services.c revision 7ae9f23cbd3ef9daff7f768da4bfd4c56b19300d
1/* 2 * Implementation of the security services. 3 * 4 * Authors : Stephen Smalley, <sds@epoch.ncsc.mil> 5 * James Morris <jmorris@redhat.com> 6 * 7 * Updated: Trusted Computer Solutions, Inc. <dgoeddel@trustedcs.com> 8 * 9 * Support for enhanced MLS infrastructure. 10 * Support for context based audit filters. 11 * 12 * Updated: Frank Mayer <mayerf@tresys.com> and Karl MacMillan <kmacmillan@tresys.com> 13 * 14 * Added conditional policy language extensions 15 * 16 * Updated: Hewlett-Packard <paul.moore@hp.com> 17 * 18 * Added support for NetLabel 19 * Added support for the policy capability bitmap 20 * 21 * Updated: Chad Sellers <csellers@tresys.com> 22 * 23 * Added validation of kernel classes and permissions 24 * 25 * Updated: KaiGai Kohei <kaigai@ak.jp.nec.com> 26 * 27 * Added support for bounds domain and audit messaged on masked permissions 28 * 29 * Updated: Guido Trentalancia <guido@trentalancia.com> 30 * 31 * Added support for runtime switching of the policy type 32 * 33 * Copyright (C) 2008, 2009 NEC Corporation 34 * Copyright (C) 2006, 2007 Hewlett-Packard Development Company, L.P. 35 * Copyright (C) 2004-2006 Trusted Computer Solutions, Inc. 36 * Copyright (C) 2003 - 2004, 2006 Tresys Technology, LLC 37 * Copyright (C) 2003 Red Hat, Inc., James Morris <jmorris@redhat.com> 38 * This program is free software; you can redistribute it and/or modify 39 * it under the terms of the GNU General Public License as published by 40 * the Free Software Foundation, version 2. 41 */ 42#include <linux/kernel.h> 43#include <linux/slab.h> 44#include <linux/string.h> 45#include <linux/spinlock.h> 46#include <linux/rcupdate.h> 47#include <linux/errno.h> 48#include <linux/in.h> 49#include <linux/sched.h> 50#include <linux/audit.h> 51#include <linux/mutex.h> 52#include <linux/selinux.h> 53#include <linux/flex_array.h> 54#include <linux/vmalloc.h> 55#include <net/netlabel.h> 56 57#include "flask.h" 58#include "avc.h" 59#include "avc_ss.h" 60#include "security.h" 61#include "context.h" 62#include "policydb.h" 63#include "sidtab.h" 64#include "services.h" 65#include "conditional.h" 66#include "mls.h" 67#include "objsec.h" 68#include "netlabel.h" 69#include "xfrm.h" 70#include "ebitmap.h" 71#include "audit.h" 72 73extern void selnl_notify_policyload(u32 seqno); 74 75int selinux_policycap_netpeer; 76int selinux_policycap_openperm; 77 78static DEFINE_RWLOCK(policy_rwlock); 79 80static struct sidtab sidtab; 81struct policydb policydb; 82int ss_initialized; 83 84/* 85 * The largest sequence number that has been used when 86 * providing an access decision to the access vector cache. 87 * The sequence number only changes when a policy change 88 * occurs. 89 */ 90static u32 latest_granting; 91 92/* Forward declaration. */ 93static int context_struct_to_string(struct context *context, char **scontext, 94 u32 *scontext_len); 95 96static void context_struct_compute_av(struct context *scontext, 97 struct context *tcontext, 98 u16 tclass, 99 struct av_decision *avd); 100 101struct selinux_mapping { 102 u16 value; /* policy value */ 103 unsigned num_perms; 104 u32 perms[sizeof(u32) * 8]; 105}; 106 107static struct selinux_mapping *current_mapping; 108static u16 current_mapping_size; 109 110static int selinux_set_mapping(struct policydb *pol, 111 struct security_class_mapping *map, 112 struct selinux_mapping **out_map_p, 113 u16 *out_map_size) 114{ 115 struct selinux_mapping *out_map = NULL; 116 size_t size = sizeof(struct selinux_mapping); 117 u16 i, j; 118 unsigned k; 119 bool print_unknown_handle = false; 120 121 /* Find number of classes in the input mapping */ 122 if (!map) 123 return -EINVAL; 124 i = 0; 125 while (map[i].name) 126 i++; 127 128 /* Allocate space for the class records, plus one for class zero */ 129 out_map = kcalloc(++i, size, GFP_ATOMIC); 130 if (!out_map) 131 return -ENOMEM; 132 133 /* Store the raw class and permission values */ 134 j = 0; 135 while (map[j].name) { 136 struct security_class_mapping *p_in = map + (j++); 137 struct selinux_mapping *p_out = out_map + j; 138 139 /* An empty class string skips ahead */ 140 if (!strcmp(p_in->name, "")) { 141 p_out->num_perms = 0; 142 continue; 143 } 144 145 p_out->value = string_to_security_class(pol, p_in->name); 146 if (!p_out->value) { 147 printk(KERN_INFO 148 "SELinux: Class %s not defined in policy.\n", 149 p_in->name); 150 if (pol->reject_unknown) 151 goto err; 152 p_out->num_perms = 0; 153 print_unknown_handle = true; 154 continue; 155 } 156 157 k = 0; 158 while (p_in->perms && p_in->perms[k]) { 159 /* An empty permission string skips ahead */ 160 if (!*p_in->perms[k]) { 161 k++; 162 continue; 163 } 164 p_out->perms[k] = string_to_av_perm(pol, p_out->value, 165 p_in->perms[k]); 166 if (!p_out->perms[k]) { 167 printk(KERN_INFO 168 "SELinux: Permission %s in class %s not defined in policy.\n", 169 p_in->perms[k], p_in->name); 170 if (pol->reject_unknown) 171 goto err; 172 print_unknown_handle = true; 173 } 174 175 k++; 176 } 177 p_out->num_perms = k; 178 } 179 180 if (print_unknown_handle) 181 printk(KERN_INFO "SELinux: the above unknown classes and permissions will be %s\n", 182 pol->allow_unknown ? "allowed" : "denied"); 183 184 *out_map_p = out_map; 185 *out_map_size = i; 186 return 0; 187err: 188 kfree(out_map); 189 return -EINVAL; 190} 191 192/* 193 * Get real, policy values from mapped values 194 */ 195 196static u16 unmap_class(u16 tclass) 197{ 198 if (tclass < current_mapping_size) 199 return current_mapping[tclass].value; 200 201 return tclass; 202} 203 204static void map_decision(u16 tclass, struct av_decision *avd, 205 int allow_unknown) 206{ 207 if (tclass < current_mapping_size) { 208 unsigned i, n = current_mapping[tclass].num_perms; 209 u32 result; 210 211 for (i = 0, result = 0; i < n; i++) { 212 if (avd->allowed & current_mapping[tclass].perms[i]) 213 result |= 1<<i; 214 if (allow_unknown && !current_mapping[tclass].perms[i]) 215 result |= 1<<i; 216 } 217 avd->allowed = result; 218 219 for (i = 0, result = 0; i < n; i++) 220 if (avd->auditallow & current_mapping[tclass].perms[i]) 221 result |= 1<<i; 222 avd->auditallow = result; 223 224 for (i = 0, result = 0; i < n; i++) { 225 if (avd->auditdeny & current_mapping[tclass].perms[i]) 226 result |= 1<<i; 227 if (!allow_unknown && !current_mapping[tclass].perms[i]) 228 result |= 1<<i; 229 } 230 /* 231 * In case the kernel has a bug and requests a permission 232 * between num_perms and the maximum permission number, we 233 * should audit that denial 234 */ 235 for (; i < (sizeof(u32)*8); i++) 236 result |= 1<<i; 237 avd->auditdeny = result; 238 } 239} 240 241int security_mls_enabled(void) 242{ 243 return policydb.mls_enabled; 244} 245 246/* 247 * Return the boolean value of a constraint expression 248 * when it is applied to the specified source and target 249 * security contexts. 250 * 251 * xcontext is a special beast... It is used by the validatetrans rules 252 * only. For these rules, scontext is the context before the transition, 253 * tcontext is the context after the transition, and xcontext is the context 254 * of the process performing the transition. All other callers of 255 * constraint_expr_eval should pass in NULL for xcontext. 256 */ 257static int constraint_expr_eval(struct context *scontext, 258 struct context *tcontext, 259 struct context *xcontext, 260 struct constraint_expr *cexpr) 261{ 262 u32 val1, val2; 263 struct context *c; 264 struct role_datum *r1, *r2; 265 struct mls_level *l1, *l2; 266 struct constraint_expr *e; 267 int s[CEXPR_MAXDEPTH]; 268 int sp = -1; 269 270 for (e = cexpr; e; e = e->next) { 271 switch (e->expr_type) { 272 case CEXPR_NOT: 273 BUG_ON(sp < 0); 274 s[sp] = !s[sp]; 275 break; 276 case CEXPR_AND: 277 BUG_ON(sp < 1); 278 sp--; 279 s[sp] &= s[sp + 1]; 280 break; 281 case CEXPR_OR: 282 BUG_ON(sp < 1); 283 sp--; 284 s[sp] |= s[sp + 1]; 285 break; 286 case CEXPR_ATTR: 287 if (sp == (CEXPR_MAXDEPTH - 1)) 288 return 0; 289 switch (e->attr) { 290 case CEXPR_USER: 291 val1 = scontext->user; 292 val2 = tcontext->user; 293 break; 294 case CEXPR_TYPE: 295 val1 = scontext->type; 296 val2 = tcontext->type; 297 break; 298 case CEXPR_ROLE: 299 val1 = scontext->role; 300 val2 = tcontext->role; 301 r1 = policydb.role_val_to_struct[val1 - 1]; 302 r2 = policydb.role_val_to_struct[val2 - 1]; 303 switch (e->op) { 304 case CEXPR_DOM: 305 s[++sp] = ebitmap_get_bit(&r1->dominates, 306 val2 - 1); 307 continue; 308 case CEXPR_DOMBY: 309 s[++sp] = ebitmap_get_bit(&r2->dominates, 310 val1 - 1); 311 continue; 312 case CEXPR_INCOMP: 313 s[++sp] = (!ebitmap_get_bit(&r1->dominates, 314 val2 - 1) && 315 !ebitmap_get_bit(&r2->dominates, 316 val1 - 1)); 317 continue; 318 default: 319 break; 320 } 321 break; 322 case CEXPR_L1L2: 323 l1 = &(scontext->range.level[0]); 324 l2 = &(tcontext->range.level[0]); 325 goto mls_ops; 326 case CEXPR_L1H2: 327 l1 = &(scontext->range.level[0]); 328 l2 = &(tcontext->range.level[1]); 329 goto mls_ops; 330 case CEXPR_H1L2: 331 l1 = &(scontext->range.level[1]); 332 l2 = &(tcontext->range.level[0]); 333 goto mls_ops; 334 case CEXPR_H1H2: 335 l1 = &(scontext->range.level[1]); 336 l2 = &(tcontext->range.level[1]); 337 goto mls_ops; 338 case CEXPR_L1H1: 339 l1 = &(scontext->range.level[0]); 340 l2 = &(scontext->range.level[1]); 341 goto mls_ops; 342 case CEXPR_L2H2: 343 l1 = &(tcontext->range.level[0]); 344 l2 = &(tcontext->range.level[1]); 345 goto mls_ops; 346mls_ops: 347 switch (e->op) { 348 case CEXPR_EQ: 349 s[++sp] = mls_level_eq(l1, l2); 350 continue; 351 case CEXPR_NEQ: 352 s[++sp] = !mls_level_eq(l1, l2); 353 continue; 354 case CEXPR_DOM: 355 s[++sp] = mls_level_dom(l1, l2); 356 continue; 357 case CEXPR_DOMBY: 358 s[++sp] = mls_level_dom(l2, l1); 359 continue; 360 case CEXPR_INCOMP: 361 s[++sp] = mls_level_incomp(l2, l1); 362 continue; 363 default: 364 BUG(); 365 return 0; 366 } 367 break; 368 default: 369 BUG(); 370 return 0; 371 } 372 373 switch (e->op) { 374 case CEXPR_EQ: 375 s[++sp] = (val1 == val2); 376 break; 377 case CEXPR_NEQ: 378 s[++sp] = (val1 != val2); 379 break; 380 default: 381 BUG(); 382 return 0; 383 } 384 break; 385 case CEXPR_NAMES: 386 if (sp == (CEXPR_MAXDEPTH-1)) 387 return 0; 388 c = scontext; 389 if (e->attr & CEXPR_TARGET) 390 c = tcontext; 391 else if (e->attr & CEXPR_XTARGET) { 392 c = xcontext; 393 if (!c) { 394 BUG(); 395 return 0; 396 } 397 } 398 if (e->attr & CEXPR_USER) 399 val1 = c->user; 400 else if (e->attr & CEXPR_ROLE) 401 val1 = c->role; 402 else if (e->attr & CEXPR_TYPE) 403 val1 = c->type; 404 else { 405 BUG(); 406 return 0; 407 } 408 409 switch (e->op) { 410 case CEXPR_EQ: 411 s[++sp] = ebitmap_get_bit(&e->names, val1 - 1); 412 break; 413 case CEXPR_NEQ: 414 s[++sp] = !ebitmap_get_bit(&e->names, val1 - 1); 415 break; 416 default: 417 BUG(); 418 return 0; 419 } 420 break; 421 default: 422 BUG(); 423 return 0; 424 } 425 } 426 427 BUG_ON(sp != 0); 428 return s[0]; 429} 430 431/* 432 * security_dump_masked_av - dumps masked permissions during 433 * security_compute_av due to RBAC, MLS/Constraint and Type bounds. 