Merge "Adding new manifest syntax support for permit and wildcards"

1 files changed, 388 insertions, 371 deletions

diff --git a/packaging/security_4.9.1.patch b/packaging/security_4.9.1.patch
index 9a67be4..cf759d3 100644
--- a/packaging/security_4.9.1.patch
+++ b/packaging/security_4.9.1.patch
@@ -1,10 +1,6 @@
-From: Elena Reshetova <elena.reshetova@intel.com>
-Date: Tue, 24 Jul 2012 12:46:12 -0700
-Subject: [PATCH] Adding security hooks and security plugin
-
 diff -Nuarp rpm/build/files.c rpm-security/build/files.c
 --- rpm/build/files.c	2012-07-11 11:00:50.000000000 +0300
-+++ rpm-security/build/files.c	2012-07-24 12:27:43.007952103 +0300
++++ rpm-security/build/files.c	2012-08-06 12:49:34.333011443 +0300
 @@ -827,6 +827,7 @@ static VFA_t virtualFileAttributes[] = {
  	{ "%readme",	0,	RPMFILE_README },
  	{ "%license",	0,	RPMFILE_LICENSE },
@@ -48,7 +44,7 @@ diff -Nuarp rpm/build/files.c rpm-security/build/files.c
  	}
 diff -Nuarp rpm/build/parsePreamble.c rpm-security/build/parsePreamble.c
 --- rpm/build/parsePreamble.c	2012-07-11 11:00:50.000000000 +0300
-+++ rpm-security/build/parsePreamble.c	2012-07-24 12:27:43.011952130 +0300
++++ rpm-security/build/parsePreamble.c	2012-08-06 12:49:34.333011443 +0300
 @@ -216,7 +216,7 @@ static int addSource(rpmSpec spec, Packa
  	*fieldp = '\0';
  
@@ -68,7 +64,7 @@ diff -Nuarp rpm/build/parsePreamble.c rpm-security/build/parsePreamble.c
  
 diff -Nuarp rpm/configure.ac rpm-security/configure.ac
 --- rpm/configure.ac	2012-07-11 11:00:50.000000000 +0300
-+++ rpm-security/configure.ac	2012-07-24 12:27:43.011952130 +0300
++++ rpm-security/configure.ac	2012-08-06 12:49:34.337011459 +0300
 @@ -653,6 +653,65 @@ AC_SUBST(WITH_SELINUX_LIB)
  AC_SUBST(WITH_SEMANAGE_LIB)
  AM_CONDITIONAL(SELINUX,[test "$with_selinux" = yes])
@@ -156,7 +152,7 @@ diff -Nuarp rpm/configure.ac rpm-security/configure.ac
  AC_OUTPUT
 diff -Nuarp rpm/lib/fsm.c rpm-security/lib/fsm.c
 --- rpm/lib/fsm.c	2012-07-11 11:00:50.000000000 +0300
-+++ rpm-security/lib/fsm.c	2012-07-24 12:27:43.015952142 +0300
++++ rpm-security/lib/fsm.c	2012-08-06 12:49:34.337011459 +0300
 @@ -28,6 +28,8 @@
  #include "lib/rpmts_internal.h"	/* rpmtsSELabelFoo() only */
  #include "lib/rpmug.h"
@@ -212,7 +208,7 @@ diff -Nuarp rpm/lib/fsm.c rpm-security/lib/fsm.c
  	    }
 diff -Nuarp rpm/lib/Makefile.am rpm-security/lib/Makefile.am
 --- rpm/lib/Makefile.am	2012-07-11 11:00:50.000000000 +0300
-+++ rpm-security/lib/Makefile.am	2012-07-24 12:27:43.011952130 +0300
++++ rpm-security/lib/Makefile.am	2012-08-06 12:49:34.337011459 +0300
 @@ -36,7 +36,8 @@ librpm_la_SOURCES = \
  	verify.c rpmlock.c rpmlock.h misc.h \
  	rpmscript.h rpmscript.c legacy.c merge.c \
@@ -225,7 +221,7 @@ diff -Nuarp rpm/lib/Makefile.am rpm-security/lib/Makefile.am
  
 diff -Nuarp rpm/lib/package.c rpm-security/lib/package.c
 --- rpm/lib/package.c	2012-07-11 11:00:50.000000000 +0300
-+++ rpm-security/lib/package.c	2012-07-24 12:27:43.015952142 +0300
++++ rpm-security/lib/package.c	2012-08-06 12:49:34.341011475 +0300
 @@ -18,6 +18,8 @@
  #include "rpmio/rpmio_internal.h"	/* fd digest bits */
  #include "lib/header_internal.h"	/* XXX headerCheck */
@@ -249,7 +245,7 @@ diff -Nuarp rpm/lib/package.c rpm-security/lib/package.c
  	rpmlog(RPMLOG_DEBUG, "%s: %s", fn, msg);
 diff -Nuarp rpm/lib/rpmfi.h rpm-security/lib/rpmfi.h
 --- rpm/lib/rpmfi.h	2012-07-11 11:00:50.000000000 +0300
-+++ rpm-security/lib/rpmfi.h	2012-07-24 12:27:43.015952142 +0300
++++ rpm-security/lib/rpmfi.h	2012-08-06 12:49:34.341011475 +0300
 @@ -60,6 +60,7 @@ enum rpmfileAttrs_e {
      RPMFILE_EXCLUDE	= (1 <<  9),	/*!< from %%exclude, internal */
      RPMFILE_UNPATCHED	= (1 << 10),	/*!< placeholder (SuSE) */
@@ -260,7 +256,7 @@ diff -Nuarp rpm/lib/rpmfi.h rpm-security/lib/rpmfi.h
  typedef rpmFlags rpmfileAttrs;
 diff -Nuarp rpm/lib/rpmscript.c rpm-security/lib/rpmscript.c
 --- rpm/lib/rpmscript.c	2012-07-11 11:00:50.000000000 +0300
-+++ rpm-security/lib/rpmscript.c	2012-07-24 12:27:43.015952142 +0300
++++ rpm-security/lib/rpmscript.c	2012-08-06 12:49:34.341011475 +0300
 @@ -14,6 +14,8 @@
  #include "rpmio/rpmlua.h"
  #include "lib/rpmscript.h"
@@ -291,7 +287,7 @@ diff -Nuarp rpm/lib/rpmscript.c rpm-security/lib/rpmscript.c
  }
 diff -Nuarp rpm/lib/rpmsecurity.c rpm-security/lib/rpmsecurity.c
 --- rpm/lib/rpmsecurity.c	1970-01-01 02:00:00.000000000 +0200
-+++ rpm-security/lib/rpmsecurity.c	2012-07-24 12:27:43.015952142 +0300
++++ rpm-security/lib/rpmsecurity.c	2012-08-06 12:49:34.345011498 +0300
 @@ -0,0 +1,269 @@
 +#include "system.h"
 +
@@ -564,7 +560,7 @@ diff -Nuarp rpm/lib/rpmsecurity.c rpm-security/lib/rpmsecurity.c
 +}
 diff -Nuarp rpm/lib/rpmsecurity.h rpm-security/lib/rpmsecurity.h
 --- rpm/lib/rpmsecurity.h	1970-01-01 02:00:00.000000000 +0200
-+++ rpm-security/lib/rpmsecurity.h	2012-07-24 12:27:43.015952142 +0300
++++ rpm-security/lib/rpmsecurity.h	2012-08-06 12:49:34.345011498 +0300
 @@ -0,0 +1,161 @@
 +#ifndef _SECURITY_H
 +#define _SECURITY_H
@@ -729,7 +725,7 @@ diff -Nuarp rpm/lib/rpmsecurity.h rpm-security/lib/rpmsecurity.h
 +#endif	/* _SECURITY_H */
 diff -Nuarp rpm/lib/rpmtag.h rpm-security/lib/rpmtag.h
 --- rpm/lib/rpmtag.h	2012-07-11 11:00:50.000000000 +0300
-+++ rpm-security/lib/rpmtag.h	2012-07-24 12:27:43.019952154 +0300
++++ rpm-security/lib/rpmtag.h	2012-08-06 12:49:34.345011498 +0300
 @@ -299,7 +299,8 @@ typedef enum rpmTag_e {
      RPMTAG_ORDERNAME		= 5035,	/* s[] */
      RPMTAG_ORDERVERSION		= 5036,	/* s[] */
@@ -742,7 +738,7 @@ diff -Nuarp rpm/lib/rpmtag.h rpm-security/lib/rpmtag.h
  
 diff -Nuarp rpm/lib/rpmte.c rpm-security/lib/rpmte.c
 --- rpm/lib/rpmte.c	2012-07-11 11:00:50.000000000 +0300
-+++ rpm-security/lib/rpmte.c	2012-07-24 12:27:43.019952154 +0300
++++ rpm-security/lib/rpmte.c	2012-08-06 12:49:34.345011498 +0300
 @@ -14,7 +14,9 @@
  #include <rpm/rpmlog.h>
  
@@ -783,7 +779,7 @@ diff -Nuarp rpm/lib/rpmte.c rpm-security/lib/rpmte.c
      
 diff -Nuarp rpm/lib/rpmts.c rpm-security/lib/rpmts.c
 --- rpm/lib/rpmts.c	2012-07-11 11:00:50.000000000 +0300
-+++ rpm-security/lib/rpmts.c	2012-07-24 12:27:43.019952154 +0300
++++ rpm-security/lib/rpmts.c	2012-08-06 12:49:34.345011498 +0300
 @@ -24,6 +24,7 @@
  #include "lib/rpmal.h"
  #include "lib/rpmchroot.h"
@@ -803,7 +799,7 @@ diff -Nuarp rpm/lib/rpmts.c rpm-security/lib/rpmts.c
  	rpmtsPrintStats(ts);
 diff -Nuarp rpm/lib/rpmtypes.h rpm-security/lib/rpmtypes.h
 --- rpm/lib/rpmtypes.h	2012-07-11 11:00:50.000000000 +0300
-+++ rpm-security/lib/rpmtypes.h	2012-07-24 12:27:43.019952154 +0300
++++ rpm-security/lib/rpmtypes.h	2012-08-06 12:49:34.349011527 +0300
 @@ -78,6 +78,7 @@ typedef struct rpmPubkey_s * rpmPubkey;
  typedef struct rpmKeyring_s * rpmKeyring;
  
@@ -814,7 +810,7 @@ diff -Nuarp rpm/lib/rpmtypes.h rpm-security/lib/rpmtypes.h
  
 diff -Nuarp rpm/lib/transaction.c rpm-security/lib/transaction.c
 --- rpm/lib/transaction.c	2012-07-11 11:00:50.000000000 +0300
