Changeset 108

Timestamp:

06/02/05 11:36:55 (4 years ago)

Author:

sshimko

Message:

-Constraint tests, compilation shell script, and random other changes

Files:

• trunk/frameworkcc.sh (added)
• trunk/src/com/tresys/framework/policy/Domain.java (modified) (4 diffs)
• trunk/src/com/tresys/framework/policy/PolicyParser.jj (modified) (43 diffs)
• trunk/test/dictionary (modified) (21 diffs)
• trunk/test/policy (modified) (1 diff)
• trunk/test/testcases (added)
• trunk/test/testcases/constraint1 (added)
• trunk/test/testcases/constraint2 (added)
• trunk/test/testcases/constraint3 (added)

trunk/src/com/tresys/framework/policy/Domain.java

@@ -10 +10 @@
-package com.tresys.framework.policy;
-
-Set
+*
-
-import com.tresys.framework.dictionary.Verb;
@@ -23 +23 @@
- */
-public final class Domain extends ComponentWithFobjects{
+        public List<Component> Children;
+        
-        /**
-         * Default domain constructor.
@@ -32 +34 @@
-        {
-                super(n, verbSet);
+                Children = new LinkedList<Component>();
-        }
-
@@ -45 +48 @@
-                super(n, par, verbSet);
-        }
+        
+        /**
+         * Add a child component to this domain.
+         * 
+         * @param child Child component
+         */
+        public void AddChild(Component child){
+                Children.add(child);
+        }
-}

