services.c revision eed7795d0a2c9b2e934afc088e903fa2c17b7958
1/* 2 * Implementation of the security services. 3 * 4 * Authors : Stephen Smalley, <sds@epoch.ncsc.mil> 5 * James Morris <jmorris@redhat.com> 6 * 7 * Updated: Trusted Computer Solutions, Inc. <dgoeddel@trustedcs.com> 8 * 9 * Support for enhanced MLS infrastructure. 10 * Support for context based audit filters. 11 * 12 * Updated: Frank Mayer <mayerf@tresys.com> and Karl MacMillan <kmacmillan@tresys.com> 13 * 14 * Added conditional policy language extensions 15 * 16 * Updated: Hewlett-Packard <paul@paul-moore.com> 17 * 18 * Added support for NetLabel 19 * Added support for the policy capability bitmap 20 * 21 * Updated: Chad Sellers <csellers@tresys.com> 22 * 23 * Added validation of kernel classes and permissions 24 * 25 * Updated: KaiGai Kohei <kaigai@ak.jp.nec.com> 26 * 27 * Added support for bounds domain and audit messaged on masked permissions 28 * 29 * Updated: Guido Trentalancia <guido@trentalancia.com> 30 * 31 * Added support for runtime switching of the policy type 32 * 33 * Copyright (C) 2008, 2009 NEC Corporation 34 * Copyright (C) 2006, 2007 Hewlett-Packard Development Company, L.P. 35 * Copyright (C) 2004-2006 Trusted Computer Solutions, Inc. 36 * Copyright (C) 2003 - 2004, 2006 Tresys Technology, LLC 37 * Copyright (C) 2003 Red Hat, Inc., James Morris <jmorris@redhat.com> 38 * This program is free software; you can redistribute it and/or modify 39 * it under the terms of the GNU General Public License as published by 40 * the Free Software Foundation, version 2. 41 */ 42#include <linux/kernel.h> 43#include <linux/slab.h> 44#include <linux/string.h> 45#include <linux/spinlock.h> 46#include <linux/rcupdate.h> 47#include <linux/errno.h> 48#include <linux/in.h> 49#include <linux/sched.h> 50#include <linux/audit.h> 51#include <linux/mutex.h> 52#include <linux/selinux.h> 53#include <linux/flex_array.h> 54#include <linux/vmalloc.h> 55#include <net/netlabel.h> 56 57#include "flask.h" 58#include "avc.h" 59#include "avc_ss.h" 60#include "security.h" 61#include "context.h" 62#include "policydb.h" 63#include "sidtab.h" 64#include "services.h" 65#include "conditional.h" 66#include "mls.h" 67#include "objsec.h" 68#include "netlabel.h" 69#include "xfrm.h" 70#include "ebitmap.h" 71#include "audit.h" 72 73int selinux_policycap_netpeer; 74int selinux_policycap_openperm; 75 76static DEFINE_RWLOCK(policy_rwlock); 77 78static struct sidtab sidtab; 79struct policydb policydb; 80int ss_initialized; 81 82/* 83 * The largest sequence number that has been used when 84 * providing an access decision to the access vector cache. 85 * The sequence number only changes when a policy change 86 * occurs. 87 */ 88static u32 latest_granting; 89 90/* Forward declaration. */ 91static int context_struct_to_string(struct context *context, char **scontext, 92 u32 *scontext_len); 93 94static void context_struct_compute_av(struct context *scontext, 95 struct context *tcontext, 96 u16 tclass, 97 struct av_decision *avd); 98 99struct selinux_mapping { 100 u16 value; /* policy value */ 101 unsigned num_perms; 102 u32 perms[sizeof(u32) * 8]; 103}; 104 105static struct selinux_mapping *current_mapping; 106static u16 current_mapping_size; 107 108static int selinux_set_mapping(struct policydb *pol, 109 struct security_class_mapping *map, 110 struct selinux_mapping **out_map_p, 111 u16 *out_map_size) 112{ 113 struct selinux_mapping *out_map = NULL; 114 size_t size = sizeof(struct selinux_mapping); 115 u16 i, j; 116 unsigned k; 117 bool print_unknown_handle = false; 118 119 /* Find number of classes in the input mapping */ 120 if (!map) 121 return -EINVAL; 122 i = 0; 123 while (map[i].name) 124 i++; 125 126 /* Allocate space for the class records, plus one for class zero */ 127 out_map = kcalloc(++i, size, GFP_ATOMIC); 128 if (!out_map) 129 return -ENOMEM; 130 131 /* Store the raw class and permission values */ 132 j = 0; 133 while (map[j].name) { 134 struct security_class_mapping *p_in = map + (j++); 135 struct selinux_mapping *p_out = out_map + j; 136 137 /* An empty class string skips ahead */ 138 if (!strcmp(p_in->name, "")) { 139 p_out->num_perms = 0; 140 continue; 141 } 142 143 p_out->value = string_to_security_class(pol, p_in->name); 144 if (!p_out->value) { 145 printk(KERN_INFO 146 "SELinux: Class %s not defined in policy.\n", 147 p_in->name); 148 if (pol->reject_unknown) 149 goto err; 150 p_out->num_perms = 0; 151 print_unknown_handle = true; 152 continue; 153 } 154 155 k = 0; 156 while (p_in->perms && p_in->perms[k]) { 157 /* An empty permission string skips ahead */ 158 if (!*p_in->perms[k]) { 159 k++; 160 continue; 161 } 162 p_out->perms[k] = string_to_av_perm(pol, p_out->value, 163 p_in->perms[k]); 164 if (!p_out->perms[k]) { 165 printk(KERN_INFO 166 "SELinux: Permission %s in class %s not defined in policy.