expand.c revision 505c75aad7f16e0db9ccfeb04eaa70f242e6b060
1/* Authors: Karl MacMillan <kmacmillan@mentalrootkit.com> 2 * Jason Tang <jtang@tresys.com> 3 * Joshua Brindle <jbrindle@tresys.com> 4 * 5 * Copyright (C) 2004-2005 Tresys Technology, LLC 6 * Copyright (C) 2007 Red Hat, Inc. 7 * 8 * This library is free software; you can redistribute it and/or 9 * modify it under the terms of the GNU Lesser General Public 10 * License as published by the Free Software Foundation; either 11 * version 2.1 of the License, or (at your option) any later version. 12 * 13 * This library is distributed in the hope that it will be useful, 14 * but WITHOUT ANY WARRANTY; without even the implied warranty of 15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU 16 * Lesser General Public License for more details. 17 * 18 * You should have received a copy of the GNU Lesser General Public 19 * License along with this library; if not, write to the Free Software 20 * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA 21 */ 22 23#include "context.h" 24#include <sepol/policydb/policydb.h> 25#include <sepol/policydb/conditional.h> 26#include <sepol/policydb/hashtab.h> 27#include <sepol/policydb/expand.h> 28#include <sepol/policydb/hierarchy.h> 29#include <sepol/policydb/avrule_block.h> 30 31#include <stdlib.h> 32#include <stdarg.h> 33#include <stdio.h> 34#include <string.h> 35#include <assert.h> 36 37#include "debug.h" 38#include "private.h" 39 40typedef struct expand_state { 41 int verbose; 42 uint32_t *typemap; 43 uint32_t *boolmap; 44 uint32_t *rolemap; 45 uint32_t *usermap; 46 policydb_t *base; 47 policydb_t *out; 48 sepol_handle_t *handle; 49 int expand_neverallow; 50} expand_state_t; 51 52static void expand_state_init(expand_state_t * state) 53{ 54 memset(state, 0, sizeof(expand_state_t)); 55} 56 57static int map_ebitmap(ebitmap_t * src, ebitmap_t * dst, uint32_t * map) 58{ 59 unsigned int i; 60 ebitmap_node_t *tnode; 61 ebitmap_init(dst); 62 63 ebitmap_for_each_bit(src, tnode, i) { 64 if (!ebitmap_node_get_bit(tnode, i)) 65 continue; 66 if (!map[i]) 67 continue; 68 if (ebitmap_set_bit(dst, map[i] - 1, 1)) 69 return -1; 70 } 71 return 0; 72} 73 74static int type_copy_callback(hashtab_key_t key, hashtab_datum_t datum, 75 void *data) 76{ 77 int ret; 78 char *id, *new_id; 79 type_datum_t *type, *new_type; 80 expand_state_t *state; 81 82 id = (char *)key; 83 type = (type_datum_t *) datum; 84 state = (expand_state_t *) data; 85 86 if ((type->flavor == TYPE_TYPE && !type->primary) 87 || type->flavor == TYPE_ALIAS) { 88 /* aliases are handled later */ 89 return 0; 90 } 91 if (!is_id_enabled(id, state->base, SYM_TYPES)) { 92 /* identifier's scope is not enabled */ 93 return 0; 94 } 95 96 if (state->verbose) 97 INFO(state->handle, "copying type or attribute %s", id); 98 99 new_id = strdup(id); 100 if (new_id == NULL) { 101 ERR(state->handle, "Out of memory!"); 102 return -1; 103 } 104 105 new_type = (type_datum_t *) malloc(sizeof(type_datum_t)); 106 if (!new_type) { 107 ERR(state->handle, "Out of memory!"); 108 free(new_id); 109 return SEPOL_ENOMEM; 110 } 111 memset(new_type, 0, sizeof(type_datum_t)); 112 113 new_type->flavor = type->flavor; 114 new_type->flags = type->flags; 115 new_type->s.value = ++state->out->p_types.nprim; 116 if (new_type->s.value > UINT16_MAX) { 117 free(new_id); 118 free(new_type); 119 ERR(state->handle, "type space overflow"); 120 return -1; 121 } 122 new_type->primary = 1; 123 state->typemap[type->s.value - 1] = new_type->s.value; 124 125 ret = hashtab_insert(state->out->p_types.table, 126 (hashtab_key_t) new_id, 127 (hashtab_datum_t) new_type); 128 if (ret) { 129 free(new_id); 130 free(new_type); 131 ERR(state->handle, "hashtab overflow"); 132 return -1; 133 } 134 135 if (new_type->flags & TYPE_FLAGS_PERMISSIVE) 136 if (ebitmap_set_bit(&state->out->permissive_map, new_type->s.value, 1)) { 137 ERR(state->handle, "Out of memory!\n"); 138 return -1; 139 } 140 141 return 0; 142} 143 144static int attr_convert_callback(hashtab_key_t key, hashtab_datum_t datum, 145 void *data) 146{ 147 char *id; 148 type_datum_t *type, *new_type; 149 expand_state_t *state; 150 ebitmap_t tmp_union; 151 152 id = (char *)key; 153 type = (type_datum_t *) datum; 154 state = (expand_state_t *) data; 155 156 if (type->flavor != TYPE_ATTRIB) 157 return 0; 158 159 if (!is_id_enabled(id, state->base, SYM_TYPES)) { 160 /* identifier's scope is not enabled */ 161 return 0; 162 } 163 164 if (state->verbose) 165 INFO(state->handle, "converting attribute %s", id); 166 167 new_type = hashtab_search(state->out->p_types.table, id); 168 if (!new_type) { 169 ERR(state->handle, "attribute %s vanished!", id); 170 return -1; 171 } 172 if (map_ebitmap(&type->types, &tmp_union, state->typemap)) { 173 ERR(state->handle, "out of memory"); 174 return -1; 175 } 176 177 /* then union tmp_union onto &new_type->types */ 178 if (ebitmap_union(&new_type->types, &tmp_union)) { 179 ERR(state->handle, "Out of memory!"); 180 return -1; 181 } 182 ebitmap_destroy(&tmp_union); 183 184 return 0; 185} 186 187static int perm_copy_callback(hashtab_key_t key, hashtab_datum_t datum, 188 void *data) 189{ 190 int ret; 191 char *id, *new_id; 192 symtab_t *s; 193 perm_datum_t *perm, *new_perm; 194 195 id = key; 196 perm = (perm_datum_t *) datum; 197 s = (symtab_t *) data; 198 199 new_perm = (perm_datum_t *) malloc(sizeof(perm_datum_t)); 200 if (!new_perm) { 201 return -1; 202 } 203 memset(new_perm, 0, sizeof(perm_datum_t)); 204 205 new_id = strdup(id); 206 if (!new_id) { 207 free(new_perm); 208 return -1; 209 } 210 211 new_perm->s.value = perm->s.value; 212 s->nprim++; 213 214 ret = hashtab_insert(s->table, new_id, (hashtab_datum_t *) new_perm); 215 if (ret) { 216 free(new_id); 217 free(new_perm); 218 return -1; 219 } 220 221 return 0; 222} 223 224static int common_copy_callback(hashtab_key_t key, hashtab_datum_t datum, 225 void *data) 226{ 227 int ret; 228 char *id, *new_id; 229 common_datum_t *common, *new_common; 230 expand_state_t *state; 231 232 id = (char *)key; 233 common = (common_datum_t *) datum; 234 state = (expand_state_t *) data; 235 236 if (state->verbose) 237 INFO(state->handle, "copying common %s", id); 238 239 new_common = (common_datum_t *) malloc(sizeof(common_datum_t)); 240 if (!new_common) { 241 ERR(state->handle, "Out of memory!"); 242 return -1; 243 } 244 memset(new_common, 0, sizeof(common_datum_t)); 245 if (symtab_init(&new_common->permissions, PERM_SYMTAB_SIZE)) { 246 ERR(state->handle, "Out of memory!"); 247 free(new_common); 248 return -1; 249 } 250 251 new_id = strdup(id); 252 if (!new_id) { 253 ERR(state->handle, "Out of memory!"); 254 free(new_common); 255 return -1; 256 } 257 258 new_common->s.value = common->s.value; 259 state->out->p_commons.nprim++; 260 261 ret = 262 hashtab_insert(state->out->p_commons.table, new_id, 263 (hashtab_datum_t *) new_common); 264 if (ret) { 265 ERR(state->handle, "hashtab overflow"); 266 free(new_common); 267 free(new_id); 268 return -1; 269 } 270 271 if (hashtab_map 272 (common->permissions.table, perm_copy_callback, 273 &new_common->permissions)) { 274 ERR(state->handle, "Out of memory!"); 275 return -1; 276 } 277 278 return 0; 279} 280 281static int constraint_node_clone(constraint_node_t ** dst, 282 constraint_node_t * src, 283 expand_state_t * state) 284{ 285 constraint_node_t *new_con = NULL, *last_new_con = NULL; 286 constraint_expr_t *new_expr = NULL; 287 *dst = NULL; 288 while (src != NULL) { 289 constraint_expr_t *expr, *expr_l = NULL; 290 new_con = 291 (constraint_node_t *) malloc(sizeof(constraint_node_t)); 292 if (!new_con) { 293 goto out_of_mem; 294 } 295 memset(new_con, 0, sizeof(constraint_node_t)); 296 new_con->permissions = src->permissions; 297 for (expr = src->expr; expr; expr = expr->next) { 298 if ((new_expr = calloc(1, sizeof(*new_expr))) == NULL) { 299 goto out_of_mem; 300 } 301 if (constraint_expr_init(new_expr) == -1) { 302 goto out_of_mem; 303 } 304 new_expr->expr_type = expr->expr_type; 305 new_expr->attr = expr->attr; 306 new_expr->op = expr->op; 307 if (new_expr->expr_type == CEXPR_NAMES) { 308 if (new_expr->attr & CEXPR_TYPE) { 309 /* Type sets require expansion and conversion. */ 310 if (expand_convert_type_set(state->out, 311 state-> 312 typemap, 313 expr-> 314 type_names, 315 &new_expr-> 316 names, 1)) { 317 goto out_of_mem; 318 } 319 } else if (new_expr->attr & CEXPR_ROLE) { 320 if (map_ebitmap(&expr->names, &new_expr->names, state->rolemap)) { 321 goto out_of_mem; 322 } 323 } else if (new_expr->attr & CEXPR_USER) { 324 if (map_ebitmap(&expr->names, &new_expr->names, state->usermap)) { 325 goto out_of_mem; 326 } 327 } else { 328 /* Other kinds of sets do not. */ 329 if (ebitmap_cpy(&new_expr->names, 330 &expr->names)) { 331 goto out_of_mem; 332 } 333 } 334 } 335 if (expr_l) { 336 expr_l->next = new_expr; 337 } else { 338 new_con->expr = new_expr; 339 } 340 expr_l = new_expr; 341 new_expr = NULL; 342 } 343 if (last_new_con == NULL) { 344 *dst = new_con; 345 } else { 346 last_new_con->next = new_con; 347 } 348 last_new_con = new_con; 349 src = src->next; 350 } 351 352 return 0; 353 out_of_mem: 354 ERR(state->handle, "Out of memory!"); 355 if (new_con) 356 free(new_con); 357 constraint_expr_destroy(new_expr); 358 return -1; 359} 360 361static int class_copy_callback(hashtab_key_t key, hashtab_datum_t datum, 362 void *data) 363{ 364 int ret; 365 char *id, *new_id; 366 class_datum_t *class, *new_class; 367 expand_state_t *state; 368 369 id = (char *)key; 370 class = (class_datum_t *) datum; 371 state = (expand_state_t *) data; 372 373 if (!is_id_enabled(id, state->base, SYM_CLASSES)) { 374 /* identifier's scope is not enabled */ 375 return 0; 376 } 377 378 if (state->verbose) 379 INFO(state->handle, "copying class %s", id); 380 381 new_class = (class_datum_t *) malloc(sizeof(class_datum_t)); 382 if (!new_class) { 383 ERR(state->handle, "Out of memory!"); 384 return -1; 385 } 386 memset(new_class, 0, sizeof(class_datum_t)); 