?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
m68knommu: remove local gettimeofday code
[wrt350n-kernel.git] / security / selinux / ss / services.c
blobf96dec1f9258f31c88525543c59d586354619649
1 /*
2 * Implementation of the security services.
3 *
4 * Authors : Stephen Smalley, <sds@epoch.ncsc.mil>
5 * James Morris <jmorris@redhat.com>
6 *
7 * Updated: Trusted Computer Solutions, Inc. <dgoeddel@trustedcs.com>
8 *
9 * Support for enhanced MLS infrastructure.
10 * Support for context based audit filters.
11 *
12 * Updated: Frank Mayer <mayerf@tresys.com> and Karl MacMillan <kmacmillan@tresys.com>
13 *
14 * Added conditional policy language extensions
15 *
16 * Updated: Hewlett-Packard <paul.moore@hp.com>
17 *
18 * Added support for NetLabel
19 * Added support for the policy capability bitmap
20 *
21 * Updated: Chad Sellers <csellers@tresys.com>
22 *
23 * Added validation of kernel classes and permissions
24 *
25 * Copyright (C) 2006, 2007 Hewlett-Packard Development Company, L.P.
26 * Copyright (C) 2004-2006 Trusted Computer Solutions, Inc.
27 * Copyright (C) 2003 - 2004, 2006 Tresys Technology, LLC
28 * Copyright (C) 2003 Red Hat, Inc., James Morris <jmorris@redhat.com>
29 * This program is free software; you can redistribute it and/or modify
30 * it under the terms of the GNU General Public License as published by
31 * the Free Software Foundation, version 2.
32 */
33 #include <linux/kernel.h>
34 #include <linux/slab.h>
35 #include <linux/string.h>
36 #include <linux/spinlock.h>
37 #include <linux/rcupdate.h>
38 #include <linux/errno.h>
39 #include <linux/in.h>
40 #include <linux/sched.h>
41 #include <linux/audit.h>
42 #include <linux/mutex.h>
43 #include <net/netlabel.h>
44
45 #include "flask.h"
46 #include "avc.h"
47 #include "avc_ss.h"
48 #include "security.h"
49 #include "context.h"
50 #include "policydb.h"
51 #include "sidtab.h"
52 #include "services.h"
53 #include "conditional.h"
54 #include "mls.h"
55 #include "objsec.h"
56 #include "netlabel.h"
57 #include "xfrm.h"
58 #include "ebitmap.h"
59
60 extern void selnl_notify_policyload(u32 seqno);
61 unsigned int policydb_loaded_version;
62
63 int selinux_policycap_netpeer;
64
65 /*
66 * This is declared in avc.c
67 */
68 extern const struct selinux_class_perm selinux_class_perm;
69
70 static DEFINE_RWLOCK(policy_rwlock);
71 #define POLICY_RDLOCK read_lock(&policy_rwlock)
72 #define POLICY_WRLOCK write_lock_irq(&policy_rwlock)
73 #define POLICY_RDUNLOCK read_unlock(&policy_rwlock)
74 #define POLICY_WRUNLOCK write_unlock_irq(&policy_rwlock)
75
76 static DEFINE_MUTEX(load_mutex);
77 #define LOAD_LOCK mutex_lock(&load_mutex)
78 #define LOAD_UNLOCK mutex_unlock(&load_mutex)
79
80 static struct sidtab sidtab;
81 struct policydb policydb;
82 int ss_initialized = 0;
83
84 /*
85 * The largest sequence number that has been used when
86 * providing an access decision to the access vector cache.
87 * The sequence number only changes when a policy change
88 * occurs.
89 */
90 static u32 latest_granting = 0;
91
92 /* Forward declaration. */
93 static int context_struct_to_string(struct context *context, char **scontext,
94 u32 *scontext_len);
95
96 /*
97 * Return the boolean value of a constraint expression
98 * when it is applied to the specified source and target
99 * security contexts.
100 *
101 * xcontext is a special beast... It is used by the validatetrans rules
102 * only. For these rules, scontext is the context before the transition,
103 * tcontext is the context after the transition, and xcontext is the context
104 * of the process performing the transition. All other callers of
105 * constraint_expr_eval should pass in NULL for xcontext.
106 */
107 static int constraint_expr_eval(struct context *scontext,
108 struct context *tcontext,
109 struct context *xcontext,
110 struct constraint_expr *cexpr)
111 {
112 u32 val1, val2;
113 struct context *c;
114 struct role_datum *r1, *r2;
115 struct mls_level *l1, *l2;
116 struct constraint_expr *e;
117 int s[CEXPR_MAXDEPTH];
118 int sp = -1;
119
120 for (e = cexpr; e; e = e->next) {
121 switch (e->expr_type) {
122 case CEXPR_NOT:
123 BUG_ON(sp < 0);
124 s[sp] = !s[sp];
125 break;
126 case CEXPR_AND:
127 BUG_ON(sp < 1);
128 sp--;
129 s[sp] &= s[sp+1];
130 break;
131 case CEXPR_OR:
132 BUG_ON(sp < 1);
133 sp--;
134 s[sp] |= s[sp+1];
135 break;
136 case CEXPR_ATTR:
137 if (sp == (CEXPR_MAXDEPTH-1))
138 return 0;
139 switch (e->attr) {
140 case CEXPR_USER:
141 val1 = scontext->user;
142 val2 = tcontext->user;
143 break;
144 case CEXPR_TYPE:
145 val1 = scontext->type;
146 val2 = tcontext->type;
147 break;
148 case CEXPR_ROLE:
149 val1 = scontext->role;
150 val2 = tcontext->role;
151 r1 = policydb.role_val_to_struct[val1 - 1];
152 r2 = policydb.role_val_to_struct[val2 - 1];
153 switch (e->op) {
154 case CEXPR_DOM:
155 s[++sp] = ebitmap_get_bit(&r1->dominates,
156 val2 - 1);
157 continue;
158 case CEXPR_DOMBY:
159 s[++sp] = ebitmap_get_bit(&r2->dominates,
160 val1 - 1);
161 continue;
162 case CEXPR_INCOMP:
163 s[++sp] = ( !ebitmap_get_bit(&r1->dominates,
164 val2 - 1) &&
165 !ebitmap_get_bit(&r2->dominates,
166 val1 - 1) );
167 continue;
168 default:
169 break;
170 }
171 break;
172 case CEXPR_L1L2:
173 l1 = &(scontext->range.level[0]);
174 l2 = &(tcontext->range.level[0]);
175 goto mls_ops;
176 case CEXPR_L1H2:
177 l1 = &(scontext->range.level[0]);
178 l2 = &(tcontext->range.level[1]);
179 goto mls_ops;
180 case CEXPR_H1L2:
181 l1 = &(scontext->range.level[1]);
182 l2 = &(tcontext->range.level[0]);
183 goto mls_ops;
184 case CEXPR_H1H2:
185 l1 = &(scontext->range.level[1]);
186 l2 = &(tcontext->range.level[1]);
187 goto mls_ops;
188 case CEXPR_L1H1:
189 l1 = &(scontext->range.level[0]);
190 l2 = &(scontext->range.level[1]);
191 goto mls_ops;
192 case CEXPR_L2H2:
193 l1 = &(tcontext->range.level[0]);
194 l2 = &(tcontext->range.level[1]);
195 goto mls_ops;
196 mls_ops:
197 switch (e->op) {
198 case CEXPR_EQ:
199 s[++sp] = mls_level_eq(l1, l2);
200 continue;
201 case CEXPR_NEQ:
202 s[++sp] = !mls_level_eq(l1, l2);
203 continue;
204 case CEXPR_DOM:
205 s[++sp] = mls_level_dom(l1, l2);
206 continue;
207 case CEXPR_DOMBY:
208 s[++sp] = mls_level_dom(l2, l1);
209 continue;
210 case CEXPR_INCOMP:
211 s[++sp] = mls_level_incomp(l2, l1);
212 continue;
213 default:
214 BUG();
215 return 0;
216 }
217 break;
218 default:
219 BUG();
220 return 0;
221 }
222
223 switch (e->op) {
224 case CEXPR_EQ:
225 s[++sp] = (val1 == val2);
226 break;
227 case CEXPR_NEQ:
228 s[++sp] = (val1 != val2);
229 break;
230 default:
231 BUG();
232 return 0;
233 }
234 break;
235 case CEXPR_NAMES:
236 if (sp == (CEXPR_MAXDEPTH-1))
237 return 0;
238 c = scontext;
239 if (e->attr & CEXPR_TARGET)
240 c = tcontext;
241 else if (e->attr & CEXPR_XTARGET) {
242 c = xcontext;
243 if (!c) {
244 BUG();
245 return 0;
246 }
247 }
248 if (e->attr & CEXPR_USER)
249 val1 = c->user;
250 else if (e->attr & CEXPR_ROLE)
251 val1 = c->role;
252 else if (e->attr & CEXPR_TYPE)
253 val1 = c->type;
254 else {
255 BUG();
256 return 0;
257 }
258
259 switch (e->op) {
260 case CEXPR_EQ:
261 s[++sp] = ebitmap_get_bit(&e->names, val1 - 1);
262 break;
263 case CEXPR_NEQ:
264 s[++sp] = !ebitmap_get_bit(&e->names, val1 - 1);
265 break;
266 default:
267 BUG();
268 return 0;
269 }
270 break;
271 default:
272 BUG();
273 return 0;
274 }
275 }
276
277 BUG_ON(sp != 0);
278 return s[0];
279 }
280
281 /*
282 * Compute access vectors based on a context structure pair for
283 * the permissions in a particular class.
284 */
285 static int context_struct_compute_av(struct context *scontext,
286 struct context *tcontext,
287 u16 tclass,
288 u32 requested,
289 struct av_decision *avd)
290 {
291 struct constraint_node *constraint;
292 struct role_allow *ra;
293 struct avtab_key avkey;
294 struct avtab_node *node;
295 struct class_datum *tclass_datum;
296 struct ebitmap *sattr, *tattr;
297 struct ebitmap_node *snode, *tnode;
298 const struct selinux_class_perm *kdefs = &selinux_class_perm;
299 unsigned int i, j;
300
301 /*
302 * Remap extended Netlink classes for old policy versions.
303 * Do this here rather than socket_type_to_security_class()
304 * in case a newer policy version is loaded, allowing sockets
305 * to remain in the correct class.
306 */
307 if (policydb_loaded_version < POLICYDB_VERSION_NLCLASS)
308 if (tclass >= SECCLASS_NETLINK_ROUTE_SOCKET &&
309 tclass <= SECCLASS_NETLINK_DNRT_SOCKET)
310 tclass = SECCLASS_NETLINK_SOCKET;
311
312 /*
313 * Initialize the access vectors to the default values.
314 */
315 avd->allowed = 0;
316 avd->decided = 0xffffffff;
317 avd->auditallow = 0;
318 avd->auditdeny = 0xffffffff;
319 avd->seqno = latest_granting;
320
321 /*
322 * Check for all the invalid cases.
323 * - tclass 0
324 * - tclass > policy and > kernel
325 * - tclass > policy but is a userspace class
326 * - tclass > policy but we do not allow unknowns
327 */
328 if (unlikely(!tclass))
329 goto inval_class;
330 if (unlikely(tclass > policydb.p_classes.nprim))
331 if (tclass > kdefs->cts_len ||
332 !kdefs->class_to_string[tclass - 1] ||
333 !policydb.allow_unknown)
334 goto inval_class;
335
336 /*
337 * Kernel class and we allow unknown so pad the allow decision
338 * the pad will be all 1 for unknown classes.