-+++ rpm-security/lib/transaction.c	2012-07-24 12:27:43.019952154 +0300
++++ rpm-security/lib/transaction.c	2012-08-06 12:49:34.349011527 +0300
 @@ -21,6 +21,8 @@
  #include "lib/rpmts_internal.h"
  #include "rpmio/rpmhook.h"
@@ -866,7 +862,7 @@ diff -Nuarp rpm/lib/transaction.c rpm-security/lib/transaction.c
  	rpmlog(RPMLOG_DEBUG, "running post-transaction scripts\n");
 diff -Nuarp rpm/macros.in rpm-security/macros.in
 --- rpm/macros.in	2012-07-11 11:00:50.000000000 +0300
-+++ rpm-security/macros.in	2012-07-24 12:27:43.023952178 +0300
++++ rpm-security/macros.in	2012-08-06 12:49:34.349011527 +0300
 @@ -1070,5 +1070,7 @@ done \
  %__collection_sepolicy		%{__plugindir}/sepolicy.so
  %__collection_sepolicy_flags	1
@@ -877,7 +873,7 @@ diff -Nuarp rpm/macros.in rpm-security/macros.in
  #*/
 diff -Nuarp rpm/Makefile.am rpm-security/Makefile.am
 --- rpm/Makefile.am	2012-07-11 11:00:50.000000000 +0300
-+++ rpm-security/Makefile.am	2012-07-24 12:27:43.003952083 +0300
++++ rpm-security/Makefile.am	2012-08-06 12:49:34.349011527 +0300
 @@ -29,7 +29,11 @@ if ENABLE_PLUGINS
  SUBDIRS += plugins
  endif
@@ -902,7 +898,7 @@ diff -Nuarp rpm/Makefile.am rpm-security/Makefile.am
  
 diff -Nuarp rpm/preinstall.am rpm-security/preinstall.am
 --- rpm/preinstall.am	2012-07-11 11:00:51.000000000 +0300
-+++ rpm-security/preinstall.am	2012-07-24 12:27:43.023952178 +0300
++++ rpm-security/preinstall.am	2012-08-06 12:49:34.349011527 +0300
 @@ -114,6 +114,14 @@ include/rpm/rpmvf.h: lib/rpmvf.h include
  	$(INSTALL_DATA) $(top_srcdir)/lib/rpmvf.h include/rpm/rpmvf.h
  BUILT_SOURCES += include/rpm/rpmvf.h
@@ -920,7 +916,7 @@ diff -Nuarp rpm/preinstall.am rpm-security/preinstall.am
  BUILT_SOURCES += include/rpm/rpmsign.h
 diff -Nuarp rpm/security/Makefile.am rpm-security/security/Makefile.am
 --- rpm/security/Makefile.am	1970-01-01 02:00:00.000000000 +0200
-+++ rpm-security/security/Makefile.am	2012-07-24 12:27:43.023952178 +0300
++++ rpm-security/security/Makefile.am	2012-08-06 12:49:34.369011618 +0300
 @@ -0,0 +1,24 @@
 +# Makefile for rpm library.
 +
@@ -948,7 +944,7 @@ diff -Nuarp rpm/security/Makefile.am rpm-security/security/Makefile.am
 +endif
 diff -Nuarp rpm/security/Makefile.msm rpm-security/security/Makefile.msm
 --- rpm/security/Makefile.msm	1970-01-01 02:00:00.000000000 +0200
-+++ rpm-security/security/Makefile.msm	2012-07-24 12:27:43.023952178 +0300
++++ rpm-security/security/Makefile.msm	2012-08-06 12:49:34.369011618 +0300
 @@ -0,0 +1,15 @@
 +CC=gcc
 +CFLAGS=-g -Wall 
@@ -967,8 +963,8 @@ diff -Nuarp rpm/security/Makefile.msm rpm-security/security/Makefile.msm
 +	rm msmmatch *.o
 diff -Nuarp rpm/security/msm.c rpm-security/security/msm.c
 --- rpm/security/msm.c	1970-01-01 02:00:00.000000000 +0200
-+++ rpm-security/security/msm.c	2012-07-24 12:42:23.144316466 +0300
-@@ -0,0 +1,914 @@
++++ rpm-security/security/msm.c	2012-08-06 13:32:38.137823835 +0300
+@@ -0,0 +1,903 @@
 +/*
 + * This file is part of MSM security plugin
 + * Greatly based on the code of MSSF security plugin
@@ -1611,8 +1607,6 @@ diff -Nuarp rpm/security/msm.c rpm-security/security/msm.c
 +    packagecontext *ctx = context;
 +    if (!ctx) return RPMRC_FAIL;
 +
-+    rpmlog(RPMLOG_DEBUG, "Started with FSM_OPENED_FUNC hook for file dir name: %s, base name %s \n", fsm->dirName, fsm->baseName);
-+
 +    ctx->path = getFilePath(fsm->dirName, fsm->baseName);
 +    rpmlog(RPMLOG_DEBUG, "Constructed file name: %s \n", ctx->path);
 + 
@@ -1637,9 +1631,6 @@ diff -Nuarp rpm/security/msm.c rpm-security/security/msm.c
 +	    }
 +	    HASH_Begin(ctx->hashctx);
 +    }
-+
-+    rpmlog(RPMLOG_DEBUG, "Finished with FSM_OPENED_FUNC hook for file: %s \n", ctx->path);
-+
 +    return RPMRC_OK;
 +}
 +
@@ -1649,7 +1640,7 @@ diff -Nuarp rpm/security/msm.c rpm-security/security/msm.c
 +    packagecontext *ctx = context;
 +    if (!ctx) return RPMRC_FAIL;
 +
-+    rpmlog(RPMLOG_DEBUG, "Started with FSM_UPDATED_FUNC hook for file dir name: %s, base name %s \n", fsm->dirName, fsm->baseName);
++
 +
 +    if (ctx->hashctx) {
 +	    const unsigned char *ptr = (unsigned char *)fsm->wrbuf;
@@ -1673,7 +1664,7 @@ diff -Nuarp rpm/security/msm.c rpm-security/security/msm.c
 +	    }
 +    }
 +
-+    rpmlog(RPMLOG_DEBUG, "Finished with FSM_UPDATED_FUNC hook for file dir name: %s, base name %s \n", fsm->dirName, fsm->baseName);
++
 +    return RPMRC_OK;
 +}
 +
@@ -1681,7 +1672,6 @@ diff -Nuarp rpm/security/msm.c rpm-security/security/msm.c
 +{
 +
 +    unsigned char digest[SHA1_LENGTH] = { 0 };
-+    rpmRC rc = RPMRC_FAIL;
 +    packagecontext *ctx = context;
 +    if (!ctx) return RPMRC_FAIL;
 +
@@ -1708,13 +1698,23 @@ diff -Nuarp rpm/security/msm.c rpm-security/security/msm.c
 +		        ctx->path = NULL;
 +		        ctx->ino = 0;
 +	        }
-+	    } 
-+	    rc = RPMRC_OK;
++
++    		if (rpmteType(ctx->te) == TR_ADDED) {
++	        	if (msmSetFileXAttributes(ctx->mfx, file->path) < 0) {
++		        	rpmlog(RPMLOG_ERR, "Setting of extended attributes failed for file %s from package %s\n",
++			           		file->path, rpmteN(ctx->te));
++				return RPMRC_FAIL;
++		        }
++    		} 
++	    } else {
++        	rpmlog(RPMLOG_ERR, "Manifest is missing while it should be present for the package %s\n",
++			   rpmteN(ctx->te));
++		return RPMRC_FAIL;
++	    }
 +    }
 +
 +    rpmlog(RPMLOG_DEBUG, "Finished with FSM_CLOSED_FUNC hook for file dir name: %s, base name %s \n", fsm->dirName, fsm->baseName);
-+    return rc;
-+
++    return RPMRC_OK;
 +}
 +
 +rpmRC SECURITYHOOK_POST_PSM_FUNC(rpmte te, char* rootDir, int rpmrc)
@@ -1742,22 +1742,8 @@ diff -Nuarp rpm/security/msm.c rpm-security/security/msm.c
 +	    root = context->mfx;
 +    } 
 +
-+    if (rpmteType(ctx->te) == TR_ADDED) {
-+	    if (rootSWSource || ctx->mfx->sw_source) {	  
-+	       if (ctx->mfx->files) {
-+		        ret = msmSetFilesystemLabels(ctx->mfx, rootDir);
-+		        if (ret) {
-+		            rpmlog(RPMLOG_ERR, "Filesystem label setup failed for %s\n",
-+			           rpmteN(ctx->te));
-+	    		    msmCancelPackage(ctx->mfx->name);
-+		            goto exit;
-+		        }
-+	        }
-+
-+	    } /* else unsigned package */
-+
-+    } else { /* TR_REMOVED */
 +
++    if (rpmteType(ctx->te) == TR_REMOVED) {
 +	    if (ctx->mfx->sw_source) {
 +	        if (rpmteDependsOn(ctx->te)) {
 +		        rpmlog(RPMLOG_INFO, "upgrading %s manifest data\n", 
@@ -1808,7 +1794,6 @@ diff -Nuarp rpm/security/msm.c rpm-security/security/msm.c
 +
 +}
 +
-+
 +rpmRC SECURITYHOOK_CLEANUP_FUNC(void)
 +{
 +
@@ -1885,7 +1870,7 @@ diff -Nuarp rpm/security/msm.c rpm-security/security/msm.c
 +}
 diff -Nuarp rpm/security/msmconfig.c rpm-security/security/msmconfig.c
 --- rpm/security/msmconfig.c	1970-01-01 02:00:00.000000000 +0200
-+++ rpm-security/security/msmconfig.c	2012-07-24 12:27:43.023952178 +0300
++++ rpm-security/security/msmconfig.c	2012-08-06 12:49:34.377011655 +0300
 @@ -0,0 +1,264 @@
 +/*
 + * This file is part of MSM security plugin
