1/* Authors: Karl MacMillan <kmacmillan@mentalrootkit.com> 2 * Jason Tang <jtang@tresys.com> 3 * Joshua Brindle <jbrindle@tresys.com> 4 * 5 * Copyright (C) 2004-2005 Tresys Technology, LLC 6 * Copyright (C) 2007 Red Hat, Inc. 7 * 8 * This library is free software; you can redistribute it and/or 9 * modify it under the terms of the GNU Lesser General Public 10 * License as published by the Free Software Foundation; either 11 * version 2.1 of the License, or (at your option) any later version. 12 * 13 * This library is distributed in the hope that it will be useful, 14 * but WITHOUT ANY WARRANTY; without even the implied warranty of 15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU 16 * Lesser General Public License for more details. 17 * 18 * You should have received a copy of the GNU Lesser General Public 19 * License along with this library; if not, write to the Free Software 20 * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA 21 */ 22 23#include "context.h" 24#include <sepol/policydb/policydb.h> 25#include <sepol/policydb/conditional.h> 26#include <sepol/policydb/hashtab.h> 27#include <sepol/policydb/expand.h> 28#include <sepol/policydb/hierarchy.h> 29#include <sepol/policydb/avrule_block.h> 30 31#include <stdlib.h> 32#include <stdarg.h> 33#include <stdio.h> 34#include <string.h> 35#include <assert.h> 36 37#include "debug.h" 38#include "private.h" 39 40typedef struct expand_state { 41 int verbose; 42 uint32_t *typemap; 43 uint32_t *boolmap; 44 uint32_t *rolemap; 45 uint32_t *usermap; 46 policydb_t *base; 47 policydb_t *out; 48 sepol_handle_t *handle; 49 int expand_neverallow; 50} expand_state_t; 51 52static void expand_state_init(expand_state_t * state) 53{ 54 memset(state, 0, sizeof(expand_state_t)); 55} 56 57static int map_ebitmap(ebitmap_t * src, ebitmap_t * dst, uint32_t * map) 58{ 59 unsigned int i; 60 ebitmap_node_t *tnode; 61 ebitmap_init(dst); 62 63 ebitmap_for_each_bit(src, tnode, i) { 64 if (!ebitmap_node_get_bit(tnode, i)) 65 continue; 66 if (!map[i]) 67 continue; 68 if (ebitmap_set_bit(dst, map[i] - 1, 1)) 69 return -1; 70 } 71 return 0; 72} 73 74static int type_copy_callback(hashtab_key_t key, hashtab_datum_t datum, 75 void *data) 76{ 77 int ret; 78 char *id, *new_id; 79 type_datum_t *type, *new_type; 80 expand_state_t *state; 81 82 id = (char *)key; 83 type = (type_datum_t *) datum; 84 state = (expand_state_t *) data; 85 86 if ((type->flavor == TYPE_TYPE && !type->primary) 87 || type->flavor == TYPE_ALIAS) { 88 /* aliases are handled later */ 89 return 0; 90 } 91 if (!is_id_enabled(id, state->base, SYM_TYPES)) { 92 /* identifier's scope is not enabled */ 93 return 0; 94 } 95 96 if (state->verbose) 97 INFO(state->handle, "copying type or attribute %s", id); 98 99 new_id = strdup(id); 100 if (new_id == NULL) { 101 ERR(state->handle, "Out of memory!"); 102 return -1; 103 } 104 105 new_type = (type_datum_t *) malloc(sizeof(type_datum_t)); 106 if (!new_type) { 107 ERR(state->handle, "Out of memory!"); 108 free(new_id); 109 return SEPOL_ENOMEM; 110 } 111 memset(new_type, 0, sizeof(type_datum_t)); 112 113 new_type->flavor = type->flavor; 114 new_type->flags = type->flags; 115 new_type->s.value = ++state->out->p_types.nprim; 116 if (new_type->s.value > UINT16_MAX) { 117 free(new_id); 118 free(new_type); 119 ERR(state->handle, "type space overflow"); 120 return -1; 121 } 122 new_type->primary = 1; 123 state->typemap[type->s.value - 1] = new_type->s.value; 124 125 ret = hashtab_insert(state->out->p_types.table, 126 (hashtab_key_t) new_id, 127 (hashtab_datum_t) new_type); 128 if (ret) { 129 free(new_id); 130 free(new_type); 131 ERR(state->handle, "hashtab overflow"); 132 return -1; 133 } 134 135 if (new_type->flags & TYPE_FLAGS_PERMISSIVE) 136 if (ebitmap_set_bit(&state->out->permissive_map, new_type->s.value, 1)) { 137 ERR(state->handle, "Out of memory!\n"); 138 return -1; 139 } 140 141 return 0; 142} 143 144static int attr_convert_callback(hashtab_key_t key, hashtab_datum_t datum, 145 void *data) 146{ 147 char *id; 148 type_datum_t *type, *new_type; 149 expand_state_t *state; 150 ebitmap_t tmp_union; 151 152 id = (char *)key; 153 type = (type_datum_t *) datum; 154 state = (expand_state_t *) data; 155 156 if (type->flavor != TYPE_ATTRIB) 157 return 0; 158 159 if (!is_id_enabled(id, state->base, SYM_TYPES)) { 160 /* identifier's scope is not enabled */ 161 return 0; 162 } 163 164 if (state->verbose) 165 INFO(state->handle, "converting attribute %s", id); 166 167 new_type = hashtab_search(state->out->p_types.table, id); 168 if (!new_type) { 169 ERR(state->handle, "attribute %s vanished!", id); 170 return -1; 171 } 172 if (map_ebitmap(&type->types, &tmp_union, state->typemap)) { 173 ERR(state->handle, "out of memory"); 174 return -1; 175 } 176 177 /* then union tmp_union onto &new_type->types */ 178 if (ebitmap_union(&new_type->types, &tmp_union)) { 179 ERR(state->handle, "Out of memory!"); 180 return -1; 181 } 182 ebitmap_destroy(&tmp_union); 183 184 return 0; 185} 186 187static int perm_copy_callback(hashtab_key_t key, hashtab_datum_t datum, 188 void *data) 189{ 190 int ret; 191 char *id, *new_id; 192 symtab_t *s; 193 perm_datum_t *perm, *new_perm; 194 195 id = key; 196 perm = (perm_datum_t *) datum; 197 s = (symtab_t *) data; 198 199 new_perm = (perm_datum_t *) malloc(sizeof(perm_datum_t)); 200 if (!new_perm) { 201 return -1; 202 } 203 memset(new_perm, 0, sizeof(perm_datum_t)); 204 205 new_id = strdup(id); 206 if (!new_id) { 207 free(new_perm); 208 return -1; 209 } 210 211 new_perm->s.value = perm->s.value; 212 s->nprim++; 213 214 ret = hashtab_insert(s->table, new_id, (hashtab_datum_t *) new_perm); 215 if (ret) { 216 free(new_id); 217 free(new_perm); 218 return -1; 219 } 220 221 return 0; 222} 223 224static int common_copy_callback(hashtab_key_t key, hashtab_datum_t datum, 225 void *data) 226{ 227 int ret; 228 char *id, *new_id; 229 common_datum_t *common, *new_common; 230 expand_state_t *state; 231 232 id = (char *)key; 233 common = (common_datum_t *) datum; 234 state = (expand_state_t *) data; 235 236 if (state->verbose) 237 INFO(state->handle, "copying common %s", id); 238 239 new_common = (common_datum_t *) malloc(sizeof(common_datum_t)); 240 if (!new_common) { 241 ERR(state->handle, "Out of memory!"); 242 return -1; 243 } 244 memset(new_common, 0, sizeof(common_datum_t)); 245 if (symtab_init(&new_common->permissions, PERM_SYMTAB_SIZE)) { 246 ERR(state->handle, "Out of memory!"); 247 free(new_common); 248 return -1; 249 } 250 251 new_id = strdup(id); 252 if (!new_id) { 253 ERR(state->handle, "Out of memory!"); 254 /* free memory created by symtab_init first, then free new_common */ 255 symtab_destroy(&new_common->permissions); 256 free(new_common); 257 return -1; 258 } 259 260 new_common->s.value = common->s.value; 261 state->out->p_commons.nprim++; 262 263 ret = 264 hashtab_insert(state->out->p_commons.table, new_id, 265 (hashtab_datum_t *) new_common); 266 if (ret) { 267 ERR(state->handle, "hashtab overflow"); 268 free(new_common); 269 free(new_id); 270 return -1; 271 } 272 273 if (hashtab_map 274 (common->permissions.table, perm_copy_callback, 275 &new_common->permissions)) { 276 ERR(state->handle, "Out of memory!"); 277 return -1; 278 } 279 280 return 0; 281} 282 283static int constraint_node_clone(constraint_node_t ** dst, 284 constraint_node_t * src, 285 expand_state_t * state) 286{ 287 constraint_node_t *new_con = NULL, *last_new_con = NULL; 288 constraint_expr_t *new_expr = NULL; 289 *dst = NULL; 290 while (src != NULL) { 291 constraint_expr_t *expr, *expr_l = NULL; 292 new_con = 293 (constraint_node_t *) malloc(sizeof(constraint_node_t)); 294 if (!new_con) { 295 goto out_of_mem; 296 } 297 memset(new_con, 0, sizeof(constraint_node_t)); 298 new_con->permissions = src->permissions; 299 for (expr = src->expr; expr; expr = expr->next) { 300 if ((new_expr = calloc(1, sizeof(*new_expr))) == NULL) { 301 goto out_of_mem; 302 } 303 if (constraint_expr_init(new_expr) == -1) { 304 goto out_of_mem; 305 } 306 new_expr->expr_type = expr->expr_type; 307 new_expr->attr = expr->attr; 308 new_expr->op = expr->op; 309 if (new_expr->expr_type == CEXPR_NAMES) { 310 if (new_expr->attr & CEXPR_TYPE) { 311 /* 312 * Copy over constraint policy source types and/or 313 * attributes for sepol_compute_av_reason_buffer(3) 314 * so that utilities can analyse constraint errors. 315 */ 316 if (map_ebitmap(&expr->type_names->types, 317 &new_expr->type_names->types, 318 state->typemap)) { 319 ERR(NULL, "Failed to map type_names->types"); 320 goto out_of_mem; 321 } 322 /* Type sets require expansion and conversion. */ 323 if (expand_convert_type_set(state->out, 324 state-> 325 typemap, 326 expr-> 327 type_names, 328 &new_expr-> 329 names, 1)) { 330 goto out_of_mem; 331 } 332 } else if (new_expr->attr & CEXPR_ROLE) { 333 if (map_ebitmap(&expr->names, &new_expr->names, state->rolemap)) { 334 goto out_of_mem; 335 } 336 } else if (new_expr->attr & CEXPR_USER) { 337 if (map_ebitmap(&expr->names, &new_expr->names, state->usermap)) { 338 goto out_of_mem; 339 } 340 } else { 341 /* Other kinds of sets do not. */ 342 if (ebitmap_cpy(&new_expr->names, 343 &expr->names)) { 344 goto out_of_mem; 345 } 346 } 347 } 348 if (expr_l) { 349 expr_l->next = new_expr; 350 } else { 351 new_con->expr = new_expr; 352 } 353 expr_l = new_expr; 354 new_expr = NULL; 355 } 356 if (last_new_con == NULL) { 357 *dst = new_con; 358 } else { 359 last_new_con->next = new_con; 360 } 361 last_new_con = new_con; 362 src = src->next; 363 } 364 365 return 0; 366 out_of_mem: 367 ERR(state->handle, "Out of memory!"); 368 if (new_con) 369 free(new_con); 370 constraint_expr_destroy(new_expr); 371 return -1; 372} 373 374static int class_copy_default_new_object(expand_state_t *state, 375 class_datum_t *olddatum, 376 class_datum_t *newdatum) 377{ 378 if (olddatum->default_user) { 379 if (newdatum->default_user && olddatum->default_user != newdatum->default_user) { 380 ERR(state->handle, "Found conflicting default user definitions"); 381 return SEPOL_ENOTSUP; 382 } 383 newdatum->default_user = olddatum->default_user; 384 385 } 386 if (olddatum->default_role) { 387 if (newdatum->default_role && olddatum->default_role != newdatum->default_role) { 388 ERR(state->handle, "Found conflicting default role definitions"); 389 return SEPOL_ENOTSUP; 390 } 391 newdatum->default_role = olddatum->default_role; 392 } 393 if (olddatum->default_type) { 394 if (newdatum->default_type && olddatum->default_type != newdatum->default_type) { 395 ERR(state->handle, "Found conflicting default type definitions"); 396 return SEPOL_ENOTSUP; 397 } 398 newdatum->default_type = olddatum->default_type; 399 } 400 if (olddatum->default_range) { 401 if (newdatum->default_range && olddatum->default_range != newdatum->default_range) { 402 ERR(state->handle, "Found conflicting default range definitions"); 403 return SEPOL_ENOTSUP; 404 } 405 newdatum->default_range = olddatum->default_range; 406 } 407 return 0; 408} 409 410static int class_copy_callback(hashtab_key_t key, hashtab_datum_t datum, 411 void *data) 412{ 413 int ret; 414 char *id, *new_id; 415 class_datum_t *class, *new_class; 416 expand_state_t *state; 417 418 id = (char *)key; 419 class = (class_datum_t *) datum; 420 state = (expand_state_t *) data; 421 422 if (!is_id_enabled(id, state->base, SYM_CLASSES)) { 423 /* identifier's scope is not enabled */ 424 return 0; 425 } 426 427 if (state->verbose) 428 INFO(state->handle, "copying class %s", id); 429 430 new_class = (class_datum_t *) malloc(sizeof(class_datum_t)); 431 if (!new_class) { 432 ERR(state->handle, "Out of memory!"); 433 return -1; 434 } 435 memset(new_class, 0, sizeof(class_datum_t)); 436 if (symtab_init(&new_class->permissions, PERM_SYMTAB_SIZE)) { 437 ERR(state->handle, "Out of memory!"); 438 free(new_class); 439 return -1; 440 } 441 442 new_class->s.value = class->s.value; 443 state->out->p_classes.nprim++; 444 445 ret = class_copy_default_new_object(state, class, new_class); 446 if (ret) { 