434 */ 435static int dump_masked_av_helper(void *k, void *d, void *args) 436{ 437 struct perm_datum *pdatum = d; 438 char **permission_names = args; 439 440 BUG_ON(pdatum->value < 1 || pdatum->value > 32); 441 442 permission_names[pdatum->value - 1] = (char *)k; 443 444 return 0; 445} 446 447static void security_dump_masked_av(struct context *scontext, 448 struct context *tcontext, 449 u16 tclass, 450 u32 permissions, 451 const char *reason) 452{ 453 struct common_datum *common_dat; 454 struct class_datum *tclass_dat; 455 struct audit_buffer *ab; 456 char *tclass_name; 457 char *scontext_name = NULL; 458 char *tcontext_name = NULL; 459 char *permission_names[32]; 460 int index; 461 u32 length; 462 bool need_comma = false; 463 464 if (!permissions) 465 return; 466 467 tclass_name = policydb.p_class_val_to_name[tclass - 1]; 468 tclass_dat = policydb.class_val_to_struct[tclass - 1]; 469 common_dat = tclass_dat->comdatum; 470 471 /* init permission_names */ 472 if (common_dat && 473 hashtab_map(common_dat->permissions.table, 474 dump_masked_av_helper, permission_names) < 0) 475 goto out; 476 477 if (hashtab_map(tclass_dat->permissions.table, 478 dump_masked_av_helper, permission_names) < 0) 479 goto out; 480 481 /* get scontext/tcontext in text form */ 482 if (context_struct_to_string(scontext, 483 &scontext_name, &length) < 0) 484 goto out; 485 486 if (context_struct_to_string(tcontext, 487 &tcontext_name, &length) < 0) 488 goto out; 489 490 /* audit a message */ 491 ab = audit_log_start(current->audit_context, 492 GFP_ATOMIC, AUDIT_SELINUX_ERR); 493 if (!ab) 494 goto out; 495 496 audit_log_format(ab, "op=security_compute_av reason=%s " 497 "scontext=%s tcontext=%s tclass=%s perms=", 498 reason, scontext_name, tcontext_name, tclass_name); 499 500 for (index = 0; index < 32; index++) { 501 u32 mask = (1 << index); 502 503 if ((mask & permissions) == 0) 504 continue; 505 506 audit_log_format(ab, "%s%s", 507 need_comma ? "," : "", 508 permission_names[index] 509 ? permission_names[index] : "????"); 510 need_comma = true; 511 } 512 audit_log_end(ab); 513out: 514 /* release scontext/tcontext */ 515 kfree(tcontext_name); 516 kfree(scontext_name); 517 518 return; 519} 520 521/* 522 * security_boundary_permission - drops violated permissions 523 * on boundary constraint. 524 */ 525static void type_attribute_bounds_av(struct context *scontext, 526 struct context *tcontext, 527 u16 tclass, 528 struct av_decision *avd) 529{ 530 struct context lo_scontext; 531 struct context lo_tcontext; 532 struct av_decision lo_avd; 533 struct type_datum *source 534 = policydb.type_val_to_struct[scontext->type - 1]; 535 struct type_datum *target 536 = policydb.type_val_to_struct[tcontext->type - 1]; 537 u32 masked = 0; 538 539 if (source->bounds) { 540 memset(&lo_avd, 0, sizeof(lo_avd)); 541 542 memcpy(&lo_scontext, scontext, sizeof(lo_scontext)); 543 lo_scontext.type = source->bounds; 544 545 context_struct_compute_av(&lo_scontext, 546 tcontext, 547 tclass, 548 &lo_avd); 549 if ((lo_avd.allowed & avd->allowed) == avd->allowed) 550 return; /* no masked permission */ 551 masked = ~lo_avd.allowed & avd->allowed; 552 } 553 554 if (target->bounds) { 555 memset(&lo_avd, 0, sizeof(lo_avd)); 556 557 memcpy(&lo_tcontext, tcontext, sizeof(lo_tcontext)); 558 lo_tcontext.type = target->bounds; 559 560 context_struct_compute_av(scontext, 561 &lo_tcontext, 562 tclass, 563 &lo_avd); 564 if ((lo_avd.allowed & avd->allowed) == avd->allowed) 565 return; /* no masked permission */ 566 masked = ~lo_avd.allowed & avd->allowed; 567 } 568 569 if (source->bounds && target->bounds) { 570 memset(&lo_avd, 0, sizeof(lo_avd)); 571 /* 572 * lo_scontext and lo_tcontext are already 573 * set up. 574 */ 575 576 context_struct_compute_av(&lo_scontext, 577 &lo_tcontext, 578 tclass, 579 &lo_avd); 580 if ((lo_avd.allowed & avd->allowed) == avd->allowed) 581 return; /* no masked permission */ 582 masked = ~lo_avd.allowed & avd->allowed; 583 } 584 585 if (masked) { 586 /* mask violated permissions */ 587 avd->allowed &= ~masked; 588 589 /* audit masked permissions */ 590 security_dump_masked_av(scontext, tcontext, 591 tclass, masked, "bounds"); 592 } 593} 594 595/* 596 * Compute access vectors based on a context structure pair for 597 * the permissions in a particular class. 598 */ 599static void context_struct_compute_av(struct context *scontext, 600 struct context *tcontext, 601 u16 tclass, 602 struct av_decision *avd) 603{ 604 struct constraint_node *constraint; 605 struct role_allow *ra; 606 struct avtab_key avkey; 607 struct avtab_node *node; 608 struct class_datum *tclass_datum; 609 struct ebitmap *sattr, *tattr; 610 struct ebitmap_node *snode, *tnode; 611 unsigned int i, j; 612 613 avd->allowed = 0; 614 avd->auditallow = 0; 615 avd->auditdeny = 0xffffffff; 616 617 if (unlikely(!tclass || tclass > policydb.p_classes.nprim)) { 618 if (printk_ratelimit()) 619 printk(KERN_WARNING "SELinux: Invalid class %hu\n", tclass); 620 return; 621 } 622 623 tclass_datum = policydb.class_val_to_struct[tclass - 1]; 624 625 /* 626 * If a specific type enforcement rule was defined for 627 * this permission check, then use it. 628 */ 629 avkey.target_class = tclass; 630 avkey.specified = AVTAB_AV; 631 sattr = flex_array_get(policydb.type_attr_map_array, scontext->type - 1); 632 BUG_ON(!sattr); 633 tattr = flex_array_get(policydb.type_attr_map_array, tcontext->type - 1); 634 BUG_ON(!tattr); 635 ebitmap_for_each_positive_bit(sattr, snode, i) { 636 ebitmap_for_each_positive_bit(tattr, tnode, j) { 637 avkey.source_type = i + 1; 638 avkey.target_type = j + 1; 639 for (node = avtab_search_node(&policydb.te_avtab, &avkey); 640 node; 641 node = avtab_search_node_next(node, avkey.specified)) { 642 if (node->key.specified == AVTAB_ALLOWED) 643 avd->allowed |= node->datum.data; 644 else if (node->key.specified == AVTAB_AUDITALLOW) 645 avd->auditallow |= node->datum.data; 646 else if (node->key.specified == AVTAB_AUDITDENY) 647 avd->auditdeny &= node->datum.data; 648 } 649 650 /* Check conditional av table for additional permissions */ 651 cond_compute_av(&policydb.te_cond_avtab, &avkey, avd); 652 653 } 654 } 655 656 /* 657 * Remove any permissions prohibited by a constraint (this includes 658 * the MLS policy). 659 */ 660 constraint = tclass_datum->constraints; 661 while (constraint) { 662 if ((constraint->permissions & (avd->allowed)) && 663 !constraint_expr_eval(scontext, tcontext, NULL, 664 constraint->expr)) { 665 avd->allowed &= ~(constraint->permissions); 666 } 667 constraint = constraint->next; 668 } 669 670 /* 671 * If checking process transition permission and the 672 * role is changing, then check the (current_role, new_role) 673 * pair. 674 */ 675 if (tclass == policydb.process_class && 676 (avd->allowed & policydb.process_trans_perms) && 677 scontext->role != tcontext->role) { 678 for (ra = policydb.role_allow; ra; ra = ra->next) { 679 if (scontext->role == ra->role && 680 tcontext->role == ra->new_role) 681 break; 682 } 683 if (!ra) 684 avd->allowed &= ~policydb.process_trans_perms; 685 } 686 687 /* 688 * If the given source and target types have boundary 689 * constraint, lazy checks have to mask any violated 690 * permission and notice it to userspace via audit. 691 */ 692 type_attribute_bounds_av(scontext, tcontext, 693 tclass, avd); 694} 695 696static int security_validtrans_handle_fail(struct context *ocontext, 697 struct context *ncontext, 698 struct context *tcontext, 699 u16 tclass) 700{ 701 char *o = NULL, *n = NULL, *t = NULL; 702 u32 olen, nlen, tlen; 703 704 if (context_struct_to_string(ocontext, &o, &olen)) 705 goto out; 706 if (context_struct_to_string(ncontext, &n, &nlen)) 707 goto out; 708 if (context_struct_to_string(tcontext, &t, &tlen)) 709 goto out; 710 audit_log(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR, 711 "security_validate_transition: denied for" 712 " oldcontext=%s newcontext=%s taskcontext=%s tclass=%s", 713 o, n, t, policydb.p_class_val_to_name[tclass-1]); 714out: 715 kfree(o); 716 kfree(n); 717 kfree(t); 718 719 if (!selinux_enforcing) 720 return 0; 721 return -EPERM; 722} 723 724int security_validate_transition(u32 oldsid, u32 newsid, u32 tasksid, 725 u16 orig_tclass) 726{ 727 struct context *ocontext; 728 struct context *ncontext; 729 struct context *tcontext; 730 struct class_datum *tclass_datum; 731 struct constraint_node *constraint; 732 u16 tclass; 733 int rc = 0; 734 735 if (!ss_initialized) 736 return 0; 737 738 read_lock(&policy_rwlock); 739 740 tclass = unmap_class(orig_tclass); 741 742 if (!tclass || tclass > policydb.p_classes.nprim) { 743 printk(KERN_ERR "SELinux: %s: unrecognized class %d\n", 744 __func__, tclass); 745 rc = -EINVAL; 746 goto out; 747 } 748 tclass_datum = policydb.class_val_to_struct[tclass - 1]; 749 750 ocontext = sidtab_search(&sidtab, oldsid); 751 if (!ocontext) { 752 printk(KERN_ERR "SELinux: %s: unrecognized SID %d\n", 753 __func__, oldsid); 754 rc = -EINVAL; 755 goto out; 756 } 757 758 ncontext = sidtab_search(&sidtab, newsid); 759 if (!ncontext) { 760 printk(KERN_ERR "SELinux: %s: unrecognized SID %d\n", 761 __func__, newsid); 762 rc = -EINVAL; 763 goto out; 764 } 765 766 tcontext = sidtab_search(&sidtab, tasksid); 767 if (!tcontext) { 768 printk(KERN_ERR "SELinux: %s: unrecognized SID %d\n", 769 __func__, tasksid); 770 rc = -EINVAL; 771 goto out; 772 } 773 774 constraint = tclass_datum->validatetrans; 775 while (constraint) { 776 if (!constraint_expr_eval(ocontext, ncontext, tcontext, 777 constraint->expr)) { 778 rc = security_validtrans_handle_fail(ocontext, ncontext, 779 tcontext, tclass); 780 goto out; 781 } 782 constraint = constraint->next; 783 } 784 785out: 786 read_unlock(&policy_rwlock); 787 return rc; 788} 789 790/* 791 * security_bounded_transition - check whether the given 792 * transition is directed to bounded, or not. 793 * It returns 0, if @newsid is bounded by @oldsid. 