@@ -2153,8 +2138,8 @@ diff -Nuarp rpm/security/msmconfig.c rpm-security/security/msmconfig.c
 +
 diff -Nuarp rpm/security/msm.h rpm-security/security/msm.h
 --- rpm/security/msm.h	1970-01-01 02:00:00.000000000 +0200
-+++ rpm-security/security/msm.h	2012-07-24 12:31:43.385144067 +0300
-@@ -0,0 +1,466 @@
++++ rpm-security/security/msm.h	2012-08-06 12:49:34.377011655 +0300
+@@ -0,0 +1,467 @@
 +/*
 + * This file is part of MSM security plugin
 + * Greatly based on the code of MSSF security plugin
@@ -2198,6 +2183,8 @@ diff -Nuarp rpm/security/msm.h rpm-security/security/msm.h
 +#define DEVICE_SECURITY_POLICY "/etc/device-sec-policy"
 +#define SMACK_LOAD_PATH "/smack/load"
 +
++#define SMACK_ISOLATED_LABEL "Isolated"
++
 +#define SMACK_LABEL_LENGTH 255
 +#define SMACK_ACCESS_TYPE_LENGHT 5
 +#define SMACK_UNINSTALL 1 
@@ -2386,6 +2373,7 @@ diff -Nuarp rpm/security/msm.h rpm-security/security/msm.h
 +
 +typedef struct d_permit_x {
 +    const char *label_name;
++    const char *to_label_name;
 +    const char *ac_type;
 +    struct d_permit_x *prev;
 +    struct d_permit_x *next;
@@ -2494,7 +2482,6 @@ diff -Nuarp rpm/security/msm.h rpm-security/security/msm.h
 + */
 +package_x *msmCreatePackage(const char *name, sw_source_x *sw_source, provide_x *provides, const char *modified);
 +
-+
 +/** \ingroup msm
 + * Go through all provides in manifest, add provided ac domains to hash.
 + * @param packages	pointer to packages list
@@ -2542,14 +2529,13 @@ diff -Nuarp rpm/security/msm.h rpm-security/security/msm.h
 + */
 +package_x *msmFreePackage(package_x *package);
 +
-+
 +/** \ingroup msm
-+ * Set Smack object labels based on manifest filesystem tags.
-+ * @param mfx	package manifest
-+ * @param rootDir	root directory of installation
++ * Set extended attributes of the file based on manifest.
++ * @param mfx		package manifest
++ * @param filepath	path of the file
 + * @return	0 on success, else -1
 + */
-+int msmSetFilesystemLabels(manifest_x *mfx, char* rootDir);
++int msmSetFileXAttributes(manifest_x *mfx, const char* filepath);
 +
 +/** \ingroup msm
 + * Set setup the request section of manifest.
@@ -2623,8 +2609,8 @@ diff -Nuarp rpm/security/msm.h rpm-security/security/msm.h
 +#endif
 diff -Nuarp rpm/security/msmmanifest.c rpm-security/security/msmmanifest.c
 --- rpm/security/msmmanifest.c	1970-01-01 02:00:00.000000000 +0200
-+++ rpm-security/security/msmmanifest.c	2012-07-24 12:27:43.027952214 +0300
-@@ -0,0 +1,1457 @@
++++ rpm-security/security/msmmanifest.c	2012-08-06 12:49:34.381011684 +0300
+@@ -0,0 +1,1484 @@
 +/*
 + * This file is part of MSM security plugin
 + * Greatly based on the code of MSSF security plugin
@@ -2672,7 +2658,85 @@ diff -Nuarp rpm/security/msmmanifest.c rpm-security/security/msmmanifest.c
 +#define ASCII(s) (const char *)s
 +#define XMLCHAR(s) (const xmlChar *)s
 +
-+static int msmNextChildElement(xmlTextReaderPtr reader, int depth) {
++
++static int msmVerifyAccessType(const char* type)
++{
++	int res = 0, idx = 0;
++
++	if (type) {
++	    if (strlen(type) > SMACK_ACCESS_TYPE_LENGHT) {
++		    rpmlog(RPMLOG_ERR, "Lenght of the access type is bigger than allowed value: %s\n", type);
++		    return -1;
++	    }
++	    while ( type[idx] != '\0' ){
++		if ((type[idx] !='a') && (type[idx]!='r') && (type[idx]!='w') &&
++		    (type[idx]!='x') && (type[idx]!='t') && (type[idx] !='-')) {
++		    rpmlog(RPMLOG_ERR, "Not allowed character in access type: %s\n", type);
++		    res = -1;
++		    break;
++		}
++		idx++;
++	    }
++	} else return -1; 
++	return res;
++}
++
++static int msmVerifySmackLabel(const char* label)
++{
++	int res = 0, idx = 0;
++
++	if (label) {
++	    if (strlen(ASCII(label)) > SMACK_LABEL_LENGTH) { //smack limitation on lenght
++		rpmlog(RPMLOG_ERR, "Domain or label name  %s lenght is longer than defined SMACK_LABEL_LENGTH\n", label);
++		return -1; 
++	    }
++           if (strlen(ASCII(label)) == 0){
++		rpmlog(RPMLOG_ERR, "An attempt to define an empty domain or label name\n");
++    		return -1; 
++	    }
++ 	    if (label[0] == '-') {
++		rpmlog(RPMLOG_ERR, "Dash is not allowed as first character in smack label: %s\n", label);
++		return -1;
++	    }
++	    while ( label[idx] != '\0' ){
++		if ((label[idx] =='\"') || (label[idx] =='\'') || (label[idx] =='/') ||
++		    (label[idx] =='\\') || (label[idx] > '~') || (label[idx] <= ' ')) {
++		    rpmlog(RPMLOG_ERR, "Not allowed character in smack label: %s, position: %d \n", label, idx);
++		    res = -1;
++		    break;
++		}
++		idx++;
++	    }
++	} else return -1; 
++
++	return res;
++}
++
++static int msmVerifyLabelPrefix(const char* sub_label, const char* domain_name) 
++{
++    char *tmp = NULL;
++    char sep[]= "::";
++
++    tmp = calloc(strlen(domain_name) + 3, sizeof (const char));
++    if (!tmp) 
++	return -1;
++
++    strncpy(tmp, domain_name, strlen(domain_name));
++    strncpy(tmp + strlen(domain_name), sep, 2);
++
++    if (strstr(ASCII(sub_label), tmp) != ASCII(sub_label)) { //sub label name should be prefixed by domain name and "::"
++	rpmlog(RPMLOG_ERR, "Label name %s isn't prefixed by domain name %s\n", ASCII(sub_label), domain_name);
++	msmFreePointer((void**)&tmp);
++	return -1;
++    } 
++
++    msmFreePointer((void**)&tmp);
++    return 0;
++
++}
++
++static int msmNextChildElement(xmlTextReaderPtr reader, int depth) 
++{
 +    int ret = xmlTextReaderRead(reader);
 +    int cur = xmlTextReaderDepth(reader);
 +    while (ret == 1) {
@@ -2702,7 +2766,7 @@ diff -Nuarp rpm/security/msmmanifest.c rpm-security/security/msmmanifest.c
 +    return ret;
 +}
 +
-+ac_domain_x *msmFreeACDomain(ac_domain_x *ac_domain)
++static ac_domain_x *msmFreeACDomain(ac_domain_x *ac_domain)
 +{
 +	if (ac_domain) {
 +	    ac_domain_x *prev = ac_domain->prev;
@@ -2938,10 +3002,12 @@ diff -Nuarp rpm/security/msmmanifest.c rpm-security/security/msmmanifest.c
 +	   ASCII(path), ASCII(label), ASCII(exec_label), ASCII(type));
 +
 +   if (path && (label || exec_label)) {
-+	/*if (exec_label && label) {
-+	    rpmlog(RPMLOG_ERR, "An attempt to setup both label and exec_label on file. You should not need to do it.\n");
-+	    goto exit;
-+	} */
++	if ((label) && (msmVerifySmackLabel(ASCII(label)) < 0)) {
++		goto fail;
++	}
++	if ((exec_label) && (msmVerifySmackLabel(ASCII(exec_label)) < 0)) {
++		goto fail;
++	}
 +
 +	filesystem_x *filesystem = calloc(1, sizeof(filesystem_x));
 +	if (filesystem) {
@@ -2958,6 +3024,7 @@ diff -Nuarp rpm/security/msmmanifest.c rpm-security/security/msmmanifest.c
 +	   ASCII(path), ASCII(label), ASCII(exec_label));
 +    }
 +
++fail:
 +    msmFreePointer((void**)&path);
 +    msmFreePointer((void**)&label);
 +    msmFreePointer((void**)&exec_label);
@@ -3066,8 +3133,6 @@ diff -Nuarp rpm/security/msmmanifest.c rpm-security/security/msmmanifest.c
 +    return ret;
 +}
 +
-+
-+
 +static int msmProcessRequest(xmlTextReaderPtr reader, request_x *request) 
 +{
 +    const xmlChar *node, *name;
