[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

[Xen-devel] [PATCH 01/23] xsm/flask: remove inherited class attributes



The ability to declare common permission blocks shared across multiple
classes is not currently used in Xen. Currently, support for this
feature is broken in the header generation scripts, and it is not
expected that this feature will be used in the future, so remove the
dead code.

Signed-off-by: Daniel De Graaf <dgdegra@xxxxxxxxxxxxx>
---
 tools/flask/policy/policy/flask/Makefile           |  2 +-
 tools/flask/policy/policy/flask/access_vectors     | 17 +----
 tools/flask/policy/policy/flask/mkaccess_vector.sh | 89 ----------------------
 xen/xsm/flask/avc.c                                | 39 ----------
 xen/xsm/flask/include/av_inherit.h                 |  1 -
 xen/xsm/flask/include/avc_ss.h                     |  8 --
 xen/xsm/flask/include/common_perm_to_string.h      |  1 -
 xen/xsm/flask/ss/policydb.c                        | 46 +----------
 xen/xsm/flask/ss/services.c                        | 54 +------------
 9 files changed, 8 insertions(+), 249 deletions(-)
 delete mode 100644 xen/xsm/flask/include/av_inherit.h
 delete mode 100644 xen/xsm/flask/include/common_perm_to_string.h

diff --git a/tools/flask/policy/policy/flask/Makefile 
b/tools/flask/policy/policy/flask/Makefile
index 970b9fe..5f57e88 100644
--- a/tools/flask/policy/policy/flask/Makefile
+++ b/tools/flask/policy/policy/flask/Makefile
@@ -14,7 +14,7 @@ FLASK_H_DEPEND = security_classes initial_sids
 AV_H_DEPEND = access_vectors
 
 FLASK_H_FILES = class_to_string.h flask.h initial_sid_to_string.h
-AV_H_FILES = av_inherit.h common_perm_to_string.h av_perm_to_string.h 
av_permissions.h
+AV_H_FILES = av_perm_to_string.h av_permissions.h
 ALL_H_FILES = $(FLASK_H_FILES) $(AV_H_FILES)
 
 all:  $(ALL_H_FILES)
diff --git a/tools/flask/policy/policy/flask/access_vectors 
b/tools/flask/policy/policy/flask/access_vectors
index 5901911..a884312 100644
--- a/tools/flask/policy/policy/flask/access_vectors
+++ b/tools/flask/policy/policy/flask/access_vectors
@@ -1,22 +1,7 @@
 #
-# Define common prefixes for access vectors
-#
-# common common_name { permission_name ... }
-
-#
-# Define a common prefix for file access vectors.
-#
-
-
-#
 # Define the access vectors.
 #
-# class class_name [ inherits common_name ] { permission_name ... }
-
-
-#
-# Define the access vector interpretation for file-related objects.
-#
+# class class_name { permission_name ... }
 
 class xen
 {
diff --git a/tools/flask/policy/policy/flask/mkaccess_vector.sh 
b/tools/flask/policy/policy/flask/mkaccess_vector.sh
index b5da734..43a60a7 100644
--- a/tools/flask/policy/policy/flask/mkaccess_vector.sh
+++ b/tools/flask/policy/policy/flask/mkaccess_vector.sh
@@ -10,50 +10,21 @@ shift
 
 # output files
 av_permissions="av_permissions.h"
-av_inherit="av_inherit.h"
-common_perm_to_string="common_perm_to_string.h"
 av_perm_to_string="av_perm_to_string.h"
 
 cat $* | $awk "
 BEGIN  {
                outfile = \"$av_permissions\"
-               inheritfile = \"$av_inherit\"
-               cpermfile = \"$common_perm_to_string\"
                avpermfile = \"$av_perm_to_string\"
                "'
                nextstate = "COMMON_OR_AV";
                printf("/* This file is automatically generated.  Do not edit. 
*/\n") > outfile;
-               printf("/* This file is automatically generated.  Do not edit. 
*/\n") > inheritfile;
-               printf("/* This file is automatically generated.  Do not edit. 
*/\n") > cpermfile;
                printf("/* This file is automatically generated.  Do not edit. 
*/\n") > avpermfile;
 ;
        }
 /^[ \t]*#/     { 
                        next;
                }
-$1 == "common" { 
-                       if (nextstate != "COMMON_OR_AV")
-                       {
-                               printf("Parse error:  Unexpected COMMON 
definition on line %d\n", NR);
-                               next;   
-                       }
-
-                       if ($2 in common_defined)
-                       {
-                               printf("Duplicate COMMON definition for %s on 
line %d.\n", $2, NR);
-                               next;
-                       }       
-                       common_defined[$2] = 1;
-
-                       tclass = $2;
-                       common_name = $2; 
-                       permission = 1;
-
-                       printf("TB_(common_%s_perm_to_string)\n", $2) > 
cpermfile;
-
-                       nextstate = "COMMON-OPENBRACKET";
-                       next;
-               }
 $1 == "class"  {
                        if (nextstate != "COMMON_OR_AV" &&
                            nextstate != "CLASS_OR_CLASS-OPENBRACKET")
@@ -71,62 +42,11 @@ $1 == "class"       {
                        } 
                        av_defined[tclass] = 1;
 