339 */
340 if (tclass <= kdefs->cts_len && policydb.allow_unknown)
341 avd->allowed = policydb.undefined_perms[tclass - 1];
342
343 /*
344 * Not in policy. Since decision is completed (all 1 or all 0) return.
345 */
346 if (unlikely(tclass > policydb.p_classes.nprim))
347 return 0;
348
349 tclass_datum = policydb.class_val_to_struct[tclass - 1];
350
351 /*
352 * If a specific type enforcement rule was defined for
353 * this permission check, then use it.
354 */
355 avkey.target_class = tclass;
356 avkey.specified = AVTAB_AV;
357 sattr = &policydb.type_attr_map[scontext->type - 1];
358 tattr = &policydb.type_attr_map[tcontext->type - 1];
359 ebitmap_for_each_positive_bit(sattr, snode, i) {
360 ebitmap_for_each_positive_bit(tattr, tnode, j) {
361 avkey.source_type = i + 1;
362 avkey.target_type = j + 1;
363 for (node = avtab_search_node(&policydb.te_avtab, &avkey);
364 node != NULL;
365 node = avtab_search_node_next(node, avkey.specified)) {
366 if (node->key.specified == AVTAB_ALLOWED)
367 avd->allowed |= node->datum.data;
368 else if (node->key.specified == AVTAB_AUDITALLOW)
369 avd->auditallow |= node->datum.data;
370 else if (node->key.specified == AVTAB_AUDITDENY)
371 avd->auditdeny &= node->datum.data;
372 }
373
374 /* Check conditional av table for additional permissions */
375 cond_compute_av(&policydb.te_cond_avtab, &avkey, avd);
376
377 }
378 }
379
380 /*
381 * Remove any permissions prohibited by a constraint (this includes
382 * the MLS policy).
383 */
384 constraint = tclass_datum->constraints;
385 while (constraint) {
386 if ((constraint->permissions & (avd->allowed)) &&
387 !constraint_expr_eval(scontext, tcontext, NULL,
388 constraint->expr)) {
389 avd->allowed = (avd->allowed) & ~(constraint->permissions);
390 }
391 constraint = constraint->next;
392 }
393
394 /*
395 * If checking process transition permission and the
396 * role is changing, then check the (current_role, new_role)
397 * pair.
398 */
399 if (tclass == SECCLASS_PROCESS &&
400 (avd->allowed & (PROCESS__TRANSITION | PROCESS__DYNTRANSITION)) &&
401 scontext->role != tcontext->role) {
402 for (ra = policydb.role_allow; ra; ra = ra->next) {
403 if (scontext->role == ra->role &&
404 tcontext->role == ra->new_role)
405 break;
406 }
407 if (!ra)
408 avd->allowed = (avd->allowed) & ~(PROCESS__TRANSITION |
409 PROCESS__DYNTRANSITION);
410 }
411
412 return 0;
413
414 inval_class:
415 printk(KERN_ERR "%s: unrecognized class %d\n", __FUNCTION__, tclass);
416 return -EINVAL;
417 }
418
419 static int security_validtrans_handle_fail(struct context *ocontext,
420 struct context *ncontext,
421 struct context *tcontext,
422 u16 tclass)
423 {
424 char *o = NULL, *n = NULL, *t = NULL;
425 u32 olen, nlen, tlen;
426
427 if (context_struct_to_string(ocontext, &o, &olen) < 0)
428 goto out;
429 if (context_struct_to_string(ncontext, &n, &nlen) < 0)
430 goto out;
431 if (context_struct_to_string(tcontext, &t, &tlen) < 0)
432 goto out;
433 audit_log(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR,
434 "security_validate_transition: denied for"
435 " oldcontext=%s newcontext=%s taskcontext=%s tclass=%s",
436 o, n, t, policydb.p_class_val_to_name[tclass-1]);
437 out:
438 kfree(o);
439 kfree(n);
440 kfree(t);
441
442 if (!selinux_enforcing)
443 return 0;
444 return -EPERM;
445 }
446
447 int security_validate_transition(u32 oldsid, u32 newsid, u32 tasksid,
448 u16 tclass)
449 {
450 struct context *ocontext;
451 struct context *ncontext;
452 struct context *tcontext;
453 struct class_datum *tclass_datum;
454 struct constraint_node *constraint;
455 int rc = 0;
456
457 if (!ss_initialized)
458 return 0;
459
460 POLICY_RDLOCK;
461
462 /*
463 * Remap extended Netlink classes for old policy versions.
464 * Do this here rather than socket_type_to_security_class()
465 * in case a newer policy version is loaded, allowing sockets
466 * to remain in the correct class.
467 */
468 if (policydb_loaded_version < POLICYDB_VERSION_NLCLASS)
469 if (tclass >= SECCLASS_NETLINK_ROUTE_SOCKET &&
470 tclass <= SECCLASS_NETLINK_DNRT_SOCKET)
471 tclass = SECCLASS_NETLINK_SOCKET;
472
473 if (!tclass || tclass > policydb.p_classes.nprim) {
474 printk(KERN_ERR "security_validate_transition: "
475 "unrecognized class %d\n", tclass);
476 rc = -EINVAL;
477 goto out;
478 }
479 tclass_datum = policydb.class_val_to_struct[tclass - 1];
480
481 ocontext = sidtab_search(&sidtab, oldsid);
482 if (!ocontext) {
483 printk(KERN_ERR "security_validate_transition: "
484 " unrecognized SID %d\n", oldsid);
485 rc = -EINVAL;
486 goto out;
487 }
488
489 ncontext = sidtab_search(&sidtab, newsid);
490 if (!ncontext) {
491 printk(KERN_ERR "security_validate_transition: "
492 " unrecognized SID %d\n", newsid);
493 rc = -EINVAL;
494 goto out;
495 }
496
497 tcontext = sidtab_search(&sidtab, tasksid);
498 if (!tcontext) {
499 printk(KERN_ERR "security_validate_transition: "
500 " unrecognized SID %d\n", tasksid);
501 rc = -EINVAL;
502 goto out;
503 }
504
505 constraint = tclass_datum->validatetrans;
506 while (constraint) {
507 if (!constraint_expr_eval(ocontext, ncontext, tcontext,
508 constraint->expr)) {
509 rc = security_validtrans_handle_fail(ocontext, ncontext,
510 tcontext, tclass);
511 goto out;
512 }
513 constraint = constraint->next;
514 }
515
516 out:
517 POLICY_RDUNLOCK;
518 return rc;
519 }
520
521 /**
522 * security_compute_av - Compute access vector decisions.
523 * @ssid: source security identifier
524 * @tsid: target security identifier
525 * @tclass: target security class
526 * @requested: requested permissions
527 * @avd: access vector decisions
528 *
529 * Compute a set of access vector decisions based on the
530 * SID pair (@ssid, @tsid) for the permissions in @tclass.
531 * Return -%EINVAL if any of the parameters are invalid or %0
532 * if the access vector decisions were computed successfully.
533 */
534 int security_compute_av(u32 ssid,
535 u32 tsid,
536 u16 tclass,
537 u32 requested,
538 struct av_decision *avd)
539 {
540 struct context *scontext = NULL, *tcontext = NULL;
541 int rc = 0;
542
543 if (!ss_initialized) {
544 avd->allowed = 0xffffffff;
545 avd->decided = 0xffffffff;
546 avd->auditallow = 0;
547 avd->auditdeny = 0xffffffff;
548 avd->seqno = latest_granting;
549 return 0;
550 }
551
552 POLICY_RDLOCK;
553
554 scontext = sidtab_search(&sidtab, ssid);
555 if (!scontext) {
556 printk(KERN_ERR "security_compute_av: unrecognized SID %d\n",
557 ssid);
558 rc = -EINVAL;
559 goto out;
560 }
561 tcontext = sidtab_search(&sidtab, tsid);
562 if (!tcontext) {
563 printk(KERN_ERR "security_compute_av: unrecognized SID %d\n",
564 tsid);
565 rc = -EINVAL;
566 goto out;
567 }
568
569 rc = context_struct_compute_av(scontext, tcontext, tclass,
570 requested, avd);
571 out:
572 POLICY_RDUNLOCK;
573 return rc;
574 }
575
576 /*
577 * Write the security context string representation of
578 * the context structure `context' into a dynamically
579 * allocated string of the correct size. Set `*scontext'
580 * to point to this string and set `*scontext_len' to
581 * the length of the string.
582 */
583 static int context_struct_to_string(struct context *context, char **scontext, u32 *scontext_len)
584 {
585 char *scontextp;
586
587 *scontext = NULL;
588 *scontext_len = 0;
589
590 /* Compute the size of the context. */
591 *scontext_len += strlen(policydb.p_user_val_to_name[context->user - 1]) + 1;
592 *scontext_len += strlen(policydb.p_role_val_to_name[context->role - 1]) + 1;
593 *scontext_len += strlen(policydb.p_type_val_to_name[context->type - 1]) + 1;
594 *scontext_len += mls_compute_context_len(context);
595
596 /* Allocate space for the context; caller must free this space. */
597 scontextp = kmalloc(*scontext_len, GFP_ATOMIC);
598 if (!scontextp) {
599 return -ENOMEM;
600 }
601 *scontext = scontextp;
602
603 /*
604 * Copy the user name, role name and type name into the context.
605 */
606 sprintf(scontextp, "%s:%s:%s",
607 policydb.p_user_val_to_name[context->user - 1],
608 policydb.p_role_val_to_name[context->role - 1],
609 policydb.p_type_val_to_name[context->type - 1]);
610 scontextp += strlen(policydb.p_user_val_to_name[context->user - 1]) +
611 1 + strlen(policydb.p_role_val_to_name[context->role - 1]) +
612 1 + strlen(policydb.p_type_val_to_name[context->type - 1]);
613
614 mls_sid_to_context(context, &scontextp);
615
616 *scontextp = 0;
617
618 return 0;
619 }
620
621 #include "initial_sid_to_string.h"
622
623 const char *security_get_initial_sid_context(u32 sid)
624 {
625 if (unlikely(sid > SECINITSID_NUM))
626 return NULL;
627 return initial_sid_to_string[sid];
628 }
629
630 /**
631 * security_sid_to_context - Obtain a context for a given SID.
632 * @sid: security identifier, SID
633 * @scontext: security context
634 * @scontext_len: length in bytes
635 *
636 * Write the string representation of the context associated with @sid
637 * into a dynamically allocated string of the correct size. Set @scontext
638 * to point to this string and set @scontext_len to the length of the string.
