Merge pull request #14 from xmikos/pasis

Merge changes from pasis/setools-android

.gitignore

@@ -1,2 +1,38 @@
 libs
 obj
+
+Makefile
+test-driver
+.libs
+Makefile.in
+configure
+libtool
+ltmain.sh
+config.guess
+config.sub
+install-sh
+missing
+compile
+aclocal.m4
+config.log
+config.status
+depcomp
+autom4te.cache
+.dirstamp
+.deps
+
+jni/libapol/*.o
+jni/libapol/regex/*.o
+jni/libqpol/*.o
+jni/libqpol/bzip2/*.o
+jni/libsepol/src/*.o
+jni/secmds/*.o
+jni/sepolicy-inject/*.o
+/libapol.a
+/libqpol.a
+/libsepol.a
+/seinfo
+/sepolicy-inject
+/sesearch
+
+tags

Makefile.am

@@ -0,0 +1,162 @@
+lib_LIBRARIES = libapol.a libqpol.a libsepol.a
+
+bin_PROGRAMS = seinfo sesearch sepolicy-inject
+
+libapol_includes = -Ijni/include -Ijni/libqpol/include -Ijni/libapol/regex
+libapol_a_CFLAGS = -std=gnu99 $(libapol_includes)
+libapol_a_SOURCES = \
+ jni/libapol/avrule-query.c \
+ jni/libapol/bool-query.c \
+ jni/libapol/bst.c \
+ jni/libapol/class-perm-query.c \
+ jni/libapol/condrule-query.c \
+ jni/libapol/constraint-query.c \
+ jni/libapol/context-query.c \
+ jni/libapol/domain-trans-analysis.c \
+ jni/libapol/fscon-query.c \
+ jni/libapol/infoflow-analysis.c \
+ jni/libapol/isid-query.c \
+ jni/libapol/mls-query.c \
+ jni/libapol/mls_level.c \
+ jni/libapol/mls_range.c \
+ jni/libapol/netcon-query.c \
+ jni/libapol/perm-map.c \
+ jni/libapol/permissive-query.c \
+ jni/libapol/polcap-query.c \
+ jni/libapol/policy.c \
+ jni/libapol/policy-path.c \
+ jni/libapol/policy-query.c \
+ jni/libapol/queue.c \
+ jni/libapol/range_trans-query.c \
+ jni/libapol/rbacrule-query.c \
+ jni/libapol/relabel-analysis.c \
+ jni/libapol/render.c \
+ jni/libapol/role-query.c \
+ jni/libapol/terule-query.c \
+ jni/libapol/ftrule-query.c \
+ jni/libapol/type-query.c \
+ jni/libapol/types-relation-analysis.c \
+ jni/libapol/user-query.c \
+ jni/libapol/util.c \
+ jni/libapol/vector.c \
+ jni/libapol/getline.c \
+ jni/libapol/regex/strlcpy.c \
+ jni/libapol/regex/regcomp.c \
+ jni/libapol/regex/regerror.c \
+ jni/libapol/regex/regexec.c \
+ jni/libapol/regex/regfree.c
+
+libqpol_includes = -Ijni/include -Ijni/libsepol/include -Ijni/libqpol/bzip2
+libqpol_a_CFLAGS = -std=gnu99 $(libqpol_includes)
+libqpol_a_SOURCES = \
+ jni/libqpol/avrule_query.c \
+ jni/libqpol/bool_query.c \
+ jni/libqpol/class_perm_query.c \
+ jni/libqpol/cond_query.c \
+ jni/libqpol/constraint_query.c \
+ jni/libqpol/context_query.c \
+ jni/libqpol/expand.c \
+ jni/libqpol/fs_use_query.c \
+ jni/libqpol/genfscon_query.c \
+ jni/libqpol/isid_query.c \
+ jni/libqpol/iterator.c \
+ jni/libqpol/mls_query.c \
+ jni/libqpol/mlsrule_query.c \
+ jni/libqpol/module.c \
+ jni/libqpol/module_compiler.c \
+ jni/libqpol/netifcon_query.c \
+ jni/libqpol/nodecon_query.c \
+ jni/libqpol/permissive_query.c \
+ jni/libqpol/polcap_query.c \
+ jni/libqpol/policy.c \
+ jni/libqpol/policy_define.c \
+ jni/libqpol/policy_extend.c \
+ jni/libqpol/portcon_query.c \
+ jni/libqpol/queue.c \
+ jni/libqpol/rbacrule_query.c \
+ jni/libqpol/role_query.c \
+ jni/libqpol/syn_rule_query.c \
+ jni/libqpol/terule_query.c \
+ jni/libqpol/ftrule_query.c \
+ jni/libqpol/type_query.c \
+ jni/libqpol/user_query.c \
+ jni/libqpol/util.c \
+ jni/libqpol/policy_parse.c \
+ jni/libqpol/policy_scan.c \
+ jni/libqpol/bzip2/blocksort.c \
+ jni/libqpol/bzip2/huffman.c \
+ jni/libqpol/bzip2/crctable.c \
+ jni/libqpol/bzip2/randtable.c \
+ jni/libqpol/bzip2/compress.c \
+ jni/libqpol/bzip2/decompress.c \
+ jni/libqpol/bzip2/bzlib.c
+
+libsepol_includes = -Ijni/libsepol/include -Ijni/libsepol/src
+libsepol_a_CFLAGS = $(libsepol_includes)
+libsepol_a_SOURCES = \
+ jni/libsepol/src/android_m_compat.c \
+ jni/libsepol/src/assertion.c \
+ jni/libsepol/src/avrule_block.c \
+ jni/libsepol/src/avtab.c \
+ jni/libsepol/src/boolean_record.c \
+ jni/libsepol/src/booleans.c \
+ jni/libsepol/src/conditional.c \
+ jni/libsepol/src/constraint.c \
+ jni/libsepol/src/context.c \
+ jni/libsepol/src/context_record.c \
+ jni/libsepol/src/debug.c \
+ jni/libsepol/src/ebitmap.c \
+ jni/libsepol/src/expand.c \
+ jni/libsepol/src/genbools.c \
+ jni/libsepol/src/genusers.c \
+ jni/libsepol/src/handle.c \
+ jni/libsepol/src/hashtab.c \
+ jni/libsepol/src/hierarchy.c \
+ jni/libsepol/src/ibendport_record.c \
+ jni/libsepol/src/ibendports.c \
+ jni/libsepol/src/ibpkey_record.c \
+ jni/libsepol/src/ibpkeys.c \
+ jni/libsepol/src/iface_record.c \
+ jni/libsepol/src/interfaces.c \
+ jni/libsepol/src/kernel_to_cil.c \
+ jni/libsepol/src/kernel_to_common.c \
+ jni/libsepol/src/kernel_to_conf.c \
+ jni/libsepol/src/link.c \
+ jni/libsepol/src/mls.c \
+ jni/libsepol/src/module.c \
+ jni/libsepol/src/module_to_cil.c \
+ jni/libsepol/src/node_record.c \
+ jni/libsepol/src/nodes.c \
+ jni/libsepol/src/polcaps.c \
+ jni/libsepol/src/policydb.c \
+ jni/libsepol/src/policydb_convert.c \
+ jni/libsepol/src/policydb_public.c \
+ jni/libsepol/src/port_record.c \
+ jni/libsepol/src/ports.c \
+ jni/libsepol/src/roles.c \
+ jni/libsepol/src/services.c \
+ jni/libsepol/src/sidtab.c \
+ jni/libsepol/src/stpcpy.c \
+ jni/libsepol/src/symtab.c \
+ jni/libsepol/src/user_record.c \
+ jni/libsepol/src/users.c \
+ jni/libsepol/src/util.c \
+ jni/libsepol/src/write.c
+
+secmds_includes = -Ijni/include -Ijni/libsepol/include
+secmds_libs = libapol.a libqpol.a libsepol.a
+
+seinfo_CFLAGS = $(secmds_includes)
+seinfo_SOURCES = \
+ jni/secmds/seinfo.c
+seinfo_LDADD = $(secmds_libs)
+
+sesearch_CFLAGS = $(secmds_includes) -std=c99
+sesearch_SOURCES = \
+ jni/secmds/sesearch.c
+sesearch_LDADD = $(secmds_libs)
+
+sepolicy_inject_CFLAGS = -Ijni/libsepol/include
+sepolicy_inject_SOURCES = \
+ jni/sepolicy-inject/sepolicy-inject.c
+sepolicy_inject_LDADD = libsepol.a