794 * Otherwise, it returns error code. 795 * 796 * @oldsid : current security identifier 797 * @newsid : destinated security identifier 798 */ 799int security_bounded_transition(u32 old_sid, u32 new_sid) 800{ 801 struct context *old_context, *new_context; 802 struct type_datum *type; 803 int index; 804 int rc; 805 806 read_lock(&policy_rwlock); 807 808 rc = -EINVAL; 809 old_context = sidtab_search(&sidtab, old_sid); 810 if (!old_context) { 811 printk(KERN_ERR "SELinux: %s: unrecognized SID %u\n", 812 __func__, old_sid); 813 goto out; 814 } 815 816 rc = -EINVAL; 817 new_context = sidtab_search(&sidtab, new_sid); 818 if (!new_context) { 819 printk(KERN_ERR "SELinux: %s: unrecognized SID %u\n", 820 __func__, new_sid); 821 goto out; 822 } 823 824 rc = 0; 825 /* type/domain unchanged */ 826 if (old_context->type == new_context->type) 827 goto out; 828 829 index = new_context->type; 830 while (true) { 831 type = policydb.type_val_to_struct[index - 1]; 832 BUG_ON(!type); 833 834 /* not bounded anymore */ 835 rc = -EPERM; 836 if (!type->bounds) 837 break; 838 839 /* @newsid is bounded by @oldsid */ 840 rc = 0; 841 if (type->bounds == old_context->type) 842 break; 843 844 index = type->bounds; 845 } 846 847 if (rc) { 848 char *old_name = NULL; 849 char *new_name = NULL; 850 u32 length; 851 852 if (!context_struct_to_string(old_context, 853 &old_name, &length) && 854 !context_struct_to_string(new_context, 855 &new_name, &length)) { 856 audit_log(current->audit_context, 857 GFP_ATOMIC, AUDIT_SELINUX_ERR, 858 "op=security_bounded_transition " 859 "result=denied " 860 "oldcontext=%s newcontext=%s", 861 old_name, new_name); 862 } 863 kfree(new_name); 864 kfree(old_name); 865 } 866out: 867 read_unlock(&policy_rwlock); 868 869 return rc; 870} 871 872static void avd_init(struct av_decision *avd) 873{ 874 avd->allowed = 0; 875 avd->auditallow = 0; 876 avd->auditdeny = 0xffffffff; 877 avd->seqno = latest_granting; 878 avd->flags = 0; 879} 880 881 882/** 883 * security_compute_av - Compute access vector decisions. 884 * @ssid: source security identifier 885 * @tsid: target security identifier 886 * @tclass: target security class 887 * @avd: access vector decisions 888 * 889 * Compute a set of access vector decisions based on the 890 * SID pair (@ssid, @tsid) for the permissions in @tclass. 891 */ 892void security_compute_av(u32 ssid, 893 u32 tsid, 894 u16 orig_tclass, 895 struct av_decision *avd) 896{ 897 u16 tclass; 898 struct context *scontext = NULL, *tcontext = NULL; 899 900 read_lock(&policy_rwlock); 901 avd_init(avd); 902 if (!ss_initialized) 903 goto allow; 904 905 scontext = sidtab_search(&sidtab, ssid); 906 if (!scontext) { 907 printk(KERN_ERR "SELinux: %s: unrecognized SID %d\n", 908 __func__, ssid); 909 goto out; 910 } 911 912 /* permissive domain? */ 913 if (ebitmap_get_bit(&policydb.permissive_map, scontext->type)) 914 avd->flags |= AVD_FLAGS_PERMISSIVE; 915 916 tcontext = sidtab_search(&sidtab, tsid); 917 if (!tcontext) { 918 printk(KERN_ERR "SELinux: %s: unrecognized SID %d\n", 919 __func__, tsid); 920 goto out; 921 } 922 923 tclass = unmap_class(orig_tclass); 924 if (unlikely(orig_tclass && !tclass)) { 925 if (policydb.allow_unknown) 926 goto allow; 927 goto out; 928 } 929 context_struct_compute_av(scontext, tcontext, tclass, avd); 930 map_decision(orig_tclass, avd, policydb.allow_unknown); 931out: 932 read_unlock(&policy_rwlock); 933 return; 934allow: 935 avd->allowed = 0xffffffff; 936 goto out; 937} 938 939void security_compute_av_user(u32 ssid, 940 u32 tsid, 941 u16 tclass, 942 struct av_decision *avd) 943{ 944 struct context *scontext = NULL, *tcontext = NULL; 945 946 read_lock(&policy_rwlock); 947 avd_init(avd); 948 if (!ss_initialized) 949 goto allow; 950 951 scontext = sidtab_search(&sidtab, ssid); 952 if (!scontext) { 953 printk(KERN_ERR "SELinux: %s: unrecognized SID %d\n", 954 __func__, ssid); 955 goto out; 956 } 957 958 /* permissive domain? */ 959 if (ebitmap_get_bit(&policydb.permissive_map, scontext->type)) 960 avd->flags |= AVD_FLAGS_PERMISSIVE; 961 962 tcontext = sidtab_search(&sidtab, tsid); 963 if (!tcontext) { 964 printk(KERN_ERR "SELinux: %s: unrecognized SID %d\n", 965 __func__, tsid); 966 goto out; 967 } 968 969 if (unlikely(!tclass)) { 970 if (policydb.allow_unknown) 971 goto allow; 972 goto out; 973 } 974 975 context_struct_compute_av(scontext, tcontext, tclass, avd); 976 out: 977 read_unlock(&policy_rwlock); 978 return; 979allow: 980 avd->allowed = 0xffffffff; 981 goto out; 982} 983 984/* 985 * Write the security context string representation of 986 * the context structure `context' into a dynamically 987 * allocated string of the correct size. Set `*scontext' 988 * to point to this string and set `*scontext_len' to 989 * the length of the string. 990 */ 991static int context_struct_to_string(struct context *context, char **scontext, u32 *scontext_len) 992{ 993 char *scontextp; 994 995 if (scontext) 996 *scontext = NULL; 997 *scontext_len = 0; 998 999 if (context->len) { 1000 *scontext_len = context->len; 1001 *scontext = kstrdup(context->str, GFP_ATOMIC); 1002 if (!(*scontext)) 1003 return -ENOMEM; 1004 return 0; 1005 } 1006 1007 /* Compute the size of the context. */ 1008 *scontext_len += strlen(policydb.p_user_val_to_name[context->user - 1]) + 1; 1009 *scontext_len += strlen(policydb.p_role_val_to_name[context->role - 1]) + 1; 1010 *scontext_len += strlen(policydb.p_type_val_to_name[context->type - 1]) + 1; 1011 *scontext_len += mls_compute_context_len(context); 1012 1013 if (!scontext) 1014 return 0; 1015 1016 /* Allocate space for the context; caller must free this space. */ 1017 scontextp = kmalloc(*scontext_len, GFP_ATOMIC); 1018 if (!scontextp) 1019 return -ENOMEM; 1020 *scontext = scontextp; 1021 1022 /* 1023 * Copy the user name, role name and type name into the context. 1024 */ 1025 sprintf(scontextp, "%s:%s:%s", 1026 policydb.p_user_val_to_name[context->user - 1], 1027 policydb.p_role_val_to_name[context->role - 1], 1028 policydb.p_type_val_to_name[context->type - 1]); 1029 scontextp += strlen(policydb.p_user_val_to_name[context->user - 1]) + 1030 1 + strlen(policydb.p_role_val_to_name[context->role - 1]) + 1031 1 + strlen(policydb.p_type_val_to_name[context->type - 1]); 1032 1033 mls_sid_to_context(context, &scontextp); 1034 1035 *scontextp = 0; 1036 1037 return 0; 1038} 1039 1040#include "initial_sid_to_string.h" 1041 1042const char *security_get_initial_sid_context(u32 sid) 1043{ 1044 if (unlikely(sid > SECINITSID_NUM)) 1045 return NULL; 1046 return initial_sid_to_string[sid]; 1047} 1048 1049static int security_sid_to_context_core(u32 sid, char **scontext, 1050 u32 *scontext_len, int force) 1051{ 1052 struct context *context; 1053 int rc = 0; 1054 1055 if (scontext) 1056 *scontext = NULL; 1057 *scontext_len = 0; 1058 1059 if (!ss_initialized) { 1060 if (sid <= SECINITSID_NUM) { 1061 char *scontextp; 1062 1063 *scontext_len = strlen(initial_sid_to_string[sid]) + 1; 1064 if (!scontext) 1065 goto out; 1066 scontextp = kmalloc(*scontext_len, GFP_ATOMIC); 1067 if (!scontextp) { 1068 rc = -ENOMEM; 1069 goto out; 1070 } 1071 strcpy(scontextp, initial_sid_to_string[sid]); 1072 *scontext = scontextp; 1073 goto out; 1074 } 1075 printk(KERN_ERR "SELinux: %s: called before initial " 1076 "load_policy on unknown SID %d\n", __func__, sid); 1077 rc = -EINVAL; 1078 goto out; 1079 } 1080 read_lock(&policy_rwlock); 1081 if (force) 1082 context = sidtab_search_force(&sidtab, sid); 1083 else 1084 context = sidtab_search(&sidtab, sid); 1085 if (!context) { 1086 printk(KERN_ERR "SELinux: %s: unrecognized SID %d\n", 1087 __func__, sid); 1088 rc = -EINVAL; 1089 goto out_unlock; 1090 } 1091 rc = context_struct_to_string(context, scontext, scontext_len); 1092out_unlock: 1093 read_unlock(&policy_rwlock); 1094out: 1095 return rc; 1096 1097} 1098 1099/** 1100 * security_sid_to_context - Obtain a context for a given SID. 1101 * @sid: security identifier, SID 1102 * @scontext: security context 1103 * @scontext_len: length in bytes 1104 * 1105 * Write the string representation of the context associated with @sid 1106 * into a dynamically allocated string of the correct size. Set @scontext 1107 * to point to this string and set @scontext_len to the length of the string. 1108 */ 1109int security_sid_to_context(u32 sid, char **scontext, u32 *scontext_len) 1110{ 1111 return security_sid_to_context_core(sid, scontext, scontext_len, 0); 1112} 1113 1114int security_sid_to_context_force(u32 sid, char **scontext, u32 *scontext_len) 1115{ 1116 return security_sid_to_context_core(sid, scontext, scontext_len, 1); 1117} 1118 1119/* 1120 * Caveat: Mutates scontext. 1121 */ 1122static int string_to_context_struct(struct policydb *pol, 1123 struct sidtab *sidtabp, 1124 char *scontext, 1125 u32 scontext_len, 1126 struct context *ctx, 1127 u32 def_sid) 1128{ 1129 struct role_datum *role; 1130 struct type_datum *typdatum; 1131 struct user_datum *usrdatum; 1132 char *scontextp, *p, oldc; 1133 int rc = 0; 1134 1135 context_init(ctx); 1136 1137 /* Parse the security context. */ 1138 1139 rc = -EINVAL; 1140 scontextp = (char *) scontext; 1141 1142 /* Extract the user. */ 1143 p = scontextp; 1144 while (*p && *p != ':') 1145 p++; 1146 1147 if (*p == 0) 1148 goto out; 1149 1150 *p++ = 0; 1151 1152 usrdatum = hashtab_search(pol->p_users.table, scontextp); 1153 if (!usrdatum) 1154 goto out; 1155 1156 ctx->user = usrdatum->value; 1157 1158 /* Extract role. */ 1159 scontextp = p; 1160 while (*p && *p != ':') 1161 p++; 1162 1163 if (*p == 0) 1164 goto out; 1165 1166 *p++ = 0; 1167 1168 role = hashtab_search(pol->p_roles.table, scontextp); 1169 if (!role) 1170 goto out; 1171 ctx->role = role->value; 1172 1173 /* Extract type. */ 1174 scontextp = p; 1175 while (*p && *p != ':') 1176 p++; 1177 oldc = *p; 1178 *p++ = 0; 1179 1180 typdatum = hashtab_search(pol->p_types.table, scontextp); 1181 if (!typdatum || typdatum->attribute) 1182 goto out; 1183 1184 ctx->type = typdatum->value; 1185 1186 rc = mls_context_to_sid(pol, oldc, &p, ctx, sidtabp, def_sid); 1187 if (rc) 1188 goto out; 1189 1190 rc = -EINVAL; 1191 if ((p - scontext) < scontext_len) 1192 goto out; 1193 1194 /* Check the validity of the new context. */ 1195 if (!policydb_context_isvalid(pol, ctx)) 1196 goto out; 1197 rc = 0; 1198out: 1199 if (rc) 1200 context_destroy(ctx); 1201 return rc; 1202} 1203 1204static int security_context_to_sid_core(const char *scontext, u32 scontext_len, 1205 u32 *sid, u32 def_sid, gfp_t gfp_flags, 1206 int force) 1207{ 1208 char *scontext2, *str = NULL; 1209 struct context context; 1210 int rc = 0; 1211 1212 if (!ss_initialized) { 1213 int i; 1214 1215 for (i = 1; i < SECINITSID_NUM; i++) { 1216 if (!strcmp(initial_sid_to_string[i], scontext)) { 1217 *sid = i; 1218 return 0; 1219 } 1220 } 1221 *sid = SECINITSID_KERNEL; 1222 return 0; 1223 } 1224 *sid = SECSID_NULL; 1225 1226 /* Copy the string so that we can modify the copy as we parse it. */ 1227 scontext2 = kmalloc(scontext_len + 1, gfp_flags); 1228 if (!scontext2) 1229 return -ENOMEM; 1230 memcpy(scontext2, scontext, scontext_len); 1231 scontext2[scontext_len] = 0; 1232 1233 if (force) { 1234 /* Save another copy for storing in uninterpreted form */ 1235 rc = -ENOMEM; 1236 str = kstrdup(scontext2, gfp_flags); 1237 if (!str) 1238 goto out; 1239 } 1240 1241 read_lock(&policy_rwlock); 1242 rc = string_to_context_struct(&policydb, &sidtab, scontext2, 1243 scontext_len, &context, def_sid); 1244 if (rc == -EINVAL && force) { 1245 context.str = str; 1246 context.len = scontext_len; 1247 str = NULL; 1248 } else if (rc) 1249 goto out_unlock; 1250 rc = sidtab_context_to_sid(&sidtab, &context, sid); 1251 context_destroy(&context); 1252out_unlock: 1253 read_unlock(&policy_rwlock); 1254out: 1255 kfree(scontext2); 1256 kfree(str); 1257 return rc; 1258} 1259 1260/** 1261 * security_context_to_sid - Obtain a SID for a given security context. 1262 * @scontext: security context 1263 * @scontext_len: length in bytes 1264 * @sid: security identifier, SID 1265 * 1266 * Obtains a SID associated with the security context that 1267 * has the string representation specified by @scontext. 1268 * Returns -%EINVAL if the context is invalid, -%ENOMEM if insufficient 1269 * memory is available, or 0 on success. 1270 */ 1271int security_context_to_sid(const char *scontext, u32 scontext_len, u32 *sid) 1272{ 1273 return security_context_to_sid_core(scontext, scontext_len, 1274 sid, SECSID_NULL, GFP_KERNEL, 0); 1275} 1276 1277/** 1278 * security_context_to_sid_default - Obtain a SID for a given security context, 1279 * falling back to specified default if needed. 1280 * 1281 * @scontext: security context 1282 * @scontext_len: length in bytes 1283 * @sid: security identifier, SID 1284 * @def_sid: default SID to assign on error 1285 * 1286 * Obtains a SID associated with the security context that 1287 * has the string representation specified by @scontext. 1288 * The default SID is passed to the MLS layer to be used to allow 1289 * kernel labeling of the MLS field if the MLS field is not present 1290 * (for upgrading to MLS without full relabel). 1291 * Implicitly forces adding of the context even if it cannot be mapped yet. 1292 * Returns -%EINVAL if the context is invalid, -%ENOMEM if insufficient 1293 * memory is available, or 0 on success. 1294 */ 1295int security_context_to_sid_default(const char *scontext, u32 scontext_len, 1296 u32 *sid, u32 def_sid, gfp_t gfp_flags) 1297{ 1298 return security_context_to_sid_core(scontext, scontext_len, 1299 sid, def_sid, gfp_flags, 1); 1300} 1301 1302int security_context_to_sid_force(const char *scontext, u32 scontext_len, 1303 u32 *sid) 1304{ 1305 return security_context_to_sid_core(scontext, scontext_len, 1306 sid, SECSID_NULL, GFP_KERNEL, 1); 1307} 1308 1309static int compute_sid_handle_invalid_context( 1310 struct context *scontext, 1311 struct context *tcontext, 1312 u16 tclass, 1313 struct context *newcontext) 1314{ 1315 char *s = NULL, *t = NULL, *n = NULL; 1316 u32 slen, tlen, nlen; 1317 1318 if (context_struct_to_string(scontext, &s, &slen)) 1319 goto out; 1320 if (context_struct_to_string(tcontext, &t, &tlen)) 1321 goto out; 1322 if (context_struct_to_string(newcontext, &n, &nlen)) 1323 goto out; 1324 audit_log(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR, 1325 "security_compute_sid: invalid context %s" 1326 " for scontext=%s" 1327 " tcontext=%s" 1328 " tclass=%s", 1329 n, s, t, policydb.p_class_val_to_name[tclass-1]); 1330out: 1331 kfree(s); 1332 kfree(t); 1333 kfree(n); 1334 if (!selinux_enforcing) 1335 return 0; 1336 return -EACCES; 1337} 1338 1339static int security_compute_sid(u32 ssid, 1340 u32 tsid, 1341 u16 orig_tclass, 1342 u32 specified, 1343 u32 *out_sid, 1344 bool kern) 1345{ 1346 struct context *scontext = NULL, *tcontext = NULL, newcontext; 1347 struct role_trans *roletr = NULL; 1348 struct avtab_key avkey; 1349 struct avtab_datum *avdatum; 1350 struct avtab_node *node; 1351 u16 tclass; 1352 int rc = 0; 1353 1354 if (!ss_initialized) { 1355 switch (orig_tclass) { 1356 case SECCLASS_PROCESS: /* kernel value */ 1357 *out_sid = ssid; 1358 break; 1359 default: 1360 *out_sid = tsid; 1361 break; 1362 } 1363 goto out; 1364 } 1365 1366 context_init(&newcontext); 1367 1368 read_lock(&policy_rwlock); 1369 1370 if (kern) 1371 tclass = unmap_class(orig_tclass); 1372 else 1373 tclass = orig_tclass; 1374 1375 scontext = sidtab_search(&sidtab, ssid); 1376 if (!scontext) { 1377 printk(KERN_ERR "SELinux: %s: unrecognized SID %d\n", 1378 __func__, ssid); 1379 rc = -EINVAL; 1380 goto out_unlock; 1381 } 1382 tcontext = sidtab_search(&sidtab, tsid); 1383 if (!tcontext) { 1384 printk(KERN_ERR "SELinux: %s: unrecognized SID %d\n", 1385 __func__, tsid); 1386 rc = -EINVAL; 1387 goto out_unlock; 1388 } 1389 1390 /* Set the user identity. */ 1391 switch (specified) { 1392 case AVTAB_TRANSITION: 1393 case AVTAB_CHANGE: 1394 /* Use the process user identity. */ 1395 newcontext.user = scontext->user; 1396 break; 1397 case AVTAB_MEMBER: 1398 /* Use the related object owner. */ 1399 newcontext.user = tcontext->user; 1400 break; 1401 } 1402 1403 /* Set the role and type to default values. */ 1404 if (tclass == policydb.process_class) { 1405 /* Use the current role and type of process. */ 1406 newcontext.role = scontext->role; 1407 newcontext.type = scontext->type; 1408 } else { 1409 /* Use the well-defined object role. */ 1410 newcontext.role = OBJECT_R_VAL; 1411 /* Use the type of the related object. */ 1412 newcontext.type = tcontext->type; 1413 } 1414 1415 /* Look for a type transition/member/change rule. */ 1416 avkey.source_type = scontext->type; 1417 avkey.target_type = tcontext->type; 1418 avkey.target_class = tclass; 1419 avkey.specified = specified; 1420 avdatum = avtab_search(&policydb.te_avtab, &avkey); 1421 1422 /* If no permanent rule, also check for enabled conditional rules */ 1423 if (!avdatum) { 1424 node = avtab_search_node(&policydb.te_cond_avtab, &avkey); 1425 for (; node; node = avtab_search_node_next(node, specified)) { 1426 if (node->key.specified & AVTAB_ENABLED) { 1427 avdatum = &node->datum; 1428 break; 1429 } 1430 } 1431 } 1432 1433 if (avdatum) { 1434 /* Use the type from the type transition/member/change rule. */ 1435 newcontext.type = avdatum->data; 1436 } 1437 1438 /* Check for class-specific changes. */ 1439 if (tclass == policydb.process_class) { 1440 if (specified & AVTAB_TRANSITION) { 1441 /* Look for a role transition rule. */ 1442 for (roletr = policydb.role_tr; roletr; 1443 roletr = roletr->next) { 1444 if (roletr->role == scontext->role && 1445 roletr->type == tcontext->type) { 1446 /* Use the role transition rule. */ 1447 newcontext.role = roletr->new_role; 1448 break; 1449 } 1450 } 1451 } 1452 } 1453 1454 /* Set the MLS attributes. 1455 This is done last because it may allocate memory. */ 1456 rc = mls_compute_sid(scontext, tcontext, tclass, specified, &newcontext); 1457 if (rc) 1458 goto out_unlock; 1459 1460 /* Check the validity of the context. */ 1461 if (!policydb_context_isvalid(&policydb, &newcontext)) { 1462 rc = compute_sid_handle_invalid_context(scontext, 1463 tcontext, 1464 tclass, 1465 &newcontext); 1466 if (rc) 1467 goto out_unlock; 1468 } 1469 /* Obtain the sid for the context. */ 1470 rc = sidtab_context_to_sid(&sidtab, &newcontext, out_sid); 1471out_unlock: 1472 read_unlock(&policy_rwlock); 1473 context_destroy(&newcontext); 1474out: 1475 return rc; 1476} 1477 1478/** 1479 * security_transition_sid - Compute the SID for a new subject/object. 1480 * @ssid: source security identifier 1481 * @tsid: target security identifier 1482 * @tclass: target security class 1483 * @out_sid: security identifier for new subject/object 1484 * 1485 * Compute a SID to use for labeling a new subject or object in the 1486 * class @tclass based on a SID pair (@ssid, @tsid). 1487 * Return -%EINVAL if any of the parameters are invalid, -%ENOMEM 1488 * if insufficient memory is available, or %0 if the new SID was 1489 * computed successfully. 1490 */ 1491int security_transition_sid(u32 ssid, 1492 u32 tsid, 1493 u16 tclass, 1494 u32 *out_sid) 1495{ 1496 return security_compute_sid(ssid, tsid, tclass, AVTAB_TRANSITION, 1497 out_sid, true); 1498} 1499 1500int security_transition_sid_user(u32 ssid, 1501 u32 tsid, 1502 u16 tclass, 1503 u32 *out_sid) 1504{ 1505 return security_compute_sid(ssid, tsid, tclass, AVTAB_TRANSITION, 1506 out_sid, false); 1507} 1508 1509/** 1510 * security_member_sid - Compute the SID for member selection. 1511 * @ssid: source security identifier 1512 * @tsid: target security identifier 1513 * @tclass: target security class 1514 * @out_sid: security identifier for selected member 1515 * 1516 * Compute a SID to use when selecting a member of a polyinstantiated 1517 * object of class @tclass based on a SID pair (@ssid, @tsid). 1518 * Return -%EINVAL if any of the parameters are invalid, -%ENOMEM 1519 * if insufficient memory is available, or %0 if the SID was 1520 * computed successfully. 1521 */ 1522int security_member_sid(u32 ssid, 1523 u32 tsid, 1524 u16 tclass, 1525 u32 *out_sid) 1526{ 1527 return security_compute_sid(ssid, tsid, tclass, AVTAB_MEMBER, out_sid, 1528 false); 1529} 1530 1531/** 1532 * security_change_sid - Compute the SID for object relabeling. 1533 * @ssid: source security identifier 1534 * @tsid: target security identifier 1535 * @tclass: target security class 1536 * @out_sid: security identifier for selected member 1537 * 1538 * Compute a SID to use for relabeling an object of class @tclass 1539 * based on a SID pair (@ssid, @tsid). 