trunk/src/com/tresys/framework/policy/PolicyParser.jj

@@ -52 +52 @@
-         * @param errmsg        Error message to display on stdout
-         */
-
+ 
-                Config.Error("Line "+ tok.beginLine + 
-                                " Column " + tok.beginColumn);
@@ -67 +67 @@
-         * @param errmsg        Error message to display on stdout
-         */
-
+ 
-                Config.Warn("Line "+ tok.beginLine + 
-                                " Column " + tok.beginColumn );
@@ -79 +79 @@
-         * @param errmsg        Error message to display on stdout
-         */
-
+ 
-                Config.Error(errmsg);
-                had_error = true;
@@ -90 +90 @@
-         *            Error message to display on stdout
-         */
-
+ 
-                Config.Warn( errmsg );
-                had_warning = true;
@@ -146 +146 @@
-                }
-                
-
+ 
-                        Config.Warn("Policy parsed but warnings were generated!  " + 
-                                        "Generated policy may be erroneous.\n");
-                }
-                
-
+ 
-                        System.out.println("Errors were generated!\n" +
-                        "The policy will NOT be translated.  Please fix the errors and try again.");
@@ -268 +268 @@
-        {
-                // construct domain w/ parent reference
-
+ 
-                        // get parent domain
-                        parent = genPolicy.Domains.get(parentStr);
@@ -274 +274 @@
-                        // due to checks in the Parent() production that _should_ always 
-                        // succeed but just in case...
-
+ 
-                                ErrorGenerate(tokDomainName, "A domain \"" 
-                                                + parentStr +  "\" does not appear to be " 
@@ -285 +285 @@
-                        }
-                // construct domain w/out parent
-
+ 
-                        domain = new Domain(tokDomainName.image, dictionary.Verbs);
-                        Config.Debug("Domain created: " + tokDomainName.image);
@@ -301 +301 @@
-        { 
-                if (domain != null) {
-
+
+
+
+
-                                Config.Debug("Domain added to policy: " + domain.Name);
-                        } else {
@@ -328 +331 @@
-        {
-                // construct resource w/ parent reference
-
+ 
-                        // get parent domain
-                        parent = genPolicy.Domains.get(parentStr);
@@ -334 +337 @@
-                        // due to checks in the Parent() production that _should_ always 
-                        // succeed but just in case...
-
+ 
-                                ErrorGenerate(tokResourceName, "A domain \"" 
-                                                + parentStr +  "\" does not appear to be " 
@@ -345 +348 @@
-                        }
-                // construct resource w/out parent
-
+ 
-                        resource = new Resource(tokResourceName.image, dictionary.Verbs);
-                        Config.Debug("Resource created: " + tokResourceName.image);
@@ -362 +365 @@
-        { 
-                if (resource != null) {
-
+ 
-                                Config.Debug("Resource added to policy: " + resource.Name);
+                                if (resource.Parent != null) {
+                                        resource.Parent.AddChild(resource);
+                                }
-                        } else {
-                                WarnGenerate(tokResourceName, "Failed attempt to insert resource \"" 
@@ -389 +395 @@
-        {
-                // construct entrypoint w/ parent reference
-
+ 
-                        // get parent domain
-                        parent = genPolicy.Domains.get(parentStr);
@@ -395 +401 @@
-                        // due to checks in the Parent() production that _should_ always 
-                        // succeed but just in case...
-
+ 
-                                ErrorGenerate(tokEntrypointName, "A domain \"" 
-                                                + parentStr +  "\" does not appear to be " 
@@ -406 +412 @@
-                        }
-                // construct entrypoint w/out parent
-
+ 
-                        entrypoint = new Entrypoint(tokEntrypointName.image, dictionary.entrypoint);
-                        Config.Debug("Entrypoint created: " + tokEntrypointName.image);
@@ -420 +426 @@
-        { 
-                if (entrypoint != null) {
-
+
+
+
+
-                                Config.Debug("Entrypoint added to policy: " + entrypoint.Name);
-                        } else {
@@ -458 +467 @@
-        {
-                // remove trailing "."
-
+ 
-                        ancestors.deleteCharAt(ancestors.length() - 1);
-                        return ancestors.toString();
@@ -489 +498 @@
-                
-                // control fobjects require special treatment (creation of control resources)
-
+ 
-                        fobject = dictionary.GetFobject(tokFobjName.image + tokAt.image);
-
+ 
-                                // check constraint (parent associated w/ same fobject) then add
-                                if ((domain.Parent != null) && 
-
+ 
-                                        ErrorGenerate(tokFobjName, "Constraint check failed in Fobject association: " 
-                                                        + fobject.Name + " --  Children can only be associated with a subset of " 
-                                                        + "the parent's Fobjects.");
-                                }
-
+ 
-                                        Config.Debug("\tControl Fobject \"" + fobject.Name 
-                                                        + "\" added to domain \"" + domain.Name + "\".");
-                                        // create a control resource
-                                        ControlResource conRes = new ControlResource(fobject.Name + domain.Name, dictionary.Verbs);
-
+ 
-                                                Config.Debug("\tControl resource created: " + conRes.Name );
-                                        } else {
@@ -519 +528 @@
-                } else {
-                        fobject = dictionary.GetFobject(tokFobjName.image);
-
+ 
-                                // check constraint (parent associated w/ same fobject) then add
-                                if ((domain.Parent != null) && 
-
+ 
-                                        ErrorGenerate(tokFobjName, "Constraint check failed in Fobject association: " 
-                                                + fobject.Name + " --  Children can only be associated with a subset of " 
-                                                + "the parent's Fobjects.");
-
+ 
-                                        Config.Debug("\tFobject \"" + fobject.Name 
-                                                        + "\" added to domain " + domain.Name + ".");
@@ -555 +564 @@
-        tokFobjName=<ID>{
-                fobject = dictionary.GetFobject(tokFobjName.image);
-
+ 
-                        // check constraint (parent associated w/ same fobject) then add
-                        if ((resource.Parent != null) && 
-
+ 
-                                ErrorGenerate(tokFobjName, "Constraint check failed in Fobject association: " 
-                                        + fobject.Name + " --  Children can only be associated with a subset of " 
-                                        + "the parent's Fobjects.");
-
+ 
-                                Config.Debug("\tFobject \"" + fobject.Name 
-                                                + "\" added to domain " + resource.Name + ".");
@@ -599 +608 @@
-                // verify verb
-                verb = dictionary.GetVerb(tokVerbName.image);
