[PATCH] libselinux: fix Python binding for security_load_policy()

Commit 9639f5d ("Add decent constants for python for return of
getenforce call") also added a global typemap that forces every void *
parameter to NULL from Python. This was intended to auto-supply NULL
for the opaque auditdata parameter of avc_has_perm(), avc_audit(), and
selinux_check_access(), but also matched the void *data parameter of
security_load_policy(), forcing it to NULL and preventing its
use. Restrict the auto-NULL typemap to only the auditdata parameters
and provide a typemap for security_load_policy that supports passing
any bytes-like object (bytes, bytearray, mmap) that can be handled.

Fixes: https://github.com/SELinuxProject/selinux/issues/354
Signed-off-by: Stephen Smalley <[email protected]>
---
 libselinux/src/selinuxswig_python.i | 25 +++++++++++++++++++++++--
 1 file changed, 23 insertions(+), 2 deletions(-)

diff --git a/libselinux/src/selinuxswig_python.i b/libselinux/src/selinuxswig_python.i
index 03ed296d..c8c08a40 100644
--- a/libselinux/src/selinuxswig_python.i
+++ b/libselinux/src/selinuxswig_python.i
@@ -88,9 +88,30 @@ def install(src, dest):
   $1 = &temp;
 }
 
-%typemap(in, numinputs=0) void *(char *temp=NULL) {
-	$1 = temp;
+/*
+ * Auto-supply NULL for the opaque auditdata parameter on avc_has_perm(),
+ * avc_audit(), and selinux_check_access(); it is not usable from Python.
+ * Restricted by parameter name so that it does not swallow other void * args.
+ */
+%typemap(in, numinputs=0) void *auditdata {
+	$1 = NULL;
+}
+
+/*
+ * security_load_policy(const void *data, size_t len) accept any
+ * object exposing the buffer protocol (bytes, bytearray, mmap, ...)
+ * as a single Python argument.
+ */
+%typemap(in) (const void *data, size_t len)(Py_buffer view) {
+	view.obj = NULL;
+	if (PyObject_GetBuffer($input, &view, PyBUF_SIMPLE) < 0)
+		SWIG_fail;
+	$1 = view.buf;
+	$2 = (size_t)view.len;
 }
+%typemap(freearg) (const void *data, size_t len) {
+	PyBuffer_Release(&view$argnum);
+ }
 
 /* Makes security_compute_user() return a Python list of contexts */
 %typemap(argout) (char ***con) {
-- 
2.55.0