@@ -3103,57 +3168,6 @@ diff -Nuarp rpm/security/msmmanifest.c rpm-security/security/msmmanifest.c
 +    return ret;
 +}
 +
-+static int msmVerifyAccessType(const char* type){
-+	int res = 0, idx = 0;
-+
-+	if (type) {
-+	    if (strlen(type) > SMACK_ACCESS_TYPE_LENGHT) {
-+		    rpmlog(RPMLOG_ERR, "Lenght of the access type is bigger than allowed value: %s\n", type);
-+		    return -1;
-+	    }
-+	    while ( type[idx] != '\0' ){
-+		if ((type[idx] !='a') && (type[idx]!='r') && (type[idx]!='w') &&
-+		    (type[idx]!='x') && (type[idx]!='t') && (type[idx] !='-')) {
-+		    rpmlog(RPMLOG_ERR, "Not allowed character in access type: %s\n", type);
-+		    res = -1;
-+		    break;
-+		}
-+		idx++;
-+	    }
-+	} else return -1; 
-+	return res;
-+}
-+
-+static int msmVerifySmackLabel(const char* type){
-+	int res = 0, idx = 0;
-+
-+	if (type) {
-+	    if (strlen(ASCII(type)) > SMACK_LABEL_LENGTH) { //smack limitation on lenght
-+		rpmlog(RPMLOG_ERR, "Domain or label name  %s lenght is longer than defined SMACK_LABEL_LENGTH\n", type);
-+		return -1; 
-+	    }
-+           if (strlen(ASCII(type)) == 0){
-+		rpmlog(RPMLOG_ERR, "An attempt to define an empty domain or label name\n");
-+    		return -1; 
-+	    }
-+ 	    if (type[0] == '-') {
-+		rpmlog(RPMLOG_ERR, "Dash is not allowed as first character in smack label: %s\n", type);
-+		return -1;
-+	    }
-+	    while ( type[idx] != '\0' ){
-+		if ((type[idx] =='\"') || (type[idx] =='\'') || (type[idx] =='/') ||
-+		    (type[idx] =='\\') || (type[idx] > '~') || (type[idx] <= ' ')) {
-+		    rpmlog(RPMLOG_ERR, "Not allowed character in smack label: %s, position:%d \n", type, idx);
-+		    res = -1;
-+		    break;
-+		}
-+		idx++;
-+	    }
-+	} else return -1; 
-+
-+	return res;
-+}
-+
 +static int msmProcessDRequest(xmlTextReaderPtr reader, define_x *define) 
 +{
 +    const xmlChar *node = NULL, *label = NULL, *type = NULL;
@@ -3176,6 +3190,11 @@ diff -Nuarp rpm/security/msmmanifest.c rpm-security/security/msmmanifest.c
 +		    	msmFreePointer((void**)&type);	
 +			return -1; 
 +		    }
++		    if (msmVerifySmackLabel(ASCII(label)) < 0) {
++		    	msmFreePointer((void**)&label);
++		    	msmFreePointer((void**)&type);
++			return -1;
++		    }
 +		    d_request_x *request = calloc(1, sizeof(d_request_x));
 +		    if (request) {
 +			request->label_name = ASCII(label);
@@ -3205,7 +3224,7 @@ diff -Nuarp rpm/security/msmmanifest.c rpm-security/security/msmmanifest.c
 +
 +static int msmProcessDPermit(xmlTextReaderPtr reader, define_x *define) 
 +{
-+    const xmlChar *node, *label, *type;
++    const xmlChar *node, *label, *type, *to_label;
 +    int ret, depth;
 +
 +    rpmlog(RPMLOG_DEBUG, "permit\n");
@@ -3217,22 +3236,38 @@ diff -Nuarp rpm/security/msmmanifest.c rpm-security/security/msmmanifest.c
 +
 +	if (!strcmp(ASCII(node), "smack")) {
 +	    label = xmlTextReaderGetAttribute(reader, XMLCHAR("permit"));
++	    to_label = xmlTextReaderGetAttribute(reader, XMLCHAR("to"));
 +	    type = xmlTextReaderGetAttribute(reader, XMLCHAR("type"));
-+	    rpmlog(RPMLOG_DEBUG, "permit %s type %s\n", ASCII(label), ASCII(type));
++	    rpmlog(RPMLOG_DEBUG, "permit %s to %s type %s\n", ASCII(label), ASCII(to_label), ASCII(type));
 +
 +	    if (label && type) {
 +		    if (msmVerifyAccessType(ASCII(type)) < 0) {
 +		    	msmFreePointer((void**)&label);
++		    	msmFreePointer((void**)&to_label);
 +		    	msmFreePointer((void**)&type);	
 +			return -1; 
 +		    }
++		    if (msmVerifySmackLabel(ASCII(label)) < 0) {
++		    	msmFreePointer((void**)&label);
++		    	msmFreePointer((void**)&to_label);
++		    	msmFreePointer((void**)&type);
++			return -1;
++		    }
++		    if ((to_label) && (msmVerifyLabelPrefix(ASCII(to_label), define->name) < 0)) {
++		    	msmFreePointer((void**)&label);
++		    	msmFreePointer((void**)&to_label);
++		    	msmFreePointer((void**)&type);
++			return -1;
++		    }
 +		    d_permit_x *permit = calloc(1, sizeof(d_permit_x));
 +		    if (permit) {
 +			permit->label_name = ASCII(label);
++			permit->to_label_name = ASCII(to_label);
 +			permit->ac_type = ASCII(type);
 +			LISTADD(define->d_permits, permit);
 +		    } else {
 +			msmFreePointer((void**)&label);
++		    	msmFreePointer((void**)&to_label);
 +		   	msmFreePointer((void**)&type);
 +			return -1;
 +		    }
@@ -3241,6 +3276,7 @@ diff -Nuarp rpm/security/msmmanifest.c rpm-security/security/msmmanifest.c
 +		    rpmlog(RPMLOG_ERR, "One of the mandatory arguments for domain permit is missing. Abort installation\n");
 +		    rpmlog(RPMLOG_ERR, "smack permit label %s type %s\n", ASCII(label), ASCII(type));
 +		    msmFreePointer((void**)&label);
++		    msmFreePointer((void**)&to_label);
 +		    msmFreePointer((void**)&type);	
 +		    return -1;
 +	    }
@@ -3257,7 +3293,6 @@ diff -Nuarp rpm/security/msmmanifest.c rpm-security/security/msmmanifest.c
 +{
 +    const xmlChar *node, *label;
 +    int ret = 0, depth;
-+    char sep[]= "::";
 +
 +    rpmlog(RPMLOG_DEBUG, "provide\n");
 +
@@ -3271,35 +3306,16 @@ diff -Nuarp rpm/security/msmmanifest.c rpm-security/security/msmmanifest.c
 +	    rpmlog(RPMLOG_DEBUG, "label %s \n", ASCII(label));
 +
 +	    if (label) {
-+		    if (strlen(ASCII(label)) > SMACK_LABEL_LENGTH) { //smack limitation on lenght
-+			rpmlog(RPMLOG_ERR, "Label name  %s lenght %d is longer than defined SMACK_LABEL_LENGTH. Can't define such domain\n", 
-+													label, strlen(ASCII(label)));
++		    if (msmVerifySmackLabel(ASCII(label)) < 0) {
 +    			msmFreePointer((void**)&label);
 +			return -1;
 +		    }
 +
-+		    char *tmp = calloc(strlen(define->name) + 3, sizeof (const char));
-+		    if (!tmp) {
-+			msmFreePointer((void**)&label);
++		    if (msmVerifyLabelPrefix(ASCII(label), define->name) < 0) {
++    			msmFreePointer((void**)&label);
 +			return -1;
 +		    }
 +
-+		    strncpy(tmp, define->name, strlen(define->name));
-+		    strncpy(tmp + strlen(define->name), sep, 2);
-+
-+		    if (strstr(ASCII(label), tmp) != ASCII(label)) { //label name should be prefixed by domain name and "::"
-+			rpmlog(RPMLOG_ERR, "Label name %s isn't prefixed by domain name %s. Can't define such domain\n", ASCII(label), define->name);
-+			msmFreePointer((void**)&label);
-+		    	msmFreePointer((void**)&tmp);
-+			return -1;
-+		    } 
-+
-+		    msmFreePointer((void**)&tmp);
-+
-+		    if (msmVerifySmackLabel(ASCII(label) + strlen(define->name) + 2) < 0) {
-+			msmFreePointer((void**)&label);
-+			return -1;
-+		    }
 +		    d_provide_x *provide = calloc(1, sizeof(d_provide_x));
 +		    if (provide) {
 +			provide->label_name = ASCII(label);
@@ -3755,8 +3771,6 @@ diff -Nuarp rpm/security/msmmanifest.c rpm-security/security/msmmanifest.c
 +    return ret;
 +}
 +
-+
-+
 +static filesystem_x *msmFreeFilesystem(filesystem_x *filesystem)
 +{    
 +	if (filesystem) {
@@ -3790,7 +3804,6 @@ diff -Nuarp rpm/security/msmmanifest.c rpm-security/security/msmmanifest.c
 +
 +}
 +
-+