639 */
640 int security_sid_to_context(u32 sid, char **scontext, u32 *scontext_len)
641 {
642 struct context *context;
643 int rc = 0;
644
645 *scontext = NULL;
646 *scontext_len = 0;
647
648 if (!ss_initialized) {
649 if (sid <= SECINITSID_NUM) {
650 char *scontextp;
651
652 *scontext_len = strlen(initial_sid_to_string[sid]) + 1;
653 scontextp = kmalloc(*scontext_len,GFP_ATOMIC);
654 if (!scontextp) {
655 rc = -ENOMEM;
656 goto out;
657 }
658 strcpy(scontextp, initial_sid_to_string[sid]);
659 *scontext = scontextp;
660 goto out;
661 }
662 printk(KERN_ERR "security_sid_to_context: called before initial "
663 "load_policy on unknown SID %d\n", sid);
664 rc = -EINVAL;
665 goto out;
666 }
667 POLICY_RDLOCK;
668 context = sidtab_search(&sidtab, sid);
669 if (!context) {
670 printk(KERN_ERR "security_sid_to_context: unrecognized SID "
671 "%d\n", sid);
672 rc = -EINVAL;
673 goto out_unlock;
674 }
675 rc = context_struct_to_string(context, scontext, scontext_len);
676 out_unlock:
677 POLICY_RDUNLOCK;
678 out:
679 return rc;
680
681 }
682
683 static int security_context_to_sid_core(char *scontext, u32 scontext_len, u32 *sid, u32 def_sid)
684 {
685 char *scontext2;
686 struct context context;
687 struct role_datum *role;
688 struct type_datum *typdatum;
689 struct user_datum *usrdatum;
690 char *scontextp, *p, oldc;
691 int rc = 0;
692
693 if (!ss_initialized) {
694 int i;
695
696 for (i = 1; i < SECINITSID_NUM; i++) {
697 if (!strcmp(initial_sid_to_string[i], scontext)) {
698 *sid = i;
699 goto out;
700 }
701 }
702 *sid = SECINITSID_KERNEL;
703 goto out;
704 }
705 *sid = SECSID_NULL;
706
707 /* Copy the string so that we can modify the copy as we parse it.
708 The string should already by null terminated, but we append a
709 null suffix to the copy to avoid problems with the existing
710 attr package, which doesn't view the null terminator as part
711 of the attribute value. */
712 scontext2 = kmalloc(scontext_len+1,GFP_KERNEL);
713 if (!scontext2) {
714 rc = -ENOMEM;
715 goto out;
716 }
717 memcpy(scontext2, scontext, scontext_len);
718 scontext2[scontext_len] = 0;
719
720 context_init(&context);
721 *sid = SECSID_NULL;
722
723 POLICY_RDLOCK;
724
725 /* Parse the security context. */
726
727 rc = -EINVAL;
728 scontextp = (char *) scontext2;
729
730 /* Extract the user. */
731 p = scontextp;
732 while (*p && *p != ':')
733 p++;
734
735 if (*p == 0)
736 goto out_unlock;
737
738 *p++ = 0;
739
740 usrdatum = hashtab_search(policydb.p_users.table, scontextp);
741 if (!usrdatum)
742 goto out_unlock;
743
744 context.user = usrdatum->value;
745
746 /* Extract role. */
747 scontextp = p;
748 while (*p && *p != ':')
749 p++;
750
751 if (*p == 0)
752 goto out_unlock;
753
754 *p++ = 0;
755
756 role = hashtab_search(policydb.p_roles.table, scontextp);
757 if (!role)
758 goto out_unlock;
759 context.role = role->value;
760
761 /* Extract type. */
762 scontextp = p;
763 while (*p && *p != ':')
764 p++;
765 oldc = *p;
766 *p++ = 0;
767
768 typdatum = hashtab_search(policydb.p_types.table, scontextp);
769 if (!typdatum)
770 goto out_unlock;
771
772 context.type = typdatum->value;
773
774 rc = mls_context_to_sid(oldc, &p, &context, &sidtab, def_sid);
775 if (rc)
776 goto out_unlock;
777
778 if ((p - scontext2) < scontext_len) {
779 rc = -EINVAL;
780 goto out_unlock;
781 }
782
783 /* Check the validity of the new context. */
784 if (!policydb_context_isvalid(&policydb, &context)) {
785 rc = -EINVAL;
786 goto out_unlock;
787 }
788 /* Obtain the new sid. */
789 rc = sidtab_context_to_sid(&sidtab, &context, sid);
790 out_unlock:
791 POLICY_RDUNLOCK;
792 context_destroy(&context);
793 kfree(scontext2);
794 out:
795 return rc;
796 }
797
798 /**
799 * security_context_to_sid - Obtain a SID for a given security context.
800 * @scontext: security context
801 * @scontext_len: length in bytes
802 * @sid: security identifier, SID
803 *
804 * Obtains a SID associated with the security context that
805 * has the string representation specified by @scontext.
806 * Returns -%EINVAL if the context is invalid, -%ENOMEM if insufficient
807 * memory is available, or 0 on success.
808 */
809 int security_context_to_sid(char *scontext, u32 scontext_len, u32 *sid)
810 {
811 return security_context_to_sid_core(scontext, scontext_len,
812 sid, SECSID_NULL);
813 }
814
815 /**
816 * security_context_to_sid_default - Obtain a SID for a given security context,
817 * falling back to specified default if needed.
818 *
819 * @scontext: security context
820 * @scontext_len: length in bytes
821 * @sid: security identifier, SID
822 * @def_sid: default SID to assign on error
823 *
824 * Obtains a SID associated with the security context that
825 * has the string representation specified by @scontext.
826 * The default SID is passed to the MLS layer to be used to allow
827 * kernel labeling of the MLS field if the MLS field is not present
828 * (for upgrading to MLS without full relabel).
829 * Returns -%EINVAL if the context is invalid, -%ENOMEM if insufficient
830 * memory is available, or 0 on success.
831 */
832 int security_context_to_sid_default(char *scontext, u32 scontext_len, u32 *sid, u32 def_sid)
833 {
834 return security_context_to_sid_core(scontext, scontext_len,
835 sid, def_sid);
836 }
837
838 static int compute_sid_handle_invalid_context(
839 struct context *scontext,
840 struct context *tcontext,
841 u16 tclass,
842 struct context *newcontext)
843 {
844 char *s = NULL, *t = NULL, *n = NULL;
845 u32 slen, tlen, nlen;
846
847 if (context_struct_to_string(scontext, &s, &slen) < 0)
848 goto out;
849 if (context_struct_to_string(tcontext, &t, &tlen) < 0)
850 goto out;
851 if (context_struct_to_string(newcontext, &n, &nlen) < 0)
852 goto out;
853 audit_log(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR,
854 "security_compute_sid: invalid context %s"
855 " for scontext=%s"
856 " tcontext=%s"
857 " tclass=%s",
858 n, s, t, policydb.p_class_val_to_name[tclass-1]);
859 out:
860 kfree(s);
861 kfree(t);
862 kfree(n);
863 if (!selinux_enforcing)
864 return 0;
865 return -EACCES;
866 }
867
868 static int security_compute_sid(u32 ssid,
869 u32 tsid,
870 u16 tclass,
871 u32 specified,
872 u32 *out_sid)
873 {
874 struct context *scontext = NULL, *tcontext = NULL, newcontext;
875 struct role_trans *roletr = NULL;
876 struct avtab_key avkey;
877 struct avtab_datum *avdatum;
878 struct avtab_node *node;
879 int rc = 0;
880
881 if (!ss_initialized) {
882 switch (tclass) {
883 case SECCLASS_PROCESS:
884 *out_sid = ssid;
885 break;
886 default:
887 *out_sid = tsid;
888 break;
889 }
890 goto out;
891 }
892
893 context_init(&newcontext);
894
895 POLICY_RDLOCK;
896
897 scontext = sidtab_search(&sidtab, ssid);
898 if (!scontext) {
899 printk(KERN_ERR "security_compute_sid: unrecognized SID %d\n",
900 ssid);
901 rc = -EINVAL;
902 goto out_unlock;
903 }
904 tcontext = sidtab_search(&sidtab, tsid);
905 if (!tcontext) {
906 printk(KERN_ERR "security_compute_sid: unrecognized SID %d\n",
907 tsid);
908 rc = -EINVAL;
909 goto out_unlock;
910 }
911
912 /* Set the user identity. */
913 switch (specified) {
914 case AVTAB_TRANSITION:
915 case AVTAB_CHANGE:
916 /* Use the process user identity. */
917 newcontext.user = scontext->user;
918 break;
919 case AVTAB_MEMBER:
920 /* Use the related object owner. */
921 newcontext.user = tcontext->user;
922 break;
923 }
924
925 /* Set the role and type to default values. */
926 switch (tclass) {
927 case SECCLASS_PROCESS:
928 /* Use the current role and type of process. */
929 newcontext.role = scontext->role;
930 newcontext.type = scontext->type;
931 break;
932 default:
933 /* Use the well-defined object role. */
934 newcontext.role = OBJECT_R_VAL;
935 /* Use the type of the related object. */
936 newcontext.type = tcontext->type;
937 }
938
939 /* Look for a type transition/member/change rule. */
940 avkey.source_type = scontext->type;
941 avkey.target_type = tcontext->type;
942 avkey.target_class = tclass;
943 avkey.specified = specified;
944 avdatum = avtab_search(&policydb.te_avtab, &avkey);
945
946 /* If no permanent rule, also check for enabled conditional rules */
947 if(!avdatum) {
948 node = avtab_search_node(&policydb.te_cond_avtab, &avkey);
949 for (; node != NULL; node = avtab_search_node_next(node, specified)) {
950 if (node->key.specified & AVTAB_ENABLED) {
951 avdatum = &node->datum;
952 break;
953 }
954 }
955 }
956
957 if (avdatum) {
958 /* Use the type from the type transition/member/change rule. */
959 newcontext.type = avdatum->data;
960 }
961
962 /* Check for class-specific changes. */
963 switch (tclass) {
964 case SECCLASS_PROCESS:
965 if (specified & AVTAB_TRANSITION) {
966 /* Look for a role transition rule. */
967 for (roletr = policydb.role_tr; roletr;
968 roletr = roletr->next) {
969 if (roletr->role == scontext->role &&
970 roletr->type == tcontext->type) {
971 /* Use the role transition rule. */
972 newcontext.role = roletr->new_role;
973 break;
974 }
975 }
976 }
977 break;
978 default:
979 break;
980 }
981
982 /* Set the MLS attributes.
983 This is done last because it may allocate memory. */
984 rc = mls_compute_sid(scontext, tcontext, tclass, specified, &newcontext);
985 if (rc)
986 goto out_unlock;
987
988 /* Check the validity of the context. */
989 if (!policydb_context_isvalid(&policydb, &newcontext)) {
990 rc = compute_sid_handle_invalid_context(scontext,
991 tcontext,
992 tclass,
993 &newcontext);
994 if (rc)
995 goto out_unlock;
996 }
997 /* Obtain the sid for the context. */
998 rc = sidtab_context_to_sid(&sidtab, &newcontext, out_sid);
999 out_unlock:
1000 POLICY_RDUNLOCK;
1001 context_destroy(&newcontext);
1002 out:
1003 return rc;
1004 }
1005
1006 /**
1007 * security_transition_sid - Compute the SID for a new subject/object.
1008 * @ssid: source security identifier
1009 * @tsid: target security identifier
1010 * @tclass: target security class
1011 * @out_sid: security identifier for new subject/object
1012 *
1013 * Compute a SID to use for labeling a new subject or object in the
1014 * class @tclass based on a SID pair (@ssid, @tsid).
1015 * Return -%EINVAL if any of the parameters are invalid, -%ENOMEM
1016 * if insufficient memory is available, or %0 if the new SID was
1017 * computed successfully.
1018 */
1019 int security_transition_sid(u32 ssid,
1020 u32 tsid,
1021 u16 tclass,
1022 u32 *out_sid)
1023 {
1024 return security_compute_sid(ssid, tsid, tclass, AVTAB_TRANSITION, out_sid);
1025 }
1026
1027 /**
1028 * security_member_sid - Compute the SID for member selection.
1029 * @ssid: source security identifier
1030 * @tsid: target security identifier
1031 * @tclass: target security class
1032 * @out_sid: security identifier for selected member
1033 *
1034 * Compute a SID to use when selecting a member of a polyinstantiated
1035 * object of class @tclass based on a SID pair (@ssid, @tsid).
