Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix bug in Checkmodule when downwriting to Module version 12 or lower. #273

Open
wants to merge 3 commits into
base: master
Choose a base branch
from

Conversation

deleriux
Copy link

Stumbled upon this issue attempting to port a module from Fedora 33 to EL6.

Steps to reproduce:

Try to build the following module then make a module from an older release:

module test 1.0.0;

require {
  type default_t;
}
attribute_role new_atrole;

Build

$ checkmodule -M -m -c 12 -o test.mod test.te
$ semodule_package -o test.pp -m test.mod
$ semodule_package:  Error while reading policy module from test.mod

With fix:

$ checkmodule -o test.mod -M -m -c12 test.te 
libsepol.policydb_write: Discarding role attribute rules
$ semodule_package -o test.pp -m test.mod

Failure occurs when the current module gets written out as the scope declaration remains intact.
semodule_package files correctly at policydb.c:3913 doing a hash table search on a scope key that is not
in the symbol table.

This patch fixes the problem by removing the hashtable entries and scope declarations properly prior to module write and emits a warning to the user of the unsupported statements.

Also altered hashtap_map slightly to allow it to be used for hashtab_remove calls in order to support the patch.

Matthew Ife added 2 commits November 30, 2020 11:20
… versions.

The current implementation fails as it doesn't remove scope declarations further in
the modular policy.

This fixes the problem by removing the offending entries in the hash table and
the scope table.

Steps to reproduce:

Try to build the following module then make a module from an older release:
module test 1.0.0;

require {
  type default_t;
}
attribute_role new_atrole;
checkmodule -M -m -c 12 -o test.mod test.te
semodule_package -o test.pp -m test.mod
semodule_package:  Error while reading policy module from test.mod

Failure occurs when the current module gets written out with the scope declaration intact.
This is due to policydb.c:3913 doing a hashtab search on a scope key that is not
in the symbol table.

Signed-off-by: Matthew Ife <matthew@home.home.ife.onl>
Signed-off-by: Matthew Ife <matthew@home.home.ife.onl>
Signed-off-by: Matthew Ife <matthew@ife.onl>
@bachradsusi
Copy link
Member

bachradsusi commented May 30, 2023

This PR was somehow missed in past. Is it still relevant?

In order to get the patch reviewed and accepted, it's necessary to send it to selinux@vger.kernel.org mailing list. The best way is to use git send-email command, e.g.:

git send-email --from='Your Name <your@email.address>' --to=selinux@vger.kernel.org --smtp-server=my.smtp.server --confirm=auto -1

Please also note that the project moved the development to main branch - https://lore.kernel.org/selinux/CAHC9VhTo0LnHwfnF1kfNcosUDdB=MtBQePemR+ju81_GFSuGiA@mail.gmail.com/T/#u

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants