Skip to content

Commit 499950d

Browse files
stephensmalleystephensmalley
committed
libsepol,checkpolicy: introduce neveraudit types
Introduce neveraudit types i.e. types that should never trigger audit messages. This allows the AVC to skip all audit-related processing for such types. Note that neveraudit differs from dontaudit not only wrt being applied for all checks with a given source type but also in that it disables all auditing, not just permission denials. When a type is both a permissive type and a neveraudit type, the security server can short-circuit the security_compute_av() logic, rendering the type equivalent to an unconfined type. Signed-off-by: Stephen Smalley <[email protected]>
1 parent f057012 commit 499950d

38 files changed

+492
-10
lines changed

‎checkpolicy/policy_define.c

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -257,6 +257,49 @@ int define_permissive(void)
257257
return rc;
258258
}
259259

260+
int define_neveraudit(void)
261+
{
262+
char *type = NULL;
263+
struct type_datum *t;
264+
int rc = 0;
265+
266+
type = queue_remove(id_queue);
267+
268+
if (!type) {
269+
yyerror2("forgot to include type in neveraudit definition?");
270+
rc = -1;
271+
goto out;
272+
}
273+
274+
if (pass == 1)
275+
goto out;
276+
277+
if (!is_id_in_scope(SYM_TYPES, type)) {
278+
yyerror2("type %s is not within scope", type);
279+
rc = -1;
280+
goto out;
281+
}
282+
283+
t = hashtab_search(policydbp->p_types.table, type);
284+
if (!t) {
285+
yyerror2("type is not defined: %s", type);
286+
rc = -1;
287+
goto out;
288+
}
289+
290+
if (t->flavor == TYPE_ATTRIB) {
291+
yyerror2("attributes may not be neveraudit: %s", type);
292+
rc = -1;
293+
goto out;
294+
}
295+
296+
t->flags |= TYPE_FLAGS_NEVERAUDIT;
297+
298+
out:
299+
free(type);
300+
return rc;
301+
}
302+
260303
int define_polcap(void)
261304
{
262305
char *id = 0;

‎checkpolicy/policy_define.h

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -45,6 +45,7 @@ int define_ipv6_cidr_node_context(void);
4545
int define_level(void);
4646
int define_netif_context(void);
4747
int define_permissive(void);
48+
int define_neveraudit(void);
4849
int define_polcap(void);
4950
int define_ibpkey_context(unsigned int low, unsigned int high);
5051
int define_ibendport_context(unsigned int port);

‎checkpolicy/policy_parse.y

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -152,6 +152,7 @@ typedef int (* require_func_t)(int pass);
152152
%token MODULE VERSION_IDENTIFIER REQUIRE OPTIONAL
153153
%token POLICYCAP
154154
%token PERMISSIVE
155+
%token NEVERAUDIT
155156
%token FILESYSTEM
156157
%token DEFAULT_USER DEFAULT_ROLE DEFAULT_TYPE DEFAULT_RANGE
157158
%token LOW_HIGH LOW HIGH GLBLUB
@@ -330,6 +331,7 @@ te_decl : attribute_def
330331
| range_trans_def
331332
| te_avtab_def
332333
| permissive_def
334+
| neveraudit_def
333335
;
334336
attribute_def : ATTRIBUTE identifier ';'
335337
{ if (define_attrib()) YYABORT;}
@@ -934,6 +936,8 @@ policycap_def : POLICYCAP identifier ';'
934936
;
935937
permissive_def : PERMISSIVE identifier ';'
936938
{if (define_permissive()) YYABORT;}
939+
neveraudit_def : NEVERAUDIT identifier ';'
940+
{if (define_neveraudit()) YYABORT;}
937941

938942
/*********** module grammar below ***********/
939943

‎checkpolicy/policy_scan.l

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -270,6 +270,8 @@ policycap |
270270
POLICYCAP { return(POLICYCAP); }
271271
permissive |
272272
PERMISSIVE { return(PERMISSIVE); }
273+
neveraudit |
274+
NEVERAUDIT { return(NEVERAUDIT); }
273275
default_user |
274276
DEFAULT_USER { return(DEFAULT_USER); }
275277
default_role |

