aboutsummaryrefslogtreecommitdiffstats
path: root/libsepol
diff options
context:
space:
mode:
Diffstat (limited to 'libsepol')
-rw-r--r--libsepol/VERSION2
-rw-r--r--libsepol/cil/src/cil_binary.c14
-rw-r--r--libsepol/cil/src/cil_resolve_ast.c9
-rw-r--r--libsepol/cil/src/cil_symtab.c1
-rw-r--r--libsepol/cil/src/cil_write_ast.c4
-rw-r--r--libsepol/man/Makefile19
-rw-r--r--libsepol/man/ru/man8/chkcon.839
-rw-r--r--libsepol/src/expand.c6
-rw-r--r--libsepol/src/kernel_to_cil.c6
-rw-r--r--libsepol/src/kernel_to_conf.c2
-rw-r--r--libsepol/src/module_to_cil.c4
-rw-r--r--libsepol/src/util.c4
12 files changed, 95 insertions, 15 deletions
diff --git a/libsepol/VERSION b/libsepol/VERSION
index a4412fa7..29cba064 100644
--- a/libsepol/VERSION
+++ b/libsepol/VERSION
@@ -1 +1 @@
-2.8
+2.9-rc1
diff --git a/libsepol/cil/src/cil_binary.c b/libsepol/cil/src/cil_binary.c
index 0cc6eeb1..e2eb3ebe 100644
--- a/libsepol/cil/src/cil_binary.c
+++ b/libsepol/cil/src/cil_binary.c
@@ -54,6 +54,7 @@
#include "cil_binary.h"
#include "cil_symtab.h"
#include "cil_find.h"
+#include "cil_build_ast.h"
/* There are 44000 filename_trans in current fedora policy. 1.33 times this is the recommended
* size of a hashtable. The next power of 2 of this is 2 ** 16.
@@ -930,7 +931,7 @@ int cil_sensalias_to_policydb(policydb_t *pdb, struct cil_alias *cil_alias)
exit:
level_datum_destroy(sepol_alias);
- free(sepol_level);
+ free(sepol_alias);
free(key);
return rc;
}
@@ -1763,11 +1764,13 @@ int __cil_avrulex_ioctl_to_hashtable(hashtab_t h, uint16_t kind, uint32_t src, u
hashtab_xperms = cil_malloc(sizeof(*hashtab_xperms));
rc = ebitmap_cpy(hashtab_xperms, xperms);
if (rc != SEPOL_OK) {
+ free(hashtab_xperms);
free(avtab_key);
goto exit;
}
rc = hashtab_insert(h, (hashtab_key_t)avtab_key, hashtab_xperms);
if (rc != SEPOL_OK) {
+ free(hashtab_xperms);
free(avtab_key);
goto exit;
}
@@ -2072,6 +2075,7 @@ static void __cil_expr_to_string(struct cil_list *expr, enum cil_flavor flavor,
char *c2 = NULL;
__cil_expr_to_string_helper(curr, flavor, &c1);
for (curr = curr->next; curr; curr = curr->next) {
+ s1 = NULL;
__cil_expr_to_string_helper(curr, flavor, &s1);
cil_asprintf(&c2, "%s %s", c1, s1);
free(c1);
@@ -2157,6 +2161,7 @@ static int __cil_cond_expr_to_sepol_expr_helper(policydb_t *pdb, struct cil_list
op->expr_type = COND_NEQ;
break;
default:
+ free(op);
goto exit;
}
@@ -2283,6 +2288,7 @@ int cil_booleanif_to_policydb(policydb_t *pdb, const struct cil_db *db, struct c
cond_expr_destroy(tmp_cond->expr);
free(tmp_cond);
+ tmp_cond = NULL;
for (cb_node = node->cl_head; cb_node != NULL; cb_node = cb_node->next) {
if (cb_node->flavor == CIL_CONDBLOCK) {
@@ -2327,6 +2333,11 @@ int cil_booleanif_to_policydb(policydb_t *pdb, const struct cil_db *db, struct c
