tree 3d94f8c2c67e0cdca6e8be87d199dd214b9e3329
parent e4205bda0592930a442b39ac6ebb6ea2ff0367a8
author Jeff Vander Stoep <jeffv@google.com> 1461185389 -0700
committer Nick Kralevich <nnk@google.com> 1461356936 -0700

Fix extended permissions neverallow checking

Commit 99fc177b "Add neverallow support for ioctl extended permissions"
first checks to see if the ioctl permission is granted, then checks to
see if the same source/target violates a neverallowed ioctl command.
Unfortunately this does not address the case where the ioctl permission
and extended permissions are granted on different attributes. Example,
the following will incorrectly cause a neverallow violation.

allow untrusted_app self:tcp_socket ioctl;
allowxperm domain domain:tcp_socket unpriv_sock_ioctls;
neverallowxperm untrusted_app domain:tcp_socket ~unpriv_sock_ioctls;

The fix is to enumerate over the source and target attributes when
looking for extended permission violations.

Note: The bug this addresses incorrectly asserts that a violation has
occurred. Actual neverallow violations are always caught.

Signed-off-by: Jeff Vander Stoep <jeffv@google.com>
Tested-by: William Roberts <william.c.roberts@intel.com>

(cherry picked from commit 1beb818f109fcbcc3b5581f712e85c4a1945c026)

Bug: 28273954
Change-Id: I47def0d95ab8d6e11850a316bbf6f07a557f6e16