1036 * Return -%EINVAL if any of the parameters are invalid, -%ENOMEM
1037 * if insufficient memory is available, or %0 if the SID was
1038 * computed successfully.
1039 */
1040 int security_member_sid(u32 ssid,
1041 u32 tsid,
1042 u16 tclass,
1043 u32 *out_sid)
1044 {
1045 return security_compute_sid(ssid, tsid, tclass, AVTAB_MEMBER, out_sid);
1046 }
1047
1048 /**
1049 * security_change_sid - Compute the SID for object relabeling.
1050 * @ssid: source security identifier
1051 * @tsid: target security identifier
1052 * @tclass: target security class
1053 * @out_sid: security identifier for selected member
1054 *
1055 * Compute a SID to use for relabeling an object of class @tclass
1056 * based on a SID pair (@ssid, @tsid).
1057 * Return -%EINVAL if any of the parameters are invalid, -%ENOMEM
1058 * if insufficient memory is available, or %0 if the SID was
1059 * computed successfully.
1060 */
1061 int security_change_sid(u32 ssid,
1062 u32 tsid,
1063 u16 tclass,
1064 u32 *out_sid)
1065 {
1066 return security_compute_sid(ssid, tsid, tclass, AVTAB_CHANGE, out_sid);
1067 }
1068
1069 /*
1070 * Verify that each kernel class that is defined in the
1071 * policy is correct
1072 */
1073 static int validate_classes(struct policydb *p)
1074 {
1075 int i, j;
1076 struct class_datum *cladatum;
1077 struct perm_datum *perdatum;
1078 u32 nprim, tmp, common_pts_len, perm_val, pol_val;
1079 u16 class_val;
1080 const struct selinux_class_perm *kdefs = &selinux_class_perm;
1081 const char *def_class, *def_perm, *pol_class;
1082 struct symtab *perms;
1083
1084 if (p->allow_unknown) {
1085 u32 num_classes = kdefs->cts_len;
1086 p->undefined_perms = kcalloc(num_classes, sizeof(u32), GFP_KERNEL);
1087 if (!p->undefined_perms)
1088 return -ENOMEM;
1089 }
1090
1091 for (i = 1; i < kdefs->cts_len; i++) {
1092 def_class = kdefs->class_to_string[i];
1093 if (!def_class)
1094 continue;
1095 if (i > p->p_classes.nprim) {
1096 printk(KERN_INFO
1097 "security: class %s not defined in policy\n",
1098 def_class);
1099 if (p->reject_unknown)
1100 return -EINVAL;
1101 if (p->allow_unknown)
1102 p->undefined_perms[i-1] = ~0U;
1103 continue;
1104 }
1105 pol_class = p->p_class_val_to_name[i-1];
1106 if (strcmp(pol_class, def_class)) {
1107 printk(KERN_ERR
1108 "security: class %d is incorrect, found %s but should be %s\n",
1109 i, pol_class, def_class);
1110 return -EINVAL;
1111 }
1112 }
1113 for (i = 0; i < kdefs->av_pts_len; i++) {
1114 class_val = kdefs->av_perm_to_string[i].tclass;
1115 perm_val = kdefs->av_perm_to_string[i].value;
1116 def_perm = kdefs->av_perm_to_string[i].name;
1117 if (class_val > p->p_classes.nprim)
1118 continue;
1119 pol_class = p->p_class_val_to_name[class_val-1];
1120 cladatum = hashtab_search(p->p_classes.table, pol_class);
1121 BUG_ON(!cladatum);
1122 perms = &cladatum->permissions;
1123 nprim = 1 << (perms->nprim - 1);
1124 if (perm_val > nprim) {
1125 printk(KERN_INFO
1126 "security: permission %s in class %s not defined in policy\n",
1127 def_perm, pol_class);
1128 if (p->reject_unknown)
1129 return -EINVAL;
1130 if (p->allow_unknown)
1131 p->undefined_perms[class_val-1] |= perm_val;
1132 continue;
1133 }
1134 perdatum = hashtab_search(perms->table, def_perm);
1135 if (perdatum == NULL) {
1136 printk(KERN_ERR
1137 "security: permission %s in class %s not found in policy, bad policy\n",
1138 def_perm, pol_class);
1139 return -EINVAL;
1140 }
1141 pol_val = 1 << (perdatum->value - 1);
1142 if (pol_val != perm_val) {
1143 printk(KERN_ERR
1144 "security: permission %s in class %s has incorrect value\n",
1145 def_perm, pol_class);
1146 return -EINVAL;
1147 }
1148 }
1149 for (i = 0; i < kdefs->av_inherit_len; i++) {
1150 class_val = kdefs->av_inherit[i].tclass;
1151 if (class_val > p->p_classes.nprim)
1152 continue;
1153 pol_class = p->p_class_val_to_name[class_val-1];
1154 cladatum = hashtab_search(p->p_classes.table, pol_class);
1155 BUG_ON(!cladatum);
1156 if (!cladatum->comdatum) {
1157 printk(KERN_ERR
1158 "security: class %s should have an inherits clause but does not\n",
1159 pol_class);
1160 return -EINVAL;
1161 }
1162 tmp = kdefs->av_inherit[i].common_base;
1163 common_pts_len = 0;
1164 while (!(tmp & 0x01)) {
1165 common_pts_len++;
1166 tmp >>= 1;
1167 }
1168 perms = &cladatum->comdatum->permissions;
1169 for (j = 0; j < common_pts_len; j++) {
1170 def_perm = kdefs->av_inherit[i].common_pts[j];
1171 if (j >= perms->nprim) {
1172 printk(KERN_INFO
1173 "security: permission %s in class %s not defined in policy\n",
1174 def_perm, pol_class);
1175 if (p->reject_unknown)
1176 return -EINVAL;
1177 if (p->allow_unknown)
1178 p->undefined_perms[class_val-1] |= (1 << j);
1179 continue;
1180 }
1181 perdatum = hashtab_search(perms->table, def_perm);
1182 if (perdatum == NULL) {
1183 printk(KERN_ERR
1184 "security: permission %s in class %s not found in policy, bad policy\n",
1185 def_perm, pol_class);
1186 return -EINVAL;
1187 }
1188 if (perdatum->value != j + 1) {
1189 printk(KERN_ERR
1190 "security: permission %s in class %s has incorrect value\n",
1191 def_perm, pol_class);
1192 return -EINVAL;
1193 }
1194 }
1195 }
1196 return 0;
1197 }
1198
1199 /* Clone the SID into the new SID table. */
1200 static int clone_sid(u32 sid,
1201 struct context *context,
1202 void *arg)
1203 {
1204 struct sidtab *s = arg;
1205
1206 return sidtab_insert(s, sid, context);
1207 }
1208
1209 static inline int convert_context_handle_invalid_context(struct context *context)
1210 {
1211 int rc = 0;
1212
1213 if (selinux_enforcing) {
1214 rc = -EINVAL;
1215 } else {
1216 char *s;
1217 u32 len;
1218
1219 context_struct_to_string(context, &s, &len);
1220 printk(KERN_ERR "security: context %s is invalid\n", s);
1221 kfree(s);
1222 }
1223 return rc;
1224 }
1225
1226 struct convert_context_args {
1227 struct policydb *oldp;
1228 struct policydb *newp;
1229 };
1230
1231 /*
1232 * Convert the values in the security context
1233 * structure `c' from the values specified
1234 * in the policy `p->oldp' to the values specified
1235 * in the policy `p->newp'. Verify that the
1236 * context is valid under the new policy.
1237 */
1238 static int convert_context(u32 key,
1239 struct context *c,
1240 void *p)
1241 {
1242 struct convert_context_args *args;
1243 struct context oldc;
1244 struct role_datum *role;
1245 struct type_datum *typdatum;
1246 struct user_datum *usrdatum;
1247 char *s;
1248 u32 len;
1249 int rc;
1250
1251 args = p;
1252
1253 rc = context_cpy(&oldc, c);
1254 if (rc)
1255 goto out;
1256
1257 rc = -EINVAL;
1258
1259 /* Convert the user. */
1260 usrdatum = hashtab_search(args->newp->p_users.table,
1261 args->oldp->p_user_val_to_name[c->user - 1]);
1262 if (!usrdatum) {
1263 goto bad;
1264 }
1265 c->user = usrdatum->value;
1266
1267 /* Convert the role. */
1268 role = hashtab_search(args->newp->p_roles.table,
1269 args->oldp->p_role_val_to_name[c->role - 1]);
1270 if (!role) {
1271 goto bad;
1272 }
1273 c->role = role->value;
1274
1275 /* Convert the type. */
1276 typdatum = hashtab_search(args->newp->p_types.table,
1277 args->oldp->p_type_val_to_name[c->type - 1]);
1278 if (!typdatum) {
1279 goto bad;
1280 }
1281 c->type = typdatum->value;
1282
1283 rc = mls_convert_context(args->oldp, args->newp, c);
1284 if (rc)
1285 goto bad;
1286
1287 /* Check the validity of the new context. */
1288 if (!policydb_context_isvalid(args->newp, c)) {
1289 rc = convert_context_handle_invalid_context(&oldc);
1290 if (rc)
1291 goto bad;
1292 }
1293
1294 context_destroy(&oldc);
1295 out:
1296 return rc;
1297 bad:
1298 context_struct_to_string(&oldc, &s, &len);
1299 context_destroy(&oldc);
1300 printk(KERN_ERR "security: invalidating context %s\n", s);
1301 kfree(s);
1302 goto out;
1303 }
1304
1305 static void security_load_policycaps(void)
1306 {
1307 selinux_policycap_netpeer = ebitmap_get_bit(&policydb.policycaps,
1308 POLICYDB_CAPABILITY_NETPEER);
1309 }
1310
1311 extern void selinux_complete_init(void);
1312 static int security_preserve_bools(struct policydb *p);
1313
1314 /**
1315 * security_load_policy - Load a security policy configuration.
1316 * @data: binary policy data
1317 * @len: length of data in bytes
1318 *
1319 * Load a new set of security policy configuration data,
1320 * validate it and convert the SID table as necessary.
1321 * This function will flush the access vector cache after
1322 * loading the new policy.
