[PATCH] libsepol: Check all the permissions in sepol_check_access()

The function sepol_check_access() takes five arguments: a path to
a policy, a source context string, a target context string, a
security class string, and a comma-separated list of permissions.
It calls functions to turn all the strings into structs that can
be passed to sepol_compute_av_reason_buffer(). Unfortunately, as
each permission in the permission list is converted to an access
vector, the previous access vector value is overwritten, so only
the last permisison is used in the access check.

Use a temporary access vector when converting each permission
string to an access vector and "or" it to the final access
vector before processing the next permission string.

Signed-off-by: James Carter <[email protected]>
---
 libsepol/utils/sepol_check_access.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/libsepol/utils/sepol_check_access.c b/libsepol/utils/sepol_check_access.c
index fb3b7edd..e80d6464 100644
--- a/libsepol/utils/sepol_check_access.c
+++ b/libsepol/utils/sepol_check_access.c
@@ -12,7 +12,7 @@ int main(int argc, char *argv[])
 	sepol_security_id_t ssid, tsid;
 	sepol_security_class_t tclass;
 	const char *permlist;
-	sepol_access_vector_t av;
+	sepol_access_vector_t av = 0;
 	struct sepol_av_decision avd;
 	unsigned int reason;
 	char *reason_buf;
@@ -58,6 +58,7 @@ int main(int argc, char *argv[])
 		char *tmp = NULL;
 		const char *perm;
 		const char *delim = strchr(permlist, ',');
+		sepol_access_vector_t perm_av;
 
 		if (delim) {
 			tmp = strndup(permlist, delim - permlist);
@@ -71,7 +72,7 @@ int main(int argc, char *argv[])
 
 		perm = tmp ? tmp : permlist;
 
-		if (sepol_string_to_av_perm(tclass, perm, &av) < 0) {
+		if (sepol_string_to_av_perm(tclass, perm, &perm_av) < 0) {
 			fprintf(stderr,
 				"Invalid permission %s for security class %s:  %s\n",
 				perm, argv[4], strerror(errno));
@@ -79,6 +80,8 @@ int main(int argc, char *argv[])
 			return 1;
 		}
 
+		av |= perm_av;
+
 		free(tmp);
 
 		permlist = strchr(permlist, ',');
-- 
2.55.0