expand.c revision 9f709e6bab863036950644a7dd470d50663b558b
1/* Authors: Karl MacMillan <kmacmillan@mentalrootkit.com> 2 * Jason Tang <jtang@tresys.com> 3 * Joshua Brindle <jbrindle@tresys.com> 4 * 5 * Copyright (C) 2004-2005 Tresys Technology, LLC 6 * Copyright (C) 2007 Red Hat, Inc. 7 * 8 * This library is free software; you can redistribute it and/or 9 * modify it under the terms of the GNU Lesser General Public 10 * License as published by the Free Software Foundation; either 11 * version 2.1 of the License, or (at your option) any later version. 12 * 13 * This library is distributed in the hope that it will be useful, 14 * but WITHOUT ANY WARRANTY; without even the implied warranty of 15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU 16 * Lesser General Public License for more details. 17 * 18 * You should have received a copy of the GNU Lesser General Public 19 * License along with this library; if not, write to the Free Software 20 * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA 21 */ 22 23#include "context.h" 24#include <sepol/policydb/policydb.h> 25#include <sepol/policydb/conditional.h> 26#include <sepol/policydb/hashtab.h> 27#include <sepol/policydb/expand.h> 28#include <sepol/policydb/hierarchy.h> 29#include <sepol/policydb/avrule_block.h> 30 31#include <stdlib.h> 32#include <stdarg.h> 33#include <stdio.h> 34#include <string.h> 35#include <assert.h> 36 37#include "debug.h" 38#include "private.h" 39 40typedef struct expand_state { 41 int verbose; 42 uint32_t *typemap; 43 uint32_t *boolmap; 44 uint32_t *rolemap; 45 uint32_t *usermap; 46 policydb_t *base; 47 policydb_t *out; 48 sepol_handle_t *handle; 49 int expand_neverallow; 50} expand_state_t; 51 52static void expand_state_init(expand_state_t * state) 53{ 54 memset(state, 0, sizeof(expand_state_t)); 55} 56 57static int map_ebitmap(ebitmap_t * src, ebitmap_t * dst, uint32_t * map) 58{ 59 unsigned int i; 60 ebitmap_node_t *tnode; 61 ebitmap_init(dst); 62 63 ebitmap_for_each_bit(src, tnode, i) { 64 if (!ebitmap_node_get_bit(tnode, i)) 65 continue; 66 if (!map[i]) 67 continue; 68 if (ebitmap_set_bit(dst, map[i] - 1, 1)) 69 return -1; 70 } 71 return 0; 72} 73 74static int type_copy_callback(hashtab_key_t key, hashtab_datum_t datum, 75 void *data) 76{ 77 int ret; 78 char *id, *new_id; 79 type_datum_t *type, *new_type; 80 expand_state_t *state; 81 82 id = (char *)key; 83 type = (type_datum_t *) datum; 84 state = (expand_state_t *) data; 85 86 if ((type->flavor == TYPE_TYPE && !type->primary) 87 || type->flavor == TYPE_ALIAS) { 88 /* aliases are handled later */ 89 return 0; 90 } 91 if (!is_id_enabled(id, state->base, SYM_TYPES)) { 92 /* identifier's scope is not enabled */ 93 return 0; 94 } 95 96 if (state->verbose) 97 INFO(state->handle, "copying type or attribute %s", id); 98 99 new_id = strdup(id); 100 if (new_id == NULL) { 101 ERR(state->handle, "Out of memory!"); 102 return -1; 103 } 104 105 new_type = (type_datum_t *) malloc(sizeof(type_datum_t)); 106 if (!new_type) { 107 ERR(state->handle, "Out of memory!"); 108 free(new_id); 109 return SEPOL_ENOMEM; 110 } 111 memset(new_type, 0, sizeof(type_datum_t)); 112 113 new_type->flavor = type->flavor; 114 new_type->flags = type->flags; 115 new_type->s.value = ++state->out->p_types.nprim; 116 if (new_type->s.value > UINT16_MAX) { 117 free(new_id); 118 free(new_type); 119 ERR(state->handle, "type space overflow"); 120 return -1; 121 } 122 new_type->primary = 1; 123 state->typemap[type->s.value - 1] = new_type->s.value; 124 125 ret = hashtab_insert(state->out->p_types.table, 126 (hashtab_key_t) new_id, 127 (hashtab_datum_t) new_type); 128 if (ret) { 129 free(new_id); 130 free(new_type); 131 ERR(state->handle, "hashtab overflow"); 132 return -1; 133 } 134 135 if (new_type->flags & TYPE_FLAGS_PERMISSIVE) 136 if (ebitmap_set_bit(&state->out->permissive_map, new_type->s.value, 1)) { 137 ERR(state->handle, "Out of memory!\n"); 138 return -1; 139 } 140 141 return 0; 142} 143 144static int attr_convert_callback(hashtab_key_t key, hashtab_datum_t datum, 145 void *data) 146{ 147 char *id; 148 type_datum_t *type, *new_type; 149 expand_state_t *state; 150 ebitmap_t tmp_union; 151 152 id = (char *)key; 153 type = (type_datum_t *) datum; 154 state = (expand_state_t *) data; 155 156 if (type->flavor != TYPE_ATTRIB) 157 return 0; 158 159 if (!is_id_enabled(id, state->base, SYM_TYPES)) { 160 /* identifier's scope is not enabled */ 161 return 0; 162 } 163 164 if (state->verbose) 165 INFO(state->handle, "converting attribute %s", id); 166 167 new_type = hashtab_search(state->out->p_types.table, id); 168 if (!new_type) { 169 ERR(state->handle, "attribute %s vanished!", id); 170 return -1; 171 } 172 if (map_ebitmap(&type->types, &tmp_union, state->typemap)) { 173 ERR(state->handle, "out of memory"); 174 return -1; 175 } 176 177 /* then union tmp_union onto &new_type->types */ 178 if (ebitmap_union(&new_type->types, &tmp_union)) { 179 ERR(state->handle, "Out of memory!"); 180 return -1; 181 } 182 ebitmap_destroy(&tmp_union); 183 184 return 0; 185} 186 187static int perm_copy_callback(hashtab_key_t key, hashtab_datum_t datum, 188 void *data) 189{ 190 int ret; 191 char *id, *new_id; 192 symtab_t *s; 193 perm_datum_t *perm, *new_perm; 194 195 id = key; 196 perm = (perm_datum_t *) datum; 197 s = (symtab_t *) data; 198 199 new_perm = (perm_datum_t *) malloc(sizeof(perm_datum_t)); 200 if (!new_perm) { 201 return -1; 202 } 203 memset(new_perm, 0, sizeof(perm_datum_t)); 204 205 new_id = strdup(id); 206 if (!new_id) { 207 free(new_perm); 208 return -1; 209 } 210 211 new_perm->s.value = perm->s.value; 212 s->nprim++; 213 214 ret = hashtab_insert(s->table, new_id, (hashtab_datum_t *) new_perm); 215 if (ret) { 216 free(new_id); 217 free(new_perm); 218 return -1; 219 } 220 221 return 0; 222} 223 224static int common_copy_callback(hashtab_key_t key, hashtab_datum_t datum, 225 void *data) 226{ 227 int ret; 228 char *id, *new_id; 229 common_datum_t *common, *new_common; 230 expand_state_t *state; 231 232 id = (char *)key; 233 common = (common_datum_t *) datum; 234 state = (expand_state_t *) data; 235 236 if (state->verbose) 237 INFO(state->handle, "copying common %s", id); 238 239 new_common = (common_datum_t *) malloc(sizeof(common_datum_t)); 240 if (!new_common) { 241 ERR(state->handle, "Out of memory!"); 242 return -1; 243 } 244 memset(new_common, 0, sizeof(common_datum_t)); 245 if (symtab_init(&new_common->permissions, PERM_SYMTAB_SIZE)) { 246 ERR(state->handle, "Out of memory!"); 247 free(new_common); 248 return -1; 249 } 250 251 new_id = strdup(id); 252 if (!new_id) { 253 ERR(state->handle, "Out of memory!"); 254 free(new_common); 255 return -1; 256 } 257 258 new_common->s.value = common->s.value; 259 state->out->p_commons.nprim++; 260 261 ret = 262 hashtab_insert(state->out->p_commons.table, new_id, 263 (hashtab_datum_t *) new_common); 264 if (ret) { 265 ERR(state->handle, "hashtab overflow"); 266 free(new_common); 267 free(new_id); 268 return -1; 269 } 270 271 if (hashtab_map 272 (common->permissions.table, perm_copy_callback, 273 &new_common->permissions)) { 274 ERR(state->handle, "Out of memory!"); 275 return -1; 276 } 277 278 return 0; 279} 280 281static int constraint_node_clone(constraint_node_t ** dst, 282 constraint_node_t * src, 283 expand_state_t * state) 284{ 285 constraint_node_t *new_con = NULL, *last_new_con = NULL; 286 constraint_expr_t *new_expr = NULL; 287 *dst = NULL; 288 while (src != NULL) { 289 constraint_expr_t *expr, *expr_l = NULL; 290 new_con = 291 (constraint_node_t *) malloc(sizeof(constraint_node_t)); 292 if (!new_con) { 293 goto out_of_mem; 294 } 295 memset(new_con, 0, sizeof(constraint_node_t)); 296 new_con->permissions = src->permissions; 297 for (expr = src->expr; expr; expr = expr->next) { 298 if ((new_expr = calloc(1, sizeof(*new_expr))) == NULL) { 299 goto out_of_mem; 300 } 301 if (constraint_expr_init(new_expr) == -1) { 302 goto out_of_mem; 303 } 304 new_expr->expr_type = expr->expr_type; 305 new_expr->attr = expr->attr; 306 new_expr->op = expr->op; 307 if (new_expr->expr_type == CEXPR_NAMES) { 308 if (new_expr->attr & CEXPR_TYPE) { 309 /* Type sets require expansion and conversion. */ 310 if (expand_convert_type_set(state->out, 311 state-> 312 typemap, 313 expr-> 314 type_names, 315 &new_expr-> 316 names, 1)) { 317 goto out_of_mem; 318 } 319 } else if (new_expr->attr & CEXPR_ROLE) { 320 if (map_ebitmap(&expr->names, &new_expr->names, state->rolemap)) { 321 goto out_of_mem; 322 } 323 } else if (new_expr->attr & CEXPR_USER) { 324 if (map_ebitmap(&expr->names, &new_expr->names, state->usermap)) { 325 goto out_of_mem; 326 } 327 } else { 328 /* Other kinds of sets do not. */ 329 if (ebitmap_cpy(&new_expr->names, 330 &expr->names)) { 331 goto out_of_mem; 332 } 333 } 334 } 335 if (expr_l) { 336 expr_l->next = new_expr; 337 } else { 338 new_con->expr = new_expr; 339 } 340 expr_l = new_expr; 341 new_expr = NULL; 342 } 343 if (last_new_con == NULL) { 344 *dst = new_con; 345 } else { 346 last_new_con->next = new_con; 347 } 348 last_new_con = new_con; 349 src = src->next; 350 } 351 352 return 0; 353 out_of_mem: 354 ERR(state->handle, "Out of memory!"); 355 if (new_con) 356 free(new_con); 357 constraint_expr_destroy(new_expr); 358 return -1; 359} 360 361static int class_copy_callback(hashtab_key_t key, hashtab_datum_t datum, 362 void *data) 363{ 364 int ret; 365 char *id, *new_id; 366 class_datum_t *class, *new_class; 367 expand_state_t *state; 368 369 id = (char *)key; 370 class = (class_datum_t *) datum; 371 state = (expand_state_t *) data; 372 373 if (!is_id_enabled(id, state->base, SYM_CLASSES)) { 374 /* identifier's scope is not enabled */ 375 return 0; 376 } 377 378 if (state->verbose) 379 INFO(state->handle, "copying class %s", id); 380 381 new_class = (class_datum_t *) malloc(sizeof(class_datum_t)); 382 if (!new_class) { 383 ERR(state->handle, "Out of memory!"); 384 return -1; 385 } 386 memset(new_class, 0, sizeof(class_datum_t)); 387 if (symtab_init(&new_class->permissions, PERM_SYMTAB_SIZE)) { 388 ERR(state->handle, "Out of memory!"); 389 free(new_class); 390 return -1; 391 } 392 393 new_class->s.value = class->s.value; 394 state->out->p_classes.nprim++; 395 396 new_id = strdup(id); 397 if (!new_id) { 398 ERR(state->handle, "Out of memory!"); 399 free(new_class); 400 return -1; 401 } 402 403 ret = 404 hashtab_insert(state->out->p_classes.table, new_id, 405 (hashtab_datum_t *) new_class); 406 if (ret) { 407 ERR(state->handle, "hashtab overflow"); 408 free(new_class); 409 free(new_id); 410 return -1; 411 } 412 413 if (hashtab_map 414 (class->permissions.table, perm_copy_callback, 415 &new_class->permissions)) { 416 ERR(state->handle, "hashtab overflow"); 417 return -1; 418 } 419 420 if (class->comkey) { 421 new_class->comkey = strdup(class->comkey); 422 if (!new_class->comkey) { 423 ERR(state->handle, "Out of memory!"); 424 return -1; 425 } 426 427 new_class->comdatum = 428 hashtab_search(state->out->p_commons.table, 429 new_class->comkey); 430 if (!new_class->comdatum) { 431 ERR(state->handle, "could not find common datum %s", 432 new_class->comkey); 433 return -1; 434 } 435 new_class->permissions.nprim += 436 new_class->comdatum->permissions.nprim; 437 } 438 439 return 0; 440} 441 442static int constraint_copy_callback(hashtab_key_t key, hashtab_datum_t datum, 443 void *data) 444{ 445 char *id; 446 class_datum_t *class, *new_class; 447 expand_state_t *state; 448 449 id = (char *)key; 450 class = (class_datum_t *) datum; 451 state = (expand_state_t *) data; 452 453 new_class = hashtab_search(state->out->p_classes.table, id); 454 if (!new_class) { 455 ERR(state->handle, "class %s vanished", id); 456 return -1; 457 } 458 459 /* constraints */ 460 if (constraint_node_clone 461 (&new_class->constraints, class->constraints, state) == -1 462 || constraint_node_clone(&new_class->validatetrans, 463 class->validatetrans, state) == -1) { 464 return -1; 465 } 466 return 0; 467} 468 469/* 470 * The boundaries have to be copied after the types/roles/users are copied, 471 * because it refers hashtab to lookup destinated objects. 