Add -f option to support transition rules
This commit is contained in:
parent
22fa57b82c
commit
01ddd8eaa8
BIN
sepolicy-inject
Executable file
BIN
sepolicy-inject
Executable file
Binary file not shown.
@ -157,6 +157,55 @@ int add_rule(char *s, char *t, char *c, char *p, policydb_t *policy) {
|
|||||||
return 0;
|
return 0;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
int add_transition(char *srcS, char *fconS, char *tgtS, char *c, policydb_t *policy) {
|
||||||
|
type_datum_t *src, *tgt, *fcon;
|
||||||
|
class_datum_t *cls;
|
||||||
|
|
||||||
|
avtab_datum_t *av;
|
||||||
|
avtab_key_t key;
|
||||||
|
|
||||||
|
src = hashtab_search(policy->p_types.table, srcS);
|
||||||
|
if (src == NULL) {
|
||||||
|
fprintf(stderr, "source type %s does not exist\n", srcS);
|
||||||
|
return 1;
|
||||||
|
}
|
||||||
|
tgt = hashtab_search(policy->p_types.table, tgtS);
|
||||||
|
if (tgt == NULL) {
|
||||||
|
fprintf(stderr, "target type %s does not exist\n", tgtS);
|
||||||
|
return 1;
|
||||||
|
}
|
||||||
|
cls = hashtab_search(policy->p_classes.table, c);
|
||||||
|
if (cls == NULL) {
|
||||||
|
fprintf(stderr, "class %s does not exist\n", c);
|
||||||
|
return 1;
|
||||||
|
}
|
||||||
|
fcon = hashtab_search(policy->p_types.table, fconS);
|
||||||
|
if (cls == NULL) {
|
||||||
|
fprintf(stderr, "class %s does not exist\n", fconS);
|
||||||
|
return 1;
|
||||||
|
}
|
||||||
|
|
||||||
|
key.source_type = src->s.value;
|
||||||
|
key.target_type = fcon->s.value;
|
||||||
|
key.target_class = cls->s.value;
|
||||||
|
key.specified = AVTAB_TRANSITION;
|
||||||
|
av = avtab_search(&policy->te_avtab, &key);
|
||||||
|
|
||||||
|
if (av == NULL) {
|
||||||
|
av = cmalloc(sizeof av);
|
||||||
|
av->data = tgt->s.value;
|
||||||
|
int ret = avtab_insert(&policy->te_avtab, &key, av);
|
||||||
|
if (ret) {
|
||||||
|
fprintf(stderr, "Error inserting into avtab\n");
|
||||||
|
return 1;
|
||||||
|
}
|
||||||
|
} else {
|
||||||
|
fprintf(stderr, "Warning, rule already defined! Won't override.\n");
|
||||||
|
fprintf(stderr, "Previous value = %d, wanted value = %d\n", av->data, tgt->s.value);
|
||||||
|
}
|
||||||
|
|
||||||
|
return 0;
|
||||||
|
}
|
||||||
|
|
||||||
int load_policy(char *filename, policydb_t *policydb, struct policy_file *pf) {
|
int load_policy(char *filename, policydb_t *policydb, struct policy_file *pf) {
|
||||||
int fd;
|
int fd;
|
||||||
@ -203,7 +252,8 @@ int load_policy(char *filename, policydb_t *policydb, struct policy_file *pf) {
|
|||||||
|
|
||||||
int main(int argc, char **argv)
|
int main(int argc, char **argv)
|
||||||
{
|
{
|
||||||
char *policy = NULL, *source = NULL, *target = NULL, *class = NULL, *perm = NULL, *outfile = NULL, *permissive = NULL;
|
char *policy = NULL, *source = NULL, *target = NULL, *class = NULL, *perm = NULL;
|
||||||
|
char *fcon = NULL, *outfile = NULL, *permissive = NULL;
|
||||||
policydb_t policydb;
|
policydb_t policydb;
|
||||||
struct policy_file pf, outpf;
|
struct policy_file pf, outpf;
|
||||||
sidtab_t sidtab;
|
sidtab_t sidtab;
|
||||||
@ -217,6 +267,7 @@ int main(int argc, char **argv)
|
|||||||
{"target", required_argument, NULL, 't'},
|
{"target", required_argument, NULL, 't'},
|
||||||
{"class", required_argument, NULL, 'c'},
|
{"class", required_argument, NULL, 'c'},
|
||||||
{"perm", required_argument, NULL, 'p'},
|
{"perm", required_argument, NULL, 'p'},
|
||||||
|
{"fcon", required_argument, NULL, 'f'},
|
||||||
{"policy", required_argument, NULL, 'P'},
|
{"policy", required_argument, NULL, 'P'},
|
||||||
{"output", required_argument, NULL, 'o'},
|
{"output", required_argument, NULL, 'o'},
|
||||||
{"permissive", required_argument, NULL, 'Z'},
|
{"permissive", required_argument, NULL, 'Z'},
|
||||||
@ -224,8 +275,11 @@ int main(int argc, char **argv)
|
|||||||
{NULL, 0, NULL, 0}
|
{NULL, 0, NULL, 0}
|
||||||
};
|
};
|
||||||
|
|
||||||
while ((ch = getopt_long(argc, argv, "s:t:c:p:P:o:Z:z:", long_options, NULL)) != -1) {
|
while ((ch = getopt_long(argc, argv, "ef:s:t:c:p:P:o:Z:z:", long_options, NULL)) != -1) {
|
||||||
switch (ch) {
|
switch (ch) {
|
||||||
|
case 'f':
|
||||||
|
fcon = optarg;
|
||||||
|
break;
|
||||||
case 's':
|
case 's':
|
||||||
source = optarg;
|
source = optarg;
|
||||||
break;
|
break;
|
||||||
@ -257,7 +311,7 @@ int main(int argc, char **argv)
|
|||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
if (((!source || !target || !class || !perm) && !permissive) || !policy)
|
if (((!source || !target || !class || !perm) && !permissive && !fcon) || !policy)
|
||||||
usage(argv[0]);
|
usage(argv[0]);
|
||||||
|
|
||||||
if(!outfile)
|
if(!outfile)
|
||||||
@ -286,6 +340,8 @@ int main(int argc, char **argv)
|
|||||||
fprintf(stderr, "Could not set bit in permissive map\n");
|
fprintf(stderr, "Could not set bit in permissive map\n");
|
||||||
return 1;
|
return 1;
|
||||||
}
|
}
|
||||||
|
} else if(fcon) {
|
||||||
|
add_transition(source, fcon, target, class, &policydb);
|
||||||
} else {
|
} else {
|
||||||
create_domain(source, &policydb);
|
create_domain(source, &policydb);
|
||||||
if (add_rule(source, target, class, perm, &policydb)) {
|
if (add_rule(source, target, class, perm, &policydb)) {
|
||||||
|
Loading…
Reference in New Issue
Block a user