[PATCH 1/2] libsepol: Validate expressions do not mix tunables and booleans

A conditional expression should never have a mixture of both
tunables and booleans. This is not allowed in CIL, checkpolicy,
or checkmodule and could only occur in a maliciously crafted
binary policy.

When validating the policy, validate that conditional expressions
do not contain a mixture of both tunables and booleans and exit
with an error if they do.

Signed-off-by: James Carter <[email protected]>
---
 libsepol/src/policydb_validate.c | 19 +++++++++++++++++--
 1 file changed, 17 insertions(+), 2 deletions(-)

diff --git a/libsepol/src/policydb_validate.c b/libsepol/src/policydb_validate.c
index fe8bf1cf..7d9ae3fd 100644
--- a/libsepol/src/policydb_validate.c
+++ b/libsepol/src/policydb_validate.c
@@ -1322,9 +1322,12 @@ bad:
 }
 
 static int validate_cond_expr(sepol_handle_t *handle,
-			      const struct cond_expr *expr,
+			      const struct cond_expr *expr, const policydb_t *p,
 			      const validate_t *boolean)
 {
+	cond_bool_datum_t *booldatum;
+	int booleans = 0;
+	int tunables = 0;
 	int depth = -1;
 
 	if (!expr)
@@ -1338,6 +1341,11 @@ static int validate_cond_expr(sepol_handle_t *handle,
 			if (depth >= (COND_EXPR_MAXDEPTH - 1))
 				goto bad;
 			depth++;
+			booldatum = p->bool_val_to_struct[expr->boolean - 1];
+			if (booldatum->flags & COND_BOOL_FLAGS_TUNABLE)
+				tunables++;
+			else
+				booleans++;
 			break;
 		case COND_NOT:
 			if (depth < 0)
@@ -1364,6 +1372,12 @@ static int validate_cond_expr(sepol_handle_t *handle,
 	if (depth != 0)
 		goto bad;
 
+	if (tunables && booleans) {
+		ERR(handle, "Found both tunables and booleans in the same "
+			    "conditional expression");
+		goto bad;
+	}
+
 	return 0;
 
 bad:
@@ -1375,7 +1389,8 @@ static int validate_cond_list(sepol_handle_t *handle, const cond_list_t *cond,
 			      const policydb_t *p, validate_t flavors[])
 {
 	for (; cond; cond = cond->next) {
-		if (validate_cond_expr(handle, cond->expr, &flavors[SYM_BOOLS]))
+		if (validate_cond_expr(handle, cond->expr, p,
+				       &flavors[SYM_BOOLS]))
 			goto bad;
 		if (validate_cond_av_list(handle, cond->true_list, p, flavors))
 			goto bad;
-- 
2.55.0