472 */ 473static int type_bounds_copy_callback(hashtab_key_t key, 474 hashtab_datum_t datum, void *data) 475{ 476 expand_state_t *state = (expand_state_t *) data; 477 type_datum_t *type = (type_datum_t *) datum; 478 type_datum_t *dest; 479 uint32_t bounds_val; 480 481 if (!type->bounds) 482 return 0; 483 484 if (!is_id_enabled((char *)key, state->base, SYM_TYPES)) 485 return 0; 486 487 bounds_val = state->typemap[type->bounds - 1]; 488 489 dest = hashtab_search(state->out->p_types.table, (char *)key); 490 if (!dest) { 491 ERR(state->handle, "Type lookup failed for %s", (char *)key); 492 return -1; 493 } 494 if (dest->bounds != 0 && dest->bounds != bounds_val) { 495 ERR(state->handle, "Inconsistent boundary for %s", (char *)key); 496 return -1; 497 } 498 dest->bounds = bounds_val; 499 500 return 0; 501} 502 503static int role_bounds_copy_callback(hashtab_key_t key, 504 hashtab_datum_t datum, void *data) 505{ 506 expand_state_t *state = (expand_state_t *) data; 507 role_datum_t *role = (role_datum_t *) datum; 508 role_datum_t *dest; 509 uint32_t bounds_val; 510 511 if (!role->bounds) 512 return 0; 513 514 if (!is_id_enabled((char *)key, state->base, SYM_ROLES)) 515 return 0; 516 517 bounds_val = state->rolemap[role->bounds - 1]; 518 519 dest = hashtab_search(state->out->p_roles.table, (char *)key); 520 if (!dest) { 521 ERR(state->handle, "Role lookup failed for %s", (char *)key); 522 return -1; 523 } 524 if (dest->bounds != 0 && dest->bounds != bounds_val) { 525 ERR(state->handle, "Inconsistent boundary for %s", (char *)key); 526 return -1; 527 } 528 dest->bounds = bounds_val; 529 530 return 0; 531} 532 533static int user_bounds_copy_callback(hashtab_key_t key, 534 hashtab_datum_t datum, void *data) 535{ 536 expand_state_t *state = (expand_state_t *) data; 537 user_datum_t *user = (user_datum_t *) datum; 538 user_datum_t *dest; 539 uint32_t bounds_val; 540 541 if (!user->bounds) 542 return 0; 543 544 if (!is_id_enabled((char *)key, state->base, SYM_USERS)) 545 return 0; 546 547 bounds_val = state->usermap[user->bounds - 1]; 548 549 dest = hashtab_search(state->out->p_users.table, (char *)key); 550 if (!dest) { 551 ERR(state->handle, "User lookup failed for %s", (char *)key); 552 return -1; 553 } 554 if (dest->bounds != 0 && dest->bounds != bounds_val) { 555 ERR(state->handle, "Inconsistent boundary for %s", (char *)key); 556 return -1; 557 } 558 dest->bounds = bounds_val; 559 560 return 0; 561} 562 563/* The aliases have to be copied after the types and attributes to be certain that 564 * the out symbol table will have the type that the alias refers. Otherwise, we 565 * won't be able to find the type value for the alias. We can't depend on the 566 * declaration ordering because of the hash table. 567 */ 568static int alias_copy_callback(hashtab_key_t key, hashtab_datum_t datum, 569 void *data) 570{ 571 int ret; 572 char *id, *new_id; 573 type_datum_t *alias, *new_alias; 574 expand_state_t *state; 575 uint32_t prival; 576 577 id = (char *)key; 578 alias = (type_datum_t *) datum; 579 state = (expand_state_t *) data; 580 581 /* ignore regular types */ 582 if (alias->flavor == TYPE_TYPE && alias->primary) 583 return 0; 584 585 /* ignore attributes */ 586 if (alias->flavor == TYPE_ATTRIB) 587 return 0; 588 589 if (alias->flavor == TYPE_ALIAS) 590 prival = alias->primary; 591 else 592 prival = alias->s.value; 593 594 if (!is_id_enabled(state->base->p_type_val_to_name[prival - 1], 595 state->base, SYM_TYPES)) { 596 /* The primary type for this alias is not enabled, the alias 597 * shouldn't be either */ 598 return 0; 599 } 600 601 if (state->verbose) 602 INFO(state->handle, "copying alias %s", id); 603 604 new_id = strdup(id); 605 if (!new_id) { 606 ERR(state->handle, "Out of memory!"); 607 return -1; 608 } 609 610 new_alias = (type_datum_t *) malloc(sizeof(type_datum_t)); 611 if (!new_alias) { 612 ERR(state->handle, "Out of memory!"); 613 free(new_id); 614 return SEPOL_ENOMEM; 615 } 616 memset(new_alias, 0, sizeof(type_datum_t)); 617 if (alias->flavor == TYPE_TYPE) 618 new_alias->s.value = state->typemap[alias->s.value - 1]; 619 else if (alias->flavor == TYPE_ALIAS) 620 new_alias->s.value = state->typemap[alias->primary - 1]; 621 else 622 assert(0); /* unreachable */ 623 624 new_alias->flags = alias->flags; 625 626 ret = hashtab_insert(state->out->p_types.table, 627 (hashtab_key_t) new_id, 628 (hashtab_datum_t) new_alias); 629 630 if (ret) { 631 ERR(state->handle, "hashtab overflow"); 632 free(new_alias); 633 free(new_id); 634 return -1; 635 } 636 637 state->typemap[alias->s.value - 1] = new_alias->s.value; 638 639 if (new_alias->flags & TYPE_FLAGS_PERMISSIVE) 640 if (ebitmap_set_bit(&state->out->permissive_map, new_alias->s.value, 1)) { 641 ERR(state->handle, "Out of memory!"); 642 return -1; 643 } 644 645 return 0; 646} 647 648static int role_remap_dominates(hashtab_key_t key __attribute__ ((unused)), hashtab_datum_t datum, void *data) 649{ 650 ebitmap_t mapped_roles; 651 role_datum_t *role = (role_datum_t *) datum; 652 expand_state_t *state = (expand_state_t *) data; 653 654 if (map_ebitmap(&role->dominates, &mapped_roles, state->rolemap)) 655 return -1; 656 657 ebitmap_destroy(&role->dominates); 658 659 if (ebitmap_cpy(&role->dominates, &mapped_roles)) 660 return -1; 661 662 ebitmap_destroy(&mapped_roles); 663 664 return 0; 665} 666 667/* For the role attribute in the base module, escalate its counterpart's 668 * types.types ebitmap in the out module to the counterparts of all the 669 * regular role that belongs to the current role attribute. Note, must be 670 * invoked after role_copy_callback so that state->rolemap is available. 671 */ 672static int role_fix_callback(hashtab_key_t key, hashtab_datum_t datum, 673 void *data) 674{ 675 char *id, *base_reg_role_id; 676 role_datum_t *role, *new_role, *regular_role; 677 expand_state_t *state; 678 ebitmap_node_t *rnode; 679 unsigned int i; 680 ebitmap_t mapped_roles; 681 682 id = key; 683 role = (role_datum_t *)datum; 684 state = (expand_state_t *)data; 685 686 if (strcmp(id, OBJECT_R) == 0) { 687 /* object_r is never a role attribute by far */ 688 return 0; 689 } 690 691 if (role->flavor != ROLE_ATTRIB) 692 return 0; 693 694 if (state->verbose) 695 INFO(state->handle, "fixing role attribute %s", id); 696 697 new_role = 698 (role_datum_t *)hashtab_search(state->out->p_roles.table, id); 699 700 assert(new_role != NULL && new_role->flavor == ROLE_ATTRIB); 701 702 ebitmap_init(&mapped_roles); 703 if (map_ebitmap(&role->roles, &mapped_roles, state->rolemap)) 704 return -1; 705 if (ebitmap_union(&new_role->roles, &mapped_roles)) { 706 ERR(state->handle, "Out of memory!"); 707 ebitmap_destroy(&mapped_roles); 708 return -1; 709 } 710 ebitmap_destroy(&mapped_roles); 711 712 ebitmap_for_each_bit(&role->roles, rnode, i) { 713 if (ebitmap_node_get_bit(rnode, i)) { 714 /* take advantage of sym_val_to_name[] 715 * of the base module */ 716 base_reg_role_id = state->base->p_role_val_to_name[i]; 717 regular_role = (role_datum_t *)hashtab_search( 718 state->out->p_roles.table, 719 base_reg_role_id); 720 assert(regular_role != NULL && 721 regular_role->flavor == ROLE_ROLE); 722 723 if (ebitmap_union(®ular_role->types.types, 724 &new_role->types.types)) { 725 ERR(state->handle, "Out of memory!"); 726 return -1; 727 } 728 } 729 } 730 731 return 0; 732} 733 734static int role_copy_callback(hashtab_key_t key, hashtab_datum_t datum, 735 void *data) 736{ 737 int ret; 738 char *id, *new_id; 739 role_datum_t *role; 740 role_datum_t *new_role; 741 expand_state_t *state; 742 ebitmap_t tmp_union_types; 743 744 id = key; 745 role = (role_datum_t *) datum; 746 state = (expand_state_t *) data; 747 748 if (strcmp(id, OBJECT_R) == 0) { 749 /* object_r is always value 1 */ 750 state->rolemap[role->s.value - 1] = 1; 751 return 0; 752 } 753 754 if (!is_id_enabled(id, state->base, SYM_ROLES)) { 755 /* identifier's scope is not enabled */ 756 return 0; 757 } 758 759 if (state->verbose) 760 INFO(state->handle, "copying role %s", id); 761 762 new_role = 763 (role_datum_t *) hashtab_search(state->out->p_roles.table, id); 764 if (!new_role) { 765 new_role = (role_datum_t *) malloc(sizeof(role_datum_t)); 766 if (!new_role) { 767 ERR(state->handle, "Out of memory!"); 768 return -1; 769 } 770 memset(new_role, 0, sizeof(role_datum_t)); 771 772 new_id = strdup(id); 773 if (!new_id) { 774 ERR(state->handle, "Out of memory!"); 775 return -1; 776 } 777 778 state->out->p_roles.nprim++; 779 new_role->flavor = role->flavor; 780 new_role->s.value = state->out->p_roles.nprim; 781 state->rolemap[role->s.value - 1] = new_role->s.value; 782 ret = hashtab_insert(state->out->p_roles.table, 783 (hashtab_key_t) new_id, 784 (hashtab_datum_t) new_role); 785 786 if (ret) { 787 ERR(state->handle, "hashtab overflow"); 788 free(new_role); 789 free(new_id); 790 return -1; 791 } 792 } 793 794 /* The dominates bitmap is going to be wrong for the moment, 795 * we'll come back later and remap them, after we are sure all 796 * the roles have been added */ 797 if (ebitmap_union(&new_role->dominates, &role->dominates)) { 798 ERR(state->handle, "Out of memory!"); 799 return -1; 800 } 801 802 ebitmap_init(&tmp_union_types); 803 804 /* convert types in the role datum in the global symtab */ 805 if (expand_convert_type_set 806 (state->out, state->typemap, &role->types, &tmp_union_types, 1)) { 807 ebitmap_destroy(&tmp_union_types); 808 ERR(state->handle, "Out of memory!"); 809 return -1; 810 } 811 812 if (ebitmap_union(&new_role->types.types, &tmp_union_types)) { 813 ERR(state->handle, "Out of memory!"); 814 ebitmap_destroy(&tmp_union_types); 815 return -1; 816 } 817 ebitmap_destroy(&tmp_union_types); 818 819 return 0; 820} 821 822int mls_semantic_level_expand(mls_semantic_level_t * sl, mls_level_t * l, 823 policydb_t * p, sepol_handle_t * h) 824{ 825 mls_semantic_cat_t *cat; 826 level_datum_t *levdatum; 827 unsigned int i; 828 829 mls_level_init(l); 830 831 if (!p->mls) 832 return 0; 833 834 /* Required not declared. */ 835 if (!sl->sens) 836 return 0; 837 838 l->sens = sl->sens; 839 levdatum = (level_datum_t *) hashtab_search(p->p_levels.table, 840 p->p_sens_val_to_name[l-> 841 sens - 842 1]); 843 for (cat = sl->cat; cat; cat = cat->next) { 844 if (cat->low > cat->high) { 845 ERR(h, "Category range is not valid %s.