387 if (symtab_init(&new_class->permissions, PERM_SYMTAB_SIZE)) { 388 ERR(state->handle, "Out of memory!"); 389 free(new_class); 390 return -1; 391 } 392 393 new_class->s.value = class->s.value; 394 state->out->p_classes.nprim++; 395 396 new_id = strdup(id); 397 if (!new_id) { 398 ERR(state->handle, "Out of memory!"); 399 free(new_class); 400 return -1; 401 } 402 403 ret = 404 hashtab_insert(state->out->p_classes.table, new_id, 405 (hashtab_datum_t *) new_class); 406 if (ret) { 407 ERR(state->handle, "hashtab overflow"); 408 free(new_class); 409 free(new_id); 410 return -1; 411 } 412 413 if (hashtab_map 414 (class->permissions.table, perm_copy_callback, 415 &new_class->permissions)) { 416 ERR(state->handle, "hashtab overflow"); 417 return -1; 418 } 419 420 if (class->comkey) { 421 new_class->comkey = strdup(class->comkey); 422 if (!new_class->comkey) { 423 ERR(state->handle, "Out of memory!"); 424 return -1; 425 } 426 427 new_class->comdatum = 428 hashtab_search(state->out->p_commons.table, 429 new_class->comkey); 430 if (!new_class->comdatum) { 431 ERR(state->handle, "could not find common datum %s", 432 new_class->comkey); 433 return -1; 434 } 435 new_class->permissions.nprim += 436 new_class->comdatum->permissions.nprim; 437 } 438 439 return 0; 440} 441 442static int constraint_copy_callback(hashtab_key_t key, hashtab_datum_t datum, 443 void *data) 444{ 445 char *id; 446 class_datum_t *class, *new_class; 447 expand_state_t *state; 448 449 id = (char *)key; 450 class = (class_datum_t *) datum; 451 state = (expand_state_t *) data; 452 453 new_class = hashtab_search(state->out->p_classes.table, id); 454 if (!new_class) { 455 ERR(state->handle, "class %s vanished", id); 456 return -1; 457 } 458 459 /* constraints */ 460 if (constraint_node_clone 461 (&new_class->constraints, class->constraints, state) == -1 462 || constraint_node_clone(&new_class->validatetrans, 463 class->validatetrans, state) == -1) { 464 return -1; 465 } 466 return 0; 467} 468 469/* 470 * The boundaries have to be copied after the types/roles/users are copied, 471 * because it refers hashtab to lookup destinated objects. 472 */ 473static int type_bounds_copy_callback(hashtab_key_t key, 474 hashtab_datum_t datum, void *data) 475{ 476 expand_state_t *state = (expand_state_t *) data; 477 type_datum_t *type = (type_datum_t *) datum; 478 type_datum_t *dest; 479 uint32_t bounds_val; 480 481 if (!type->bounds) 482 return 0; 483 484 if (!is_id_enabled((char *)key, state->base, SYM_TYPES)) 485 return 0; 486 487 bounds_val = state->typemap[type->bounds - 1]; 488 489 dest = hashtab_search(state->out->p_types.table, (char *)key); 490 if (!dest) { 491 ERR(state->handle, "Type lookup failed for %s", (char *)key); 492 return -1; 493 } 494 if (dest->bounds != 0 && dest->bounds != bounds_val) { 495 ERR(state->handle, "Inconsistent boundary for %s", (char *)key); 496 return -1; 497 } 498 dest->bounds = bounds_val; 499 500 return 0; 501} 502 503static int role_bounds_copy_callback(hashtab_key_t key, 504 hashtab_datum_t datum, void *data) 505{ 506 expand_state_t *state = (expand_state_t *) data; 507 role_datum_t *role = (role_datum_t *) datum; 508 role_datum_t *dest; 509 uint32_t bounds_val; 510 511 if (!role->bounds) 512 return 0; 513 514 if (!is_id_enabled((char *)key, state->base, SYM_ROLES)) 515 return 0; 516 517 bounds_val = state->rolemap[role->bounds - 1]; 518 519 dest = hashtab_search(state->out->p_roles.table, (char *)key); 520 if (!dest) { 521 ERR(state->handle, "Role lookup failed for %s", (char *)key); 522 return -1; 523 } 524 if (dest->bounds != 0 && dest->bounds != bounds_val) { 525 ERR(state->handle, "Inconsistent boundary for %s", (char *)key); 526 return -1; 527 } 528 dest->bounds = bounds_val; 529 530 return 0; 531} 532 533static int user_bounds_copy_callback(hashtab_key_t key, 534 hashtab_datum_t datum, void *data) 535{ 536 expand_state_t *state = (expand_state_t *) data; 537 user_datum_t *user = (user_datum_t *) datum; 538 user_datum_t *dest; 539 uint32_t bounds_val; 540 541 if (!user->bounds) 542 return 0; 543 544 if (!is_id_enabled((char *)key, state->base, SYM_USERS)) 545 return 0; 546 547 bounds_val = state->usermap[user->bounds - 1]; 548 549 dest = hashtab_search(state->out->p_users.table, (char *)key); 550 if (!dest) { 551 ERR(state->handle, "User lookup failed for %s", (char *)key); 552 return -1; 553 } 554 if (dest->bounds != 0 && dest->bounds != bounds_val) { 555 ERR(state->handle, "Inconsistent boundary for %s", (char *)key); 556 return -1; 557 } 558 dest->bounds = bounds_val; 559 560 return 0; 561} 562 563/* The aliases have to be copied after the types and attributes to be certain that 564 * the out symbol table will have the type that the alias refers. Otherwise, we 565 * won't be able to find the type value for the alias. We can't depend on the 566 * declaration ordering because of the hash table. 567 */ 568static int alias_copy_callback(hashtab_key_t key, hashtab_datum_t datum, 569 void *data) 570{ 571 int ret; 572 char *id, *new_id; 573 type_datum_t *alias, *new_alias; 574 expand_state_t *state; 575 uint32_t prival; 576 577 id = (char *)key; 578 alias = (type_datum_t *) datum; 579 state = (expand_state_t *) data; 580 581 /* ignore regular types */ 582 if (alias->flavor == TYPE_TYPE && alias->primary) 583 return 0; 584 585 /* ignore attributes */ 586 if (alias->flavor == TYPE_ATTRIB) 587 return 0; 588 589 if (alias->flavor == TYPE_ALIAS) 590 prival = alias->primary; 591 else 592 prival = alias->s.value; 593 594 if (!is_id_enabled(state->base->p_type_val_to_name[prival - 1], 595 state->base, SYM_TYPES)) { 596 /* The primary type for this alias is not enabled, the alias 597 * shouldn't be either */ 598 return 0; 599 } 600 601 if (state->verbose) 602 INFO(state->handle, "copying alias %s", id); 603 604 new_id = strdup(id); 605 if (!new_id) { 606 ERR(state->handle, "Out of memory!"); 607 return -1; 608 } 609 610 new_alias = (type_datum_t *) malloc(sizeof(type_datum_t)); 611 if (!new_alias) { 612 ERR(state->handle, "Out of memory!"); 613 free(new_id); 614 return SEPOL_ENOMEM; 615 } 616 memset(new_alias, 0, sizeof(type_datum_t)); 617 if (alias->flavor == TYPE_TYPE) 618 new_alias->s.value = state->typemap[alias->s.value - 1]; 619 else if (alias->flavor == TYPE_ALIAS) 620 new_alias->s.value = state->typemap[alias->primary - 1]; 621 else 622 assert(0); /* unreachable */ 623 624 new_alias->flags = alias->flags; 625 626 ret = hashtab_insert(state->out->p_types.table, 627 (hashtab_key_t) new_id, 628 (hashtab_datum_t) new_alias); 629 630 if (ret) { 631 ERR(state->handle, "hashtab overflow"); 632 free(new_alias); 633 free(new_id); 634 return -1; 635 } 636 637 state->typemap[alias->s.value - 1] = new_alias->s.value; 638 639 if (new_alias->flags & TYPE_FLAGS_PERMISSIVE) 640 if (ebitmap_set_bit(&state->out->permissive_map, new_alias->s.value, 1)) { 641 ERR(state->handle, "Out of memory!"); 642 return -1; 643 } 644 645 return 0; 646} 647 648static int role_remap_dominates(hashtab_key_t key __attribute__ ((unused)), hashtab_datum_t datum, void *data) 649{ 650 ebitmap_t mapped_roles; 651 role_datum_t *role = (role_datum_t *) datum; 652 expand_state_t *state = (expand_state_t *) data; 653 654 if (map_ebitmap(&role->dominates, &mapped_roles, state->rolemap)) 655 return -1; 656 657 ebitmap_destroy(&role->dominates); 658 659 if (ebitmap_cpy(&role->dominates, &mapped_roles)) 660 return -1; 661 662 ebitmap_destroy(&mapped_roles); 663 664 return 0; 665} 666 667static int role_copy_callback(hashtab_key_t key, hashtab_datum_t datum, 668 void *data) 669{ 670 int ret; 671 char *id, *new_id; 672 role_datum_t *role; 673 role_datum_t *new_role; 674 expand_state_t *state; 675 ebitmap_t tmp_union_types; 676 677 id = key; 678 role = (role_datum_t *) datum; 679 state = (expand_state_t *) data; 680 681 if (strcmp(id, OBJECT_R) == 0) { 682 /* object_r is always value 1 */ 683 state->rolemap[role->s.value - 1] = 1; 684 return 0; 685 } 686 687 if (!is_id_enabled(id, state->base, SYM_ROLES)) { 688 /* identifier's scope is not enabled */ 689 return 0; 690 } 691 692 if (state->verbose) 693 INFO(state->handle, "copying role %s", id); 694 695 new_role = 696 (role_datum_t *) hashtab_search(state->out->p_roles.table, id); 697 if (!new_role) { 698 new_role = (role_datum_t *) malloc(sizeof(role_datum_t)); 699 if (!new_role) { 700 ERR(state->handle, "Out of memory!"); 701 return -1; 702 } 703 memset(new_role, 0, sizeof(role_datum_t)); 704 705 new_id = strdup(id); 706 if (!new_id) { 707 ERR(state->handle, "Out of memory!"); 708 return -1; 709 } 710 711 state->out->p_roles.nprim++; 712 new_role->s.value = state->out->p_roles.nprim; 713 state->rolemap[role->s.value - 1] = new_role->s.value; 714 ret = hashtab_insert(state->out->p_roles.table, 715 (hashtab_key_t) new_id, 716 (hashtab_datum_t) new_role); 717 718 if (ret) { 719 ERR(state->handle, "hashtab overflow"); 720 free(new_role); 721 free(new_id); 722 return -1; 723 } 724 } 725 726 /* The dominates bitmap is going to be wrong for the moment, 727 * we'll come back later and remap them, after we are sure all 728 * the roles have been added */ 729 if (ebitmap_union(&new_role->dominates, &role->dominates)) { 730 ERR(state->handle, "Out of memory!"); 731 return -1; 732 } 733 734 ebitmap_init(&tmp_union_types); 735 736 /* convert types in the role datum in the global symtab */ 737 if (expand_convert_type_set 738 (state->out, state->typemap, &role->types, &tmp_union_types, 1)) { 739 ebitmap_destroy(&tmp_union_types); 740 ERR(state->handle, "Out of memory!"); 741 return -1; 742 } 743 744 if (ebitmap_union(&new_role->types.types, &tmp_union_types)) { 745 ERR(state->handle, "Out of memory!"); 746 ebitmap_destroy(&tmp_union_types); 747 return -1; 748 } 749 ebitmap_destroy(&tmp_union_types); 750 751 return 0; 752} 753 754int mls_semantic_level_expand(mls_semantic_level_t * sl, mls_level_t * l, 755 policydb_t * p, sepol_handle_t * h) 756{ 757 mls_semantic_cat_t *cat; 758 level_datum_t *levdatum; 759 unsigned int i; 760 761 mls_level_init(l); 762 763 if (!p->mls) 764 return 0; 765 766 /* Required not declared. */ 767 if (!sl->sens) 768 return 0; 769 770 l->sens = sl->sens; 771 levdatum = (level_datum_t *) hashtab_search(p->p_levels.table, 772 p->p_sens_val_to_name[l-> 773 sens - 774 1]); 775 for (cat = sl->cat; cat; cat = cat->next) { 776 if (cat->low > cat->high) { 777 ERR(h, "Category range is not valid %s.