1540 * Return -%EINVAL if any of the parameters are invalid, -%ENOMEM 1541 * if insufficient memory is available, or %0 if the SID was 1542 * computed successfully. 1543 */ 1544int security_change_sid(u32 ssid, 1545 u32 tsid, 1546 u16 tclass, 1547 u32 *out_sid) 1548{ 1549 return security_compute_sid(ssid, tsid, tclass, AVTAB_CHANGE, out_sid, 1550 false); 1551} 1552 1553/* Clone the SID into the new SID table. */ 1554static int clone_sid(u32 sid, 1555 struct context *context, 1556 void *arg) 1557{ 1558 struct sidtab *s = arg; 1559 1560 if (sid > SECINITSID_NUM) 1561 return sidtab_insert(s, sid, context); 1562 else 1563 return 0; 1564} 1565 1566static inline int convert_context_handle_invalid_context(struct context *context) 1567{ 1568 char *s; 1569 u32 len; 1570 1571 if (selinux_enforcing) 1572 return -EINVAL; 1573 1574 if (!context_struct_to_string(context, &s, &len)) { 1575 printk(KERN_WARNING "SELinux: Context %s would be invalid if enforcing\n", s); 1576 kfree(s); 1577 } 1578 return 0; 1579} 1580 1581struct convert_context_args { 1582 struct policydb *oldp; 1583 struct policydb *newp; 1584}; 1585 1586/* 1587 * Convert the values in the security context 1588 * structure `c' from the values specified 1589 * in the policy `p->oldp' to the values specified 1590 * in the policy `p->newp'. Verify that the 1591 * context is valid under the new policy. 1592 */ 1593static int convert_context(u32 key, 1594 struct context *c, 1595 void *p) 1596{ 1597 struct convert_context_args *args; 1598 struct context oldc; 1599 struct ocontext *oc; 1600 struct mls_range *range; 1601 struct role_datum *role; 1602 struct type_datum *typdatum; 1603 struct user_datum *usrdatum; 1604 char *s; 1605 u32 len; 1606 int rc = 0; 1607 1608 if (key <= SECINITSID_NUM) 1609 goto out; 1610 1611 args = p; 1612 1613 if (c->str) { 1614 struct context ctx; 1615 1616 rc = -ENOMEM; 1617 s = kstrdup(c->str, GFP_KERNEL); 1618 if (!s) 1619 goto out; 1620 1621 rc = string_to_context_struct(args->newp, NULL, s, 1622 c->len, &ctx, SECSID_NULL); 1623 kfree(s); 1624 if (!rc) { 1625 printk(KERN_INFO "SELinux: Context %s became valid (mapped).\n", 1626 c->str); 1627 /* Replace string with mapped representation. */ 1628 kfree(c->str); 1629 memcpy(c, &ctx, sizeof(*c)); 1630 goto out; 1631 } else if (rc == -EINVAL) { 1632 /* Retain string representation for later mapping. */ 1633 rc = 0; 1634 goto out; 1635 } else { 1636 /* Other error condition, e.g. ENOMEM. */ 1637 printk(KERN_ERR "SELinux: Unable to map context %s, rc = %d.\n", 1638 c->str, -rc); 1639 goto out; 1640 } 1641 } 1642 1643 rc = context_cpy(&oldc, c); 1644 if (rc) 1645 goto out; 1646 1647 /* Convert the user. */ 1648 rc = -EINVAL; 1649 usrdatum = hashtab_search(args->newp->p_users.table, 1650 args->oldp->p_user_val_to_name[c->user - 1]); 1651 if (!usrdatum) 1652 goto bad; 1653 c->user = usrdatum->value; 1654 1655 /* Convert the role. */ 1656 rc = -EINVAL; 1657 role = hashtab_search(args->newp->p_roles.table, 1658 args->oldp->p_role_val_to_name[c->role - 1]); 1659 if (!role) 1660 goto bad; 1661 c->role = role->value; 1662 1663 /* Convert the type. */ 1664 rc = -EINVAL; 1665 typdatum = hashtab_search(args->newp->p_types.table, 1666 args->oldp->p_type_val_to_name[c->type - 1]); 1667 if (!typdatum) 1668 goto bad; 1669 c->type = typdatum->value; 1670 1671 /* Convert the MLS fields if dealing with MLS policies */ 1672 if (args->oldp->mls_enabled && args->newp->mls_enabled) { 1673 rc = mls_convert_context(args->oldp, args->newp, c); 1674 if (rc) 1675 goto bad; 1676 } else if (args->oldp->mls_enabled && !args->newp->mls_enabled) { 1677 /* 1678 * Switching between MLS and non-MLS policy: 1679 * free any storage used by the MLS fields in the 1680 * context for all existing entries in the sidtab. 1681 */ 1682 mls_context_destroy(c); 1683 } else if (!args->oldp->mls_enabled && args->newp->mls_enabled) { 1684 /* 1685 * Switching between non-MLS and MLS policy: 1686 * ensure that the MLS fields of the context for all 1687 * existing entries in the sidtab are filled in with a 1688 * suitable default value, likely taken from one of the 1689 * initial SIDs. 1690 */ 1691 oc = args->newp->ocontexts[OCON_ISID]; 1692 while (oc && oc->sid[0] != SECINITSID_UNLABELED) 1693 oc = oc->next; 1694 rc = -EINVAL; 1695 if (!oc) { 1696 printk(KERN_ERR "SELinux: unable to look up" 1697 " the initial SIDs list\n"); 1698 goto bad; 1699 } 1700 range = &oc->context[0].range; 1701 rc = mls_range_set(c, range); 1702 if (rc) 1703 goto bad; 1704 } 1705 1706 /* Check the validity of the new context. */ 1707 if (!policydb_context_isvalid(args->newp, c)) { 1708 rc = convert_context_handle_invalid_context(&oldc); 1709 if (rc) 1710 goto bad; 1711 } 1712 1713 context_destroy(&oldc); 1714 1715 rc = 0; 1716out: 1717 return rc; 1718bad: 1719 /* Map old representation to string and save it. */ 1720 rc = context_struct_to_string(&oldc, &s, &len); 1721 if (rc) 1722 return rc; 1723 context_destroy(&oldc); 1724 context_destroy(c); 1725 c->str = s; 1726 c->len = len; 1727 printk(KERN_INFO "SELinux: Context %s became invalid (unmapped).\n", 1728 c->str); 1729 rc = 0; 1730 goto out; 1731} 1732 1733static void security_load_policycaps(void) 1734{ 1735 selinux_policycap_netpeer = ebitmap_get_bit(&policydb.policycaps, 1736 POLICYDB_CAPABILITY_NETPEER); 1737 selinux_policycap_openperm = ebitmap_get_bit(&policydb.policycaps, 1738 POLICYDB_CAPABILITY_OPENPERM); 1739} 1740 1741extern void selinux_complete_init(void); 1742static int security_preserve_bools(struct policydb *p); 1743 1744/** 1745 * security_load_policy - Load a security policy configuration. 1746 * @data: binary policy data 1747 * @len: length of data in bytes 1748 * 1749 * Load a new set of security policy configuration data, 1750 * validate it and convert the SID table as necessary. 1751 * This function will flush the access vector cache after 1752 * loading the new policy. 1753 */ 1754int security_load_policy(void *data, size_t len) 1755{ 1756 struct policydb oldpolicydb, newpolicydb; 1757 struct sidtab oldsidtab, newsidtab; 1758 struct selinux_mapping *oldmap, *map = NULL; 1759 struct convert_context_args args; 1760 u32 seqno; 1761 u16 map_size; 1762 int rc = 0; 1763 struct policy_file file = { data, len }, *fp = &file; 1764 1765 if (!ss_initialized) { 1766 avtab_cache_init(); 1767 rc = policydb_read(&policydb, fp); 1768 if (rc) { 1769 avtab_cache_destroy(); 1770 return rc; 1771 } 1772 1773 policydb.len = len; 1774 rc = selinux_set_mapping(&policydb, secclass_map, 1775 ¤t_mapping, 1776 ¤t_mapping_size); 1777 if (rc) { 1778 policydb_destroy(&policydb); 1779 avtab_cache_destroy(); 1780 return rc; 1781 } 1782 1783 rc = policydb_load_isids(&policydb, &sidtab); 1784 if (rc) { 1785 policydb_destroy(&policydb); 1786 avtab_cache_destroy(); 1787 return rc; 1788 } 1789 1790 security_load_policycaps(); 1791 ss_initialized = 1; 1792 seqno = ++latest_granting; 1793 selinux_complete_init(); 1794 avc_ss_reset(seqno); 1795 selnl_notify_policyload(seqno); 1796 selinux_status_update_policyload(seqno); 1797 selinux_netlbl_cache_invalidate(); 1798 selinux_xfrm_notify_policyload(); 1799 return 0; 1800 } 1801 1802#if 0 1803 sidtab_hash_eval(&sidtab, "sids"); 1804#endif 1805 1806 rc = policydb_read(&newpolicydb, fp); 1807 if (rc) 1808 return rc; 1809 1810 newpolicydb.len = len; 1811 /* If switching between different policy types, log MLS status */ 1812 if (policydb.mls_enabled && !newpolicydb.mls_enabled) 1813 printk(KERN_INFO "SELinux: Disabling MLS support...\n"); 1814 else if (!policydb.mls_enabled && newpolicydb.mls_enabled) 1815 printk(KERN_INFO "SELinux: Enabling MLS support...\n"); 1816 1817 rc = policydb_load_isids(&newpolicydb, &newsidtab); 1818 if (rc) { 1819 printk(KERN_ERR "SELinux: unable to load the initial SIDs\n"); 1820 policydb_destroy(&newpolicydb); 1821 return rc; 1822 } 1823 1824 rc = selinux_set_mapping(&newpolicydb, secclass_map, &map, &map_size); 1825 if (rc) 1826 goto err; 1827 1828 rc = security_preserve_bools(&newpolicydb); 1829 if (rc) { 1830 printk(KERN_ERR "SELinux: unable to preserve booleans\n"); 1831 goto err; 1832 } 1833 1834 /* Clone the SID table. */ 1835 sidtab_shutdown(&sidtab); 1836 1837 rc = sidtab_map(&sidtab, clone_sid, &newsidtab); 1838 if (rc) 1839 goto err; 1840 1841 /* 1842 * Convert the internal representations of contexts 1843 * in the new SID table. 1844 */ 1845 args.oldp = &policydb; 1846 args.newp = &newpolicydb; 1847 rc = sidtab_map(&newsidtab, convert_context, &args); 1848 if (rc) { 1849 printk(KERN_ERR "SELinux: unable to convert the internal" 1850 " representation of contexts in the new SID" 1851 " table\n"); 1852 goto err; 1853 } 1854 1855 /* Save the old policydb and SID table to free later. */ 1856 memcpy(&oldpolicydb, &policydb, sizeof policydb); 1857 sidtab_set(&oldsidtab, &sidtab); 1858 1859 /* Install the new policydb and SID table. */ 1860 write_lock_irq(&policy_rwlock); 1861 memcpy(&policydb, &newpolicydb, sizeof policydb); 1862 sidtab_set(&sidtab, &newsidtab); 1863 security_load_policycaps(); 1864 oldmap = current_mapping; 1865 current_mapping = map; 1866 current_mapping_size = map_size; 1867 seqno = ++latest_granting; 1868 write_unlock_irq(&policy_rwlock); 1869 1870 /* Free the old policydb and SID table. */ 1871 policydb_destroy(&oldpolicydb); 1872 sidtab_destroy(&oldsidtab); 1873 kfree(oldmap); 1874 1875 avc_ss_reset(seqno); 1876 selnl_notify_policyload(seqno); 1877 selinux_status_update_policyload(seqno); 1878 selinux_netlbl_cache_invalidate(); 1879 selinux_xfrm_notify_policyload(); 1880 1881 return 0; 1882 1883err: 1884 kfree(map); 1885 sidtab_destroy(&newsidtab); 1886 policydb_destroy(&newpolicydb); 1887 return rc; 1888 1889} 1890 1891size_t security_policydb_len(void) 1892{ 1893 size_t len; 1894 1895 read_lock(&policy_rwlock); 1896 len = policydb.len; 1897 read_unlock(&policy_rwlock); 1898 1899 return len; 1900} 1901 1902/** 1903 * security_port_sid - Obtain the SID for a port. 1904 * @protocol: protocol number 1905 * @port: port number 1906 * @out_sid: security identifier 1907 */ 1908int security_port_sid(u8 protocol, u16 port, u32 *out_sid) 1909{ 1910 struct ocontext *c; 1911 int rc = 0; 1912 1913 read_lock(&policy_rwlock); 1914 1915 c = policydb.ocontexts[OCON_PORT]; 1916 while (c) { 1917 if (c->u.port.protocol == protocol && 1918 c->u.port.low_port <= port && 1919 c->u.port.high_port >= port) 1920 break; 1921 c = c->next; 1922 } 1923 1924 if (c) { 1925 if (!c->sid[0]) { 1926 rc = sidtab_context_to_sid(&sidtab, 1927 &c->context[0], 1928 &c->sid[0]); 1929 if (rc) 1930 goto out; 1931 } 1932 *out_sid = c->sid[0]; 1933 } else { 1934 *out_sid = SECINITSID_PORT; 1935 } 1936 1937out: 1938 read_unlock(&policy_rwlock); 1939 return rc; 1940} 1941 1942/** 1943 * security_netif_sid - Obtain the SID for a network interface. 