 +static interface_x *msmFreeInterface(interface_x *interface)
 +{    
 +
@@ -3873,7 +3886,6 @@ diff -Nuarp rpm/security/msmmanifest.c rpm-security/security/msmmanifest.c
 +    return prev;
 +}
 +
-+
 +static file_x *msmFreeFile(file_x *file)
 +{
 +    file_x *prev = file->prev;
@@ -3969,6 +3981,7 @@ diff -Nuarp rpm/security/msmmanifest.c rpm-security/security/msmmanifest.c
 +    d_permit_x *next = d_permit->next;
 +    rpmlog(RPMLOG_DEBUG, "freeing domain permit %s\n", d_permit->label_name);
 +    msmFreePointer((void**)&d_permit->label_name);
++    msmFreePointer((void**)&d_permit->to_label_name);
 +    msmFreePointer((void**)&d_permit->ac_type);
 +    msmFreePointer((void**)&d_permit);
 +    return next;
@@ -4084,7 +4097,7 @@ diff -Nuarp rpm/security/msmmanifest.c rpm-security/security/msmmanifest.c
 +}
 diff -Nuarp rpm/security/msmmatch.c rpm-security/security/msmmatch.c
 --- rpm/security/msmmatch.c	1970-01-01 02:00:00.000000000 +0200
-+++ rpm-security/security/msmmatch.c	2012-07-24 12:27:43.027952214 +0300
++++ rpm-security/security/msmmatch.c	2012-08-06 12:49:34.381011684 +0300
 @@ -0,0 +1,71 @@
 +/*
 + * This file is part of MSM security plugin
@@ -4159,8 +4172,8 @@ diff -Nuarp rpm/security/msmmatch.c rpm-security/security/msmmatch.c
 +
 diff -Nuarp rpm/security/msmxattr.c rpm-security/security/msmxattr.c
 --- rpm/security/msmxattr.c	1970-01-01 02:00:00.000000000 +0200
-+++ rpm-security/security/msmxattr.c	2012-07-24 12:44:01.576804569 +0300
-@@ -0,0 +1,1340 @@
++++ rpm-security/security/msmxattr.c	2012-08-06 13:37:44.891344948 +0300
+@@ -0,0 +1,1344 @@
 +/*
 + * This file is part of MSM security plugin
 + * Greatly based on the code of MSSF security plugin
@@ -4218,6 +4231,7 @@ diff -Nuarp rpm/security/msmxattr.c rpm-security/security/msmxattr.c
 +	HASH_CLEAR(hh,allpackages);
 +    }
 +}
++
 +static int msmCheckACDomainRules(ac_domain_x *ac_domain, 
 +				    sw_source_x *requested, sw_source_x *provided)
 +{
@@ -4226,6 +4240,7 @@ diff -Nuarp rpm/security/msmxattr.c rpm-security/security/msmxattr.c
 +    /* go through sw source and its parents: ac domains must not match */
 +    /* deny or deny wildcards and must match allow or allow wildcards */
 +    /* in the whole path up to the level of the providing sw source */ 
++
 +    for (sw_source = requested; sw_source->parent && sw_source->parent != sw_source; sw_source = sw_source->parent) {
 +	ac_domain_x *denied;
 +	ac_domain_x *allowed;
@@ -4251,6 +4266,20 @@ diff -Nuarp rpm/security/msmxattr.c rpm-security/security/msmxattr.c
 +    return 1; /* still here, allow for root sw source */
 +}
 +
++static int msmCheckLabelProvisioning(manifest_x *mfx, const char* label) 
++{
++
++    d_provide_x *provide = NULL;
++
++    if ((mfx) && (label) && (mfx->define) && (mfx->define->d_provides)) {
++	    for (provide = mfx->define->d_provides; provide; provide = provide->prev) {
++		if ( strcmp(provide->label_name, label) == 0 )
++			return 0;
++	    }
++    }
++    rpmlog(RPMLOG_ERR, "Label %s hasn't been provided in the manifest\n", label);
++    return -1;
++}
 +
 +static int msmSetSmackRules(struct smack_accesses *smack_accesses, ac_domain_x *ac_domains, const char *aid)
 +{
@@ -4276,7 +4305,6 @@ diff -Nuarp rpm/security/msmxattr.c rpm-security/security/msmxattr.c
 +
 +}
 +
-+
 +static int msmIsProvideAllowed(ac_domain_x *provided, sw_source_x *sw_source, const char *origin)
 +{
 +
@@ -4302,7 +4330,6 @@ diff -Nuarp rpm/security/msmxattr.c rpm-security/security/msmxattr.c
 +    return msmCheckACDomainRules(provided, sw_source, provided->sw_source);
 +}
 +
-+
 +static int msmSetSmackProvide(struct smack_accesses *smack_accesses, provide_x *provide, sw_source_x *sw_source)
 +{
 +    ac_domain_x *ac_domain;
@@ -4340,6 +4367,7 @@ diff -Nuarp rpm/security/msmxattr.c rpm-security/security/msmxattr.c
 +    /* NOTE: Creating zypper repos manually here! */
 +    /* A library call would be the correct way, but calling c++ from c */
 +    /* is not nice. On the other hand, now there is no libzypp dependency. */
++
 +    char *sysconfdir = rpmExpand("%{?_sysconfdir}", NULL);
 +    if (!sysconfdir || !strcmp(sysconfdir, "")) {
 +	rpmlog(RPMLOG_ERR, "Failed to expand %%_sysconfdir macro\n");
@@ -4546,7 +4574,6 @@ diff -Nuarp rpm/security/msmxattr.c rpm-security/security/msmxattr.c
 +    return 0;
 +}
 +
-+
 +static void msmRemoveDBusConfig(package_x *package, dbus_x *dbuss)
 +{
 +    dbus_x *dbus;
@@ -4677,7 +4704,6 @@ diff -Nuarp rpm/security/msmxattr.c rpm-security/security/msmxattr.c
 +    return 0;
 +}
 +
-+
 +static int msmSetupDBusConfig(package_x *package, dbus_x *dbus, int phase)
 +{
 +    char path[NAME_MAX+1];
@@ -4804,19 +4830,64 @@ diff -Nuarp rpm/security/msmxattr.c rpm-security/security/msmxattr.c
 +    } else return 0;
 +
 +    return msmCheckACDomainRules(provided, mfx->sw_source, provided->sw_source);
++}
 +
++static int msmCheckDomainJoinPossibility(manifest_x *mfx, ac_domain_x *defined_ac_domain) 
++{
 +
++    char *tmp = NULL, *pch = NULL;
++    unsigned int found = 0;
++
++    if ((!mfx) || (!defined_ac_domain))
++    	return -1; 
++
++    if (defined_ac_domain->type) {
++	if (strcmp(defined_ac_domain->type, "restricted") == 0) {
++		if (defined_ac_domain->plist) {
++			tmp = calloc(strlen(defined_ac_domain->plist) + 1, sizeof(char));
++			if (!tmp) return -1; 
++			strncpy(tmp, defined_ac_domain->plist, strlen(defined_ac_domain->plist));
++			pch = strtok (tmp, ", ");
++			while (pch != NULL)
++			{
++				if (strcmp(pch, mfx->name) == 0) {
++					found = 1; 
++					break;
++				}					
++				pch = strtok(NULL, ", ");
++			}
++			msmFreePointer((void**)&tmp);
++		}
++		if (found != 1) {
++	   		rpmlog(RPMLOG_ERR, "Request for a domain name %s isn't allowed ", mfx->request->ac_domain);
++	   		rpmlog(RPMLOG_ERR, "because ac domain is marked as restricted\n");
++		   	return -1;
++		}
++   	} else if (strcmp(defined_ac_domain->type, "shared") == 0) {
++	   	return 0;			
++   	} else {
++	   	// domain hasn't been marked as shared 
++	   	rpmlog(RPMLOG_ERR, "Request for a domain name %s isn't allowed ", mfx->request->ac_domain);
++	   	rpmlog(RPMLOG_ERR, "because ac domain is marked as private\n");
++		return -1;
++	}
++   } else { 
++	// by default ac domains are private
++   	rpmlog(RPMLOG_ERR, "Request for a domain name %s isn't allowed ", mfx->request->ac_domain);
++	rpmlog(RPMLOG_ERR, "because ac domain is marked as private\n");
++	return -1;
++  }
++
++  return 0;
 +}
 +
-+int msmSetupRequests(manifest_x *mfx){
++int msmSetupRequests(manifest_x *mfx) 
++{
 +
 +  	ac_domain_x *defined_ac_domain = NULL; 
 +
-+	if (!mfx->request) 
-+		return 0;
-+
-+	if (!mfx->request->ac_domain) 
-+		return 0;
++	if ((!mfx) || (!mfx->request) || (!mfx->request->ac_domain))
++		return -1;
 +	
 +	HASH_FIND(hh, all_ac_domains, mfx->request->ac_domain, strlen(mfx->request->ac_domain), defined_ac_domain);
 +	if (!defined_ac_domain){ // request for a undefined domain. 
