls.h
|
|
|
02871fc |
+++ libsepol-2.7/src/mls.h
|
|
|
02871fc |
@@ -1,4 +1,4 @@
|
|
|
02871fc |
-/* Author: Stephen Smalley, <sds@epoch.ncsc.mil>
|
|
|
02871fc |
+/* Author: Stephen Smalley, <sds@tycho.nsa.gov>
|
|
|
02871fc |
* Updated: Trusted Computer Solutions, Inc. <dgoeddel@trustedcs.com>
|
|
|
02871fc |
*
|
|
|
02871fc |
* Support for enhanced MLS infrastructure.
|
|
|
02871fc |
diff --git libsepol-2.7/src/module_to_cil.c libsepol-2.7/src/module_to_cil.c
|
|
|
02871fc |
index 619a48f..15b58a7 100644
|
|
|
02871fc |
--- libsepol-2.7/src/module_to_cil.c
|
|
|
02871fc |
+++ libsepol-2.7/src/module_to_cil.c
|
|
|
02871fc |
@@ -2687,7 +2687,7 @@ static int ocontext_selinux_ibpkey_to_cil(struct policydb *pdb,
|
|
|
02871fc |
int rc = -1;
|
|
|
02871fc |
struct ocontext *ibpkeycon;
|
|
|
02871fc |
char subnet_prefix_str[INET6_ADDRSTRLEN];
|
|
|
02871fc |
- struct in6_addr subnet_prefix = {0};
|
|
|
02871fc |
+ struct in6_addr subnet_prefix = IN6ADDR_ANY_INIT;
|
|
|
02871fc |
uint16_t high;
|
|
|
02871fc |
uint16_t low;
|
|
|
02871fc |
|
|
|
02871fc |
diff --git libsepol-2.7/src/policydb.c libsepol-2.7/src/policydb.c
|
|
|
355996f |
index 691101e..c752123 100644
|
|
|
02871fc |
--- libsepol-2.7/src/policydb.c
|
|
|
02871fc |
+++ libsepol-2.7/src/policydb.c
|
|
|
02871fc |
@@ -1,5 +1,5 @@
|
|
|
02871fc |
|
|
|
02871fc |
-/* Author : Stephen Smalley, <sds@epoch.ncsc.mil> */
|
|
|
02871fc |
+/* Author : Stephen Smalley, <sds@tycho.nsa.gov> */
|
|
|
02871fc |
|
|
|
02871fc |
/*
|
|
|
02871fc |
* Updated: Trusted Computer Solutions, Inc. <dgoeddel@trustedcs.com>
|
|
|
355996f |
@@ -1420,6 +1420,8 @@ void ocontext_selinux_free(ocontext_t **ocontexts)
|
|
|
355996f |
if (i == OCON_ISID || i == OCON_FS || i == OCON_NETIF
|
|
|
355996f |
|| i == OCON_FSUSE)
|
|
|
355996f |
free(ctmp->u.name);
|
|
|
355996f |
+ else if (i == OCON_IBENDPORT)
|
|
|
355996f |
+ free(ctmp->u.ibendport.dev_name);
|
|
|
355996f |
free(ctmp);
|
|
|
355996f |
}
|
|
|
355996f |
}
|
|
|
02871fc |
diff --git libsepol-2.7/src/services.c libsepol-2.7/src/services.c
|
|
|
02871fc |
index 10338a6..d40793e 100644
|
|
|
02871fc |
--- libsepol-2.7/src/services.c
|
|
|
02871fc |
+++ libsepol-2.7/src/services.c
|
|
|
02871fc |
@@ -1,6 +1,6 @@
|
|
|
02871fc |
|
|
|
02871fc |
/*
|
|
|
02871fc |
- * Author : Stephen Smalley, <sds@epoch.ncsc.mil>
|
|
|
02871fc |
+ * Author : Stephen Smalley, <sds@tycho.nsa.gov>
|
|
|
02871fc |
*/
|
|
|
02871fc |
/*
|
|
|
02871fc |
* Updated: Trusted Computer Solutions, Inc. <dgoeddel@trustedcs.com>
|
|
|
02871fc |
diff --git libsepol-2.7/src/sidtab.c libsepol-2.7/src/sidtab.c
|
|
|
02871fc |
index 5bd7999..23b2e8f 100644
|
|
|
02871fc |
--- libsepol-2.7/src/sidtab.c
|
|
|
02871fc |
+++ libsepol-2.7/src/sidtab.c
|
|
|
02871fc |
@@ -1,5 +1,5 @@
|
|
|
02871fc |
|
|
|
02871fc |
-/* Author : Stephen Smalley, <sds@epoch.ncsc.mil> */
|
|
|
02871fc |
+/* Author : Stephen Smalley, <sds@tycho.nsa.gov> */
|
|
|
02871fc |
|
|
|
02871fc |
/* FLASK */
|
|
|
02871fc |
|
|
|
02871fc |
diff --git libsepol-2.7/src/symtab.c libsepol-2.7/src/symtab.c
|
|
|
02871fc |
index c1e625d..9a417ca 100644
|
|
|
02871fc |
--- libsepol-2.7/src/symtab.c
|
|
|
02871fc |
+++ libsepol-2.7/src/symtab.c
|
|
|
02871fc |
@@ -1,5 +1,5 @@
|
|
|
02871fc |
|
|
|
02871fc |
-/* Author : Stephen Smalley, <sds@epoch.ncsc.mil> */
|
|
|
02871fc |
+/* Author : Stephen Smalley, <sds@tycho.nsa.gov> */
|
|
|
02871fc |
|
|
|
02871fc |
/* FLASK */
|
|
|
02871fc |
|
|
|
02871fc |
diff --git libsepol-2.7/src/write.c libsepol-2.7/src/write.c
|
|
|
02871fc |
index e486e28..1fb3095 100644
|
|
|
02871fc |
--- libsepol-2.7/src/write.c
|
|
|
02871fc |
+++ libsepol-2.7/src/write.c
|
|
|
02871fc |
@@ -1,5 +1,5 @@
|
|
|
02871fc |
|
|
|
02871fc |
-/* Author : Stephen Smalley, <sds@epoch.ncsc.mil> */
|
|
|
02871fc |
+/* Author : Stephen Smalley, <sds@tycho.nsa.gov> */
|
|
|
02871fc |
|
|
|
02871fc |
/*
|
|
|
02871fc |
* Updated: Trusted Computer Solutions, Inc. <dgoeddel@trustedcs.com>
|