%s", 846 p->p_cat_val_to_name[cat->low - 1], 847 p->p_cat_val_to_name[cat->high - 1]); 848 return -1; 849 } 850 for (i = cat->low - 1; i < cat->high; i++) { 851 if (!ebitmap_get_bit(&levdatum->level->cat, i)) { 852 ERR(h, "Category %s can not be associate with " 853 "level %s", 854 p->p_cat_val_to_name[i], 855 p->p_sens_val_to_name[l->sens - 1]); 856 } 857 if (ebitmap_set_bit(&l->cat, i, 1)) { 858 ERR(h, "Out of memory!"); 859 return -1; 860 } 861 } 862 } 863 864 return 0; 865} 866 867int mls_semantic_range_expand(mls_semantic_range_t * sr, mls_range_t * r, 868 policydb_t * p, sepol_handle_t * h) 869{ 870 if (mls_semantic_level_expand(&sr->level[0], &r->level[0], p, h) < 0) 871 return -1; 872 873 if (mls_semantic_level_expand(&sr->level[1], &r->level[1], p, h) < 0) { 874 mls_semantic_level_destroy(&sr->level[0]); 875 return -1; 876 } 877 878 if (!mls_level_dom(&r->level[1], &r->level[0])) { 879 mls_range_destroy(r); 880 ERR(h, "MLS range high level does not dominate low level"); 881 return -1; 882 } 883 884 return 0; 885} 886 887static int user_copy_callback(hashtab_key_t key, hashtab_datum_t datum, 888 void *data) 889{ 890 int ret; 891 expand_state_t *state; 892 user_datum_t *user; 893 user_datum_t *new_user; 894 char *id, *new_id; 895 ebitmap_t tmp_union; 896 897 id = key; 898 user = (user_datum_t *) datum; 899 state = (expand_state_t *) data; 900 901 if (!is_id_enabled(id, state->base, SYM_USERS)) { 902 /* identifier's scope is not enabled */ 903 return 0; 904 } 905 906 if (state->verbose) 907 INFO(state->handle, "copying user %s", id); 908 909 new_user = 910 (user_datum_t *) hashtab_search(state->out->p_users.table, id); 911 if (!new_user) { 912 new_user = (user_datum_t *) malloc(sizeof(user_datum_t)); 913 if (!new_user) { 914 ERR(state->handle, "Out of memory!"); 915 return -1; 916 } 917 memset(new_user, 0, sizeof(user_datum_t)); 918 919 state->out->p_users.nprim++; 920 new_user->s.value = state->out->p_users.nprim; 921 state->usermap[user->s.value - 1] = new_user->s.value; 922 923 new_id = strdup(id); 924 if (!new_id) { 925 ERR(state->handle, "Out of memory!"); 926 return -1; 927 } 928 ret = hashtab_insert(state->out->p_users.table, 929 (hashtab_key_t) new_id, 930 (hashtab_datum_t) new_user); 931 if (ret) { 932 ERR(state->handle, "hashtab overflow"); 933 user_datum_destroy(new_user); 934 free(new_user); 935 free(new_id); 936 return -1; 937 } 938 939 /* expand the semantic MLS info */ 940 if (mls_semantic_range_expand(&user->range, 941 &new_user->exp_range, 942 state->out, state->handle)) { 943 return -1; 944 } 945 if (mls_semantic_level_expand(&user->dfltlevel, 946 &new_user->exp_dfltlevel, 947 state->out, state->handle)) { 948 return -1; 949 } 950 if (!mls_level_between(&new_user->exp_dfltlevel, 951 &new_user->exp_range.level[0], 952 &new_user->exp_range.level[1])) { 953 ERR(state->handle, "default level not within user " 954 "range"); 955 return -1; 956 } 957 } else { 958 /* require that the MLS info match */ 959 mls_range_t tmp_range; 960 mls_level_t tmp_level; 961 962 if (mls_semantic_range_expand(&user->range, &tmp_range, 963 state->out, state->handle)) { 964 return -1; 965 } 966 if (mls_semantic_level_expand(&user->dfltlevel, &tmp_level, 967 state->out, state->handle)) { 968 mls_range_destroy(&tmp_range); 969 return -1; 970 } 971 if (!mls_range_eq(&new_user->exp_range, &tmp_range) || 972 !mls_level_eq(&new_user->exp_dfltlevel, &tmp_level)) { 973 mls_range_destroy(&tmp_range); 974 mls_level_destroy(&tmp_level); 975 return -1; 976 } 977 mls_range_destroy(&tmp_range); 978 mls_level_destroy(&tmp_level); 979 } 980 981 ebitmap_init(&tmp_union); 982 983 /* get global roles for this user */ 984 if (role_set_expand(&user->roles, &tmp_union, state->out, state->base, state->rolemap)) { 985 ERR(state->handle, "Out of memory!"); 986 ebitmap_destroy(&tmp_union); 987 return -1; 988 } 989 990 if (ebitmap_union(&new_user->roles.roles, &tmp_union)) { 991 ERR(state->handle, "Out of memory!"); 992 ebitmap_destroy(&tmp_union); 993 return -1; 994 } 995 ebitmap_destroy(&tmp_union); 996 997 return 0; 998} 999 1000static int bool_copy_callback(hashtab_key_t key, hashtab_datum_t datum, 1001 void *data) 1002{ 1003 int ret; 1004 expand_state_t *state; 1005 cond_bool_datum_t *bool, *new_bool; 1006 char *id, *new_id; 1007 1008 id = key; 1009 bool = (cond_bool_datum_t *) datum; 1010 state = (expand_state_t *) data; 1011 1012 if (!is_id_enabled(id, state->base, SYM_BOOLS)) { 1013 /* identifier's scope is not enabled */ 1014 return 0; 1015 } 1016 1017 if (bool->flags & COND_BOOL_FLAGS_TUNABLE) { 1018 /* Skip tunables */ 1019 return 0; 1020 } 1021 1022 if (state->verbose) 1023 INFO(state->handle, "copying boolean %s", id); 1024 1025 new_bool = (cond_bool_datum_t *) malloc(sizeof(cond_bool_datum_t)); 1026 if (!new_bool) { 1027 ERR(state->handle, "Out of memory!"); 1028 return -1; 1029 } 1030 1031 new_id = strdup(id); 1032 if (!new_id) { 1033 ERR(state->handle, "Out of memory!"); 1034 free(new_bool); 1035 return -1; 1036 } 1037 1038 state->out->p_bools.nprim++; 1039 new_bool->s.value = state->out->p_bools.nprim; 1040 1041 ret = hashtab_insert(state->out->p_bools.table, 1042 (hashtab_key_t) new_id, 1043 (hashtab_datum_t) new_bool); 1044 if (ret) { 1045 ERR(state->handle, "hashtab overflow"); 1046 free(new_bool); 1047 free(new_id); 1048 return -1; 1049 } 1050 1051 state->boolmap[bool->s.value - 1] = new_bool->s.value; 1052 1053 new_bool->state = bool->state; 1054 new_bool->flags = bool->flags; 1055 1056 return 0; 1057} 1058 1059static int sens_copy_callback(hashtab_key_t key, hashtab_datum_t datum, 1060 void *data) 1061{ 1062 expand_state_t *state = (expand_state_t *) data; 1063 level_datum_t *level = (level_datum_t *) datum, *new_level = NULL; 1064 char *id = (char *)key, *new_id = NULL; 1065 1066 if (!is_id_enabled(id, state->base, SYM_LEVELS)) { 1067 /* identifier's scope is not enabled */ 1068 return 0; 1069 } 1070 1071 if (state->verbose) 1072 INFO(state->handle, "copying sensitivity level %s", id); 1073 1074 new_level = (level_datum_t *) malloc(sizeof(level_datum_t)); 1075 if (!new_level) 1076 goto out_of_mem; 1077 level_datum_init(new_level); 1078 new_level->level = (mls_level_t *) malloc(sizeof(mls_level_t)); 1079 if (!new_level->level) 1080 goto out_of_mem; 1081 mls_level_init(new_level->level); 1082 new_id = strdup(id); 1083 if (!new_id) 1084 goto out_of_mem; 1085 1086 if (mls_level_cpy(new_level->level, level->level)) { 1087 goto out_of_mem; 1088 } 1089 new_level->isalias = level->isalias; 1090 state->out->p_levels.nprim++; 1091 1092 if (hashtab_insert(state->out->p_levels.table, 1093 (hashtab_key_t) new_id, 1094 (hashtab_datum_t) new_level)) { 1095 goto out_of_mem; 1096 } 1097 return 0; 1098 1099 out_of_mem: 1100 ERR(state->handle, "Out of memory!"); 1101 if (new_level != NULL && new_level->level != NULL) { 1102 mls_level_destroy(new_level->level); 1103 free(new_level->level); 1104 } 1105 level_datum_destroy(new_level); 1106 free(new_level); 1107 free(new_id); 1108 return -1; 1109} 1110 1111static int cats_copy_callback(hashtab_key_t key, hashtab_datum_t datum, 1112 void *data) 1113{ 1114 expand_state_t *state = (expand_state_t *) data; 1115 cat_datum_t *cat = (cat_datum_t *) datum, *new_cat = NULL; 1116 char *id = (char *)key, *new_id = NULL; 1117 1118 if (!is_id_enabled(id, state->base, SYM_CATS)) { 1119 /* identifier's scope is not enabled */ 1120 return 0; 1121 } 1122 1123 if (state->verbose) 1124 INFO(state->handle, "copying category attribute %s", id); 1125 1126 new_cat = (cat_datum_t *) malloc(sizeof(cat_datum_t)); 1127 if (!new_cat) 1128 goto out_of_mem; 1129 cat_datum_init(new_cat); 1130 new_id = strdup(id); 1131 if (!new_id) 1132 goto out_of_mem; 1133 1134 new_cat->s.value = cat->s.value; 1135 new_cat->isalias = cat->isalias; 1136 state->out->p_cats.nprim++; 1137 if (hashtab_insert(state->out->p_cats.table, 1138 (hashtab_key_t) new_id, (hashtab_datum_t) new_cat)) { 1139 goto out_of_mem; 1140 } 1141 1142 return 0; 1143 1144 out_of_mem: 1145 ERR(state->handle, "Out of memory!"); 1146 cat_datum_destroy(new_cat); 1147 free(new_cat); 1148 free(new_id); 1149 return -1; 1150} 1151 1152static int copy_role_allows(expand_state_t * state, role_allow_rule_t * rules) 1153{ 1154 unsigned int i, j; 1155 role_allow_t *cur_allow, *n, *l; 1156 role_allow_rule_t *cur; 1157 ebitmap_t roles, new_roles; 1158 ebitmap_node_t *snode, *tnode; 1159 1160 /* start at the end of the list */ 1161 for (l = state->out->role_allow; l && l->next; l = l->next) ; 1162 1163 cur = rules; 1164 while (cur) { 1165 ebitmap_init(&roles); 1166 ebitmap_init(&new_roles); 1167 1168 if (role_set_expand(&cur->roles, &roles, state->out, state->base, state->rolemap)) { 1169 ERR(state->handle, "Out of memory!"); 1170 return -1; 1171 } 1172 1173 if (role_set_expand(&cur->new_roles, &new_roles, state->out, state->base, state->rolemap)) { 1174 ERR(state->handle, "Out of memory!"); 1175 return -1; 1176 } 1177 1178 ebitmap_for_each_bit(&roles, snode, i) { 1179 if (!ebitmap_node_get_bit(snode, i)) 1180 continue; 1181 ebitmap_for_each_bit(&new_roles, tnode, j) { 1182 if (!ebitmap_node_get_bit(tnode, j)) 1183 continue; 1184 /* check for duplicates */ 1185 cur_allow = state->out->role_allow; 1186 while (cur_allow) { 1187 if ((cur_allow->role == i + 1) && 1188 (cur_allow->new_role == j + 1)) 1189 break; 1190 cur_allow = cur_allow->next; 1191 } 1192 if (cur_allow) 1193 continue; 1194 n = (role_allow_t *) 1195 malloc(sizeof(role_allow_t)); 1196 if (!n) { 1197 ERR(state->handle, "Out of memory!"); 1198 return -1; 1199 } 1200 memset(n, 0, sizeof(role_allow_t)); 1201 n->role = i + 1; 1202 n->new_role = j + 1; 1203 if (l) { 1204 l->next = n; 1205 } else { 1206 state->out->role_allow = n; 1207 } 1208 l = n; 1209 } 1210 } 1211 1212 ebitmap_destroy(&roles); 1213 ebitmap_destroy(&new_roles); 1214 1215 cur = cur->next; 1216 } 1217 1218 return 0; 1219} 1220 1221static int copy_role_trans(expand_state_t * state, role_trans_rule_t * rules) 1222{ 1223 unsigned int i, j, k; 1224 role_trans_t *n, *l, *cur_trans; 1225 role_trans_rule_t *cur; 1226 ebitmap_t roles, types; 1227 ebitmap_node_t *rnode, *tnode, *cnode; 1228 1229 /* start at the end of the list */ 1230 for (l = state->out->role_tr; l && l->next; l = l->next) ; 1231 1232 cur = rules; 1233 while (cur) { 1234 ebitmap_init(&roles); 1235 ebitmap_init(&types); 1236 1237 if (role_set_expand(&cur->roles, &roles, state->out, state->base, state->rolemap)) { 1238 ERR(state->handle, "Out of memory!"); 1239 return -1; 1240 } 1241 if (expand_convert_type_set 1242 (state->out, state->typemap, &cur->types, &types, 1)) { 1243 ERR(state->handle, "Out of memory!"); 1244 return -1; 1245 } 1246 ebitmap_for_each_bit(&roles, rnode, i) { 1247 if (!ebitmap_node_get_bit(rnode, i)) 1248 continue; 1249 ebitmap_for_each_bit(&types, tnode, j) { 1250 if (!ebitmap_node_get_bit(tnode, j)) 1251 continue; 1252 ebitmap_for_each_bit(&cur->classes, cnode, k) { 1253 if (!ebitmap_node_get_bit(cnode, k)) 1254 continue; 1255 1256 cur_trans = state->out->role_tr; 1257 while (cur_trans) { 1258 unsigned int mapped_role; 1259 1260 mapped_role = state->rolemap[cur->new_role - 1]; 1261 1262 if ((cur_trans->role == 1263 i + 1) && 1264 (cur_trans->type == 1265 j + 1) && 1266 (cur_trans->tclass == 1267 k + 1)) { 1268 if (cur_trans->new_role == mapped_role) { 1269 break; 1270 } else { 1271 ERR(state->handle, 1272 "Conflicting role trans rule %s %s : %s { %s vs %s }", 1273 state->out->p_role_val_to_name[i], 1274 state->out->p_type_val_to_name[j], 