-
+ 
-                        // if all if kopasetic create an access
-
+ 
-                                access = new Access(domain, resource, verb);
-                        }else {
@@ -632 +641 @@
-                 * domain can only access resources at the same level or higher.
-                 */  
-
+ 
-                        // if the domain has a parent then the resource's parent must be a 
-                        //superset of the domain's parent  
-                        if ( (domain.Parent == null ) ||
-
+ 
-                                ErrorGenerate(tokAccess, 
-                                                "Constraint violation!  Domain \""  + domain.Name 
@@ -650 +659 @@
-                 *  constraints).
-                 */
-
+ 
-                        /*
-                         * if no access defined for this verb in parent
@@ -656 +665 @@
-                         */
-                        if ((domain.Parent.Accesses.get(verb) == null) || 
-
+ 
-                                ErrorGenerate(tokAccess, 
-                                        "Constraint violation!  Access must be defined " 
@@ -663 +672 @@
-                                return;
-                        // if valid parent and verb access but not a correct subset
-
+ 
-                                ErrorGenerate(tokAccess, 
-                                        "Constraint violation!  Must use subset of parent's access."); 
@@ -672 +681 @@
-                        }
-                }
-
+ 
-                        // update graph links for information flow
-                        domain.Accesses.get(verb).put(resource, access);
@@ -701 +710 @@
-        AccessDefnEP axxDefnEP = null;
-        String key;
+        String keyParent;
-        LinkedList<Enter> list;
+        LinkedList<Enter> listParent;
-}
-{
@@ -714 +725 @@
-        {
-                // tweak or choose default
-
+ 
-                        axxDefnEP = dictionary.entrypoint.GetAccessDefnEP(tokTweakName.image);
-                } else {
@@ -721 +732 @@
-                }
-                
-
-
+ 
+ 
-                                ErrorGenerate(tokTweakName, "Invalid entrypoint access: " 
-                                        + tokTweakName.image);
@@ -737 +748 @@
-                 * domain can only access entrypoints at the same level or higher.
-                 */  
-
+ 
-                        // if the domain has a parent then the resource's parent must be a 
-                        //superset of the domain's parent  
-
-
+
+
+
-                                ErrorGenerate(tokEntry, 
-                                                "Constraint violation!  Domain \""  + domainSrc.Name 
@@ -747 +759 @@
-                                                + "\" which is hidden inside of another domain.");
-                                return;
-
-
+
+
+
+
-                                ErrorGenerate(tokEntry, 
-                                                "Constraint violation!  Domain \""  + domainDest.Name 
@@ -760 +774 @@
-                key = domainSrc.toString() + Config.DELIM 
-                        + entrypoint.toString();
+
-                // pull list if already created
-                list = genPolicy.Entries.get(key);
-                
-                /*
-                 * 
-                 * TODO: clean this mess up
-                 */
-
-
-
+ 
+domain dest. 
+ 
-                                list.add(enter);
-
+ 
-                                ErrorGenerate(tokEntry, 
-                                                "Constraint violation!  Parent domain of \""  + domainDest.Name 
@@ -777 +791 @@
-                                return;
-                        }
-
-
+
+
+
+
+
+
+
+
+
+
+
+
-                                        "Constraint violation!  Parent domain \""  + domainSrc.Parent.Name 
-                                        + "\" must enter domain \"" + domainDest.Name 
-                                        + "\" before its child \"" + domainSrc.SubName + "\".");
-
+
+
-                // if we don't have a list then create one w/ no other constraint checks
-                } else {
@@ -810 +835 @@
-        {
-                // domain w/ parent reference
-
+ 
-                        // retrieve domain
-                        domain = genPolicy.Domains.get(domParentStr 
-                                        + "." + tokDomainName.image);
-                        
-
+ 
-                                ErrorGenerate(tokDomainName, "The domain \"" 
-                                                + domParentStr + "." + tokDomainName.image 
@@ -824 +849 @@
-                        }
-                // domain w/out parent
-
+ 
-                        domain = genPolicy.Domains.get(tokDomainName.image);
-                        
-
+ 
-                                ErrorGenerate(tokDomainName, "The domain \"" + tokDomainName.image  
-                                                +  "\" does not appear to be defined before use.");
@@ -876 +901 @@
-        {
-                // if this is a control resource
-
+ 
-                        /*
-                         *  Parent() doesn't recognize a single domain w/ no "."
-                         *  which is only possible in a control resource attached to a TLD
-                         */
-
+ 
-                                resParentStr = tokNoParent.image;
-                        }
@@ -889 +914 @@
-                                        + tokAt.image + resParentStr);
-                
-
+ 
-                                ErrorGenerate(tokResourceName, "The control resource \"" 
-                                                + tokResourceName.image + tokAt.image + resParentStr
@@ -898 +923 @@
-                        }
-                // resource w/ parent reference
-
+ 
-                        // get resource from policy
-                        resource = genPolicy.Resources.get(resParentStr 
-                                        + "." + tokResourceName.image);
-                
-
+ 
-                                ErrorGenerate(tokResourceName, "The resource \"" 
-                                                + resParentStr + "." + tokResourceName.image 
@@ -912 +937 @@
-                        }
-                // domain w/out parent
-
+ 
-                        resource = genPolicy.Resources.get(tokResourceName.image);
-                
-
+ 
-                                ErrorGenerate(tokResourceName, "The resource \"" + tokResourceName.image
-                                                + "\" does not appear to be defined before use.");
@@ -946 +971 @@
-        {
-                // domain w/ parent reference
-
+ 
-                        // retrieve domain
-                        entrypoint = genPolicy.Entrypoints.get(domParentStr 
-                                        + "." + tokEPName.image);
-                        
-
+ 
-                                ErrorGenerate(tokEPName, "The domain \"" 
-                                                + domParentStr + "." + tokEPName.image 
@@ -960 +985 @@
-                        }
-                // domain w/out parent
-
+ 
-                        entrypoint = genPolicy.Entrypoints.get(tokEPName.image);
-                        
-
+ 
-                                ErrorGenerate(tokEPName, "The entrypoint \"" + tokEPName.image  
-                                                +  "\" does not appear to be defined before use in an enter statement.");
@@ -994 +1019 @@
-                        return;
-                
-
+ 
-                        Config.Debug("\tAccess tweaked (Fobject Access): " 
-                                        + tokFobjName.image + " " + tokAccessName.image);