‎checkpolicy/tests/policy_allonce.conf

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -45,6 +45,7 @@ auditallowxperm TYPE1 TYPE2 : CLASS1 ioctl 0x2;
4545
dontauditxperm TYPE1 TYPE2 : CLASS1 ioctl 0x3;
4646
neverallowxperm TYPE1 TYPE2 : CLASS1 ioctl 0x4;
4747
permissive TYPE1;
48+
neveraudit TYPE1;
4849
attribute_role ROLE_ATTR1;
4950
role ROLE1;
5051
role ROLE3;

‎checkpolicy/tests/policy_allonce.expected.conf

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,7 @@ typealias TYPE4 alias TYPEALIAS4;
3131
typebounds TYPE4 TYPE3;
3232
typeattribute TYPE4 ATTR2;
3333
permissive TYPE1;
34+
neveraudit TYPE1;
3435
allow TYPE1 self:CLASS1 { PERM1 };
3536
allow TYPE1 self:CLASS2 { CPERM1 };
3637
auditallow TYPE1 TYPE3:CLASS1 { PERM1 };

‎checkpolicy/tests/policy_allonce.expected_opt.conf

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,7 @@ typealias TYPE4 alias TYPEALIAS4;
3131
typebounds TYPE4 TYPE3;
3232
typeattribute TYPE4 ATTR2;
3333
permissive TYPE1;
34+
neveraudit TYPE1;
3435
allow TYPE1 self:CLASS1 { PERM1 };
3536
allow TYPE1 self:CLASS2 { CPERM1 };
3637
auditallow TYPE1 TYPE3:CLASS1 { PERM1 };

‎checkpolicy/tests/policy_allonce_mls.conf

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -53,6 +53,7 @@ auditallowxperm TYPE1 TYPE2 : CLASS1 ioctl 0x2;
5353
dontauditxperm TYPE1 TYPE2 : CLASS1 ioctl 0x3;
5454
neverallowxperm TYPE1 TYPE2 : CLASS1 ioctl 0x4;
5555
permissive TYPE1;
56+
neveraudit TYPE1;
5657
attribute_role ROLE_ATTR1;
5758
role ROLE1;
5859
role ROLE3;

‎checkpolicy/tests/policy_allonce_mls.expected.conf

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -39,6 +39,7 @@ typealias TYPE4 alias TYPEALIAS4;
3939
typebounds TYPE4 TYPE3;
4040
typeattribute TYPE4 ATTR2;
4141
permissive TYPE1;
42+
neveraudit TYPE1;
4243
allow TYPE1 self:CLASS1 { PERM1 };
4344
allow TYPE1 self:CLASS2 { CPERM1 };
4445
auditallow TYPE1 TYPE3:CLASS1 { PERM1 };

‎checkpolicy/tests/policy_allonce_mls.expected_opt.conf

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -39,6 +39,7 @@ typealias TYPE4 alias TYPEALIAS4;
3939
typebounds TYPE4 TYPE3;
4040
typeattribute TYPE4 ATTR2;
4141
permissive TYPE1;
42+
neveraudit TYPE1;
4243
allow TYPE1 self:CLASS1 { PERM1 };
4344
allow TYPE1 self:CLASS2 { CPERM1 };
4445
auditallow TYPE1 TYPE3:CLASS1 { PERM1 };

‎libsepol/cil/src/cil.c

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -171,6 +171,7 @@ char *CIL_KEY_TYPEALIAS;
171171
char *CIL_KEY_TYPEALIASACTUAL;
172172
char *CIL_KEY_TYPEBOUNDS;
173173
char *CIL_KEY_TYPEPERMISSIVE;
174+
char *CIL_KEY_TYPENEVERAUDIT;
174175
char *CIL_KEY_RANGETRANSITION;
175176
char *CIL_KEY_USERROLE;
176177
char *CIL_KEY_ROLETYPE;
@@ -320,6 +321,7 @@ static void cil_init_keys(void)
320321
CIL_KEY_TYPEALIASACTUAL = cil_strpool_add("typealiasactual");
321322
CIL_KEY_TYPEBOUNDS = cil_strpool_add("typebounds");
322323
CIL_KEY_TYPEPERMISSIVE = cil_strpool_add("typepermissive");
324+
CIL_KEY_TYPENEVERAUDIT = cil_strpool_add("typeneveraudit");
323325
CIL_KEY_RANGETRANSITION = cil_strpool_add("rangetransition");
324326
CIL_KEY_USERROLE = cil_strpool_add("userrole");
325327
CIL_KEY_ROLETYPE = cil_strpool_add("roletype");
@@ -939,6 +941,9 @@ void cil_destroy_data(void **data, enum cil_flavor flavor)
939941
case CIL_TYPEPERMISSIVE:
940942
cil_destroy_typepermissive(*data);
941943
break;
944+
case CIL_TYPENEVERAUDIT:
945+
cil_destroy_typeneveraudit(*data);
946+
break;
942947
case CIL_SENS:
943948
cil_destroy_sensitivity(*data);
944949
break;
@@ -1310,6 +1315,8 @@ const char * cil_node_to_string(struct cil_tree_node *node)
13101315
return CIL_KEY_TYPEBOUNDS;
13111316
case CIL_TYPEPERMISSIVE:
13121317
return CIL_KEY_TYPEPERMISSIVE;
1318+
case CIL_TYPENEVERAUDIT:
1319+
return CIL_KEY_TYPENEVERAUDIT;
13131320
case CIL_SENS:
13141321
return CIL_KEY_SENSITIVITY;
13151322
case CIL_SENSALIAS:
@@ -2451,6 +2458,14 @@ void cil_typepermissive_init(struct cil_typepermissive **typeperm)
24512458
(*typeperm)->type = NULL;
24522459
}
24532460

