Warn on deprecated dir=untrusted rules

The legacy dir=untrusted rule macro remained accepted after it had been superseded by explicit trust matching, but parsing those rules did not tell administrators that the compatibility path is obsolete and scheduled for removal.

The parser now warns whenever a subject or object directory attribute resolves to the untrusted macro, including named sets. The existing positional subject/object compatibility check in check_object() is isolated behind a named helper with comments documenting why the obsolete behavior still exists.

Regression coverage in rules_test now pins the subject and object dir=untrusted warning paths, set-based warning behavior, exe=untrusted non-warning behavior, and the trusted-object compatibility exception.

Author: stevegrubb

ChangeLog

@@ -1,4 +1,6 @@
 1.6
+- Many internal changes
+- Mark dir=untrusted as deprecated in rules
 
 1.5
 - Increase the line length of config files (Renaud Métrich)

doc/fapolicyd.rules.5

@@ -83,7 +83,13 @@ The \fIsystemdirs\fP option will match against the same list as \fIexecdirs\fP b
 .B untrusted
 The \fIuntrusted\fP option will look up the current executable's full path in the rpm database to see if the executable is known to the system. The rule will trigger if the file in question is not in the trust database. This option is
 .B deprecated
-in favor of using obj_trust with execute permission when writing rules.
+in favor of using object \fBtrust\fP with execute permission when writing rules.
+Rules that use \fBdir=untrusted\fP emit a deprecation warning when parsed,
+and this compatibility option will be removed in a future release.
+For compatibility with older policies, a subject \fBdir=untrusted\fP rule
+paired with a path object at the same rule field position will not match a
+trusted object. This subject/object cross-reference is obsolete; use explicit
+object trust rules for new policy.
 .RE
 .TP
 .B ftype

src/library/rules.c

@@ -71,6 +71,29 @@ static int assign_subject(llist *l, lnode *n, int type,
 static int assign_object(llist *l, lnode *n, int type,
 			 const char *ptr2, int lineno) __wur;
 
+/*
+ * warn_deprecated_untrusted_dir - warn about the legacy dir=untrusted macro
+ * @type: parsed subject or object attribute type.
+ * @set: parsed attribute value set.
+ * @lineno: rule line number used for diagnostics.
+ * @side: rule side used to make the warning actionable.
+ *
+ * The untrusted directory macro was superseded by explicit trust attributes,
+ * but it remains accepted for old rules. Warn when a directory attribute uses
+ * it, including through a named set, so administrators have time to migrate
+ * before a future release removes this compatibility path.
+ */
+static void warn_deprecated_untrusted_dir(int type, attr_sets_entry_t *set,
+					  int lineno, const char *side)
+{
+	if ((type == EXE_DIR || type == ODIR) &&
+	    attr_set_check_str(set, "untrusted"))
+		msg(LOG_WARNING,
+		    "rules: line:%d: %s dir=untrusted is deprecated and "
+		    "will be removed in a future release",
+		    lineno, side);
+}
+
 int rules_create(llist *l)
 {
 	l->head = NULL;
@@ -571,6 +594,7 @@ static int assign_subject(llist *l, lnode *n, int type,
 	} // switch
 
 finalize:
+	warn_deprecated_untrusted_dir(type, n->s[i].set, lineno, "subject");
 	n->s_count++;
 	free(tmp);
 	sanity_check_node(n, "assign_subject - 2");
@@ -721,6 +745,7 @@ static int assign_object(llist *l, lnode *n, int type,
 
 
  finalize:
+	warn_deprecated_untrusted_dir(type, n->o[i].set, lineno, "object");
 	n->o_count++;
 	free(tmp);
 	sanity_check_node(n, "assign_object - 2");
@@ -1497,6 +1522,32 @@ static int check_subject(lnode *r, event_t *e)
 	return 1;
 }
 
+/*
+ * legacy_untrusted_subject_path_blocked - preserve untrusted path exception
+ * @r: rule being evaluated.
+ * @idx: object attribute index currently being evaluated.
+ * @e: event containing already-owned decision attributes.
+ *
+ * Historical exe=untrusted and dir=untrusted subject rules also filtered a
+ * path object at the same rule-field index: trusted objects did not match the
+ * legacy untrusted exception. The positional cross-reference is obsolete, but
+ * remains here for compatibility until dir=untrusted support is removed.
+ *
+ * Returns: 1 when the legacy compatibility rule blocks this object match,
+ * otherwise 0.
+ */
+static int legacy_untrusted_subject_path_blocked(lnode *r, unsigned int idx,
+						 event_t *e)
+{
+	if (idx >= r->s_count)
+		return 0;
+	if (r->s[idx].type != EXE && r->s[idx].type != EXE_DIR)
+		return 0;
+	if (!attr_set_check_str(r->s[idx].set, "untrusted"))
+		return 0;
+
+	return is_obj_trusted(e);
+}
 