1275 state->out->p_class_val_to_name[k], 1276 state->out->p_role_val_to_name[mapped_role - 1], 1277 state->out->p_role_val_to_name[cur_trans->new_role - 1]); 1278 return -1; 1279 } 1280 } 1281 cur_trans = cur_trans->next; 1282 } 1283 if (cur_trans) 1284 continue; 1285 1286 n = (role_trans_t *) 1287 malloc(sizeof(role_trans_t)); 1288 if (!n) { 1289 ERR(state->handle, 1290 "Out of memory!"); 1291 return -1; 1292 } 1293 memset(n, 0, sizeof(role_trans_t)); 1294 n->role = i + 1; 1295 n->type = j + 1; 1296 n->tclass = k + 1; 1297 n->new_role = state->rolemap 1298 [cur->new_role - 1]; 1299 if (l) 1300 l->next = n; 1301 else 1302 state->out->role_tr = n; 1303 1304 l = n; 1305 } 1306 } 1307 } 1308 1309 ebitmap_destroy(&roles); 1310 ebitmap_destroy(&types); 1311 1312 cur = cur->next; 1313 } 1314 return 0; 1315} 1316 1317static int expand_filename_trans(expand_state_t *state, filename_trans_rule_t *rules) 1318{ 1319 unsigned int i, j; 1320 filename_trans_t *new_trans, *tail, *cur_trans; 1321 filename_trans_rule_t *cur_rule; 1322 ebitmap_t stypes, ttypes; 1323 ebitmap_node_t *snode, *tnode; 1324 1325 /* start at the end of the list */ 1326 tail = state->out->filename_trans; 1327 while (tail && tail->next) 1328 tail = tail->next; 1329 1330 cur_rule = rules; 1331 while (cur_rule) { 1332 ebitmap_init(&stypes); 1333 ebitmap_init(&ttypes); 1334 1335 if (expand_convert_type_set(state->out, state->typemap, 1336 &cur_rule->stypes, &stypes, 1)) { 1337 ERR(state->handle, "Out of memory!"); 1338 return -1; 1339 } 1340 1341 if (expand_convert_type_set(state->out, state->typemap, 1342 &cur_rule->ttypes, &ttypes, 1)) { 1343 ERR(state->handle, "Out of memory!"); 1344 return -1; 1345 } 1346 1347 ebitmap_for_each_bit(&stypes, snode, i) { 1348 if (!ebitmap_node_get_bit(snode, i)) 1349 continue; 1350 ebitmap_for_each_bit(&ttypes, tnode, j) { 1351 if (!ebitmap_node_get_bit(tnode, j)) 1352 continue; 1353 1354 cur_trans = state->out->filename_trans; 1355 while (cur_trans) { 1356 if ((cur_trans->stype == i + 1) && 1357 (cur_trans->ttype == j + 1) && 1358 (cur_trans->tclass == cur_rule->tclass) && 1359 (!strcmp(cur_trans->name, cur_rule->name))) { 1360 /* duplicate rule, who cares */ 1361 if (cur_trans->otype == cur_rule->otype) 1362 break; 1363 1364 ERR(state->handle, "Conflicting filename trans rules %s %s %s : %s otype1:%s otype2:%s", 1365 cur_trans->name, 1366 state->out->p_type_val_to_name[i], 1367 state->out->p_type_val_to_name[j], 1368 state->out->p_class_val_to_name[cur_trans->tclass - 1], 1369 state->out->p_type_val_to_name[cur_trans->otype - 1], 1370 state->out->p_type_val_to_name[state->typemap[cur_rule->otype - 1] - 1]); 1371 1372 return -1; 1373 } 1374 cur_trans = cur_trans->next; 1375 } 1376 /* duplicate rule, who cares */ 1377 if (cur_trans) 1378 continue; 1379 1380 new_trans = malloc(sizeof(*new_trans)); 1381 if (!new_trans) { 1382 ERR(state->handle, "Out of memory!"); 1383 return -1; 1384 } 1385 memset(new_trans, 0, sizeof(*new_trans)); 1386 if (tail) 1387 tail->next = new_trans; 1388 else 1389 state->out->filename_trans = new_trans; 1390 tail = new_trans; 1391 1392 new_trans->name = strdup(cur_rule->name); 1393 if (!new_trans->name) { 1394 ERR(state->handle, "Out of memory!"); 1395 return -1; 1396 } 1397 new_trans->stype = i + 1; 1398 new_trans->ttype = j + 1; 1399 new_trans->tclass = cur_rule->tclass; 1400 new_trans->otype = state->typemap[cur_rule->otype - 1]; 1401 } 1402 } 1403 1404 ebitmap_destroy(&stypes); 1405 ebitmap_destroy(&ttypes); 1406 1407 cur_rule = cur_rule->next; 1408 } 1409 return 0; 1410} 1411 1412static int exp_rangetr_helper(uint32_t stype, uint32_t ttype, uint32_t tclass, 1413 mls_semantic_range_t * trange, 1414 expand_state_t * state) 1415{ 1416 range_trans_t *rt, *check_rt = state->out->range_tr; 1417 mls_range_t exp_range; 1418 int rc = -1; 1419 1420 if (mls_semantic_range_expand(trange, &exp_range, state->out, 1421 state->handle)) 1422 goto out; 1423 1424 /* check for duplicates/conflicts */ 1425 while (check_rt) { 1426 if ((check_rt->source_type == stype) && 1427 (check_rt->target_type == ttype) && 1428 (check_rt->target_class == tclass)) { 1429 if (mls_range_eq(&check_rt->target_range, &exp_range)) { 1430 /* duplicate */ 1431 break; 1432 } else { 1433 /* conflict */ 1434 ERR(state->handle, 1435 "Conflicting range trans rule %s %s : %s", 1436 state->out->p_type_val_to_name[stype - 1], 1437 state->out->p_type_val_to_name[ttype - 1], 1438 state->out->p_class_val_to_name[tclass - 1439 1]); 1440 goto out; 1441 } 1442 } 1443 check_rt = check_rt->next; 1444 } 1445 if (check_rt) { 1446 /* this is a dup - skip */ 1447 rc = 0; 1448 goto out; 1449 } 1450 1451 rt = (range_trans_t *) calloc(1, sizeof(range_trans_t)); 1452 if (!rt) { 1453 ERR(state->handle, "Out of memory!"); 1454 goto out; 1455 } 1456 1457 rt->next = state->out->range_tr; 1458 state->out->range_tr = rt; 1459 1460 rt->source_type = stype; 1461 rt->target_type = ttype; 1462 rt->target_class = tclass; 1463 if (mls_range_cpy(&rt->target_range, &exp_range)) { 1464 ERR(state->handle, "Out of memory!"); 1465 goto out; 1466 } 1467 1468 rc = 0; 1469 1470 out: 1471 mls_range_destroy(&exp_range); 1472 return rc; 1473} 1474 1475static int expand_range_trans(expand_state_t * state, 1476 range_trans_rule_t * rules) 1477{ 1478 unsigned int i, j, k; 1479 range_trans_rule_t *rule; 1480 1481 ebitmap_t stypes, ttypes; 1482 ebitmap_node_t *snode, *tnode, *cnode; 1483 1484 if (state->verbose) 1485 INFO(state->handle, "expanding range transitions"); 1486 1487 for (rule = rules; rule; rule = rule->next) { 1488 ebitmap_init(&stypes); 1489 ebitmap_init(&ttypes); 1490 1491 /* expand the type sets */ 1492 if (expand_convert_type_set(state->out, state->typemap, 1493 &rule->stypes, &stypes, 1)) { 1494 ERR(state->handle, "Out of memory!"); 1495 return -1; 1496 } 1497 if (expand_convert_type_set(state->out, state->typemap, 1498 &rule->ttypes, &ttypes, 1)) { 1499 ebitmap_destroy(&stypes); 1500 ERR(state->handle, "Out of memory!"); 1501 return -1; 1502 } 1503 1504 /* loop on source type */ 1505 ebitmap_for_each_bit(&stypes, snode, i) { 1506 if (!ebitmap_node_get_bit(snode, i)) 1507 continue; 1508 /* loop on target type */ 1509 ebitmap_for_each_bit(&ttypes, tnode, j) { 1510 if (!ebitmap_node_get_bit(tnode, j)) 1511 continue; 1512 /* loop on target class */ 1513 ebitmap_for_each_bit(&rule->tclasses, cnode, k) { 1514 if (!ebitmap_node_get_bit(cnode, k)) 1515 continue; 1516 1517 if (exp_rangetr_helper(i + 1, 1518 j + 1, 1519 k + 1, 1520 &rule->trange, 1521 state)) { 1522 ebitmap_destroy(&stypes); 1523 ebitmap_destroy(&ttypes); 1524 return -1; 1525 } 1526 } 1527 } 1528 } 1529 1530 ebitmap_destroy(&stypes); 1531 ebitmap_destroy(&ttypes); 1532 } 1533 1534 return 0; 1535} 1536 1537/* Search for an AV tab node within a hash table with the given key. 1538 * If the node does not exist, create it and return it; otherwise 1539 * return the pre-existing one. 1540*/ 1541static avtab_ptr_t find_avtab_node(sepol_handle_t * handle, 1542 avtab_t * avtab, avtab_key_t * key, 1543 cond_av_list_t ** cond) 1544{ 1545 avtab_ptr_t node; 1546 avtab_datum_t avdatum; 1547 cond_av_list_t *nl; 1548 1549 node = avtab_search_node(avtab, key); 1550 1551 /* If this is for conditional policies, keep searching in case 1552 the node is part of my conditional avtab. */ 1553 if (cond) { 1554 while (node) { 1555 if (node->parse_context == cond) 1556 break; 1557 node = avtab_search_node_next(node, key->specified); 1558 } 1559 } 1560 1561 if (!node) { 1562 memset(&avdatum, 0, sizeof avdatum); 1563 /* this is used to get the node - insertion is actually unique */ 1564 node = avtab_insert_nonunique(avtab, key, &avdatum); 1565 if (!node) { 1566 ERR(handle, "hash table overflow"); 1567 return NULL; 1568 } 1569 if (cond) { 1570 node->parse_context = cond; 1571 nl = (cond_av_list_t *) malloc(sizeof(cond_av_list_t)); 1572 if (!nl) { 1573 ERR(handle, "Memory error"); 1574 return NULL; 1575 } 1576 memset(nl, 0, sizeof(cond_av_list_t)); 1577 nl->node = node; 1578 nl->next = *cond; 1579 *cond = nl; 1580 } 1581 } 1582 1583 return node; 1584} 1585 1586#define EXPAND_RULE_SUCCESS 1 1587#define EXPAND_RULE_CONFLICT 0 1588#define EXPAND_RULE_ERROR -1 1589 1590static int expand_terule_helper(sepol_handle_t * handle, 1591 policydb_t * p, uint32_t * typemap, 1592 uint32_t specified, cond_av_list_t ** cond, 1593 cond_av_list_t ** other, uint32_t stype, 1594 uint32_t ttype, class_perm_node_t * perms, 1595 avtab_t * avtab, int enabled) 1596{ 1597 avtab_key_t avkey; 1598 avtab_datum_t *avdatump; 1599 avtab_ptr_t node; 1600 class_perm_node_t *cur; 1601 int conflict; 1602 uint32_t oldtype = 0, spec = 0; 1603 1604 if (specified & AVRULE_TRANSITION) { 1605 spec = AVTAB_TRANSITION; 1606 } else if (specified & AVRULE_MEMBER) { 1607 spec = AVTAB_MEMBER; 1608 } else if (specified & AVRULE_CHANGE) { 1609 spec = AVTAB_CHANGE; 1610 } else { 1611 assert(0); /* unreachable */ 1612 } 1613 1614 cur = perms; 1615 while (cur) { 1616 uint32_t remapped_data = 1617 typemap ? typemap[cur->data - 1] : cur->data; 1618 avkey.source_type = stype + 1; 1619 avkey.target_type = ttype + 1; 1620 avkey.target_class = cur->class; 1621 avkey.specified = spec; 1622 1623 conflict = 0; 1624 /* check to see if the expanded TE already exists -- 1625 * either in the global scope or in another 1626 * conditional AV tab */ 1627 node = avtab_search_node(&p->te_avtab, &avkey); 1628 if (node) { 1629 conflict = 1; 1630 } else { 1631 node = avtab_search_node(&p->te_cond_avtab, &avkey); 1632 if (node && node->parse_context != other) { 1633 conflict = 2; 1634 } 1635 } 1636 1637 if (conflict) { 1638 avdatump = &node->datum; 1639 if (specified & AVRULE_TRANSITION) { 1640 oldtype = avdatump->data; 1641 } else if (specified & AVRULE_MEMBER) { 1642 oldtype = avdatump->data; 1643 } else if (specified & AVRULE_CHANGE) { 1644 oldtype = avdatump->data; 1645 } 1646 1647 if (oldtype == remapped_data) { 1648 /* if the duplicate is inside the same scope (eg., unconditional 1649 * or in same conditional then ignore it */ 1650 if ((conflict == 1 && cond == NULL) 1651 || node->parse_context == cond) 1652 return EXPAND_RULE_SUCCESS; 1653 ERR(handle, "duplicate TE rule for %s %s:%s %s", 1654 p->p_type_val_to_name[avkey.source_type - 1655 1], 1656 p->p_type_val_to_name[avkey.target_type - 1657 1], 1658 p->p_class_val_to_name[avkey.target_class - 1659 1], 1660 p->p_type_val_to_name[oldtype - 1]); 1661 return EXPAND_RULE_CONFLICT; 1662 } 1663 ERR(handle, 1664 "conflicting TE rule for (%s, %s:%s): old was %s, new is %s", 1665 p->p_type_val_to_name[avkey.source_type - 1], 1666 p->p_type_val_to_name[avkey.target_type - 1], 1667 p->p_class_val_to_name[avkey.target_class - 1], 1668 p->p_type_val_to_name[oldtype - 1], 1669 p->p_type_val_to_name[remapped_data - 1]); 1670 return EXPAND_RULE_CONFLICT; 1671 } 1672 1673 node = find_avtab_node(handle, avtab, &avkey, cond); 1674 if (!node) 1675 return -1; 1676 if (enabled) { 1677 node->key.specified |= AVTAB_ENABLED; 1678 } else { 1679 node->key.specified &= ~AVTAB_ENABLED; 1680 } 1681 1682 avdatump = &node->datum; 1683 if (specified & AVRULE_TRANSITION) { 1684 avdatump->data = remapped_data; 1685 } else if (specified & AVRULE_MEMBER) { 1686 avdatump->data = remapped_data; 1687 } else if (specified & AVRULE_CHANGE) { 