1944 * @name: interface name 1945 * @if_sid: interface SID 1946 */ 1947int security_netif_sid(char *name, u32 *if_sid) 1948{ 1949 int rc = 0; 1950 struct ocontext *c; 1951 1952 read_lock(&policy_rwlock); 1953 1954 c = policydb.ocontexts[OCON_NETIF]; 1955 while (c) { 1956 if (strcmp(name, c->u.name) == 0) 1957 break; 1958 c = c->next; 1959 } 1960 1961 if (c) { 1962 if (!c->sid[0] || !c->sid[1]) { 1963 rc = sidtab_context_to_sid(&sidtab, 1964 &c->context[0], 1965 &c->sid[0]); 1966 if (rc) 1967 goto out; 1968 rc = sidtab_context_to_sid(&sidtab, 1969 &c->context[1], 1970 &c->sid[1]); 1971 if (rc) 1972 goto out; 1973 } 1974 *if_sid = c->sid[0]; 1975 } else 1976 *if_sid = SECINITSID_NETIF; 1977 1978out: 1979 read_unlock(&policy_rwlock); 1980 return rc; 1981} 1982 1983static int match_ipv6_addrmask(u32 *input, u32 *addr, u32 *mask) 1984{ 1985 int i, fail = 0; 1986 1987 for (i = 0; i < 4; i++) 1988 if (addr[i] != (input[i] & mask[i])) { 1989 fail = 1; 1990 break; 1991 } 1992 1993 return !fail; 1994} 1995 1996/** 1997 * security_node_sid - Obtain the SID for a node (host). 1998 * @domain: communication domain aka address family 1999 * @addrp: address 2000 * @addrlen: address length in bytes 2001 * @out_sid: security identifier 2002 */ 2003int security_node_sid(u16 domain, 2004 void *addrp, 2005 u32 addrlen, 2006 u32 *out_sid) 2007{ 2008 int rc; 2009 struct ocontext *c; 2010 2011 read_lock(&policy_rwlock); 2012 2013 switch (domain) { 2014 case AF_INET: { 2015 u32 addr; 2016 2017 rc = -EINVAL; 2018 if (addrlen != sizeof(u32)) 2019 goto out; 2020 2021 addr = *((u32 *)addrp); 2022 2023 c = policydb.ocontexts[OCON_NODE]; 2024 while (c) { 2025 if (c->u.node.addr == (addr & c->u.node.mask)) 2026 break; 2027 c = c->next; 2028 } 2029 break; 2030 } 2031 2032 case AF_INET6: 2033 rc = -EINVAL; 2034 if (addrlen != sizeof(u64) * 2) 2035 goto out; 2036 c = policydb.ocontexts[OCON_NODE6]; 2037 while (c) { 2038 if (match_ipv6_addrmask(addrp, c->u.node6.addr, 2039 c->u.node6.mask)) 2040 break; 2041 c = c->next; 2042 } 2043 break; 2044 2045 default: 2046 rc = 0; 2047 *out_sid = SECINITSID_NODE; 2048 goto out; 2049 } 2050 2051 if (c) { 2052 if (!c->sid[0]) { 2053 rc = sidtab_context_to_sid(&sidtab, 2054 &c->context[0], 2055 &c->sid[0]); 2056 if (rc) 2057 goto out; 2058 } 2059 *out_sid = c->sid[0]; 2060 } else { 2061 *out_sid = SECINITSID_NODE; 2062 } 2063 2064 rc = 0; 2065out: 2066 read_unlock(&policy_rwlock); 2067 return rc; 2068} 2069 2070#define SIDS_NEL 25 2071 2072/** 2073 * security_get_user_sids - Obtain reachable SIDs for a user. 2074 * @fromsid: starting SID 2075 * @username: username 2076 * @sids: array of reachable SIDs for user 2077 * @nel: number of elements in @sids 2078 * 2079 * Generate the set of SIDs for legal security contexts 2080 * for a given user that can be reached by @fromsid. 2081 * Set *@sids to point to a dynamically allocated 2082 * array containing the set of SIDs. Set *@nel to the 2083 * number of elements in the array. 2084 */ 2085 2086int security_get_user_sids(u32 fromsid, 2087 char *username, 2088 u32 **sids, 2089 u32 *nel) 2090{ 2091 struct context *fromcon, usercon; 2092 u32 *mysids = NULL, *mysids2, sid; 2093 u32 mynel = 0, maxnel = SIDS_NEL; 2094 struct user_datum *user; 2095 struct role_datum *role; 2096 struct ebitmap_node *rnode, *tnode; 2097 int rc = 0, i, j; 2098 2099 *sids = NULL; 2100 *nel = 0; 2101 2102 if (!ss_initialized) 2103 goto out; 2104 2105 read_lock(&policy_rwlock); 2106 2107 context_init(&usercon); 2108 2109 rc = -EINVAL; 2110 fromcon = sidtab_search(&sidtab, fromsid); 2111 if (!fromcon) 2112 goto out_unlock; 2113 2114 rc = -EINVAL; 2115 user = hashtab_search(policydb.p_users.table, username); 2116 if (!user) 2117 goto out_unlock; 2118 2119 usercon.user = user->value; 2120 2121 rc = -ENOMEM; 2122 mysids = kcalloc(maxnel, sizeof(*mysids), GFP_ATOMIC); 2123 if (!mysids) 2124 goto out_unlock; 2125 2126 ebitmap_for_each_positive_bit(&user->roles, rnode, i) { 2127 role = policydb.role_val_to_struct[i]; 2128 usercon.role = i + 1; 2129 ebitmap_for_each_positive_bit(&role->types, tnode, j) { 2130 usercon.type = j + 1; 2131 2132 if (mls_setup_user_range(fromcon, user, &usercon)) 2133 continue; 2134 2135 rc = sidtab_context_to_sid(&sidtab, &usercon, &sid); 2136 if (rc) 2137 goto out_unlock; 2138 if (mynel < maxnel) { 2139 mysids[mynel++] = sid; 2140 } else { 2141 rc = -ENOMEM; 2142 maxnel += SIDS_NEL; 2143 mysids2 = kcalloc(maxnel, sizeof(*mysids2), GFP_ATOMIC); 2144 if (!mysids2) 2145 goto out_unlock; 2146 memcpy(mysids2, mysids, mynel * sizeof(*mysids2)); 2147 kfree(mysids); 2148 mysids = mysids2; 2149 mysids[mynel++] = sid; 2150 } 2151 } 2152 } 2153 rc = 0; 2154out_unlock: 2155 read_unlock(&policy_rwlock); 2156 if (rc || !mynel) { 2157 kfree(mysids); 2158 goto out; 2159 } 2160 2161 rc = -ENOMEM; 2162 mysids2 = kcalloc(mynel, sizeof(*mysids2), GFP_KERNEL); 2163 if (!mysids2) { 2164 kfree(mysids); 2165 goto out; 2166 } 2167 for (i = 0, j = 0; i < mynel; i++) { 2168 rc = avc_has_perm_noaudit(fromsid, mysids[i], 2169 SECCLASS_PROCESS, /* kernel value */ 2170 PROCESS__TRANSITION, AVC_STRICT, 2171 NULL); 2172 if (!rc) 2173 mysids2[j++] = mysids[i]; 2174 cond_resched(); 2175 } 2176 rc = 0; 2177 kfree(mysids); 2178 *sids = mysids2; 2179 *nel = j; 2180out: 2181 return rc; 2182} 2183 2184/** 2185 * security_genfs_sid - Obtain a SID for a file in a filesystem 2186 * @fstype: filesystem type 2187 * @path: path from root of mount 2188 * @sclass: file security class 2189 * @sid: SID for path 2190 * 2191 * Obtain a SID to use for a file in a filesystem that 2192 * cannot support xattr or use a fixed labeling behavior like 2193 * transition SIDs or task SIDs. 2194 */ 2195int security_genfs_sid(const char *fstype, 2196 char *path, 2197 u16 orig_sclass, 2198 u32 *sid) 2199{ 2200 int len; 2201 u16 sclass; 2202 struct genfs *genfs; 2203 struct ocontext *c; 2204 int rc, cmp = 0; 2205 2206 while (path[0] == '/' && path[1] == '/') 2207 path++; 2208 2209 read_lock(&policy_rwlock); 2210 2211 sclass = unmap_class(orig_sclass); 2212 *sid = SECINITSID_UNLABELED; 2213 2214 for (genfs = policydb.genfs; genfs; genfs = genfs->next) { 2215 cmp = strcmp(fstype, genfs->fstype); 2216 if (cmp <= 0) 2217 break; 2218 } 2219 2220 rc = -ENOENT; 2221 if (!genfs || cmp) 2222 goto out; 2223 2224 for (c = genfs->head; c; c = c->next) { 2225 len = strlen(c->u.name); 2226 if ((!c->v.sclass || sclass == c->v.sclass) && 2227 (strncmp(c->u.name, path, len) == 0)) 2228 break; 2229 } 2230 2231 rc = -ENOENT; 2232 if (!c) 2233 goto out; 2234 2235 if (!c->sid[0]) { 2236 rc = sidtab_context_to_sid(&sidtab, &c->context[0], &c->sid[0]); 2237 if (rc) 2238 goto out; 2239 } 2240 2241 *sid = c->sid[0]; 2242 rc = 0; 2243out: 2244 read_unlock(&policy_rwlock); 2245 return rc; 2246} 2247 2248/** 2249 * security_fs_use - Determine how to handle labeling for a filesystem. 2250 * @fstype: filesystem type 2251 * @behavior: labeling behavior 2252 * @sid: SID for filesystem (superblock) 2253 */ 2254int security_fs_use( 2255 const char *fstype, 2256 unsigned int *behavior, 2257 u32 *sid) 2258{ 2259 int rc = 0; 2260 struct ocontext *c; 2261 2262 read_lock(&policy_rwlock); 2263 2264 c = policydb.ocontexts[OCON_FSUSE]; 2265 while (c) { 2266 if (strcmp(fstype, c->u.name) == 0) 2267 break; 2268 c = c->next; 2269 } 2270 2271 if (c) { 2272 *behavior = c->v.behavior; 2273 if (!c->sid[0]) { 2274 rc = sidtab_context_to_sid(&sidtab, &c->context[0], 2275 &c->sid[0]); 2276 if (rc) 2277 goto out; 2278 } 2279 *sid = c->sid[0]; 2280 } else { 2281 rc = security_genfs_sid(fstype, "/", SECCLASS_DIR, sid); 2282 if (rc) { 2283 *behavior = SECURITY_FS_USE_NONE; 2284 rc = 0; 2285 } else { 2286 *behavior = SECURITY_FS_USE_GENFS; 2287 } 2288 } 2289 2290out: 2291 read_unlock(&policy_rwlock); 2292 return rc; 2293} 2294 2295int security_get_bools(int *len, char ***names, int **values) 2296{ 2297 int i, rc; 2298 2299 read_lock(&policy_rwlock); 2300 *names = NULL; 2301 *values = NULL; 2302 2303 rc = 0; 2304 *len = policydb.p_bools.nprim; 2305 if (!*len) 2306 goto out; 2307 2308 rc = -ENOMEM; 2309 *names = kcalloc(*len, sizeof(char *), GFP_ATOMIC); 2310 if (!*names) 2311 goto err; 2312 2313 rc = -ENOMEM; 2314 *values = kcalloc(*len, sizeof(int), GFP_ATOMIC); 2315 if (!*values) 2316 goto err; 2317 2318 for (i = 0; i < *len; i++) { 2319 size_t name_len; 2320 2321 (*values)[i] = policydb.bool_val_to_struct[i]->state; 2322 name_len = strlen(policydb.p_bool_val_to_name[i]) + 1; 2323 2324 rc = -ENOMEM; 2325 (*names)[i] = kmalloc(sizeof(char) * name_len, GFP_ATOMIC); 2326 if (!