-                       inherits = "";
                        permission = 1;
 
                        nextstate = "INHERITS_OR_CLASS-OPENBRACKET";
                        next;
                }
-$1 == "inherits" {                     
-                       if (nextstate != "INHERITS_OR_CLASS-OPENBRACKET")
-                       {
-                               printf("Parse error:  Unexpected INHERITS 
definition on line %d\n", NR);
-                               next;   
-                       }
-
-                       if (!($2 in common_defined))
-                       {
-                               printf("COMMON %s is not defined (line %d).\n", 
$2, NR);
-                               next;
-                       }
-
-                       inherits = $2;
-                       permission = common_base[$2];
-
-                       for (combined in common_perms)
-                       {
-                               split(combined,separate, SUBSEP);
-                               if (separate[1] == inherits)
-                               {
-                                       inherited_perms[common_perms[combined]] 
= separate[2];
-                               }
-                       }
-
-                        j = 1;
-                        for (i in inherited_perms) {
-                            ind[j] = i + 0;
-                            j++;
-                        }
-                        n = asort(ind);
-                       for (i = 1; i <= n; i++) {
-                               perm = inherited_perms[ind[i]];
-                               printf("#define %s__%s", toupper(tclass), 
toupper(perm)) > outfile; 
-                               spaces = 40 - (length(perm) + length(tclass));
-                               if (spaces < 1)
-                                     spaces = 1;
-                               for (j = 0; j < spaces; j++) 
-                                       printf(" ") > outfile; 
-                               printf("0x%08xUL\n", ind[i]) > outfile; 
-                       }
-                       printf("\n") > outfile;
-                        for (i in ind) delete ind[i];
-                        for (i in inherited_perms) delete inherited_perms[i];
-
-                       printf("   S_(SECCLASS_%s, %s, 0x%08xUL)\n", 
toupper(tclass), inherits, permission) > inheritfile; 
-
-                       nextstate = "CLASS_OR_CLASS-OPENBRACKET";
-                       next;
-               }
 $1 == "{"      { 
                        if (nextstate != "INHERITS_OR_CLASS-OPENBRACKET" &&
                            nextstate != "CLASS_OR_CLASS-OPENBRACKET" &&
@@ -177,15 +97,6 @@ $1 == "{"   {
 
                                av_perms[tclass,$1] = permission;
                
-                               if (inherits != "")
-                               {
-                                       if ((inherits,$1) in common_perms)
-                                       {
-                                               printf("Permission %s in %s on 
line %d conflicts with common permission.\n", $1, tclass, inherits, NR);
-                                               next;
-                                       }
-                               }
-
                                printf("#define %s__%s", toupper(tclass), 
toupper($1)) > outfile; 
 
                                printf("   S_(SECCLASS_%s, %s__%s, \"%s\")\n", 
toupper(tclass), toupper(tclass), toupper($1), $1) > avpermfile; 
diff --git a/xen/xsm/flask/avc.c b/xen/xsm/flask/avc.c
index 44240a9..7fede00 100644
--- a/xen/xsm/flask/avc.c
+++ b/xen/xsm/flask/avc.c
@@ -45,28 +45,11 @@ static const char *class_to_string[] = {
 #undef S_
 };
 
-#define TB_(s) static const char * s [] = {
-#define TE_(s) };
-#define S_(s) s,
-#include "common_perm_to_string.h"
-#undef TB_
-#undef TE_
-#undef S_
-
-static const struct av_inherit av_inherit[] = {
-#define S_(c, i, b) { .tclass = c, .common_pts = common_##i##_perm_to_string, \
-                      .common_base = b },
-#include "av_inherit.h"
-#undef S_
-};
-
 const struct selinux_class_perm selinux_class_perm = {
     .av_perm_to_string = av_perm_to_string,
     .av_pts_len = ARRAY_SIZE(av_perm_to_string),
     .class_to_string = class_to_string,
     .cts_len = ARRAY_SIZE(class_to_string),
-    .av_inherit = av_inherit,
-    .av_inherit_len = ARRAY_SIZE(av_inherit)
 };
 
