git: 8e605d88c2f1 - stable/14 - MAC/do: Ease input/output of ID types

The branch stable/14 has been updated by olce:

URL: https://cgit.FreeBSD.org/src/commit/?id=8e605d88c2f1ed3fea26fb5017a76d02952b47eb

commit 8e605d88c2f1ed3fea26fb5017a76d02952b47eb
Author:     Olivier Certner <olce@FreeBSD.org>
AuthorDate: 2024-07-05 13:30:15 +0000
Commit:     Olivier Certner <olce@FreeBSD.org>
CommitDate: 2025-04-03 19:31:02 +0000

    MAC/do: Ease input/output of ID types
    
    Have a static constant array mapping numerical ID types to their
    canonical representations ('id_type_to_str').
    
    New parse_id_type() that parses a type thanks to 'id_type_to_str' and
    with a special case to accept also 'any'.
    
    Have parse_rule_element() use parse_id_type().  A later commit will add
    a second call to the latter for the destination ID.
    
    Reviewed by:    bapt
    Approved by:    markj (mentor)
    Sponsored by:   The FreeBSD Foundation
    Differential Revision:  https://reviews.freebsd.org/D47615
    
    (cherry picked from commit 65766063f85d8b8fe8b24a50250a12a122974c26)
---
 sys/security/mac_do/mac_do.c | 49 +++++++++++++++++++++++++++++++++++++++-----
 1 file changed, 44 insertions(+), 5 deletions(-)

diff --git a/sys/security/mac_do/mac_do.c b/sys/security/mac_do/mac_do.c
index e13684c15dab..5bec02ee2e56 100644
--- a/sys/security/mac_do/mac_do.c
+++ b/sys/security/mac_do/mac_do.c
@@ -38,10 +38,20 @@ static MALLOC_DEFINE(M_DO, "do_rule", "Rules for mac_do");
 
 static unsigned		mac_do_osd_jail_slot;
 
+#define RULE_INVALID	0 /* Must stay 0. */
 #define RULE_UID	1
 #define RULE_GID	2
 #define RULE_ANY	3
 
+static const char *id_type_to_str[] = {
+	[RULE_INVALID]	= "invalid",
+	[RULE_UID]	= "uid",
+	[RULE_GID]	= "gid",
+	/* See also parse_id_type(). */
+	[RULE_ANY]	= "*",
+	NULL
+};
+
 /*
  * We assume that 'uid_t' and 'gid_t' are aliases to 'u_int' in conversions
  * required for parsing rules specification strings.
@@ -129,11 +139,36 @@ strtoui_strict(const char *const restrict s, const char **const restrict endptr,
 	return (0);
 }
 
+static int
+parse_id_type(const char *const string, int *const type)
+{
+	/*
+	 * Special case for "any", as the canonical form for RULE_ANY in
+	 * id_type_to_str[] is "*".
+	 */
+	if (strcmp(string, "any") == 0) {
+		*type = RULE_ANY;
+		return (0);
+	}
+
+	/* Start at 1 to avoid parsing "invalid". */
+	for (size_t i = 1; id_type_to_str[i] != NULL; ++i) {
+		if (strcmp(string, id_type_to_str[i]) == 0) {
+			*type = i;
+			return (0);
+		}
+	}
+
+	*type = RULE_INVALID;
+	return (EINVAL);
+}
+
 static int
 parse_rule_element(char *element, struct rule **rule)
 {
 	const char *from_type, *from_id, *to, *p;
 	struct rule *new;
+	int error;
 
 	new = malloc(sizeof(*new), M_DO, M_ZERO|M_WAITOK);
 
@@ -141,12 +176,16 @@ parse_rule_element(char *element, struct rule **rule)
 	if (from_type == NULL)
 		goto einval;
 
-	if (strcmp(from_type, "uid") == 0)
-		new->from_type = RULE_UID;
-	else if (strcmp(from_type, "gid") == 0)
-		new->from_type = RULE_GID;
-	else
+	error = parse_id_type(from_type, &new->from_type);
+	if (error != 0)
 		goto einval;
+	switch (new->from_type) {
+	case RULE_UID:
+	case RULE_GID:
+		break;
+	default:
+		goto einval;
+	}
 
 	from_id = strsep(&element, ":");
 	if (from_id == NULL || *from_id == '\0')