Add seamendc binary
Bug: 236691128 Test: adb shell seamendc -b <binary_policy> -o <output_policy> <test.cil> <test-redefinitions.cil> Change-Id: Id51271e89261a2a612cf25e7b56147d5931c76f9
This commit is contained in:
sandrom
parent
1579b37a19
commit
b246b1dc35
2 changed files with 266 additions and 0 deletions
|
|
@ -59,6 +59,13 @@ cc_binary_host {
|
|||
srcs: ["version_policy.c"],
|
||||
}
|
||||
|
||||
cc_binary {
|
||||
name: "seamendc",
|
||||
defaults: ["sepolicy_tools_defaults"],
|
||||
srcs: ["seamendc.c"],
|
||||
host_supported: true,
|
||||
}
|
||||
|
||||
python_binary_host {
|
||||
name: "insertkeys",
|
||||
srcs: ["insertkeys.py"],
|
||||
|
|
|
|||
259
tools/seamendc.c
Normal file
259
tools/seamendc.c
Normal file
|
|
@ -0,0 +1,259 @@
|
|||
#include <getopt.h>
|
||||
#include <stddef.h>
|
||||
#include <stdint.h>
|
||||
#include <stdio.h>
|
||||
#include <stdlib.h>
|
||||
#include <string.h>
|
||||
#include <sys/stat.h>
|
||||
|
||||
#include <cil/cil.h>
|
||||
#include <cil/android.h>
|
||||
#include <sepol/policydb.h>
|
||||
|
||||
void usage(const char *prog)
|
||||
{
|
||||
printf("Usage: %s [OPTION]... FILE...\n", prog);
|
||||
printf("Takes a binary policy file as input and applies the rules and definitions specified ");
|
||||
printf("in the provided FILEs. Each FILE must be a policy file in CIL format.\n");
|
||||
printf("\n");
|
||||
printf("Options:\n");
|
||||
printf(" -b, --base=<file> (required) base binary policy.\n");
|
||||
printf(" -o, --output=<file> (required) write binary policy to <file>\n");
|
||||
printf(" -v, --verbose increment verbosity level\n");
|
||||
printf(" -h, --help display usage information\n");
|
||||
exit(1);
|
||||
}
|
||||
|
||||
/*
|
||||
* Read binary policy file from path into the allocated pdb.
|
||||
*/
|
||||
static int read_binary_policy(char *path, sepol_policydb_t *pdb)
|
||||
{
|
||||
int rc = SEPOL_OK;
|
||||
|
||||
FILE *file = fopen(path, "r");
|
||||
if (!file) {
|
||||
fprintf(stderr, "Could not open %s: %s.\n", path, strerror(errno));
|
||||
rc = SEPOL_ERR;
|
||||
goto exit;
|
||||
}
|
||||
|
||||
struct stat binarydata;
|
||||
rc = stat(path, &binarydata);
|
||||
if (rc == -1) {
|
||||
fprintf(stderr, "Could not stat %s: %s.\n", path, strerror(errno));
|
||||
goto exit;
|
||||
}
|
||||
if (!binarydata.st_size) {
|
||||
fprintf(stderr, "Binary policy file is empty.\n");
|
||||
rc = SEPOL_ERR;
|
||||
goto exit;
|
||||
}
|
||||
|
||||
struct sepol_policy_file *pf = NULL;
|
||||
rc = sepol_policy_file_create(&pf);
|
||||
if (rc != 0) {
|
||||
fprintf(stderr, "Failed to create policy file: %d.\n", rc);
|
||||
goto exit;
|
||||
}
|
||||
sepol_policy_file_set_fp(pf, file);
|
||||
|
||||
rc = sepol_policydb_read(pdb, pf);
|
||||
if (rc != 0) {
|
||||
fprintf(stderr, "Failed to read binary policy: %d.\n", rc);
|
||||
goto exit;
|
||||
}
|
||||
|
||||
exit:
|
||||
if (file != NULL && fclose(file) == EOF && rc == SEPOL_OK) {
|
||||
perror("Failure closing binary file");
|
||||
rc = SEPOL_ERR;
|
||||
}
|
||||
return rc;
|
||||
}
|
||||
|
||||
/*
|
||||
* read_cil_files - Initialize db and parse CIL input files.
|
||||
*/
|
||||
static int read_cil_files(struct cil_db **db, char **paths,
|
||||
unsigned int n_files)
|
||||
{
|
||||
int rc = SEPOL_ERR;
|
||||
FILE *file = NULL;
|
||||
char *buff = NULL;
|
||||
|
||||
for (int i = 0; i < n_files; i++) {
|
||||
char *path = paths[i];
|
||||
|
||||
file = fopen(path, "r");
|
||||
if (file == NULL) {
|
||||
rc = SEPOL_ERR;
|
||||
fprintf(stderr, "Could not open %s: %s.\n", path, strerror(errno));
|
||||
goto file_err;
|
||||
}
|
||||
|
||||
struct stat filedata;
|
||||
rc = stat(path, &filedata);
|
||||
if (rc == -1) {
|
||||
fprintf(stderr, "Could not stat %s: %s.\n", path, strerror(errno));
|
||||
goto err;
|
||||
}
|
||||
|
||||
uint32_t file_size = filedata.st_size;
|
||||
buff = malloc(file_size);
|
||||
if (buff == NULL) {
|
||||
perror("malloc failed");
|
||||
rc = SEPOL_ERR;
|
||||
goto err;
|
||||
}
|
||||
|
||||
rc = fread(buff, file_size, 1, file);
|
||||
if (rc != 1) {
|
||||
fprintf(stderr, "Failure reading %s: %s.\n", path, strerror(errno));
|
||||
rc = SEPOL_ERR;
|
||||
goto err;
|
||||
}
|
||||
fclose(file);
|
||||
file = NULL;
|
||||
|
||||
/* create parse_tree */
|
||||
rc = cil_add_file(*db, path, buff, file_size);
|
||||
if (rc != SEPOL_OK) {
|
||||
fprintf(stderr, "Failure adding %s to parse tree.\n", path);
|
||||
goto parse_err;
|
||||
}
|
||||
free(buff);
|
||||
}
|
||||
|
||||
return SEPOL_OK;
|
||||
err:
|
||||
fclose(file);
|
||||
parse_err:
|
||||
free(buff);
|
||||
file_err:
|
||||
return rc;
|
||||
}
|
||||
|
||||
/*
|
||||
* Write binary policy in pdb to file at path.