return SEPOL_OK;
exit:
+ if (tmp_cond) {
+ if (tmp_cond->expr)
+ cond_expr_destroy(tmp_cond->expr);
+ free(tmp_cond);
+ }
return rc;
}
@@ -4797,6 +4808,7 @@ static struct cil_list *cil_classperms_from_sepol(policydb_t *pdb, uint16_t clas
return cp_list;
exit:
+ cil_destroy_classperms(cp);
cil_log(CIL_ERR,"Failed to create CIL class-permissions from sepol values\n");
return NULL;
}
diff --git a/libsepol/cil/src/cil_resolve_ast.c b/libsepol/cil/src/cil_resolve_ast.c
index fb9d9174..ea08087d 100644
--- a/libsepol/cil/src/cil_resolve_ast.c
+++ b/libsepol/cil/src/cil_resolve_ast.c
@@ -1535,6 +1535,7 @@ int cil_resolve_sidorder(struct cil_tree_node *current, void *extra_args)
return SEPOL_OK;
exit:
+ cil_list_destroy(&new, CIL_FALSE);
return rc;
}
@@ -1591,6 +1592,7 @@ int cil_resolve_catorder(struct cil_tree_node *current, void *extra_args)
return SEPOL_OK;
exit:
+ cil_list_destroy(&new, CIL_FALSE);
return rc;
}
@@ -1624,6 +1626,7 @@ int cil_resolve_sensitivityorder(struct cil_tree_node *current, void *extra_args
return SEPOL_OK;
exit:
+ cil_list_destroy(&new, CIL_FALSE);
return rc;
}
@@ -2853,6 +2856,7 @@ int cil_resolve_call1(struct cil_tree_node *current, void *extra_args)
rc = cil_fill_cats(pc, &catset->cats);
if (rc != SEPOL_OK) {
cil_destroy_catset(catset);
+ cil_destroy_args(new_arg);
goto exit;
}
cil_tree_node_init(&cat_node);
@@ -2877,6 +2881,7 @@ int cil_resolve_call1(struct cil_tree_node *current, void *extra_args)
if (rc != SEPOL_OK) {
cil_log(CIL_ERR, "Failed to create anonymous level, rc: %d\n", rc);
cil_destroy_level(level);
+ cil_destroy_args(new_arg);
goto exit;
}
cil_tree_node_init(&lvl_node);
@@ -2901,6 +2906,7 @@ int cil_resolve_call1(struct cil_tree_node *current, void *extra_args)
if (rc != SEPOL_OK) {
cil_log(CIL_ERR, "Failed to create anonymous levelrange, rc: %d\n", rc);
cil_destroy_levelrange(range);
+ cil_destroy_args(new_arg);
goto exit;
}
cil_tree_node_init(&range_node);
@@ -2925,6 +2931,7 @@ int cil_resolve_call1(struct cil_tree_node *current, void *extra_args)
if (rc != SEPOL_OK) {
cil_log(CIL_ERR, "Failed to create anonymous ip address, rc: %d\n", rc);
cil_destroy_ipaddr(ipaddr);
+ cil_destroy_args(new_arg);
goto exit;
}
cil_tree_node_init(&addr_node);
@@ -2955,6 +2962,7 @@ int cil_resolve_call1(struct cil_tree_node *current, void *extra_args)
if (rc != SEPOL_OK) {
cil_log(CIL_ERR, "Failed to create anonymous classpermission\n");
cil_destroy_classpermission(cp);
+ cil_destroy_args(new_arg);
goto exit;
}
cil_tree_node_init(&cp_node);
@@ -2970,6 +2978,7 @@ int cil_resolve_call1(struct cil_tree_node *current, void *extra_args)
default:
cil_log(CIL_ERR, "Unexpected flavor: %d\n",
(((struct cil_param*)item->data)->flavor));
+ cil_destroy_args(new_arg);
rc = SEPOL_ERR;
goto exit;
}