447 free(new_class); 448 return ret; 449 } 450 451 new_id = strdup(id); 452 if (!new_id) { 453 ERR(state->handle, "Out of memory!"); 454 free(new_class); 455 return -1; 456 } 457 458 ret = 459 hashtab_insert(state->out->p_classes.table, new_id, 460 (hashtab_datum_t *) new_class); 461 if (ret) { 462 ERR(state->handle, "hashtab overflow"); 463 free(new_class); 464 free(new_id); 465 return -1; 466 } 467 468 if (hashtab_map 469 (class->permissions.table, perm_copy_callback, 470 &new_class->permissions)) { 471 ERR(state->handle, "hashtab overflow"); 472 return -1; 473 } 474 475 if (class->comkey) { 476 new_class->comkey = strdup(class->comkey); 477 if (!new_class->comkey) { 478 ERR(state->handle, "Out of memory!"); 479 return -1; 480 } 481 482 new_class->comdatum = 483 hashtab_search(state->out->p_commons.table, 484 new_class->comkey); 485 if (!new_class->comdatum) { 486 ERR(state->handle, "could not find common datum %s", 487 new_class->comkey); 488 return -1; 489 } 490 new_class->permissions.nprim += 491 new_class->comdatum->permissions.nprim; 492 } 493 494 return 0; 495} 496 497static int constraint_copy_callback(hashtab_key_t key, hashtab_datum_t datum, 498 void *data) 499{ 500 char *id; 501 class_datum_t *class, *new_class; 502 expand_state_t *state; 503 504 id = (char *)key; 505 class = (class_datum_t *) datum; 506 state = (expand_state_t *) data; 507 508 new_class = hashtab_search(state->out->p_classes.table, id); 509 if (!new_class) { 510 ERR(state->handle, "class %s vanished", id); 511 return -1; 512 } 513 514 /* constraints */ 515 if (constraint_node_clone 516 (&new_class->constraints, class->constraints, state) == -1 517 || constraint_node_clone(&new_class->validatetrans, 518 class->validatetrans, state) == -1) { 519 return -1; 520 } 521 return 0; 522} 523 524/* 525 * The boundaries have to be copied after the types/roles/users are copied, 526 * because it refers hashtab to lookup destinated objects. 527 */ 528static int type_bounds_copy_callback(hashtab_key_t key, 529 hashtab_datum_t datum, void *data) 530{ 531 expand_state_t *state = (expand_state_t *) data; 532 type_datum_t *type = (type_datum_t *) datum; 533 type_datum_t *dest; 534 uint32_t bounds_val; 535 536 if (!type->bounds) 537 return 0; 538 539 if (!is_id_enabled((char *)key, state->base, SYM_TYPES)) 540 return 0; 541 542 bounds_val = state->typemap[type->bounds - 1]; 543 544 dest = hashtab_search(state->out->p_types.table, (char *)key); 545 if (!dest) { 546 ERR(state->handle, "Type lookup failed for %s", (char *)key); 547 return -1; 548 } 549 if (dest->bounds != 0 && dest->bounds != bounds_val) { 550 ERR(state->handle, "Inconsistent boundary for %s", (char *)key); 551 return -1; 552 } 553 dest->bounds = bounds_val; 554 555 return 0; 556} 557 558static int role_bounds_copy_callback(hashtab_key_t key, 559 hashtab_datum_t datum, void *data) 560{ 561 expand_state_t *state = (expand_state_t *) data; 562 role_datum_t *role = (role_datum_t *) datum; 563 role_datum_t *dest; 564 uint32_t bounds_val; 565 566 if (!role->bounds) 567 return 0; 568 569 if (!is_id_enabled((char *)key, state->base, SYM_ROLES)) 570 return 0; 571 572 bounds_val = state->rolemap[role->bounds - 1]; 573 574 dest = hashtab_search(state->out->p_roles.table, (char *)key); 575 if (!dest) { 576 ERR(state->handle, "Role lookup failed for %s", (char *)key); 577 return -1; 578 } 579 if (dest->bounds != 0 && dest->bounds != bounds_val) { 580 ERR(state->handle, "Inconsistent boundary for %s", (char *)key); 581 return -1; 582 } 583 dest->bounds = bounds_val; 584 585 return 0; 586} 587 588static int user_bounds_copy_callback(hashtab_key_t key, 589 hashtab_datum_t datum, void *data) 590{ 591 expand_state_t *state = (expand_state_t *) data; 592 user_datum_t *user = (user_datum_t *) datum; 593 user_datum_t *dest; 594 uint32_t bounds_val; 595 596 if (!user->bounds) 597 return 0; 598 599 if (!is_id_enabled((char *)key, state->base, SYM_USERS)) 600 return 0; 601 602 bounds_val = state->usermap[user->bounds - 1]; 603 604 dest = hashtab_search(state->out->p_users.table, (char *)key); 605 if (!dest) { 606 ERR(state->handle, "User lookup failed for %s", (char *)key); 607 return -1; 608 } 609 if (dest->bounds != 0 && dest->bounds != bounds_val) { 610 ERR(state->handle, "Inconsistent boundary for %s", (char *)key); 611 return -1; 612 } 613 dest->bounds = bounds_val; 614 615 return 0; 616} 617 618/* The aliases have to be copied after the types and attributes to be certain that 619 * the out symbol table will have the type that the alias refers. Otherwise, we 620 * won't be able to find the type value for the alias. We can't depend on the 621 * declaration ordering because of the hash table. 622 */ 623static int alias_copy_callback(hashtab_key_t key, hashtab_datum_t datum, 624 void *data) 625{ 626 int ret; 627 char *id, *new_id; 628 type_datum_t *alias, *new_alias; 629 expand_state_t *state; 630 uint32_t prival; 631 632 id = (char *)key; 633 alias = (type_datum_t *) datum; 634 state = (expand_state_t *) data; 635 636 /* ignore regular types */ 637 if (alias->flavor == TYPE_TYPE && alias->primary) 638 return 0; 639 640 /* ignore attributes */ 641 if (alias->flavor == TYPE_ATTRIB) 642 return 0; 643 644 if (alias->flavor == TYPE_ALIAS) 645 prival = alias->primary; 646 else 647 prival = alias->s.value; 648 649 if (!is_id_enabled(state->base->p_type_val_to_name[prival - 1], 650 state->base, SYM_TYPES)) { 651 /* The primary type for this alias is not enabled, the alias 652 * shouldn't be either */ 653 return 0; 654 } 655 656 if (state->verbose) 657 INFO(state->handle, "copying alias %s", id); 658 659 new_id = strdup(id); 660 if (!new_id) { 661 ERR(state->handle, "Out of memory!"); 662 return -1; 663 } 664 665 new_alias = (type_datum_t *) malloc(sizeof(type_datum_t)); 666 if (!new_alias) { 667 ERR(state->handle, "Out of memory!"); 668 free(new_id); 669 return SEPOL_ENOMEM; 670 } 671 memset(new_alias, 0, sizeof(type_datum_t)); 672 if (alias->flavor == TYPE_TYPE) 673 new_alias->s.value = state->typemap[alias->s.value - 1]; 674 else if (alias->flavor == TYPE_ALIAS) 675 new_alias->s.value = state->typemap[alias->primary - 1]; 676 else 677 assert(0); /* unreachable */ 678 679 new_alias->flags = alias->flags; 680 681 ret = hashtab_insert(state->out->p_types.table, 682 (hashtab_key_t) new_id, 683 (hashtab_datum_t) new_alias); 684 685 if (ret) { 686 ERR(state->handle, "hashtab overflow"); 687 free(new_alias); 688 free(new_id); 689 return -1; 690 } 691 692 state->typemap[alias->s.value - 1] = new_alias->s.value; 693 694 if (new_alias->flags & TYPE_FLAGS_PERMISSIVE) 695 if (ebitmap_set_bit(&state->out->permissive_map, new_alias->s.value, 1)) { 696 ERR(state->handle, "Out of memory!"); 697 return -1; 698 } 699 700 return 0; 701} 702 703static int role_remap_dominates(hashtab_key_t key __attribute__ ((unused)), hashtab_datum_t datum, void *data) 704{ 705 ebitmap_t mapped_roles; 706 role_datum_t *role = (role_datum_t *) datum; 707 expand_state_t *state = (expand_state_t *) data; 708 709 if (map_ebitmap(&role->dominates, &mapped_roles, state->rolemap)) 710 return -1; 711 712 ebitmap_destroy(&role->dominates); 713 714 if (ebitmap_cpy(&role->dominates, &mapped_roles)) 715 return -1; 716 717 ebitmap_destroy(&mapped_roles); 718 719 return 0; 720} 721 722/* For the role attribute in the base module, escalate its counterpart's 723 * types.types ebitmap in the out module to the counterparts of all the 724 * regular role that belongs to the current role attribute. Note, must be 725 * invoked after role_copy_callback so that state->rolemap is available. 726 */ 727static int role_fix_callback(hashtab_key_t key, hashtab_datum_t datum, 728 void *data) 729{ 730 char *id, *base_reg_role_id; 731 role_datum_t *role, *new_role, *regular_role; 732 expand_state_t *state; 733 ebitmap_node_t *rnode; 734 unsigned int i; 735 ebitmap_t mapped_roles; 736 737 id = key; 738 role = (role_datum_t *)datum; 739 state = (expand_state_t *)data; 740 741 if (strcmp(id, OBJECT_R) == 0) { 742 /* object_r is never a role attribute by far */ 743 return 0; 744 } 745 746 if (!is_id_enabled(id, state->base, SYM_ROLES)) { 747 /* identifier's scope is not enabled */ 748 return 0; 749 } 750 751 if (role->flavor != ROLE_ATTRIB) 752 return 0; 753 754 if (state->verbose) 755 INFO(state->handle, "fixing role attribute %s", id); 756 757 new_role = 758 (role_datum_t *)hashtab_search(state->out->p_roles.table, id); 759 760 assert(new_role != NULL && new_role->flavor == ROLE_ATTRIB); 761 762 ebitmap_init(&mapped_roles); 763 if (map_ebitmap(&role->roles, &mapped_roles, state->rolemap)) 764 return -1; 765 if (ebitmap_union(&new_role->roles, &mapped_roles)) { 766 ERR(state->handle, "Out of memory!"); 767 ebitmap_destroy(&mapped_roles); 768 return -1; 769 } 770 ebitmap_destroy(&mapped_roles); 771 772 ebitmap_for_each_bit(&role->roles, rnode, i) { 773 if (ebitmap_node_get_bit(rnode, i)) { 774 /* take advantage of sym_val_to_name[] 775 * of the base module */ 776 base_reg_role_id = state->base->p_role_val_to_name[i]; 777 regular_role = (role_datum_t *)hashtab_search( 778 state->out->p_roles.table, 779 base_reg_role_id); 780 assert(regular_role != NULL && 781 regular_role->flavor == ROLE_ROLE); 782 783 if (ebitmap_union(®ular_role->types.types, 784 &new_role->types.types)) { 785 ERR(state->handle, "Out of memory!"); 786 return -1; 787 } 788 } 789 } 790 791 return 0; 792} 793 794static int role_copy_callback(hashtab_key_t key, hashtab_datum_t datum, 795 void *data) 796{ 797 int ret; 798 char *id, *new_id; 799 role_datum_t *role; 800 role_datum_t *new_role; 801 expand_state_t *state; 802 ebitmap_t tmp_union_types; 803 804 id = key; 805 role = (role_datum_t *) datum; 806 state = (expand_state_t *) data; 807 808 if (strcmp(id, OBJECT_R) == 0) { 809 /* object_r is always value 1 */ 810 state->rolemap[role->s.value - 1] = 1; 811 return 0; 812 } 813 814 if (!is_id_enabled(id, state->base, SYM_ROLES)) { 815 /* identifier's scope is not enabled */ 816 return 0; 817 } 818 819 if (state->verbose) 820 INFO(state->handle, "copying role %s", id); 821 822 new_role = 823 (role_datum_t *) hashtab_search(state->out->p_roles.table, id); 824 if (!new_role) { 825 new_role = (role_datum_t *) malloc(sizeof(role_datum_t)); 826 if (!new_role) { 827 ERR(state->handle, "Out of memory!"); 828 return -1; 829 } 830 memset(new_role, 0, sizeof(role_datum_t)); 831 832 new_id = strdup(id); 833 if (!new_id) { 834 ERR(state->handle, "Out of memory!"); 835 free(new_role); 836 return -1; 837 } 838 839 state->out->p_roles.nprim++; 840 new_role->flavor = role->flavor; 841 new_role->s.value = state->out->p_roles.nprim; 842 state->rolemap[role->s.value - 1] = new_role->s.value; 843 ret = hashtab_insert(state->out->p_roles.table, 844 (hashtab_key_t) new_id, 845 (hashtab_datum_t) new_role); 846 847 if (ret) { 848 ERR(state->handle, "hashtab overflow"); 849 free(new_role); 850 free(new_id); 851 return -1; 852 } 853 } 854 855 /* The dominates bitmap is going to be wrong for the moment, 856 * we'll come back later and remap them, after we are sure all 857 * the roles have been added */ 858 if (ebitmap_union(&new_role->dominates, &role->dominates)) { 859 ERR(state->handle, "Out of memory!"); 860 return -1; 861 } 862 863 ebitmap_init(&tmp_union_types); 864 865 /* convert types in the role datum in the global symtab */ 866 if (expand_convert_type_set 867 (state->out, state->typemap, &role->types, &tmp_union_types, 1)) { 868 ebitmap_destroy(&tmp_union_types); 869 ERR(state->handle, "Out of memory!"); 870 return -1; 871 } 872 873 if (ebitmap_union(&new_role->types.types, &tmp_union_types)) { 874 ERR(state->handle, "Out of memory!"); 875 ebitmap_destroy(&tmp_union_types); 876 return -1; 877 } 878 ebitmap_destroy(&tmp_union_types); 879 880 return 0; 881} 882 883int mls_semantic_level_expand(mls_semantic_level_t * sl, mls_level_t * l, 884 policydb_t * p, sepol_handle_t * h) 885{ 886 mls_semantic_cat_t *cat; 887 level_datum_t *levdatum; 888 unsigned int i; 889 890 mls_level_init(l); 891 892 if (!p->mls) 893 return 0; 894 895 /* Required not declared. */ 896 if (!sl->sens) 897 return 0; 898 899 l->sens = sl->sens; 900 levdatum = (level_datum_t *) hashtab_search(p->p_levels.table, 901 p->p_sens_val_to_name[l->sens - 1]); 902 if (!levdatum) { 903 ERR(h, "%s: Impossible situation found, nothing in p_levels.table.