@@ -4824,55 +4895,21 @@ diff -Nuarp rpm/security/msmxattr.c rpm-security/security/msmxattr.c
 +		return -1;
 +	}
 +
-+	//now check that this ac_domain can be requested
++	//now check that the package can join the requested AC domain
 +
-+        if (mfx->define){
++       if (mfx->define){
 +		rpmlog(RPMLOG_DEBUG, "mfx->define->name %s mfx->request->ac_domain %s\n", mfx->define->name, mfx->request->ac_domain);
 +		if (strcmp(mfx->define->name, mfx->request->ac_domain) == 0)
-+			//ac domain is requested from the same package where it was define. this case is always allowed
++			//ac domain is requested from the same package where it was define. This case is always allowed
 +			return 0;		
 +	} 
-+	//need to check if developer allowed other packages to request this domain
-+	if (defined_ac_domain->type) {
-+		if (strcmp(defined_ac_domain->type, "restricted") == 0) {
-+			if (defined_ac_domain->plist){
-+				unsigned int found = 0;
-+				char *tmp = calloc(strlen(defined_ac_domain->plist) + 1, sizeof(char));
-+				if (tmp) {
-+					strncpy(tmp, defined_ac_domain->plist, strlen(defined_ac_domain->plist));
-+					char *pch = strtok (tmp,", ");
-+					while (pch != NULL)
-+					  {
-+					    if (strcmp(pch,mfx->name) == 0) {
-+						found = 1; 
-+						break;
-+					    }					
-+					    pch = strtok(NULL, ", ");
-+					  }
-+					msmFreePointer((void**)&tmp);
-+				}
-+				if (found != 1) {
-+					rpmlog(RPMLOG_ERR, "Request for a domain name %s isn't allowed because ac domain is restricted\n", mfx->request->ac_domain);
-+					return -1;
-+				}
-+			} else {
-+				rpmlog(RPMLOG_ERR, "Request for a domain name %s isn't allowed because ac domain is restricted\n", mfx->request->ac_domain);
-+				return -1;
-+			}
-+		} else if (strcmp(defined_ac_domain->type, "shared") != 0) {
-+			// domain hasn't been marked as shared 
-+			rpmlog(RPMLOG_ERR, "Request for a domain name %s isn't allowed because ac domain is marked as private\n", mfx->request->ac_domain);
-+			return -1;
-+			
-+		}
-+	} else { 
-+		// by default ac domains are private
-+		rpmlog(RPMLOG_ERR, "Request for a domain name %s isn't allowed because ac domain is marked as private\n", mfx->request->ac_domain);
++
++	//need to check if developer allowed other packages to join this domain
++	if (msmCheckDomainJoinPossibility(mfx, defined_ac_domain) < 0 )
 +		return -1;
-+	}
 +	
++	// now checking if security policy allows to join this domain
 +	if (msmIsRequestAllowed(mfx, defined_ac_domain)) {
-+		// request is allowed by domain policy
 +	    rpmlog(RPMLOG_INFO, "Request for a domain name %s is allowed based on package sw source\n", mfx->request->ac_domain);
 +	    return 0;
 +		
@@ -4886,6 +4923,7 @@ diff -Nuarp rpm/security/msmxattr.c rpm-security/security/msmxattr.c
 +{
 +    provide_x *provide;
 +    ac_domain_x *ac_domain;
++
 +    for (provide = package->provides; provide; provide = provide->prev) {
 +	for (ac_domain = provide->ac_domains; ac_domain; ac_domain = ac_domain->prev) {
 +	    ac_domain_x *current_d = NULL;
@@ -4922,7 +4960,8 @@ diff -Nuarp rpm/security/msmxattr.c rpm-security/security/msmxattr.c
 +    return 0;
 +}
 +
-+int msmSetupDBusPolicies(package_x *package) {
++int msmSetupDBusPolicies(package_x *package) 
++{
 +
 +	dbus_x *session = NULL;
 +	dbus_x *system = NULL;
@@ -4947,45 +4986,56 @@ diff -Nuarp rpm/security/msmxattr.c rpm-security/security/msmxattr.c
 +
 +}
 +
-+
-+static int msmCheckDomainRequest(manifest_x *mfx, char* requested){
++static int msmCheckDomainRequestOrPermit(manifest_x *mfx, const char* domain) 
++{
 +
 +  	ac_domain_x *defined_ac_domain = NULL; 
++	char* name = NULL;
 +
-+	if (!mfx) 
++	if ((!mfx) || (!domain))
 +		return -1;
 +
-+	if (!requested) 
-+		return -1;
++	name = calloc(strlen(domain) + 1, sizeof(char));
++	if (!name) return -1;
++	strncpy(name, domain, strlen(domain));
++	strtok(name, ":");  // remove label name if present
++	rpmlog(RPMLOG_DEBUG, "label name %s domain name %s \n", domain, name);
 +	
-+	HASH_FIND(hh, all_ac_domains, requested, strlen(requested), defined_ac_domain);
-+	if (!defined_ac_domain){ // request for a undefined domain. 
-+		rpmlog(RPMLOG_ERR, "A domain name %s that hasn't been yet defined by any package. Can't verify if request is allowed\n", requested);
++	HASH_FIND(hh, all_ac_domains, name, strlen(name), defined_ac_domain);
++	if (!defined_ac_domain) { // request or permit for an undefined domain. 
++		rpmlog(RPMLOG_ERR, "A domain name %s hasn't been yet defined by any package. Can't verify if it is allowed\n", name);
++		msmFreePointer((void**)&name);
 +		return -1;
 +	}
 +
 +	//now check that this ac_domain can be requested
 +
-+        if (mfx->define){
-+		rpmlog(RPMLOG_DEBUG, "mfx->sw_source->name %s requested %s\n", mfx->sw_source->name, requested);
-+		if (strcmp(mfx->sw_source->name, requested) == 0)
-+			//ac domain access is requested from the same package where it was define. this case is always allowed
++        if ((mfx->define) && (mfx->define->name)) {
++		rpmlog(RPMLOG_DEBUG, "mfx->define->name %s domain %s\n", mfx->define->name, name);
++		if (strcmp(mfx->define->name, name) == 0) {
++			// AC domain access is requested or permitted from the same package where it was defined. 
