Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Disjoint Attributes Rule #359

Open
wants to merge 6 commits into
base: main
Choose a base branch
from
Open

Disjoint Attributes Rule #359

wants to merge 6 commits into from

Conversation

cgzones
Copy link
Contributor

@cgzones cgzones commented Jun 29, 2022

No description provided.

@cgzones cgzones force-pushed the z35_segregate_attributes branch 2 times, most recently from de29a2d to 7f6d770 Compare July 21, 2022 15:01
@cgzones
libsepol: add ebitmap iterator wrapper with startnode
e46d08f 
Similar like ebitmap_for_each_bit() iterates over all bits of an ebitmap
add ebitmap_for_each_bit_starting() iterating over all bits starting
from a specific node and bit, which can be from an outer iteration.

Signed-off-by: Christian Göttsche <[email protected]>
---
v4:
   merge two statements into for loop initializer
v2:
   * use _after suffix
   * reorder parameters
@cgzones
libsepol: add compile-time constraint for mutual exclusive attributes
054e921 
Add a new compile-time constraint, similar to neverallow, which enables
to specify two or more type attributes to be mutual exclusive.  This
means no type can be associated with more than one of them.

The constraints are stored as a linked-list in the policy for modular
policies, by a new modular policy version, and are discarded in kernel
policies, not needing any kernel support.

Some Reference Policy examples:

    unpriv_userdomain, admindomain:

        <no violations>

    client_packet_type, server_packet_type:

        <no violations>

    auth_file_type, non_auth_file_type:

        <no violations>

    pseudofs, xattrfs, noxattrfs:

         <no violations>

    reserved_port_type, unreserved_port_type:

         <no violations>

    security_file_type, non_security_file_type:

        libsepol.check_disjoint_attributes: Disjoint Attributes Rule violation, type dnssec_t associated with attributes security_file_type and non_security_file_type

    ibendport_type, packet_type, sysctl_type, device_node, ibpkey_type,
    sysfs_types, domain, boolean_type, netif_type, file_type, node_type,
    proc_type, port_type:

        libsepol.check_disjoint_attributes: Disjoint Attributes Rule violation, type sysctl_fs_t associated with attributes sysctl_type and file_type
        libsepol.check_disjoint_attributes: Disjoint Attributes Rule violation, type sysctl_t associated with attributes sysctl_type and file_type
        libsepol.check_disjoint_attributes: Disjoint Attributes Rule violation, type virt_content_t associated with attributes device_node and file_type
        libsepol.check_disjoint_attributes: Disjoint Attributes Rule violation, type initrc_devpts_t associated with attributes device_node and file_type
        libsepol.check_disjoint_attributes: Disjoint Attributes Rule violation, type qemu_image_t associated with attributes device_node and file_type
        libsepol.check_disjoint_attributes: Disjoint Attributes Rule violation, type user_devpts_t associated with attributes device_node and file_type
        libsepol.check_disjoint_attributes: Disjoint Attributes Rule violation, type cardmgr_dev_t associated with attributes device_node and file_type
        libsepol.check_disjoint_attributes: Disjoint Attributes Rule violation, type bootloader_tmp_t associated with attributes device_node and file_type
        libsepol.check_disjoint_attributes: Disjoint Attributes Rule violation, type xen_image_t associated with attributes device_node and file_type
        libsepol.check_disjoint_attributes: Disjoint Attributes Rule violation, type svirt_prot_exec_image_t associated with attributes device_node and file_type
        libsepol.check_disjoint_attributes: Disjoint Attributes Rule violation, type xen_devpts_t associated with attributes device_node and file_type
        libsepol.check_disjoint_attributes: Disjoint Attributes Rule violation, type svirt_image_t associated with attributes device_node and file_type
        libsepol.check_disjoint_attributes: Disjoint Attributes Rule violation, type virt_image_t associated with attributes device_node and file_type
        libsepol.check_disjoint_attributes: Disjoint Attributes Rule violation, type container_file_t associated with attributes device_node and file_type
        libsepol.check_disjoint_attributes: Disjoint Attributes Rule violation, type cpu_online_t associated with attributes sysfs_types and file_type
        libsepol.check_disjoint_attributes: Disjoint Attributes Rule violation, type sysfs_t associated with attributes sysfs_types and file_type
        libsepol.check_disjoint_attributes: Disjoint Attributes Rule violation, type dockerc_t associated with attributes domain and file_type
        libsepol.check_disjoint_attributes: Disjoint Attributes Rule violation, type proc_t associated with attributes file_type and proc_type
        libsepol.check_disjoint_attributes: Disjoint Attributes Rule violation, type proc_xen_t associated with attributes file_type and proc_type

    libsepol.check_assertions: 20 Disjoint Attributes Rule failures occurred

Closes: SELinuxProject#42

Signed-off-by: Christian Göttsche <[email protected]>
---
v4:
   rename to disjoint attributes
v3:
   - drop source location information:
     this information was already lost for binary modular policies and
     CIL policies; also typeattribute statements have none and the few
     segregate_attributes statements can be easily grepped
   - misc renaming
v2:
   rebase onto _after suffix change
@cgzones
checkpolicy: add front-end support for disjoint attributes
b26a942 
Support specifying disjoint attributes rules.

The following two blocks are equivalent and prevent at compile time that
any type can be associated with more than one of the listed attributes:

    disjoint_attributes attr1, attr2, attr3;

    disjoint_attributes attr1, attr2;
    disjoint_attributes attr1, attr3;
    disjoint_attributes attr2, attr3;

Accept more than two attributes with a rule to avoid quadratic growth of
necessary statements for a group of attributes.

Signed-off-by: Christian Göttsche <[email protected]>
---
v4:
   rename to disjoint_attributes
@cgzones
libsepol/tests: add test for disjoint attributes
fbf66c0 
Test assertions are correctly computed and linking and expanding of
modules works correctly.

Signed-off-by: Christian Göttsche <[email protected]>
---
v4:
   rename to disjoint attributes
@cgzones cgzones changed the base branch from master to main April 29, 2024 20:09
@cgzones cgzones changed the title segregate attributes Disjoint Attributes Rule Apr 29, 2024
@cgzones
libsepol/cil: add support for segregate attributes
d9a1b82 
Support the compile time constraint with the following syntax:

    (disjointattributes (attr1 attr2 [...]))

and reports like:

    ...
    Qualifying Names
    Compile post process
    Building policy binary
    Checking Neverallows
    Checking Segregate Attributes
    Disjoint Attributes Rule violation, type test_type associated with attributes attr1 attr2
    Checking User Bounds
    Checking Role Bounds
    Checking Type Bounds
    Failed to generate binary
    Failed to build policydb

Signed-off-by: Christian Göttsche <[email protected]>
---
v4:
   rename to disjointattributes
@cgzones
secilc/test: add disjoint attributes rule
63e6cee 
Signed-off-by: Christian Göttsche <[email protected]>
---
v4:
   rename to disjointattributes
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
1 participant
@cgzones