\n", 904 __func__); 905 errno = ENOENT; 906 return -1; 907 } 908 for (cat = sl->cat; cat; cat = cat->next) { 909 if (cat->low > cat->high) { 910 ERR(h, "Category range is not valid %s.%s", 911 p->p_cat_val_to_name[cat->low - 1], 912 p->p_cat_val_to_name[cat->high - 1]); 913 return -1; 914 } 915 for (i = cat->low - 1; i < cat->high; i++) { 916 if (!ebitmap_get_bit(&levdatum->level->cat, i)) { 917 ERR(h, "Category %s can not be associated with " 918 "level %s", 919 p->p_cat_val_to_name[i], 920 p->p_sens_val_to_name[l->sens - 1]); 921 return -1; 922 } 923 if (ebitmap_set_bit(&l->cat, i, 1)) { 924 ERR(h, "Out of memory!"); 925 return -1; 926 } 927 } 928 } 929 930 return 0; 931} 932 933int mls_semantic_range_expand(mls_semantic_range_t * sr, mls_range_t * r, 934 policydb_t * p, sepol_handle_t * h) 935{ 936 if (mls_semantic_level_expand(&sr->level[0], &r->level[0], p, h) < 0) 937 return -1; 938 939 if (mls_semantic_level_expand(&sr->level[1], &r->level[1], p, h) < 0) { 940 mls_semantic_level_destroy(&sr->level[0]); 941 return -1; 942 } 943 944 if (!mls_level_dom(&r->level[1], &r->level[0])) { 945 mls_range_destroy(r); 946 ERR(h, "MLS range high level does not dominate low level"); 947 return -1; 948 } 949 950 return 0; 951} 952 953static int user_copy_callback(hashtab_key_t key, hashtab_datum_t datum, 954 void *data) 955{ 956 int ret; 957 expand_state_t *state; 958 user_datum_t *user; 959 user_datum_t *new_user; 960 char *id, *new_id; 961 ebitmap_t tmp_union; 962 963 id = key; 964 user = (user_datum_t *) datum; 965 state = (expand_state_t *) data; 966 967 if (!is_id_enabled(id, state->base, SYM_USERS)) { 968 /* identifier's scope is not enabled */ 969 return 0; 970 } 971 972 if (state->verbose) 973 INFO(state->handle, "copying user %s", id); 974 975 new_user = 976 (user_datum_t *) hashtab_search(state->out->p_users.table, id); 977 if (!new_user) { 978 new_user = (user_datum_t *) malloc(sizeof(user_datum_t)); 979 if (!new_user) { 980 ERR(state->handle, "Out of memory!"); 981 return -1; 982 } 983 memset(new_user, 0, sizeof(user_datum_t)); 984 985 state->out->p_users.nprim++; 986 new_user->s.value = state->out->p_users.nprim; 987 state->usermap[user->s.value - 1] = new_user->s.value; 988 989 new_id = strdup(id); 990 if (!new_id) { 991 ERR(state->handle, "Out of memory!"); 992 free(new_user); 993 return -1; 994 } 995 ret = hashtab_insert(state->out->p_users.table, 996 (hashtab_key_t) new_id, 997 (hashtab_datum_t) new_user); 998 if (ret) { 999 ERR(state->handle, "hashtab overflow"); 1000 user_datum_destroy(new_user); 1001 free(new_user); 1002 free(new_id); 1003 return -1; 1004 } 1005 1006 /* expand the semantic MLS info */ 1007 if (mls_semantic_range_expand(&user->range, 1008 &new_user->exp_range, 1009 state->out, state->handle)) { 1010 return -1; 1011 } 1012 if (mls_semantic_level_expand(&user->dfltlevel, 1013 &new_user->exp_dfltlevel, 1014 state->out, state->handle)) { 1015 return -1; 1016 } 1017 if (!mls_level_between(&new_user->exp_dfltlevel, 1018 &new_user->exp_range.level[0], 1019 &new_user->exp_range.level[1])) { 1020 ERR(state->handle, "default level not within user " 1021 "range"); 1022 return -1; 1023 } 1024 } else { 1025 /* require that the MLS info match */ 1026 mls_range_t tmp_range; 1027 mls_level_t tmp_level; 1028 1029 if (mls_semantic_range_expand(&user->range, &tmp_range, 1030 state->out, state->handle)) { 1031 return -1; 1032 } 1033 if (mls_semantic_level_expand(&user->dfltlevel, &tmp_level, 1034 state->out, state->handle)) { 1035 mls_range_destroy(&tmp_range); 1036 return -1; 1037 } 1038 if (!mls_range_eq(&new_user->exp_range, &tmp_range) || 1039 !mls_level_eq(&new_user->exp_dfltlevel, &tmp_level)) { 1040 mls_range_destroy(&tmp_range); 1041 mls_level_destroy(&tmp_level); 1042 return -1; 1043 } 1044 mls_range_destroy(&tmp_range); 1045 mls_level_destroy(&tmp_level); 1046 } 1047 1048 ebitmap_init(&tmp_union); 1049 1050 /* get global roles for this user */ 1051 if (role_set_expand(&user->roles, &tmp_union, state->out, state->base, state->rolemap)) { 1052 ERR(state->handle, "Out of memory!"); 1053 ebitmap_destroy(&tmp_union); 1054 return -1; 1055 } 1056 1057 if (ebitmap_union(&new_user->roles.roles, &tmp_union)) { 1058 ERR(state->handle, "Out of memory!"); 1059 ebitmap_destroy(&tmp_union); 1060 return -1; 1061 } 1062 ebitmap_destroy(&tmp_union); 1063 1064 return 0; 1065} 1066 1067static int bool_copy_callback(hashtab_key_t key, hashtab_datum_t datum, 1068 void *data) 1069{ 1070 int ret; 1071 expand_state_t *state; 1072 cond_bool_datum_t *bool, *new_bool; 1073 char *id, *new_id; 1074 1075 id = key; 1076 bool = (cond_bool_datum_t *) datum; 1077 state = (expand_state_t *) data; 1078 1079 if (!is_id_enabled(id, state->base, SYM_BOOLS)) { 1080 /* identifier's scope is not enabled */ 1081 return 0; 1082 } 1083 1084 if (bool->flags & COND_BOOL_FLAGS_TUNABLE) { 1085 /* Skip tunables */ 1086 return 0; 1087 } 1088 1089 if (state->verbose) 1090 INFO(state->handle, "copying boolean %s", id); 1091 1092 new_bool = (cond_bool_datum_t *) malloc(sizeof(cond_bool_datum_t)); 1093 if (!new_bool) { 1094 ERR(state->handle, "Out of memory!"); 1095 return -1; 1096 } 1097 1098 new_id = strdup(id); 1099 if (!new_id) { 1100 ERR(state->handle, "Out of memory!"); 1101 free(new_bool); 1102 return -1; 1103 } 1104 1105 state->out->p_bools.nprim++; 1106 new_bool->s.value = state->out->p_bools.nprim; 1107 1108 ret = hashtab_insert(state->out->p_bools.table, 1109 (hashtab_key_t) new_id, 1110 (hashtab_datum_t) new_bool); 1111 if (ret) { 1112 ERR(state->handle, "hashtab overflow"); 1113 free(new_bool); 1114 free(new_id); 1115 return -1; 1116 } 1117 1118 state->boolmap[bool->s.value - 1] = new_bool->s.value; 1119 1120 new_bool->state = bool->state; 1121 new_bool->flags = bool->flags; 1122 1123 return 0; 1124} 1125 1126static int sens_copy_callback(hashtab_key_t key, hashtab_datum_t datum, 1127 void *data) 1128{ 1129 expand_state_t *state = (expand_state_t *) data; 1130 level_datum_t *level = (level_datum_t *) datum, *new_level = NULL; 1131 char *id = (char *)key, *new_id = NULL; 1132 1133 if (!is_id_enabled(id, state->base, SYM_LEVELS)) { 1134 /* identifier's scope is not enabled */ 1135 return 0; 1136 } 1137 1138 if (state->verbose) 1139 INFO(state->handle, "copying sensitivity level %s", id); 1140 1141 new_level = (level_datum_t *) malloc(sizeof(level_datum_t)); 1142 if (!new_level) 1143 goto out_of_mem; 1144 level_datum_init(new_level); 1145 new_level->level = (mls_level_t *) malloc(sizeof(mls_level_t)); 1146 if (!new_level->level) 1147 goto out_of_mem; 1148 mls_level_init(new_level->level); 1149 new_id = strdup(id); 1150 if (!new_id) 1151 goto out_of_mem; 1152 1153 if (mls_level_cpy(new_level->level, level->level)) { 1154 goto out_of_mem; 1155 } 1156 new_level->isalias = level->isalias; 1157 state->out->p_levels.nprim++; 1158 1159 if (hashtab_insert(state->out->p_levels.table, 1160 (hashtab_key_t) new_id, 1161 (hashtab_datum_t) new_level)) { 1162 goto out_of_mem; 1163 } 1164 return 0; 1165 1166 out_of_mem: 1167 ERR(state->handle, "Out of memory!"); 1168 if (new_level != NULL && new_level->level != NULL) { 1169 mls_level_destroy(new_level->level); 1170 free(new_level->level); 1171 } 1172 level_datum_destroy(new_level); 1173 free(new_level); 1174 free(new_id); 1175 return -1; 1176} 1177 1178static int cats_copy_callback(hashtab_key_t key, hashtab_datum_t datum, 1179 void *data) 1180{ 1181 expand_state_t *state = (expand_state_t *) data; 1182 cat_datum_t *cat = (cat_datum_t *) datum, *new_cat = NULL; 1183 char *id = (char *)key, *new_id = NULL; 1184 1185 if (!is_id_enabled(id, state->base, SYM_CATS)) { 1186 /* identifier's scope is not enabled */ 1187 return 0; 1188 } 1189 1190 if (state->verbose) 1191 INFO(state->handle, "copying category attribute %s", id); 1192 1193 new_cat = (cat_datum_t *) malloc(sizeof(cat_datum_t)); 1194 if (!new_cat) 1195 goto out_of_mem; 1196 cat_datum_init(new_cat); 1197 new_id = strdup(id); 1198 if (!new_id) 1199 goto out_of_mem; 1200 1201 new_cat->s.value = cat->s.value; 1202 new_cat->isalias = cat->isalias; 1203 state->out->p_cats.nprim++; 1204 if (hashtab_insert(state->out->p_cats.table, 1205 (hashtab_key_t) new_id, (hashtab_datum_t) new_cat)) { 1206 goto out_of_mem; 1207 } 1208 1209 return 0; 1210 1211 out_of_mem: 1212 ERR(state->handle, "Out of memory!"); 1213 cat_datum_destroy(new_cat); 1214 free(new_cat); 1215 free(new_id); 1216 return -1; 1217} 1218 1219static int copy_role_allows(expand_state_t * state, role_allow_rule_t * rules) 1220{ 1221 unsigned int i, j; 1222 role_allow_t *cur_allow, *n, *l; 1223 role_allow_rule_t *cur; 1224 ebitmap_t roles, new_roles; 1225 ebitmap_node_t *snode, *tnode; 1226 1227 /* start at the end of the list */ 1228 for (l = state->out->role_allow; l && l->next; l = l->next) ; 1229 1230 cur = rules; 1231 while (cur) { 1232 ebitmap_init(&roles); 1233 ebitmap_init(&new_roles); 1234 1235 if (role_set_expand(&cur->roles, &roles, state->out, state->base, state->rolemap)) { 1236 ERR(state->handle, "Out of memory!"); 1237 return -1; 1238 } 1239 1240 if (role_set_expand(&cur->new_roles, &new_roles, state->out, state->base, state->rolemap)) { 1241 ERR(state->handle, "Out of memory!"); 1242 return -1; 1243 } 1244 1245 ebitmap_for_each_bit(&roles, snode, i) { 1246 if (!ebitmap_node_get_bit(snode, i)) 1247 continue; 1248 ebitmap_for_each_bit(&new_roles, tnode, j) { 1249 if (!ebitmap_node_get_bit(tnode, j)) 1250 continue; 1251 /* check for duplicates */ 1252 cur_allow = state->out->role_allow; 1253 while (cur_allow) { 1254 if ((cur_allow->role == i + 1) && 1255 (cur_allow->new_role == j + 1)) 1256 break; 1257 cur_allow = cur_allow->next; 1258 } 1259 if (cur_allow) 1260 continue; 1261 n = (role_allow_t *) 1262 malloc(sizeof(role_allow_t)); 1263 if (!n) { 1264 ERR(state->handle, "Out of memory!"); 1265 return -1; 1266 } 1267 memset(n, 0, sizeof(role_allow_t)); 1268 n->role = i + 1; 1269 n->new_role = j + 1; 1270 if (l) { 1271 l->next = n; 1272 } else { 1273 state->out->role_allow = n; 1274 } 1275 l = n; 1276 } 1277 } 1278 1279 ebitmap_destroy(&roles); 1280 ebitmap_destroy(&new_roles); 1281 1282 cur = cur->next; 1283 } 1284 1285 return 0; 1286} 1287 1288static int copy_role_trans(expand_state_t * state, role_trans_rule_t * rules) 1289{ 1290 unsigned int i, j, k; 1291 role_trans_t *n, *l, *cur_trans; 1292 role_trans_rule_t *cur; 1293 ebitmap_t roles, types; 1294 ebitmap_node_t *rnode, *tnode, *cnode; 1295 1296 /* start at the end of the list */ 1297 for (l = state->out->role_tr; l && l->next; l = l->next) ; 1298 1299 cur = rules; 1300 while (cur) { 1301 ebitmap_init(&roles); 1302 ebitmap_init(&types); 1303 1304 if (role_set_expand(&cur->roles, &roles, state->out, state->base, state->rolemap)) { 1305 ERR(state->handle, "Out of memory!"); 1306 return -1; 1307 } 1308 if (expand_convert_type_set 1309 (state->out, state->typemap, &cur->types, &types, 1)) { 1310 ERR(state->handle, "Out of memory!"); 1311 return -1; 1312 } 1313 ebitmap_for_each_bit(&roles, rnode, i) { 1314 if (!ebitmap_node_get_bit(rnode, i)) 1315 continue; 1316 ebitmap_for_each_bit(&types, tnode, j) { 1317 if (!ebitmap_node_get_bit(tnode, j)) 1318 continue; 1319 ebitmap_for_each_bit(&cur->classes, cnode, k) { 1320 if (!ebitmap_node_get_bit(cnode, k)) 1321 continue; 1322 1323 cur_trans = state->out->role_tr; 1324 while (cur_trans) { 1325 unsigned int mapped_role; 1326 1327 mapped_role = state->rolemap[cur->new_role - 1]; 1328 1329 if ((cur_trans->role == 1330 i + 1) && 1331 (cur_trans->type == 1332 j + 1) && 1333 (cur_trans->tclass == 1334 k + 1)) { 1335 if (cur_trans->new_role == mapped_role) { 1336 