%s", 778 p->p_cat_val_to_name[cat->low - 1], 779 p->p_cat_val_to_name[cat->high - 1]); 780 return -1; 781 } 782 for (i = cat->low - 1; i < cat->high; i++) { 783 if (!ebitmap_get_bit(&levdatum->level->cat, i)) { 784 ERR(h, "Category %s can not be associate with " 785 "level %s", 786 p->p_cat_val_to_name[i], 787 p->p_sens_val_to_name[l->sens - 1]); 788 } 789 if (ebitmap_set_bit(&l->cat, i, 1)) { 790 ERR(h, "Out of memory!"); 791 return -1; 792 } 793 } 794 } 795 796 return 0; 797} 798 799int mls_semantic_range_expand(mls_semantic_range_t * sr, mls_range_t * r, 800 policydb_t * p, sepol_handle_t * h) 801{ 802 if (mls_semantic_level_expand(&sr->level[0], &r->level[0], p, h) < 0) 803 return -1; 804 805 if (mls_semantic_level_expand(&sr->level[1], &r->level[1], p, h) < 0) { 806 mls_semantic_level_destroy(&sr->level[0]); 807 return -1; 808 } 809 810 if (!mls_level_dom(&r->level[1], &r->level[0])) { 811 mls_range_destroy(r); 812 ERR(h, "MLS range high level does not dominate low level"); 813 return -1; 814 } 815 816 return 0; 817} 818 819static int user_copy_callback(hashtab_key_t key, hashtab_datum_t datum, 820 void *data) 821{ 822 int ret; 823 expand_state_t *state; 824 user_datum_t *user; 825 user_datum_t *new_user; 826 char *id, *new_id; 827 ebitmap_t tmp_union; 828 829 id = key; 830 user = (user_datum_t *) datum; 831 state = (expand_state_t *) data; 832 833 if (!is_id_enabled(id, state->base, SYM_USERS)) { 834 /* identifier's scope is not enabled */ 835 return 0; 836 } 837 838 if (state->verbose) 839 INFO(state->handle, "copying user %s", id); 840 841 new_user = 842 (user_datum_t *) hashtab_search(state->out->p_users.table, id); 843 if (!new_user) { 844 new_user = (user_datum_t *) malloc(sizeof(user_datum_t)); 845 if (!new_user) { 846 ERR(state->handle, "Out of memory!"); 847 return -1; 848 } 849 memset(new_user, 0, sizeof(user_datum_t)); 850 851 state->out->p_users.nprim++; 852 new_user->s.value = state->out->p_users.nprim; 853 state->usermap[user->s.value - 1] = new_user->s.value; 854 855 new_id = strdup(id); 856 if (!new_id) { 857 ERR(state->handle, "Out of memory!"); 858 return -1; 859 } 860 ret = hashtab_insert(state->out->p_users.table, 861 (hashtab_key_t) new_id, 862 (hashtab_datum_t) new_user); 863 if (ret) { 864 ERR(state->handle, "hashtab overflow"); 865 user_datum_destroy(new_user); 866 free(new_user); 867 free(new_id); 868 return -1; 869 } 870 871 /* expand the semantic MLS info */ 872 if (mls_semantic_range_expand(&user->range, 873 &new_user->exp_range, 874 state->out, state->handle)) { 875 return -1; 876 } 877 if (mls_semantic_level_expand(&user->dfltlevel, 878 &new_user->exp_dfltlevel, 879 state->out, state->handle)) { 880 return -1; 881 } 882 if (!mls_level_between(&new_user->exp_dfltlevel, 883 &new_user->exp_range.level[0], 884 &new_user->exp_range.level[1])) { 885 ERR(state->handle, "default level not within user " 886 "range"); 887 return -1; 888 } 889 } else { 890 /* require that the MLS info match */ 891 mls_range_t tmp_range; 892 mls_level_t tmp_level; 893 894 if (mls_semantic_range_expand(&user->range, &tmp_range, 895 state->out, state->handle)) { 896 return -1; 897 } 898 if (mls_semantic_level_expand(&user->dfltlevel, &tmp_level, 899 state->out, state->handle)) { 900 mls_range_destroy(&tmp_range); 901 return -1; 902 } 903 if (!mls_range_eq(&new_user->exp_range, &tmp_range) || 904 !mls_level_eq(&new_user->exp_dfltlevel, &tmp_level)) { 905 mls_range_destroy(&tmp_range); 906 mls_level_destroy(&tmp_level); 907 return -1; 908 } 909 mls_range_destroy(&tmp_range); 910 mls_level_destroy(&tmp_level); 911 } 912 913 ebitmap_init(&tmp_union); 914 915 /* get global roles for this user */ 916 if (role_set_expand(&user->roles, &tmp_union, state->base, state->rolemap)) { 917 ERR(state->handle, "Out of memory!"); 918 ebitmap_destroy(&tmp_union); 919 return -1; 920 } 921 922 if (ebitmap_union(&new_user->roles.roles, &tmp_union)) { 923 ERR(state->handle, "Out of memory!"); 924 ebitmap_destroy(&tmp_union); 925 return -1; 926 } 927 ebitmap_destroy(&tmp_union); 928 929 return 0; 930} 931 932static int bool_copy_callback(hashtab_key_t key, hashtab_datum_t datum, 933 void *data) 934{ 935 int ret; 936 expand_state_t *state; 937 cond_bool_datum_t *bool, *new_bool; 938 char *id, *new_id; 939 940 id = key; 941 bool = (cond_bool_datum_t *) datum; 942 state = (expand_state_t *) data; 943 944 if (!is_id_enabled(id, state->base, SYM_BOOLS)) { 945 /* identifier's scope is not enabled */ 946 return 0; 947 } 948 949 if (state->verbose) 950 INFO(state->handle, "copying boolean %s", id); 951 952 new_bool = (cond_bool_datum_t *) malloc(sizeof(cond_bool_datum_t)); 953 if (!new_bool) { 954 ERR(state->handle, "Out of memory!"); 955 return -1; 956 } 957 958 new_id = strdup(id); 959 if (!new_id) { 960 ERR(state->handle, "Out of memory!"); 961 free(new_bool); 962 return -1; 963 } 964 965 state->out->p_bools.nprim++; 966 new_bool->s.value = state->out->p_bools.nprim; 967 968 ret = hashtab_insert(state->out->p_bools.table, 969 (hashtab_key_t) new_id, 970 (hashtab_datum_t) new_bool); 971 if (ret) { 972 ERR(state->handle, "hashtab overflow"); 973 free(new_bool); 974 free(new_id); 975 return -1; 976 } 977 978 state->boolmap[bool->s.value - 1] = new_bool->s.value; 979 980 new_bool->state = bool->state; 981 982 return 0; 983} 984 985static int sens_copy_callback(hashtab_key_t key, hashtab_datum_t datum, 986 void *data) 987{ 988 expand_state_t *state = (expand_state_t *) data; 989 level_datum_t *level = (level_datum_t *) datum, *new_level = NULL; 990 char *id = (char *)key, *new_id = NULL; 991 992 if (!is_id_enabled(id, state->base, SYM_LEVELS)) { 993 /* identifier's scope is not enabled */ 994 return 0; 995 } 996 997 if (state->verbose) 998 INFO(state->handle, "copying sensitivity level %s", id); 999 1000 new_level = (level_datum_t *) malloc(sizeof(level_datum_t)); 1001 if (!new_level) 1002 goto out_of_mem; 1003 level_datum_init(new_level); 1004 new_level->level = (mls_level_t *) malloc(sizeof(mls_level_t)); 1005 if (!new_level->level) 1006 goto out_of_mem; 1007 mls_level_init(new_level->level); 1008 new_id = strdup(id); 1009 if (!new_id) 1010 goto out_of_mem; 1011 1012 if (mls_level_cpy(new_level->level, level->level)) { 1013 goto out_of_mem; 1014 } 1015 new_level->isalias = level->isalias; 1016 state->out->p_levels.nprim++; 1017 1018 if (hashtab_insert(state->out->p_levels.table, 1019 (hashtab_key_t) new_id, 1020 (hashtab_datum_t) new_level)) { 1021 goto out_of_mem; 1022 } 1023 return 0; 1024 1025 out_of_mem: 1026 ERR(state->handle, "Out of memory!"); 1027 if (new_level != NULL && new_level->level != NULL) { 1028 mls_level_destroy(new_level->level); 1029 free(new_level->level); 1030 } 1031 level_datum_destroy(new_level); 1032 free(new_level); 1033 free(new_id); 1034 return -1; 1035} 1036 1037static int cats_copy_callback(hashtab_key_t key, hashtab_datum_t datum, 1038 void *data) 1039{ 1040 expand_state_t *state = (expand_state_t *) data; 1041 cat_datum_t *cat = (cat_datum_t *) datum, *new_cat = NULL; 1042 char *id = (char *)key, *new_id = NULL; 1043 1044 if (!is_id_enabled(id, state->base, SYM_CATS)) { 1045 /* identifier's scope is not enabled */ 1046 return 0; 1047 } 1048 1049 if (state->verbose) 1050 INFO(state->handle, "copying category attribute %s", id); 1051 1052 new_cat = (cat_datum_t *) malloc(sizeof(cat_datum_t)); 1053 if (!new_cat) 1054 goto out_of_mem; 1055 cat_datum_init(new_cat); 1056 new_id = strdup(id); 1057 if (!new_id) 1058 goto out_of_mem; 1059 1060 new_cat->s.value = cat->s.value; 1061 new_cat->isalias = cat->isalias; 1062 state->out->p_cats.nprim++; 1063 if (hashtab_insert(state->out->p_cats.table, 1064 (hashtab_key_t) new_id, (hashtab_datum_t) new_cat)) { 1065 goto out_of_mem; 1066 } 1067 1068 return 0; 1069 1070 out_of_mem: 1071 ERR(state->handle, "Out of memory!"); 1072 cat_datum_destroy(new_cat); 1073 free(new_cat); 1074 free(new_id); 1075 return -1; 1076} 1077 1078static int copy_role_allows(expand_state_t * state, role_allow_rule_t * rules) 1079{ 1080 unsigned int i, j; 1081 role_allow_t *cur_allow, *n, *l; 1082 role_allow_rule_t *cur; 1083 ebitmap_t roles, new_roles; 1084 ebitmap_node_t *snode, *tnode; 1085 1086 /* start at the end of the list */ 1087 for (l = state->out->role_allow; l && l->next; l = l->next) ; 1088 1089 cur = rules; 1090 while (cur) { 1091 ebitmap_init(&roles); 1092 ebitmap_init(&new_roles); 1093 1094 if (role_set_expand(&cur->roles, &roles, state->out, state->rolemap)) { 1095 ERR(state->handle, "Out of memory!"); 1096 return -1; 1097 } 1098 1099 if (role_set_expand(&cur->new_roles, &new_roles, state->out, state->rolemap)) { 1100 ERR(state->handle, "Out of memory!"); 1101 return -1; 1102 } 1103 1104 ebitmap_for_each_bit(&roles, snode, i) { 1105 if (!ebitmap_node_get_bit(snode, i)) 1106 continue; 1107 ebitmap_for_each_bit(&new_roles, tnode, j) { 1108 if (!ebitmap_node_get_bit(tnode, j)) 1109 continue; 1110 /* check for duplicates */ 1111 cur_allow = state->out->role_allow; 1112 while (cur_allow) { 1113 if ((cur_allow->role == i + 1) && 1114 (cur_allow->new_role == j + 1)) 1115 break; 1116 cur_allow = cur_allow->next; 1117 } 1118 if (cur_allow) 1119 continue; 1120 n = (role_allow_t *) 1121 malloc(sizeof(role_allow_t)); 1122 if (!n) { 1123 ERR(state->handle, "Out of memory!"); 1124 return -1; 1125 } 1126 memset(n, 0, sizeof(role_allow_t)); 1127 n->role = i + 1; 1128 n->new_role = j + 1; 1129 if (l) { 1130 l->next = n; 1131 } else { 1132 state->out->role_allow = n; 1133 } 1134 l = n; 1135 } 1136 } 1137 