1323 */
1324 int security_load_policy(void *data, size_t len)
1325 {
1326 struct policydb oldpolicydb, newpolicydb;
1327 struct sidtab oldsidtab, newsidtab;
1328 struct convert_context_args args;
1329 u32 seqno;
1330 int rc = 0;
1331 struct policy_file file = { data, len }, *fp = &file;
1332
1333 LOAD_LOCK;
1334
1335 if (!ss_initialized) {
1336 avtab_cache_init();
1337 if (policydb_read(&policydb, fp)) {
1338 LOAD_UNLOCK;
1339 avtab_cache_destroy();
1340 return -EINVAL;
1341 }
1342 if (policydb_load_isids(&policydb, &sidtab)) {
1343 LOAD_UNLOCK;
1344 policydb_destroy(&policydb);
1345 avtab_cache_destroy();
1346 return -EINVAL;
1347 }
1348 /* Verify that the kernel defined classes are correct. */
1349 if (validate_classes(&policydb)) {
1350 printk(KERN_ERR
1351 "security: the definition of a class is incorrect\n");
1352 LOAD_UNLOCK;
1353 sidtab_destroy(&sidtab);
1354 policydb_destroy(&policydb);
1355 avtab_cache_destroy();
1356 return -EINVAL;
1357 }
1358 security_load_policycaps();
1359 policydb_loaded_version = policydb.policyvers;
1360 ss_initialized = 1;
1361 seqno = ++latest_granting;
1362 LOAD_UNLOCK;
1363 selinux_complete_init();
1364 avc_ss_reset(seqno);
1365 selnl_notify_policyload(seqno);
1366 selinux_netlbl_cache_invalidate();
1367 selinux_xfrm_notify_policyload();
1368 return 0;
1369 }
1370
1371 #if 0
1372 sidtab_hash_eval(&sidtab, "sids");
1373 #endif
1374
1375 if (policydb_read(&newpolicydb, fp)) {
1376 LOAD_UNLOCK;
1377 return -EINVAL;
1378 }
1379
1380 sidtab_init(&newsidtab);
1381
1382 /* Verify that the kernel defined classes are correct. */
1383 if (validate_classes(&newpolicydb)) {
1384 printk(KERN_ERR
1385 "security: the definition of a class is incorrect\n");
1386 rc = -EINVAL;
1387 goto err;
1388 }
1389
1390 rc = security_preserve_bools(&newpolicydb);
1391 if (rc) {
1392 printk(KERN_ERR "security: unable to preserve booleans\n");
1393 goto err;
1394 }
1395
1396 /* Clone the SID table. */
1397 sidtab_shutdown(&sidtab);
1398 if (sidtab_map(&sidtab, clone_sid, &newsidtab)) {
1399 rc = -ENOMEM;
1400 goto err;
1401 }
1402
1403 /* Convert the internal representations of contexts
1404 in the new SID table and remove invalid SIDs. */
1405 args.oldp = &policydb;
1406 args.newp = &newpolicydb;
1407 sidtab_map_remove_on_error(&newsidtab, convert_context, &args);
1408
1409 /* Save the old policydb and SID table to free later. */
1410 memcpy(&oldpolicydb, &policydb, sizeof policydb);
1411 sidtab_set(&oldsidtab, &sidtab);
1412
1413 /* Install the new policydb and SID table. */
1414 POLICY_WRLOCK;
1415 memcpy(&policydb, &newpolicydb, sizeof policydb);
1416 sidtab_set(&sidtab, &newsidtab);
1417 security_load_policycaps();
1418 seqno = ++latest_granting;
1419 policydb_loaded_version = policydb.policyvers;
1420 POLICY_WRUNLOCK;
1421 LOAD_UNLOCK;
1422
1423 /* Free the old policydb and SID table. */
1424 policydb_destroy(&oldpolicydb);
1425 sidtab_destroy(&oldsidtab);
1426
1427 avc_ss_reset(seqno);
1428 selnl_notify_policyload(seqno);
1429 selinux_netlbl_cache_invalidate();
1430 selinux_xfrm_notify_policyload();
1431
1432 return 0;
1433
1434 err:
1435 LOAD_UNLOCK;
1436 sidtab_destroy(&newsidtab);
1437 policydb_destroy(&newpolicydb);
1438 return rc;
1439
1440 }
1441
1442 /**
1443 * security_port_sid - Obtain the SID for a port.
1444 * @domain: communication domain aka address family
1445 * @type: socket type
1446 * @protocol: protocol number
1447 * @port: port number
1448 * @out_sid: security identifier
1449 */
1450 int security_port_sid(u16 domain,
1451 u16 type,
1452 u8 protocol,
1453 u16 port,
1454 u32 *out_sid)
1455 {
1456 struct ocontext *c;
1457 int rc = 0;
1458
1459 POLICY_RDLOCK;
1460
1461 c = policydb.ocontexts[OCON_PORT];
1462 while (c) {
1463 if (c->u.port.protocol == protocol &&
1464 c->u.port.low_port <= port &&
1465 c->u.port.high_port >= port)
1466 break;
1467 c = c->next;
1468 }
1469
1470 if (c) {
1471 if (!c->sid[0]) {
1472 rc = sidtab_context_to_sid(&sidtab,
1473 &c->context[0],
1474 &c->sid[0]);
1475 if (rc)
1476 goto out;
1477 }
1478 *out_sid = c->sid[0];
1479 } else {
1480 *out_sid = SECINITSID_PORT;
1481 }
1482
1483 out:
1484 POLICY_RDUNLOCK;
1485 return rc;
1486 }
1487
1488 /**
1489 * security_netif_sid - Obtain the SID for a network interface.
1490 * @name: interface name
1491 * @if_sid: interface SID
1492 */
1493 int security_netif_sid(char *name, u32 *if_sid)
1494 {
1495 int rc = 0;
1496 struct ocontext *c;
1497
1498 POLICY_RDLOCK;
1499
1500 c = policydb.ocontexts[OCON_NETIF];
1501 while (c) {
1502 if (strcmp(name, c->u.name) == 0)
1503 break;
1504 c = c->next;
1505 }
1506
1507 if (c) {
1508 if (!c->sid[0] || !c->sid[1]) {
1509 rc = sidtab_context_to_sid(&sidtab,
1510 &c->context[0],
1511 &c->sid[0]);
1512 if (rc)
1513 goto out;
1514 rc = sidtab_context_to_sid(&sidtab,
1515 &c->context[1],
1516 &c->sid[1]);
1517 if (rc)
1518 goto out;
1519 }
1520 *if_sid = c->sid[0];
1521 } else
1522 *if_sid = SECINITSID_NETIF;
1523
1524 out:
1525 POLICY_RDUNLOCK;
1526 return rc;
1527 }
1528
1529 static int match_ipv6_addrmask(u32 *input, u32 *addr, u32 *mask)
1530 {
1531 int i, fail = 0;
1532
1533 for(i = 0; i < 4; i++)
1534 if(addr[i] != (input[i] & mask[i])) {
1535 fail = 1;
1536 break;
1537 }
1538
1539 return !fail;
1540 }
1541
1542 /**
1543 * security_node_sid - Obtain the SID for a node (host).
1544 * @domain: communication domain aka address family
1545 * @addrp: address
1546 * @addrlen: address length in bytes
1547 * @out_sid: security identifier
1548 */
1549 int security_node_sid(u16 domain,
1550 void *addrp,
1551 u32 addrlen,
1552 u32 *out_sid)
1553 {
1554 int rc = 0;
1555 struct ocontext *c;
1556
1557 POLICY_RDLOCK;
1558
1559 switch (domain) {
1560 case AF_INET: {
1561 u32 addr;
1562
1563 if (addrlen != sizeof(u32)) {
1564 rc = -EINVAL;
1565 goto out;
1566 }
1567
1568 addr = *((u32 *)addrp);
1569
1570 c = policydb.ocontexts[OCON_NODE];
1571 while (c) {
1572 if (c->u.node.addr == (addr & c->u.node.mask))
1573 break;
1574 c = c->next;
1575 }
1576 break;
1577 }
1578
1579 case AF_INET6:
1580 if (addrlen != sizeof(u64) * 2) {
1581 rc = -EINVAL;
1582 goto out;
1583 }
1584 c = policydb.ocontexts[OCON_NODE6];
1585 while (c) {
1586 if (match_ipv6_addrmask(addrp, c->u.node6.addr,
1587 c->u.node6.mask))
1588 break;
1589 c = c->next;
1590 }
1591 break;
1592
1593 default:
1594 *out_sid = SECINITSID_NODE;
1595 goto out;
1596 }
1597
1598 if (c) {
1599 if (!c->sid[0]) {
1600 rc = sidtab_context_to_sid(&sidtab,
1601 &c->context[0],
1602 &c->sid[0]);
1603 if (rc)
1604 goto out;
1605 }
1606 *out_sid = c->sid[0];
1607 } else {
1608 *out_sid = SECINITSID_NODE;
1609 }
1610
1611 out:
1612 POLICY_RDUNLOCK;
1613 return rc;
1614 }
1615
1616 #define SIDS_NEL 25
1617
1618 /**
1619 * security_get_user_sids - Obtain reachable SIDs for a user.
1620 * @fromsid: starting SID
1621 * @username: username
1622 * @sids: array of reachable SIDs for user
1623 * @nel: number of elements in @sids
1624 *
1625 * Generate the set of SIDs for legal security contexts
1626 * for a given user that can be reached by @fromsid.
1627 * Set *@sids to point to a dynamically allocated
1628 * array containing the set of SIDs. Set *@nel to the
1629 * number of elements in the array.
1630 */
1631
1632 int security_get_user_sids(u32 fromsid,
1633 char *username,
1634 u32 **sids,
1635 u32 *nel)
1636 {
1637 struct context *fromcon, usercon;
1638 u32 *mysids = NULL, *mysids2, sid;
1639 u32 mynel = 0, maxnel = SIDS_NEL;
1640 struct user_datum *user;
1641 struct role_datum *role;
1642 struct ebitmap_node *rnode, *tnode;
1643 int rc = 0, i, j;
1644
1645 *sids = NULL;
1646 *nel = 0;
1647
1648 if (!ss_initialized)
1649 goto out;
1650
1651 POLICY_RDLOCK;
1652
1653 fromcon = sidtab_search(&sidtab, fromsid);
1654 if (!fromcon) {
1655 rc = -EINVAL;
1656 goto out_unlock;
1657 }
1658
1659 user = hashtab_search(policydb.p_users.table, username);
1660 if (!user) {
1661 rc = -EINVAL;
1662 goto out_unlock;
1663 }
1664 usercon.user = user->value;
1665
1666 mysids = kcalloc(maxnel, sizeof(*mysids), GFP_ATOMIC);
1667 if (!mysids) {
1668 rc = -ENOMEM;
1669 goto out_unlock;
1670 }
1671
1672 ebitmap_for_each_positive_bit(&user->roles, rnode, i) {
1673 role = policydb.role_val_to_struct[i];
1674 usercon.role = i+1;
1675 ebitmap_for_each_positive_bit(&role->types, tnode, j) {
1676 usercon.type = j+1;
1677
1678 if (mls_setup_user_range(fromcon, user, &usercon))
1679 continue;
1680
1681 rc = sidtab_context_to_sid(&sidtab, &usercon, &sid);
1682 if (rc)
1683 goto out_unlock;
1684 if (mynel < maxnel) {
1685 mysids[mynel++] = sid;
1686 } else {
1687 maxnel += SIDS_NEL;
1688 mysids2 = kcalloc(maxnel, sizeof(*mysids2), GFP_ATOMIC);
1689 if (!mysids2) {
1690 rc = -ENOMEM;
1691 goto out_unlock;
1692 }
1693 memcpy(mysids2, mysids, mynel * sizeof(*mysids2));
1694 kfree(mysids);
1695 mysids = mysids2;
1696 mysids[mynel++] = sid;
1697 }
1698 }
1699 }
1700
1701 out_unlock:
1702 POLICY_RDUNLOCK;
1703 if (rc || !mynel) {
1704 kfree(mysids);
1705 goto out;
1706 }
1707
1708 mysids2 = kcalloc(mynel, sizeof(*mysids2), GFP_KERNEL);
1709 if (!mysids2) {
1710 rc = -ENOMEM;
1711 kfree(mysids);
1712 goto out;
1713 }
1714 for (i = 0, j = 0; i < mynel; i++) {
1715 rc = avc_has_perm_noaudit(fromsid, mysids[i],
1716 SECCLASS_PROCESS,
1717 PROCESS__TRANSITION, AVC_STRICT,
1718 NULL);
1719 if (!rc)
1720 mysids2[j++] = mysids[i];
1721 cond_resched();
1722 }
1723 rc = 0;
1724 kfree(mysids);
1725 *sids = mysids2;
1726 *nel = j;
1727 out:
1728 return rc;
1729 }
1730
1731 /**
1732 * security_genfs_sid - Obtain a SID for a file in a filesystem
1733 * @fstype: filesystem type
1734 * @path: path from root of mount
1735 * @sclass: file security class
1736 * @sid: SID for path
1737 *
1738 * Obtain a SID to use for a file in a filesystem that
1739 * cannot support xattr or use a fixed labeling behavior like
1740 * transition SIDs or task SIDs.