|
||||
*/
|
||||
static int write_binary_policy(sepol_policydb_t *pdb, char *path)
|
||||
{
|
||||
int rc = SEPOL_OK;
|
||||
|
||||
FILE *file = fopen(path, "w");
|
||||
if (file == NULL) {
|
||||
fprintf(stderr, "Could not open %s: %s.\n", path, strerror(errno));
|
||||
rc = SEPOL_ERR;
|
||||
goto exit;
|
||||
}
|
||||
|
||||
struct sepol_policy_file *pf = NULL;
|
||||
rc = sepol_policy_file_create(&pf);
|
||||
if (rc != 0) {
|
||||
fprintf(stderr, "Failed to create policy file: %d.\n", rc);
|
||||
goto exit;
|
||||
}
|
||||
sepol_policy_file_set_fp(pf, file);
|
||||
|
||||
rc = sepol_policydb_write(pdb, pf);
|
||||
if (rc != 0) {
|
||||
fprintf(stderr, "failed to write binary policy: %d.\n", rc);
|
||||
goto exit;
|
||||
}
|
||||
|
||||
exit:
|
||||
if (file != NULL && fclose(file) == EOF && rc == SEPOL_OK) {
|
||||
perror("Failure closing binary file");
|
||||
rc = SEPOL_ERR;
|
||||
}
|
||||
return rc;
|
||||
}
|
||||
|
||||
int main(int argc, char *argv[])
|
||||
{
|
||||
char *base = NULL;
|
||||
char *output = NULL;
|
||||
enum cil_log_level log_level = CIL_ERR;
|
||||
static struct option long_opts[] = {{"base", required_argument, 0, 'b'},
|
||||
{"output", required_argument, 0, 'o'},
|
||||
{"verbose", no_argument, 0, 'v'},
|
||||
{"help", no_argument, 0, 'h'},
|
||||
{0, 0, 0, 0}};
|
||||
|
||||
while (1) {
|
||||
int opt_index = 0;
|
||||
int opt_char = getopt_long(argc, argv, "b:o:vh", long_opts, &opt_index);
|
||||
if (opt_char == -1) {
|
||||
break;
|
||||
}
|
||||
switch (opt_char)
|
||||
{
|
||||
case 'b':
|
||||
base = optarg;
|
||||
break;
|
||||
case 'o':
|
||||
output = optarg;
|
||||
break;
|
||||
case 'v':
|
||||
log_level++;
|
||||
break;
|
||||
case 'h':
|
||||
usage(argv[0]);
|
||||
default:
|
||||
fprintf(stderr, "Unsupported option: %s.\n", optarg);
|
||||
usage(argv[0]);
|
||||
}
|
||||
}
|
||||
if (base == NULL || output == NULL) {
|
||||
fprintf(stderr, "Please specify required arguments.\n");
|
||||
usage(argv[0]);
|
||||
}
|
||||
|
||||
cil_set_log_level(log_level);
|
||||
|
||||
// Initialize and read input policydb file.
|
||||
sepol_policydb_t *pdb = NULL;
|
||||
int rc = sepol_policydb_create(&pdb);
|
||||
if (rc != 0) {
|
||||
fprintf(stderr, "Could not create policy db: %d.\n", rc);
|
||||
exit(rc);
|
||||
}
|
||||
|
||||
rc = read_binary_policy(base, pdb);
|
||||
if (rc != SEPOL_OK) {
|
||||
fprintf(stderr, "Failed to read binary policy: %d.\n", rc);
|
||||
exit(rc);
|
||||
}
|
||||
|
||||
// Initialize cil_db.
|
||||
struct cil_db *incremental_db = NULL;
|
||||
cil_db_init(&incremental_db);
|
||||
cil_set_attrs_expand_generated(incremental_db, 1);
|
||||
|
||||
// Read input cil files and compile them into cil_db.
|
||||
rc = read_cil_files(&incremental_db, argv + optind, argc - optind);
|
||||
if (rc != SEPOL_OK) {
|
||||
fprintf(stderr, "Failed to read CIL files: %d.\n", rc);
|
||||
exit(rc);
|
||||
}
|
||||
|
||||
rc = cil_compile(incremental_db);
|
||||
if (rc != SEPOL_OK) {
|
||||
fprintf(stderr, "Failed to compile cildb: %d.\n", rc);
|
||||
exit(rc);
|
||||
}
|
||||
|
||||
// Amend the policydb.
|
||||
rc = cil_amend_policydb(incremental_db, pdb);
|
||||
if (rc != SEPOL_OK) {
|
||||
fprintf(stderr, "Failed to build policydb.\n");
|
||||
exit(rc);
|
||||
}
|
||||
|
||||
rc = write_binary_policy(pdb, output);
|
||||
if (rc != SEPOL_OK) {
|
||||
fprintf(stderr, "Failed to write binary policy: %d.\n", rc);
|
||||
exit(rc);
|
||||
}
|
||||
}
|
||||
Loading…
Reference in a new issue