Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Allow M4 escaped strings inside QUOTED_STRING #289

Closed
wants to merge 1 commit into from
Closed

Allow M4 escaped strings inside QUOTED_STRING #289

wants to merge 1 commit into from

Conversation

bachradsusi
Copy link
Member

When a file name in type transition rule used in an interface is same as a keyword, it needs to be M4 escaped so that the keyword is not expanded by M4, e.g.

  • filetrans_pattern($1, virt_var_run_t, virtinterfaced_var_run_t, dir, "interface")
  • filetrans_pattern($1, virt_var_run_t, virtinterfaced_var_run_t, dir, "``interface''")

Fixes:

$ selint ./policy/modules/contrib/virt.if
Note: Check E-007 is not performed because no permission macro has been parsed.
./policy/modules/contrib/virt.if:169: (F): syntax error, unexpected UNKNOWN_TOKEN (F-001)
  169 |     filetrans_pattern($1, virt_var_run_t, virtinterfaced_var_run_t, dir, "``interface''")
      |                                                                          ^
./policy/modules/contrib/virt.if:169: (F): Error: Invalid statement (F-001)
  169 |     filetrans_pattern($1, virt_var_run_t, virtinterfaced_var_run_t, dir, "``interface''")
      |     ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Error: Failed to parse files

@bachradsusi
Allow M4 escaped strings inside QUOTED_STRING
7f28f7f 
When a file name in type transition rule used in an interface is same as
a keyword, it needs to be M4 escaped so that the keyword is not expanded
by M4, e.g.

-	filetrans_pattern($1, virt_var_run_t, virtinterfaced_var_run_t, dir, "interface")
+	filetrans_pattern($1, virt_var_run_t, virtinterfaced_var_run_t, dir, "``interface''")

Fixes:

    $ selint ./policy/modules/contrib/virt.if
    Note: Check E-007 is not performed because no permission macro has been parsed.
    ./policy/modules/contrib/virt.if:169: (F): syntax error, unexpected UNKNOWN_TOKEN (F-001)
      169 |     filetrans_pattern($1, virt_var_run_t, virtinterfaced_var_run_t, dir, "``interface''")
          |                                                                          ^
    ./policy/modules/contrib/virt.if:169: (F): Error: Invalid statement (F-001)
      169 |     filetrans_pattern($1, virt_var_run_t, virtinterfaced_var_run_t, dir, "``interface''")
          |     ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    Error: Failed to parse files
@bachradsusi
Copy link
Member Author

Why it's necessary to escape "interface":

$ cat > test.m4 <<EOF
define(`interface',` dnl
        ifdef(`$1',`refpolicywarn(`duplicate definition of $1(). Original definition on '$1.) define(`__if_error')',`define(`$1',__file__:__line__)') dnl
        `define(`$1',` dnl
        pushdef(`policy_call_depth',incr(policy_call_depth)) dnl
        policy_m4_comment(policy_call_depth,begin `$1'(dollarsstar)) dnl
        $2
        popdef(`policy_call_depth') dnl
        policy_m4_comment(policy_call_depth,end `$1'(dollarsstar)) dnl
        '')
')

define(`filetrans_pattern',`
        allow $1 $2:dir rw_dir_perms;
        type_transition $1 $2:$4 $3 $5;
')

define(`virt_driver_template',`
filetrans_pattern($1, virt_var_run_t, virtinterfaced_var_run_t, dir, "interface")
')

virt_driver_template(vms_t)
EOF

$ m4 test.m4 

        allow vms_t virt_var_run_t:dir rw_dir_perms;
        type_transition vms_t virt_var_run_t:dir virtinterfaced_var_run_t "

with "``interface''":

$ cat > test.m4 <<EOF
define(`interface',` dnl
        ifdef(`$1',`refpolicywarn(`duplicate definition of $1(). Original definition on '$1.) define(`__if_error')',`define(`$1',__file__:__line__)') dnl
        `define(`$1',` dnl
        pushdef(`policy_call_depth',incr(policy_call_depth)) dnl
        policy_m4_comment(policy_call_depth,begin `$1'(dollarsstar)) dnl
        $2
        popdef(`policy_call_depth') dnl
        policy_m4_comment(policy_call_depth,end `$1'(dollarsstar)) dnl
        '')
')

define(`filetrans_pattern',`
        allow $1 $2:dir rw_dir_perms;
        type_transition $1 $2:$4 $3 $5;
')

define(`virt_driver_template',`
filetrans_pattern($1, virt_var_run_t, virtinterfaced_var_run_t, dir, "``interface''")
')

virt_driver_template(vms_t)
EOF

$ m4 test.m4 
        allow vms_t virt_var_run_t:dir rw_dir_perms;
        type_transition vms_t virt_var_run_t:dir virtinterfaced_var_run_t "interface";

see also https://bugzilla.redhat.com/show_bug.cgi?id=2254206#c6

cgzones added a commit to cgzones/selint that referenced this pull request Aug 24, 2024
@cgzones
Support m4 quoted strings in interface call arguments
ed58cb9 
Required for escaped strings, that would otherwise be replaced by m4,
e.g. "interface":

    filetrans_pattern(foo_t, bar_run_t, baz_run_t, dir, ``"interface"'')

Replaces: SELinuxProject#289
@cgzones cgzones mentioned this pull request Aug 24, 2024
Merged
@cgzones
Copy link
Contributor

cgzones commented Aug 24, 2024

See alternative with syntax

``"interface"''

in #291.

@bachradsusi
Copy link
Member Author

Lets move to #291

dburgener pushed a commit that referenced this pull request Aug 28, 2024
@cgzones @dburgener
Support m4 quoted strings in interface call arguments
1157cb9 
Required for escaped strings, that would otherwise be replaced by m4,
e.g. "interface":

    filetrans_pattern(foo_t, bar_run_t, baz_run_t, dir, ``"interface"'')

Replaces: #289
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@bachradsusi @cgzones