policyrep: add prefix/suffix matching to filename type transitions #108
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
pebenito
requested changes
Nov 29, 2023
setools/policyrep/terule.pxi
Outdated
| @@ -476,11 +476,13 @@ cdef class FileNameTERule(BaseTERule): | |||
| cdef: | |||
| Type dft | |||
| readonly str filename | |||
| uint32_t match_type | |||
There was a problem hiding this comment.
This won't be visible in Python code, only in cython code. It needs the readonly qualifier. By making it visible, I think it should change to a PolicyEnum object.
There was a problem hiding this comment.
Hi, sorry for a late reply.
I have changed the type for a new PolicyEnum subclass that I have created and updated usages of it.
Currently, filename transitions are stored separately from other type enforcement rules and only support exact name matching. However, in practice, the names contain variable parts. This leads to many duplicated rules in the policy that differ only in the part of the name, or it is even impossible to cover all possible combinations. This patch reflects changes in libsepol implemented in this patch [1]. The patch adds additional filename transition tables to policydb structure for prefix and suffix rules and updates the functions that access them. [1]: https://lore.kernel.org/selinux/[email protected]/ Reviewed-by: Ondrej Mosnacek <[email protected]> Signed-off-by: Juraj Marcin <[email protected]>
JurajMarcin
force-pushed
the
selinux-prefix2-pr
branch
from
c172d3c to
e5876ed
Compare
|
This PR has not had any recent activity. It will be closed in 7 days if it makes no further progress. |
|
Closing stale PR. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Currently, filename transitions are stored separately from other type enforcement rules and only support exact name matching. However, in practice, the names contain variable parts. This leads to many duplicated rules in the policy that differ only in the part of the name, or it is even impossible to cover all possible combinations.
This patch reflects changes in libsepol implemented in this patch.
The patch adds additional filename transition tables to policydb structure for prefix and suffix rules and updates the functions that access them.
This is a new reimplemented version of the feature, as the previous version was not accepted by the SELinux kernel upstream.
Reviewed-by: Ondrej Mosnacek [email protected]