|
 |
a7ec325 |
diff --git libsepol-2.5/ChangeLog libsepol-2.5/ChangeLog
|
|
|
a7ec325 |
index ace3d54..41bf8c0 100644
|
|
|
a7ec325 |
--- libsepol-2.5/ChangeLog
|
|
|
a7ec325 |
+++ libsepol-2.5/ChangeLog
|
|
|
a7ec325 |
@@ -1,3 +1,6 @@
|
|
|
a7ec325 |
+ * Add support for portcon dccp protocol, from Richard Haines
|
|
|
a7ec325 |
+ * Fix bug in CIL when resetting classes, from Steve Lawrence
|
|
|
a7ec325 |
+
|
|
|
a7ec325 |
2.5 2016-02-23
|
|
|
a7ec325 |
* Fix unused variable annotations, from Nicolas Iooss.
|
|
|
a7ec325 |
* Fix uninitialized variable in CIL, from Nicolas Iooss.
|
|
|
a7ec325 |
diff --git libsepol-2.5/cil/src/cil.c libsepol-2.5/cil/src/cil.c
|
|
|
a7ec325 |
index afdc240..de7033a 100644
|
|
|
a7ec325 |
--- libsepol-2.5/cil/src/cil.c
|
|
|
a7ec325 |
+++ libsepol-2.5/cil/src/cil.c
|
|
|
a7ec325 |
@@ -108,6 +108,7 @@ static void cil_init_keys(void)
|
|
|
a7ec325 |
CIL_KEY_STAR = cil_strpool_add("*");
|
|
|
a7ec325 |
CIL_KEY_UDP = cil_strpool_add("udp");
|
|
|
a7ec325 |
CIL_KEY_TCP = cil_strpool_add("tcp");
|
|
|
a7ec325 |
+ CIL_KEY_DCCP = cil_strpool_add("dccp");
|
|
|
a7ec325 |
CIL_KEY_AUDITALLOW = cil_strpool_add("auditallow");
|
|
|
a7ec325 |
CIL_KEY_TUNABLEIF = cil_strpool_add("tunableif");
|
|
|
a7ec325 |
CIL_KEY_ALLOW = cil_strpool_add("allow");
|
|
|
a7ec325 |
diff --git libsepol-2.5/cil/src/cil_binary.c libsepol-2.5/cil/src/cil_binary.c
|
|
|
a7ec325 |
index f749e53..5d7e52e 100644
|
|
|
a7ec325 |
--- libsepol-2.5/cil/src/cil_binary.c
|
|
|
a7ec325 |
+++ libsepol-2.5/cil/src/cil_binary.c
|
|
|
a7ec325 |
@@ -3035,6 +3035,9 @@ int cil_portcon_to_policydb(policydb_t *pdb, struct cil_sort *portcons)
|
|
|
a7ec325 |
case CIL_PROTOCOL_TCP:
|
|
|
a7ec325 |
new_ocon->u.port.protocol = IPPROTO_TCP;
|
|
|
a7ec325 |
break;
|
|
|
a7ec325 |
+ case CIL_PROTOCOL_DCCP:
|
|
|
a7ec325 |
+ new_ocon->u.port.protocol = IPPROTO_DCCP;
|
|
|
a7ec325 |
+ break;
|
|
|
a7ec325 |
default:
|
|
|
a7ec325 |
/* should not get here */
|
|
|
a7ec325 |
rc = SEPOL_ERR;
|
|
|
a7ec325 |
diff --git libsepol-2.5/cil/src/cil_build_ast.c libsepol-2.5/cil/src/cil_build_ast.c
|
|
|
a7ec325 |
index 1135e06..90fee8e 100644
|
|
|
a7ec325 |
--- libsepol-2.5/cil/src/cil_build_ast.c
|
|
|
a7ec325 |
+++ libsepol-2.5/cil/src/cil_build_ast.c
|
|
|
a7ec325 |
@@ -4261,6 +4261,8 @@ int cil_gen_portcon(struct cil_db *db, struct cil_tree_node *parse_current, stru
|
|
|
a7ec325 |
portcon->proto = CIL_PROTOCOL_UDP;
|
|
|
a7ec325 |
} else if (proto == CIL_KEY_TCP) {
|
|
|
a7ec325 |
portcon->proto = CIL_PROTOCOL_TCP;
|
|
|
a7ec325 |
+ } else if (proto == CIL_KEY_DCCP) {
|
|
|
a7ec325 |
+ portcon->proto = CIL_PROTOCOL_DCCP;
|
|
|
a7ec325 |
} else {
|
|
|
a7ec325 |
cil_log(CIL_ERR, "Invalid protocol\n");
|
|
|
a7ec325 |
rc = SEPOL_ERR;
|
|
|
a7ec325 |
diff --git libsepol-2.5/cil/src/cil_internal.h libsepol-2.5/cil/src/cil_internal.h
|
|
|
a7ec325 |
index a0a5480..a75ddf8 100644
|
|
|
a7ec325 |
--- libsepol-2.5/cil/src/cil_internal.h
|
|
|
a7ec325 |
+++ libsepol-2.5/cil/src/cil_internal.h
|
|
|
a7ec325 |
@@ -101,6 +101,7 @@ char *CIL_KEY_OBJECT_R;
|
|
|
a7ec325 |
char *CIL_KEY_STAR;
|
|
|
a7ec325 |
char *CIL_KEY_TCP;
|
|
|
a7ec325 |
char *CIL_KEY_UDP;
|
|
|
a7ec325 |
+char *CIL_KEY_DCCP;
|
|
|
a7ec325 |
char *CIL_KEY_AUDITALLOW;
|
|
|
a7ec325 |
char *CIL_KEY_TUNABLEIF;
|
|
|
a7ec325 |
char *CIL_KEY_ALLOW;
|
|
|
a7ec325 |
@@ -713,7 +714,8 @@ struct cil_filecon {
|
|
|
a7ec325 |
|
|
|
a7ec325 |
enum cil_protocol {
|
|
|
a7ec325 |
CIL_PROTOCOL_UDP = 1,
|
|
|
a7ec325 |
- CIL_PROTOCOL_TCP
|
|
|
a7ec325 |
+ CIL_PROTOCOL_TCP,
|
|
|
a7ec325 |
+ CIL_PROTOCOL_DCCP
|
|
|
a7ec325 |
};
|
|
|
a7ec325 |
|
|
|
a7ec325 |
struct cil_portcon {
|
|
|
a7ec325 |
diff --git libsepol-2.5/cil/src/cil_policy.c libsepol-2.5/cil/src/cil_policy.c
|
|
|
a7ec325 |
index 2c9b158..382129b 100644
|
|
|
a7ec325 |
--- libsepol-2.5/cil/src/cil_policy.c
|
|
|
a7ec325 |
+++ libsepol-2.5/cil/src/cil_policy.c
|
|
|
a7ec325 |
@@ -123,6 +123,8 @@ int cil_portcon_to_policy(FILE **file_arr, struct cil_sort *sort)
|
|
|
a7ec325 |
fprintf(file_arr[NETIFCONS], "udp ");
|
|
|
a7ec325 |
} else if (portcon->proto == CIL_PROTOCOL_TCP) {
|
|
|
a7ec325 |
fprintf(file_arr[NETIFCONS], "tcp ");
|
|
|
a7ec325 |
+ } else if (portcon->proto == CIL_PROTOCOL_DCCP) {
|
|
|
a7ec325 |
+ fprintf(file_arr[NETIFCONS], "dccp ");
|
|
|
a7ec325 |
}
|
|
|
a7ec325 |
fprintf(file_arr[NETIFCONS], "%d ", portcon->port_low);
|
|
|
a7ec325 |
fprintf(file_arr[NETIFCONS], "%d ", portcon->port_high);
|
|
|
a7ec325 |
diff --git libsepol-2.5/cil/src/cil_reset_ast.c libsepol-2.5/cil/src/cil_reset_ast.c
|
|
|
a7ec325 |
index 06146ca..de00679 100644
|
|
|
a7ec325 |
--- libsepol-2.5/cil/src/cil_reset_ast.c
|
|
|
a7ec325 |
+++ libsepol-2.5/cil/src/cil_reset_ast.c
|
|
|
a7ec325 |
@@ -23,7 +23,7 @@ static void cil_reset_class(struct cil_class *class)
|
|
|
a7ec325 |
{
|
|
|
a7ec325 |
if (class->common != NULL) {
|
|
|
a7ec325 |
struct cil_class *common = class->common;
|
|
|
a7ec325 |
- cil_symtab_map(&common->perms, __class_reset_perm_values, &common->num_perms);
|
|
|
a7ec325 |
+ cil_symtab_map(&class->perms, __class_reset_perm_values, &common->num_perms);
|
|
|
a7ec325 |
/* during a re-resolve, we need to reset the common, so a classcommon
|
|
|
a7ec325 |
* statement isn't seen as a duplicate */
|
|
|
a7ec325 |
class->num_perms -= common->num_perms;
|
|
|
a7ec325 |
diff --git libsepol-2.5/cil/src/cil_tree.c libsepol-2.5/cil/src/cil_tree.c
|
|
|
a7ec325 |
index 1c23efc..563b817 100644
|
|
|
a7ec325 |
--- libsepol-2.5/cil/src/cil_tree.c
|
|
|
a7ec325 |
+++ libsepol-2.5/cil/src/cil_tree.c
|
|
|
a7ec325 |
@@ -1319,6 +1319,8 @@ void cil_tree_print_node(struct cil_tree_node *node)
|
|
|
a7ec325 |
cil_log(CIL_INFO, " udp");
|
|
|
a7ec325 |
} else if (portcon->proto == CIL_PROTOCOL_TCP) {
|
|
|
a7ec325 |
cil_log(CIL_INFO, " tcp");
|
|
|
a7ec325 |
+ } else if (portcon->proto == CIL_PROTOCOL_DCCP) {
|
|
|
a7ec325 |
+ cil_log(CIL_INFO, " dccp");
|
|
|
a7ec325 |
}
|
|
|
a7ec325 |
cil_log(CIL_INFO, " (%d %d)", portcon->port_low, portcon->port_high);