break; 1337 } else { 1338 ERR(state->handle, 1339 "Conflicting role trans rule %s %s : %s { %s vs %s }", 1340 state->out->p_role_val_to_name[i], 1341 state->out->p_type_val_to_name[j], 1342 state->out->p_class_val_to_name[k], 1343 state->out->p_role_val_to_name[mapped_role - 1], 1344 state->out->p_role_val_to_name[cur_trans->new_role - 1]); 1345 return -1; 1346 } 1347 } 1348 cur_trans = cur_trans->next; 1349 } 1350 if (cur_trans) 1351 continue; 1352 1353 n = (role_trans_t *) 1354 malloc(sizeof(role_trans_t)); 1355 if (!n) { 1356 ERR(state->handle, 1357 "Out of memory!"); 1358 return -1; 1359 } 1360 memset(n, 0, sizeof(role_trans_t)); 1361 n->role = i + 1; 1362 n->type = j + 1; 1363 n->tclass = k + 1; 1364 n->new_role = state->rolemap 1365 [cur->new_role - 1]; 1366 if (l) 1367 l->next = n; 1368 else 1369 state->out->role_tr = n; 1370 1371 l = n; 1372 } 1373 } 1374 } 1375 1376 ebitmap_destroy(&roles); 1377 ebitmap_destroy(&types); 1378 1379 cur = cur->next; 1380 } 1381 return 0; 1382} 1383 1384static int expand_filename_trans(expand_state_t *state, filename_trans_rule_t *rules) 1385{ 1386 unsigned int i, j; 1387 filename_trans_t *new_trans, *cur_trans; 1388 filename_trans_rule_t *cur_rule; 1389 ebitmap_t stypes, ttypes; 1390 ebitmap_node_t *snode, *tnode; 1391 1392 cur_rule = rules; 1393 while (cur_rule) { 1394 uint32_t mapped_otype; 1395 1396 ebitmap_init(&stypes); 1397 ebitmap_init(&ttypes); 1398 1399 if (expand_convert_type_set(state->out, state->typemap, 1400 &cur_rule->stypes, &stypes, 1)) { 1401 ERR(state->handle, "Out of memory!"); 1402 return -1; 1403 } 1404 1405 if (expand_convert_type_set(state->out, state->typemap, 1406 &cur_rule->ttypes, &ttypes, 1)) { 1407 ERR(state->handle, "Out of memory!"); 1408 return -1; 1409 } 1410 1411 mapped_otype = state->typemap[cur_rule->otype - 1]; 1412 1413 ebitmap_for_each_bit(&stypes, snode, i) { 1414 if (!ebitmap_node_get_bit(snode, i)) 1415 continue; 1416 ebitmap_for_each_bit(&ttypes, tnode, j) { 1417 if (!ebitmap_node_get_bit(tnode, j)) 1418 continue; 1419 1420 cur_trans = state->out->filename_trans; 1421 while (cur_trans) { 1422 if ((cur_trans->stype == i + 1) && 1423 (cur_trans->ttype == j + 1) && 1424 (cur_trans->tclass == cur_rule->tclass) && 1425 (!strcmp(cur_trans->name, cur_rule->name))) { 1426 /* duplicate rule, who cares */ 1427 if (cur_trans->otype == mapped_otype) 1428 break; 1429 1430 ERR(state->handle, "Conflicting name-based type_transition %s %s:%s \"%s\": %s vs %s", 1431 state->out->p_type_val_to_name[i], 1432 state->out->p_type_val_to_name[j], 1433 state->out->p_class_val_to_name[cur_trans->tclass - 1], 1434 cur_trans->name, 1435 state->out->p_type_val_to_name[cur_trans->otype - 1], 1436 state->out->p_type_val_to_name[mapped_otype - 1]); 1437 1438 return -1; 1439 } 1440 cur_trans = cur_trans->next; 1441 } 1442 /* duplicate rule, who cares */ 1443 if (cur_trans) 1444 continue; 1445 1446 new_trans = malloc(sizeof(*new_trans)); 1447 if (!new_trans) { 1448 ERR(state->handle, "Out of memory!"); 1449 return -1; 1450 } 1451 memset(new_trans, 0, sizeof(*new_trans)); 1452 new_trans->next = state->out->filename_trans; 1453 state->out->filename_trans = new_trans; 1454 1455 new_trans->name = strdup(cur_rule->name); 1456 if (!new_trans->name) { 1457 ERR(state->handle, "Out of memory!"); 1458 return -1; 1459 } 1460 new_trans->stype = i + 1; 1461 new_trans->ttype = j + 1; 1462 new_trans->tclass = cur_rule->tclass; 1463 new_trans->otype = mapped_otype; 1464 } 1465 } 1466 1467 ebitmap_destroy(&stypes); 1468 ebitmap_destroy(&ttypes); 1469 1470 cur_rule = cur_rule->next; 1471 } 1472 return 0; 1473} 1474 1475static int exp_rangetr_helper(uint32_t stype, uint32_t ttype, uint32_t tclass, 1476 mls_semantic_range_t * trange, 1477 expand_state_t * state) 1478{ 1479 range_trans_t *rt, *check_rt = state->out->range_tr; 1480 mls_range_t exp_range; 1481 int rc = -1; 1482 1483 if (mls_semantic_range_expand(trange, &exp_range, state->out, 1484 state->handle)) 1485 goto out; 1486 1487 /* check for duplicates/conflicts */ 1488 while (check_rt) { 1489 if ((check_rt->source_type == stype) && 1490 (check_rt->target_type == ttype) && 1491 (check_rt->target_class == tclass)) { 1492 if (mls_range_eq(&check_rt->target_range, &exp_range)) { 1493 /* duplicate */ 1494 break; 1495 } else { 1496 /* conflict */ 1497 ERR(state->handle, 1498 "Conflicting range trans rule %s %s : %s", 1499 state->out->p_type_val_to_name[stype - 1], 1500 state->out->p_type_val_to_name[ttype - 1], 1501 state->out->p_class_val_to_name[tclass - 1502 1]); 1503 goto out; 1504 } 1505 } 1506 check_rt = check_rt->next; 1507 } 1508 if (check_rt) { 1509 /* this is a dup - skip */ 1510 rc = 0; 1511 goto out; 1512 } 1513 1514 rt = (range_trans_t *) calloc(1, sizeof(range_trans_t)); 1515 if (!rt) { 1516 ERR(state->handle, "Out of memory!"); 1517 goto out; 1518 } 1519 1520 rt->next = state->out->range_tr; 1521 state->out->range_tr = rt; 1522 1523 rt->source_type = stype; 1524 rt->target_type = ttype; 1525 rt->target_class = tclass; 1526 if (mls_range_cpy(&rt->target_range, &exp_range)) { 1527 ERR(state->handle, "Out of memory!"); 1528 goto out; 1529 } 1530 1531 rc = 0; 1532 1533 out: 1534 mls_range_destroy(&exp_range); 1535 return rc; 1536} 1537 1538static int expand_range_trans(expand_state_t * state, 1539 range_trans_rule_t * rules) 1540{ 1541 unsigned int i, j, k; 1542 range_trans_rule_t *rule; 1543 1544 ebitmap_t stypes, ttypes; 1545 ebitmap_node_t *snode, *tnode, *cnode; 1546 1547 if (state->verbose) 1548 INFO(state->handle, "expanding range transitions"); 1549 1550 for (rule = rules; rule; rule = rule->next) { 1551 ebitmap_init(&stypes); 1552 ebitmap_init(&ttypes); 1553 1554 /* expand the type sets */ 1555 if (expand_convert_type_set(state->out, state->typemap, 1556 &rule->stypes, &stypes, 1)) { 1557 ERR(state->handle, "Out of memory!"); 1558 return -1; 1559 } 1560 if (expand_convert_type_set(state->out, state->typemap, 1561 &rule->ttypes, &ttypes, 1)) { 1562 ebitmap_destroy(&stypes); 1563 ERR(state->handle, "Out of memory!"); 1564 return -1; 1565 } 1566 1567 /* loop on source type */ 1568 ebitmap_for_each_bit(&stypes, snode, i) { 1569 if (!ebitmap_node_get_bit(snode, i)) 1570 continue; 1571 /* loop on target type */ 1572 ebitmap_for_each_bit(&ttypes, tnode, j) { 1573 if (!ebitmap_node_get_bit(tnode, j)) 1574 continue; 1575 /* loop on target class */ 1576 ebitmap_for_each_bit(&rule->tclasses, cnode, k) { 1577 if (!ebitmap_node_get_bit(cnode, k)) 1578 continue; 1579 1580 if (exp_rangetr_helper(i + 1, 1581 j + 1, 1582 k + 1, 1583 &rule->trange, 1584 state)) { 1585 ebitmap_destroy(&stypes); 1586 ebitmap_destroy(&ttypes); 1587 return -1; 1588 } 1589 } 1590 } 1591 } 1592 1593 ebitmap_destroy(&stypes); 1594 ebitmap_destroy(&ttypes); 1595 } 1596 1597 return 0; 1598} 1599 1600/* Search for an AV tab node within a hash table with the given key. 1601 * If the node does not exist, create it and return it; otherwise 1602 * return the pre-existing one. 1603*/ 1604static avtab_ptr_t find_avtab_node(sepol_handle_t * handle, 1605 avtab_t * avtab, avtab_key_t * key, 1606 cond_av_list_t ** cond, 1607 av_operations_t *operations) 1608{ 1609 avtab_ptr_t node; 1610 avtab_datum_t avdatum; 1611 cond_av_list_t *nl; 1612 int type_match = 0; 1613 1614 /* AVTAB_OPNUM entries are not necessarily unique */ 1615 if (key->specified & AVTAB_OPNUM) { 1616 node = avtab_search_node(avtab, key); 1617 while (node) { 1618 if (node->datum.ops->type == operations->type) { 1619 type_match = 1; 1620 break; 1621 } 1622 node = avtab_search_node_next(node, key->specified); 1623 } 1624 if (!type_match) 1625 node = NULL; 1626 } else { 1627 node = avtab_search_node(avtab, key); 1628 } 1629 1630 /* If this is for conditional policies, keep searching in case 1631 the node is part of my conditional avtab. */ 1632 if (cond) { 1633 while (node) { 1634 if (node->parse_context == cond) 1635 break; 1636 node = avtab_search_node_next(node, key->specified); 1637 } 1638 } 1639 1640 if (!node) { 1641 memset(&avdatum, 0, sizeof avdatum); 1642 /* this is used to get the node - insertion is actually unique */ 1643 node = avtab_insert_nonunique(avtab, key, &avdatum); 1644 if (!node) { 1645 ERR(handle, "hash table overflow"); 1646 return NULL; 1647 } 1648 if (cond) { 1649 node->parse_context = cond; 1650 nl = (cond_av_list_t *) malloc(sizeof(cond_av_list_t)); 1651 if (!nl) { 1652 ERR(handle, "Memory error"); 1653 return NULL; 1654 } 1655 memset(nl, 0, sizeof(cond_av_list_t)); 1656 nl->node = node; 1657 nl->next = *cond; 1658 *cond = nl; 1659 } 1660 } 1661 1662 return node; 1663} 1664 1665#define EXPAND_RULE_SUCCESS 1 1666#define EXPAND_RULE_CONFLICT 0 1667#define EXPAND_RULE_ERROR -1 1668 1669static int expand_terule_helper(sepol_handle_t * handle, 1670 policydb_t * p, uint32_t * typemap, 1671 uint32_t specified, cond_av_list_t ** cond, 1672 cond_av_list_t ** other, uint32_t stype, 1673 uint32_t ttype, class_perm_node_t * perms, 1674 avtab_t * avtab, int enabled) 1675{ 1676 avtab_key_t avkey; 1677 avtab_datum_t *avdatump; 1678 avtab_ptr_t node; 1679 class_perm_node_t *cur; 1680 int conflict; 1681 uint32_t oldtype = 0, spec = 0; 1682 1683 if (specified & AVRULE_TRANSITION) { 1684 spec = AVTAB_TRANSITION; 1685 } else if (specified & AVRULE_MEMBER) { 1686 spec = AVTAB_MEMBER; 1687 } else if (specified & AVRULE_CHANGE) { 1688 spec = AVTAB_CHANGE; 1689 } else { 1690 assert(0); /* unreachable */ 1691 } 1692 1693 cur = perms; 1694 while (cur) { 1695 uint32_t remapped_data = 1696 typemap ? typemap[cur->data - 1] : cur->data; 1697 avkey.source_type = stype + 1; 1698 avkey.target_type = ttype + 1; 1699 avkey.target_class = cur->tclass; 1700 avkey.specified = spec; 1701 1702 conflict = 0; 1703 /* check to see if the expanded TE already exists -- 1704 * either in the global scope or in another 1705 * conditional AV tab */ 1706 node = avtab_search_node(&p->te_avtab, &avkey); 1707 if (node) { 1708 conflict = 1; 1709 } else { 1710 node = avtab_search_node(&p->te_cond_avtab, &avkey); 1711 if (node && node->parse_context != other) { 1712 conflict = 2; 1713 } 1714 } 1715 1716 if (conflict) { 1717 avdatump = &node->datum; 1718 if (specified & AVRULE_TRANSITION) { 1719 oldtype = avdatump->data; 1720 } else if (specified & AVRULE_MEMBER) { 1721 oldtype = avdatump->data; 1722 } else if (specified & AVRULE_CHANGE) { 1723 oldtype = avdatump->data; 1724 } 1725 1726 if (oldtype == remapped_data) { 1727 /* if the duplicate is inside the same scope (eg., unconditional 1728 * or in same conditional then ignore it */ 1729 if ((conflict == 1 && cond == NULL) 1730 || node->parse_context == cond) 1731 return EXPAND_RULE_SUCCESS; 1732 ERR(handle, "duplicate TE rule for %s %s:%s %s", 1733 p->p_type_val_to_name[avkey.source_type - 1734 1], 1735 p->p_type_val_to_name[avkey.target_type - 1736 1], 1737 p->p_class_val_to_name[avkey.target_class - 1738 1], 1739 p->p_type_val_to_name[oldtype - 1]); 1740 return EXPAND_RULE_CONFLICT; 1741 } 1742 ERR(handle, 1743 "conflicting TE rule for (%s, %s:%s): old was %s, new is %s", 1744 p->p_type_val_to_name[avkey.source_type - 1], 1745 p->p_type_val_to_name[avkey.target_type - 1], 1746 p->p_class_val_to_name[avkey.target_class - 1], 1747 p->p_type_val_to_name[oldtype - 1], 1748 p->p_type_val_to_name[remapped_data - 1]); 1749 return EXPAND_RULE_CONFLICT; 1750 } 1751 1752 node = find_avtab_node(handle, avtab, &avkey, cond, NULL); 1753 if (!node) 1754 return -1; 1755 if (enabled) { 1756 node->key.specified |= AVTAB_ENABLED; 1757 } else { 1758 node->key.specified &= ~AVTAB_ENABLED; 1759 } 1760 1761 avdatump = &node->datum; 1762 if (specified & AVRULE_TRANSITION) { 1763 avdatump->data = remapped_data; 1764 } else if (specified & AVRULE_MEMBER) { 1765 avdatump->data = remapped_data; 1766 } else if (specified & AVRULE_CHANGE) { 1767 avdatump->data = remapped_data; 1768 } else { 1769 assert(0); /* should never occur */ 1770 } 1771 1772 cur = cur->next; 1773 } 1774 1775 return EXPAND_RULE_SUCCESS; 1776} 1777 