1138 ebitmap_destroy(&roles); 1139 ebitmap_destroy(&new_roles); 1140 1141 cur = cur->next; 1142 } 1143 1144 return 0; 1145} 1146 1147static int copy_role_trans(expand_state_t * state, role_trans_rule_t * rules) 1148{ 1149 unsigned int i, j; 1150 role_trans_t *n, *l, *cur_trans; 1151 role_trans_rule_t *cur; 1152 ebitmap_t roles, types; 1153 ebitmap_node_t *rnode, *tnode; 1154 1155 /* start at the end of the list */ 1156 for (l = state->out->role_tr; l && l->next; l = l->next) ; 1157 1158 cur = rules; 1159 while (cur) { 1160 ebitmap_init(&roles); 1161 ebitmap_init(&types); 1162 1163 if (role_set_expand(&cur->roles, &roles, state->out, state->rolemap)) { 1164 ERR(state->handle, "Out of memory!"); 1165 return -1; 1166 } 1167 if (expand_convert_type_set 1168 (state->out, state->typemap, &cur->types, &types, 1)) { 1169 ERR(state->handle, "Out of memory!"); 1170 return -1; 1171 } 1172 ebitmap_for_each_bit(&roles, rnode, i) { 1173 if (!ebitmap_node_get_bit(rnode, i)) 1174 continue; 1175 ebitmap_for_each_bit(&types, tnode, j) { 1176 if (!ebitmap_node_get_bit(tnode, j)) 1177 continue; 1178 1179 cur_trans = state->out->role_tr; 1180 while (cur_trans) { 1181 if ((cur_trans->role == i + 1) && 1182 (cur_trans->type == j + 1)) { 1183 if (cur_trans->new_role == 1184 cur->new_role) { 1185 break; 1186 } else { 1187 ERR(state->handle, 1188 "Conflicting role trans rule %s %s : %s", 1189 state->out-> 1190 p_role_val_to_name 1191 [i], 1192 state->out-> 1193 p_type_val_to_name 1194 [j], 1195 state->out-> 1196 p_role_val_to_name 1197 [cur->new_role - 1198 1]); 1199 return -1; 1200 } 1201 } 1202 cur_trans = cur_trans->next; 1203 } 1204 if (cur_trans) 1205 continue; 1206 1207 n = (role_trans_t *) 1208 malloc(sizeof(role_trans_t)); 1209 if (!n) { 1210 ERR(state->handle, "Out of memory!"); 1211 return -1; 1212 } 1213 memset(n, 0, sizeof(role_trans_t)); 1214 n->role = i + 1; 1215 n->type = j + 1; 1216 n->new_role = state->rolemap[cur->new_role - 1]; 1217 if (l) { 1218 l->next = n; 1219 } else { 1220 state->out->role_tr = n; 1221 } 1222 l = n; 1223 } 1224 } 1225 1226 ebitmap_destroy(&roles); 1227 ebitmap_destroy(&types); 1228 1229 cur = cur->next; 1230 } 1231 return 0; 1232} 1233 1234static int exp_rangetr_helper(uint32_t stype, uint32_t ttype, uint32_t tclass, 1235 mls_semantic_range_t * trange, 1236 expand_state_t * state) 1237{ 1238 range_trans_t *rt, *check_rt = state->out->range_tr; 1239 mls_range_t exp_range; 1240 int rc = -1; 1241 1242 if (mls_semantic_range_expand(trange, &exp_range, state->out, 1243 state->handle)) 1244 goto out; 1245 1246 /* check for duplicates/conflicts */ 1247 while (check_rt) { 1248 if ((check_rt->source_type == stype) && 1249 (check_rt->target_type == ttype) && 1250 (check_rt->target_class == tclass)) { 1251 if (mls_range_eq(&check_rt->target_range, &exp_range)) { 1252 /* duplicate */ 1253 break; 1254 } else { 1255 /* conflict */ 1256 ERR(state->handle, 1257 "Conflicting range trans rule %s %s : %s", 1258 state->out->p_type_val_to_name[stype - 1], 1259 state->out->p_type_val_to_name[ttype - 1], 1260 state->out->p_class_val_to_name[tclass - 1261 1]); 1262 goto out; 1263 } 1264 } 1265 check_rt = check_rt->next; 1266 } 1267 if (check_rt) { 1268 /* this is a dup - skip */ 1269 rc = 0; 1270 goto out; 1271 } 1272 1273 rt = (range_trans_t *) calloc(1, sizeof(range_trans_t)); 1274 if (!rt) { 1275 ERR(state->handle, "Out of memory!"); 1276 goto out; 1277 } 1278 1279 rt->next = state->out->range_tr; 1280 state->out->range_tr = rt; 1281 1282 rt->source_type = stype; 1283 rt->target_type = ttype; 1284 rt->target_class = tclass; 1285 if (mls_range_cpy(&rt->target_range, &exp_range)) { 1286 ERR(state->handle, "Out of memory!"); 1287 goto out; 1288 } 1289 1290 rc = 0; 1291 1292 out: 1293 mls_range_destroy(&exp_range); 1294 return rc; 1295} 1296 1297static int expand_range_trans(expand_state_t * state, 1298 range_trans_rule_t * rules) 1299{ 1300 unsigned int i, j, k; 1301 range_trans_rule_t *rule; 1302 1303 ebitmap_t stypes, ttypes; 1304 ebitmap_node_t *snode, *tnode, *cnode; 1305 1306 if (state->verbose) 1307 INFO(state->handle, "expanding range transitions"); 1308 1309 for (rule = rules; rule; rule = rule->next) { 1310 ebitmap_init(&stypes); 1311 ebitmap_init(&ttypes); 1312 1313 /* expand the type sets */ 1314 if (expand_convert_type_set(state->out, state->typemap, 1315 &rule->stypes, &stypes, 1)) { 1316 ERR(state->handle, "Out of memory!"); 1317 return -1; 1318 } 1319 if (expand_convert_type_set(state->out, state->typemap, 1320 &rule->ttypes, &ttypes, 1)) { 1321 ebitmap_destroy(&stypes); 1322 ERR(state->handle, "Out of memory!"); 1323 return -1; 1324 } 1325 1326 /* loop on source type */ 1327 ebitmap_for_each_bit(&stypes, snode, i) { 1328 if (!ebitmap_node_get_bit(snode, i)) 1329 continue; 1330 /* loop on target type */ 1331 ebitmap_for_each_bit(&ttypes, tnode, j) { 1332 if (!ebitmap_node_get_bit(tnode, j)) 1333 continue; 1334 /* loop on target class */ 1335 ebitmap_for_each_bit(&rule->tclasses, cnode, k) { 1336 if (!ebitmap_node_get_bit(cnode, k)) 1337 continue; 1338 1339 if (exp_rangetr_helper(i + 1, 1340 j + 1, 1341 k + 1, 1342 &rule->trange, 1343 state)) { 1344 ebitmap_destroy(&stypes); 1345 ebitmap_destroy(&ttypes); 1346 return -1; 1347 } 1348 } 1349 } 1350 } 1351 1352 ebitmap_destroy(&stypes); 1353 ebitmap_destroy(&ttypes); 1354 } 1355 1356 return 0; 1357} 1358 1359/* Search for an AV tab node within a hash table with the given key. 1360 * If the node does not exist, create it and return it; otherwise 1361 * return the pre-existing one. 1362*/ 1363static avtab_ptr_t find_avtab_node(sepol_handle_t * handle, 1364 avtab_t * avtab, avtab_key_t * key, 1365 cond_av_list_t ** cond) 1366{ 1367 avtab_ptr_t node; 1368 avtab_datum_t avdatum; 1369 cond_av_list_t *nl; 1370 1371 node = avtab_search_node(avtab, key); 1372 1373 /* If this is for conditional policies, keep searching in case 1374 the node is part of my conditional avtab. */ 1375 if (cond) { 1376 while (node) { 1377 if (node->parse_context == cond) 1378 break; 1379 node = avtab_search_node_next(node, key->specified); 1380 } 1381 } 1382 1383 if (!node) { 1384 memset(&avdatum, 0, sizeof avdatum); 1385 /* this is used to get the node - insertion is actually unique */ 1386 node = avtab_insert_nonunique(avtab, key, &avdatum); 1387 if (!node) { 1388 ERR(handle, "hash table overflow"); 1389 return NULL; 1390 } 1391 if (cond) { 1392 node->parse_context = cond; 1393 nl = (cond_av_list_t *) malloc(sizeof(cond_av_list_t)); 1394 if (!nl) { 1395 ERR(handle, "Memory error"); 1396 return NULL; 1397 } 1398 memset(nl, 0, sizeof(cond_av_list_t)); 1399 nl->node = node; 1400 nl->next = *cond; 1401 *cond = nl; 1402 } 1403 } 1404 1405 return node; 1406} 1407 1408#define EXPAND_RULE_SUCCESS 1 1409#define EXPAND_RULE_CONFLICT 0 1410#define EXPAND_RULE_ERROR -1 1411 1412static int expand_terule_helper(sepol_handle_t * handle, 1413 policydb_t * p, uint32_t * typemap, 1414 uint32_t specified, cond_av_list_t ** cond, 1415 cond_av_list_t ** other, uint32_t stype, 1416 uint32_t ttype, class_perm_node_t * perms, 1417 avtab_t * avtab, int enabled) 1418{ 1419 avtab_key_t avkey; 1420 avtab_datum_t *avdatump; 1421 avtab_ptr_t node; 1422 class_perm_node_t *cur; 1423 int conflict; 1424 uint32_t oldtype = 0, spec = 0; 1425 1426 if (specified & AVRULE_TRANSITION) { 1427 spec = AVTAB_TRANSITION; 1428 } else if (specified & AVRULE_MEMBER) { 1429 spec = AVTAB_MEMBER; 1430 } else if (specified & AVRULE_CHANGE) { 1431 spec = AVTAB_CHANGE; 1432 } else { 1433 assert(0); /* unreachable */ 1434 } 1435 1436 cur = perms; 1437 while (cur) { 1438 uint32_t remapped_data = 1439 typemap ? typemap[cur->data - 1] : cur->data; 1440 avkey.source_type = stype + 1; 1441 avkey.target_type = ttype + 1; 1442 avkey.target_class = cur->class; 1443 avkey.specified = spec; 1444 1445 conflict = 0; 1446 /* check to see if the expanded TE already exists -- 1447 * either in the global scope or in another 1448 * conditional AV tab */ 1449 node = avtab_search_node(&p->te_avtab, &avkey); 1450 if (node) { 1451 conflict = 1; 1452 } else { 1453 node = avtab_search_node(&p->te_cond_avtab, &avkey); 1454 if (node && node->parse_context != other) { 1455 conflict = 2; 1456 } 1457 } 1458 1459 if (conflict) { 1460 avdatump = &node->datum; 1461 if (specified & AVRULE_TRANSITION) { 1462 oldtype = avdatump->data; 1463 } else if (specified & AVRULE_MEMBER) { 1464 oldtype = avdatump->data; 1465 } else if (specified & AVRULE_CHANGE) { 1466 oldtype = avdatump->data; 1467 } 1468 1469 if (oldtype == remapped_data) { 1470 /* if the duplicate is inside the same scope (eg., unconditional 1471 * or in same conditional then ignore it */ 1472 if ((conflict == 1 && cond == NULL) 1473 || node->parse_context == cond) 1474 return EXPAND_RULE_SUCCESS; 1475 ERR(handle, "duplicate TE rule for %s %s:%s %s", 1476 p->p_type_val_to_name[avkey.source_type - 1477 1], 1478 p->p_type_val_to_name[avkey.target_type - 1479 1], 1480 p->p_class_val_to_name[avkey.target_class - 1481 1], 1482 p->p_type_val_to_name[oldtype - 1]); 1483 return EXPAND_RULE_CONFLICT; 1484 } 1485 ERR(handle, 1486 "conflicting TE rule for (%s, %s:%s): old was %s, new is %s", 1487 p->p_type_val_to_name[avkey.source_type - 1], 1488 p->p_type_val_to_name[avkey.target_type - 1], 1489 p->p_class_val_to_name[avkey.target_class - 1], 1490 p->p_type_val_to_name[oldtype - 1], 1491 p->p_type_val_to_name[remapped_data - 1]); 1492 return EXPAND_RULE_CONFLICT; 1493 } 1494 1495 node = find_avtab_node(handle, avtab, &avkey, cond); 1496 if (!node) 1497 return -1; 1498 if (enabled) { 1499 node->key.specified |= AVTAB_ENABLED; 1500 } else { 1501 node->key.specified &= ~AVTAB_ENABLED; 1502 } 1503 1504 avdatump = &node->datum; 1505 if (specified & AVRULE_TRANSITION) { 1506 avdatump->data = remapped_data; 1507 } else if (specified & AVRULE_MEMBER) { 1508 avdatump->data = remapped_data; 1509 } else if (specified & AVRULE_CHANGE) { 1510 avdatump->data = remapped_data; 