1741 */
1742 int security_genfs_sid(const char *fstype,
1743 char *path,
1744 u16 sclass,
1745 u32 *sid)
1746 {
1747 int len;
1748 struct genfs *genfs;
1749 struct ocontext *c;
1750 int rc = 0, cmp = 0;
1751
1752 while (path[0] == '/' && path[1] == '/')
1753 path++;
1754
1755 POLICY_RDLOCK;
1756
1757 for (genfs = policydb.genfs; genfs; genfs = genfs->next) {
1758 cmp = strcmp(fstype, genfs->fstype);
1759 if (cmp <= 0)
1760 break;
1761 }
1762
1763 if (!genfs || cmp) {
1764 *sid = SECINITSID_UNLABELED;
1765 rc = -ENOENT;
1766 goto out;
1767 }
1768
1769 for (c = genfs->head; c; c = c->next) {
1770 len = strlen(c->u.name);
1771 if ((!c->v.sclass || sclass == c->v.sclass) &&
1772 (strncmp(c->u.name, path, len) == 0))
1773 break;
1774 }
1775
1776 if (!c) {
1777 *sid = SECINITSID_UNLABELED;
1778 rc = -ENOENT;
1779 goto out;
1780 }
1781
1782 if (!c->sid[0]) {
1783 rc = sidtab_context_to_sid(&sidtab,
1784 &c->context[0],
1785 &c->sid[0]);
1786 if (rc)
1787 goto out;
1788 }
1789
1790 *sid = c->sid[0];
1791 out:
1792 POLICY_RDUNLOCK;
1793 return rc;
1794 }
1795
1796 /**
1797 * security_fs_use - Determine how to handle labeling for a filesystem.
1798 * @fstype: filesystem type
1799 * @behavior: labeling behavior
1800 * @sid: SID for filesystem (superblock)
1801 */
1802 int security_fs_use(
1803 const char *fstype,
1804 unsigned int *behavior,
1805 u32 *sid)
1806 {
1807 int rc = 0;
1808 struct ocontext *c;
1809
1810 POLICY_RDLOCK;
1811
1812 c = policydb.ocontexts[OCON_FSUSE];
1813 while (c) {
1814 if (strcmp(fstype, c->u.name) == 0)
1815 break;
1816 c = c->next;
1817 }
1818
1819 if (c) {
1820 *behavior = c->v.behavior;
1821 if (!c->sid[0]) {
1822 rc = sidtab_context_to_sid(&sidtab,
1823 &c->context[0],
1824 &c->sid[0]);
1825 if (rc)
1826 goto out;
1827 }
1828 *sid = c->sid[0];
1829 } else {
1830 rc = security_genfs_sid(fstype, "/", SECCLASS_DIR, sid);
1831 if (rc) {
1832 *behavior = SECURITY_FS_USE_NONE;
1833 rc = 0;
1834 } else {
1835 *behavior = SECURITY_FS_USE_GENFS;
1836 }
1837 }
1838
1839 out:
1840 POLICY_RDUNLOCK;
1841 return rc;
1842 }
1843
1844 int security_get_bools(int *len, char ***names, int **values)
1845 {
1846 int i, rc = -ENOMEM;
1847
1848 POLICY_RDLOCK;
1849 *names = NULL;
1850 *values = NULL;
1851
1852 *len = policydb.p_bools.nprim;
1853 if (!*len) {
1854 rc = 0;
1855 goto out;
1856 }
1857
1858 *names = kcalloc(*len, sizeof(char*), GFP_ATOMIC);
1859 if (!*names)
1860 goto err;
1861
1862 *values = kcalloc(*len, sizeof(int), GFP_ATOMIC);
1863 if (!*values)
1864 goto err;
1865
1866 for (i = 0; i < *len; i++) {
1867 size_t name_len;
1868 (*values)[i] = policydb.bool_val_to_struct[i]->state;
1869 name_len = strlen(policydb.p_bool_val_to_name[i]) + 1;
1870 (*names)[i] = kmalloc(sizeof(char) * name_len, GFP_ATOMIC);
1871 if (!(*names)[i])
1872 goto err;
1873 strncpy((*names)[i], policydb.p_bool_val_to_name[i], name_len);
1874 (*names)[i][name_len - 1] = 0;
1875 }
1876 rc = 0;
1877 out:
1878 POLICY_RDUNLOCK;
1879 return rc;
1880 err:
1881 if (*names) {
1882 for (i = 0; i < *len; i++)
1883 kfree((*names)[i]);
1884 }
1885 kfree(*values);
1886 goto out;
1887 }
1888
1889
1890 int security_set_bools(int len, int *values)
1891 {
1892 int i, rc = 0;
1893 int lenp, seqno = 0;
1894 struct cond_node *cur;
1895
1896 POLICY_WRLOCK;
1897
1898 lenp = policydb.p_bools.nprim;
1899 if (len != lenp) {
1900 rc = -EFAULT;
1901 goto out;
1902 }
1903
1904 for (i = 0; i < len; i++) {
1905 if (!!values[i] != policydb.bool_val_to_struct[i]->state) {
1906 audit_log(current->audit_context, GFP_ATOMIC,
1907 AUDIT_MAC_CONFIG_CHANGE,
1908 "bool=%s val=%d old_val=%d auid=%u",
1909 policydb.p_bool_val_to_name[i],
1910 !!values[i],
1911 policydb.bool_val_to_struct[i]->state,
1912 audit_get_loginuid(current->audit_context));
1913 }
1914 if (values[i]) {
1915 policydb.bool_val_to_struct[i]->state = 1;
1916 } else {
1917 policydb.bool_val_to_struct[i]->state = 0;
1918 }
1919 }
1920
1921 for (cur = policydb.cond_list; cur != NULL; cur = cur->next) {
1922 rc = evaluate_cond_node(&policydb, cur);
1923 if (rc)
1924 goto out;
1925 }
1926
1927 seqno = ++latest_granting;
1928
1929 out:
1930 POLICY_WRUNLOCK;
1931 if (!rc) {
1932 avc_ss_reset(seqno);
1933 selnl_notify_policyload(seqno);
1934 selinux_xfrm_notify_policyload();
1935 }
1936 return rc;
1937 }
1938
1939 int security_get_bool_value(int bool)
1940 {
1941 int rc = 0;
1942 int len;
1943
1944 POLICY_RDLOCK;
1945
1946 len = policydb.p_bools.nprim;
1947 if (bool >= len) {
1948 rc = -EFAULT;
1949 goto out;
1950 }
1951
1952 rc = policydb.bool_val_to_struct[bool]->state;
1953 out:
1954 POLICY_RDUNLOCK;
1955 return rc;
1956 }
1957
1958 static int security_preserve_bools(struct policydb *p)
1959 {
1960 int rc, nbools = 0, *bvalues = NULL, i;
1961 char **bnames = NULL;
1962 struct cond_bool_datum *booldatum;
1963 struct cond_node *cur;
1964
1965 rc = security_get_bools(&nbools, &bnames, &bvalues);
1966 if (rc)
1967 goto out;
1968 for (i = 0; i < nbools; i++) {
1969 booldatum = hashtab_search(p->p_bools.table, bnames[i]);
1970 if (booldatum)
1971 booldatum->state = bvalues[i];
1972 }
1973 for (cur = p->cond_list; cur != NULL; cur = cur->next) {
1974 rc = evaluate_cond_node(p, cur);
1975 if (rc)
1976 goto out;
1977 }
1978
1979 out:
1980 if (bnames) {
1981 for (i = 0; i < nbools; i++)
1982 kfree(bnames[i]);
1983 }
1984 kfree(bnames);
1985 kfree(bvalues);
1986 return rc;
1987 }
1988
1989 /*
1990 * security_sid_mls_copy() - computes a new sid based on the given
1991 * sid and the mls portion of mls_sid.