1778static int expand_avrule_helper(sepol_handle_t * handle, 1779 uint32_t specified, 1780 cond_av_list_t ** cond, 1781 uint32_t stype, uint32_t ttype, 1782 class_perm_node_t * perms, avtab_t * avtab, 1783 int enabled, av_operations_t *operations) 1784{ 1785 avtab_key_t avkey; 1786 avtab_datum_t *avdatump; 1787 avtab_operations_t *ops; 1788 avtab_ptr_t node; 1789 class_perm_node_t *cur; 1790 uint32_t spec = 0; 1791 unsigned int i; 1792 1793 if (specified & AVRULE_ALLOWED) { 1794 spec = AVTAB_ALLOWED; 1795 } else if (specified & AVRULE_AUDITALLOW) { 1796 spec = AVTAB_AUDITALLOW; 1797 } else if (specified & AVRULE_AUDITDENY) { 1798 spec = AVTAB_AUDITDENY; 1799 } else if (specified & AVRULE_DONTAUDIT) { 1800 if (handle && handle->disable_dontaudit) 1801 return EXPAND_RULE_SUCCESS; 1802 spec = AVTAB_AUDITDENY; 1803 } else if (specified & AVRULE_NEVERALLOW) { 1804 spec = AVTAB_NEVERALLOW; 1805 } else if (specified & AVRULE_OPNUM_ALLOWED) { 1806 spec = AVTAB_OPNUM_ALLOWED; 1807 } else if (specified & AVRULE_OPNUM_AUDITALLOW) { 1808 spec = AVTAB_OPNUM_AUDITALLOW; 1809 } else if (specified & AVRULE_OPNUM_DONTAUDIT) { 1810 if (handle && handle->disable_dontaudit) 1811 return EXPAND_RULE_SUCCESS; 1812 spec = AVTAB_OPNUM_DONTAUDIT; 1813 } else if (specified & AVRULE_OPTYPE_ALLOWED) { 1814 spec = AVTAB_OPTYPE_ALLOWED; 1815 } else if (specified & AVRULE_OPTYPE_AUDITALLOW) { 1816 spec = AVTAB_OPTYPE_AUDITALLOW; 1817 } else if (specified & AVRULE_OPTYPE_DONTAUDIT) { 1818 if (handle && handle->disable_dontaudit) 1819 return EXPAND_RULE_SUCCESS; 1820 spec = AVTAB_OPTYPE_DONTAUDIT; 1821 } else { 1822 assert(0); /* unreachable */ 1823 } 1824 1825 cur = perms; 1826 while (cur) { 1827 avkey.source_type = stype + 1; 1828 avkey.target_type = ttype + 1; 1829 avkey.target_class = cur->tclass; 1830 avkey.specified = spec; 1831 1832 node = find_avtab_node(handle, avtab, &avkey, cond, operations); 1833 if (!node) 1834 return EXPAND_RULE_ERROR; 1835 if (enabled) { 1836 node->key.specified |= AVTAB_ENABLED; 1837 } else { 1838 node->key.specified &= ~AVTAB_ENABLED; 1839 } 1840 1841 avdatump = &node->datum; 1842 if (specified & AVRULE_ALLOWED) { 1843 avdatump->data |= cur->data; 1844 } else if (specified & AVRULE_AUDITALLOW) { 1845 avdatump->data |= cur->data; 1846 } else if (specified & AVRULE_NEVERALLOW) { 1847 avdatump->data |= cur->data; 1848 } else if (specified & AVRULE_AUDITDENY) { 1849 /* Since a '0' in an auditdeny mask represents 1850 * a permission we do NOT want to audit 1851 * (dontaudit), we use the '&' operand to 1852 * ensure that all '0's in the mask are 1853 * retained (much unlike the allow and 1854 * auditallow cases). 1855 */ 1856 avdatump->data &= cur->data; 1857 } else if (specified & AVRULE_DONTAUDIT) { 1858 if (avdatump->data) 1859 avdatump->data &= ~cur->data; 1860 else 1861 avdatump->data = ~cur->data; 1862 } else if (specified & AVRULE_OP) { 1863 if (!avdatump->ops) { 1864 ops = (avtab_operations_t *) 1865 calloc(1, sizeof(avtab_operations_t)); 1866 if (!ops) { 1867 ERR(handle, "Out of memory!"); 1868 return -1; 1869 } 1870 node->datum.ops = ops; 1871 } 1872 node->datum.ops->type = operations->type; 1873 for (i = 0; i < ARRAY_SIZE(operations->perms); i++) { 1874 node->datum.ops->perms[i] |= operations->perms[i]; 1875 } 1876 } else { 1877 assert(0); /* should never occur */ 1878 } 1879 1880 cur = cur->next; 1881 } 1882 return EXPAND_RULE_SUCCESS; 1883} 1884 1885static int expand_rule_helper(sepol_handle_t * handle, 1886 policydb_t * p, uint32_t * typemap, 1887 avrule_t * source_rule, avtab_t * dest_avtab, 1888 cond_av_list_t ** cond, cond_av_list_t ** other, 1889 int enabled, 1890 ebitmap_t * stypes, ebitmap_t * ttypes) 1891{ 1892 unsigned int i, j; 1893 int retval; 1894 ebitmap_node_t *snode, *tnode; 1895 1896 ebitmap_for_each_bit(stypes, snode, i) { 1897 if (!ebitmap_node_get_bit(snode, i)) 1898 continue; 1899 if (source_rule->flags & RULE_SELF) { 1900 if (source_rule->specified & (AVRULE_AV | AVRULE_OP)) { 1901 retval = expand_avrule_helper(handle, source_rule->specified, 1902 cond, i, i, source_rule->perms, 1903 dest_avtab, enabled, source_rule->ops); 1904 if (retval != EXPAND_RULE_SUCCESS) 1905 return retval; 1906 } else { 1907 retval = expand_terule_helper(handle, p, typemap, 1908 source_rule->specified, cond, 1909 other, i, i, source_rule->perms, 1910 dest_avtab, enabled); 1911 if (retval != EXPAND_RULE_SUCCESS) 1912 return retval; 1913 } 1914 } 1915 ebitmap_for_each_bit(ttypes, tnode, j) { 1916 if (!ebitmap_node_get_bit(tnode, j)) 1917 continue; 1918 if (source_rule->specified & (AVRULE_AV | AVRULE_OP)) { 1919 retval = expand_avrule_helper(handle, source_rule->specified, 1920 cond, i, j, source_rule->perms, 1921 dest_avtab, enabled, source_rule->ops); 1922 if (retval != EXPAND_RULE_SUCCESS) 1923 return retval; 1924 } else { 1925 retval = expand_terule_helper(handle, p, typemap, 1926 source_rule->specified, cond, 1927 other, i, j, source_rule->perms, 1928 dest_avtab, enabled); 1929 if (retval != EXPAND_RULE_SUCCESS) 1930 return retval; 1931 } 1932 } 1933 } 1934 1935 return EXPAND_RULE_SUCCESS; 1936} 1937 1938/* 1939 * Expand a rule into a given avtab - checking for conflicting type 1940 * rules in the destination policy. Return EXPAND_RULE_SUCCESS on 1941 * success, EXPAND_RULE_CONFLICT if the rule conflicts with something 1942 * (and hence was not added), or EXPAND_RULE_ERROR on error. 1943 */ 1944static int convert_and_expand_rule(sepol_handle_t * handle, 1945 policydb_t * dest_pol, uint32_t * typemap, 1946 avrule_t * source_rule, avtab_t * dest_avtab, 1947 cond_av_list_t ** cond, 1948 cond_av_list_t ** other, int enabled, 1949 int do_neverallow) 1950{ 1951 int retval; 1952 ebitmap_t stypes, ttypes; 1953 unsigned char alwaysexpand; 1954 1955 if (!do_neverallow && source_rule->specified & AVRULE_NEVERALLOW) 1956 return EXPAND_RULE_SUCCESS; 1957 1958 ebitmap_init(&stypes); 1959 ebitmap_init(&ttypes); 1960 1961 /* Force expansion for type rules and for self rules. */ 1962 alwaysexpand = ((source_rule->specified & AVRULE_TYPE) || 1963 (source_rule->flags & RULE_SELF)); 1964 1965 if (expand_convert_type_set 1966 (dest_pol, typemap, &source_rule->stypes, &stypes, alwaysexpand)) 1967 return EXPAND_RULE_ERROR; 1968 if (expand_convert_type_set 1969 (dest_pol, typemap, &source_rule->ttypes, &ttypes, alwaysexpand)) 1970 return EXPAND_RULE_ERROR; 1971 1972 retval = expand_rule_helper(handle, dest_pol, typemap, 1973 source_rule, dest_avtab, 1974 cond, other, enabled, &stypes, &ttypes); 1975 ebitmap_destroy(&stypes); 1976 ebitmap_destroy(&ttypes); 1977 return retval; 1978} 1979 1980static int cond_avrule_list_copy(policydb_t * dest_pol, avrule_t * source_rules, 1981 avtab_t * dest_avtab, cond_av_list_t ** list, 1982 cond_av_list_t ** other, uint32_t * typemap, 1983 int enabled, expand_state_t * state) 1984{ 1985 avrule_t *cur; 1986 1987 cur = source_rules; 1988 while (cur) { 1989 if (convert_and_expand_rule(state->handle, dest_pol, 1990 typemap, cur, dest_avtab, 1991 list, other, enabled, 1992 0) != EXPAND_RULE_SUCCESS) { 1993 return -1; 1994 } 1995 1996 cur = cur->next; 1997 } 1998 1999 return 0; 2000} 2001 2002static int cond_node_map_bools(expand_state_t * state, cond_node_t * cn) 2003{ 2004 cond_expr_t *cur; 2005 unsigned int i; 2006 2007 cur = cn->expr; 2008 while (cur) { 2009 if (cur->bool) 2010 cur->bool = state->boolmap[cur->bool - 1]; 2011 cur = cur->next; 2012 } 2013 2014 for (i = 0; i < min(cn->nbools, COND_MAX_BOOLS); i++) 2015 cn->bool_ids[i] = state->boolmap[cn->bool_ids[i] - 1]; 2016 2017 if (cond_normalize_expr(state->out, cn)) { 2018 ERR(state->handle, "Error while normalizing conditional"); 2019 return -1; 2020 } 2021 2022 return 0; 2023} 2024 2025/* copy the nodes in *reverse* order -- the result is that the last 2026 * given conditional appears first in the policy, so as to match the 2027 * behavior of the upstream compiler */ 2028static int cond_node_copy(expand_state_t * state, cond_node_t * cn) 2029{ 2030 cond_node_t *new_cond, *tmp; 2031 2032 if (cn == NULL) { 2033 return 0; 2034 } 2035 if (cond_node_copy(state, cn->next)) { 2036 return -1; 2037 } 2038 2039 /* If current cond_node_t is of tunable, its effective branch 2040 * has been appended to its home decl->avrules list during link 2041 * and now we should just skip it. */ 2042 if (cn->flags & COND_NODE_FLAGS_TUNABLE) 2043 return 0; 2044 2045 if (cond_normalize_expr(state->base, cn)) { 2046 ERR(state->handle, "Error while normalizing conditional"); 2047 return -1; 2048 } 2049 2050 /* create a new temporary conditional node with the booleans 2051 * mapped */ 2052 tmp = cond_node_create(state->base, cn); 2053 if (!tmp) { 2054 ERR(state->handle, "Out of memory"); 2055 return -1; 2056 } 2057 2058 if (cond_node_map_bools(state, tmp)) { 2059 cond_node_destroy(tmp); 2060 free(tmp); 2061 ERR(state->handle, "Error mapping booleans"); 2062 return -1; 2063 } 2064 2065 new_cond = cond_node_search(state->out, state->out->cond_list, tmp); 2066 if (!new_cond) { 2067 cond_node_destroy(tmp); 2068 free(tmp); 2069 ERR(state->handle, "Out of memory!"); 2070 return -1; 2071 } 2072 cond_node_destroy(tmp); 2073 free(tmp); 2074 2075 if (cond_avrule_list_copy 2076 (state->out, cn->avtrue_list, &state->out->te_cond_avtab, 2077 &new_cond->true_list, &new_cond->false_list, state->typemap, 2078 new_cond->cur_state, state)) 2079 return -1; 2080 if (cond_avrule_list_copy 2081 (state->out, cn->avfalse_list, &state->out->te_cond_avtab, 2082 &new_cond->false_list, &new_cond->true_list, state->typemap, 2083 !new_cond->cur_state, state)) 2084 return -1; 2085 2086 return 0; 2087} 2088 2089static int context_copy(context_struct_t * dst, context_struct_t * src, 2090 expand_state_t * state) 2091{ 2092 dst->user = state->usermap[src->user - 1]; 2093 dst->role = state->rolemap[src->role - 1]; 2094 dst->type = state->typemap[src->type - 1]; 2095 return mls_context_cpy(dst, src); 2096} 2097 2098static int ocontext_copy_xen(expand_state_t *state) 2099{ 2100 unsigned int i; 2101 ocontext_t *c, *n, *l; 2102 2103 for (i = 0; i < OCON_NUM; i++) { 2104 l = NULL; 2105 for (c = state->base->ocontexts[i]; c; c = c->next) { 2106 n = malloc(sizeof(ocontext_t)); 2107 if (!n) { 2108 ERR(state->handle, "Out of memory!"); 2109 return -1; 2110 } 2111 memset(n, 0, sizeof(ocontext_t)); 2112 if (l) 2113 l->next = n; 2114 else 2115 state->out->ocontexts[i] = n; 2116 l = n; 2117 switch (i) { 2118 case OCON_XEN_ISID: 2119 if (c->context[0].user == 0) { 2120 ERR(state->handle, 2121 "Missing context for %s initial sid", 2122 c->u.name); 2123 return -1; 2124 } 2125 n->sid[0] = c->sid[0]; 2126 break; 2127 case OCON_XEN_PIRQ: 2128 n->u.pirq = c->u.pirq; 2129 break; 2130 case OCON_XEN_IOPORT: 2131 n->u.ioport.low_ioport = c->u.ioport.low_ioport; 2132 n->u.ioport.high_ioport = 2133 c->u.ioport.high_ioport; 2134 break; 2135 case OCON_XEN_IOMEM: 2136 n->u.iomem.low_iomem = c->u.iomem.low_iomem; 2137 n->u.iomem.high_iomem = c->u.iomem.high_iomem; 2138 break; 2139 case OCON_XEN_PCIDEVICE: 2140 n->u.device = c->u.device; 2141 break; 2142 case OCON_XEN_DEVICETREE: 2143 n->u.name = strdup(c->u.name); 2144 if (!n->u.name) { 2145 ERR(state->handle, "Out of memory!"); 2146 return -1; 2147 } 2148 break; 2149 default: 2150 /* shouldn't get here */ 2151 ERR(state->handle, "Unknown ocontext"); 2152 return -1; 2153 } 2154 if (context_copy(&n->context[0], &c->context[0], 2155 state)) { 2156 ERR(state->handle, "Out of memory!"); 2157 return -1; 2158 } 2159 } 2160 } 2161 return 0; 2162} 2163 2164static int ocontext_copy_selinux(expand_state_t *state) 2165{ 2166 unsigned int i, j; 2167 ocontext_t *c, *n, *l; 2168 2169 for (i = 0; i < OCON_NUM; i++) { 2170 l = NULL; 2171 for (c = state->base->ocontexts[i]; c; c = c->next) { 2172 n = malloc(sizeof(ocontext_t)); 2173 if (!n) { 2174 ERR(state->handle, "Out of memory!"); 2175 return -1; 2176 } 2177 memset(n, 0, sizeof(ocontext_t)); 2178 if (l) 2179 l->next = n; 2180 else 2181 state->out->ocontexts[i] = n; 2182 