++			// This case is always allowed
++			msmFreePointer((void**)&name);
 +			return 0;		
-+	} 
-+	// no need to check if developer allowed other packages to request this domain, because this isn't a request to belong to a domain, but request to domain access
++		}
++	 } 
++
++	 // no need to check if developer allowed other packages to request/permit this domain
++        // because this isn't a request to belong to a domain, but request/permit for domain access
 +	
 +	if (msmIsRequestAllowed(mfx, defined_ac_domain)) {
-+		// request is allowed by domain policy
-+	    rpmlog(RPMLOG_DEBUG, "Request to access a domain name %s is allowed based on package sw source\n", requested);
++	    // request or permit is allowed by domain policy
++	    rpmlog(RPMLOG_DEBUG, "Request/Permit to access a domain name %s is allowed based on package sw source\n", name);
++	    msmFreePointer((void**)&name);
 +	    return 0;
 +		
 +	} else {
-+	    rpmlog(RPMLOG_ERR, "Request to access a domain name %s isn't allowed based on package sw source\n", requested);
++	    rpmlog(RPMLOG_ERR, "Request/Permit to access a domain name %s isn't allowed based on package sw source\n", name);
++	    msmFreePointer((void**)&name);
 +	    return -1;
 +	}
 +}
 +
-+
 +int msmSetupDefine(struct smack_accesses *smack_accesses, manifest_x *mfx)
 +{
 +    d_request_x *d_request;
@@ -4993,10 +5043,11 @@ diff -Nuarp rpm/security/msmxattr.c rpm-security/security/msmxattr.c
 +    ac_domain_x * defined_ac_domain = NULL;
 +    int ret;
 +
-+    if (!mfx->define->name) {
-+			rpmlog(RPMLOG_ERR, "Failed to setup define with empty name\n");
-+			return -1;
++    if ( (!mfx) || (!mfx->define) || (!mfx->define->name)) {
++	rpmlog(RPMLOG_ERR, "Failed to setup define with empty name\n");
++	return -1;
 +    }
++
 +    /* need to check if domain hasn't been already defined by other package */
 +
 +    HASH_FIND(hh, all_ac_domains, mfx->define->name, strlen(mfx->define->name), defined_ac_domain);
@@ -5011,20 +5062,10 @@ diff -Nuarp rpm/security/msmxattr.c rpm-security/security/msmxattr.c
 +
 +    if (mfx->define->d_requests) {
 +	    for (d_request = mfx->define->d_requests; d_request; d_request = d_request->prev) {
-+
 +			// first check if the current's package sw source can grant access to requested domain
-+			char* name = calloc(strlen(d_request->label_name) + 1, sizeof(char));
-+			if (!name) return -1;
-+			strncpy(name, d_request->label_name, strlen(d_request->label_name));
-+			strtok(name, ":");// remove label name if present
-+			rpmlog(RPMLOG_DEBUG, "label name %s domain name %s \n", d_request->label_name, name);
-+                       ret = msmCheckDomainRequest(mfx, name);
-+			msmFreePointer((void**)&name);
-+			if (ret < 0) {
++			if ( msmCheckDomainRequestOrPermit(mfx, d_request->label_name) < 0 )
 +				return -1;
-+			}
-+			ret = smack_accesses_add(smack_accesses, mfx->define->name, d_request->label_name, d_request->ac_type);
-+			if (ret < 0) {
++			if ( smack_accesses_add(smack_accesses, mfx->define->name, d_request->label_name, d_request->ac_type) < 0 ) {
 +				rpmlog(RPMLOG_ERR, "Failed to set smack rules for domain requests\n");
 +				return -1;
 +			}	
@@ -5034,20 +5075,26 @@ diff -Nuarp rpm/security/msmxattr.c rpm-security/security/msmxattr.c
 +
 +    if (mfx->define->d_permits) {
 +	    for (d_permit = mfx->define->d_permits; d_permit; d_permit = d_permit->prev) {
-+			ret = smack_accesses_add(smack_accesses, d_permit->label_name, mfx->define->name, d_permit->ac_type);
++			// first check if the current's package sw source can grant access to permited domain
++			if ( msmCheckDomainRequestOrPermit(mfx, d_permit->label_name) < 0 )
++				return -1;
++			if (!d_permit->to_label_name)
++				ret = smack_accesses_add(smack_accesses, d_permit->label_name, mfx->define->name, d_permit->ac_type);
++			else {
++				if ( msmCheckLabelProvisioning(mfx, d_permit->to_label_name) < 0 )
++					return -1;
++				ret = smack_accesses_add(smack_accesses, d_permit->label_name, d_permit->to_label_name, d_permit->ac_type);
++			}
 +			if (ret < 0) {
 +				rpmlog(RPMLOG_ERR, "Failed to set smack rules for domain permits\n");
 +				return -1;
 +			}	
-+	
 +	    }
 +    }
-+
 + 
 +    return 0;
 +}
 +
-+
 +package_x *msmCreatePackage(const char *name, sw_source_x *sw_source, provide_x *provides, const char *modified)
 +{
 +    if (!name) return NULL;
@@ -5073,8 +5120,8 @@ diff -Nuarp rpm/security/msmxattr.c rpm-security/security/msmxattr.c
 +    return NULL;
 +}
 +
-+int msmSetupSmackRules(struct smack_accesses *smack_accesses, const char* package_name, int flag, int SmackEnabled){
-+
++int msmSetupSmackRules(struct smack_accesses *smack_accesses, const char* package_name, int flag, int SmackEnabled)
++{
 +    int ret = 0;
 +    char * buffer = calloc(strlen(SMACK_RULES_PATH) + strlen(package_name) + 1, sizeof(char));
 +    if (!buffer) return -1;    
@@ -5136,6 +5183,7 @@ diff -Nuarp rpm/security/msmxattr.c rpm-security/security/msmxattr.c
 +    return 0;	
 +
 +}
++
 +int msmSetupPackages(struct smack_accesses *smack_accesses, package_x *packages, sw_source_x *sw_source)
 +{
 +    package_x *package, *first = NULL;
@@ -5182,7 +5230,6 @@ diff -Nuarp rpm/security/msmxattr.c rpm-security/security/msmxattr.c
 +    return 0;
 +}
 +
-+
 +package_x *msmCheckPackage(const char *name)
 +{
 +    package_x *package = NULL;
@@ -5245,31 +5292,31 @@ diff -Nuarp rpm/security/msmxattr.c rpm-security/security/msmxattr.c
 +    }
 +}
 +
-+static int is_executable(const char* path) {
-+
-+ char buffer[1024];
-+ int result;
-+ char string[] = "file \"";
-+ char* ptr = NULL, *ptr1 = NULL;
-+ FILE* pipe;
++static int is_executable(const char* path) 
++{
++   char buffer[1024];
++   int result;
++   char string[] = "file \"";
++   char* ptr = NULL, *ptr1 = NULL;
++   FILE* pipe;
 +
-+ if (!path)
++   if (!path)
 +	return -1;
 +
-+ char* str = calloc(strlen(path) + 8, sizeof (char*));
-+ strncpy(str, string, 6);
-+ strncpy(str + 6, path, strlen(path));
-+ strncpy(str + 6 + strlen(path), "\"", 1);
++   char* str = calloc(strlen(path) + 8, sizeof (char*));
++   strncpy(str, string, 6);
++   strncpy(str + 6, path, strlen(path));
++   strncpy(str + 6 + strlen(path), "\"", 1);
 +
-+ pipe = popen(str, "r");
-+ if (!pipe) {
-+   msmFreePointer((void**)&str);
-+   return -1;
-+ }
++   pipe = popen(str, "r");
++   if (!pipe) {
++     msmFreePointer((void**)&str);
++     return -1;
++   }
 +
-+ result = -1; 
++   result = -1; 
 +
-+ if(fgets(buffer, 1023, pipe) != NULL) {
++   if(fgets(buffer, 1023, pipe) != NULL) {
 +	ptr = strchr(buffer,':');
 +	if (ptr!= NULL) { 
 +		ptr1 = strstr(ptr,"executable");
@@ -5277,52 +5324,63 @@ diff -Nuarp rpm/security/msmxattr.c rpm-security/security/msmxattr.c
 +		ptr1 = strstr(ptr,"ELF");
 +		if (ptr1) result = 0;		
 +	}
-+ }
++   }
 +
-+ msmFreePointer((void**)&str);
-+ pclose(pipe);
-+ return result;
++   msmFreePointer((void**)&str);
++   pclose(pipe);
++   return result;
 +}
-+int msmSetFilesystemLabels(manifest_x *mfx, char* rootDir) {
-+    file_x *file;
-+    provide_x *provide;
-+    filesystem_x *filesystem;
-+    int fd, ret = 0;
-+    size_t len;
++
++int msmSetFileXAttributes(manifest_x *mfx, const char* filepath) 
++{
++    provide_x *provide = NULL;
++    filesystem_x *filesystem = NULL;
++    int fd;
++    size_t len = 0, match = 0;
 +    const char *label = NULL;
 +    const char *exec_label = NULL;
 +    const char *type = NULL;
-+    int match = 0;
++    const char isolatedLabel[] = SMACK_ISOLATED_LABEL;
 +    struct stat st;
 +
-+   for (file = mfx->files; file; file = file->prev) {
-+	if (mfx->name) {
-+		package_x *package = msmCheckPackage(mfx->name);
-+		if (!package)
-+			return -1;
-+		for (provide = package->provides; provide; provide = provide->prev) {
-+		    for (filesystem = provide->filesystems; filesystem; filesystem = filesystem->prev) {
-+			if (!strcmp(file->path, filesystem->path)) {
++    if (mfx->name) {
++	package_x *package = msmCheckPackage(mfx->name);
++	if (!package)
++		return -1;
++	for (provide = package->provides; provide; provide = provide->prev) {
++		for (filesystem = provide->filesystems; filesystem; filesystem = filesystem->prev) {