\n", 167 p_in->perms[k], p_in->name); 168 if (pol->reject_unknown) 169 goto err; 170 print_unknown_handle = true; 171 } 172 173 k++; 174 } 175 p_out->num_perms = k; 176 } 177 178 if (print_unknown_handle) 179 printk(KERN_INFO "SELinux: the above unknown classes and permissions will be %s\n", 180 pol->allow_unknown ? "allowed" : "denied"); 181 182 *out_map_p = out_map; 183 *out_map_size = i; 184 return 0; 185err: 186 kfree(out_map); 187 return -EINVAL; 188} 189 190/* 191 * Get real, policy values from mapped values 192 */ 193 194static u16 unmap_class(u16 tclass) 195{ 196 if (tclass < current_mapping_size) 197 return current_mapping[tclass].value; 198 199 return tclass; 200} 201 202/* 203 * Get kernel value for class from its policy value 204 */ 205static u16 map_class(u16 pol_value) 206{ 207 u16 i; 208 209 for (i = 1; i < current_mapping_size; i++) { 210 if (current_mapping[i].value == pol_value) 211 return i; 212 } 213 214 return SECCLASS_NULL; 215} 216 217static void map_decision(u16 tclass, struct av_decision *avd, 218 int allow_unknown) 219{ 220 if (tclass < current_mapping_size) { 221 unsigned i, n = current_mapping[tclass].num_perms; 222 u32 result; 223 224 for (i = 0, result = 0; i < n; i++) { 225 if (avd->allowed & current_mapping[tclass].perms[i]) 226 result |= 1<<i; 227 if (allow_unknown && !current_mapping[tclass].perms[i]) 228 result |= 1<<i; 229 } 230 avd->allowed = result; 231 232 for (i = 0, result = 0; i < n; i++) 233 if (avd->auditallow & current_mapping[tclass].perms[i]) 234 result |= 1<<i; 235 avd->auditallow = result; 236 237 for (i = 0, result = 0; i < n; i++) { 238 if (avd->auditdeny & current_mapping[tclass].perms[i]) 239 result |= 1<<i; 240 if (!allow_unknown && !current_mapping[tclass].perms[i]) 241 result |= 1<<i; 242 } 243 /* 244 * In case the kernel has a bug and requests a permission 245 * between num_perms and the maximum permission number, we 246 * should audit that denial 247 */ 248 for (; i < (sizeof(u32)*8); i++) 249 result |= 1<<i; 250 avd->auditdeny = result; 251 } 252} 253 254int security_mls_enabled(void) 255{ 256 return policydb.mls_enabled; 257} 258 259/* 260 * Return the boolean value of a constraint expression 261 * when it is applied to the specified source and target 262 * security contexts. 263 * 264 * xcontext is a special beast... It is used by the validatetrans rules 265 * only. For these rules, scontext is the context before the transition, 266 * tcontext is the context after the transition, and xcontext is the context 267 * of the process performing the transition. All other callers of 268 * constraint_expr_eval should pass in NULL for xcontext. 269 */ 270static int constraint_expr_eval(struct context *scontext, 271 struct context *tcontext, 272 struct context *xcontext, 273 struct constraint_expr *cexpr) 274{ 275 u32 val1, val2; 276 struct context *c; 277 struct role_datum *r1, *r2; 278 struct mls_level *l1, *l2; 279 struct constraint_expr *e; 280 int s[CEXPR_MAXDEPTH]; 281 int sp = -1; 282 283 for (e = cexpr; e; e = e->next) { 284 switch (e->expr_type) { 285 case CEXPR_NOT: 286 BUG_ON(sp < 0); 287 s[sp] = !s[sp]; 288 break; 289 case CEXPR_AND: 290 BUG_ON(sp < 1); 291 sp--; 292 s[sp] &= s[sp + 1]; 293 break; 294 case CEXPR_OR: 295 BUG_ON(sp < 1); 296 sp--; 297 s[sp] |= s[sp + 1]; 298 break; 299 case CEXPR_ATTR: 300 if (sp == (CEXPR_MAXDEPTH - 1)) 301 return 0; 302 switch (e->attr) { 303 case CEXPR_USER: 304 val1 = scontext->user; 305 val2 = tcontext->user; 306 break; 307 case CEXPR_TYPE: 308 val1 = scontext->type; 309 val2 = tcontext->type; 310 break; 311 case CEXPR_ROLE: 312 val1 = scontext->role; 313 val2 = tcontext->role; 314 r1 = policydb.role_val_to_struct[val1 - 1]; 315 r2 = policydb.role_val_to_struct[val2 - 1]; 316 switch (e->op) { 317 case CEXPR_DOM: 318 s[++sp] = ebitmap_get_bit(&r1->dominates, 319 val2 - 1); 320 continue; 321 case CEXPR_DOMBY: 322 s[++sp] = ebitmap_get_bit(&r2->dominates, 323 val1 - 1); 324 continue; 325 case CEXPR_INCOMP: 326 s[++sp] = (!ebitmap_get_bit(&r1->dominates, 327 val2 - 1) && 328 !ebitmap_get_bit(&r2->dominates, 329 val1 - 1)); 330 continue; 331 default: 332 break; 333 } 334 break; 335 case CEXPR_L1L2: 336 l1 = &(scontext->range.level[0]); 337 l2 = &(tcontext->range.level[0]); 338 goto mls_ops; 339 case CEXPR_L1H2: 340 l1 = &(scontext->range.level[0]); 341 l2 = &(tcontext->range.level[1]); 342 goto mls_ops; 343 case CEXPR_H1L2: 344 l1 = &(scontext->range.level[1]); 345 l2 = &(tcontext->range.level[0]); 346 goto mls_ops; 347 case CEXPR_H1H2: 348 l1 = &(scontext->range.level[1]); 349 l2 = &(tcontext->range.level[1]); 350 goto mls_ops; 351 case CEXPR_L1H1: 352 l1 = &(scontext->range.level[0]); 353 l2 = &(scontext->range.level[1]); 354 goto mls_ops; 355 case CEXPR_L2H2: 356 l1 = &(tcontext->range.level[0]); 357 l2 = &(tcontext->range.level[1]); 358 goto mls_ops; 359mls_ops: 360 switch (e->op) { 361 case CEXPR_EQ: 362 