2461+
void cil_typeneveraudit_init(struct cil_typeneveraudit **typeperm)
2462+
{
2463+
*typeperm = cil_malloc(sizeof(**typeperm));
2464+
2465+
(*typeperm)->type_str = NULL;
2466+
(*typeperm)->type = NULL;
2467+
}
2468+
24542469
void cil_nametypetransition_init(struct cil_nametypetransition **nametypetrans)
24552470
{
24562471
*nametypetrans = cil_malloc(sizeof(**nametypetrans));

‎libsepol/cil/src/cil_binary.c

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -564,6 +564,27 @@ int cil_typepermissive_to_policydb(policydb_t *pdb, struct cil_typepermissive *c
564564

565565
}
566566

567+
int cil_typeneveraudit_to_policydb(policydb_t *pdb, struct cil_typeneveraudit *cil_typeperm)
568+
{
569+
int rc = SEPOL_ERR;
570+
type_datum_t *sepol_type = NULL;
571+
572+
rc = __cil_get_sepol_type_datum(pdb, DATUM(cil_typeperm->type), &sepol_type);
573+
if (rc != SEPOL_OK) goto exit;
574+
575+
if (ebitmap_set_bit(&pdb->neveraudit_map, sepol_type->s.value, 1)) {
576+
goto exit;
577+
}
578+
579+
return SEPOL_OK;
580+
581+
exit:
582+
type_datum_destroy(sepol_type);
583+
free(sepol_type);
584+
return rc;
585+
586+
}
587+
567588
int cil_typeattribute_to_policydb(policydb_t *pdb, struct cil_typeattribute *cil_attr, void *type_value_to_cil[])
568589
{
569590
int rc = SEPOL_ERR;
@@ -4101,6 +4122,9 @@ static int __cil_node_to_policydb(struct cil_tree_node *node, void *extra_args)
41014122
case CIL_TYPEPERMISSIVE:
41024123
rc = cil_typepermissive_to_policydb(pdb, node->data);
41034124
break;
4125+
case CIL_TYPENEVERAUDIT:
4126+
rc = cil_typeneveraudit_to_policydb(pdb, node->data);
4127+
break;
41044128
case CIL_TYPEATTRIBUTE:
41054129
rc = cil_typeattribute_to_bitmap(pdb, db, node->data);
41064130
break;

‎libsepol/cil/src/cil_binary.h

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -136,6 +136,18 @@ int cil_typealias_to_policydb(policydb_t *pdb, struct cil_alias *cil_alias);
136136
*/
137137
int cil_typepermissive_to_policydb(policydb_t *pdb, struct cil_typepermissive *cil_typeperm);
138138

139+
/**
140+
* Insert cil typeneveraudit structure into sepol policydb.
141+
* The function looks up the previously inserted type and flips the bit
142+
* in the neveraudit types bitmap that corresponds to that type's value.
143+
*
144+
* @param[in] pdb The policy database to insert the typeneveraudit into.
145+
* @param[in] datum The cil_typeneveraudit datum.
146+
*
147+
* @return SEPOL_OK upon success or an error otherwise.
148+
*/
149+
int cil_typeneveraudit_to_policydb(policydb_t *pdb, struct cil_typeneveraudit *cil_typeperm);
150+
139151
/**
140152
* Insert cil attribute structure into sepol policydb.
141153
*