1992 */
1993 int security_sid_mls_copy(u32 sid, u32 mls_sid, u32 *new_sid)
1994 {
1995 struct context *context1;
1996 struct context *context2;
1997 struct context newcon;
1998 char *s;
1999 u32 len;
2000 int rc = 0;
2001
2002 if (!ss_initialized || !selinux_mls_enabled) {
2003 *new_sid = sid;
2004 goto out;
2005 }
2006
2007 context_init(&newcon);
2008
2009 POLICY_RDLOCK;
2010 context1 = sidtab_search(&sidtab, sid);
2011 if (!context1) {
2012 printk(KERN_ERR "security_sid_mls_copy: unrecognized SID "
2013 "%d\n", sid);
2014 rc = -EINVAL;
2015 goto out_unlock;
2016 }
2017
2018 context2 = sidtab_search(&sidtab, mls_sid);
2019 if (!context2) {
2020 printk(KERN_ERR "security_sid_mls_copy: unrecognized SID "
2021 "%d\n", mls_sid);
2022 rc = -EINVAL;
2023 goto out_unlock;
2024 }
2025
2026 newcon.user = context1->user;
2027 newcon.role = context1->role;
2028 newcon.type = context1->type;
2029 rc = mls_context_cpy(&newcon, context2);
2030 if (rc)
2031 goto out_unlock;
2032
2033 /* Check the validity of the new context. */
2034 if (!policydb_context_isvalid(&policydb, &newcon)) {
2035 rc = convert_context_handle_invalid_context(&newcon);
2036 if (rc)
2037 goto bad;
2038 }
2039
2040 rc = sidtab_context_to_sid(&sidtab, &newcon, new_sid);
2041 goto out_unlock;
2042
2043 bad:
2044 if (!context_struct_to_string(&newcon, &s, &len)) {
2045 audit_log(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR,
2046 "security_sid_mls_copy: invalid context %s", s);
2047 kfree(s);
2048 }
2049
2050 out_unlock:
2051 POLICY_RDUNLOCK;
2052 context_destroy(&newcon);
2053 out:
2054 return rc;
2055 }
2056
2057 /**
2058 * security_net_peersid_resolve - Compare and resolve two network peer SIDs
2059 * @nlbl_sid: NetLabel SID
2060 * @nlbl_type: NetLabel labeling protocol type
2061 * @xfrm_sid: XFRM SID
2062 *
2063 * Description:
2064 * Compare the @nlbl_sid and @xfrm_sid values and if the two SIDs can be
2065 * resolved into a single SID it is returned via @peer_sid and the function
2066 * returns zero. Otherwise @peer_sid is set to SECSID_NULL and the function
2067 * returns a negative value. A table summarizing the behavior is below:
2068 *
2069 * | function return | @sid
2070 * ------------------------------+-----------------+-----------------
2071 * no peer labels | 0 | SECSID_NULL
2072 * single peer label | 0 | <peer_label>
2073 * multiple, consistent labels | 0 | <peer_label>
2074 * multiple, inconsistent labels | -<errno> | SECSID_NULL
2075 *
2076 */
2077 int security_net_peersid_resolve(u32 nlbl_sid, u32 nlbl_type,
2078 u32 xfrm_sid,
2079 u32 *peer_sid)
2080 {
2081 int rc;
2082 struct context *nlbl_ctx;
2083 struct context *xfrm_ctx;
2084
2085 /* handle the common (which also happens to be the set of easy) cases
2086 * right away, these two if statements catch everything involving a
2087 * single or absent peer SID/label */
2088 if (xfrm_sid == SECSID_NULL) {
2089 *peer_sid = nlbl_sid;
2090 return 0;
2091 }
2092 /* NOTE: an nlbl_type == NETLBL_NLTYPE_UNLABELED is a "fallback" label
2093 * and is treated as if nlbl_sid == SECSID_NULL when a XFRM SID/label
2094 * is present */
2095 if (nlbl_sid == SECSID_NULL || nlbl_type == NETLBL_NLTYPE_UNLABELED) {
2096 *peer_sid = xfrm_sid;
2097 return 0;
2098 }
2099
2100 /* we don't need to check ss_initialized here since the only way both
2101 * nlbl_sid and xfrm_sid are not equal to SECSID_NULL would be if the
2102 * security server was initialized and ss_initialized was true */
2103 if (!selinux_mls_enabled) {
2104 *peer_sid = SECSID_NULL;
2105 return 0;
2106 }
2107
2108 POLICY_RDLOCK;
2109
2110 nlbl_ctx = sidtab_search(&sidtab, nlbl_sid);
2111 if (!nlbl_ctx) {
2112 printk(KERN_ERR
2113 "security_sid_mls_cmp: unrecognized SID %d\n",
2114 nlbl_sid);
2115 rc = -EINVAL;
2116 goto out_slowpath;
2117 }
2118 xfrm_ctx = sidtab_search(&sidtab, xfrm_sid);
2119 if (!xfrm_ctx) {
2120 printk(KERN_ERR
2121 "security_sid_mls_cmp: unrecognized SID %d\n",
2122 xfrm_sid);
2123 rc = -EINVAL;
2124 goto out_slowpath;
2125 }
2126 rc = (mls_context_cmp(nlbl_ctx, xfrm_ctx) ? 0 : -EACCES);
2127
2128 out_slowpath:
2129 POLICY_RDUNLOCK;
2130 if (rc == 0)
2131 /* at present NetLabel SIDs/labels really only carry MLS
2132 * information so if the MLS portion of the NetLabel SID
2133 * matches the MLS portion of the labeled XFRM SID/label
2134 * then pass along the XFRM SID as it is the most
2135 * expressive */
2136 *peer_sid = xfrm_sid;
2137 else
2138 *peer_sid = SECSID_NULL;
2139 return rc;
2140 }
2141
2142 static int get_classes_callback(void *k, void *d, void *args)
2143 {
2144 struct class_datum *datum = d;
2145 char *name = k, **classes = args;
2146 int value = datum->value - 1;
2147
2148 classes[value] = kstrdup(name, GFP_ATOMIC);
2149 if (!classes[value])
2150 return -ENOMEM;
2151
2152 return 0;
2153 }
2154
2155 int security_get_classes(char ***classes, int *nclasses)
2156 {
2157 int rc = -ENOMEM;
2158
2159 POLICY_RDLOCK;
2160
2161 *nclasses = policydb.p_classes.nprim;
2162 *classes = kcalloc(*nclasses, sizeof(*classes), GFP_ATOMIC);
2163 if (!*classes)
2164 goto out;
2165
2166 rc = hashtab_map(policydb.p_classes.table, get_classes_callback,
2167 *classes);
2168 if (rc < 0) {
2169 int i;
2170 for (i = 0; i < *nclasses; i++)
2171 kfree((*classes)[i]);
2172 kfree(*classes);
2173 }
2174
2175 out:
2176 POLICY_RDUNLOCK;
2177 return rc;
2178 }
2179
2180 static int get_permissions_callback(void *k, void *d, void *args)
2181 {
2182 struct perm_datum *datum = d;
2183 char *name = k, **perms = args;
2184 int value = datum->value - 1;
2185
2186 perms[value] = kstrdup(name, GFP_ATOMIC);
2187 if (!perms[value])
2188 return -ENOMEM;
2189
2190 return 0;
2191 }
2192
2193 int security_get_permissions(char *class, char ***perms, int *nperms)
2194 {
2195 int rc = -ENOMEM, i;
2196 struct class_datum *match;
2197
2198 POLICY_RDLOCK;
2199
2200 match = hashtab_search(policydb.p_classes.table, class);
2201 if (!match) {
2202 printk(KERN_ERR "%s: unrecognized class %s\n",
2203 __FUNCTION__, class);
2204 rc = -EINVAL;
2205 goto out;
2206 }
2207
2208 *nperms = match->permissions.nprim;
2209 *perms = kcalloc(*nperms, sizeof(*perms), GFP_ATOMIC);
2210 if (!*perms)
2211 goto out;
2212
2213 if (match->comdatum) {
2214 rc = hashtab_map(match->comdatum->permissions.table,
2215 get_permissions_callback, *perms);
2216 if (rc < 0)
2217 goto err;
2218 }
2219
2220 rc = hashtab_map(match->permissions.table, get_permissions_callback,
2221 *perms);
2222 if (rc < 0)
2223 goto err;
2224
2225 out:
2226 POLICY_RDUNLOCK;
2227 return rc;
2228
2229 err:
2230 POLICY_RDUNLOCK;
2231 for (i = 0; i < *nperms; i++)
2232 kfree((*perms)[i]);
2233 kfree(*perms);
2234 return rc;
2235 }
2236
2237 int security_get_reject_unknown(void)
2238 {
2239 return policydb.reject_unknown;
2240 }
2241
2242 int security_get_allow_unknown(void)
2243 {
2244 return policydb.allow_unknown;
2245 }
2246
2247 /**
2248 * security_get_policycaps - Query the loaded policy for its capabilities
2249 * @len: the number of capability bits
2250 * @values: the capability bit array
2251 *
2252 * Description:
2253 * Get an array of the policy capabilities in @values where each entry in
2254 * @values is either true (1) or false (0) depending the policy's support of
2255 * that feature. The policy capabilities are defined by the
2256 * POLICYDB_CAPABILITY_* enums. The size of the array is stored in @len and it
2257 * is up to the caller to free the array in @values. Returns zero on success,
2258 * negative values on failure.
2259 *
2260 */
2261 int security_get_policycaps(int *len, int **values)
2262 {
2263 int rc = -ENOMEM;
2264 unsigned int iter;
2265
2266 POLICY_RDLOCK;
2267
2268 *values = kcalloc(POLICYDB_CAPABILITY_MAX, sizeof(int), GFP_ATOMIC);
2269 if (*values == NULL)
2270 goto out;
2271 for (iter = 0; iter < POLICYDB_CAPABILITY_MAX; iter++)
2272 (*values)[iter] = ebitmap_get_bit(&policydb.policycaps, iter);
2273 *len = POLICYDB_CAPABILITY_MAX;
2274
2275 out:
2276 POLICY_RDUNLOCK;
2277 return rc;
2278 }
2279
2280 /**
2281 * security_policycap_supported - Check for a specific policy capability
2282 * @req_cap: capability
2283 *
2284 * Description:
2285 * This function queries the currently loaded policy to see if it supports the
2286 * capability specified by @req_cap. Returns true (1) if the capability is
2287 * supported, false (0) if it isn't supported.
2288 *
2289 */
2290 int security_policycap_supported(unsigned int req_cap)
2291 {
2292 int rc;
2293
2294 POLICY_RDLOCK;
2295 rc = ebitmap_get_bit(&policydb.policycaps, req_cap);
2296 POLICY_RDUNLOCK;
2297
2298 return rc;
2299 }
2300
2301 struct selinux_audit_rule {
2302 u32 au_seqno;
2303 struct context au_ctxt;
2304 };
2305
2306 void selinux_audit_rule_free(struct selinux_audit_rule *rule)
2307 {
2308 if (rule) {
2309 context_destroy(&rule->au_ctxt);
2310 kfree(rule);
2311 }
2312 }
2313
2314 int selinux_audit_rule_init(u32 field, u32 op, char *rulestr,
2315 struct selinux_audit_rule **rule)
2316 {
2317 struct selinux_audit_rule *tmprule;
2318 struct role_datum *roledatum;
2319 struct type_datum *typedatum;
2320 struct user_datum *userdatum;
2321 int rc = 0;
2322
2323 *rule = NULL;
2324
2325 if (!ss_initialized)
2326 return -EOPNOTSUPP;
2327
2328 switch (field) {
2329 case AUDIT_SUBJ_USER:
2330 case AUDIT_SUBJ_ROLE:
2331 case AUDIT_SUBJ_TYPE:
2332 case AUDIT_OBJ_USER:
2333 case AUDIT_OBJ_ROLE:
2334 case AUDIT_OBJ_TYPE:
2335 /* only 'equals' and 'not equals' fit user, role, and type */
2336 if (op != AUDIT_EQUAL && op != AUDIT_NOT_EQUAL)
2337 return -EINVAL;
2338 break;
2339 case AUDIT_SUBJ_SEN:
2340 case AUDIT_SUBJ_CLR:
2341 case AUDIT_OBJ_LEV_LOW:
2342 case AUDIT_OBJ_LEV_HIGH:
2343 /* we do not allow a range, indicated by the presense of '-' */
2344 if (strchr(rulestr, '-'))
2345 return -EINVAL;
2346 break;
2347 default:
2348 /* only the above fields are valid */
2349 return -EINVAL;
2350 }
2351
2352 tmprule = kzalloc(sizeof(struct selinux_audit_rule), GFP_KERNEL);
2353 if (!tmprule)
2354 return -ENOMEM;
2355
2356 context_init(&tmprule->au_ctxt);
2357
2358 POLICY_RDLOCK;
2359
2360 tmprule->au_seqno = latest_granting;
2361
2362 switch (field) {
2363 case AUDIT_SUBJ_USER:
2364 case AUDIT_OBJ_USER:
2365 userdatum = hashtab_search(policydb.p_users.table, rulestr);
2366 if (!userdatum)
2367 rc = -EINVAL;
2368 else
2369 tmprule->au_ctxt.user = userdatum->value;
2370 break;
2371 case AUDIT_SUBJ_ROLE:
2372 case AUDIT_OBJ_ROLE:
2373 roledatum = hashtab_search(policydb.p_roles.table, rulestr);
2374 if (!roledatum)
2375 rc = -EINVAL;
2376 else
2377 tmprule->au_ctxt.role = roledatum->value;
2378 break;
2379 case AUDIT_SUBJ_TYPE:
2380 case AUDIT_OBJ_TYPE:
2381 typedatum = hashtab_search(policydb.p_types.table, rulestr);
2382 if (!typedatum)
2383 rc = -EINVAL;
2384 else
2385 tmprule->au_ctxt.type = typedatum->value;
2386 break;
2387 case AUDIT_SUBJ_SEN:
2388 case AUDIT_SUBJ_CLR:
2389 case AUDIT_OBJ_LEV_LOW:
2390 case AUDIT_OBJ_LEV_HIGH:
2391 rc = mls_from_string(rulestr, &tmprule->au_ctxt, GFP_ATOMIC);
2392 break;
2393 }
2394
2395 POLICY_RDUNLOCK;
2396
2397 if (rc) {
2398 selinux_audit_rule_free(tmprule);
2399 tmprule = NULL;
2400 }
2401
2402 *rule = tmprule;
2403
2404 return rc;
2405 }
2406
2407 int selinux_audit_rule_match(u32 sid, u32 field, u32 op,
2408 struct selinux_audit_rule *rule,
2409 struct audit_context *actx)
2410 {
2411 struct context *ctxt;
2412 struct mls_level *level;
2413 int match = 0;
2414
2415 if (!rule) {
2416 audit_log(actx, GFP_ATOMIC, AUDIT_SELINUX_ERR,
2417 "selinux_audit_rule_match: missing rule\n");
2418 return -ENOENT;
2419 }
2420
2421 POLICY_RDLOCK;
2422
2423 if (rule->au_seqno < latest_granting) {
2424 audit_log(actx, GFP_ATOMIC, AUDIT_SELINUX_ERR,
2425 "selinux_audit_rule_match: stale rule\n");
2426 match = -ESTALE;
2427 goto out;
2428 }
2429
2430 ctxt = sidtab_search(&sidtab, sid);
2431 if (!ctxt) {
2432 audit_log(actx, GFP_ATOMIC, AUDIT_SELINUX_ERR,
2433 "selinux_audit_rule_match: unrecognized SID %d\n",
2434 sid);
2435 match = -ENOENT;
2436 goto out;
2437 }
2438
2439 /* a field/op pair that is not caught here will simply fall through
2440 without a match */
2441 switch (field) {
2442 case AUDIT_SUBJ_USER:
2443 case AUDIT_OBJ_USER:
2444 switch (op) {
2445 case AUDIT_EQUAL:
2446 match = (ctxt->user == rule->au_ctxt.user);
2447 break;
2448 case AUDIT_NOT_EQUAL:
2449 match = (ctxt->user != rule->au_ctxt.user);
2450 break;
2451 }
2452 break;
2453 case AUDIT_SUBJ_ROLE:
2454 case AUDIT_OBJ_ROLE:
2455 switch (op) {
2456 case AUDIT_EQUAL:
2457 match = (ctxt->role == rule->au_ctxt.role);
2458 break;
2459 case AUDIT_NOT_EQUAL:
2460 match = (ctxt->role != rule->au_ctxt.role);
2461 break;
2462 }
2463 break;
2464 case AUDIT_SUBJ_TYPE:
2465 case AUDIT_OBJ_TYPE:
2466 switch (op) {
2467 case AUDIT_EQUAL:
2468 match = (ctxt->type == rule->au_ctxt.type);
2469 break;
2470 case AUDIT_NOT_EQUAL:
2471 match = (ctxt->type != rule->au_ctxt.type);
2472 break;
2473 }
2474 break;
2475 case AUDIT_SUBJ_SEN:
2476 case AUDIT_SUBJ_CLR:
2477 case AUDIT_OBJ_LEV_LOW:
2478 case AUDIT_OBJ_LEV_HIGH:
2479 level = ((field == AUDIT_SUBJ_SEN ||
2480 field == AUDIT_OBJ_LEV_LOW) ?