1511 } else { 1512 assert(0); /* should never occur */ 1513 } 1514 1515 cur = cur->next; 1516 } 1517 1518 return EXPAND_RULE_SUCCESS; 1519} 1520 1521static int expand_avrule_helper(sepol_handle_t * handle, 1522 uint32_t specified, 1523 cond_av_list_t ** cond, 1524 uint32_t stype, uint32_t ttype, 1525 class_perm_node_t * perms, avtab_t * avtab, 1526 int enabled) 1527{ 1528 avtab_key_t avkey; 1529 avtab_datum_t *avdatump; 1530 avtab_ptr_t node; 1531 class_perm_node_t *cur; 1532 uint32_t spec = 0; 1533 1534 if (specified & AVRULE_ALLOWED) { 1535 spec = AVTAB_ALLOWED; 1536 } else if (specified & AVRULE_AUDITALLOW) { 1537 spec = AVTAB_AUDITALLOW; 1538 } else if (specified & AVRULE_AUDITDENY) { 1539 spec = AVTAB_AUDITDENY; 1540 } else if (specified & AVRULE_DONTAUDIT) { 1541 if (handle && handle->disable_dontaudit) 1542 return EXPAND_RULE_SUCCESS; 1543 spec = AVTAB_AUDITDENY; 1544 } else if (specified & AVRULE_NEVERALLOW) { 1545 spec = AVTAB_NEVERALLOW; 1546 } else { 1547 assert(0); /* unreachable */ 1548 } 1549 1550 cur = perms; 1551 while (cur) { 1552 avkey.source_type = stype + 1; 1553 avkey.target_type = ttype + 1; 1554 avkey.target_class = cur->class; 1555 avkey.specified = spec; 1556 1557 node = find_avtab_node(handle, avtab, &avkey, cond); 1558 if (!node) 1559 return EXPAND_RULE_ERROR; 1560 if (enabled) { 1561 node->key.specified |= AVTAB_ENABLED; 1562 } else { 1563 node->key.specified &= ~AVTAB_ENABLED; 1564 } 1565 1566 avdatump = &node->datum; 1567 if (specified & AVRULE_ALLOWED) { 1568 avdatump->data |= cur->data; 1569 } else if (specified & AVRULE_AUDITALLOW) { 1570 avdatump->data |= cur->data; 1571 } else if (specified & AVRULE_NEVERALLOW) { 1572 avdatump->data |= cur->data; 1573 } else if (specified & AVRULE_AUDITDENY) { 1574 /* Since a '0' in an auditdeny mask represents 1575 * a permission we do NOT want to audit 1576 * (dontaudit), we use the '&' operand to 1577 * ensure that all '0's in the mask are 1578 * retained (much unlike the allow and 1579 * auditallow cases). 1580 */ 1581 avdatump->data &= cur->data; 1582 } else if (specified & AVRULE_DONTAUDIT) { 1583 if (avdatump->data) 1584 avdatump->data &= ~cur->data; 1585 else 1586 avdatump->data = ~cur->data; 1587 } else { 1588 assert(0); /* should never occur */ 1589 } 1590 1591 cur = cur->next; 1592 } 1593 return EXPAND_RULE_SUCCESS; 1594} 1595 1596static int expand_rule_helper(sepol_handle_t * handle, 1597 policydb_t * p, uint32_t * typemap, 1598 avrule_t * source_rule, avtab_t * dest_avtab, 1599 cond_av_list_t ** cond, cond_av_list_t ** other, 1600 int enabled, 1601 ebitmap_t * stypes, ebitmap_t * ttypes) 1602{ 1603 unsigned int i, j; 1604 int retval; 1605 ebitmap_node_t *snode, *tnode; 1606 1607 ebitmap_for_each_bit(stypes, snode, i) { 1608 if (!ebitmap_node_get_bit(snode, i)) 1609 continue; 1610 if (source_rule->flags & RULE_SELF) { 1611 if (source_rule->specified & AVRULE_AV) { 1612 if ((retval = 1613 expand_avrule_helper(handle, 1614 source_rule-> 1615 specified, cond, i, i, 1616 source_rule->perms, 1617 dest_avtab, 1618 enabled)) != 1619 EXPAND_RULE_SUCCESS) { 1620 return retval; 1621 } 1622 } else { 1623 if ((retval = 1624 expand_terule_helper(handle, p, 1625 typemap, 1626 source_rule-> 1627 specified, cond, 1628 other, i, i, 1629 source_rule->perms, 1630 dest_avtab, 1631 enabled)) != 1632 EXPAND_RULE_SUCCESS) { 1633 return retval; 1634 } 1635 } 1636 } 1637 ebitmap_for_each_bit(ttypes, tnode, j) { 1638 if (!ebitmap_node_get_bit(tnode, j)) 1639 continue; 1640 if (source_rule->specified & AVRULE_AV) { 1641 if ((retval = 1642 expand_avrule_helper(handle, 1643 source_rule-> 1644 specified, cond, i, j, 1645 source_rule->perms, 1646 dest_avtab, 1647 enabled)) != 1648 EXPAND_RULE_SUCCESS) { 1649 return retval; 1650 } 1651 } else { 1652 if ((retval = 1653 expand_terule_helper(handle, p, 1654 typemap, 1655 source_rule-> 1656 specified, cond, 1657 other, i, j, 1658 source_rule->perms, 1659 dest_avtab, 1660 enabled)) != 1661 EXPAND_RULE_SUCCESS) { 1662 return retval; 1663 } 1664 } 1665 } 1666 } 1667 1668 return EXPAND_RULE_SUCCESS; 1669} 1670 1671/* 1672 * Expand a rule into a given avtab - checking for conflicting type 1673 * rules in the destination policy. Return EXPAND_RULE_SUCCESS on 1674 * success, EXPAND_RULE_CONFLICT if the rule conflicts with something 1675 * (and hence was not added), or EXPAND_RULE_ERROR on error. 1676 */ 1677static int convert_and_expand_rule(sepol_handle_t * handle, 1678 policydb_t * dest_pol, uint32_t * typemap, 1679 avrule_t * source_rule, avtab_t * dest_avtab, 1680 cond_av_list_t ** cond, 1681 cond_av_list_t ** other, int enabled, 1682 int do_neverallow) 1683{ 1684 int retval; 1685 ebitmap_t stypes, ttypes; 1686 unsigned char alwaysexpand; 1687 1688 if (!do_neverallow && source_rule->specified & AVRULE_NEVERALLOW) 1689 return EXPAND_RULE_SUCCESS; 1690 1691 ebitmap_init(&stypes); 1692 ebitmap_init(&ttypes); 1693 1694 /* Force expansion for type rules and for self rules. */ 1695 alwaysexpand = ((source_rule->specified & AVRULE_TYPE) || 1696 (source_rule->flags & RULE_SELF)); 1697 1698 if (expand_convert_type_set 1699 (dest_pol, typemap, &source_rule->stypes, &stypes, alwaysexpand)) 1700 return EXPAND_RULE_ERROR; 1701 if (expand_convert_type_set 1702 (dest_pol, typemap, &source_rule->ttypes, &ttypes, alwaysexpand)) 1703 return EXPAND_RULE_ERROR; 1704 1705 retval = expand_rule_helper(handle, dest_pol, typemap, 1706 source_rule, dest_avtab, 1707 cond, other, enabled, &stypes, &ttypes); 1708 ebitmap_destroy(&stypes); 1709 ebitmap_destroy(&ttypes); 1710 return retval; 1711} 1712 1713static int cond_avrule_list_copy(policydb_t * dest_pol, avrule_t * source_rules, 1714 avtab_t * dest_avtab, cond_av_list_t ** list, 1715 cond_av_list_t ** other, uint32_t * typemap, 1716 int enabled, expand_state_t * state) 1717{ 1718 avrule_t *cur; 1719 1720 cur = source_rules; 1721 while (cur) { 1722 if (convert_and_expand_rule(state->handle, dest_pol, 1723 typemap, cur, dest_avtab, 1724 list, other, enabled, 1725 0) != EXPAND_RULE_SUCCESS) { 1726 return -1; 1727 } 1728 1729 cur = cur->next; 1730 } 1731 1732 return 0; 1733} 1734 1735static int cond_node_map_bools(expand_state_t * state, cond_node_t * cn) 1736{ 1737 cond_expr_t *cur; 1738 unsigned int i; 1739 1740 cur = cn->expr; 1741 while (cur) { 1742 if (cur->bool) 1743 cur->bool = state->boolmap[cur->bool - 1]; 1744 cur = cur->next; 1745 } 1746 1747 for (i = 0; i < min(cn->nbools, COND_MAX_BOOLS); i++) 1748 cn->bool_ids[i] = state->boolmap[cn->bool_ids[i] - 1]; 1749 1750 if (cond_normalize_expr(state->out, cn)) { 1751 ERR(state->handle, "Error while normalizing conditional"); 1752 return -1; 1753 } 1754 1755 return 0; 1756} 1757 1758/* copy the nodes in *reverse* order -- the result is that the last 1759 * given conditional appears first in the policy, so as to match the 1760 * behavior of the upstream compiler */ 1761static int cond_node_copy(expand_state_t * state, cond_node_t * cn) 1762{ 1763 cond_node_t *new_cond, *tmp; 1764 1765 if (cn == NULL) { 1766 return 0; 1767 } 1768 if (cond_node_copy(state, cn->next)) { 1769 return -1; 1770 } 1771 if (cond_normalize_expr(state->base, cn)) { 1772 ERR(state->handle, "Error while normalizing conditional"); 1773 return -1; 1774 } 1775 1776 /* create a new temporary conditional node with the booleans 1777 * mapped */ 1778 tmp = cond_node_create(state->base, cn); 1779 if (!tmp) { 1780 ERR(state->handle, "Out of memory"); 1781 return -1; 1782 } 1783 1784 if (cond_node_map_bools(state, tmp)) { 1785 ERR(state->handle, "Error mapping booleans"); 1786 return -1; 1787 } 1788 1789 new_cond = cond_node_search(state->out, state->out->cond_list, tmp); 1790 if (!new_cond) { 1791 cond_node_destroy(tmp); 1792 free(tmp); 1793 ERR(state->handle, "Out of memory!"); 1794 return -1; 1795 } 1796 cond_node_destroy(tmp); 1797 free(tmp); 1798 1799 if (cond_avrule_list_copy 1800 (state->out, cn->avtrue_list, &state->out->te_cond_avtab, 1801 &new_cond->true_list, &new_cond->false_list, state->typemap, 1802 new_cond->cur_state, state)) 1803 return -1; 1804 if (cond_avrule_list_copy 1805 (state->out, cn->avfalse_list, &state->out->te_cond_avtab, 1806 &new_cond->false_list, &new_cond->true_list, state->typemap, 1807 !new_cond->cur_state, state)) 1808 return -1; 1809 1810 return 0; 1811} 1812 1813static int context_copy(context_struct_t * dst, context_struct_t * src, 1814 expand_state_t * state) 1815{ 1816 dst->user = state->usermap[src->user - 1]; 1817 dst->role = state->rolemap[src->role - 1]; 1818 dst->type = state->typemap[src->type - 1]; 1819 return mls_context_cpy(dst, src); 1820} 1821 1822static int ocontext_copy_xen(expand_state_t *state) 1823{ 1824 unsigned int i; 1825 ocontext_t *c, *n, *l; 1826 1827 for (i = 0; i < OCON_NUM; i++) { 1828 l = NULL; 1829 for (c = state->base->ocontexts[i]; c; c = c->next) { 1830 n = malloc(sizeof(ocontext_t)); 1831 if (!n) { 1832 ERR(state->handle, "Out of memory!"); 1833 return -1; 1834 } 1835 memset(n, 0, sizeof(ocontext_t)); 1836 if (l) 1837 l->next = n; 1838 else 1839 state->out->ocontexts[i] = n; 1840 l = n; 1841 if (context_copy(&n->context[0], &c->context[0], 1842 state)) { 1843 ERR(state->handle, "Out of memory!"); 1844 return -1; 1845 } 1846 switch (i) { 1847 case OCON_XEN_ISID: 1848 n->sid[0] = c->sid[0]; 1849 break; 1850 case OCON_XEN_PIRQ: 1851 n->u.pirq = c->u.pirq; 1852 break; 1853 case OCON_XEN_IOPORT: 1854 n->u.ioport.low_ioport = c->u.ioport.low_ioport; 1855 n->u.ioport.high_ioport = 1856 c->u.ioport.high_ioport; 1857 break; 1858 case OCON_XEN_IOMEM: 1859 n->u.iomem.low_iomem = c->u.iomem.low_iomem; 1860 n->u.iomem.high_iomem = c->u.iomem.high_iomem; 1861 break; 1862 case OCON_XEN_PCIDEVICE: 1863 n->u.device = c->u.device; 1864 break; 1865 default: 1866 /* shouldn't get here */ 1867 ERR(state->handle, "Unknown ocontext"); 1868 return -1; 1869 } 1870 } 1871 } 1872 return 0; 1873} 1874 1875static int ocontext_copy_selinux(expand_state_t *state) 1876{ 1877 