‎libsepol/cil/src/cil_build_ast.c

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3374,6 +3374,50 @@ void cil_destroy_typepermissive(struct cil_typepermissive *typeperm)
33743374
free(typeperm);
33753375
}
33763376

3377+
int cil_gen_typeneveraudit(struct cil_db *db, struct cil_tree_node *parse_current, struct cil_tree_node *ast_node)
3378+
{
3379+
enum cil_syntax syntax[] = {
3380+
CIL_SYN_STRING,
3381+
CIL_SYN_STRING,
3382+
CIL_SYN_END
3383+
};
3384+
size_t syntax_len = sizeof(syntax)/sizeof(*syntax);
3385+
struct cil_typeneveraudit *typeperm = NULL;
3386+
int rc = SEPOL_ERR;
3387+
3388+
if (db == NULL || parse_current == NULL || ast_node == NULL) {
3389+
goto exit;
3390+
}
3391+
3392+
rc = __cil_verify_syntax(parse_current, syntax, syntax_len);
3393+
if (rc != SEPOL_OK) {
3394+
goto exit;
3395+
}
3396+
3397+
cil_typeneveraudit_init(&typeperm);
3398+
3399+
typeperm->type_str = parse_current->next->data;
3400+
3401+
ast_node->data = typeperm;
3402+
ast_node->flavor = CIL_TYPENEVERAUDIT;
3403+
3404+
return SEPOL_OK;
3405+
3406+
exit:
3407+
cil_tree_log(parse_current, CIL_ERR, "Bad typeneveraudit declaration");
3408+
cil_destroy_typeneveraudit(typeperm);
3409+
return rc;
3410+
}
3411+
3412+
void cil_destroy_typeneveraudit(struct cil_typeneveraudit *typeperm)
3413+
{
3414+
if (typeperm == NULL) {
3415+
return;
3416+
}
3417+
3418+
free(typeperm);
3419+
}
3420+
33773421
int cil_gen_typetransition(struct cil_db *db, struct cil_tree_node *parse_current, struct cil_tree_node *ast_node)
33783422
{
33793423
int rc = SEPOL_ERR;
@@ -6255,6 +6299,8 @@ static struct cil_tree_node * parse_statement(struct cil_db *db, struct cil_tree
62556299
rc = cil_gen_bounds(db, parse_current, new_ast_node, CIL_TYPE);
62566300
} else if (parse_current->data == CIL_KEY_TYPEPERMISSIVE) {
62576301
rc = cil_gen_typepermissive(db, parse_current, new_ast_node);
6302+
} else if (parse_current->data == CIL_KEY_TYPENEVERAUDIT) {
6303+
rc = cil_gen_typeneveraudit(db, parse_current, new_ast_node);
62586304
} else if (parse_current->data == CIL_KEY_RANGETRANSITION) {
62596305
rc = cil_gen_rangetransition(db, parse_current, new_ast_node);
62606306
} else if (parse_current->data == CIL_KEY_ROLE) {

‎libsepol/cil/src/cil_build_ast.h

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -146,7 +146,9 @@ int cil_gen_expandtypeattribute(struct cil_db *db, struct cil_tree_node *parse_c
146146
void cil_destroy_expandtypeattribute(struct cil_expandtypeattribute *expandattr);
147147
int cil_gen_typebounds(struct cil_db *db, struct cil_tree_node *parse_current, struct cil_tree_node *ast_node);
148148
int cil_gen_typepermissive(struct cil_db *db, struct cil_tree_node *parse_current, struct cil_tree_node *ast_node);
149+
int cil_gen_typeneveraudit(struct cil_db *db, struct cil_tree_node *parse_current, struct cil_tree_node *ast_node);
149150
void cil_destroy_typepermissive(struct cil_typepermissive *typeperm);
151+
void cil_destroy_typeneveraudit(struct cil_typeneveraudit *typeperm);
150152
int cil_gen_typetransition(struct cil_db *db, struct cil_tree_node *parse_current, struct cil_tree_node *ast_node);
151153
void cil_destroy_typetransition(struct cil_nametypetransition *nametypetrans);
152154
int cil_gen_rangetransition(struct cil_db *db, struct cil_tree_node *parse_current, struct cil_tree_node *ast_node);

‎libsepol/cil/src/cil_copy_ast.c

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -608,6 +608,20 @@ int cil_copy_typepermissive(__attribute__((unused)) struct cil_db *db, void *dat
608608
return SEPOL_OK;
609609
}
610610