s[++sp] = mls_level_eq(l1, l2); 363 continue; 364 case CEXPR_NEQ: 365 s[++sp] = !mls_level_eq(l1, l2); 366 continue; 367 case CEXPR_DOM: 368 s[++sp] = mls_level_dom(l1, l2); 369 continue; 370 case CEXPR_DOMBY: 371 s[++sp] = mls_level_dom(l2, l1); 372 continue; 373 case CEXPR_INCOMP: 374 s[++sp] = mls_level_incomp(l2, l1); 375 continue; 376 default: 377 BUG(); 378 return 0; 379 } 380 break; 381 default: 382 BUG(); 383 return 0; 384 } 385 386 switch (e->op) { 387 case CEXPR_EQ: 388 s[++sp] = (val1 == val2); 389 break; 390 case CEXPR_NEQ: 391 s[++sp] = (val1 != val2); 392 break; 393 default: 394 BUG(); 395 return 0; 396 } 397 break; 398 case CEXPR_NAMES: 399 if (sp == (CEXPR_MAXDEPTH-1)) 400 return 0; 401 c = scontext; 402 if (e->attr & CEXPR_TARGET) 403 c = tcontext; 404 else if (e->attr & CEXPR_XTARGET) { 405 c = xcontext; 406 if (!c) { 407 BUG(); 408 return 0; 409 } 410 } 411 if (e->attr & CEXPR_USER) 412 val1 = c->user; 413 else if (e->attr & CEXPR_ROLE) 414 val1 = c->role; 415 else if (e->attr & CEXPR_TYPE) 416 val1 = c->type; 417 else { 418 BUG(); 419 return 0; 420 } 421 422 switch (e->op) { 423 case CEXPR_EQ: 424 s[++sp] = ebitmap_get_bit(&e->names, val1 - 1); 425 break; 426 case CEXPR_NEQ: 427 s[++sp] = !ebitmap_get_bit(&e->names, val1 - 1); 428 break; 429 default: 430 BUG(); 431 return 0; 432 } 433 break; 434 default: 435 BUG(); 436 return 0; 437 } 438 } 439 440 BUG_ON(sp != 0); 441 return s[0]; 442} 443 444/* 445 * security_dump_masked_av - dumps masked permissions during 446 * security_compute_av due to RBAC, MLS/Constraint and Type bounds. 447 */ 448static int dump_masked_av_helper(void *k, void *d, void *args) 449{ 450 struct perm_datum *pdatum = d; 451 char **permission_names = args; 452 453 BUG_ON(pdatum->value < 1 || pdatum->value > 32); 454 455 permission_names[pdatum->value - 1] = (char *)k; 456 457 return 0; 458} 459 460static void security_dump_masked_av(struct context *scontext, 461 struct context *tcontext, 462 u16 tclass, 463 u32 permissions, 464 const char *reason) 465{ 466 struct common_datum *common_dat; 467 struct class_datum *tclass_dat; 468 struct audit_buffer *ab; 469 char *tclass_name; 470 char *scontext_name = NULL; 471 char *tcontext_name = NULL; 472 char *permission_names[32]; 473 int index; 474 u32 length; 475 bool need_comma = false; 476 477 if (!permissions) 478 return; 479 480 tclass_name = sym_name(&policydb, SYM_CLASSES, tclass - 1); 481 tclass_dat = policydb.class_val_to_struct[tclass - 1]; 482 common_dat = tclass_dat->comdatum; 483 484 /* init permission_names */ 485 if (common_dat && 486 hashtab_map(common_dat->permissions.table, 487 dump_masked_av_helper, permission_names) < 0) 488 goto out; 489 490 if (hashtab_map(tclass_dat->permissions.table, 491 dump_masked_av_helper, permission_names) < 0) 492 goto out; 493 494 /* get scontext/tcontext in text form */ 495 if (context_struct_to_string(scontext, 496 &scontext_name, &length) < 0) 497 goto out; 498 499 if (context_struct_to_string(tcontext, 500 &tcontext_name, &length) < 0) 501 goto out; 502 503 /* audit a message */ 504 ab = audit_log_start(current->audit_context, 505 GFP_ATOMIC, AUDIT_SELINUX_ERR); 506 if (!ab) 507 goto out; 508 509 audit_log_format(ab, "op=security_compute_av reason=%s " 510 "scontext=%s tcontext=%s tclass=%s perms=", 511 reason, scontext_name, tcontext_name, tclass_name); 512 513 for (index = 0; index < 32; index++) { 514 u32 mask = (1 << index); 515 516 if ((mask & permissions) == 0) 517 continue; 518 519 audit_log_format(ab, "%s%s", 520 need_comma ? "," : "", 521 permission_names[index] 522 ? permission_names[index] : "????"); 523 need_comma = true; 524 } 525 audit_log_end(ab); 526out: 527 /* release scontext/tcontext */ 528 kfree(tcontext_name); 529 kfree(scontext_name); 530 531 return; 532} 533 534/* 535 * security_boundary_permission - drops violated permissions 536 * on boundary constraint. 537 */ 538static void type_attribute_bounds_av(struct context *scontext, 539 struct context *tcontext, 540 u16 tclass, 541 struct av_decision *avd) 542{ 543 struct context lo_scontext; 544 struct context lo_tcontext; 545 struct av_decision lo_avd; 546 struct type_datum *source; 547 struct type_datum *target; 548 u32 masked = 0; 549 550 source = flex_array_get_ptr(policydb.type_val_to_struct_array, 551 scontext->type - 1); 552 BUG_ON(!source); 553 554 target = flex_array_get_ptr(policydb.type_val_to_struct_array, 555 tcontext->type - 1); 556 BUG_ON(!target); 557 558 if (source->bounds) { 559 memset(&lo_avd, 0, sizeof(lo_avd)); 560 561 memcpy(&lo_scontext, scontext, sizeof(lo_scontext)); 562 lo_scontext.type = source->bounds; 563 564 context_struct_compute_av(&lo_scontext, 565 tcontext, 566 tclass, 567 &lo_avd); 568 if ((lo_avd.allowed & avd->allowed) == avd->allowed) 569 return; /* no masked permission */ 570 masked = ~lo_avd.allowed & avd->allowed; 571 } 572 573 if (target->bounds) { 574 