 // Returns 0 if no match, 1 if a match
 __attribute__((hot))
@@ -1542,13 +1593,9 @@ static decision_t check_object(lnode *r, event_t *e)
 
 		case PATH:
 		  // skip if fall through
-		  if (type == PATH) {
-			if (r->s[cnt].type == EXE || r->s[cnt].type == EXE_DIR)
-				if (attr_set_check_str(r->s[cnt].set,
-						       "untrusted"))
-					if (is_obj_trusted(e))
-						return 0;
-		}
+		  if (type == PATH &&
+		      legacy_untrusted_subject_path_blocked(r, cnt, e))
+			return 0;
 
 		// fall through
 

src/tests/rules_test.c

@@ -209,6 +209,33 @@ static void prep_macro_event(event_t *e, const char *exe, const char *obj)
 	e->type = 0;
 }
 
+/*
+* add_trust_attrs - add cached subject and object trust values
+*
+* e: event to update
+* subj_trusted: subject trust value to cache
+* obj_trusted: object trust value to cache
+*
+* Returns: none
+*/
+static void add_trust_attrs(event_t *e, unsigned int subj_trusted,
+			    int obj_trusted)
+{
+	subject_attr_t subj_trust = {
+		.type = SUBJ_TRUST,
+		.uval = subj_trusted
+	};
+	object_attr_t obj_trust = {
+		.type = OBJ_TRUST,
+		.val = obj_trusted
+	};
+
+	if (subject_add(e->s, &subj_trust))
+		error(1, 0, "subject_add trust failed");
+	if (object_add(e->o, &obj_trust))
+		error(1, 0, "object_add trust failed");
+}
+
 /*
 * free_event - release memory from prep_event()
 */
@@ -330,6 +357,88 @@ int main(void)
 
 	rules_clear(&l);
 
+	/* deprecated dir=untrusted warnings and compatibility */
+	if (rules_create(&l))
+		error(1, 0, "rules_create failed");
+
+	rc = append_capture(&l,
+		"allow perm=any dir=untrusted : path=/tmp/payload", 1,
+		err, sizeof(err));
+	if (rc)
+		error(1, 0, "subject untrusted dir parse failed: %s", err);
+	if (strstr(err, "subject dir=untrusted is deprecated") == NULL)
+		error(1, 0, "subject untrusted dir warning missing: %s", err);
+
+	prep_macro_event(&e, "/opt/untrusted-tool", "/tmp/payload");
+	add_trust_attrs(&e, 0, 0);
+	if (evaluate(&l, &e) != ALLOW)
+		error(1, 0, "subject untrusted dir compatibility failed");
+	free_event(&e);
+
+	prep_macro_event(&e, "/opt/untrusted-tool", "/tmp/payload");
+	add_trust_attrs(&e, 0, 1);
+	if (evaluate(&l, &e) != NO_OPINION)
+		error(1, 0, "trusted object matched legacy exception");
+	free_event(&e);
+
+	rules_clear(&l);
+
+	if (rules_create(&l))
+		error(1, 0, "rules_create failed");
+
+	rc = append_capture(&l,
+		"allow perm=any all : dir=untrusted", 1,
+		err, sizeof(err));
+	if (rc)
+		error(1, 0, "object untrusted dir parse failed: %s", err);
+	if (strstr(err, "object dir=untrusted is deprecated") == NULL)
+		error(1, 0, "object untrusted dir warning missing: %s", err);
+
+	prep_macro_event(&e, "/usr/bin/bash", "/tmp/payload");
+	add_trust_attrs(&e, 1, 0);
+	if (evaluate(&l, &e) != ALLOW)
+		error(1, 0, "object untrusted dir compatibility failed");
+	free_event(&e);
+
+	prep_macro_event(&e, "/usr/bin/bash", "/tmp/payload");
+	add_trust_attrs(&e, 1, 1);
+	if (evaluate(&l, &e) != NO_OPINION)
+		error(1, 0, "trusted object matched object untrusted dir");
+	free_event(&e);
+
+	rules_clear(&l);
+
+	if (rules_create(&l))
+		error(1, 0, "rules_create failed");
+
+	rc = append_capture(&l, "%legacy=untrusted", 1, err, sizeof(err));
+	if (rc)
+		error(1, 0, "legacy set parse failed: %s", err);
+	if (strstr(err, "dir=untrusted is deprecated") != NULL)
+		error(1, 0, "set definition emitted dir warning: %s", err);
+
+	rc = append_capture(&l,
+		"allow perm=any all : dir=%legacy", 2, err, sizeof(err));
+	if (rc)
+		error(1, 0, "object untrusted dir set parse failed: %s", err);
+	if (strstr(err, "object dir=untrusted is deprecated") == NULL)
+		error(1, 0, "set-based untrusted dir warning missing: %s",
+		      err);
+
+	rules_clear(&l);
+
+	if (rules_create(&l))
+		error(1, 0, "rules_create failed");
+
+	rc = append_capture(&l,
+		"allow perm=any exe=untrusted : all", 1, err, sizeof(err));
+	if (rc)
+		error(1, 0, "exe untrusted rule parse failed: %s", err);
+	if (strstr(err, "dir=untrusted is deprecated") != NULL)
+		error(1, 0, "exe untrusted emitted dir warning: %s", err);
+
+	rules_clear(&l);
+
 	/* duplicate inline string values should remain harmless */
 	if (rules_create(&l))
 		error(1, 0, "rules_create failed");