l = n; 2183 switch (i) { 2184 case OCON_ISID: 2185 if (c->context[0].user == 0) { 2186 ERR(state->handle, 2187 "Missing context for %s initial sid", 2188 c->u.name); 2189 return -1; 2190 } 2191 n->sid[0] = c->sid[0]; 2192 break; 2193 case OCON_FS: /* FALLTHROUGH */ 2194 case OCON_NETIF: 2195 n->u.name = strdup(c->u.name); 2196 if (!n->u.name) { 2197 ERR(state->handle, "Out of memory!"); 2198 return -1; 2199 } 2200 if (context_copy 2201 (&n->context[1], &c->context[1], state)) { 2202 ERR(state->handle, "Out of memory!"); 2203 return -1; 2204 } 2205 break; 2206 case OCON_PORT: 2207 n->u.port.protocol = c->u.port.protocol; 2208 n->u.port.low_port = c->u.port.low_port; 2209 n->u.port.high_port = c->u.port.high_port; 2210 break; 2211 case OCON_NODE: 2212 n->u.node.addr = c->u.node.addr; 2213 n->u.node.mask = c->u.node.mask; 2214 break; 2215 case OCON_FSUSE: 2216 n->v.behavior = c->v.behavior; 2217 n->u.name = strdup(c->u.name); 2218 if (!n->u.name) { 2219 ERR(state->handle, "Out of memory!"); 2220 return -1; 2221 } 2222 break; 2223 case OCON_NODE6: 2224 for (j = 0; j < 4; j++) 2225 n->u.node6.addr[j] = c->u.node6.addr[j]; 2226 for (j = 0; j < 4; j++) 2227 n->u.node6.mask[j] = c->u.node6.mask[j]; 2228 break; 2229 default: 2230 /* shouldn't get here */ 2231 ERR(state->handle, "Unknown ocontext"); 2232 return -1; 2233 } 2234 if (context_copy(&n->context[0], &c->context[0], state)) { 2235 ERR(state->handle, "Out of memory!"); 2236 return -1; 2237 } 2238 } 2239 } 2240 return 0; 2241} 2242 2243static int ocontext_copy(expand_state_t *state, uint32_t target) 2244{ 2245 int rc = -1; 2246 switch (target) { 2247 case SEPOL_TARGET_SELINUX: 2248 rc = ocontext_copy_selinux(state); 2249 break; 2250 case SEPOL_TARGET_XEN: 2251 rc = ocontext_copy_xen(state); 2252 break; 2253 default: 2254 ERR(state->handle, "Unknown target"); 2255 return -1; 2256 } 2257 return rc; 2258} 2259 2260static int genfs_copy(expand_state_t * state) 2261{ 2262 ocontext_t *c, *newc, *l; 2263 genfs_t *genfs, *newgenfs, *end; 2264 2265 end = NULL; 2266 for (genfs = state->base->genfs; genfs; genfs = genfs->next) { 2267 newgenfs = malloc(sizeof(genfs_t)); 2268 if (!newgenfs) { 2269 ERR(state->handle, "Out of memory!"); 2270 return -1; 2271 } 2272 memset(newgenfs, 0, sizeof(genfs_t)); 2273 newgenfs->fstype = strdup(genfs->fstype); 2274 if (!newgenfs->fstype) { 2275 free(newgenfs); 2276 ERR(state->handle, "Out of memory!"); 2277 return -1; 2278 } 2279 if (!end) 2280 state->out->genfs = newgenfs; 2281 else 2282 end->next = newgenfs; 2283 end = newgenfs; 2284 2285 l = NULL; 2286 for (c = genfs->head; c; c = c->next) { 2287 newc = malloc(sizeof(ocontext_t)); 2288 if (!newc) { 2289 ERR(state->handle, "Out of memory!"); 2290 return -1; 2291 } 2292 memset(newc, 0, sizeof(ocontext_t)); 2293 newc->u.name = strdup(c->u.name); 2294 if (!newc->u.name) { 2295 ERR(state->handle, "Out of memory!"); 2296 free(newc); 2297 return -1; 2298 } 2299 newc->v.sclass = c->v.sclass; 2300 context_copy(&newc->context[0], &c->context[0], state); 2301 if (l) 2302 l->next = newc; 2303 else 2304 newgenfs->head = newc; 2305 l = newc; 2306 } 2307 } 2308 return 0; 2309} 2310 2311static int type_attr_map(hashtab_key_t key 2312 __attribute__ ((unused)), hashtab_datum_t datum, 2313 void *ptr) 2314{ 2315 type_datum_t *type; 2316 expand_state_t *state = ptr; 2317 policydb_t *p = state->out; 2318 unsigned int i; 2319 ebitmap_node_t *tnode; 2320 2321 type = (type_datum_t *) datum; 2322 if (type->flavor == TYPE_ATTRIB) { 2323 if (ebitmap_cpy(&p->attr_type_map[type->s.value - 1], 2324 &type->types)) { 2325 ERR(state->handle, "Out of memory!"); 2326 return -1; 2327 } 2328 ebitmap_for_each_bit(&type->types, tnode, i) { 2329 if (!ebitmap_node_get_bit(tnode, i)) 2330 continue; 2331 if (ebitmap_set_bit(&p->type_attr_map[i], 2332 type->s.value - 1, 1)) { 2333 ERR(state->handle, "Out of memory!"); 2334 return -1; 2335 } 2336 } 2337 } 2338 return 0; 2339} 2340 2341/* converts typeset using typemap and expands into ebitmap_t types using the attributes in the passed in policy. 2342 * this should not be called until after all the blocks have been processed and the attributes in target policy 2343 * are complete. */ 2344int expand_convert_type_set(policydb_t * p, uint32_t * typemap, 2345 type_set_t * set, ebitmap_t * types, 2346 unsigned char alwaysexpand) 2347{ 2348 type_set_t tmpset; 2349 2350 type_set_init(&tmpset); 2351 2352 if (map_ebitmap(&set->types, &tmpset.types, typemap)) 2353 return -1; 2354 2355 if (map_ebitmap(&set->negset, &tmpset.negset, typemap)) 2356 return -1; 2357 2358 tmpset.flags = set->flags; 2359 2360 if (type_set_expand(&tmpset, types, p, alwaysexpand)) 2361 return -1; 2362 2363 type_set_destroy(&tmpset); 2364 2365 return 0; 2366} 2367 2368/* Expand a rule into a given avtab - checking for conflicting type 2369 * rules. Return 1 on success, 0 if the rule conflicts with something 2370 * (and hence was not added), or -1 on error. */ 2371int expand_rule(sepol_handle_t * handle, 2372 policydb_t * source_pol, 2373 avrule_t * source_rule, avtab_t * dest_avtab, 2374 cond_av_list_t ** cond, cond_av_list_t ** other, int enabled) 2375{ 2376 int retval; 2377 ebitmap_t stypes, ttypes; 2378 2379 if (source_rule->specified & AVRULE_NEVERALLOW) 2380 return 1; 2381 2382 ebitmap_init(&stypes); 2383 ebitmap_init(&ttypes); 2384 2385 if (type_set_expand(&source_rule->stypes, &stypes, source_pol, 1)) 2386 return -1; 2387 if (type_set_expand(&source_rule->ttypes, &ttypes, source_pol, 1)) 2388 return -1; 2389 retval = expand_rule_helper(handle, source_pol, NULL, 2390 source_rule, dest_avtab, 2391 cond, other, enabled, &stypes, &ttypes); 2392 ebitmap_destroy(&stypes); 2393 ebitmap_destroy(&ttypes); 2394 return retval; 2395} 2396 2397/* Expand a role set into an ebitmap containing the roles. 2398 * This handles the attribute and flags. 2399 * Attribute expansion depends on if the rolemap is available. 2400 * During module compile the rolemap is not available, the 2401 * possible duplicates of a regular role and the role attribute 2402 * the regular role belongs to could be properly handled by 2403 * copy_role_trans and copy_role_allow. 2404 */ 2405int role_set_expand(role_set_t * x, ebitmap_t * r, policydb_t * out, policydb_t * base, uint32_t * rolemap) 2406{ 2407 unsigned int i; 2408 ebitmap_node_t *rnode; 2409 ebitmap_t mapped_roles, roles; 2410 policydb_t *p = out; 2411 role_datum_t *role; 2412 2413 ebitmap_init(r); 2414 2415 if (x->flags & ROLE_STAR) { 2416 for (i = 0; i < p->p_roles.nprim++; i++) 2417 if (ebitmap_set_bit(r, i, 1)) 2418 return -1; 2419 return 0; 2420 } 2421 2422 ebitmap_init(&mapped_roles); 2423 ebitmap_init(&roles); 2424 2425 if (rolemap) { 2426 assert(base != NULL); 2427 ebitmap_for_each_bit(&x->roles, rnode, i) { 2428 if (ebitmap_node_get_bit(rnode, i)) { 2429 /* take advantage of p_role_val_to_struct[] 2430 * of the base module */ 2431 role = base->role_val_to_struct[i]; 2432 assert(role != NULL); 2433 if (role->flavor == ROLE_ATTRIB) { 2434 if (ebitmap_union(&roles, 2435 &role->roles)) 2436 goto bad; 2437 } else { 2438 if (ebitmap_set_bit(&roles, i, 1)) 2439 goto bad; 2440 } 2441 } 2442 } 2443 if (map_ebitmap(&roles, &mapped_roles, rolemap)) 2444 goto bad; 2445 } else { 2446 if (ebitmap_cpy(&mapped_roles, &x->roles)) 2447 goto bad; 2448 } 2449 2450 ebitmap_for_each_bit(&mapped_roles, rnode, i) { 2451 if (ebitmap_node_get_bit(rnode, i)) { 2452 if (ebitmap_set_bit(r, i, 1)) 2453 goto bad; 2454 } 2455 } 2456 2457 ebitmap_destroy(&mapped_roles); 2458 ebitmap_destroy(&roles); 2459 2460 /* if role is to be complimented, invert the entire bitmap here */ 2461 if (x->flags & ROLE_COMP) { 2462 for (i = 0; i < ebitmap_length(r); i++) { 2463 if (ebitmap_get_bit(r, i)) { 2464 if (ebitmap_set_bit(r, i, 0)) 2465 return -1; 2466 } else { 2467 if (ebitmap_set_bit(r, i, 1)) 2468 return -1; 2469 } 2470 } 2471 } 2472 return 0; 2473 2474bad: 2475 ebitmap_destroy(&mapped_roles); 2476 ebitmap_destroy(&roles); 2477 return -1; 2478} 2479 2480/* Expand a type set into an ebitmap containing the types. This 2481 * handles the negset, attributes, and flags. 2482 * Attribute expansion depends on several factors: 2483 * - if alwaysexpand is 1, then they will be expanded, 2484 * - if the type set has a negset or flags, then they will be expanded, 2485 * - otherwise, they will not be expanded. 2486 */ 2487int type_set_expand(type_set_t * set, ebitmap_t * t, policydb_t * p, 2488 unsigned char alwaysexpand) 2489{ 2490 unsigned int i; 2491 ebitmap_t types, neg_types; 2492 ebitmap_node_t *tnode; 2493 2494 ebitmap_init(&types); 2495 ebitmap_init(t); 2496 2497 if (alwaysexpand || ebitmap_length(&set->negset) || set->flags) { 2498 /* First go through the types and OR all the attributes to types */ 2499 ebitmap_for_each_bit(&set->types, tnode, i) { 2500 if (ebitmap_node_get_bit(tnode, i)) { 2501 if (p->type_val_to_struct[i]->flavor == 2502 TYPE_ATTRIB) { 2503 if (ebitmap_union 2504 (&types, 2505 &p->type_val_to_struct[i]-> 2506 types)) { 2507 return -1; 2508 } 2509 } else { 2510 if (ebitmap_set_bit(&types, i, 1)) { 2511 return -1; 2512 } 2513 } 2514 } 2515 } 2516 } else { 2517 /* No expansion of attributes, just copy the set as is. */ 2518 if (ebitmap_cpy(&types, &set->types)) 2519 return -1; 2520 } 2521 2522 /* Now do the same thing for negset */ 2523 ebitmap_init(&neg_types); 2524 ebitmap_for_each_bit(&set->negset, tnode, i) { 2525 if (ebitmap_node_get_bit(tnode, i)) { 2526 if (p->type_val_to_struct[i] && 2527 p->type_val_to_struct[i]->flavor == TYPE_ATTRIB) { 2528 if (ebitmap_union 2529 (&neg_types, 2530 &p->type_val_to_struct[i]->types)) { 2531 return -1; 2532 } 2533 } else { 2534 if (ebitmap_set_bit(&neg_types, i, 1)) { 2535 return -1; 2536 } 2537 } 2538 } 2539 } 2540 2541 if (set->flags & TYPE_STAR) { 2542 /* set all types not in neg_types */ 2543 for (i = 0; i < p->p_types.nprim; i++) { 2544 if (ebitmap_get_bit(&neg_types, i)) 2545 continue; 2546 if (p->type_val_to_struct[i] && 2547 p->type_val_to_struct[i]->flavor == TYPE_ATTRIB) 2548 continue; 2549 if (ebitmap_set_bit(t, i, 1)) 2550 return -1; 2551 } 2552 goto out; 2553 } 2554 2555 ebitmap_for_each_bit(&types, tnode, i) { 2556 if (ebitmap_node_get_bit(tnode, i) 2557 && (!ebitmap_get_bit(&neg_types, i))) 2558 if (ebitmap_set_bit(t, i, 1)) 2559 return -1; 2560 } 2561 2562 if (set->flags & TYPE_COMP) { 2563 for (i = 0; i < p->p_types.nprim; i++) { 2564 if (p->type_val_to_struct[i] && 2565 p->type_val_to_struct[i]->flavor == TYPE_ATTRIB) { 2566 assert(!ebitmap_get_bit(t, i)); 2567 continue; 2568 } 2569 if (ebitmap_get_bit(t, i)) { 2570 if (ebitmap_set_bit(t, i, 0)) 2571 return -1; 2572 } else { 2573 if (ebitmap_set_bit(t, i, 1)) 2574 return -1; 2575 } 2576 } 2577 } 2578 2579 out: 2580 2581 ebitmap_destroy(&types); 2582 ebitmap_destroy(&neg_types); 2583 2584 return 0; 2585} 2586 2587static int copy_neverallow(policydb_t * dest_pol, uint32_t * typemap, 2588 avrule_t * source_rule) 2589{ 2590 ebitmap_t stypes, ttypes; 2591 avrule_t *avrule; 2592 class_perm_node_t *cur_perm, *new_perm, *tail_perm; 2593 2594 ebitmap_init(&stypes); 2595 ebitmap_init(&ttypes); 2596 2597 if (expand_convert_type_set 2598 (dest_pol, typemap, &source_rule->stypes, &stypes, 1)) 2599 return -1; 2600 if (expand_convert_type_set 2601 (dest_pol, typemap, &source_rule->ttypes, &ttypes, 1)) 2602 return -1; 2603 2604 avrule = (avrule_t *) malloc(sizeof(avrule_t)); 2605 if (!avrule) 2606 return -1; 2607 2608 avrule_init(avrule); 2609 avrule->specified = AVRULE_NEVERALLOW; 2610 avrule->line = source_rule->line; 2611 avrule->flags = source_rule->flags; 2612 avrule->source_line = source_rule->source_line; 2613 if (source_rule->source_filename) { 2614 avrule->source_filename = strdup(source_rule->source_filename); 2615 if (!avrule->source_filename) 2616 goto err; 2617 } 2618 2619 if (ebitmap_cpy(&avrule->stypes.types, &stypes)) 2620 goto err; 2621 2622 if (ebitmap_cpy(&avrule->ttypes.types, &ttypes)) 2623 goto err; 2624 2625 cur_perm = source_rule->perms; 2626 tail_perm = NULL; 2627 while (cur_perm) { 2628 new_perm = 2629 (class_perm_node_t *) malloc(sizeof(class_perm_node_t)); 2630 if (!new_perm) 2631 goto err; 2632 class_perm_node_init(new_perm); 2633 new_perm->tclass = cur_perm->tclass; 2634 assert(new_perm->tclass); 2635 2636 /* once we have modules with permissions we'll need to map the permissions (and classes) */ 2637 new_perm->data = cur_perm->data; 2638 2639 if (!avrule->perms) 2640 avrule->perms = new_perm; 2641 2642 if (tail_perm) 2643 tail_perm->next = new_perm; 2644 tail_perm = new_perm; 2645 cur_perm = cur_perm->next; 2646 } 2647 2648 /* just prepend the avrule to the first branch; it'll never be 2649 written to disk */ 2650 if (!dest_pol->global->branch_list->avrules) 2651 dest_pol->global->branch_list->avrules = avrule; 2652 else { 2653 avrule->next = dest_pol->global->branch_list->avrules; 2654 dest_pol->global->branch_list->avrules = avrule; 2655 } 2656 2657 ebitmap_destroy(&stypes); 2658 ebitmap_destroy(&ttypes); 2659 2660 return 0; 2661 2662 err: 2663 ebitmap_destroy(&stypes); 2664 ebitmap_destroy(&ttypes); 2665 ebitmap_destroy(&avrule->stypes.types); 2666 ebitmap_destroy(&avrule->ttypes.types); 2667 cur_perm = avrule->perms; 2668 while (cur_perm) { 2669 tail_perm = cur_perm->next; 2670 free(cur_perm); 2671 cur_perm = tail_perm; 2672 } 2673 free(avrule); 2674 return -1; 2675} 2676 2677/* 2678 * Expands the avrule blocks for a policy. RBAC rules are copied. Neverallow 2679 * rules are copied or expanded as per the settings in the state object; all 2680 * other AV rules are expanded. If neverallow rules are expanded, they are not 2681 * copied, otherwise they are copied for later use by the assertion checker. 