memset(&lo_avd, 0, sizeof(lo_avd)); 575 576 memcpy(&lo_tcontext, tcontext, sizeof(lo_tcontext)); 577 lo_tcontext.type = target->bounds; 578 579 context_struct_compute_av(scontext, 580 &lo_tcontext, 581 tclass, 582 &lo_avd); 583 if ((lo_avd.allowed & avd->allowed) == avd->allowed) 584 return; /* no masked permission */ 585 masked = ~lo_avd.allowed & avd->allowed; 586 } 587 588 if (source->bounds && target->bounds) { 589 memset(&lo_avd, 0, sizeof(lo_avd)); 590 /* 591 * lo_scontext and lo_tcontext are already 592 * set up. 593 */ 594 595 context_struct_compute_av(&lo_scontext, 596 &lo_tcontext, 597 tclass, 598 &lo_avd); 599 if ((lo_avd.allowed & avd->allowed) == avd->allowed) 600 return; /* no masked permission */ 601 masked = ~lo_avd.allowed & avd->allowed; 602 } 603 604 if (masked) { 605 /* mask violated permissions */ 606 avd->allowed &= ~masked; 607 608 /* audit masked permissions */ 609 security_dump_masked_av(scontext, tcontext, 610 tclass, masked, "bounds"); 611 } 612} 613 614/* 615 * Compute access vectors based on a context structure pair for 616 * the permissions in a particular class. 617 */ 618static void context_struct_compute_av(struct context *scontext, 619 struct context *tcontext, 620 u16 tclass, 621 struct av_decision *avd) 622{ 623 struct constraint_node *constraint; 624 struct role_allow *ra; 625 struct avtab_key avkey; 626 struct avtab_node *node; 627 struct class_datum *tclass_datum; 628 struct ebitmap *sattr, *tattr; 629 struct ebitmap_node *snode, *tnode; 630 unsigned int i, j; 631 632 avd->allowed = 0; 633 avd->auditallow = 0; 634 avd->auditdeny = 0xffffffff; 635 636 if (unlikely(!tclass || tclass > policydb.p_classes.nprim)) { 637 if (printk_ratelimit()) 638 printk(KERN_WARNING "SELinux: Invalid class %hu\n", tclass); 639 return; 640 } 641 642 tclass_datum = policydb.class_val_to_struct[tclass - 1]; 643 644 /* 645 * If a specific type enforcement rule was defined for 646 * this permission check, then use it. 647 */ 648 avkey.target_class = tclass; 649 avkey.specified = AVTAB_AV; 650 sattr = flex_array_get(policydb.type_attr_map_array, scontext->type - 1); 651 BUG_ON(!sattr); 652 tattr = flex_array_get(policydb.type_attr_map_array, tcontext->type - 1); 653 BUG_ON(!tattr); 654 ebitmap_for_each_positive_bit(sattr, snode, i) { 655 ebitmap_for_each_positive_bit(tattr, tnode, j) { 656 avkey.source_type = i + 1; 657 avkey.target_type = j + 1; 658 for (node = avtab_search_node(&policydb.te_avtab, &avkey); 659 node; 660 node = avtab_search_node_next(node, avkey.specified)) { 661 if (node->key.specified == AVTAB_ALLOWED) 662 avd->allowed |= node->datum.data; 663 else if (node->key.specified == AVTAB_AUDITALLOW) 664 avd->auditallow |= node->datum.data; 665 else if (node->key.specified == AVTAB_AUDITDENY) 666 avd->auditdeny &= node->datum.data; 667 } 668 669 /* Check conditional av table for additional permissions */ 670 cond_compute_av(&policydb.te_cond_avtab, &avkey, avd); 671 672 } 673 } 674 675 /* 676 * Remove any permissions prohibited by a constraint (this includes 677 * the MLS policy). 678 */ 679 constraint = tclass_datum->constraints; 680 while (constraint) { 681 if ((constraint->permissions & (avd->allowed)) && 682 !constraint_expr_eval(scontext, tcontext, NULL, 683 constraint->expr)) { 684 avd->allowed &= ~(constraint->permissions); 685 } 686 constraint = constraint->next; 687 } 688 689 /* 690 * If checking process transition permission and the 691 * role is changing, then check the (current_role, new_role) 692 * pair. 693 */ 694 if (tclass == policydb.process_class && 695 (avd->allowed & policydb.process_trans_perms) && 696 scontext->role != tcontext->role) { 697 for (ra = policydb.role_allow; ra; ra = ra->next) { 698 if (scontext->role == ra->role && 699 tcontext->role == ra->new_role) 700 break; 701 } 702 if (!ra) 703 avd->allowed &= ~policydb.process_trans_perms; 704 } 705 706 /* 707 * If the given source and target types have boundary 708 * constraint, lazy checks have to mask any violated 709 * permission and notice it to userspace via audit. 710 */ 711 type_attribute_bounds_av(scontext, tcontext, 712 tclass, avd); 713} 714 715static int security_validtrans_handle_fail(struct context *ocontext, 716 struct context *ncontext, 717 struct context *tcontext, 718 u16 tclass) 719{ 720 char *o = NULL, *n = NULL, *t = NULL; 721 u32 olen, nlen, tlen; 722 723 if (context_struct_to_string(ocontext, &o, &olen)) 724 goto out; 725 if (context_struct_to_string(ncontext, &n, &nlen)) 726 goto out; 727 if (context_struct_to_string(tcontext, &t, &tlen)) 728 goto out; 729 audit_log(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR, 730 "security_validate_transition: denied for" 731 " oldcontext=%s newcontext=%s taskcontext=%s tclass=%s", 732 o, n, t, sym_name(&policydb, SYM_CLASSES, tclass-1)); 733out: 734 kfree(o); 735 kfree(n); 736 kfree(t); 737 738 if (!selinux_enforcing) 