611+
int cil_copy_typeneveraudit(__attribute__((unused)) struct cil_db *db, void *data, void **copy, __attribute__((unused)) symtab_t *symtab)
612+
{
613+
struct cil_typeneveraudit *orig = data;
614+
struct cil_typeneveraudit *new = NULL;
615+
616+
cil_typeneveraudit_init(&new);
617+
618+
new->type_str = orig->type_str;
619+
620+
*copy = new;
621+
622+
return SEPOL_OK;
623+
}
624+
611625
int cil_copy_typeattribute(__attribute__((unused)) struct cil_db *db, __attribute__((unused)) void *data, void **copy, __attribute__((unused)) symtab_t *symtab)
612626
{
613627
struct cil_typeattribute *new;
@@ -1807,6 +1821,9 @@ static int __cil_copy_node_helper(struct cil_tree_node *orig, uint32_t *finished
18071821
case CIL_TYPEPERMISSIVE:
18081822
copy_func = cil_copy_typepermissive;
18091823
break;
1824+
case CIL_TYPENEVERAUDIT:
1825+
copy_func = cil_copy_typeneveraudit;
1826+
break;
18101827
case CIL_TYPEATTRIBUTE:
18111828
copy_func = &cil_copy_typeattribute;
18121829
break;

‎libsepol/cil/src/cil_copy_ast.h

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -72,6 +72,7 @@ int cil_copy_roleallow(struct cil_db *db, void *data, void **copy, symtab_t *sym
7272
int cil_copy_type(struct cil_db *db, void *data, void **copy, symtab_t *symtab);
7373
int cil_copy_typebounds(struct cil_db *db, void *data, void **copy, symtab_t *symtab);
7474
int cil_copy_typepermissive(struct cil_db *db, void *data, void **copy, symtab_t *symtab);
75+
int cil_copy_typeneveraudit(struct cil_db *db, void *data, void **copy, symtab_t *symtab);
7576
int cil_copy_typeattribute(struct cil_db *db, void *data, void **copy, symtab_t *symtab);
7677
int cil_copy_typeattributeset(struct cil_db *db, void *data, void **copy, symtab_t *symtab);
7778
int cil_copy_typealias(struct cil_db *db, void *data, void **copy, symtab_t *symtab);

‎libsepol/cil/src/cil_flavor.h

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -77,6 +77,7 @@ enum cil_flavor {
7777
CIL_TYPEALIASACTUAL,
7878
CIL_TYPEBOUNDS,
7979
CIL_TYPEPERMISSIVE,
80+
CIL_TYPENEVERAUDIT,
8081
CIL_SENSALIASACTUAL,
8182
CIL_SENSITIVITYORDER,
8283
CIL_SENSCAT,

‎libsepol/cil/src/cil_internal.h

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -188,6 +188,7 @@ extern char *CIL_KEY_TYPEALIAS;
188188
extern char *CIL_KEY_TYPEALIASACTUAL;
189189
extern char *CIL_KEY_TYPEBOUNDS;
190190
extern char *CIL_KEY_TYPEPERMISSIVE;
191+
extern char *CIL_KEY_TYPENEVERAUDIT;
191192
extern char *CIL_KEY_RANGETRANSITION;
192193
extern char *CIL_KEY_USERROLE;
193194
extern char *CIL_KEY_ROLETYPE;
@@ -580,6 +581,11 @@ struct cil_typepermissive {
580581
void *type; /* type or alias */
581582
};
582583

584+
struct cil_typeneveraudit {
585+
char *type_str;
586+
void *type; /* type or alias */
587+
};
588+
583589
struct cil_nametypetransition {
584590
char *src_str;
585591
void *src; /* type, alias, or attribute */
@@ -1045,6 +1051,7 @@ void cil_expandtypeattribute_init(struct cil_expandtypeattribute **expandattr);
10451051
void cil_alias_init(struct cil_alias **alias);
10461052
void cil_aliasactual_init(struct cil_aliasactual **aliasactual);
10471053
void cil_typepermissive_init(struct cil_typepermissive **typeperm);
1054+
void cil_typeneveraudit_init(struct cil_typeneveraudit **typeperm);
10481055
void cil_nametypetransition_init(struct cil_nametypetransition **nametypetrans);
10491056
void cil_rangetransition_init(struct cil_rangetransition **rangetrans);
10501057
void cil_bool_init(struct cil_bool **cilbool);

0 commit comments

Comments
 (0)