2682 */ 2683static int copy_and_expand_avrule_block(expand_state_t * state) 2684{ 2685 avrule_block_t *curblock = state->base->global; 2686 avrule_block_t *prevblock; 2687 int retval = -1; 2688 2689 if (avtab_alloc(&state->out->te_avtab, MAX_AVTAB_SIZE)) { 2690 ERR(state->handle, "Out of Memory!"); 2691 return -1; 2692 } 2693 2694 if (avtab_alloc(&state->out->te_cond_avtab, MAX_AVTAB_SIZE)) { 2695 ERR(state->handle, "Out of Memory!"); 2696 return -1; 2697 } 2698 2699 while (curblock) { 2700 avrule_decl_t *decl = curblock->enabled; 2701 avrule_t *cur_avrule; 2702 2703 if (decl == NULL) { 2704 /* nothing was enabled within this block */ 2705 goto cont; 2706 } 2707 2708 /* copy role allows and role trans */ 2709 if (copy_role_allows(state, decl->role_allow_rules) != 0 || 2710 copy_role_trans(state, decl->role_tr_rules) != 0) { 2711 goto cleanup; 2712 } 2713 2714 if (expand_filename_trans(state, decl->filename_trans_rules)) 2715 goto cleanup; 2716 2717 /* expand the range transition rules */ 2718 if (expand_range_trans(state, decl->range_tr_rules)) 2719 goto cleanup; 2720 2721 /* copy rules */ 2722 cur_avrule = decl->avrules; 2723 while (cur_avrule != NULL) { 2724 if (!(state->expand_neverallow) 2725 && cur_avrule->specified & AVRULE_NEVERALLOW) { 2726 /* copy this over directly so that assertions are checked later */ 2727 if (copy_neverallow 2728 (state->out, state->typemap, cur_avrule)) 2729 ERR(state->handle, 2730 "Error while copying neverallow."); 2731 } else { 2732 if (cur_avrule->specified & AVRULE_NEVERALLOW) { 2733 state->out->unsupported_format = 1; 2734 } 2735 if (convert_and_expand_rule 2736 (state->handle, state->out, state->typemap, 2737 cur_avrule, &state->out->te_avtab, NULL, 2738 NULL, 0, 2739 state->expand_neverallow) != 2740 EXPAND_RULE_SUCCESS) { 2741 goto cleanup; 2742 } 2743 } 2744 cur_avrule = cur_avrule->next; 2745 } 2746 2747 /* copy conditional rules */ 2748 if (cond_node_copy(state, decl->cond_list)) 2749 goto cleanup; 2750 2751 cont: 2752 prevblock = curblock; 2753 curblock = curblock->next; 2754 2755 if (state->handle && state->handle->expand_consume_base) { 2756 /* set base top avrule block in case there 2757 * is an error condition and the policy needs 2758 * to be destroyed */ 2759 state->base->global = curblock; 2760 avrule_block_destroy(prevblock); 2761 } 2762 } 2763 2764 retval = 0; 2765 2766 cleanup: 2767 return retval; 2768} 2769 2770/* 2771 * This function allows external users of the library (such as setools) to 2772 * expand only the avrules and optionally perform expansion of neverallow rules 2773 * or expand into the same policy for analysis purposes. 2774 */ 2775int expand_module_avrules(sepol_handle_t * handle, policydb_t * base, 2776 policydb_t * out, uint32_t * typemap, 2777 uint32_t * boolmap, uint32_t * rolemap, 2778 uint32_t * usermap, int verbose, 2779 int expand_neverallow) 2780{ 2781 expand_state_t state; 2782 2783 expand_state_init(&state); 2784 2785 state.base = base; 2786 state.out = out; 2787 state.typemap = typemap; 2788 state.boolmap = boolmap; 2789 state.rolemap = rolemap; 2790 state.usermap = usermap; 2791 state.handle = handle; 2792 state.verbose = verbose; 2793 state.expand_neverallow = expand_neverallow; 2794 2795 return copy_and_expand_avrule_block(&state); 2796} 2797 2798static void discard_tunables(sepol_handle_t *sh, policydb_t *pol) 2799{ 2800 avrule_block_t *block; 2801 avrule_decl_t *decl; 2802 cond_node_t *cur_node; 2803 cond_expr_t *cur_expr; 2804 int cur_state, preserve_tunables = 0; 2805 avrule_t *tail, *to_be_appended; 2806 2807 if (sh && sh->preserve_tunables) 2808 preserve_tunables = 1; 2809 2810 /* Iterate through all cond_node of all enabled decls, if a cond_node 2811 * is about tunable, calculate its state value and concatenate one of 2812 * its avrule list to the current decl->avrules list. On the other 2813 * hand, the disabled unused branch of a tunable would be discarded. 2814 * 2815 * Note, such tunable cond_node would be skipped over in expansion, 2816 * so we won't have to worry about removing it from decl->cond_list 2817 * here :-) 2818 * 2819 * If tunables are requested to be preserved then they would be 2820 * "transformed" as booleans by having their TUNABLE flag cleared. 2821 */ 2822 for (block = pol->global; block != NULL; block = block->next) { 2823 decl = block->enabled; 2824 if (decl == NULL || decl->enabled == 0) 2825 continue; 2826 2827 tail = decl->avrules; 2828 while (tail && tail->next) 2829 tail = tail->next; 2830 2831 for (cur_node = decl->cond_list; cur_node != NULL; 2832 cur_node = cur_node->next) { 2833 int booleans, tunables, i; 2834 cond_bool_datum_t *booldatum; 2835 cond_bool_datum_t *tmp[COND_EXPR_MAXDEPTH]; 2836 2837 booleans = tunables = 0; 2838 memset(tmp, 0, sizeof(cond_bool_datum_t *) * COND_EXPR_MAXDEPTH); 2839 2840 for (cur_expr = cur_node->expr; cur_expr != NULL; 2841 cur_expr = cur_expr->next) { 2842 if (cur_expr->expr_type != COND_BOOL) 2843 continue; 2844 booldatum = pol->bool_val_to_struct[cur_expr->bool - 1]; 2845 if (booldatum->flags & COND_BOOL_FLAGS_TUNABLE) 2846 tmp[tunables++] = booldatum; 2847 else 2848 booleans++; 2849 } 2850 2851 /* bool_copy_callback() at link phase has ensured 2852 * that no mixture of tunables and booleans in one 2853 * expression. However, this would be broken by the 2854 * request to preserve tunables */ 2855 if (!preserve_tunables) 2856 assert(!(booleans && tunables)); 2857 2858 if (booleans || preserve_tunables) { 2859 cur_node->flags &= ~COND_NODE_FLAGS_TUNABLE; 2860 if (tunables) { 2861 for (i = 0; i < tunables; i++) 2862 tmp[i]->flags &= ~COND_BOOL_FLAGS_TUNABLE; 2863 } 2864 } else { 2865 cur_node->flags |= COND_NODE_FLAGS_TUNABLE; 2866 cur_state = cond_evaluate_expr(pol, cur_node->expr); 2867 if (cur_state == -1) { 2868 printf("Expression result was " 2869 "undefined, skipping all" 2870 "rules\n"); 2871 continue; 2872 } 2873 2874 to_be_appended = (cur_state == 1) ? 2875 cur_node->avtrue_list : cur_node->avfalse_list; 2876 2877 if (tail) 2878 tail->next = to_be_appended; 2879 else 2880 tail = decl->avrules = to_be_appended; 2881 2882 /* Now that the effective branch has been 2883 * appended, neutralize its original pointer */ 2884 if (cur_state == 1) 2885 cur_node->avtrue_list = NULL; 2886 else 2887 cur_node->avfalse_list = NULL; 2888 2889 /* Update the tail of decl->avrules for 2890 * further concatenation */ 2891 while (tail && tail->next) 2892 tail = tail->next; 2893 } 2894 } 2895 } 2896} 2897 2898/* Linking should always be done before calling expand, even if 2899 * there is only a base since all optionals are dealt with at link time 2900 * the base passed in should be indexed and avrule blocks should be 2901 * enabled. 2902 */ 2903int expand_module(sepol_handle_t * handle, 2904 policydb_t * base, policydb_t * out, int verbose, int check) 2905{ 2906 int retval = -1; 2907 unsigned int i; 2908 expand_state_t state; 2909 avrule_block_t *curblock; 2910 2911 /* Append tunable's avtrue_list or avfalse_list to the avrules list 2912 * of its home decl depending on its state value, so that the effect 2913 * rules of a tunable would be added to te_avtab permanently. Whereas 2914 * the disabled unused branch would be discarded. 2915 * 2916 * Originally this function is called at the very end of link phase, 2917 * however, we need to keep the linked policy intact for analysis 2918 * purpose. */ 2919 discard_tunables(handle, base); 2920 2921 expand_state_init(&state); 2922 2923 state.verbose = verbose; 2924 state.typemap = NULL; 2925 state.base = base; 2926 state.out = out; 2927 state.handle = handle; 2928 2929 if (base->policy_type != POLICY_BASE) { 2930 ERR(handle, "Target of expand was not a base policy."); 2931 return -1; 2932 } 2933 2934 state.out->policy_type = POLICY_KERN; 2935 state.out->policyvers = POLICYDB_VERSION_MAX; 2936 2937 /* Copy mls state from base to out */ 2938 out->mls = base->mls; 2939 out->handle_unknown = base->handle_unknown; 2940 2941 /* Copy target from base to out */ 2942 out->target_platform = base->target_platform; 2943 2944 /* Copy policy capabilities */ 2945 if (ebitmap_cpy(&out->policycaps, &base->policycaps)) { 2946 ERR(handle, "Out of memory!"); 2947 goto cleanup; 2948 } 2949 2950 if ((state.typemap = 2951 (uint32_t *) calloc(state.base->p_types.nprim, 2952 sizeof(uint32_t))) == NULL) { 2953 ERR(handle, "Out of memory!"); 2954 goto cleanup; 2955 } 2956 2957 state.boolmap = (uint32_t *)calloc(state.base->p_bools.nprim, sizeof(uint32_t)); 2958 if (!state.boolmap) { 2959 ERR(handle, "Out of memory!"); 2960 goto cleanup; 2961 } 2962 2963 state.rolemap = (uint32_t *)calloc(state.base->p_roles.nprim, sizeof(uint32_t)); 2964 if (!state.rolemap) { 2965 ERR(handle, "Out of memory!"); 2966 goto cleanup; 2967 } 2968 2969 state.usermap = (uint32_t *)calloc(state.base->p_users.nprim, sizeof(uint32_t)); 2970 if (!state.usermap) { 2971 ERR(handle, "Out of memory!"); 2972 goto cleanup; 2973 } 2974 2975 /* order is important - types must be first */ 2976 2977 /* copy types */ 2978 if (hashtab_map(state.base->p_types.table, type_copy_callback, &state)) { 2979 goto cleanup; 2980 } 2981 2982 /* convert attribute type sets */ 2983 if (hashtab_map 2984 (state.base->p_types.table, attr_convert_callback, &state)) { 2985 goto cleanup; 2986 } 2987 2988 /* copy commons */ 2989 if (hashtab_map 2990 (state.base->p_commons.table, common_copy_callback, &state)) { 2991 goto cleanup; 2992 } 2993 2994 /* copy classes, note, this does not copy constraints, constraints can't be 2995 * copied until after all the blocks have been processed and attributes are complete */ 2996 if (hashtab_map 2997 (state.base->p_classes.table, class_copy_callback, &state)) { 2998 goto cleanup; 2999 } 3000 3001 /* copy type bounds */ 3002 if (hashtab_map(state.base->p_types.table, 3003 type_bounds_copy_callback, &state)) 3004 goto cleanup; 3005 3006 /* copy aliases */ 3007 if (hashtab_map(state.base->p_types.table, alias_copy_callback, &state)) 3008 goto cleanup; 3009 3010 /* index here so that type indexes are available for role_copy_callback */ 3011 if (policydb_index_others(handle, out, verbose)) { 3012 ERR(handle, "Error while indexing out symbols"); 3013 goto cleanup; 3014 } 3015 3016 /* copy roles */ 3017 