739 return 0; 740 return -EPERM; 741} 742 743int security_validate_transition(u32 oldsid, u32 newsid, u32 tasksid, 744 u16 orig_tclass) 745{ 746 struct context *ocontext; 747 struct context *ncontext; 748 struct context *tcontext; 749 struct class_datum *tclass_datum; 750 struct constraint_node *constraint; 751 u16 tclass; 752 int rc = 0; 753 754 if (!ss_initialized) 755 return 0; 756 757 read_lock(&policy_rwlock); 758 759 tclass = unmap_class(orig_tclass); 760 761 if (!tclass || tclass > policydb.p_classes.nprim) { 762 printk(KERN_ERR "SELinux: %s: unrecognized class %d\n", 763 __func__, tclass); 764 rc = -EINVAL; 765 goto out; 766 } 767 tclass_datum = policydb.class_val_to_struct[tclass - 1]; 768 769 ocontext = sidtab_search(&sidtab, oldsid); 770 if (!ocontext) { 771 printk(KERN_ERR "SELinux: %s: unrecognized SID %d\n", 772 __func__, oldsid); 773 rc = -EINVAL; 774 goto out; 775 } 776 777 ncontext = sidtab_search(&sidtab, newsid); 778 if (!ncontext) { 779 printk(KERN_ERR "SELinux: %s: unrecognized SID %d\n", 780 __func__, newsid); 781 rc = -EINVAL; 782 goto out; 783 } 784 785 tcontext = sidtab_search(&sidtab, tasksid); 786 if (!tcontext) { 787 printk(KERN_ERR "SELinux: %s: unrecognized SID %d\n", 788 __func__, tasksid); 789 rc = -EINVAL; 790 goto out; 791 } 792 793 constraint = tclass_datum->validatetrans; 794 while (constraint) { 795 if (!constraint_expr_eval(ocontext, ncontext, tcontext, 796 constraint->expr)) { 797 rc = security_validtrans_handle_fail(ocontext, ncontext, 798 tcontext, tclass); 799 goto out; 800 } 801 constraint = constraint->next; 802 } 803 804out: 805 read_unlock(&policy_rwlock); 806 return rc; 807} 808 809/* 810 * security_bounded_transition - check whether the given 811 * transition is directed to bounded, or not. 812 * It returns 0, if @newsid is bounded by @oldsid. 813 * Otherwise, it returns error code. 814 * 815 * @oldsid : current security identifier 816 * @newsid : destinated security identifier 817 */ 818int security_bounded_transition(u32 old_sid, u32 new_sid) 819{ 820 struct context *old_context, *new_context; 821 struct type_datum *type; 822 int index; 823 int rc; 824 825 read_lock(&policy_rwlock); 826 827 rc = -EINVAL; 828 old_context = sidtab_search(&sidtab, old_sid); 829 if (!old_context) { 830 printk(KERN_ERR "SELinux: %s: unrecognized SID %u\n", 831 __func__, old_sid); 832 goto out; 833 } 834 835 rc = -EINVAL; 836 new_context = sidtab_search(&sidtab, new_sid); 837 if (!new_context) { 838 printk(KERN_ERR "SELinux: %s: unrecognized SID %u\n", 839 __func__, new_sid); 840 goto out; 841 } 842 843 rc = 0; 844 /* type/domain unchanged */ 845 if (old_context->type == new_context->type) 846 goto out; 847 848 index = new_context->type; 849 while (true) { 850 type = flex_array_get_ptr(policydb.type_val_to_struct_array, 851 index - 1); 852 BUG_ON(!type); 853 854 /* not bounded anymore */ 855 rc = -EPERM; 856 if (!type->bounds) 857 break; 858 859 /* @newsid is bounded by @oldsid */ 860 rc = 0; 861 if (type->bounds == old_context->type) 862 break; 863 864 index = type->bounds; 865 } 866 867 if (rc) { 868 char *old_name = NULL; 869 char *new_name = NULL; 870 u32 length; 871 872 if (!context_struct_to_string(old_context, 873 &old_name, &length) && 874 !context_struct_to_string(new_context, 875 &new_name, &length)) { 876 audit_log(current->audit_context, 877 GFP_ATOMIC, AUDIT_SELINUX_ERR, 878 "op=security_bounded_transition " 879 "result=denied " 880 "oldcontext=%s newcontext=%s", 881 old_name, new_name); 882 } 883 kfree(new_name); 884 kfree(old_name); 885 } 886out: 887 read_unlock(&policy_rwlock); 888 889 return rc; 890} 891 892static void avd_init(struct av_decision *avd) 893{ 894 avd->allowed = 0; 895 avd->auditallow = 0; 896 avd->auditdeny = 0xffffffff; 897 avd->seqno = latest_granting; 898 avd->flags = 0; 899} 900 901 902/** 903 * security_compute_av - Compute access vector decisions. 904 * @ssid: source security identifier 905 * @tsid: target security identifier 906 * @tclass: target security class 907 * @avd: access vector decisions 908 * 909 * Compute a set of access vector decisions based on the 910 * SID pair (@ssid, @tsid) for the permissions in @tclass. 