 #define AVC_CACHE_SLOTS            512
@@ -181,8 +164,6 @@ static void avc_printk(struct avc_dump_buf *buf, const char 
*fmt, ...)
  */
 static void avc_dump_av(struct avc_dump_buf *buf, u16 tclass, u32 av)
 {
-    const char **common_pts = NULL;
-    u32 common_base = 0;
     int i, i2, perm;
 
     if ( av == 0 )
@@ -191,29 +172,9 @@ static void avc_dump_av(struct avc_dump_buf *buf, u16 
tclass, u32 av)
         return;
     }
 
-    for ( i = 0; i < ARRAY_SIZE(av_inherit); i++ )
-    {
-        if (av_inherit[i].tclass == tclass)
-        {
-            common_pts = av_inherit[i].common_pts;
-            common_base = av_inherit[i].common_base;
-            break;
-        }
-    }
-
     avc_printk(buf, " {");
     i = 0;
     perm = 1;
-    while ( perm < common_base )
-    {
-        if (perm & av)
-        {
-            avc_printk(buf, " %s", common_pts[i]);
-            av &= ~perm;
-        }
-        i++;
-        perm <<= 1;
-    }
 
     while ( i < sizeof(av) * 8 )
     {
diff --git a/xen/xsm/flask/include/av_inherit.h 
b/xen/xsm/flask/include/av_inherit.h
deleted file mode 100644
index 321ffe7..0000000
--- a/xen/xsm/flask/include/av_inherit.h
+++ /dev/null
@@ -1 +0,0 @@
-/* This file is automatically generated.  Do not edit. */
diff --git a/xen/xsm/flask/include/avc_ss.h b/xen/xsm/flask/include/avc_ss.h
index ea4e98c..a3d7d1e 100644
--- a/xen/xsm/flask/include/avc_ss.h
+++ b/xen/xsm/flask/include/avc_ss.h
@@ -16,19 +16,11 @@ struct av_perm_to_string {
     const char *name;
 };
 
-struct av_inherit {
-    const char **common_pts;
-    u32 common_base;
-    u16 tclass;
-};
-
 struct selinux_class_perm {
     const struct av_perm_to_string *av_perm_to_string;
     u32 av_pts_len;
     u32 cts_len;
     const char **class_to_string;
-    const struct av_inherit *av_inherit;
-    u32 av_inherit_len;
 };
 
 extern const struct selinux_class_perm selinux_class_perm;
diff --git a/xen/xsm/flask/include/common_perm_to_string.h 
b/xen/xsm/flask/include/common_perm_to_string.h
deleted file mode 100644
index 321ffe7..0000000
--- a/xen/xsm/flask/include/common_perm_to_string.h
+++ /dev/null
@@ -1 +0,0 @@
-/* This file is automatically generated.  Do not edit. */
diff --git a/xen/xsm/flask/ss/policydb.c b/xen/xsm/flask/ss/policydb.c
index 26097b9..fefcd59 100644
--- a/xen/xsm/flask/ss/policydb.c
+++ b/xen/xsm/flask/ss/policydb.c
@@ -254,14 +254,6 @@ out_free_symtab:
 
 static int common_index(void *key, void *datum, void *datap)
 {
-    struct policydb *p;
-    struct common_datum *comdatum;
-
-    comdatum = datum;
-    p = datap;
-    if ( !comdatum->value || comdatum->value > p->p_commons.nprim )
-        return -EINVAL;
-    p->p_common_val_to_name[comdatum->value - 1] = key;
     return 0;
 }
 
@@ -382,8 +374,7 @@ static int (*index_f[SYM_NUM]) (void *key, void *datum, 
void *datap) =
 };
 
 /*
- * Define the common val_to_name array and the class
- * val_to_name and val_to_struct arrays in a policy
+ * Define the class val_to_name and val_to_struct arrays in a policy
  * database structure.
  *
  * Caller must clean up upon failure.
@@ -392,18 +383,6 @@ static int policydb_index_classes(struct policydb *p)
 {
     int rc;
 