2481 &ctxt->range.level[0] : &ctxt->range.level[1]);
2482 switch (op) {
2483 case AUDIT_EQUAL:
2484 match = mls_level_eq(&rule->au_ctxt.range.level[0],
2485 level);
2486 break;
2487 case AUDIT_NOT_EQUAL:
2488 match = !mls_level_eq(&rule->au_ctxt.range.level[0],
2489 level);
2490 break;
2491 case AUDIT_LESS_THAN:
2492 match = (mls_level_dom(&rule->au_ctxt.range.level[0],
2493 level) &&
2494 !mls_level_eq(&rule->au_ctxt.range.level[0],
2495 level));
2496 break;
2497 case AUDIT_LESS_THAN_OR_EQUAL:
2498 match = mls_level_dom(&rule->au_ctxt.range.level[0],
2499 level);
2500 break;
2501 case AUDIT_GREATER_THAN:
2502 match = (mls_level_dom(level,
2503 &rule->au_ctxt.range.level[0]) &&
2504 !mls_level_eq(level,
2505 &rule->au_ctxt.range.level[0]));
2506 break;
2507 case AUDIT_GREATER_THAN_OR_EQUAL:
2508 match = mls_level_dom(level,
2509 &rule->au_ctxt.range.level[0]);
2510 break;
2511 }
2512 }
2513
2514 out:
2515 POLICY_RDUNLOCK;
2516 return match;
2517 }
2518
2519 static int (*aurule_callback)(void) = NULL;
2520
2521 static int aurule_avc_callback(u32 event, u32 ssid, u32 tsid,
2522 u16 class, u32 perms, u32 *retained)
2523 {
2524 int err = 0;
2525
2526 if (event == AVC_CALLBACK_RESET && aurule_callback)
2527 err = aurule_callback();
2528 return err;
2529 }
2530
2531 static int __init aurule_init(void)
2532 {
2533 int err;
2534
2535 err = avc_add_callback(aurule_avc_callback, AVC_CALLBACK_RESET,
2536 SECSID_NULL, SECSID_NULL, SECCLASS_NULL, 0);
2537 if (err)
2538 panic("avc_add_callback() failed, error %d\n", err);
2539
2540 return err;
2541 }
2542 __initcall(aurule_init);
2543
2544 void selinux_audit_set_callback(int (*callback)(void))
2545 {
2546 aurule_callback = callback;
2547 }
2548
2549 #ifdef CONFIG_NETLABEL
2550 /**
2551 * security_netlbl_cache_add - Add an entry to the NetLabel cache
2552 * @secattr: the NetLabel packet security attributes
2553 * @sid: the SELinux SID
2554 *
2555 * Description:
2556 * Attempt to cache the context in @ctx, which was derived from the packet in
2557 * @skb, in the NetLabel subsystem cache. This function assumes @secattr has
2558 * already been initialized.
2559 *
2560 */
2561 static void security_netlbl_cache_add(struct netlbl_lsm_secattr *secattr,
2562 u32 sid)
2563 {
2564 u32 *sid_cache;
2565
2566 sid_cache = kmalloc(sizeof(*sid_cache), GFP_ATOMIC);
2567 if (sid_cache == NULL)
2568 return;
2569 secattr->cache = netlbl_secattr_cache_alloc(GFP_ATOMIC);
2570 if (secattr->cache == NULL) {
2571 kfree(sid_cache);
2572 return;
2573 }
2574
2575 *sid_cache = sid;
2576 secattr->cache->free = kfree;
2577 secattr->cache->data = sid_cache;
2578 secattr->flags |= NETLBL_SECATTR_CACHE;
2579 }
2580
2581 /**
2582 * security_netlbl_secattr_to_sid - Convert a NetLabel secattr to a SELinux SID
2583 * @secattr: the NetLabel packet security attributes
2584 * @sid: the SELinux SID
2585 *
2586 * Description:
2587 * Convert the given NetLabel security attributes in @secattr into a
2588 * SELinux SID. If the @secattr field does not contain a full SELinux
2589 * SID/context then use SECINITSID_NETMSG as the foundation. If possibile the
2590 * 'cache' field of @secattr is set and the CACHE flag is set; this is to
2591 * allow the @secattr to be used by NetLabel to cache the secattr to SID
2592 * conversion for future lookups. Returns zero on success, negative values on
2593 * failure.
2594 *
2595 */
2596 int security_netlbl_secattr_to_sid(struct netlbl_lsm_secattr *secattr,
2597 u32 *sid)
2598 {
2599 int rc = -EIDRM;
2600 struct context *ctx;
2601 struct context ctx_new;
2602
2603 if (!ss_initialized) {
2604 *sid = SECSID_NULL;
2605 return 0;
2606 }
2607
2608 POLICY_RDLOCK;
2609
2610 if (secattr->flags & NETLBL_SECATTR_CACHE) {
2611 *sid = *(u32 *)secattr->cache->data;
2612 rc = 0;
2613 } else if (secattr->flags & NETLBL_SECATTR_SECID) {
2614 *sid = secattr->attr.secid;
2615 rc = 0;
2616 } else if (secattr->flags & NETLBL_SECATTR_MLS_LVL) {
2617 ctx = sidtab_search(&sidtab, SECINITSID_NETMSG);
2618 if (ctx == NULL)
2619 goto netlbl_secattr_to_sid_return;
2620
2621 ctx_new.user = ctx->user;
2622 ctx_new.role = ctx->role;
2623 ctx_new.type = ctx->type;
2624 mls_import_netlbl_lvl(&ctx_new, secattr);
2625 if (secattr->flags & NETLBL_SECATTR_MLS_CAT) {
2626 if (ebitmap_netlbl_import(&ctx_new.range.level[0].cat,
2627 secattr->attr.mls.cat) != 0)
2628 goto netlbl_secattr_to_sid_return;
2629 ctx_new.range.level[1].cat.highbit =
2630 ctx_new.range.level[0].cat.highbit;
2631 ctx_new.range.level[1].cat.node =
2632 ctx_new.range.level[0].cat.node;
2633 } else {
2634 ebitmap_init(&ctx_new.range.level[0].cat);
2635 ebitmap_init(&ctx_new.range.level[1].cat);
2636 }
2637 if (mls_context_isvalid(&policydb, &ctx_new) != 1)
2638 goto netlbl_secattr_to_sid_return_cleanup;
2639
2640 rc = sidtab_context_to_sid(&sidtab, &ctx_new, sid);
2641 if (rc != 0)
2642 goto netlbl_secattr_to_sid_return_cleanup;
2643
2644 security_netlbl_cache_add(secattr, *sid);
2645
2646 ebitmap_destroy(&ctx_new.range.level[0].cat);
2647 } else {
2648 *sid = SECSID_NULL;
2649 rc = 0;
2650 }
2651
2652 netlbl_secattr_to_sid_return:
2653 POLICY_RDUNLOCK;
2654 return rc;
2655 netlbl_secattr_to_sid_return_cleanup:
2656 ebitmap_destroy(&ctx_new.range.level[0].cat);
2657 goto netlbl_secattr_to_sid_return;
2658 }
2659
2660 /**
2661 * security_netlbl_sid_to_secattr - Convert a SELinux SID to a NetLabel secattr
2662 * @sid: the SELinux SID
2663 * @secattr: the NetLabel packet security attributes
2664 *
2665 * Description:
2666 * Convert the given SELinux SID in @sid into a NetLabel security attribute.
2667 * Returns zero on success, negative values on failure.
2668 *
2669 */
2670 int security_netlbl_sid_to_secattr(u32 sid, struct netlbl_lsm_secattr *secattr)
2671 {
2672 int rc = -ENOENT;
2673 struct context *ctx;
2674
2675 if (!ss_initialized)
2676 return 0;
2677
2678 POLICY_RDLOCK;
2679 ctx = sidtab_search(&sidtab, sid);
2680 if (ctx == NULL)
2681 goto netlbl_sid_to_secattr_failure;
2682 secattr->domain = kstrdup(policydb.p_type_val_to_name[ctx->type - 1],
2683 GFP_ATOMIC);
2684 secattr->flags |= NETLBL_SECATTR_DOMAIN;
2685 mls_export_netlbl_lvl(ctx, secattr);
2686 rc = mls_export_netlbl_cat(ctx, secattr);
2687 if (rc != 0)
2688 goto netlbl_sid_to_secattr_failure;
2689 POLICY_RDUNLOCK;
2690
2691 return 0;
2692
2693 netlbl_sid_to_secattr_failure:
2694 POLICY_RDUNLOCK;
2695 netlbl_secattr_destroy(secattr);
2696 return rc;
2697 }
2698 #endif /* CONFIG_NETLABEL */
WRT350N Kernel Patches