1688 avdatump->data = remapped_data; 1689 } else { 1690 assert(0); /* should never occur */ 1691 } 1692 1693 cur = cur->next; 1694 } 1695 1696 return EXPAND_RULE_SUCCESS; 1697} 1698 1699static int expand_avrule_helper(sepol_handle_t * handle, 1700 uint32_t specified, 1701 cond_av_list_t ** cond, 1702 uint32_t stype, uint32_t ttype, 1703 class_perm_node_t * perms, avtab_t * avtab, 1704 int enabled) 1705{ 1706 avtab_key_t avkey; 1707 avtab_datum_t *avdatump; 1708 avtab_ptr_t node; 1709 class_perm_node_t *cur; 1710 uint32_t spec = 0; 1711 1712 if (specified & AVRULE_ALLOWED) { 1713 spec = AVTAB_ALLOWED; 1714 } else if (specified & AVRULE_AUDITALLOW) { 1715 spec = AVTAB_AUDITALLOW; 1716 } else if (specified & AVRULE_AUDITDENY) { 1717 spec = AVTAB_AUDITDENY; 1718 } else if (specified & AVRULE_DONTAUDIT) { 1719 if (handle && handle->disable_dontaudit) 1720 return EXPAND_RULE_SUCCESS; 1721 spec = AVTAB_AUDITDENY; 1722 } else if (specified & AVRULE_NEVERALLOW) { 1723 spec = AVTAB_NEVERALLOW; 1724 } else { 1725 assert(0); /* unreachable */ 1726 } 1727 1728 cur = perms; 1729 while (cur) { 1730 avkey.source_type = stype + 1; 1731 avkey.target_type = ttype + 1; 1732 avkey.target_class = cur->class; 1733 avkey.specified = spec; 1734 1735 node = find_avtab_node(handle, avtab, &avkey, cond); 1736 if (!node) 1737 return EXPAND_RULE_ERROR; 1738 if (enabled) { 1739 node->key.specified |= AVTAB_ENABLED; 1740 } else { 1741 node->key.specified &= ~AVTAB_ENABLED; 1742 } 1743 1744 avdatump = &node->datum; 1745 if (specified & AVRULE_ALLOWED) { 1746 avdatump->data |= cur->data; 1747 } else if (specified & AVRULE_AUDITALLOW) { 1748 avdatump->data |= cur->data; 1749 } else if (specified & AVRULE_NEVERALLOW) { 1750 avdatump->data |= cur->data; 1751 } else if (specified & AVRULE_AUDITDENY) { 1752 /* Since a '0' in an auditdeny mask represents 1753 * a permission we do NOT want to audit 1754 * (dontaudit), we use the '&' operand to 1755 * ensure that all '0's in the mask are 1756 * retained (much unlike the allow and 1757 * auditallow cases). 1758 */ 1759 avdatump->data &= cur->data; 1760 } else if (specified & AVRULE_DONTAUDIT) { 1761 if (avdatump->data) 1762 avdatump->data &= ~cur->data; 1763 else 1764 avdatump->data = ~cur->data; 1765 } else { 1766 assert(0); /* should never occur */ 1767 } 1768 1769 cur = cur->next; 1770 } 1771 return EXPAND_RULE_SUCCESS; 1772} 1773 1774static int expand_rule_helper(sepol_handle_t * handle, 1775 policydb_t * p, uint32_t * typemap, 1776 avrule_t * source_rule, avtab_t * dest_avtab, 1777 cond_av_list_t ** cond, cond_av_list_t ** other, 1778 int enabled, 1779 ebitmap_t * stypes, ebitmap_t * ttypes) 1780{ 1781 unsigned int i, j; 1782 int retval; 1783 ebitmap_node_t *snode, *tnode; 1784 1785 ebitmap_for_each_bit(stypes, snode, i) { 1786 if (!ebitmap_node_get_bit(snode, i)) 1787 continue; 1788 if (source_rule->flags & RULE_SELF) { 1789 if (source_rule->specified & AVRULE_AV) { 1790 if ((retval = 1791 expand_avrule_helper(handle, 1792 source_rule-> 1793 specified, cond, i, i, 1794 source_rule->perms, 1795 dest_avtab, 1796 enabled)) != 1797 EXPAND_RULE_SUCCESS) { 1798 return retval; 1799 } 1800 } else { 1801 if ((retval = 1802 expand_terule_helper(handle, p, 1803 typemap, 1804 source_rule-> 1805 specified, cond, 1806 other, i, i, 1807 source_rule->perms, 1808 dest_avtab, 1809 enabled)) != 1810 EXPAND_RULE_SUCCESS) { 1811 return retval; 1812 } 1813 } 1814 } 1815 ebitmap_for_each_bit(ttypes, tnode, j) { 1816 if (!ebitmap_node_get_bit(tnode, j)) 1817 continue; 1818 if (source_rule->specified & AVRULE_AV) { 1819 if ((retval = 1820 expand_avrule_helper(handle, 1821 source_rule-> 1822 specified, cond, i, j, 1823 source_rule->perms, 1824 dest_avtab, 1825 enabled)) != 1826 EXPAND_RULE_SUCCESS) { 1827 return retval; 1828 } 1829 } else { 1830 if ((retval = 1831 expand_terule_helper(handle, p, 1832 typemap, 1833 source_rule-> 1834 specified, cond, 1835 other, i, j, 1836 source_rule->perms, 1837 dest_avtab, 1838 enabled)) != 1839 EXPAND_RULE_SUCCESS) { 1840 return retval; 1841 } 1842 } 1843 } 1844 } 1845 1846 return EXPAND_RULE_SUCCESS; 1847} 1848 1849/* 1850 * Expand a rule into a given avtab - checking for conflicting type 1851 * rules in the destination policy. Return EXPAND_RULE_SUCCESS on 1852 * success, EXPAND_RULE_CONFLICT if the rule conflicts with something 1853 * (and hence was not added), or EXPAND_RULE_ERROR on error. 1854 */ 1855static int convert_and_expand_rule(sepol_handle_t * handle, 1856 policydb_t * dest_pol, uint32_t * typemap, 1857 avrule_t * source_rule, avtab_t * dest_avtab, 1858 cond_av_list_t ** cond, 1859 cond_av_list_t ** other, int enabled, 1860 int do_neverallow) 1861{ 1862 int retval; 1863 ebitmap_t stypes, ttypes; 1864 unsigned char alwaysexpand; 1865 1866 if (!do_neverallow && source_rule->specified & AVRULE_NEVERALLOW) 1867 return EXPAND_RULE_SUCCESS; 1868 1869 ebitmap_init(&stypes); 1870 ebitmap_init(&ttypes); 1871 1872 /* Force expansion for type rules and for self rules. */ 1873 alwaysexpand = ((source_rule->specified & AVRULE_TYPE) || 1874 (source_rule->flags & RULE_SELF)); 1875 1876 if (expand_convert_type_set 1877 (dest_pol, typemap, &source_rule->stypes, &stypes, alwaysexpand)) 1878 return EXPAND_RULE_ERROR; 1879 if (expand_convert_type_set 1880 (dest_pol, typemap, &source_rule->ttypes, &ttypes, alwaysexpand)) 1881 return EXPAND_RULE_ERROR; 1882 1883 retval = expand_rule_helper(handle, dest_pol, typemap, 1884 source_rule, dest_avtab, 1885 cond, other, enabled, &stypes, &ttypes); 1886 ebitmap_destroy(&stypes); 1887 ebitmap_destroy(&ttypes); 1888 return retval; 1889} 1890 1891static int cond_avrule_list_copy(policydb_t * dest_pol, avrule_t * source_rules, 1892 avtab_t * dest_avtab, cond_av_list_t ** list, 1893 cond_av_list_t ** other, uint32_t * typemap, 1894 int enabled, expand_state_t * state) 1895{ 1896 avrule_t *cur; 1897 1898 cur = source_rules; 1899 while (cur) { 1900 if (convert_and_expand_rule(state->handle, dest_pol, 1901 typemap, cur, dest_avtab, 1902 list, other, enabled, 1903 0) != EXPAND_RULE_SUCCESS) { 1904 return -1; 1905 } 1906 1907 cur = cur->next; 1908 } 1909 1910 return 0; 1911} 1912 1913static int cond_node_map_bools(expand_state_t * state, cond_node_t * cn) 1914{ 1915 cond_expr_t *cur; 1916 unsigned int i; 1917 1918 cur = cn->expr; 1919 while (cur) { 1920 if (cur->bool) 1921 cur->bool = state->boolmap[cur->bool - 1]; 1922 cur = cur->next; 1923 } 1924 1925 for (i = 0; i < min(cn->nbools, COND_MAX_BOOLS); i++) 1926 cn->bool_ids[i] = state->boolmap[cn->bool_ids[i] - 1]; 1927 1928 if (cond_normalize_expr(state->out, cn)) { 1929 ERR(state->handle, "Error while normalizing conditional"); 1930 return -1; 1931 } 1932 1933 return 0; 1934} 1935 1936/* copy the nodes in *reverse* order -- the result is that the last 1937 * given conditional appears first in the policy, so as to match the 1938 * behavior of the upstream compiler */ 1939static int cond_node_copy(expand_state_t * state, cond_node_t * cn) 1940{ 1941 cond_node_t *new_cond, *tmp; 1942 1943 if (cn == NULL) { 1944 return 0; 1945 } 1946 if (cond_node_copy(state, cn->next)) { 1947 return -1; 1948 } 1949 1950 /* If current cond_node_t is of tunable, its effective branch 1951 * has been appended to its home decl->avrules list during link 1952 * and now we should just skip it. */ 1953 if (cn->flags & COND_NODE_FLAGS_TUNABLE) 1954 return 0; 1955 1956 if (cond_normalize_expr(state->base, cn)) { 1957 ERR(state->handle, "Error while normalizing conditional"); 1958 return -1; 1959 } 1960 1961 /* create a new temporary conditional node with the booleans 1962 * mapped */ 1963 tmp = cond_node_create(state->base, cn); 1964 if (!tmp) { 1965 ERR(state->handle, "Out of memory"); 1966 return -1; 1967 } 1968 1969 if (cond_node_map_bools(state, tmp)) { 1970 ERR(state->handle, "Error mapping booleans"); 1971 return -1; 1972 } 1973 1974 new_cond = cond_node_search(state->out, state->out->cond_list, tmp); 1975 if (!new_cond) { 1976 cond_node_destroy(tmp); 1977 free(tmp); 1978 ERR(state->handle, "Out of memory!"); 1979 return -1; 1980 } 1981 cond_node_destroy(tmp); 1982 free(tmp); 1983 1984 if (cond_avrule_list_copy 1985 (state->out, cn->avtrue_list, &state->out->te_cond_avtab, 1986 &new_cond->true_list, &new_cond->false_list, state->typemap, 1987 new_cond->cur_state, state)) 1988 return -1; 1989 if (cond_avrule_list_copy 1990 (state->out, cn->avfalse_list, &state->out->te_cond_avtab, 1991 &new_cond->false_list, &new_cond->true_list, state->typemap, 1992 !new_cond->cur_state, state)) 1993 return -1; 1994 1995 return 0; 1996} 1997 1998static int context_copy(context_struct_t * dst, context_struct_t * src, 1999 expand_state_t * state) 2000{ 2001 dst->user = state->usermap[src->user - 1]; 2002 dst->role = state->rolemap[src->role - 1]; 2003 dst->type = state->typemap[src->type - 1]; 2004 return mls_context_cpy(dst, src); 2005} 2006 2007static int ocontext_copy_xen(expand_state_t *state) 2008{ 2009 unsigned int i; 2010 ocontext_t *c, *n, *l; 2011 2012 for (i = 0; i < OCON_NUM; i++) { 2013 l = NULL; 2014 for (c = state->base->ocontexts[i]; c; c = c->next) { 2015 n = malloc(sizeof(ocontext_t)); 2016 if (!n) { 2017 ERR(state->handle, "Out of memory!"); 2018 return -1; 2019 } 2020 memset(n, 0, sizeof(ocontext_t)); 2021 if (l) 2022 l->next = n; 2023 else 2024 state->out->ocontexts[i] = n; 2025 l = n; 2026 if (context_copy(&n->context[0], &c->context[0], 2027 state)) { 2028 ERR(state->handle, "Out of memory!"); 2029 return -1; 2030 } 2031 switch (i) { 2032 case OCON_XEN_ISID: 2033 n->sid[0] = c->sid[0]; 2034 break; 2035 case OCON_XEN_PIRQ: 2036 n->u.pirq = c->u.pirq; 2037 break; 2038 case OCON_XEN_IOPORT: 2039 n->u.ioport.low_ioport = c->u.ioport.low_ioport; 2040 n->u.ioport.high_ioport = 2041 c->u.ioport.high_ioport; 2042 break; 2043 case OCON_XEN_IOMEM: 2044 n->u.iomem.low_iomem = c->u.iomem.low_iomem; 2045 n->u.iomem.high_iomem = c->u.iomem.high_iomem; 2046 break; 2047 case OCON_XEN_PCIDEVICE: 2048 n->u.device = c->u.device; 2049 break; 2050 default: 2051 /* shouldn't get here */ 2052 ERR(state->handle, "Unknown ocontext"); 2053 return -1; 2054 } 2055 } 2056 } 2057 return 0; 2058} 2059 2060static int ocontext_copy_selinux(expand_state_t *state) 2061{ 2062 unsigned int i, j; 2063 ocontext_t *c, *n, *l; 2064 2065 for (i = 0; i < OCON_NUM; i++) { 2066 l = NULL; 2067 for (c = state->base->ocontexts[i]; c; c = c->next) { 2068 n = malloc(sizeof(ocontext_t)); 2069 if (!n) { 2070 ERR(state->handle, "Out of memory!"); 2071 return -1; 2072 } 2073 memset(n, 0, sizeof(ocontext_t)); 2074 if (l) 2075 l->next = n; 2076 else 2077 state->out->ocontexts[i] = n; 2078 l = n; 2079 if (context_copy(&n->context[0], &c->context[0], state)) { 2080 ERR(state->handle, "Out of memory!"); 2081 return -1; 2082 } 2083 switch (i) { 2084 case OCON_ISID: 2085 n->sid[0] = c->sid[0]; 2086 break; 2087 case OCON_FS: /* FALLTHROUGH */ 2088 case OCON_NETIF: 2089 n->u.name = strdup(c->u.name); 2090 if (!n->u.name) { 2091 ERR(state->handle, "Out of memory!"); 2092 return -1; 2093 } 2094 if (context_copy 2095 (&n->context[1], &c->context[1], state)) { 2096 ERR(state->handle, "Out of memory!"); 2097 return -1; 2098 } 2099 break; 2100 case OCON_PORT: 2101 n->u.port.protocol = c->u.port.protocol; 2102 n->u.port.low_port = c->u.port.low_port; 2103 n->u.port.high_port = c->u.port.high_port; 2104 break; 2105 case OCON_NODE: 2106 n->u.node.addr = c->u.node.addr; 2107 n->u.node.mask = c->u.node.mask; 2108 break; 2109 case OCON_FSUSE: 2110 n->v.behavior = c->v.behavior; 2111 n->u.name = strdup(c->u.name); 2112 if (!n->u.name) { 2113 ERR(state->handle, "Out of memory!"); 2114 return -1; 2115 } 2116 break; 2117 case OCON_NODE6: 2118 for (j = 0; j < 4; j++) 2119 n->u.node6.addr[j] = c->u.node6.addr[j]; 2120 for (j = 0; j < 4; j++) 2121 n->u.node6.mask[j] = c->u.node6.mask[j]; 2122 break; 2123 default: 2124 /* shouldn't get here */ 2125 ERR(state->handle, "Unknown ocontext"); 2126 return -1; 2127 } 2128 } 2129 } 2130 return 0; 2131} 2132 2133static int ocontext_copy(expand_state_t *state, uint32_t target) 2134{ 2135 int rc = -1; 2136 switch (target) { 2137 case SEPOL_TARGET_SELINUX: 2138 rc = ocontext_copy_selinux(state); 2139 break; 2140 case SEPOL_TARGET_XEN: 2141 rc = ocontext_copy_xen(state); 2142 break; 2143 default: 2144 ERR(state->handle, "Unknown target"); 2145 return -1; 2146 } 2147 return rc; 2148} 2149 2150static int genfs_copy(expand_state_t * state) 2151{ 2152 ocontext_t *c, *newc, *l; 2153 genfs_t *genfs, *newgenfs, *end; 2154 2155 end = NULL; 2156 for (genfs = state->base->genfs; genfs; genfs = genfs->next) { 2157 newgenfs = malloc(sizeof(genfs_t)); 2158 if (!newgenfs) { 2159 ERR(state->handle, "Out of memory!"); 2160 return -1; 2161 } 2162 memset(newgenfs, 0, sizeof(genfs_t)); 2163 newgenfs->fstype = strdup(genfs->fstype); 2164 if (!newgenfs->fstype) { 2165 ERR(state->handle, "Out of memory!"); 2166 return -1; 2167 } 2168 2169 l = NULL; 2170 for (c = genfs->head; c; c = c->next) { 2171 newc = malloc(sizeof(ocontext_t)); 2172 if (!newc) { 2173 ERR(state->handle, "Out of memory!"); 2174 return -1; 2175 } 2176 memset(newc, 0, sizeof(ocontext_t)); 2177 newc->u.name = strdup(c->u.name); 2178 if (!newc->u.name) { 2179 ERR(state->handle, "Out of memory!"); 2180 return -1; 2181 } 2182 newc->v.sclass = c->v.sclass; 2183 context_copy(&newc->context[0], &c->context[0], state); 2184 if (l) 2185 l->next = newc; 2186 else 2187 newgenfs->head = newc; 2188 l = newc; 2189 } 2190 if (!end) { 2191 state->out->genfs = newgenfs; 2192 } else { 2193 end->next = newgenfs; 2194 } 2195 end = newgenfs; 2196 } 2197 return 0; 2198} 2199 2200static int type_attr_map(hashtab_key_t key 2201 __attribute__ ((unused)), hashtab_datum_t datum, 2202 void *ptr) 2203{ 2204 type_datum_t *type; 2205 expand_state_t *state = ptr; 2206 policydb_t *p = state->out; 2207 unsigned int i; 2208 ebitmap_node_t *tnode; 2209 2210 type = (type_datum_t *) datum; 2211 if (type->flavor == TYPE_ATTRIB) { 2212 if (ebitmap_cpy(&p->attr_type_map[type->s.value - 1], 2213 &type->types)) { 2214 ERR(state->handle, "Out of memory!"); 2215 return -1; 2216 } 2217 ebitmap_for_each_bit(&type->types, tnode, i) { 2218 if (!ebitmap_node_get_bit(tnode, i)) 2219 continue; 2220 if (ebitmap_set_bit(&p->type_attr_map[i], 2221 type->s.value - 1, 1)) { 2222 ERR(state->handle, "Out of memory!"); 2223 return -1; 2224 } 2225 } 2226 } 2227 return 0; 2228} 2229 2230/* converts typeset using typemap and expands into ebitmap_t types using the attributes in the passed in policy. 2231 * this should not be called until after all the blocks have been processed and the attributes in target policy 2232 * are complete. */ 2233int expand_convert_type_set(policydb_t * p, uint32_t * typemap, 2234 type_set_t * set, ebitmap_t * types, 2235 unsigned char alwaysexpand) 2236{ 2237 type_set_t tmpset; 2238 2239 type_set_init(&tmpset); 2240 2241 if (map_ebitmap(&set->types, &tmpset.types, typemap)) 2242 return -1; 2243 2244 if (map_ebitmap(&set->negset, &tmpset.negset, typemap)) 2245 return -1; 2246 2247 tmpset.flags = set->flags; 2248 2249 if (type_set_expand(&tmpset, types, p, alwaysexpand)) 2250 return -1; 2251 2252 type_set_destroy(&tmpset); 2253 2254 return 0; 2255} 2256 2257/* Expand a rule into a given avtab - checking for conflicting type 2258 * rules. Return 1 on success, 0 if the rule conflicts with something 2259 * (and hence was not added), or -1 on error. */ 2260int expand_rule(sepol_handle_t * handle, 2261 policydb_t * source_pol, 2262 avrule_t * source_rule, avtab_t * dest_avtab, 2263 cond_av_list_t ** cond, cond_av_list_t ** other, int enabled) 2264{ 2265 int retval; 2266 ebitmap_t stypes, ttypes; 2267 2268 if (source_rule->specified & AVRULE_NEVERALLOW) 2269 return 1; 2270 2271 ebitmap_init(&stypes); 2272 ebitmap_init(&ttypes); 2273 2274 if (type_set_expand(&source_rule->stypes, &stypes, source_pol, 1)) 2275 return -1; 2276 if (type_set_expand(&source_rule->ttypes, &ttypes, source_pol, 1)) 2277 return -1; 2278 retval = expand_rule_helper(handle, source_pol, NULL, 2279 source_rule, dest_avtab, 2280 cond, other, enabled, &stypes, &ttypes); 2281 ebitmap_destroy(&stypes); 2282 ebitmap_destroy(&ttypes); 2283 return retval; 2284} 2285 2286/* Expand a role set into an ebitmap containing the roles. 2287 * This handles the attribute and flags. 2288 * Attribute expansion depends on if the rolemap is available. 2289 * During module compile the rolemap is not available, the 2290 * possible duplicates of a regular role and the role attribute 2291 * the regular role belongs to could be properly handled by 2292 * copy_role_trans and copy_role_allow. 2293 */ 2294int role_set_expand(role_set_t * x, ebitmap_t * r, policydb_t * out, policydb_t * base, uint32_t * rolemap) 2295{ 2296 unsigned int i; 2297 ebitmap_node_t *rnode; 2298 ebitmap_t mapped_roles, roles; 2299 policydb_t *p = out; 2300 role_datum_t *role; 2301 2302 ebitmap_init(r); 2303 2304 if (x->flags & ROLE_STAR) { 2305 for (i = 0; i < p->p_roles.nprim++; i++) 2306 if (ebitmap_set_bit(r, i, 1)) 2307 return -1; 2308 return 0; 2309 } 2310 2311 ebitmap_init(&mapped_roles); 2312 ebitmap_init(&roles); 2313 2314 if (rolemap) { 2315 assert(base != NULL); 2316 ebitmap_for_each_bit(&x->roles, rnode, i) { 2317 if (ebitmap_node_get_bit(rnode, i)) { 2318 /* take advantage of p_role_val_to_struct[] 2319 * of the base module */ 2320 role = base->role_val_to_struct[i]; 2321 assert(role != NULL); 2322 if (role->flavor == ROLE_ATTRIB) { 2323 if (ebitmap_union(&roles, 2324 &role->roles)) 2325 goto bad; 2326 } else { 2327 if (ebitmap_set_bit(&roles, i, 1)) 2328 goto bad; 2329 } 2330 } 2331 } 2332 if (map_ebitmap(&roles, &mapped_roles, rolemap)) 2333 goto bad; 2334 } else { 2335 if (ebitmap_cpy(&mapped_roles, &x->roles)) 2336 goto bad; 2337 } 2338 2339 ebitmap_for_each_bit(&mapped_roles, rnode, i) { 2340 if (ebitmap_node_get_bit(rnode, i)) { 2341 if (ebitmap_set_bit(r, i, 1)) 2342 goto bad; 2343 } 2344 } 2345 2346 ebitmap_destroy(&mapped_roles); 2347 ebitmap_destroy(&roles); 2348 2349 /* if role is to be complimented, invert the entire bitmap here */ 2350 if (x->flags & ROLE_COMP) { 2351 for (i = 0; i < ebitmap_length(r); i++) { 2352 if (ebitmap_get_bit(r, i)) { 2353 if (ebitmap_set_bit(r, i, 0)) 2354 return -1; 2355 } else { 2356 if (ebitmap_set_bit(r, i, 1)) 2357 return -1; 2358 } 2359 } 2360 } 2361 return 0; 2362 2363bad: 2364 ebitmap_destroy(&mapped_roles); 2365 ebitmap_destroy(&roles); 2366 return -1; 2367} 2368 2369/* Expand a type set into an ebitmap containing the types. This 2370 * handles the negset, attributes, and flags. 2371 * Attribute expansion depends on several factors: 2372 * - if alwaysexpand is 1, then they will be expanded, 2373 * - if the type set has a negset or flags, then they will be expanded, 2374 * - otherwise, they will not be expanded. 2375 */ 2376int type_set_expand(type_set_t * set, ebitmap_t * t, policydb_t * p, 2377 unsigned char alwaysexpand) 2378{ 2379 unsigned int i; 2380 ebitmap_t types, neg_types; 2381 ebitmap_node_t *tnode; 2382 2383 ebitmap_init(&types); 2384 ebitmap_init(t); 2385 2386 if (alwaysexpand || ebitmap_length(&set->negset) || set->flags) { 2387 /* First go through the types and OR all the attributes to types */ 2388 ebitmap_for_each_bit(&set->types, tnode, i) { 2389 if (ebitmap_node_get_bit(tnode, i)) { 2390 if (p->type_val_to_struct[i]->flavor == 2391 TYPE_ATTRIB) { 2392 if (ebitmap_union 2393 (&types, 2394 &p->type_val_to_struct[i]-> 2395 types)) { 2396 return -1; 2397 } 2398 } else { 2399 if (ebitmap_set_bit(&types, i, 1)) { 2400 return -1; 2401 } 2402 } 2403 } 2404 } 2405 } else { 2406 /* No expansion of attributes, just copy the set as is. */ 2407 if (ebitmap_cpy(&types, &set->types)) 2408 return -1; 2409 } 2410 2411 /* Now do the same thing for negset */ 2412 ebitmap_init(&neg_types); 2413 ebitmap_for_each_bit(&set->negset, tnode, i) { 2414 if (ebitmap_node_get_bit(tnode, i)) { 2415 if (p->type_val_to_struct[i] && 2416 p->type_val_to_struct[i]->flavor == TYPE_ATTRIB) { 2417 if (ebitmap_union 2418 (&neg_types, 2419 &p->type_val_to_struct[i]->types)) { 2420 return -1; 2421 } 2422 } else { 2423 if (ebitmap_set_bit(&neg_types, i, 1)) { 2424 return -1; 2425 } 2426 } 2427 } 2428 } 2429 2430 if (set->flags & TYPE_STAR) { 2431 /* set all types not in neg_types */ 2432 for (i = 0; i < p->p_types.nprim; i++) { 2433 if (ebitmap_get_bit(&neg_types, i)) 2434 continue; 2435 if (p->type_val_to_struct[i] && 2436 p->type_val_to_struct[i]->flavor == TYPE_ATTRIB) 2437 continue; 2438 if (ebitmap_set_bit(t, i, 1)) 2439 return -1; 2440 } 2441 goto out; 2442 } 2443 2444 ebitmap_for_each_bit(&types, tnode, i) { 2445 if (ebitmap_node_get_bit(tnode, i) 2446 && (!ebitmap_get_bit(&neg_types, i))) 2447 if (ebitmap_set_bit(t, i, 1)) 2448 return -1; 2449 } 2450 2451 if (set->flags & TYPE_COMP) { 2452 for (i = 0; i < p->p_types.nprim; i++) { 2453 if (p->type_val_to_struct[i] && 2454 p->type_val_to_struct[i]->flavor == TYPE_ATTRIB) { 2455 assert(!ebitmap_get_bit(t, i)); 2456 continue; 2457 } 2458 if (ebitmap_get_bit(t, i)) { 2459 if (ebitmap_set_bit(t, i, 0)) 2460 return -1; 2461 } else { 2462 if (ebitmap_set_bit(t, i, 1)) 2463 return -1; 2464 } 2465 } 2466 } 2467 2468 out: 2469 2470 ebitmap_destroy(&types); 2471 ebitmap_destroy(&neg_types); 2472 2473 return 0; 2474} 2475 2476static int copy_neverallow(policydb_t * dest_pol, uint32_t * typemap, 2477 avrule_t * source_rule) 2478{ 2479 ebitmap_t stypes, ttypes; 2480 avrule_t *avrule; 2481 class_perm_node_t *cur_perm, *new_perm, *tail_perm; 2482 2483 ebitmap_init(&stypes); 2484 ebitmap_init(&ttypes); 2485 2486 if (expand_convert_type_set 2487 (dest_pol, typemap, &source_rule->stypes, &stypes, 1)) 2488 return -1; 2489 if (expand_convert_type_set 2490 (dest_pol, typemap, &source_rule->ttypes, &ttypes, 1)) 2491 return -1; 2492 2493 avrule = (avrule_t *) malloc(sizeof(avrule_t)); 2494 if (!avrule) 2495 return -1; 2496 2497 avrule_init(avrule); 2498 avrule->specified = AVRULE_NEVERALLOW; 2499 avrule->line = source_rule->line; 2500 avrule->flags = source_rule->flags; 2501 2502 if (ebitmap_cpy(&avrule->stypes.types, &stypes)) 2503 goto err; 2504 2505 if (ebitmap_cpy(&avrule->ttypes.types, &ttypes)) 2506 goto err; 2507 2508 cur_perm = source_rule->perms; 2509 tail_perm = NULL; 2510 while (cur_perm) { 2511 new_perm = 2512 (class_perm_node_t *) malloc(sizeof(class_perm_node_t)); 2513 if (!new_perm) 2514 goto err; 2515 class_perm_node_init(new_perm); 2516 new_perm->class = cur_perm->class; 2517 assert(new_perm->class); 2518 2519 /* once we have modules with permissions we'll need to map the permissions (and classes) */ 2520 new_perm->data = cur_perm->data; 2521 2522 if (!avrule->perms) 2523 avrule->perms = new_perm; 2524 2525 if (tail_perm) 2526 tail_perm->next = new_perm; 2527 tail_perm = new_perm; 2528 cur_perm = cur_perm->next; 2529 } 2530 2531 /* just prepend the avrule to the first branch; it'll never be 2532 written to disk */ 2533 if (!dest_pol->global->branch_list->avrules) 2534 dest_pol->global->branch_list->avrules = avrule; 2535 else { 2536 avrule->next = dest_pol->global->branch_list->avrules; 2537 dest_pol->global->branch_list->avrules = avrule; 2538 } 2539 2540 ebitmap_destroy(&stypes); 2541 ebitmap_destroy(&ttypes); 2542 2543 return 0; 2544 2545 err: 2546 ebitmap_destroy(&stypes); 2547 ebitmap_destroy(&ttypes); 2548 ebitmap_destroy(&avrule->stypes.types); 2549 ebitmap_destroy(&avrule->ttypes.types); 2550 cur_perm = avrule->perms; 2551 while (cur_perm) { 2552 tail_perm = cur_perm->next; 2553 free(cur_perm); 2554 cur_perm = tail_perm; 2555 } 2556 free(avrule); 2557 return -1; 2558} 2559 2560/* 2561 * Expands the avrule blocks for a policy. RBAC rules are copied. Neverallow 2562 * rules are copied or expanded as per the settings in the state object; all 2563 * other AV rules are expanded. If neverallow rules are expanded, they are not 2564 * copied, otherwise they are copied for later use by the assertion checker. 