(*names)[i]) 2327 goto err; 2328 2329 strncpy((*names)[i], policydb.p_bool_val_to_name[i], name_len); 2330 (*names)[i][name_len - 1] = 0; 2331 } 2332 rc = 0; 2333out: 2334 read_unlock(&policy_rwlock); 2335 return rc; 2336err: 2337 if (*names) { 2338 for (i = 0; i < *len; i++) 2339 kfree((*names)[i]); 2340 } 2341 kfree(*values); 2342 goto out; 2343} 2344 2345 2346int security_set_bools(int len, int *values) 2347{ 2348 int i, rc; 2349 int lenp, seqno = 0; 2350 struct cond_node *cur; 2351 2352 write_lock_irq(&policy_rwlock); 2353 2354 rc = -EFAULT; 2355 lenp = policydb.p_bools.nprim; 2356 if (len != lenp) 2357 goto out; 2358 2359 for (i = 0; i < len; i++) { 2360 if (!!values[i] != policydb.bool_val_to_struct[i]->state) { 2361 audit_log(current->audit_context, GFP_ATOMIC, 2362 AUDIT_MAC_CONFIG_CHANGE, 2363 "bool=%s val=%d old_val=%d auid=%u ses=%u", 2364 policydb.p_bool_val_to_name[i], 2365 !!values[i], 2366 policydb.bool_val_to_struct[i]->state, 2367 audit_get_loginuid(current), 2368 audit_get_sessionid(current)); 2369 } 2370 if (values[i]) 2371 policydb.bool_val_to_struct[i]->state = 1; 2372 else 2373 policydb.bool_val_to_struct[i]->state = 0; 2374 } 2375 2376 for (cur = policydb.cond_list; cur; cur = cur->next) { 2377 rc = evaluate_cond_node(&policydb, cur); 2378 if (rc) 2379 goto out; 2380 } 2381 2382 seqno = ++latest_granting; 2383 rc = 0; 2384out: 2385 write_unlock_irq(&policy_rwlock); 2386 if (!rc) { 2387 avc_ss_reset(seqno); 2388 selnl_notify_policyload(seqno); 2389 selinux_status_update_policyload(seqno); 2390 selinux_xfrm_notify_policyload(); 2391 } 2392 return rc; 2393} 2394 2395int security_get_bool_value(int bool) 2396{ 2397 int rc; 2398 int len; 2399 2400 read_lock(&policy_rwlock); 2401 2402 rc = -EFAULT; 2403 len = policydb.p_bools.nprim; 2404 if (bool >= len) 2405 goto out; 2406 2407 rc = policydb.bool_val_to_struct[bool]->state; 2408out: 2409 read_unlock(&policy_rwlock); 2410 return rc; 2411} 2412 2413static int security_preserve_bools(struct policydb *p) 2414{ 2415 int rc, nbools = 0, *bvalues = NULL, i; 2416 char **bnames = NULL; 2417 struct cond_bool_datum *booldatum; 2418 struct cond_node *cur; 2419 2420 rc = security_get_bools(&nbools, &bnames, &bvalues); 2421 if (rc) 2422 goto out; 2423 for (i = 0; i < nbools; i++) { 2424 booldatum = hashtab_search(p->p_bools.table, bnames[i]); 2425 if (booldatum) 2426 booldatum->state = bvalues[i]; 2427 } 2428 for (cur = p->cond_list; cur; cur = cur->next) { 2429 rc = evaluate_cond_node(p, cur); 2430 if (rc) 2431 goto out; 2432 } 2433 2434out: 2435 if (bnames) { 2436 for (i = 0; i < nbools; i++) 2437 kfree(bnames[i]); 2438 } 2439 kfree(bnames); 2440 kfree(bvalues); 2441 return rc; 2442} 2443 2444/* 2445 * security_sid_mls_copy() - computes a new sid based on the given 2446 * sid and the mls portion of mls_sid. 2447 */ 2448int security_sid_mls_copy(u32 sid, u32 mls_sid, u32 *new_sid) 2449{ 2450 struct context *context1; 2451 struct context *context2; 2452 struct context newcon; 2453 char *s; 2454 u32 len; 2455 int rc; 2456 2457 rc = 0; 2458 if (!ss_initialized || !policydb.mls_enabled) { 2459 *new_sid = sid; 2460 goto out; 2461 } 2462 2463 context_init(&newcon); 2464 2465 read_lock(&policy_rwlock); 2466 2467 rc = -EINVAL; 2468 context1 = sidtab_search(&sidtab, sid); 2469 if (!context1) { 2470 printk(KERN_ERR "SELinux: %s: unrecognized SID %d\n", 2471 __func__, sid); 2472 goto out_unlock; 2473 } 2474 2475 rc = -EINVAL; 2476 context2 = sidtab_search(&sidtab, mls_sid); 2477 if (!context2) { 2478 printk(KERN_ERR "SELinux: %s: unrecognized SID %d\n", 2479 __func__, mls_sid); 2480 goto out_unlock; 2481 } 2482 2483 newcon.user = context1->user; 2484 newcon.role = context1->role; 2485 newcon.type = context1->type; 2486 rc = mls_context_cpy(&newcon, context2); 2487 if (rc) 2488 goto out_unlock; 2489 2490 /* Check the validity of the new context. */ 2491 if (!policydb_context_isvalid(&policydb, &newcon)) { 2492 rc = convert_context_handle_invalid_context(&newcon); 2493 if (rc) { 2494 if (!context_struct_to_string(&newcon, &s, &len)) { 2495 audit_log(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR, 2496 "security_sid_mls_copy: invalid context %s", s); 2497 kfree(s); 2498 } 2499 goto out_unlock; 2500 } 2501 } 2502 2503 rc = sidtab_context_to_sid(&sidtab, &newcon, new_sid); 2504out_unlock: 2505 read_unlock(&policy_rwlock); 2506 context_destroy(&newcon); 2507out: 2508 return rc; 2509} 2510 2511/** 2512 * security_net_peersid_resolve - Compare and resolve two network peer SIDs 2513 * @nlbl_sid: NetLabel SID 2514 * @nlbl_type: NetLabel labeling protocol type 2515 * @xfrm_sid: XFRM SID 2516 * 2517 * Description: 2518 * Compare the @nlbl_sid and @xfrm_sid values and if the two SIDs can be 2519 * resolved into a single SID it is returned via @peer_sid and the function 2520 * returns zero. Otherwise @peer_sid is set to SECSID_NULL and the function 2521 * returns a negative value. A table summarizing the behavior is below: 2522 * 2523 * | function return | @sid 2524 * ------------------------------+-----------------+----------------- 2525 * no peer labels | 0 | SECSID_NULL 2526 * single peer label | 0 | <peer_label> 2527 * multiple, consistent labels | 0 | <peer_label> 2528 * multiple, inconsistent labels | -<errno> | SECSID_NULL 2529 * 2530 */ 2531int security_net_peersid_resolve(u32 nlbl_sid, u32 nlbl_type, 2532 u32 xfrm_sid, 2533 u32 *peer_sid) 2534{ 2535 int rc; 2536 struct context *nlbl_ctx; 2537 struct context *xfrm_ctx; 2538 2539 *peer_sid = SECSID_NULL; 2540 2541 /* handle the common (which also happens to be the set of easy) cases 2542 * right away, these two if statements catch everything involving a 2543 * single or absent peer SID/label */ 2544 if (xfrm_sid == SECSID_NULL) { 2545 *peer_sid = nlbl_sid; 2546 return 0; 2547 } 2548 /* NOTE: an nlbl_type == NETLBL_NLTYPE_UNLABELED is a "fallback" label 2549 * and is treated as if nlbl_sid == SECSID_NULL when a XFRM SID/label 2550 * is present */ 2551 if (nlbl_sid == SECSID_NULL || nlbl_type == NETLBL_NLTYPE_UNLABELED) { 2552 *peer_sid = xfrm_sid; 2553 return 0; 2554 } 2555 2556 /* we don't need to check ss_initialized here since the only way both 2557 * nlbl_sid and xfrm_sid are not equal to SECSID_NULL would be if the 2558 * security server was initialized and ss_initialized was true */ 2559 if (!policydb.mls_enabled) 2560 return 0; 2561 2562 read_lock(&policy_rwlock); 2563 2564 rc = -EINVAL; 2565 nlbl_ctx = sidtab_search(&sidtab, nlbl_sid); 2566 if (!nlbl_ctx) { 2567 printk(KERN_ERR "SELinux: %s: unrecognized SID %d\n", 2568 __func__, nlbl_sid); 2569 goto out; 2570 } 2571 rc = -EINVAL; 2572 xfrm_ctx = sidtab_search(&sidtab, xfrm_sid); 2573 if (!xfrm_ctx) { 2574 printk(KERN_ERR "SELinux: %s: unrecognized SID %d\n", 2575 __func__, xfrm_sid); 2576 goto out; 2577 } 2578 rc = (mls_context_cmp(nlbl_ctx, xfrm_ctx) ? 0 : -EACCES); 2579 if (rc) 2580 goto out; 2581 2582 /* at present NetLabel SIDs/labels really only carry MLS 2583 * information so if the MLS portion of the NetLabel SID 2584 * matches the MLS portion of the labeled XFRM SID/label 2585 * then pass along the XFRM SID as it is the most 2586 * expressive */ 2587 *peer_sid = xfrm_sid; 2588out: 2589 read_unlock(&policy_rwlock); 2590 return rc; 2591} 2592 2593static int get_classes_callback(void *k, void *d, void *args) 2594{ 2595 struct class_datum *datum = d; 2596 char *name = k, **classes = args; 2597 int value = datum->value - 1; 2598 2599 classes[value] = kstrdup(name, GFP_ATOMIC); 2600 if (!classes[value]) 2601 return -ENOMEM; 2602 2603 return 0; 2604} 2605 2606int security_get_classes(char ***classes, int *nclasses) 2607{ 2608 int rc; 2609 2610 read_lock(&policy_rwlock); 2611 2612 rc = -ENOMEM; 2613 *nclasses = policydb.p_classes.nprim; 2614 *classes = kcalloc(*nclasses, sizeof(**classes), GFP_ATOMIC); 2615 if (!*classes) 2616 goto out; 2617 2618 rc = hashtab_map(policydb.p_classes.table, get_classes_callback, 2619 *classes); 2620 if (rc) { 2621 int i; 2622 for (i = 0; i < *nclasses; i++) 2623 kfree((*classes)[i]); 2624 kfree(*classes); 2625 } 2626 2627out: 2628 read_unlock(&policy_rwlock); 2629 return rc; 2630} 2631 2632static int get_permissions_callback(void *k, void *d, void *args) 2633{ 2634 struct perm_datum *datum = d; 2635 char *name = k, **perms = args; 2636 int value = datum->value - 1; 2637 2638 perms[value] = kstrdup(name, GFP_ATOMIC); 2639 if (!perms[value]) 2640 return -ENOMEM; 2641 2642 return 0; 2643} 2644 2645int security_get_permissions(char *class, char ***perms, int *nperms) 2646{ 2647 int rc, i; 2648 struct class_datum *match; 2649 2650 read_lock(&policy_rwlock); 2651 2652 rc = -EINVAL; 2653 match = hashtab_search(policydb.p_classes.table, class); 2654 if (!match) { 2655 printk(KERN_ERR "SELinux: %s: unrecognized class %s\n", 2656 __func__, class); 2657 goto out; 2658 } 2659 2660 rc = -ENOMEM; 2661 *nperms = match->permissions.nprim; 2662 *perms = kcalloc(*nperms, sizeof(**perms), GFP_ATOMIC); 2663 if (!*perms) 2664 goto out; 2665 2666 if (match->comdatum) { 2667 rc = hashtab_map(match->comdatum->permissions.table, 2668 get_permissions_callback, *perms); 2669 if (rc) 2670 goto err; 2671 } 2672 2673 rc = hashtab_map(match->permissions.table, get_permissions_callback, 2674 *perms); 2675 if (rc) 2676 goto err; 2677 2678out: 2679 read_unlock(&policy_rwlock); 2680 return rc; 2681 2682err: 2683 read_unlock(&policy_rwlock); 2684 for (i = 0; i < *nperms; i++) 2685 kfree((*perms)[i]); 2686 kfree(*perms); 2687 return rc; 2688} 2689 2690int security_get_reject_unknown(void) 2691{ 2692 return policydb.reject_unknown; 2693} 2694 2695int security_get_allow_unknown(void) 2696{ 2697 return policydb.allow_unknown; 2698} 2699 2700/** 2701 * security_policycap_supported - Check for a specific policy capability 2702 * @req_cap: capability 2703 * 2704 * Description: 2705 * This function queries the currently loaded policy to see if it supports the 2706 * capability specified by @req_cap. Returns true (1) if the capability is 2707 * supported, false (0) if it isn't supported. 2708 * 2709 */ 2710int security_policycap_supported(unsigned int req_cap) 2711{ 2712 int rc; 2713 2714 read_lock(&policy_rwlock); 2715 rc = ebitmap_get_bit(&policydb.policycaps, req_cap); 2716 read_unlock(&policy_rwlock); 2717 2718 return rc; 2719} 2720 2721struct selinux_audit_rule { 2722 u32 au_seqno; 2723 struct context au_ctxt; 2724}; 2725 2726void selinux_audit_rule_free(void *vrule) 2727{ 2728 struct selinux_audit_rule *rule = vrule; 2729 2730 if (rule) { 2731 context_destroy(&rule->au_ctxt); 2732 kfree(rule); 2733 } 2734} 2735 2736int selinux_audit_rule_init(u32 field, u32 op, char *rulestr, void **vrule) 2737{ 2738 struct selinux_audit_rule *tmprule; 2739 struct role_datum *roledatum; 2740 struct type_datum *typedatum; 2741 struct user_datum *userdatum; 2742 struct selinux_audit_rule **rule = (struct selinux_audit_rule **)vrule; 2743 int rc = 0; 2744 2745 *rule = NULL; 2746 2747 if (!ss_initialized) 2748 return -EOPNOTSUPP; 2749 2750 switch (field) { 2751 case AUDIT_SUBJ_USER: 2752 case AUDIT_SUBJ_ROLE: 2753 case AUDIT_SUBJ_TYPE: 2754 case AUDIT_OBJ_USER: 2755 case AUDIT_OBJ_ROLE: 2756 case AUDIT_OBJ_TYPE: 2757 /* only 'equals' and 'not equals' fit user, role, and type */ 2758 if (op != Audit_equal && op != Audit_not_equal) 2759 return -EINVAL; 2760 break; 2761 case AUDIT_SUBJ_SEN: 2762 case AUDIT_SUBJ_CLR: 2763 case AUDIT_OBJ_LEV_LOW: 2764 case AUDIT_OBJ_LEV_HIGH: 2765 /* we do not allow a range, indicated by the presense of '-' */ 2766 if (strchr(rulestr, '-')) 2767 return -EINVAL; 2768 break; 2769 default: 2770 /* only the above fields are valid */ 2771 return -EINVAL; 2772 } 2773 2774 tmprule = kzalloc(sizeof(struct selinux_audit_rule), GFP_KERNEL); 2775 if (!tmprule) 2776 return -ENOMEM; 2777 2778 context_init(&tmprule->au_ctxt); 2779 2780 read_lock(&policy_rwlock); 2781 2782 tmprule->au_seqno = latest_granting; 2783 2784 switch (field) { 2785 case AUDIT_SUBJ_USER: 2786 case AUDIT_OBJ_USER: 2787 rc = -EINVAL; 2788 userdatum = hashtab_search(policydb.p_users.table, rulestr); 2789 if (!userdatum) 2790 goto out; 2791 tmprule->au_ctxt.user = userdatum->value; 2792 break; 2793 case AUDIT_SUBJ_ROLE: 2794 case AUDIT_OBJ_ROLE: 2795 rc = -EINVAL; 2796 roledatum = hashtab_search(policydb.p_roles.table, rulestr); 2797 if (!roledatum) 2798 goto out; 2799 tmprule->au_ctxt.role = roledatum->value; 2800 break; 2801 case AUDIT_SUBJ_TYPE: 2802 case AUDIT_OBJ_TYPE: 2803 rc = -EINVAL; 2804 typedatum = hashtab_search(policydb.p_types.table, rulestr); 2805 if (!typedatum) 2806 goto out; 2807 tmprule->au_ctxt.type = typedatum->value; 2808 break; 2809 case AUDIT_SUBJ_SEN: 2810 case AUDIT_SUBJ_CLR: 2811 case AUDIT_OBJ_LEV_LOW: 2812 case AUDIT_OBJ_LEV_HIGH: 2813 rc = mls_from_string(rulestr, &tmprule->au_ctxt, GFP_ATOMIC); 2814 if (rc) 2815 goto out; 2816 break; 2817 } 2818 rc = 0; 2819out: 2820 read_unlock(&policy_rwlock); 2821 2822 if (rc) { 2823 selinux_audit_rule_free(tmprule); 2824 tmprule = NULL; 2825 } 2826 2827 *rule = tmprule; 2828 2829 return rc; 2830} 2831 2832/* Check to see if the rule contains any selinux fields */ 2833int selinux_audit_rule_known(struct audit_krule *rule) 2834{ 2835 int i; 2836 2837 for (i = 0; i < rule->field_count; i++) { 2838 struct audit_field *f = &rule->fields[i]; 2839 switch (f->type) { 2840 case AUDIT_SUBJ_USER: 2841 case AUDIT_SUBJ_ROLE: 2842 case AUDIT_SUBJ_TYPE: 2843 case AUDIT_SUBJ_SEN: 2844 case AUDIT_SUBJ_CLR: 2845 case AUDIT_OBJ_USER: 2846 case AUDIT_OBJ_ROLE: 2847 case AUDIT_OBJ_TYPE: 2848 case AUDIT_OBJ_LEV_LOW: 2849 case AUDIT_OBJ_LEV_HIGH: 2850 return 1; 2851 } 2852 } 2853 2854 return 0; 2855} 2856 2857int selinux_audit_rule_match(u32 sid, u32 field, u32 op, void *vrule, 2858 struct audit_context *actx) 2859{ 2860 struct context *ctxt; 2861 struct mls_level *level; 2862 struct selinux_audit_rule *rule = vrule; 2863 int match = 0; 2864 2865 if (!rule) { 2866 audit_log(actx, GFP_ATOMIC, AUDIT_SELINUX_ERR, 2867 "selinux_audit_rule_match: missing rule\n"); 2868 return -ENOENT; 2869 } 2870 2871 read_lock(&policy_rwlock); 2872 2873 if (rule->au_seqno < latest_granting) { 2874 audit_log(actx, GFP_ATOMIC, AUDIT_SELINUX_ERR, 2875 "selinux_audit_rule_match: stale rule\n"); 2876 match = -ESTALE; 2877 goto out; 2878 } 2879 2880 ctxt = sidtab_search(&sidtab, sid); 2881 if (!ctxt) { 2882 audit_log(actx, GFP_ATOMIC, AUDIT_SELINUX_ERR, 2883 "selinux_audit_rule_match: unrecognized SID %d\n", 2884 sid); 2885 match = -ENOENT; 2886 goto out; 2887 } 2888 2889 /* a field/op pair that is not caught here will simply fall through 2890 without a match */ 2891 switch (field) { 2892 case AUDIT_SUBJ_USER: 2893 case AUDIT_OBJ_USER: 2894 switch (op) { 2895 case Audit_equal: 2896 match = (ctxt->user == rule->au_ctxt.user); 2897 break; 2898 case Audit_not_equal: 2899 match = (ctxt->user != rule->au_ctxt.user); 2900 break; 2901 } 2902 break; 2903 case AUDIT_SUBJ_ROLE: 2904 case AUDIT_OBJ_ROLE: 2905 switch (op) { 2906 case Audit_equal: 2907 match = (ctxt->role == rule->au_ctxt.role); 2908 break; 2909 case Audit_not_equal: 2910 match = (ctxt->role != rule->au_ctxt.role); 2911 break; 2912 } 2913 break; 2914 case AUDIT_SUBJ_TYPE: 2915 case AUDIT_OBJ_TYPE: 2916 switch (op) { 2917 case Audit_equal: 2918 match = (ctxt->type == rule->au_ctxt.type); 2919 break; 2920 case Audit_not_equal: 2921 match = (ctxt->type != rule->au_ctxt.type); 2922 break; 2923 } 2924 break; 2925 case AUDIT_SUBJ_SEN: 2926 case AUDIT_SUBJ_CLR: 2927 case AUDIT_OBJ_LEV_LOW: 2928 case AUDIT_OBJ_LEV_HIGH: 2929 level = ((field == AUDIT_SUBJ_SEN || 2930 field == AUDIT_OBJ_LEV_LOW) ? 2931 &ctxt->range.level[0] : &ctxt->range.level[1]); 2932 switch (op) { 2933 case Audit_equal: 2934 match = mls_level_eq(&rule->au_ctxt.range.level[0], 2935 level); 2936 break; 2937 case Audit_not_equal: 2938 match = !mls_level_eq(&rule->au_ctxt.range.level[0], 2939 level); 2940 break; 2941 case Audit_lt: 2942 match = (mls_level_dom(&rule->au_ctxt.range.level[0], 2943 level) && 2944 !mls_level_eq(&rule->au_ctxt.range.level[0], 2945 level)); 2946 break; 2947 case Audit_le: 2948 match = mls_level_dom(&rule->au_ctxt.range.level[0], 2949 level); 2950 break; 2951 case Audit_gt: 2952 match = (mls_level_dom(level, 2953 &rule->au_ctxt.range.level[0]) && 2954 !mls_level_eq(level, 2955 &rule->au_ctxt.range.level[0])); 2956 break; 2957 case Audit_ge: 2958 match = mls_level_dom(level, 2959 &rule->au_ctxt.range.level[0]); 2960 break; 2961 } 2962 } 2963 2964out: 2965 read_unlock(&policy_rwlock); 2966 return match; 2967} 2968 2969static int (*aurule_callback)(void) = audit_update_lsm_rules; 2970 2971static int aurule_avc_callback(u32 event, u32 ssid, u32 tsid, 2972 u16 class, u32 perms, u32 *retained) 2973{ 2974 int err = 0; 2975 2976 if (event == AVC_CALLBACK_RESET && aurule_callback) 2977 err = aurule_callback(); 2978 return err; 2979} 2980 2981static int __init aurule_init(void) 2982{ 2983 int err; 2984 2985 err = avc_add_callback(aurule_avc_callback, AVC_CALLBACK_RESET, 2986 SECSID_NULL, SECSID_NULL, SECCLASS_NULL, 0); 2987 if (err) 2988 panic("avc_add_callback() failed, error %d\n", err); 2989 2990 return err; 2991} 2992__initcall(aurule_init); 2993 2994#ifdef CONFIG_NETLABEL 2995/** 2996 * security_netlbl_cache_add - Add an entry to the NetLabel cache 2997 * @secattr: the NetLabel packet security attributes 2998 * @sid: the SELinux SID 2999 * 3000 * Description: 3001 * Attempt to cache the context in @ctx, which was derived from the packet in 3002 * @skb, in the NetLabel subsystem cache. This function assumes @secattr has 3003 * already been initialized. 3004 * 3005 */ 3006static void security_netlbl_cache_add(struct netlbl_lsm_secattr *secattr, 3007 u32 sid) 3008{ 3009 u32 *sid_cache; 3010 3011 sid_cache = kmalloc(sizeof(*sid_cache), GFP_ATOMIC); 3012 if (sid_cache == NULL) 3013 return; 3014 secattr->cache = netlbl_secattr_cache_alloc(GFP_ATOMIC); 3015 if (secattr->cache == NULL) { 3016 kfree(sid_cache); 3017 return; 3018 } 3019 3020 *sid_cache = sid; 3021 secattr->cache->free = kfree; 3022 secattr->cache->data = sid_cache; 3023 secattr->flags |= NETLBL_SECATTR_CACHE; 3024} 3025 3026/** 3027 * security_netlbl_secattr_to_sid - Convert a NetLabel secattr to a SELinux SID 3028 * @secattr: the NetLabel packet security attributes 3029 * @sid: the SELinux SID 3030 * 3031 * Description: 3032 * Convert the given NetLabel security attributes in @secattr into a 3033 * SELinux SID. If the @secattr field does not contain a full SELinux 3034 * SID/context then use SECINITSID_NETMSG as the foundation. If possibile the 3035 * 'cache' field of @secattr is set and the CACHE flag is set; this is to 3036 * allow the @secattr to be used by NetLabel to cache the secattr to SID 3037 * conversion for future lookups. Returns zero on success, negative values on 3038 * failure. 3039 * 3040 */ 3041int security_netlbl_secattr_to_sid(struct netlbl_lsm_secattr *secattr, 3042 u32 *sid) 3043{ 3044 int rc; 3045 struct context *ctx; 3046 struct context ctx_new; 3047 3048 if (!ss_initialized) { 3049 *sid = SECSID_NULL; 3050 return 0; 3051 } 3052 3053 read_lock(&policy_rwlock); 3054 3055 if (secattr->flags & NETLBL_SECATTR_CACHE) 3056 *sid = *(u32 *)secattr->cache->data; 3057 else if (secattr->flags & NETLBL_SECATTR_SECID) 3058 *sid = secattr->attr.secid; 3059 else if (secattr->flags & NETLBL_SECATTR_MLS_LVL) { 3060 rc = -EIDRM; 3061 ctx = sidtab_search(&sidtab, SECINITSID_NETMSG); 3062 if (ctx == NULL) 3063 goto out; 3064 3065 context_init(&ctx_new); 3066 ctx_new.user = ctx->user; 3067 ctx_new.role = ctx->role; 3068 ctx_new.type = ctx->type; 3069 mls_import_netlbl_lvl(&ctx_new, secattr); 3070 if (secattr->flags & NETLBL_SECATTR_MLS_CAT) { 3071 rc = ebitmap_netlbl_import(&ctx_new.range.level[0].cat, 3072 secattr->attr.mls.cat); 3073 if (rc) 3074 goto out; 3075 memcpy(&ctx_new.range.level[1].cat, 3076 &ctx_new.range.level[0].cat, 3077 sizeof(ctx_new.range.level[0].cat)); 3078 } 3079 rc = -EIDRM; 3080 if (!mls_context_isvalid(&policydb, &ctx_new)) 3081 goto out_free; 3082 3083 rc = sidtab_context_to_sid(&sidtab, &ctx_new, sid); 3084 if (rc) 3085 goto out_free; 3086 3087 security_netlbl_cache_add(secattr, *sid); 3088 3089 ebitmap_destroy(&ctx_new.range.level[0].cat); 3090 } else 3091 *sid = SECSID_NULL; 3092 3093 read_unlock(&policy_rwlock); 3094 return 0; 3095out_free: 3096 ebitmap_destroy(&ctx_new.range.level[0].cat); 3097out: 3098 read_unlock(&policy_rwlock); 3099 return rc; 3100} 3101 3102/** 3103 * security_netlbl_sid_to_secattr - Convert a SELinux SID to a NetLabel secattr 3104 * @sid: the SELinux SID 3105 * @secattr: the NetLabel packet security attributes 3106 * 3107 * Description: 3108 * Convert the given SELinux SID in @sid into a NetLabel security attribute. 3109 * Returns zero on success, negative values on failure. 3110 * 3111 */ 3112int security_netlbl_sid_to_secattr(u32 sid, struct netlbl_lsm_secattr *secattr) 3113{ 3114 int rc; 3115 struct context *ctx; 3116 3117 if (!ss_initialized) 3118 return 0; 3119 3120 read_lock(&policy_rwlock); 3121 3122 rc = -ENOENT; 3123 ctx = sidtab_search(&sidtab, sid); 3124 if (ctx == NULL) 3125 goto out; 3126 3127 rc = -ENOMEM; 3128 secattr->domain = kstrdup(policydb.p_type_val_to_name[ctx->type - 1], 3129 GFP_ATOMIC); 3130 if (secattr->domain == NULL) 3131 goto out; 3132 3133 secattr->attr.secid = sid; 3134 secattr->flags |= NETLBL_SECATTR_DOMAIN_CPY | NETLBL_SECATTR_SECID; 3135 mls_export_netlbl_lvl(ctx, secattr); 3136 rc = mls_export_netlbl_cat(ctx, secattr); 3137out: 3138 read_unlock(&policy_rwlock); 3139 return rc; 3140} 3141#endif /* CONFIG_NETLABEL */ 3142 3143/** 3144 * security_read_policy - read the policy. 3145 * @data: binary policy data 3146 * @len: length of data in bytes 3147 * 3148 */ 3149int security_read_policy(void **data, ssize_t *len) 3150{ 3151 int rc; 3152 struct policy_file fp; 3153 3154 if (!ss_initialized) 3155 return -EINVAL; 3156 3157 *len = security_policydb_len(); 3158 3159 *data = vmalloc_user(*len); 3160 if (!*data) 3161 return -ENOMEM; 3162 3163 fp.data = *data; 3164 fp.len = *len; 3165 3166 read_lock(&policy_rwlock); 3167 rc = policydb_write(&policydb, &fp); 3168 read_unlock(&policy_rwlock); 3169 3170 if (rc) 3171 return rc; 3172 3173 *len = (unsigned long)fp.data - (unsigned long)*data; 3174 return 0; 3175 3176} 3177