diff --git a/libsepol/cil/src/cil_symtab.c b/libsepol/cil/src/cil_symtab.c
index 3769979b..2970b863 100644
--- a/libsepol/cil/src/cil_symtab.c
+++ b/libsepol/cil/src/cil_symtab.c
@@ -185,6 +185,7 @@ int cil_complex_symtab_insert(struct cil_complex_symtab *symtab,
ckey->key2 == curr->ckey->key2 &&
ckey->key3 == curr->ckey->key3 &&
ckey->key4 == curr->ckey->key4) {
+ free(node);
return SEPOL_EEXIST;
}
diff --git a/libsepol/cil/src/cil_write_ast.c b/libsepol/cil/src/cil_write_ast.c
index 3b252db7..bcf5f416 100644
--- a/libsepol/cil/src/cil_write_ast.c
+++ b/libsepol/cil/src/cil_write_ast.c
@@ -1153,7 +1153,6 @@ exit:
static int __cil_write_node_helper(struct cil_tree_node *node, uint32_t *finished, void *extra_args)
{
int rc = SEPOL_OK;
- struct cil_db *db = NULL;
struct cil_args_write *args = NULL;
FILE *cil_out = NULL;
@@ -1162,7 +1161,6 @@ static int __cil_write_node_helper(struct cil_tree_node *node, uint32_t *finishe
}
args = extra_args;
- db = args->db;
cil_out = args->cil_out;
switch (node->flavor) {
@@ -1462,7 +1460,6 @@ exit:
static int __cil_write_last_child_helper(struct cil_tree_node *node, void *extra_args)
{
int rc = SEPOL_ERR;
- struct cil_db *db = NULL;
struct cil_args_write *args = NULL;
FILE *cil_out = NULL;
@@ -1471,7 +1468,6 @@ static int __cil_write_last_child_helper(struct cil_tree_node *node, void *extra
}
args = extra_args;
- db = args->db;
cil_out = args->cil_out;
if (node->parent && node->parent->flavor != CIL_ROOT && node->parent->flavor != CIL_SRC_INFO) {
diff --git a/libsepol/man/Makefile b/libsepol/man/Makefile
index 9b754548..f54e478d 100644
--- a/libsepol/man/Makefile
+++ b/libsepol/man/Makefile
@@ -1,7 +1,11 @@
# Installation directories.
+LINGUAS ?= ru
PREFIX ?= /usr
-MAN8DIR ?= $(PREFIX)/share/man/man8
-MAN3DIR ?= $(PREFIX)/share/man/man3
+MANDIR ?= $(PREFIX)/share/man
+MAN3SUBDIR ?= man3
+MAN8SUBDIR ?= man8
+MAN3DIR ?= $(MANDIR)/$(MAN3SUBDIR)
+MAN8DIR ?= $(MANDIR)/$(MAN8SUBDIR)
all:
@@ -10,4 +14,13 @@ install: all
mkdir -p $(DESTDIR)$(MAN8DIR)
install -m 644 man3/*.3 $(DESTDIR)$(MAN3DIR)
install -m 644 man8/*.8 $(DESTDIR)$(MAN8DIR)
-
+ for lang in $(LINGUAS) ; do \
+ if [ -e $${lang}/man3 ] ; then \
+ mkdir -p $(DESTDIR)$(MANDIR)/$${lang}/$(MAN3SUBDIR) ; \
+ install -m 644 $${lang}/man3/*.3 $(DESTDIR)$(MANDIR)/$${lang}/$(MAN3SUBDIR) ; \
+ fi ; \
+ if [ -e $${lang}/man8 ] ; then \
+ mkdir -p $(DESTDIR)$(MANDIR)/$${lang}/$(MAN8SUBDIR) ; \
+ install -m 644 $${lang}/man8/*.8 $(DESTDIR)$(MANDIR)/$${lang}/$(MAN8SUBDIR) ; \
+ fi ; \
+ done
diff --git a/libsepol/man/ru/man8/chkcon.8 b/libsepol/man/ru/man8/chkcon.8
new file mode 100644
index 00000000..2661afb0
--- /dev/null
+++ b/libsepol/man/ru/man8/chkcon.8
@@ -0,0 +1,39 @@
+.\" Hey, Emacs! This is an -*- nroff -*- source file.