2565 */ 2566static int copy_and_expand_avrule_block(expand_state_t * state) 2567{ 2568 avrule_block_t *curblock = state->base->global; 2569 avrule_block_t *prevblock; 2570 int retval = -1; 2571 2572 if (avtab_alloc(&state->out->te_avtab, MAX_AVTAB_SIZE)) { 2573 ERR(state->handle, "Out of Memory!"); 2574 return -1; 2575 } 2576 2577 if (avtab_alloc(&state->out->te_cond_avtab, MAX_AVTAB_SIZE)) { 2578 ERR(state->handle, "Out of Memory!"); 2579 return -1; 2580 } 2581 2582 while (curblock) { 2583 avrule_decl_t *decl = curblock->enabled; 2584 avrule_t *cur_avrule; 2585 2586 if (decl == NULL) { 2587 /* nothing was enabled within this block */ 2588 goto cont; 2589 } 2590 2591 /* copy role allows and role trans */ 2592 if (copy_role_allows(state, decl->role_allow_rules) != 0 || 2593 copy_role_trans(state, decl->role_tr_rules) != 0) { 2594 goto cleanup; 2595 } 2596 2597 if (expand_filename_trans(state, decl->filename_trans_rules)) 2598 goto cleanup; 2599 2600 /* expand the range transition rules */ 2601 if (expand_range_trans(state, decl->range_tr_rules)) 2602 goto cleanup; 2603 2604 /* copy rules */ 2605 cur_avrule = decl->avrules; 2606 while (cur_avrule != NULL) { 2607 if (!(state->expand_neverallow) 2608 && cur_avrule->specified & AVRULE_NEVERALLOW) { 2609 /* copy this over directly so that assertions are checked later */ 2610 if (copy_neverallow 2611 (state->out, state->typemap, cur_avrule)) 2612 ERR(state->handle, 2613 "Error while copying neverallow."); 2614 } else { 2615 if (cur_avrule->specified & AVRULE_NEVERALLOW) { 2616 state->out->unsupported_format = 1; 2617 } 2618 if (convert_and_expand_rule 2619 (state->handle, state->out, state->typemap, 2620 cur_avrule, &state->out->te_avtab, NULL, 2621 NULL, 0, 2622 state->expand_neverallow) != 2623 EXPAND_RULE_SUCCESS) { 2624 goto cleanup; 2625 } 2626 } 2627 cur_avrule = cur_avrule->next; 2628 } 2629 2630 /* copy conditional rules */ 2631 if (cond_node_copy(state, decl->cond_list)) 2632 goto cleanup; 2633 2634 cont: 2635 prevblock = curblock; 2636 curblock = curblock->next; 2637 2638 if (state->handle && state->handle->expand_consume_base) { 2639 /* set base top avrule block in case there 2640 * is an error condition and the policy needs 2641 * to be destroyed */ 2642 state->base->global = curblock; 2643 avrule_block_destroy(prevblock); 2644 } 2645 } 2646 2647 retval = 0; 2648 2649 cleanup: 2650 return retval; 2651} 2652 2653/* 2654 * This function allows external users of the library (such as setools) to 2655 * expand only the avrules and optionally perform expansion of neverallow rules 2656 * or expand into the same policy for analysis purposes. 2657 */ 2658int expand_module_avrules(sepol_handle_t * handle, policydb_t * base, 2659 policydb_t * out, uint32_t * typemap, 2660 uint32_t * boolmap, uint32_t * rolemap, 2661 uint32_t * usermap, int verbose, 2662 int expand_neverallow) 2663{ 2664 expand_state_t state; 2665 2666 expand_state_init(&state); 2667 2668 state.base = base; 2669 state.out = out; 2670 state.typemap = typemap; 2671 state.boolmap = boolmap; 2672 state.rolemap = rolemap; 2673 state.usermap = usermap; 2674 state.handle = handle; 2675 state.verbose = verbose; 2676 state.expand_neverallow = expand_neverallow; 2677 2678 return copy_and_expand_avrule_block(&state); 2679} 2680 2681static void discard_tunables(sepol_handle_t *sh, policydb_t *pol) 2682{ 2683 avrule_block_t *block; 2684 avrule_decl_t *decl; 2685 cond_node_t *cur_node; 2686 cond_expr_t *cur_expr; 2687 int cur_state, preserve_tunables = 0; 2688 avrule_t *tail, *to_be_appended; 2689 2690 if (sh && sh->preserve_tunables) 2691 preserve_tunables = 1; 2692 2693 /* Iterate through all cond_node of all enabled decls, if a cond_node 2694 * is about tunable, calculate its state value and concatenate one of 2695 * its avrule list to the current decl->avrules list. On the other 2696 * hand, the disabled unused branch of a tunable would be discarded. 2697 * 2698 * Note, such tunable cond_node would be skipped over in expansion, 2699 * so we won't have to worry about removing it from decl->cond_list 2700 * here :-) 2701 * 2702 * If tunables are requested to be preserved then they would be 2703 * "transformed" as booleans by having their TUNABLE flag cleared. 2704 */ 2705 for (block = pol->global; block != NULL; block = block->next) { 2706 decl = block->enabled; 2707 if (decl == NULL || decl->enabled == 0) 2708 continue; 2709 2710 tail = decl->avrules; 2711 while (tail && tail->next) 2712 tail = tail->next; 2713 2714 for (cur_node = decl->cond_list; cur_node != NULL; 2715 cur_node = cur_node->next) { 2716 int booleans, tunables, i; 2717 cond_bool_datum_t *booldatum; 2718 cond_bool_datum_t *tmp[COND_EXPR_MAXDEPTH]; 2719 2720 booleans = tunables = 0; 2721 memset(tmp, 0, sizeof(cond_bool_datum_t *) * COND_EXPR_MAXDEPTH); 2722 2723 for (cur_expr = cur_node->expr; cur_expr != NULL; 2724 cur_expr = cur_expr->next) { 2725 if (cur_expr->expr_type != COND_BOOL) 2726 continue; 2727 booldatum = pol->bool_val_to_struct[cur_expr->bool - 1]; 2728 if (booldatum->flags & COND_BOOL_FLAGS_TUNABLE) 2729 tmp[tunables++] = booldatum; 2730 else 2731 booleans++; 2732 } 2733 2734 /* bool_copy_callback() at link phase has ensured 2735 * that no mixture of tunables and booleans in one 2736 * expression. However, this would be broken by the 2737 * request to preserve tunables */ 2738 if (!preserve_tunables) 2739 assert(!(booleans && tunables)); 2740 2741 if (booleans || preserve_tunables) { 2742 cur_node->flags &= ~COND_NODE_FLAGS_TUNABLE; 2743 if (tunables) { 2744 for (i = 0; i < tunables; i++) 2745 tmp[i]->flags &= ~COND_BOOL_FLAGS_TUNABLE; 2746 } 2747 } else { 2748 cur_node->flags |= COND_NODE_FLAGS_TUNABLE; 2749 cur_state = cond_evaluate_expr(pol, cur_node->expr); 2750 if (cur_state == -1) { 2751 printf("Expression result was " 2752 "undefined, skipping all" 2753 "rules\n"); 2754 continue; 2755 } 2756 2757 to_be_appended = (cur_state == 1) ? 2758 cur_node->avtrue_list : cur_node->avfalse_list; 2759 2760 if (tail) 2761 tail->next = to_be_appended; 2762 else 2763 tail = decl->avrules = to_be_appended; 2764 2765 /* Now that the effective branch has been 2766 * appended, neutralize its original pointer */ 2767 if (cur_state == 1) 2768 cur_node->avtrue_list = NULL; 2769 else 2770 cur_node->avfalse_list = NULL; 2771 2772 /* Update the tail of decl->avrules for 2773 * further concatenation */ 2774 while (tail && tail->next) 2775 tail = tail->next; 2776 } 2777 } 2778 } 2779} 2780 2781/* Linking should always be done before calling expand, even if 2782 * there is only a base since all optionals are dealt with at link time 2783 * the base passed in should be indexed and avrule blocks should be 2784 * enabled. 2785 */ 2786int expand_module(sepol_handle_t * handle, 2787 policydb_t * base, policydb_t * out, int verbose, int check) 2788{ 2789 int retval = -1; 2790 unsigned int i; 2791 expand_state_t state; 2792 avrule_block_t *curblock; 2793 2794 /* Append tunable's avtrue_list or avfalse_list to the avrules list 2795 * of its home decl depending on its state value, so that the effect 2796 * rules of a tunable would be added to te_avtab permanently. Whereas 2797 * the disabled unused branch would be discarded. 2798 * 2799 * Originally this function is called at the very end of link phase, 2800 * however, we need to keep the linked policy intact for analysis 2801 * purpose. */ 2802 discard_tunables(handle, base); 2803 2804 expand_state_init(&state); 2805 2806 state.verbose = verbose; 2807 state.typemap = NULL; 2808 state.base = base; 2809 state.out = out; 2810 state.handle = handle; 2811 2812 if (base->policy_type != POLICY_BASE) { 2813 ERR(handle, "Target of expand was not a base policy."); 2814 return -1; 2815 } 2816 2817 state.out->policy_type = POLICY_KERN; 2818 state.out->policyvers = POLICYDB_VERSION_MAX; 2819 2820 /* Copy mls state from base to out */ 2821 out->mls = base->mls; 2822 out->handle_unknown = base->handle_unknown; 2823 2824 /* Copy target from base to out */ 2825 out->target_platform = base->target_platform; 2826 2827 /* Copy policy capabilities */ 2828 if (ebitmap_cpy(&out->policycaps, &base->policycaps)) { 2829 ERR(handle, "Out of memory!"); 2830 goto cleanup; 2831 } 2832 2833 if ((state.typemap = 2834 (uint32_t *) calloc(state.base->p_types.nprim, 2835 sizeof(uint32_t))) == NULL) { 2836 ERR(handle, "Out of memory!"); 2837 goto cleanup; 2838 } 2839 2840 state.boolmap = (uint32_t *)calloc(state.base->p_bools.nprim, sizeof(uint32_t)); 2841 if (!state.boolmap) { 2842 ERR(handle, "Out of memory!"); 2843 goto cleanup; 2844 } 2845 2846 state.rolemap = (uint32_t *)calloc(state.base->p_roles.nprim, sizeof(uint32_t)); 2847 if (!state.rolemap) { 2848 ERR(handle, "Out of memory!"); 2849 goto cleanup; 2850 } 2851 2852 state.usermap = (uint32_t *)calloc(state.base->p_users.nprim, sizeof(uint32_t)); 2853 if (!state.usermap) { 2854 ERR(handle, "Out of memory!"); 2855 goto cleanup; 2856 } 2857 2858 /* order is important - types must be first */ 2859 2860 /* copy types */ 2861 if (hashtab_map(state.base->p_types.table, type_copy_callback, &state)) { 2862 goto cleanup; 2863 } 2864 2865 /* convert attribute type sets */ 2866 if (hashtab_map 2867 (state.base->p_types.table, attr_convert_callback, &state)) { 2868 goto cleanup; 2869 } 2870 2871 /* copy commons */ 2872 if (hashtab_map 2873 (state.base->p_commons.table, common_copy_callback, &state)) { 2874 goto cleanup; 2875 } 2876 2877 /* copy classes, note, this does not copy constraints, constraints can't be 2878 * copied until after all the blocks have been processed and attributes are complete */ 2879 if (hashtab_map 2880 (state.base->p_classes.table, class_copy_callback, &state)) { 2881 goto cleanup; 2882 } 2883 2884 /* copy type bounds */ 2885 if (hashtab_map(state.base->p_types.table, 2886 type_bounds_copy_callback, &state)) 2887 goto cleanup; 2888 2889 /* copy aliases */ 2890 if (hashtab_map(state.base->p_types.table, alias_copy_callback, &state)) 2891 goto cleanup; 2892 2893 /* index here so that type indexes are available for role_copy_callback */ 2894 if (policydb_index_others(handle, out, verbose)) { 2895 ERR(handle, "Error while indexing out symbols"); 2896 goto cleanup; 2897 } 2898 2899 /* copy roles */ 2900 if (hashtab_map(state.base->p_roles.table, role_copy_callback, &state)) 2901 goto cleanup; 2902 if (hashtab_map(state.base->p_roles.table, 2903 role_bounds_copy_callback, &state)) 2904 goto cleanup; 2905 /* escalate the type_set_t in a role attribute to all regular roles 2906 * that belongs to it. */ 2907 if (hashtab_map(state.base->p_roles.table, role_fix_callback, &state)) 2908 goto cleanup; 2909 2910 /* copy MLS's sensitivity level and categories - this needs to be done 2911 * before expanding users (they need to be indexed too) */ 2912 if (hashtab_map(state.base->p_levels.table, sens_copy_callback, &state)) 2913 goto cleanup; 2914 if (hashtab_map(state.base->p_cats.table, cats_copy_callback, &state)) 2915 goto cleanup; 2916 if (policydb_index_others(handle, out, verbose)) { 2917 ERR(handle, "Error while indexing out symbols"); 2918 goto cleanup; 2919 } 2920 2921 /* copy users */ 2922 if (hashtab_map(state.base->p_users.table, user_copy_callback, &state)) 2923 goto cleanup; 2924 if (hashtab_map(state.base->p_users.table, 2925 user_bounds_copy_callback, &state)) 2926 goto cleanup; 2927 2928 /* copy bools */ 2929 if (hashtab_map(state.base->p_bools.table, bool_copy_callback, &state)) 2930 goto cleanup; 2931 2932 if (policydb_index_classes(out)) { 2933 ERR(handle, "Error while indexing out classes"); 2934 goto cleanup; 2935 } 2936 if (policydb_index_others(handle, out, verbose)) { 2937 ERR(handle, "Error while indexing out symbols"); 2938 goto cleanup; 2939 } 2940 2941 /* loop through all decls and union attributes, roles, users */ 2942 for (curblock = state.base->global; curblock != NULL; 2943 curblock = curblock->next) { 2944 avrule_decl_t *decl = curblock->enabled; 2945 2946 if (decl == NULL) { 2947 /* nothing was enabled within this block */ 2948 continue; 2949 } 2950 2951 /* convert attribute type sets */ 2952 if (hashtab_map 2953 (decl->p_types.table, attr_convert_callback, &state)) { 2954 goto cleanup; 2955 } 2956 2957 /* copy roles */ 2958 if (hashtab_map 2959 (decl->p_roles.table, role_copy_callback, &state)) 2960 goto cleanup; 2961 2962 /* copy users */ 2963 if (hashtab_map 2964 (decl->p_users.table, user_copy_callback, &state)) 2965 goto cleanup; 2966 2967 } 2968 2969 /* remap role dominates bitmaps */ 2970 if (hashtab_map(state.out->p_roles.table, role_remap_dominates, &state)) { 2971 goto cleanup; 2972 } 2973 2974 if (copy_and_expand_avrule_block(&state) < 0) { 2975 ERR(handle, "Error during expand"); 2976 goto cleanup; 2977 } 2978 2979 /* copy constraints */ 2980 if (hashtab_map 2981 (state.base->p_classes.table, constraint_copy_callback, &state)) { 2982 goto cleanup; 2983 } 2984 2985 cond_optimize_lists(state.out->cond_list); 2986 evaluate_conds(state.out); 2987 2988 /* copy ocontexts */ 2989 if (ocontext_copy(&state, out->target_platform)) 2990 goto cleanup; 2991 2992 /* copy genfs */ 2993 if (genfs_copy(&state)) 2994 goto cleanup; 2995 2996 /* Build the type<->attribute maps and remove attributes. */ 2997 state.out->attr_type_map = malloc(state.out->p_types.nprim * 2998 sizeof(ebitmap_t)); 2999 state.out->type_attr_map = malloc(state.out->p_types.nprim * 3000 sizeof(ebitmap_t)); 3001 if (!state.out->attr_type_map || !state.out->type_attr_map) { 3002 ERR(handle, "Out of memory!"); 3003 goto cleanup; 3004 } 3005 for (i = 0; i < state.out->p_types.nprim; i++) { 3006 ebitmap_init(&state.out->type_attr_map[i]); 3007 ebitmap_init(&state.out->attr_type_map[i]); 3008 /* add the type itself as the degenerate case */ 3009 if (ebitmap_set_bit(&state.out->type_attr_map[i], i, 1)) { 3010 ERR(handle, "Out of memory!"); 3011 goto cleanup; 3012 } 3013 } 3014 if (hashtab_map(state.out->p_types.table, type_attr_map, &state)) 3015 goto cleanup; 3016 if (check) { 3017 if (hierarchy_check_constraints(handle, state.out)) 3018 goto cleanup; 3019 3020 if (check_assertions 3021 (handle, state.out, 3022 state.out->global->branch_list->avrules)) 3023 goto cleanup; 3024 } 3025 3026 retval = 0; 3027 3028 cleanup: 3029 free(state.typemap); 3030 free(state.boolmap); 3031 free(state.rolemap); 3032 free(state.usermap); 3033 return retval; 3034} 3035 3036static int expand_avtab_insert(avtab_t * a, avtab_key_t * k, avtab_datum_t * d) 3037{ 3038 avtab_ptr_t node; 3039 avtab_datum_t *avd; 3040 int rc; 3041 3042 node = avtab_search_node(a, k); 3043 if (!node) { 3044 rc = avtab_insert(a, k, d); 3045 if (rc) 3046 ERR(NULL, "Out of memory!"); 3047 return rc; 3048 } 3049 3050 if ((k->specified & AVTAB_ENABLED) != 3051 (node->key.specified & AVTAB_ENABLED)) { 3052 node = avtab_insert_nonunique(a, k, d); 3053 if (!node) { 3054 ERR(NULL, "Out of memory!"); 3055 return -1; 3056 } 3057 return 0; 3058 } 3059 3060 avd = &node->datum; 3061 switch (k->specified & ~AVTAB_ENABLED) { 3062 case AVTAB_ALLOWED: 3063 case AVTAB_AUDITALLOW: 3064 avd->data |= d->data; 3065 break; 3066 case AVTAB_AUDITDENY: 3067 avd->data &= d->data; 3068 break; 3069 default: 3070 ERR(NULL, "Type conflict!"); 3071 return -1; 3072 } 3073 3074 return 0; 3075} 3076 3077struct expand_avtab_data { 3078 avtab_t *expa; 3079 policydb_t *p; 3080 3081}; 3082 3083static int expand_avtab_node(avtab_key_t * k, avtab_datum_t * d, void *args) 3084{ 3085 struct expand_avtab_data *ptr = args; 3086 avtab_t *expa = ptr->expa; 3087 policydb_t *p = ptr->p; 3088 type_datum_t *stype = p->type_val_to_struct[k->source_type - 1]; 3089 type_datum_t *ttype = p->type_val_to_struct[k->target_type - 1]; 3090 ebitmap_t *sattr = &p->attr_type_map[k->source_type - 1]; 3091 ebitmap_t *tattr = &p->attr_type_map[k->target_type - 1]; 3092 ebitmap_node_t *snode, *tnode; 3093 unsigned int i, j; 3094 avtab_key_t newkey; 3095 int rc; 3096 3097 newkey.target_class = k->target_class; 3098 newkey.specified = k->specified; 3099 3100 if (stype && ttype) { 3101 /* Both are individual types, no expansion required. */ 3102 return expand_avtab_insert(expa, k, d); 3103 } 3104 3105 if (stype) { 3106 /* Source is an individual type, target is an attribute. */ 3107 newkey.source_type = k->source_type; 3108 ebitmap_for_each_bit(tattr, tnode, j) { 3109 if (!ebitmap_node_get_bit(tnode, j)) 3110 continue; 3111 newkey.target_type = j + 1; 3112 rc = expand_avtab_insert(expa, &newkey, d); 3113 if (rc) 3114 return -1; 3115 } 3116 return 0; 3117 } 3118 3119 if (ttype) { 3120 /* Target is an individual type, source is an attribute. */ 3121 newkey.target_type = k->target_type; 3122 ebitmap_for_each_bit(sattr, snode, i) { 3123 if (!ebitmap_node_get_bit(snode, i)) 3124 continue; 3125 newkey.source_type = i + 1; 3126 rc = expand_avtab_insert(expa, &newkey, d); 3127 if (rc) 3128 return -1; 3129 } 3130 return 0; 3131 } 3132 3133 /* Both source and target type are attributes. */ 3134 ebitmap_for_each_bit(sattr, snode, i) { 3135 if (!ebitmap_node_get_bit(snode, i)) 3136 continue; 3137 ebitmap_for_each_bit(tattr, tnode, j) { 3138 if (!ebitmap_node_get_bit(tnode, j)) 3139 continue; 3140 newkey.source_type = i + 1; 3141 newkey.target_type = j + 1; 3142 rc = expand_avtab_insert(expa, &newkey, d); 3143 if (rc) 3144 return -1; 3145 } 3146 } 3147 3148 return 0; 3149} 3150 3151int expand_avtab(policydb_t * p, avtab_t * a, avtab_t * expa) 3152{ 3153 struct expand_avtab_data data; 3154 3155 if (avtab_alloc(expa, MAX_AVTAB_SIZE)) { 3156 ERR(NULL, "Out of memory!"); 3157 return -1; 3158 } 3159 3160 data.expa = expa; 3161 data.p = p; 3162 return avtab_map(a, expand_avtab_node, &data); 3163} 3164 3165static int expand_cond_insert(cond_av_list_t ** l, 3166 avtab_t * expa, 3167 avtab_key_t * k, avtab_datum_t * d) 3168{ 3169 avtab_ptr_t node; 3170 avtab_datum_t *avd; 3171 cond_av_list_t *nl; 3172 3173 node = avtab_search_node(expa, k); 3174 if (!node || 3175 (k->specified & AVTAB_ENABLED) != 3176 (node->key.specified & AVTAB_ENABLED)) { 3177 node = avtab_insert_nonunique(expa, k, d); 3178 if (!node) { 3179 ERR(NULL, "Out of memory!"); 3180 return -1; 3181 } 3182 node->parse_context = (void *)1; 3183 nl = (cond_av_list_t *) malloc(sizeof(*nl)); 3184 if (!nl) { 3185 ERR(NULL, "Out of memory!"); 3186 return -1; 3187 } 3188 memset(nl, 0, sizeof(*nl)); 3189 nl->node = node; 3190 nl->next = *l; 3191 *l = nl; 3192 return 0; 3193 } 3194 3195 avd = &node->datum; 3196 switch (k->specified & ~AVTAB_ENABLED) { 3197 case AVTAB_ALLOWED: 3198 case AVTAB_AUDITALLOW: 3199 avd->data |= d->data; 3200 break; 3201 case AVTAB_AUDITDENY: 3202 avd->data &= d->data; 3203 break; 3204 default: 3205 ERR(NULL, "Type conflict!"); 3206 return -1; 3207 } 3208 3209 return 0; 3210} 3211 3212int expand_cond_av_node(policydb_t * p, 3213 avtab_ptr_t node, 3214 cond_av_list_t ** newl, avtab_t * expa) 3215{ 3216 avtab_key_t *k = &node->key; 3217 avtab_datum_t *d = &node->datum; 3218 type_datum_t *stype = p->type_val_to_struct[k->source_type - 1]; 3219 type_datum_t *ttype = p->type_val_to_struct[k->target_type - 1]; 3220 ebitmap_t *sattr = &p->attr_type_map[k->source_type - 1]; 3221 ebitmap_t *tattr = &p->attr_type_map[k->target_type - 1]; 3222 ebitmap_node_t *snode, *tnode; 3223 unsigned int i, j; 3224 avtab_key_t newkey; 3225 int rc; 3226 3227 newkey.target_class = k->target_class; 3228 newkey.specified = k->specified; 3229 3230 if (stype && ttype) { 3231 /* Both are individual types, no expansion required. */ 3232 return expand_cond_insert(newl, expa, k, d); 3233 } 3234 3235 if (stype) { 3236 /* Source is an individual type, target is an attribute. */ 3237 newkey.source_type = k->source_type; 3238 ebitmap_for_each_bit(tattr, tnode, j) { 3239 if (!ebitmap_node_get_bit(tnode, j)) 3240 continue; 3241 newkey.target_type = j + 1; 3242 rc = expand_cond_insert(newl, expa, &newkey, d); 3243 if (rc) 3244 return -1; 3245 } 3246 return 0; 3247 } 3248 3249 if (ttype) { 3250 /* Target is an individual type, source is an attribute. */ 3251 newkey.target_type = k->target_type; 3252 ebitmap_for_each_bit(sattr, snode, i) { 3253 if (!ebitmap_node_get_bit(snode, i)) 3254 continue; 3255 newkey.source_type = i + 1; 3256 rc = expand_cond_insert(newl, expa, &newkey, d); 3257 if (rc) 3258 return -1; 3259 } 3260 return 0; 3261 } 3262 3263 /* Both source and target type are attributes. */ 3264 ebitmap_for_each_bit(sattr, snode, i) { 3265 if (!ebitmap_node_get_bit(snode, i)) 3266 continue; 3267 ebitmap_for_each_bit(tattr, tnode, j) { 3268 if (!ebitmap_node_get_bit(tnode, j)) 3269 continue; 3270 newkey.source_type = i + 1; 3271 newkey.target_type = j + 1; 3272 rc = expand_cond_insert(newl, expa, &newkey, d); 3273 if (rc) 3274 return -1; 3275 } 3276 } 3277 3278 return 0; 3279} 3280 3281int expand_cond_av_list(policydb_t * p, cond_av_list_t * l, 3282 cond_av_list_t ** newl, avtab_t * expa) 3283{ 3284 cond_av_list_t *cur; 3285 avtab_ptr_t node; 3286 int rc; 3287 3288 if (avtab_alloc(expa, MAX_AVTAB_SIZE)) { 3289 ERR(NULL, "Out of memory!"); 3290 return -1; 3291 } 3292 3293 *newl = NULL; 3294 for (cur = l; cur; cur = cur->next) { 3295 node = cur->node; 3296 rc = expand_cond_av_node(p, node, newl, expa); 3297 if (rc) 3298 return rc; 3299 } 3300 3301 return 0; 3302} 3303