911 */ 912void security_compute_av(u32 ssid, 913 u32 tsid, 914 u16 orig_tclass, 915 struct av_decision *avd) 916{ 917 u16 tclass; 918 struct context *scontext = NULL, *tcontext = NULL; 919 920 read_lock(&policy_rwlock); 921 avd_init(avd); 922 if (!ss_initialized) 923 goto allow; 924 925 scontext = sidtab_search(&sidtab, ssid); 926 if (!scontext) { 927 printk(KERN_ERR "SELinux: %s: unrecognized SID %d\n", 928 __func__, ssid); 929 goto out; 930 } 931 932 /* permissive domain? */ 933 if (ebitmap_get_bit(&policydb.permissive_map, scontext->type)) 934 avd->flags |= AVD_FLAGS_PERMISSIVE; 935 936 tcontext = sidtab_search(&sidtab, tsid); 937 if (!tcontext) { 938 printk(KERN_ERR "SELinux: %s: unrecognized SID %d\n", 939 __func__, tsid); 940 goto out; 941 } 942 943 tclass = unmap_class(orig_tclass); 944 if (unlikely(orig_tclass && !tclass)) { 945 if (policydb.allow_unknown) 946 goto allow; 947 goto out; 948 } 949 context_struct_compute_av(scontext, tcontext, tclass, avd); 950 map_decision(orig_tclass, avd, policydb.allow_unknown); 951out: 952 read_unlock(&policy_rwlock); 953 return; 954allow: 955 avd->allowed = 0xffffffff; 956 goto out; 957} 958 959void security_compute_av_user(u32 ssid, 960 u32 tsid, 961 u16 tclass, 962 struct av_decision *avd) 963{ 964 struct context *scontext = NULL, *tcontext = NULL; 965 966 read_lock(&policy_rwlock); 967 avd_init(avd); 968 if (!ss_initialized) 969 goto allow; 970 971 scontext = sidtab_search(&sidtab, ssid); 972 if (!scontext) { 973 printk(KERN_ERR "SELinux: %s: unrecognized SID %d\n", 974 __func__, ssid); 975 goto out; 976 } 977 978 /* permissive domain? */ 979 if (ebitmap_get_bit(&policydb.permissive_map, scontext->type)) 980 avd->flags |= AVD_FLAGS_PERMISSIVE; 981 982 tcontext = sidtab_search(&sidtab, tsid); 983 if (!tcontext) { 984 printk(KERN_ERR "SELinux: %s: unrecognized SID %d\n", 985 __func__, tsid); 986 goto out; 987 } 988 989 if (unlikely(!tclass)) { 990 if (policydb.allow_unknown) 991 goto allow; 992 goto out; 993 } 994 995 context_struct_compute_av(scontext, tcontext, tclass, avd); 996 out: 997 read_unlock(&policy_rwlock); 998 return; 999allow: 1000 avd->allowed = 0xffffffff; 1001 goto out; 1002} 1003 1004/* 1005 * Write the security context string representation of 1006 * the context structure `context' into a dynamically 1007 * allocated string of the correct size. Set `*scontext' 1008 * to point to this string and set `*scontext_len' to 1009 * the length of the string. 1010 */ 1011static int context_struct_to_string(struct context *context, char **scontext, u32 *scontext_len) 1012{ 1013 char *scontextp; 1014 1015 if (scontext) 1016 *scontext = NULL; 1017 *scontext_len = 0; 1018 1019 if (context->len) { 1020 *scontext_len = context->len; 1021 *scontext = kstrdup(context->str, GFP_ATOMIC); 1022 if (!(*scontext)) 1023 return -ENOMEM; 1024 return 0; 1025 } 1026 1027 /* Compute the size of the context. */ 1028 *scontext_len += strlen(sym_name(&policydb, SYM_USERS, context->user - 1)) + 1; 1029 *scontext_len += strlen(sym_name(&policydb, SYM_ROLES, context->role - 1)) + 1; 1030 *scontext_len += strlen(sym_name(&policydb, SYM_TYPES, context->type - 1)) + 1; 1031 *scontext_len += mls_compute_context_len(context); 1032 1033 if (!scontext) 1034 return 0; 1035 1036 /* Allocate space for the context; caller must free this space. */ 1037 scontextp = kmalloc(*scontext_len, GFP_ATOMIC); 1038 if (!scontextp) 1039 return -ENOMEM; 1040 *scontext = scontextp; 1041 1042 /* 1043 * Copy the user name, role name and type name into the context. 1044 */ 1045 sprintf(scontextp, "%s:%s:%s", 1046 sym_name(&policydb, SYM_USERS, context->user - 1), 1047 sym_name(&policydb, SYM_ROLES, context->role - 1), 1048 sym_name(&policydb, SYM_TYPES, context->type - 1)); 1049 scontextp += strlen(sym_name(&policydb, SYM_USERS, context->user - 1)) + 1050 1 + strlen(sym_name(&policydb, SYM_ROLES, context->role - 1)) + 1051 1 + strlen(sym_name(&policydb, SYM_TYPES, context->type - 1)); 1052 1053 mls_sid_to_context(context, &scontextp); 1054 1055 *scontextp = 0; 1056 1057 return 0; 1058} 1059 1060#include "initial_sid_to_string.h" 1061 1062const char *security_get_initial_sid_context(u32 sid) 1063{ 1064 if (unlikely(sid > SECINITSID_NUM)) 1065 return NULL; 1066 return initial_sid_to_string[sid]; 1067} 1068 1069static int security_sid_to_context_core(u32 sid, char **scontext, 1070 u32 *scontext_len, int force) 1071{ 1072 struct context *context; 1073 int rc = 0; 1074 1075 if (scontext) 1076 *scontext = NULL; 1077 *scontext_len = 0; 1078 1079 if (!ss_initialized) { 1080 if (sid <= SECINITSID_NUM) { 1081 char *scontextp; 1082 1083 *scontext_len = strlen(initial_sid_to_string[sid]) + 1; 1084 if (!scontext) 1085 goto out; 1086 scontextp = kmalloc(*scontext_len, GFP_ATOMIC); 1087 if (!scontextp) { 1088 rc = -ENOMEM; 1089 goto out; 1090 } 1091 strcpy(scontextp, initial_sid_to_string[sid]); 1092 *scontext = scontextp; 1093 goto out; 1094 } 1095 printk(KERN_ERR "SELinux: %s: called before initial " 1096 "load_policy on unknown SID %d\n", __func__, sid); 1097 rc = -EINVAL; 1098 goto out; 1099 } 1100 read_lock(&policy_rwlock); 1101 if (force) 1102 context = sidtab_search_force(&sidtab, sid); 1103 else 1104 context = sidtab_search(&sidtab, sid); 1105 if (!context) { 1106 printk(KERN_ERR "SELinux: %s: unrecognized SID %d\n", 1107 __func__, sid); 1108 rc = -EINVAL; 1109 goto out_unlock; 1110 } 1111 rc = context_struct_to_string(context, scontext, scontext_len); 1112out_unlock: 1113 read_unlock(&policy_rwlock); 1114out: 1115 return rc; 1116 1117} 1118 1119/** 1120 * security_sid_to_context - Obtain a context for a given SID. 1121 * @sid: security identifier, SID 1122 * @scontext: security context 1123 * @scontext_len: length in bytes 1124 * 1125 * Write the string representation of the context associated with @sid 1126 * into a dynamically allocated string of the correct size. Set @scontext 1127 * to point to this string and set @scontext_len to the length of the string. 