+.\" Copyright (c) 1997 Manoj Srivastava <srivasta@debian.org>
+.\"
+.\" This is free documentation; you can redistribute it and/or
+.\" modify it under the terms of the GNU General Public License as
+.\" published by the Free Software Foundation; either version 2 of
+.\" the License, or (at your option) any later version.
+.\"
+.\" The GNU General Public License's references to "object code"
+.\" and "executables" are to be interpreted as the output of any
+.\" document formatting or typesetting system, including
+.\" intermediate and printed output.
+.\"
+.\" This manual is distributed in the hope that it will be useful,
+.\" but WITHOUT ANY WARRANTY; without even the implied warranty of
+.\" MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+.\" GNU General Public License for more details.
+.\"
+.\" You should have received a copy of the GNU General Public
+.\" License along with this manual; if not, write to the Free
+.\" Software Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139,
+.\" USA.
+.\"
+.TH CHKCON 8 "12 марта 2005" "SELinux" "Документация по командной строке SELinux"
+.SH ИМЯ
+chkcon \- определить, является ли контекст безопасности действительным для конкретной двоичной политики
+.SH ОБЗОР
+chkcon policy_file context
+.SH ОПИСАНИЕ
+Эта утилита проверяет контекст безопасности (его строковое представление), заданный аргументом
+.I context,
+относительно данных конфигурации, прочтённых из файла двоичного представления базы данных политик, заданного аргументом
+.I policy_file.
+.SH ФАЙЛЫ
+policy file
+.SH АВТОРЫ
+Эта страница руководства (и только она) была написана Manoj
+Srivastava <srivasta@debian.org>.
+Перевод на русский язык выполнила Герасименко Олеся <gammaray@basealt.ru>.
diff --git a/libsepol/src/expand.c b/libsepol/src/expand.c
index 6f1b235e..312d137b 100644
--- a/libsepol/src/expand.c
+++ b/libsepol/src/expand.c
@@ -1451,6 +1451,7 @@ static int expand_filename_trans(expand_state_t *state, filename_trans_rule_t *r
new_trans->name = strdup(cur_rule->name);
if (!new_trans->name) {
ERR(state->handle, "Out of memory!");
+ free(new_trans);
return -1;
}
new_trans->stype = i + 1;
@@ -1460,6 +1461,8 @@ static int expand_filename_trans(expand_state_t *state, filename_trans_rule_t *r
otype = calloc(1, sizeof(*otype));
if (!otype) {
ERR(state->handle, "Out of memory!");
+ free(new_trans->name);
+ free(new_trans);
return -1;
}
otype->otype = mapped_otype;
@@ -1469,6 +1472,9 @@ static int expand_filename_trans(expand_state_t *state, filename_trans_rule_t *r
otype);
if (rc) {
ERR(state->handle, "Out of memory!");
+ free(otype);
+ free(new_trans->name);
+ free(new_trans);
return -1;
}
}
diff --git a/libsepol/src/kernel_to_cil.c b/libsepol/src/kernel_to_cil.c
index 63e4d489..48b571a5 100644
--- a/libsepol/src/kernel_to_cil.c
+++ b/libsepol/src/kernel_to_cil.c
@@ -1614,8 +1614,8 @@ static char *xperms_to_str(avtab_extended_perms_t *xperms)
if (xperms->specified & AVTAB_XPERMS_IOCTLFUNCTION) {