-    p->p_common_val_to_name =
-        xmalloc_array(char *, p->p_commons.nprim);
-    if ( !p->p_common_val_to_name )
-    {
-        rc = -ENOMEM;
-        goto out;
-    }
-
-    rc = hashtab_map(p->p_commons.table, common_index, p);
-    if ( rc )
-        goto out;
-
     p->class_val_to_struct =
         xmalloc_array(struct class_datum *, p->p_classes.nprim);
     if ( !p->class_val_to_struct )
@@ -1200,26 +1179,9 @@ static int class_read(struct policydb *p, struct hashtab 
*h, void *fp)
 
     if ( len2 )
     {
-        cladatum->comkey = xmalloc_array(char, len2 + 1);
-        if ( !cladatum->comkey )
-        {
-            rc = -ENOMEM;
-            goto bad;
-        }
-        rc = next_entry(cladatum->comkey, fp, len2);
-        if ( rc < 0 )
-            goto bad;
-        cladatum->comkey[len2] = 0;
-
-        cladatum->comdatum = hashtab_search(p->p_commons.table,
-                            cladatum->comkey);
-        if ( !cladatum->comdatum )
-        {
-            printk(KERN_ERR "Flask:  unknown common %s\n",
-                   cladatum->comkey);
-            rc = -EINVAL;
-            goto bad;
-        }
+        printk(KERN_ERR "Flask:  classes with common prefixes are not 
supported\n");
+        rc = -EINVAL;
+        goto bad;
     }
     for ( i = 0; i < nel; i++ )
     {
diff --git a/xen/xsm/flask/ss/services.c b/xen/xsm/flask/ss/services.c
index 363f586..1bf3b0c 100644
--- a/xen/xsm/flask/ss/services.c
+++ b/xen/xsm/flask/ss/services.c
@@ -1167,10 +1167,10 @@ int security_change_sid(u32 ssid, u32 tsid, u16 tclass, 
u32 *out_sid)
  */
 static int validate_classes(struct policydb *p)
 {
-    int i, j;
+    int i;
     struct class_datum *cladatum;
     struct perm_datum *perdatum;
-    u32 nprim, tmp, common_pts_len, perm_val, pol_val;
+    u32 nprim, perm_val, pol_val;
     u16 class_val;
     const struct selinux_class_perm *kdefs = &selinux_class_perm;
     const char *def_class, *def_perm, *pol_class;
@@ -1233,56 +1233,6 @@ static int validate_classes(struct policydb *p)
             return -EINVAL;
         }
     }
-    for ( i = 0; i < kdefs->av_inherit_len; i++ )
-    {
-        class_val = kdefs->av_inherit[i].tclass;
-        if ( class_val > p->p_classes.nprim )
-            continue;
-        pol_class = p->p_class_val_to_name[class_val-1];
-        cladatum = hashtab_search(p->p_classes.table, pol_class);
-        BUG_ON( !cladatum );
-        if ( !cladatum->comdatum )
-        {
-            printk(KERN_ERR
-            "Flask:  class %s should have an inherits clause but does not\n",
-                   pol_class);
-            return -EINVAL;
-        }
-        tmp = kdefs->av_inherit[i].common_base;
-        common_pts_len = 0;
-        while ( !(tmp & 0x01) )
-        {
-            common_pts_len++;
-            tmp >>= 1;
-        }
-        perms = &cladatum->comdatum->permissions;
-        for ( j = 0; j < common_pts_len; j++ )
-        {
-            def_perm = kdefs->av_inherit[i].common_pts[j];
-            if ( j >= perms->nprim )
-            {
-                printk(KERN_INFO
-                "Flask:  permission %s in class %s not defined in policy\n",
-                       def_perm, pol_class);
-                return -EINVAL;
-            }
-            perdatum = hashtab_search(perms->table, def_perm);
-            if ( perdatum == NULL )
-            {
-                printk(KERN_ERR
-                       "Flask:  permission %s in class %s not found in 
policy\n",
-                       def_perm, pol_class);
-                return -EINVAL;
-            }
-            if ( perdatum->value != j + 1 )
-            {
-                printk(KERN_ERR
-                      "Flask:  permission %s in class %s has incorrect 
value\n",
-                       def_perm, pol_class);
-                return -EINVAL;
-            }
-        }
-    }
     return 0;
 }
 
-- 
1.7.11.4


_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxx
http://lists.xen.org/xen-devel


 


Rackspace

Lists.xenproject.org is hosted with RackSpace, monitoring our
servers 24x7x365 and backed by RackSpace's Fanatical Support®.