++			if (!strcmp(filepath, filesystem->path)) {
 +			    /* exact match */
 +			    label = filesystem->label;
 +			    exec_label = filesystem->exec_label;
 +			    if (filesystem->type) type = filesystem->type;
 +			    goto found;
 +			}
++
 +			len = strlen(filesystem->path);
++			rpmlog(RPMLOG_DEBUG, "filesystem->path: %s, length %d\n", filesystem->path, len);
++			rpmlog(RPMLOG_DEBUG, "filesystem->path + len - 1: %s\n", filesystem->path + len - 1);
 +			if (len > match) {
-+			    if ((!strncmp(file->path, filesystem->path, len)) && (filesystem->type)) {
++			    if ((!strncmp(filepath, filesystem->path, len)) && (filesystem->type)) {
 +				/* partial match and the directory marked as transmutable*/
 +				label = filesystem->label;
-+			    exec_label = filesystem->exec_label;
++			    	exec_label = filesystem->exec_label;
 +				match = len;
 +			    }
++			    if (!strncmp(filesystem->path + len - 1, "*", 1)) { 
++			    	if (!strncmp(filepath, filesystem->path, len - 1))  {
++				    /* partial match and the path is marked with wildcard*/
++				    label = filesystem->label;
++			    	    exec_label = filesystem->exec_label;
++				    match = len - 1;
++			    	}
++ 			    }
 +			}
-+		    }
 +		}
-+       match = 0;
-+	} else 
-+		return -1;
++	}
++    } else 
++	return -1;
++
 +    found:
 +	if ((!label) || (!exec_label)) {
 +	    /* no match, use default label of AC domain */
@@ -5331,126 +5389,86 @@ diff -Nuarp rpm/security/msmxattr.c rpm-security/security/msmxattr.c
 +			if (!label) label = mfx->request->ac_domain;
 +			if (!exec_label) exec_label = mfx->request->ac_domain;
 +		} else {
-+			rpmlog(RPMLOG_ERR, "Request for AC domain is empty. Can't identify default file label\n");
-+			return -1;
++			rpmlog(RPMLOG_INFO, "Request for AC domain is empty. Can't identify default file label\n");
++			rpmlog(RPMLOG_INFO, "File will be labelled with the label \"Isolated\"\n");
++			if (!label) label = isolatedLabel;
++			if (!exec_label) exec_label = isolatedLabel;
 +		}
 +	     } else if (mfx->define) { // AC domain defined in manifest
 +		if (mfx->define->name) {
 +			if (!label) label = mfx->define->name;
 +			if (!exec_label) exec_label = mfx->define->name;
 +		} else {
-+			rpmlog(RPMLOG_ERR, "Define for AC domain is empty. Can't identify default file label\n");
-+			return -1;
++			rpmlog(RPMLOG_INFO, "Define for AC domain is empty. Can't identify default file label\n");
++			rpmlog(RPMLOG_INFO, "File will be labelled with the label \"Isolated\"\n");
++			if (!label) label = isolatedLabel;
++			if (!exec_label) exec_label = isolatedLabel;
 +		}		 
-+	     } else { // no request or definition of domain, return an error
-+			rpmlog(RPMLOG_ERR, "Both request and define for AC domain are empty. Can't identify default file label\n");
-+			return -1;
++	     } else { // no request or definition of domain
++			rpmlog(RPMLOG_INFO, "Both define and request sections are empty. Can't identify default file label\n");
++			rpmlog(RPMLOG_INFO, "File will be labelled with the label \"Isolated\"\n");
++			if (!label) label = isolatedLabel;
++			if (!exec_label) exec_label = isolatedLabel;
 +	     }
 +	} 
 + 
-+    	char* fullPath = NULL;
-+    	if ((rootDir) && (strcmp(rootDir, "/") != 0)) {   
-+        	fullPath = calloc(strlen(rootDir) + strlen(file->path), sizeof(char));
-+		snprintf(fullPath, strlen(rootDir) + strlen(file->path), "%s%s", rootDir, file->path + 1);
-+   		rpmlog(RPMLOG_DEBUG, "Full path %s, file->path: %s, rootDir: %s\n", fullPath, file->path, rootDir);
-+    	} else
-+       	fullPath = file->path;
-+
-+	fd = open(fullPath, O_RDONLY);
++	fd = open(filepath, O_RDONLY);
 +	if (fd == -1) {
 +	    rpmlog(RPMLOG_ERR, "Failed to open %s: %s\n", 
-+		   fullPath, strerror(errno));
-+	    goto next1;
++		   filepath, strerror(errno));
++	    return -1;
 +	}
-+	ret = fstat(fd, &st);
-+	if (ret == -1) {
++	
++	if (fstat(fd, &st) == -1) {
 +	    rpmlog(RPMLOG_ERR, "fstat failed for %s: %s\n", 
-+		   fullPath, strerror(errno));
-+	    goto next;
++		   filepath, strerror(errno));
++	    close(fd);
++	    return -1;
 +	}
-+	if (file->ino && (st.st_ino != file->ino)) {
-+	    rpmlog(RPMLOG_ERR, "Inode check failed for %s\n", fullPath);
-+	    goto next;
-+	} 	    
 +
-+	rpmlog(RPMLOG_INFO, "setting SMACK64 %s for %s\n", label, fullPath);
-+	ret = fsetxattr(fd, SMACK64, label, strlen(label), 0);
-+	if (ret < 0) {
++	rpmlog(RPMLOG_INFO, "setting SMACK64 %s for %s\n", label, filepath);
++
++	if (fsetxattr(fd, SMACK64, label, strlen(label), 0) < 0 ) {
 +	    rpmlog(RPMLOG_ERR, "Failed to set SMACK64 %s for %s: %s\n", 
-+		   label, fullPath, strerror(errno));
++		   label, filepath, strerror(errno));
 +	}
 +
-+	if ((is_executable(fullPath)) == 0) {
++	if ((is_executable(filepath)) == 0) {
 +		if ((exec_label) && (strcmp(exec_label, "none") == 0)) {
 +			// do not set SMACK64EXEC
-+			rpmlog(RPMLOG_INFO, "not setting SMACK64EXEC for %s as requested in manifest\n", fullPath);
++			rpmlog(RPMLOG_INFO, "not setting SMACK64EXEC for %s as requested in manifest\n", filepath);
 +		} else {
-+			rpmlog(RPMLOG_INFO, "setting SMACK64EXEC %s for %s\n", exec_label, fullPath);
-+			ret = fsetxattr(fd, SMACK64EXEC, exec_label, strlen(exec_label), 0);
-+			if (ret < 0) {
++			rpmlog(RPMLOG_INFO, "setting SMACK64EXEC %s for %s\n", exec_label, filepath);
++			if ( fsetxattr(fd, SMACK64EXEC, exec_label, strlen(exec_label), 0) < 0 ) {
 +		    		rpmlog(RPMLOG_ERR, "Failed to set SMACK64EXEC %s for %s: %s\n", 
-+			   exec_label, fullPath, strerror(errno));
++			   		exec_label, filepath, strerror(errno));
 +			}
 +		}
 +	}
 +		
-+	if (type) { //marked as transmutable
++	if (type) { //marked as transmutable+
 +		if (S_ISDIR(st.st_mode)) { //check that it is a directory
-+			char at_true[]="TRUE";
-+			rpmlog(RPMLOG_INFO, "setting SMACK64TRANSMUTE %s for %s\n", at_true, fullPath);
-+			ret = fsetxattr(fd, SMACK64TRANSMUTE, at_true, strlen(at_true), 0);
-+			if (ret < 0) {
++			char at_true[] = "TRUE";
++			rpmlog(RPMLOG_INFO, "setting SMACK64TRANSMUTE %s for %s\n", at_true, filepath);
++			if ( fsetxattr(fd, SMACK64TRANSMUTE, at_true, strlen(at_true), 0) < 0 ) {
 +			    rpmlog(RPMLOG_ERR, "Failed to set SMACK64TRANSMUTE %s for %s: %s\n", 
-+				   at_true, fullPath, strerror(errno));
++				   at_true, filepath, strerror(errno));
 +			}
 +		} else {
 +			rpmlog(RPMLOG_DEBUG, "No setting up of transmute attr for a non-directory, path %s\n", 
-+				   fullPath);
++				   filepath);
 +		}
 +	
 +	}
 +
-+   next:
-+	close(fd);
-+
-+   next1:
-+	label = NULL;
-+   	exec_label = NULL;
-+    	if ((rootDir) && (strcmp(rootDir, "/") != 0)) {
-+        	msmFreePointer((void**)&fullPath);
-+    	}
++    	close(fd);
 +
-+    }
 +    return 0;
-+}
 +
-+#if 0
-+
-+static void msmRemoveObjectRules(SmackRuleSet rule_set, const char *name, package_x *package )
-+{
-+    if (package) {
-+	provide_x *provide;
-+	ac_domain_x *ac_domain;
-+	for (provide = package->provides; provide; provide = provide->prev) {
-+	    for (ac_domain = provide->ac_domains; ac_domain; ac_domain = ac_domain->prev) {
-+		if (!strcmp(name, ac_domain->name)) {
-+		    name = NULL; /* don't remove this one, it's in upgrade */
-+		    goto out;
-+		}
-+	    }
-+	}
-+    }
-+ out:
-+    if (name) {
-+	rpmlog(RPMLOG_INFO, "removing smack object rules for %s\n", name);
-+	smack_rule_set_remove_by_object(rule_set, name, NULL);
-+    }
 +}
-+#endif
 +
 +void msmRemoveRules(struct smack_accesses *smack_accesses, manifest_x *mfx, int SmackEnabled)
 +{
-+
 +    provide_x *provide;
 +    package_x *package;
 +
@@ -5472,7 +5490,6 @@ diff -Nuarp rpm/security/msmxattr.c rpm-security/security/msmxattr.c
 +
 +}
 +
-+
 +void msmRemoveConfig(manifest_x *mfx)
 +{
 +    package_x *package;
@@ -5503,7 +5520,7 @@ diff -Nuarp rpm/security/msmxattr.c rpm-security/security/msmxattr.c
 +
 diff -Nuarp rpm/security/security.h rpm-security/security/security.h
 --- rpm/security/security.h	1970-01-01 02:00:00.000000000 +0200
-+++ rpm-security/security/security.h	2012-07-24 12:27:43.031952220 +0300
++++ rpm-security/security/security.h	2012-08-06 12:49:34.381011684 +0300
 @@ -0,0 +1,25 @@
 +#include "system.h"
 +