|
|
|
a7ec325 |
|
|
|
a7ec325 |
diff --git libsepol-2.5/include/sepol/port_record.h libsepol-2.5/include/sepol/port_record.h
|
|
|
a7ec325 |
index 697cea4..c07d1fa 100644
|
|
|
a7ec325 |
--- libsepol-2.5/include/sepol/port_record.h
|
|
|
a7ec325 |
+++ libsepol-2.5/include/sepol/port_record.h
|
|
|
a7ec325 |
@@ -14,6 +14,7 @@ typedef struct sepol_port_key sepol_port_key_t;
|
|
|
a7ec325 |
|
|
|
a7ec325 |
#define SEPOL_PROTO_UDP 0
|
|
|
a7ec325 |
#define SEPOL_PROTO_TCP 1
|
|
|
a7ec325 |
+#define SEPOL_PROTO_DCCP 2
|
|
|
a7ec325 |
|
|
|
a7ec325 |
/* Key */
|
|
|
a7ec325 |
extern int sepol_port_compare(const sepol_port_t * port,
|
|
|
a7ec325 |
diff --git libsepol-2.5/src/module_to_cil.c libsepol-2.5/src/module_to_cil.c
|
|
|
a7ec325 |
index 18ec6b9..b478d9f 100644
|
|
|
a7ec325 |
--- libsepol-2.5/src/module_to_cil.c
|
|
|
a7ec325 |
+++ libsepol-2.5/src/module_to_cil.c
|
|
|
a7ec325 |
@@ -2537,6 +2537,7 @@ static int ocontext_selinux_port_to_cil(struct policydb *pdb, struct ocontext *p
|
|
|
a7ec325 |
switch (portcon->u.port.protocol) {
|
|
|
a7ec325 |
case IPPROTO_TCP: protocol = "tcp"; break;
|
|
|
a7ec325 |
case IPPROTO_UDP: protocol = "udp"; break;
|
|
|
a7ec325 |
+ case IPPROTO_DCCP: protocol = "dccp"; break;
|
|
|
a7ec325 |
default:
|
|
|
a7ec325 |
log_err("Unknown portcon protocol: %i", portcon->u.port.protocol);
|
|
|
a7ec325 |
rc = -1;
|
|
|
a7ec325 |
diff --git libsepol-2.5/src/port_record.c libsepol-2.5/src/port_record.c
|
|
|
a7ec325 |
index 6a33d93..ed9093b 100644
|
|
|
a7ec325 |
--- libsepol-2.5/src/port_record.c
|
|
|
a7ec325 |
+++ libsepol-2.5/src/port_record.c
|
|
|
a7ec325 |
@@ -184,6 +184,8 @@ const char *sepol_port_get_proto_str(int proto)
|
|
|
a7ec325 |
return "udp";
|
|
|
a7ec325 |
case SEPOL_PROTO_TCP:
|
|
|
a7ec325 |
return "tcp";
|
|
|
a7ec325 |
+ case SEPOL_PROTO_DCCP:
|
|
|
a7ec325 |
+ return "dccp";
|
|
|
a7ec325 |
default:
|
|
|
a7ec325 |
return "???";
|
|
|
a7ec325 |
}
|
|
|
a7ec325 |
diff --git libsepol-2.5/src/ports.c libsepol-2.5/src/ports.c
|
|
|
a7ec325 |
index 607a629..b1ee094 100644
|
|
|
a7ec325 |
--- libsepol-2.5/src/ports.c
|
|
|
a7ec325 |
+++ libsepol-2.5/src/ports.c
|
|
|
a7ec325 |
@@ -16,6 +16,8 @@ static inline int sepol2ipproto(sepol_handle_t * handle, int proto)
|
|
|
a7ec325 |
return IPPROTO_TCP;
|
|
|
a7ec325 |
case SEPOL_PROTO_UDP:
|
|
|
a7ec325 |
return IPPROTO_UDP;
|
|
|
a7ec325 |
+ case SEPOL_PROTO_DCCP:
|
|
|
a7ec325 |
+ return IPPROTO_DCCP;
|
|
|
a7ec325 |
default:
|
|
|
a7ec325 |
ERR(handle, "unsupported protocol %u", proto);
|
|
|
a7ec325 |
return STATUS_ERR;
|
|
|
a7ec325 |
@@ -30,6 +32,8 @@ static inline int ipproto2sepol(sepol_handle_t * handle, int proto)
|
|
|
a7ec325 |
return SEPOL_PROTO_TCP;
|
|
|
a7ec325 |
case IPPROTO_UDP:
|
|
|
a7ec325 |
return SEPOL_PROTO_UDP;
|
|
|
a7ec325 |
+ case IPPROTO_DCCP:
|
|
|
a7ec325 |
+ return SEPOL_PROTO_DCCP;
|
|
|
a7ec325 |
default:
|
|
|
a7ec325 |
ERR(handle, "invalid protocol %u " "found in policy", proto);
|
|
|
a7ec325 |
return STATUS_ERR;
|