value = xperms->driver<<8 | bit;
- low_value = xperms->driver<<8 | low_bit;
if (in_range) {
+ low_value = xperms->driver<<8 | low_bit;
len = snprintf(p, remaining, " (range 0x%hx 0x%hx)", low_value, value);
in_range = 0;
} else {
@@ -1623,8 +1623,8 @@ static char *xperms_to_str(avtab_extended_perms_t *xperms)
}
} else if (xperms->specified & AVTAB_XPERMS_IOCTLDRIVER) {
value = bit << 8;
- low_value = low_bit << 8;
if (in_range) {
+ low_value = low_bit << 8;
len = snprintf(p, remaining, " (range 0x%hx 0x%hx)", low_value, (uint16_t) (value|0xff));
in_range = 0;
} else {
@@ -2031,6 +2031,8 @@ static int write_cond_av_list_to_cil(FILE *out, struct policydb *pdb, cond_av_li
return 0;
exit:
+ strs_free_all(strs);
+ strs_destroy(&strs);
return rc;
}
diff --git a/libsepol/src/kernel_to_conf.c b/libsepol/src/kernel_to_conf.c
index 215d940c..afadca6b 100644
--- a/libsepol/src/kernel_to_conf.c
+++ b/libsepol/src/kernel_to_conf.c
@@ -1999,6 +1999,8 @@ static int write_cond_av_list_to_conf(FILE *out, struct policydb *pdb, cond_av_l
return 0;
exit:
+ strs_free_all(strs);
+ strs_destroy(&strs);
return rc;
}
diff --git a/libsepol/src/module_to_cil.c b/libsepol/src/module_to_cil.c
index 4cb44e0e..f04589ed 100644
--- a/libsepol/src/module_to_cil.c
+++ b/libsepol/src/module_to_cil.c
@@ -655,8 +655,8 @@ static int xperms_to_cil(const av_extended_perms_t *xperms)
if (xperms->specified & AVTAB_XPERMS_IOCTLFUNCTION) {
value = xperms->driver<<8 | bit;
- low_value = xperms->driver<<8 | low_bit;
if (in_range) {
+ low_value = xperms->driver<<8 | low_bit;
cil_printf("(range 0x%hx 0x%hx)", low_value, value);
in_range = 0;
} else {
@@ -664,8 +664,8 @@ static int xperms_to_cil(const av_extended_perms_t *xperms)
}
} else if (xperms->specified & AVTAB_XPERMS_IOCTLDRIVER) {
value = bit << 8;
- low_value = low_bit << 8;
if (in_range) {
+ low_value = low_bit << 8;
cil_printf("(range 0x%hx 0x%hx)", low_value, (uint16_t) (value|0xff));
in_range = 0;
} else {
diff --git a/libsepol/src/util.c b/libsepol/src/util.c
index b00251c6..a4008882 100644
--- a/libsepol/src/util.c
+++ b/libsepol/src/util.c
@@ -159,16 +159,16 @@ char *sepol_extended_perms_to_string(avtab_extended_perms_t *xperms)
if (xperms->specified & AVTAB_XPERMS_IOCTLFUNCTION) {
value = xperms->driver<<8 | bit;
- low_value = xperms->driver<<8 | low_bit;
if (in_range) {
+ low_value = xperms->driver<<8 | low_bit;
len = snprintf(p, sizeof(xpermsbuf) - xpermslen, "0x%hx-0x%hx ", low_value, value);
} else {
len = snprintf(p, sizeof(xpermsbuf) - xpermslen, "0x%hx ", value);
}
} else if (xperms->specified & AVTAB_XPERMS_IOCTLDRIVER) {
value = bit << 8;
- low_value = low_bit << 8;
if (in_range) {
+ low_value = low_bit << 8;
len = snprintf(p, sizeof(xpermsbuf) - xpermslen, "0x%hx-0x%hx ", low_value, (uint16_t) (value|0xff));
} else {
len = snprintf(p, sizeof(xpermsbuf) - xpermslen, "0x%hx-0x%hx ", value, (uint16_t) (value|0xff));
generated by cgit v1.2.3 (git 2.25.1) at 2024-09-28 15:26:07 +0000