README.md

@@ -20,19 +20,30 @@ This tool injects allow rules into binary SELinux kernel policies.
 [2]: http://bitbucket.org/joshua_brindle/sepolicy-inject
 
 
-## Building
+## Building for Android
 
 Ensure that you have installed _android-ndk_ properly. Then run:
 
- git clone https://github.com/xmikos/setools-android.git
- cd setools-android
  ndk-build
 
 
+## Building for Linux
+
+setools-android can be built for *nix platform as stand-alone binaries without
+external dependencies. This build simplifies analysis of Android's sepolicy
+after dumping it from a device.
+
+ autoreconf -i
+ ./configure
+ make
+ sudo cp ./seinfo ./sesearch ./sepolicy-inject /usr/local/bin # optional
+
+
 ## Usage
 
  sepolicy-inject -s <source type> -t <target type> -c <class> -p <perm>[,<perm2>,<perm3>,...] [-P <policy file>] [-o <output file>] [-l|--load]
- sepolicy-inject -Z permissive_type [-P <policy file>] [-o <output file>] [-l|--load]
+ sepolicy-inject -Z type_to_make_permissive [-P <policy file>] [-o <output file>] [-l|--load]
+ sepolicy-inject -z type_to_make_nonpermissive [-P <policy file>] [-o <output file>] [-l|--load]
 