1128 */ 1129int security_sid_to_context(u32 sid, char **scontext, u32 *scontext_len) 1130{ 1131 return security_sid_to_context_core(sid, scontext, scontext_len, 0); 1132} 1133 1134int security_sid_to_context_force(u32 sid, char **scontext, u32 *scontext_len) 1135{ 1136 return security_sid_to_context_core(sid, scontext, scontext_len, 1); 1137} 1138 1139/* 1140 * Caveat: Mutates scontext. 1141 */ 1142static int string_to_context_struct(struct policydb *pol, 1143 struct sidtab *sidtabp, 1144 char *scontext, 1145 u32 scontext_len, 1146 struct context *ctx, 1147 u32 def_sid) 1148{ 1149 struct role_datum *role; 1150 struct type_datum *typdatum; 1151 struct user_datum *usrdatum; 1152 char *scontextp, *p, oldc; 1153 int rc = 0; 1154 1155 context_init(ctx); 1156 1157 /* Parse the security context. */ 1158 1159 rc = -EINVAL; 1160 scontextp = (char *) scontext; 1161 1162 /* Extract the user. */ 1163 p = scontextp; 1164 while (*p && *p != ':') 1165 p++; 1166 1167 if (*p == 0) 1168 goto out; 1169 1170 *p++ = 0; 1171 1172 usrdatum = hashtab_search(pol->p_users.table, scontextp); 1173 if (!usrdatum) 1174 goto out; 1175 1176 ctx->user = usrdatum->value; 1177 1178 /* Extract role. */ 1179 scontextp = p; 1180 while (*p && *p != ':') 1181 p++; 1182 1183 if (*p == 0) 1184 goto out; 1185 1186 *p++ = 0; 1187 1188 role = hashtab_search(pol->p_roles.table, scontextp); 1189 if (!role) 1190 goto out; 1191 ctx->role = role->value; 1192 1193 /* Extract type. */ 1194 scontextp = p; 1195 while (*p && *p != ':') 1196 p++; 1197 oldc = *p; 1198 *p++ = 0; 1199 1200 typdatum = hashtab_search(pol->p_types.table, scontextp); 1201 if (!typdatum || typdatum->attribute) 1202 goto out; 1203 1204 ctx->type = typdatum->value; 1205 1206 rc = mls_context_to_sid(pol, oldc, &p, ctx, sidtabp, def_sid); 1207 if (rc) 1208 goto out; 1209 1210 rc = -EINVAL; 1211 if ((p - scontext) < scontext_len) 1212 goto out; 1213 1214 /* Check the validity of the new context. */ 1215 if (!policydb_context_isvalid(pol, ctx)) 1216 goto out; 1217 rc = 0; 1218out: 1219 if (rc) 1220 context_destroy(ctx); 1221 return rc; 1222} 1223 1224static int security_context_to_sid_core(const char *scontext, u32 scontext_len, 1225 u32 *sid, u32 def_sid, gfp_t gfp_flags, 1226 int force) 1227{ 1228 char *scontext2, *str = NULL; 1229 struct context context; 1230 int rc = 0; 1231 1232 if (!ss_initialized) { 1233 int i; 1234 1235 for (i = 1; i < SECINITSID_NUM; i++) { 1236 if (!strcmp(initial_sid_to_string[i], scontext)) { 1237 *sid = i; 1238 return 0; 1239 } 1240 } 1241 *sid = SECINITSID_KERNEL; 1242 return 0; 1243 } 1244 *sid = SECSID_NULL; 1245 1246 /* Copy the string so that we can modify the copy as we parse it. */ 1247 scontext2 = kmalloc(scontext_len + 1, gfp_flags); 1248 if (!scontext2) 1249 return -ENOMEM; 1250 memcpy(scontext2, scontext, scontext_len); 1251 scontext2[scontext_len] = 0; 1252 1253 if (force) { 1254 /* Save another copy for storing in uninterpreted form */ 1255 rc = -ENOMEM; 1256 str = kstrdup(scontext2, gfp_flags); 1257 if (!str) 1258 goto out; 1259 } 1260 1261 read_lock(&policy_rwlock); 1262 rc = string_to_context_struct(&policydb, &sidtab, scontext2, 1263 scontext_len, &context, def_sid); 1264 if (rc == -EINVAL && force) { 1265 context.str = str; 1266 context.len = scontext_len; 1267 str = NULL; 1268 } else if (rc) 1269 goto out_unlock; 1270 rc = sidtab_context_to_sid(&sidtab, &context, sid); 1271 context_destroy(&context); 1272out_unlock: 1273 read_unlock(&policy_rwlock); 1274out: 1275 kfree(scontext2); 1276 kfree(str); 1277 return rc; 1278} 1279 1280/** 1281 * security_context_to_sid - Obtain a SID for a given security context. 1282 * @scontext: security context 1283 * @scontext_len: length in bytes 1284 * @sid: security identifier, SID 1285 * 1286 * Obtains a SID associated with the security context that 1287 * has the string representation specified by @scontext. 1288 * Returns -%EINVAL if the context is invalid, -%ENOMEM if insufficient 1289 * memory is available, or 0 on success. 1290 */ 1291int security_context_to_sid(const char *scontext, u32 scontext_len, u32 *sid) 1292{ 1293 return security_context_to_sid_core(scontext, scontext_len, 1294 sid, SECSID_NULL, GFP_KERNEL, 0); 1295} 1296 1297/** 1298 * security_context_to_sid_default - Obtain a SID for a given security context, 1299 * falling back to specified default if needed. 