if (hashtab_map(state.base->p_roles.table, role_copy_callback, &state)) 3018 goto cleanup; 3019 if (hashtab_map(state.base->p_roles.table, 3020 role_bounds_copy_callback, &state)) 3021 goto cleanup; 3022 /* escalate the type_set_t in a role attribute to all regular roles 3023 * that belongs to it. */ 3024 if (hashtab_map(state.base->p_roles.table, role_fix_callback, &state)) 3025 goto cleanup; 3026 3027 /* copy MLS's sensitivity level and categories - this needs to be done 3028 * before expanding users (they need to be indexed too) */ 3029 if (hashtab_map(state.base->p_levels.table, sens_copy_callback, &state)) 3030 goto cleanup; 3031 if (hashtab_map(state.base->p_cats.table, cats_copy_callback, &state)) 3032 goto cleanup; 3033 if (policydb_index_others(handle, out, verbose)) { 3034 ERR(handle, "Error while indexing out symbols"); 3035 goto cleanup; 3036 } 3037 3038 /* copy users */ 3039 if (hashtab_map(state.base->p_users.table, user_copy_callback, &state)) 3040 goto cleanup; 3041 if (hashtab_map(state.base->p_users.table, 3042 user_bounds_copy_callback, &state)) 3043 goto cleanup; 3044 3045 /* copy bools */ 3046 if (hashtab_map(state.base->p_bools.table, bool_copy_callback, &state)) 3047 goto cleanup; 3048 3049 if (policydb_index_classes(out)) { 3050 ERR(handle, "Error while indexing out classes"); 3051 goto cleanup; 3052 } 3053 if (policydb_index_others(handle, out, verbose)) { 3054 ERR(handle, "Error while indexing out symbols"); 3055 goto cleanup; 3056 } 3057 3058 /* loop through all decls and union attributes, roles, users */ 3059 for (curblock = state.base->global; curblock != NULL; 3060 curblock = curblock->next) { 3061 avrule_decl_t *decl = curblock->enabled; 3062 3063 if (decl == NULL) { 3064 /* nothing was enabled within this block */ 3065 continue; 3066 } 3067 3068 /* convert attribute type sets */ 3069 if (hashtab_map 3070 (decl->p_types.table, attr_convert_callback, &state)) { 3071 goto cleanup; 3072 } 3073 3074 /* copy roles */ 3075 if (hashtab_map 3076 (decl->p_roles.table, role_copy_callback, &state)) 3077 goto cleanup; 3078 3079 /* copy users */ 3080 if (hashtab_map 3081 (decl->p_users.table, user_copy_callback, &state)) 3082 goto cleanup; 3083 3084 } 3085 3086 /* remap role dominates bitmaps */ 3087 if (hashtab_map(state.out->p_roles.table, role_remap_dominates, &state)) { 3088 goto cleanup; 3089 } 3090 3091 if (copy_and_expand_avrule_block(&state) < 0) { 3092 ERR(handle, "Error during expand"); 3093 goto cleanup; 3094 } 3095 3096 /* copy constraints */ 3097 if (hashtab_map 3098 (state.base->p_classes.table, constraint_copy_callback, &state)) { 3099 goto cleanup; 3100 } 3101 3102 cond_optimize_lists(state.out->cond_list); 3103 if (evaluate_conds(state.out)) 3104 goto cleanup; 3105 3106 /* copy ocontexts */ 3107 if (ocontext_copy(&state, out->target_platform)) 3108 goto cleanup; 3109 3110 /* copy genfs */ 3111 if (genfs_copy(&state)) 3112 goto cleanup; 3113 3114 /* Build the type<->attribute maps and remove attributes. */ 3115 state.out->attr_type_map = malloc(state.out->p_types.nprim * 3116 sizeof(ebitmap_t)); 3117 state.out->type_attr_map = malloc(state.out->p_types.nprim * 3118 sizeof(ebitmap_t)); 3119 if (!state.out->attr_type_map || !state.out->type_attr_map) { 3120 ERR(handle, "Out of memory!"); 3121 goto cleanup; 3122 } 3123 for (i = 0; i < state.out->p_types.nprim; i++) { 3124 ebitmap_init(&state.out->type_attr_map[i]); 3125 ebitmap_init(&state.out->attr_type_map[i]); 3126 /* add the type itself as the degenerate case */ 3127 if (ebitmap_set_bit(&state.out->type_attr_map[i], i, 1)) { 3128 ERR(handle, "Out of memory!"); 3129 goto cleanup; 3130 } 3131 } 3132 if (hashtab_map(state.out->p_types.table, type_attr_map, &state)) 3133 goto cleanup; 3134 if (check) { 3135 if (hierarchy_check_constraints(handle, state.out)) 3136 goto cleanup; 3137 3138 if (check_assertions 3139 (handle, state.out, 3140 state.out->global->branch_list->avrules)) 3141 goto cleanup; 3142 } 3143 3144 retval = 0; 3145 3146 cleanup: 3147 free(state.typemap); 3148 free(state.boolmap); 3149 free(state.rolemap); 3150 free(state.usermap); 3151 return retval; 3152} 3153 3154static int expand_avtab_insert(avtab_t * a, avtab_key_t * k, avtab_datum_t * d) 3155{ 3156 avtab_ptr_t node; 3157 avtab_datum_t *avd; 3158 avtab_operations_t *ops; 3159 unsigned int i; 3160 unsigned int type_match = 0; 3161 3162 if (k->specified & AVTAB_OPNUM) { 3163 /* 3164 * AVTAB_OPNUM entries are not necessarily unique. 3165 * find node with matching ops->type 3166 */ 3167 node = avtab_search_node(a, k); 3168 while (node) { 3169 if (node->datum.ops->type == d->ops->type) { 3170 type_match = 1; 3171 break; 3172 } 3173 node = avtab_search_node_next(node, k->specified); 3174 } 3175 if (!type_match) 3176 node = NULL; 3177 } else { 3178 node = avtab_search_node(a, k); 3179 } 3180 3181 if (!node || ((k->specified & AVTAB_ENABLED) != 3182 (node->key.specified & AVTAB_ENABLED))) { 3183 node = avtab_insert_nonunique(a, k, d); 3184 if (!node) { 3185 ERR(NULL, "Out of memory!"); 3186 return -1; 3187 } 3188 return 0; 3189 } 3190 3191 avd = &node->datum; 3192 ops = node->datum.ops; 3193 switch (k->specified & ~AVTAB_ENABLED) { 3194 case AVTAB_ALLOWED: 3195 case AVTAB_AUDITALLOW: 3196 avd->data |= d->data; 3197 break; 3198 case AVTAB_AUDITDENY: 3199 avd->data &= d->data; 3200 break; 3201 case AVTAB_OPNUM_ALLOWED: 3202 case AVTAB_OPNUM_AUDITALLOW: 3203 case AVTAB_OPNUM_DONTAUDIT: 3204 case AVTAB_OPTYPE_ALLOWED: 3205 case AVTAB_OPTYPE_AUDITALLOW: 3206 case AVTAB_OPTYPE_DONTAUDIT: 3207 for (i = 0; i < ARRAY_SIZE(ops->perms); i++) 3208 ops->perms[i] |= d->ops->perms[i]; 3209 break; 3210 default: 3211 ERR(NULL, "Type conflict!"); 3212 return -1; 3213 } 3214 3215 return 0; 3216} 3217 3218struct expand_avtab_data { 3219 avtab_t *expa; 3220 policydb_t *p; 3221 3222}; 3223 3224static int expand_avtab_node(avtab_key_t * k, avtab_datum_t * d, void *args) 3225{ 3226 struct expand_avtab_data *ptr = args; 3227 avtab_t *expa = ptr->expa; 3228 policydb_t *p = ptr->p; 3229 type_datum_t *stype = p->type_val_to_struct[k->source_type - 1]; 3230 type_datum_t *ttype = p->type_val_to_struct[k->target_type - 1]; 3231 ebitmap_t *sattr = &p->attr_type_map[k->source_type - 1]; 3232 ebitmap_t *tattr = &p->attr_type_map[k->target_type - 1]; 3233 ebitmap_node_t *snode, *tnode; 3234 unsigned int i, j; 3235 avtab_key_t newkey; 3236 int rc; 3237 3238 newkey.target_class = k->target_class; 3239 newkey.specified = k->specified; 3240 3241 if (stype && ttype && stype->flavor != TYPE_ATTRIB && ttype->flavor != TYPE_ATTRIB) { 3242 /* Both are individual types, no expansion required. */ 3243 return expand_avtab_insert(expa, k, d); 3244 } 3245 3246 if (stype && stype->flavor != TYPE_ATTRIB) { 3247 /* Source is an individual type, target is an attribute. */ 3248 newkey.source_type = k->source_type; 3249 ebitmap_for_each_bit(tattr, tnode, j) { 3250 if (!ebitmap_node_get_bit(tnode, j)) 3251 continue; 3252 newkey.target_type = j + 1; 3253 rc = expand_avtab_insert(expa, &newkey, d); 3254 if (rc) 3255 return -1; 3256 } 3257 return 0; 3258 } 3259 3260 if (ttype && ttype->flavor != TYPE_ATTRIB) { 3261 /* Target is an individual type, source is an attribute. */ 3262 newkey.target_type = k->target_type; 3263 ebitmap_for_each_bit(sattr, snode, i) { 3264 if (!ebitmap_node_get_bit(snode, i)) 3265 continue; 3266 newkey.source_type = i + 1; 3267 rc = expand_avtab_insert(expa, &newkey, d); 3268 if (rc) 3269 return -1; 3270 } 3271 return 0; 3272 } 3273 3274 /* Both source and target type are attributes. */ 3275 ebitmap_for_each_bit(sattr, snode, i) { 3276 if (!ebitmap_node_get_bit(snode, i)) 3277 continue; 3278 ebitmap_for_each_bit(tattr, tnode, j) { 3279 if (!ebitmap_node_get_bit(tnode, j)) 3280 continue; 3281 newkey.source_type = i + 1; 3282 newkey.target_type = j + 1; 3283 rc = expand_avtab_insert(expa, &newkey, d); 3284 if (rc) 3285 return -1; 3286 } 3287 } 3288 3289 return 0; 3290} 3291 3292int expand_avtab(policydb_t * p, avtab_t * a, avtab_t * expa) 3293{ 3294 struct expand_avtab_data data; 3295 3296 if (avtab_alloc(expa, MAX_AVTAB_SIZE)) { 3297 ERR(NULL, "Out of memory!"); 3298 return -1; 3299 } 3300 3301 data.expa = expa; 3302 data.p = p; 3303 return avtab_map(a, expand_avtab_node, &data); 3304} 3305 3306static int expand_cond_insert(cond_av_list_t ** l, 3307 avtab_t * expa, 3308 avtab_key_t * k, avtab_datum_t * d) 3309{ 3310 avtab_ptr_t node; 3311 avtab_datum_t *avd; 3312 cond_av_list_t *nl; 3313 3314 node = avtab_search_node(expa, k); 3315 if (!node || 3316 (k->specified & AVTAB_ENABLED) != 3317 (node->key.specified & AVTAB_ENABLED)) { 3318 node = avtab_insert_nonunique(expa, k, d); 3319 if (!node) { 3320 ERR(NULL, "Out of memory!"); 3321 return -1; 3322 } 3323 node->parse_context = (void *)1; 3324 nl = (cond_av_list_t *) malloc(sizeof(*nl)); 3325 if (!nl) { 3326 ERR(NULL, "Out of memory!"); 3327 return -1; 3328 } 3329 memset(nl, 0, sizeof(*nl)); 3330 nl->node = node; 3331 nl->next = *l; 3332 *l = nl; 3333 return 0; 3334 } 3335 3336 avd = &node->datum; 3337 switch (k->specified & ~AVTAB_ENABLED) { 3338 case AVTAB_ALLOWED: 3339 case AVTAB_AUDITALLOW: 3340 avd->data |= d->data; 3341 break; 3342 case AVTAB_AUDITDENY: 3343 avd->data &= d->data; 3344 break; 3345 default: 3346 ERR(NULL, "Type conflict!"); 3347 return -1; 3348 } 3349 3350 return 0; 3351} 3352 3353int expand_cond_av_node(policydb_t * p, 3354 avtab_ptr_t node, 3355 cond_av_list_t ** newl, avtab_t * expa) 3356{ 3357 avtab_key_t *k = &node->key; 3358 avtab_datum_t *d = &node->datum; 3359 type_datum_t *stype = p->type_val_to_struct[k->source_type - 1]; 3360 type_datum_t *ttype = p->type_val_to_struct[k->target_type - 1]; 3361 ebitmap_t *sattr = &p->attr_type_map[k->source_type - 1]; 3362 ebitmap_t *tattr = &p->attr_type_map[k->target_type - 1]; 3363 ebitmap_node_t *snode, *tnode; 3364 unsigned int i, j; 3365 avtab_key_t newkey; 3366 int rc; 3367 3368 newkey.target_class = k->target_class; 3369 newkey.specified = k->specified; 3370 3371 if (stype && ttype && stype->flavor != TYPE_ATTRIB && ttype->flavor != TYPE_ATTRIB) { 3372 /* Both are individual types, no expansion required. */ 3373 return expand_cond_insert(newl, expa, k, d); 3374 } 3375 3376 if (stype && stype->flavor != TYPE_ATTRIB) { 3377 /* Source is an individual type, target is an attribute. */ 3378 newkey.source_type = k->source_type; 3379 ebitmap_for_each_bit(tattr, tnode, j) { 3380 if (!ebitmap_node_get_bit(tnode, j)) 3381 continue; 3382 newkey.target_type = j + 1; 3383 rc = expand_cond_insert(newl, expa, &newkey, d); 3384 if (rc) 3385 return -1; 3386 } 3387 return 0; 3388 } 3389 3390 if (ttype && ttype->flavor != TYPE_ATTRIB) { 3391 /* Target is an individual type, source is an attribute. */ 3392 newkey.target_type = k->target_type; 3393 ebitmap_for_each_bit(sattr, snode, i) { 3394 if (!ebitmap_node_get_bit(snode, i)) 3395 continue; 3396 newkey.source_type = i + 1; 3397 rc = expand_cond_insert(newl, expa, &newkey, d); 3398 if (rc) 3399 return -1; 3400 } 3401 return 0; 3402 } 3403 3404 /* Both source and target type are attributes. */ 3405 ebitmap_for_each_bit(sattr, snode, i) { 3406 if (!ebitmap_node_get_bit(snode, i)) 3407 continue; 3408 ebitmap_for_each_bit(tattr, tnode, j) { 3409 if (!ebitmap_node_get_bit(tnode, j)) 3410 continue; 3411 newkey.source_type = i + 1; 3412 newkey.target_type = j + 1; 3413 rc = expand_cond_insert(newl, expa, &newkey, d); 3414 if (rc) 3415 return -1; 3416 } 3417 } 3418 3419 return 0; 3420} 3421 3422int expand_cond_av_list(policydb_t * p, cond_av_list_t * l, 3423 cond_av_list_t ** newl, avtab_t * expa) 3424{ 3425 cond_av_list_t *cur; 3426 avtab_ptr_t node; 3427 int rc; 3428 3429 if (avtab_alloc(expa, MAX_AVTAB_SIZE)) { 3430 ERR(NULL, "Out of memory!"); 3431 return -1; 3432 } 3433 3434 *newl = NULL; 3435 for (cur = l; cur; cur = cur->next) { 3436 node = cur->node; 3437 rc = expand_cond_av_node(p, node, newl, expa); 3438 if (rc) 3439 return rc; 3440 } 3441 3442 return 0; 3443} 3444