 For example if you want to allow _vdc_ to write to pseudo-terminal (so you can see replies from _vdc_ command):
 
@@ -47,6 +58,8 @@ This repository contains other opensource code:
  * bzip2
  * libsepol
 
-Based on [setools-android][3] by Dmitry Podgorny (pasis)
+Based on [pasis/setools-android][3] by Dmitry Podgorny (pasis) and
+[xmikos/setools-android][4] by Michal Krenek (Mikos)
 
 [3]: https://github.com/pasis/setools-android
+[4]: https://github.com/xmikos/setools-android

configure.ac

@@ -0,0 +1,10 @@
+AC_INIT([setools-android], [1.3], [pasis.ua@gmail.com])
+AM_INIT_AUTOMAKE([foreign subdir-objects])
+
+AC_CONFIG_FILES([Makefile])
+
+AC_PROG_CC
+AC_PROG_RANLIB
+AM_PROG_CC_C_O
+
+AC_OUTPUT

jni/include/config.h

@@ -105,25 +105,39 @@
 #define NDEBUG 1
 
 /* Name of package */
+#ifndef PACKAGE
 #define PACKAGE "setools"
+#endif
 
 /* Define to the address where bug reports for this package should be sent. */
+#ifndef PACKAGE_BUGREPORT
 #define PACKAGE_BUGREPORT "Tresys Technology <setools@tresys.com>"
+#endif
 
 /* Define to the full name of this package. */
+#ifndef PACKAGE_NAME
 #define PACKAGE_NAME "setools"
+#endif
 
 /* Define to the full name and version of this package. */
+#ifndef PACKAGE_STRING
 #define PACKAGE_STRING "setools 3.3.8"
+#endif
 
 /* Define to the one symbol short name of this package. */
+#ifndef PACKAGE_TARNAME
 #define PACKAGE_TARNAME "setools"
+#endif
 
 /* Define to the home page for this package. */
+#ifndef PACKAGE_URL
 #define PACKAGE_URL ""
+#endif
 
 /* Define to the version of this package. */
+#ifndef PACKAGE_VERSION
 #define PACKAGE_VERSION "3.3.8"
+#endif
 
 /* if avtab sizes are calculated dynamically by loader or are hardcoded */
 #define SEPOL_DYNAMIC_AVTAB 1
@@ -166,7 +180,9 @@
 
 
 /* Version number of package */
+#ifndef VERSION
 #define VERSION "3.3.8"
+#endif
 
 /* Define WORDS_BIGENDIAN to 1 if your processor stores words with the most
  significant byte first (like Motorola and SPARC, unlike Intel). */

jni/libapol/Android.mk

@@ -46,6 +46,7 @@ LOCAL_SRC_FILES := \
  util.c \
  vector.c \
  getline.c \
+ regex/strlcpy.c \
  regex/regcomp.c \
  regex/regerror.c \
  regex/regexec.c \

jni/libapol/getline.c

@@ -14,16 +14,24 @@
  * limitations under the License.
  */
 
+#include <errno.h>
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
 
 ssize_t apol_getline(char **lineptr, size_t *n, FILE *stream)
 {
+#ifdef __ANDROID__
+
  char *ptr;
+ size_t len;
 
- ptr = fgetln(stream, n);
+ if (lineptr == NULL || n == NULL) {
+ errno = EINVAL;
+ return -1;
+ }
 
+ ptr = fgetln(stream, n);
  if (ptr == NULL) {
  return -1;
  }
@@ -32,13 +40,17 @@ ssize_t apol_getline(char **lineptr, size_t *n, FILE *stream)
  if (*lineptr != NULL) free(*lineptr);
 
  /* Add one more space for '\0' */
- size_t len = n[0] + 1;
+ len = n[0] + 1;
 
  /* Update the length */
  n[0] = len;
 
  /* Allocate a new buffer */
  *lineptr = malloc(len);
+ if (*lineptr == NULL) {
+ errno = ENOMEM;
+ return -1;
+ }
 
  /* Copy over the string */
  memcpy(*lineptr, ptr, len-1);
@@ -47,5 +59,11 @@ ssize_t apol_getline(char **lineptr, size_t *n, FILE *stream)
  (*lineptr)[len-1] = '\0';
 
  /* Return the length of the new buffer */
- return len;
+ return (ssize_t)len;
+
+#else /* __ANDROID__ */
+
+ return getdelim(lineptr, n, '\n', stream);
+
+#endif /* __ANDROID__ */
 }

jni/libapol/getline.h

@@ -1,3 +1,5 @@
+/* Replacement for getline(3) which is absent in bionic. */
+
 #ifndef __GETLINE_H__
 #define __GETLINE_H__
 

jni/libapol/policy-path.c

@@ -341,7 +341,7 @@ int apol_policy_path_to_file(const apol_policy_path_t * path, const char *filena
  fclose(f);
  }
  if (retval != 0) {
- error = errno;
+ errno = error;
  }
  return retval;
 }