unsigned int i, j; 1878 ocontext_t *c, *n, *l; 1879 1880 for (i = 0; i < OCON_NUM; i++) { 1881 l = NULL; 1882 for (c = state->base->ocontexts[i]; c; c = c->next) { 1883 n = malloc(sizeof(ocontext_t)); 1884 if (!n) { 1885 ERR(state->handle, "Out of memory!"); 1886 return -1; 1887 } 1888 memset(n, 0, sizeof(ocontext_t)); 1889 if (l) 1890 l->next = n; 1891 else 1892 state->out->ocontexts[i] = n; 1893 l = n; 1894 if (context_copy(&n->context[0], &c->context[0], state)) { 1895 ERR(state->handle, "Out of memory!"); 1896 return -1; 1897 } 1898 switch (i) { 1899 case OCON_ISID: 1900 n->sid[0] = c->sid[0]; 1901 break; 1902 case OCON_FS: /* FALLTHROUGH */ 1903 case OCON_NETIF: 1904 n->u.name = strdup(c->u.name); 1905 if (!n->u.name) { 1906 ERR(state->handle, "Out of memory!"); 1907 return -1; 1908 } 1909 if (context_copy 1910 (&n->context[1], &c->context[1], state)) { 1911 ERR(state->handle, "Out of memory!"); 1912 return -1; 1913 } 1914 break; 1915 case OCON_PORT: 1916 n->u.port.protocol = c->u.port.protocol; 1917 n->u.port.low_port = c->u.port.low_port; 1918 n->u.port.high_port = c->u.port.high_port; 1919 break; 1920 case OCON_NODE: 1921 n->u.node.addr = c->u.node.addr; 1922 n->u.node.mask = c->u.node.mask; 1923 break; 1924 case OCON_FSUSE: 1925 n->v.behavior = c->v.behavior; 1926 n->u.name = strdup(c->u.name); 1927 if (!n->u.name) { 1928 ERR(state->handle, "Out of memory!"); 1929 return -1; 1930 } 1931 break; 1932 case OCON_NODE6: 1933 for (j = 0; j < 4; j++) 1934 n->u.node6.addr[j] = c->u.node6.addr[j]; 1935 for (j = 0; j < 4; j++) 1936 n->u.node6.mask[j] = c->u.node6.mask[j]; 1937 break; 1938 default: 1939 /* shouldn't get here */ 1940 ERR(state->handle, "Unknown ocontext"); 1941 return -1; 1942 } 1943 } 1944 } 1945 return 0; 1946} 1947 1948static int ocontext_copy(expand_state_t *state, uint32_t target) 1949{ 1950 int rc = -1; 1951 switch (target) { 1952 case SEPOL_TARGET_SELINUX: 1953 rc = ocontext_copy_selinux(state); 1954 break; 1955 case SEPOL_TARGET_XEN: 1956 rc = ocontext_copy_xen(state); 1957 break; 1958 default: 1959 ERR(state->handle, "Unknown target"); 1960 return -1; 1961 } 1962 return rc; 1963} 1964 1965static int genfs_copy(expand_state_t * state) 1966{ 1967 ocontext_t *c, *newc, *l; 1968 genfs_t *genfs, *newgenfs, *end; 1969 1970 end = NULL; 1971 for (genfs = state->base->genfs; genfs; genfs = genfs->next) { 1972 newgenfs = malloc(sizeof(genfs_t)); 1973 if (!newgenfs) { 1974 ERR(state->handle, "Out of memory!"); 1975 return -1; 1976 } 1977 memset(newgenfs, 0, sizeof(genfs_t)); 1978 newgenfs->fstype = strdup(genfs->fstype); 1979 if (!newgenfs->fstype) { 1980 ERR(state->handle, "Out of memory!"); 1981 return -1; 1982 } 1983 1984 l = NULL; 1985 for (c = genfs->head; c; c = c->next) { 1986 newc = malloc(sizeof(ocontext_t)); 1987 if (!newc) { 1988 ERR(state->handle, "Out of memory!"); 1989 return -1; 1990 } 1991 memset(newc, 0, sizeof(ocontext_t)); 1992 newc->u.name = strdup(c->u.name); 1993 if (!newc->u.name) { 1994 ERR(state->handle, "Out of memory!"); 1995 return -1; 1996 } 1997 newc->v.sclass = c->v.sclass; 1998 context_copy(&newc->context[0], &c->context[0], state); 1999 if (l) 2000 l->next = newc; 2001 else 2002 newgenfs->head = newc; 2003 l = newc; 2004 } 2005 if (!end) { 2006 state->out->genfs = newgenfs; 2007 } else { 2008 end->next = newgenfs; 2009 } 2010 end = newgenfs; 2011 } 2012 return 0; 2013} 2014 2015static int type_attr_map(hashtab_key_t key 2016 __attribute__ ((unused)), hashtab_datum_t datum, 2017 void *ptr) 2018{ 2019 type_datum_t *type; 2020 expand_state_t *state = ptr; 2021 policydb_t *p = state->out; 2022 unsigned int i; 2023 ebitmap_node_t *tnode; 2024 2025 type = (type_datum_t *) datum; 2026 if (type->flavor == TYPE_ATTRIB) { 2027 if (ebitmap_cpy(&p->attr_type_map[type->s.value - 1], 2028 &type->types)) { 2029 ERR(state->handle, "Out of memory!"); 2030 return -1; 2031 } 2032 ebitmap_for_each_bit(&type->types, tnode, i) { 2033 if (!ebitmap_node_get_bit(tnode, i)) 2034 continue; 2035 if (ebitmap_set_bit(&p->type_attr_map[i], 2036 type->s.value - 1, 1)) { 2037 ERR(state->handle, "Out of memory!"); 2038 return -1; 2039 } 2040 } 2041 } 2042 return 0; 2043} 2044 2045/* converts typeset using typemap and expands into ebitmap_t types using the attributes in the passed in policy. 2046 * this should not be called until after all the blocks have been processed and the attributes in target policy 2047 * are complete. */ 2048int expand_convert_type_set(policydb_t * p, uint32_t * typemap, 2049 type_set_t * set, ebitmap_t * types, 2050 unsigned char alwaysexpand) 2051{ 2052 type_set_t tmpset; 2053 2054 type_set_init(&tmpset); 2055 2056 if (map_ebitmap(&set->types, &tmpset.types, typemap)) 2057 return -1; 2058 2059 if (map_ebitmap(&set->negset, &tmpset.negset, typemap)) 2060 return -1; 2061 2062 tmpset.flags = set->flags; 2063 2064 if (type_set_expand(&tmpset, types, p, alwaysexpand)) 2065 return -1; 2066 2067 type_set_destroy(&tmpset); 2068 2069 return 0; 2070} 2071 2072/* Expand a rule into a given avtab - checking for conflicting type 2073 * rules. Return 1 on success, 0 if the rule conflicts with something 2074 * (and hence was not added), or -1 on error. */ 2075int expand_rule(sepol_handle_t * handle, 2076 policydb_t * source_pol, 2077 avrule_t * source_rule, avtab_t * dest_avtab, 2078 cond_av_list_t ** cond, cond_av_list_t ** other, int enabled) 2079{ 2080 int retval; 2081 ebitmap_t stypes, ttypes; 2082 2083 if (source_rule->specified & AVRULE_NEVERALLOW) 2084 return 1; 2085 2086 ebitmap_init(&stypes); 2087 ebitmap_init(&ttypes); 2088 2089 if (type_set_expand(&source_rule->stypes, &stypes, source_pol, 1)) 2090 return -1; 2091 if (type_set_expand(&source_rule->ttypes, &ttypes, source_pol, 1)) 2092 return -1; 2093 retval = expand_rule_helper(handle, source_pol, NULL, 2094 source_rule, dest_avtab, 2095 cond, other, enabled, &stypes, &ttypes); 2096 ebitmap_destroy(&stypes); 2097 ebitmap_destroy(&ttypes); 2098 return retval; 2099} 2100 2101int role_set_expand(role_set_t * x, ebitmap_t * r, policydb_t * p, uint32_t * rolemap) 2102{ 2103 unsigned int i; 2104 ebitmap_node_t *rnode; 2105 ebitmap_t mapped_roles; 2106 2107 ebitmap_init(r); 2108 ebitmap_init(&mapped_roles); 2109 2110 if (x->flags & ROLE_STAR) { 2111 for (i = 0; i < p->p_roles.nprim++; i++) 2112 if (ebitmap_set_bit(r, i, 1)) 2113 return -1; 2114 return 0; 2115 } 2116 2117 if (rolemap) { 2118 if (map_ebitmap(&x->roles, &mapped_roles, rolemap)) 2119 return -1; 2120 } else { 2121 if (ebitmap_cpy(&mapped_roles, &x->roles)) 2122 return -1; 2123 } 2124 2125 ebitmap_for_each_bit(&mapped_roles, rnode, i) { 2126 if (ebitmap_node_get_bit(rnode, i)) { 2127 if (ebitmap_set_bit(r, i, 1)) 2128 return -1; 2129 } 2130 } 2131 2132 ebitmap_destroy(&mapped_roles); 2133 2134 /* if role is to be complimented, invert the entire bitmap here */ 2135 if (x->flags & ROLE_COMP) { 2136 for (i = 0; i < ebitmap_length(r); i++) { 2137 if (ebitmap_get_bit(r, i)) { 2138 if (ebitmap_set_bit(r, i, 0)) 2139 return -1; 2140 } else { 2141 if (ebitmap_set_bit(r, i, 1)) 2142 return -1; 2143 } 2144 } 2145 } 2146 return 0; 2147} 2148 2149/* Expand a type set into an ebitmap containing the types. This 2150 * handles the negset, attributes, and flags. 2151 * Attribute expansion depends on several factors: 2152 * - if alwaysexpand is 1, then they will be expanded, 2153 * - if the type set has a negset or flags, then they will be expanded, 2154 * - otherwise, they will not be expanded. 2155 */ 2156int type_set_expand(type_set_t * set, ebitmap_t * t, policydb_t * p, 2157 unsigned char alwaysexpand) 2158{ 2159 unsigned int i; 2160 ebitmap_t types, neg_types; 2161 ebitmap_node_t *tnode; 2162 2163 ebitmap_init(&types); 2164 ebitmap_init(t); 2165 2166 if (alwaysexpand || ebitmap_length(&set->negset) || set->flags) { 2167 /* First go through the types and OR all the attributes to types */ 2168 ebitmap_for_each_bit(&set->types, tnode, i) { 2169 if (ebitmap_node_get_bit(tnode, i)) { 2170 if (p->type_val_to_struct[i]->flavor == 2171 TYPE_ATTRIB) { 2172 if (ebitmap_union 2173 (&types, 2174 &p->type_val_to_struct[i]-> 2175 types)) { 2176 return -1; 2177 } 2178 } else { 2179 if (ebitmap_set_bit(&types, i, 1)) { 2180 return -1; 2181 } 2182 } 2183 } 2184 } 2185 } else { 2186 /* No expansion of attributes, just copy the set as is. */ 2187 if (ebitmap_cpy(&types, &set->types)) 2188 return -1; 2189 } 2190 2191 /* Now do the same thing for negset */ 2192 ebitmap_init(&neg_types); 2193 ebitmap_for_each_bit(&set->negset, tnode, i) { 2194 if (ebitmap_node_get_bit(tnode, i)) { 2195 if (p->type_val_to_struct[i] && 2196 p->type_val_to_struct[i]->flavor == TYPE_ATTRIB) { 2197 if (ebitmap_union 2198 (&neg_types, 2199 &p->type_val_to_struct[i]->types)) { 2200 return -1; 2201 } 2202 } else { 2203 if (ebitmap_set_bit(&neg_types, i, 1)) { 2204 return -1; 2205 } 2206 } 2207 } 2208 } 2209 2210 if (set->flags & TYPE_STAR) { 2211 /* set all types not in neg_types */ 2212 for (i = 0; i < p->p_types.nprim; i++) { 2213 if (ebitmap_get_bit(&neg_types, i)) 2214 continue; 2215 if (p->type_val_to_struct[i] && 2216 p->type_val_to_struct[i]->flavor == TYPE_ATTRIB) 2217 continue; 2218 if (ebitmap_set_bit(t, i, 1)) 2219 return -1; 2220 } 2221 goto out; 2222 } 2223 2224 ebitmap_for_each_bit(&types, tnode, i) { 2225 if (ebitmap_node_get_bit(tnode, i) 2226 && (!ebitmap_get_bit(&neg_types, i))) 2227 if (ebitmap_set_bit(t, i, 1)) 2228 return -1; 2229 } 2230 2231 if (set->flags & TYPE_COMP) { 2232 for (i = 0; i < p->p_types.nprim; i++) { 2233 if (p->type_val_to_struct[i] && 2234 p->type_val_to_struct[i]->flavor == TYPE_ATTRIB) { 2235 assert(!ebitmap_get_bit(t, i)); 2236 continue; 2237 } 2238 if (ebitmap_get_bit(t, i)) { 2239 if (ebitmap_set_bit(t, i, 0)) 2240 return -1; 2241 } else { 2242 if (ebitmap_set_bit(t, i, 1)) 2243 return -1; 2244 } 2245 } 2246 } 2247 2248 out: 2249 2250 ebitmap_destroy(&types); 2251 ebitmap_destroy(&neg_types); 2252 2253 return 0; 2254} 2255 