trunk/test/dictionary

@@ -2 +2 @@
-verbs { read write }            
-fobject dirFiles {
-a directory full of files
+"a directory full of files"
-        all {
-                file { append create execute getattr ioctl link lock read rename setattr unlink write }
@@ -10 +10 @@
-        read {
-                default {
-default read access
+"default read access"
-                        [flow: 9]
-                        resource {
@@ -21 +21 @@
-        write {
-                default {
-default write access
+"default write access"
-                        [flow: 9]
-                        resource {
@@ -30 +30 @@
-                }
-                append {
-limited write that only allows append
+"limited write that only allows append"
-                        [flow: 8]
-                        resource {
@@ -39 +39 @@
-                }
-                delete {
-delete a file
+"delete a file"
-                        [flow: 2]
-                        resource {
@@ -51 +51 @@
-
-fobject namedPipes {
-named pipe and the directory it lives in
+"named pipe and the directory it lives in"
-        all {
-                dir { add_name append create execute getattr ioctl link lock read remove_name rename reparent rmdir search setattr unlink write }
@@ -58 +58 @@
-        read {
-                default {
-default read access
+"default read access"
-                        [flow: 9]
-                        resource {
@@ -68 +68 @@
-        write {
-                default {
-default write access
+"default write access"
-                        [flow: 9]
-                        resource {
@@ -79 +79 @@
-
-fobject unixStreamSockets {
-unix stream sockets with sockfiles and the directory they live in
+"unix stream sockets with sockfiles and the directory they live in"
-        all {
-                dir { add_name read remove_name search write }
@@ -87 +87 @@
-        read {
-                default {
-create sockfile, bind to socket, listen, and read socket
+"create sockfile, bind to socket, listen, and read socket"
-                        [flow: 9]
-                        resource {
@@ -100 +100 @@
-        write {
-                default {
-connect to and write to a socket
+"connect to and write to a socket"
-                        [flow: 9]
-                        resource {
@@ -117 +117 @@
-
-fobject tcpNetwork {
-tcp network interface, including interface, node, and socket permissions
+"tcp network interface, including interface, node, and socket permissions"
-        all {
-                netif { tcp_recv tcp_send }
@@ -125 +125 @@
-        read {
-                default {
-read from a tcp socket
+"read from a tcp socket"
-                        [flow: 9]
-                        resource {
@@ -137 +137 @@
-                }
-                serverRead {
-bind, listen, accept, and read from a tcp socket
+"bind, listen, accept, and read from a tcp socket"
-                        resource {
-                                netif { tcp_recv tcp_send }
@@ -150 +150 @@
-        write {
-                default {
- connect and write to a tcp socket
+" connect and write to a tcp socket"
-                        resource {
-                                netif { tcp_recv tcp_send }
@@ -161 +161 @@
-                }
-                serverWrite {
-bind, listen, accept, and write to a tcp socket
+"bind, listen, accept, and write to a tcp socket"
-                        resource {
-                                netif { tcp_recv tcp_send }
@@ -176 +176 @@
-#this is a test fobject to exercise the parsers ability to understand control fobjects and resources
-fobject mqueues@ {
+[desc: "message queues control fobject"]
-        all { 
-                msgq { enqueue create destroy } 
@@ -182 +183 @@
-        read {
-                default {
-
-
-
-
-
-
-
-
+
+
+
+
+
+
+
+
+
+
-                        resource {
-                                msgq { enqueue create destroy } 
@@ -200 +203 @@
-#this is a test fobject to exercise the parsers ability to understand control fobjects and resources
-fobject mqueues {
+[desc: "message queues control fobject"]
-        all { 
-                msgq { enqueue create destroy } 
@@ -206 +210 @@
-        read {
-                default {
-
-
-
-
-
-
-
-
+
+
+
+
+
+
+
+
+
+
-                        resource {
-                                msgq { enqueue create destroy } 
@@ -224 +230 @@
-                        
-entrypoint {
-       
+
-        default {
-                start resource {

trunk/test/policy

@@ -3 +3 @@
-domain out;
-domain guard { namedPipes unixStreamSockets dirFiles };
-
-# TEST: entry constraint checking
-domain in.test1;
-domain out.test2;
-entrypoint exec;
-enter in out exec {test};
-enter in.test1 out.test2 exec;
-
-# TEST: for domain accessing a hidden resource
-#domain foo;
-#domain fob {dirFiles};
-#resource fob.bar {dirFiles};
-#access foo fob.bar write;
-
-# TEST: for exceeding permissions granted to the parent (PermVector fails subset test)
-#domain foo;
-#domain foo.bar;
-#resource baz {dirFiles};
-#access foo baz write { dirFiles:append };
-#access foo.bar baz write;
-
-resource eth1 { tcpNetwork };