2256static int copy_neverallow(policydb_t * dest_pol, uint32_t * typemap, 2257 avrule_t * source_rule) 2258{ 2259 ebitmap_t stypes, ttypes; 2260 avrule_t *avrule; 2261 class_perm_node_t *cur_perm, *new_perm, *tail_perm; 2262 2263 ebitmap_init(&stypes); 2264 ebitmap_init(&ttypes); 2265 2266 if (expand_convert_type_set 2267 (dest_pol, typemap, &source_rule->stypes, &stypes, 1)) 2268 return -1; 2269 if (expand_convert_type_set 2270 (dest_pol, typemap, &source_rule->ttypes, &ttypes, 1)) 2271 return -1; 2272 2273 avrule = (avrule_t *) malloc(sizeof(avrule_t)); 2274 if (!avrule) 2275 return -1; 2276 2277 avrule_init(avrule); 2278 avrule->specified = AVRULE_NEVERALLOW; 2279 avrule->line = source_rule->line; 2280 avrule->flags = source_rule->flags; 2281 2282 if (ebitmap_cpy(&avrule->stypes.types, &stypes)) 2283 goto err; 2284 2285 if (ebitmap_cpy(&avrule->ttypes.types, &ttypes)) 2286 goto err; 2287 2288 cur_perm = source_rule->perms; 2289 tail_perm = NULL; 2290 while (cur_perm) { 2291 new_perm = 2292 (class_perm_node_t *) malloc(sizeof(class_perm_node_t)); 2293 if (!new_perm) 2294 goto err; 2295 class_perm_node_init(new_perm); 2296 new_perm->class = cur_perm->class; 2297 assert(new_perm->class); 2298 2299 /* once we have modules with permissions we'll need to map the permissions (and classes) */ 2300 new_perm->data = cur_perm->data; 2301 2302 if (!avrule->perms) 2303 avrule->perms = new_perm; 2304 2305 if (tail_perm) 2306 tail_perm->next = new_perm; 2307 tail_perm = new_perm; 2308 cur_perm = cur_perm->next; 2309 } 2310 2311 /* just prepend the avrule to the first branch; it'll never be 2312 written to disk */ 2313 if (!dest_pol->global->branch_list->avrules) 2314 dest_pol->global->branch_list->avrules = avrule; 2315 else { 2316 avrule->next = dest_pol->global->branch_list->avrules; 2317 dest_pol->global->branch_list->avrules = avrule; 2318 } 2319 2320 ebitmap_destroy(&stypes); 2321 ebitmap_destroy(&ttypes); 2322 2323 return 0; 2324 2325 err: 2326 ebitmap_destroy(&stypes); 2327 ebitmap_destroy(&ttypes); 2328 ebitmap_destroy(&avrule->stypes.types); 2329 ebitmap_destroy(&avrule->ttypes.types); 2330 cur_perm = avrule->perms; 2331 while (cur_perm) { 2332 tail_perm = cur_perm->next; 2333 free(cur_perm); 2334 cur_perm = tail_perm; 2335 } 2336 free(avrule); 2337 return -1; 2338} 2339 2340/* 2341 * Expands the avrule blocks for a policy. RBAC rules are copied. Neverallow 2342 * rules are copied or expanded as per the settings in the state object; all 2343 * other AV rules are expanded. If neverallow rules are expanded, they are not 2344 * copied, otherwise they are copied for later use by the assertion checker. 2345 */ 2346static int copy_and_expand_avrule_block(expand_state_t * state) 2347{ 2348 avrule_block_t *curblock = state->base->global; 2349 avrule_block_t *prevblock; 2350 int retval = -1; 2351 2352 if (avtab_alloc(&state->out->te_avtab, MAX_AVTAB_SIZE)) { 2353 ERR(state->handle, "Out of Memory!"); 2354 return -1; 2355 } 2356 2357 if (avtab_alloc(&state->out->te_cond_avtab, MAX_AVTAB_SIZE)) { 2358 ERR(state->handle, "Out of Memory!"); 2359 return -1; 2360 } 2361 2362 while (curblock) { 2363 avrule_decl_t *decl = curblock->enabled; 2364 avrule_t *cur_avrule; 2365 2366 if (decl == NULL) { 2367 /* nothing was enabled within this block */ 2368 goto cont; 2369 } 2370 2371 /* copy role allows and role trans */ 2372 if (copy_role_allows(state, decl->role_allow_rules) != 0 || 2373 copy_role_trans(state, decl->role_tr_rules) != 0) { 2374 goto cleanup; 2375 } 2376 2377 /* expand the range transition rules */ 2378 if (expand_range_trans(state, decl->range_tr_rules)) 2379 goto cleanup; 2380 2381 /* copy rules */ 2382 cur_avrule = decl->avrules; 2383 while (cur_avrule != NULL) { 2384 if (!(state->expand_neverallow) 2385 && cur_avrule->specified & AVRULE_NEVERALLOW) { 2386 /* copy this over directly so that assertions are checked later */ 2387 if (copy_neverallow 2388 (state->out, state->typemap, cur_avrule)) 2389 ERR(state->handle, 2390 "Error while copying neverallow."); 2391 } else { 2392 if (cur_avrule->specified & AVRULE_NEVERALLOW) { 2393 state->out->unsupported_format = 1; 2394 } 2395 if (convert_and_expand_rule 2396 (state->handle, state->out, state->typemap, 2397 cur_avrule, &state->out->te_avtab, NULL, 2398 NULL, 0, 2399 state->expand_neverallow) != 2400 EXPAND_RULE_SUCCESS) { 2401 goto cleanup; 2402 } 2403 } 2404 cur_avrule = cur_avrule->next; 2405 } 2406 2407 /* copy conditional rules */ 2408 if (cond_node_copy(state, decl->cond_list)) 2409 goto cleanup; 2410 2411 cont: 2412 prevblock = curblock; 2413 curblock = curblock->next; 2414 2415 if (state->handle && state->handle->expand_consume_base) { 2416 /* set base top avrule block in case there 2417 * is an error condition and the policy needs 2418 * to be destroyed */ 2419 state->base->global = curblock; 2420 avrule_block_destroy(prevblock); 2421 } 2422 } 2423 2424 retval = 0; 2425 2426 cleanup: 2427 return retval; 2428} 2429 2430/* 2431 * This function allows external users of the library (such as setools) to 2432 * expand only the avrules and optionally perform expansion of neverallow rules 2433 * or expand into the same policy for analysis purposes. 2434 */ 2435int expand_module_avrules(sepol_handle_t * handle, policydb_t * base, 2436 policydb_t * out, uint32_t * typemap, 2437 uint32_t * boolmap, uint32_t * rolemap, 2438 uint32_t * usermap, int verbose, 2439 int expand_neverallow) 2440{ 2441 expand_state_t state; 2442 2443 expand_state_init(&state); 2444 2445 state.base = base; 2446 state.out = out; 2447 state.typemap = typemap; 2448 state.boolmap = boolmap; 2449 state.rolemap = rolemap; 2450 state.usermap = usermap; 2451 state.handle = handle; 2452 state.verbose = verbose; 2453 state.expand_neverallow = expand_neverallow; 2454 2455 return copy_and_expand_avrule_block(&state); 2456} 2457 2458/* Linking should always be done before calling expand, even if 2459 * there is only a base since all optionals are dealt with at link time 2460 * the base passed in should be indexed and avrule blocks should be 2461 * enabled. 2462 */ 2463int expand_module(sepol_handle_t * handle, 2464 policydb_t * base, policydb_t * out, int verbose, int check) 2465{ 2466 int retval = -1; 2467 unsigned int i; 2468 expand_state_t state; 2469 avrule_block_t *curblock; 2470 2471 expand_state_init(&state); 2472 2473 state.verbose = verbose; 2474 state.typemap = NULL; 2475 state.base = base; 2476 state.out = out; 2477 state.handle = handle; 2478 2479 if (base->policy_type != POLICY_BASE) { 2480 ERR(handle, "Target of expand was not a base policy."); 2481 return -1; 2482 } 2483 2484 state.out->policy_type = POLICY_KERN; 2485 state.out->policyvers = POLICYDB_VERSION_MAX; 2486 2487 /* Copy mls state from base to out */ 2488 out->mls = base->mls; 2489 out->handle_unknown = base->handle_unknown; 2490 2491 /* Copy target from base to out */ 2492 out->target_platform = base->target_platform; 2493 2494 /* Copy policy capabilities */ 2495 if (ebitmap_cpy(&out->policycaps, &base->policycaps)) { 2496 ERR(handle, "Out of memory!"); 2497 goto cleanup; 2498 } 2499 2500 if ((state.typemap = 2501 (uint32_t *) calloc(state.base->p_types.nprim, 2502 sizeof(uint32_t))) == NULL) { 2503 ERR(handle, "Out of memory!"); 2504 goto cleanup; 2505 } 2506 2507 state.boolmap = (uint32_t *)calloc(state.base->p_bools.nprim, sizeof(uint32_t)); 2508 if (!state.boolmap) { 2509 ERR(handle, "Out of memory!"); 2510 goto cleanup; 2511 } 2512 2513 state.rolemap = (uint32_t *)calloc(state.base->p_roles.nprim, sizeof(uint32_t)); 2514 if (!state.rolemap) { 2515 ERR(handle, "Out of memory!"); 2516 goto cleanup; 2517 } 2518 2519 state.usermap = (uint32_t *)calloc(state.base->p_users.nprim, sizeof(uint32_t)); 2520 if (!state.usermap) { 2521 ERR(handle, "Out of memory!"); 2522 goto cleanup; 2523 } 2524 2525 /* order is important - types must be first */ 2526 2527 /* copy types */ 2528 if (hashtab_map(state.base->p_types.table, type_copy_callback, &state)) { 2529 goto cleanup; 2530 } 2531 2532 /* convert attribute type sets */ 2533 if (hashtab_map 2534 (state.base->p_types.table, attr_convert_callback, &state)) { 2535 goto cleanup; 2536 } 2537 2538 /* copy commons */ 2539 if (hashtab_map 2540 (state.base->p_commons.table, common_copy_callback, &state)) { 2541 goto cleanup; 2542 } 2543 2544 /* copy classes, note, this does not copy constraints, constraints can't be 2545 * copied until after all the blocks have been processed and attributes are complete */ 2546 if (hashtab_map 2547 (state.base->p_classes.table, class_copy_callback, &state)) { 2548 goto cleanup; 2549 } 2550 2551 /* copy type bounds */ 2552 if (hashtab_map(state.base->p_types.table, 2553 type_bounds_copy_callback, &state)) 2554 goto cleanup; 2555 2556 /* copy aliases */ 2557 if (hashtab_map(state.base->p_types.table, alias_copy_callback, &state)) 2558 goto cleanup; 2559 2560 /* index here so that type indexes are available for role_copy_callback */ 2561 if (policydb_index_others(handle, out, verbose)) { 2562 ERR(handle, "Error while indexing out symbols"); 2563 goto cleanup; 2564 } 2565 2566 /* copy roles */ 2567 if (hashtab_map(state.base->p_roles.table, role_copy_callback, &state)) 2568 goto cleanup; 2569 if (hashtab_map(state.base->p_roles.table, 2570 role_bounds_copy_callback, &state)) 2571 goto cleanup; 2572 2573 /* copy MLS's sensitivity level and categories - this needs to be done 2574 * before expanding users (they need to be indexed too) */ 2575 if (hashtab_map(state.base->p_levels.table, sens_copy_callback, &state)) 2576 goto cleanup; 2577 if (hashtab_map(state.base->p_cats.table, cats_copy_callback, &state)) 2578 goto cleanup; 2579 if (policydb_index_others(handle, out, verbose)) { 2580 ERR(handle, "Error while indexing out symbols"); 2581 goto cleanup; 2582 } 2583 2584 /* copy users */ 2585 if (hashtab_map(state.base->p_users.table, user_copy_callback, &state)) 2586 goto cleanup; 2587 if (hashtab_map(state.base->p_users.table, 2588 user_bounds_copy_callback, &state)) 2589 goto cleanup; 2590 2591 /* copy bools */ 2592 if (hashtab_map(state.base->p_bools.table, bool_copy_callback, &state)) 2593 goto cleanup; 2594 2595 if (policydb_index_classes(out)) { 2596 ERR(handle, "Error while indexing out classes"); 2597 goto cleanup; 2598 } 2599 if (policydb_index_others(handle, out, verbose)) { 2600 ERR(handle, "Error while indexing out symbols"); 2601 goto cleanup; 2602 } 2603 2604 /* loop through all decls and union attributes, roles, users */ 2605 for (curblock = state.base->global; curblock != NULL; 2606 curblock = curblock->next) { 2607 avrule_decl_t *decl = curblock->enabled; 2608 2609 if (decl == NULL) { 2610 /* nothing was enabled within this block */ 2611 continue; 2612 } 2613 2614 /* convert attribute type sets */ 2615 if (hashtab_map 2616 (decl->p_types.table, attr_convert_callback, &state)) { 2617 goto cleanup; 2618 } 2619 2620 /* copy roles */ 2621 if (hashtab_map 2622 (decl->p_roles.table, role_copy_callback, &state)) 2623 goto cleanup; 2624 2625 /* copy users */ 2626 if (hashtab_map 2627 (decl->p_users.table, user_copy_callback, &state)) 2628 goto cleanup; 2629 2630 } 2631 2632 /* remap role dominates bitmaps */ 2633 if (hashtab_map(state.out->p_roles.table, role_remap_dominates, &state)) { 2634 goto cleanup; 2635 } 2636 2637 if (copy_and_expand_avrule_block(&state) < 0) { 2638 ERR(handle, "Error during expand"); 2639 goto cleanup; 2640 } 2641 2642 /* copy constraints */ 2643 if (hashtab_map 2644 (state.base->p_classes.table, constraint_copy_callback, &state)) { 2645 goto cleanup; 2646 } 2647 2648 cond_optimize_lists(state.out->cond_list); 2649 evaluate_conds(state.out); 2650 2651 /* copy ocontexts */ 2652 if (ocontext_copy(&state, out->target_platform)) 2653 goto cleanup; 2654 2655 /* copy genfs */ 2656 if (genfs_copy(&state)) 2657 goto cleanup; 2658 2659 /* Build the type<->attribute maps and remove attributes. */ 2660 state.out->attr_type_map = malloc(state.out->p_types.nprim * 2661 sizeof(ebitmap_t)); 2662 state.out->type_attr_map = malloc(state.out->p_types.nprim * 2663 sizeof(ebitmap_t)); 2664 if (!state.out->attr_type_map || !state.out->type_attr_map) { 2665 ERR(handle, "Out of memory!"); 2666 goto cleanup; 2667 } 2668 for (i = 0; i < state.out->p_types.nprim; i++) { 2669 ebitmap_init(&state.out->type_attr_map[i]); 2670 ebitmap_init(&state.out->attr_type_map[i]); 2671 /* add the type itself as the degenerate case */ 2672 if (ebitmap_set_bit(&state.out->type_attr_map[i], i, 1)) { 2673 ERR(handle, "Out of memory!"); 2674 goto cleanup; 2675 } 2676 } 2677 if (hashtab_map(state.out->p_types.table, type_attr_map, &state)) 2678 goto cleanup; 2679 if (check) { 2680 if (hierarchy_check_constraints(handle, state.out)) 2681 goto cleanup; 2682 2683 if (check_assertions 2684 (handle, state.out, 2685 state.out->global->branch_list->avrules)) 2686 goto cleanup; 2687 } 2688 2689 retval = 0; 2690 2691 cleanup: 2692 free(state.typemap); 2693 free(state.boolmap); 2694 free(state.rolemap); 2695 free(state.usermap); 2696 return retval; 2697} 2698 2699static int expand_avtab_insert(avtab_t * a, avtab_key_t * k, avtab_datum_t * d) 2700{ 2701 avtab_ptr_t node; 2702 avtab_datum_t *avd; 2703 int rc; 2704 2705 node = avtab_search_node(a, k); 2706 if (!node) { 2707 rc = avtab_insert(a, k, d); 2708 if (rc) 2709 ERR(NULL, "Out of memory!"); 2710 return rc; 2711 } 2712 2713 if ((k->specified & AVTAB_ENABLED) != 2714 (node->key.specified & AVTAB_ENABLED)) { 2715 node = avtab_insert_nonunique(a, k, d); 2716 if (!node) { 2717 ERR(NULL, "Out of memory!"); 2718 return -1; 2719 } 2720 return 0; 2721 } 2722 2723 avd = &node->datum; 2724 switch (k->specified & ~AVTAB_ENABLED) { 2725 case AVTAB_ALLOWED: 2726 case AVTAB_AUDITALLOW: 2727 avd->data |= d->data; 2728 break; 2729 case AVTAB_AUDITDENY: 2730 avd->data &= d->data; 2731 break; 2732 default: 2733 ERR(NULL, "Type conflict!"); 2734 return -1; 2735 } 2736 2737 return 0; 2738} 2739 2740struct expand_avtab_data { 2741 avtab_t *expa; 2742 policydb_t *p; 2743 2744}; 2745 2746static int expand_avtab_node(avtab_key_t * k, avtab_datum_t * d, void *args) 2747{ 2748 struct expand_avtab_data *ptr = args; 2749 avtab_t *expa = ptr->expa; 2750 policydb_t *p = ptr->p; 2751 type_datum_t *stype = p->type_val_to_struct[k->source_type - 1]; 2752 type_datum_t *ttype = p->type_val_to_struct[k->target_type - 1]; 2753 ebitmap_t *sattr = &p->attr_type_map[k->source_type - 1]; 2754 ebitmap_t *tattr = &p->attr_type_map[k->target_type - 1]; 2755 ebitmap_node_t *snode, *tnode; 2756 unsigned int i, j; 2757 avtab_key_t newkey; 2758 int rc; 2759 2760 newkey.target_class = k->target_class; 2761 newkey.specified = k->specified; 2762 2763 if (stype && ttype) { 2764 /* Both are individual types, no expansion required. */ 2765 return expand_avtab_insert(expa, k, d); 2766 } 2767 2768 if (stype) { 2769 /* Source is an individual type, target is an attribute. */ 2770 newkey.source_type = k->source_type; 2771 ebitmap_for_each_bit(tattr, tnode, j) { 2772 if (!ebitmap_node_get_bit(tnode, j)) 2773 continue; 2774 newkey.target_type = j + 1; 2775 rc = expand_avtab_insert(expa, &newkey, d); 2776 if (rc) 2777 return -1; 2778 } 2779 return 0; 2780 } 2781 2782 if (ttype) { 2783 /* Target is an individual type, source is an attribute. */ 2784 newkey.target_type = k->target_type; 2785 ebitmap_for_each_bit(sattr, snode, i) { 2786 if (!ebitmap_node_get_bit(snode, i)) 2787 continue; 2788 newkey.source_type = i + 1; 2789 rc = expand_avtab_insert(expa, &newkey, d); 2790 if (rc) 2791 return -1; 2792 } 2793 return 0; 2794 } 2795 2796 /* Both source and target type are attributes. */ 2797 ebitmap_for_each_bit(sattr, snode, i) { 2798 if (!ebitmap_node_get_bit(snode, i)) 2799 continue; 2800 ebitmap_for_each_bit(tattr, tnode, j) { 2801 if (!ebitmap_node_get_bit(tnode, j)) 2802 continue; 2803 newkey.source_type = i + 1; 2804 newkey.target_type = j + 1; 2805 rc = expand_avtab_insert(expa, &newkey, d); 2806 if (rc) 2807 return -1; 2808 } 2809 } 2810 2811 return 0; 2812} 2813 2814int expand_avtab(policydb_t * p, avtab_t * a, avtab_t * expa) 2815{ 2816 struct expand_avtab_data data; 2817 2818 if (avtab_alloc(expa, MAX_AVTAB_SIZE)) { 2819 ERR(NULL, "Out of memory!"); 2820 return -1; 2821 } 2822 2823 data.expa = expa; 2824 data.p = p; 2825 return avtab_map(a, expand_avtab_node, &data); 2826} 2827 2828static int expand_cond_insert(cond_av_list_t ** l, 2829 avtab_t * expa, 2830 avtab_key_t * k, avtab_datum_t * d) 2831{ 2832 avtab_ptr_t node; 2833 avtab_datum_t *avd; 2834 cond_av_list_t *nl; 2835 2836 node = avtab_search_node(expa, k); 2837 if (!node || 2838 (k->specified & AVTAB_ENABLED) != 2839 (node->key.specified & AVTAB_ENABLED)) { 2840 node = avtab_insert_nonunique(expa, k, d); 2841 if (!node) { 2842 ERR(NULL, "Out of memory!"); 2843 return -1; 2844 } 2845 node->parse_context = (void *)1; 2846 nl = (cond_av_list_t *) malloc(sizeof(*nl)); 2847 if (!nl) { 2848 ERR(NULL, "Out of memory!"); 2849 return -1; 2850 } 2851 memset(nl, 0, sizeof(*nl)); 2852 nl->node = node; 2853 nl->next = *l; 2854 *l = nl; 2855 return 0; 2856 } 2857 2858 avd = &node->datum; 2859 switch (k->specified & ~AVTAB_ENABLED) { 2860 case AVTAB_ALLOWED: 2861 case AVTAB_AUDITALLOW: 2862 avd->data |= d->data; 2863 break; 2864 case AVTAB_AUDITDENY: 2865 avd->data &= d->data; 2866 break; 2867 default: 2868 ERR(NULL, "Type conflict!"); 2869 return -1; 2870 } 2871 2872 return 0; 2873} 2874 2875int expand_cond_av_node(policydb_t * p, 2876 avtab_ptr_t node, 2877 cond_av_list_t ** newl, avtab_t * expa) 2878{ 2879 avtab_key_t *k = &node->key; 2880 avtab_datum_t *d = &node->datum; 2881 type_datum_t *stype = p->type_val_to_struct[k->source_type - 1]; 2882 type_datum_t *ttype = p->type_val_to_struct[k->target_type - 1]; 2883 ebitmap_t *sattr = &p->attr_type_map[k->source_type - 1]; 2884 ebitmap_t *tattr = &p->attr_type_map[k->target_type - 1]; 2885 ebitmap_node_t *snode, *tnode; 2886 unsigned int i, j; 2887 avtab_key_t newkey; 2888 int rc; 2889 2890 newkey.target_class = k->target_class; 2891 newkey.specified = k->specified; 2892 2893 if (stype && ttype) { 2894 /* Both are individual types, no expansion required. */ 2895 return expand_cond_insert(newl, expa, k, d); 2896 } 2897 2898 if (stype) { 2899 /* Source is an individual type, target is an attribute. */ 2900 newkey.source_type = k->source_type; 2901 ebitmap_for_each_bit(tattr, tnode, j) { 2902 if (!ebitmap_node_get_bit(tnode, j)) 2903 continue; 2904 newkey.target_type = j + 1; 2905 rc = expand_cond_insert(newl, expa, &newkey, d); 2906 if (rc) 2907 return -1; 2908 } 2909 return 0; 2910 } 2911 2912 if (ttype) { 2913 /* Target is an individual type, source is an attribute. */ 2914 newkey.target_type = k->target_type; 2915 ebitmap_for_each_bit(sattr, snode, i) { 2916 if (!ebitmap_node_get_bit(snode, i)) 2917 continue; 2918 newkey.source_type = i + 1; 2919 rc = expand_cond_insert(newl, expa, &newkey, d); 2920 if (rc) 2921 return -1; 2922 } 2923 return 0; 2924 } 2925 2926 /* Both source and target type are attributes. */ 2927 ebitmap_for_each_bit(sattr, snode, i) { 2928 if (!ebitmap_node_get_bit(snode, i)) 2929 continue; 2930 ebitmap_for_each_bit(tattr, tnode, j) { 2931 if (!ebitmap_node_get_bit(tnode, j)) 2932 continue; 2933 newkey.source_type = i + 1; 2934 newkey.target_type = j + 1; 2935 rc = expand_cond_insert(newl, expa, &newkey, d); 2936 if (rc) 2937 return -1; 2938 } 2939 } 2940 2941 return 0; 2942} 2943 2944int expand_cond_av_list(policydb_t * p, cond_av_list_t * l, 2945 cond_av_list_t ** newl, avtab_t * expa) 2946{ 2947 cond_av_list_t *cur; 2948 avtab_ptr_t node; 2949 int rc; 2950 2951 if (avtab_alloc(expa, MAX_AVTAB_SIZE)) { 2952 ERR(NULL, "Out of memory!"); 2953 return -1; 2954 } 2955 2956 *newl = NULL; 2957 for (cur = l; cur; cur = cur->next) { 2958 node = cur->node; 2959 rc = expand_cond_av_node(p, node, newl, expa); 2960 if (rc) 2961 return rc; 2962 } 2963 2964 return 0; 2965} 2966