1300 * 1301 * @scontext: security context 1302 * @scontext_len: length in bytes 1303 * @sid: security identifier, SID 1304 * @def_sid: default SID to assign on error 1305 * 1306 * Obtains a SID associated with the security context that 1307 * has the string representation specified by @scontext. 1308 * The default SID is passed to the MLS layer to be used to allow 1309 * kernel labeling of the MLS field if the MLS field is not present 1310 * (for upgrading to MLS without full relabel). 1311 * Implicitly forces adding of the context even if it cannot be mapped yet. 1312 * Returns -%EINVAL if the context is invalid, -%ENOMEM if insufficient 1313 * memory is available, or 0 on success. 1314 */ 1315int security_context_to_sid_default(const char *scontext, u32 scontext_len, 1316 u32 *sid, u32 def_sid, gfp_t gfp_flags) 1317{ 1318 return security_context_to_sid_core(scontext, scontext_len, 1319 sid, def_sid, gfp_flags, 1); 1320} 1321 1322int security_context_to_sid_force(const char *scontext, u32 scontext_len, 1323 u32 *sid) 1324{ 1325 return security_context_to_sid_core(scontext, scontext_len, 1326 sid, SECSID_NULL, GFP_KERNEL, 1); 1327} 1328 1329static int compute_sid_handle_invalid_context( 1330 struct context *scontext, 1331 struct context *tcontext, 1332 u16 tclass, 1333 struct context *newcontext) 1334{ 1335 char *s = NULL, *t = NULL, *n = NULL; 1336 u32 slen, tlen, nlen; 1337 1338 if (context_struct_to_string(scontext, &s, &slen)) 1339 goto out; 1340 if (context_struct_to_string(tcontext, &t, &tlen)) 1341 goto out; 1342 if (context_struct_to_string(newcontext, &n, &nlen)) 1343 goto out; 1344 audit_log(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR, 1345 "security_compute_sid: invalid context %s" 1346 " for scontext=%s" 1347 " tcontext=%s" 1348 " tclass=%s", 1349 n, s, t, sym_name(&policydb, SYM_CLASSES, tclass-1)); 1350out: 1351 kfree(s); 1352 kfree(t); 1353 kfree(n); 1354 if (!selinux_enforcing) 1355 return 0; 1356 return -EACCES; 1357} 1358 1359static void filename_compute_type(struct policydb *p, struct context *newcontext, 1360 u32 stype, u32 ttype, u16 tclass, 1361 const char *objname) 1362{ 1363 struct filename_trans ft; 1364 struct filename_trans_datum *otype; 1365 1366 /* 1367 * Most filename trans rules are going to live in specific directories 1368 * like /dev or /var/run. This bitmap will quickly skip rule searches 1369 * if the ttype does not contain any rules. 1370 */ 1371 if (!ebitmap_get_bit(&p->filename_trans_ttypes, ttype)) 1372 return; 1373 1374 ft.stype = stype; 1375 ft.ttype = ttype; 1376 ft.tclass = tclass; 1377 ft.name = objname; 1378 1379 otype = hashtab_search(p->filename_trans, &ft); 1380 if (otype) 1381 newcontext->type = otype->otype; 1382} 1383 1384static int security_compute_sid(u32 ssid, 1385 u32 tsid, 1386 u16 orig_tclass, 1387 u32 specified, 1388 const char *objname, 1389 u32 *out_sid, 1390 bool kern) 1391{ 1392 struct class_datum *cladatum = NULL; 1393 struct context *scontext = NULL, *tcontext = NULL, newcontext; 1394 struct role_trans *roletr = NULL; 1395 struct avtab_key avkey; 1396 struct avtab_datum *avdatum; 1397 struct avtab_node *node; 1398 u16 tclass; 1399 int rc = 0; 1400 bool sock; 1401 1402 if (!ss_initialized) { 1403 switch (orig_tclass) { 1404 case SECCLASS_PROCESS: /* kernel value */ 1405 *out_sid = ssid; 1406 break; 1407 default: 1408 *out_sid = tsid; 1409 break; 1410 } 1411 goto out; 1412 } 1413 1414 context_init(&newcontext); 1415 1416 read_lock(&policy_rwlock); 1417 1418 if (kern) { 1419 tclass = unmap_class(orig_tclass); 1420 sock = security_is_socket_class(orig_tclass); 1421 } else { 1422 tclass = orig_tclass; 1423 sock = security_is_socket_class(map_class(tclass)); 1424 } 1425 1426 scontext = sidtab_search(&sidtab, ssid); 1427 if (!scontext) { 1428 printk(KERN_ERR "SELinux: %s: unrecognized SID %d\n", 1429 __func__, ssid); 1430 rc = -EINVAL; 1431 goto out_unlock; 1432 } 1433 tcontext = sidtab_search(&sidtab, tsid); 1434 if (!tcontext) { 1435 printk(KERN_ERR "SELinux: %s: unrecognized SID %d\n", 1436 __func__, tsid); 1437 rc = -EINVAL; 1438 goto out_unlock; 1439 } 1440 1441 if (tclass && tclass <= policydb.p_classes.nprim) 1442 cladatum = policydb.class_val_to_struct[tclass - 1]; 1443 1444 /* Set the user identity. */ 1445 switch (specified) { 1446 case AVTAB_TRANSITION: 1447 case AVTAB_CHANGE: 1448 if (cladatum && cladatum->default_user == DEFAULT_TARGET) { 1449 newcontext.user = tcontext->user; 1450 } else { 1451 /* notice this gets both DEFAULT_SOURCE and unset */ 1452 /* Use the process user identity. */ 1453 newcontext.user = scontext->user; 1454 } 1455 break; 1456 case AVTAB_MEMBER: 1457 /* Use the related object owner. */ 1458 newcontext.user = tcontext->user; 1459 break; 1460 } 1461 1462 /* Set the role to default values. */ 1463 if (cladatum && cladatum->default_role == DEFAULT_SOURCE) { 1464 newcontext.role = scontext->role; 1465 } else if (cladatum && cladatum->default_role == DEFAULT_TARGET) { 1466 newcontext.role = tcontext->role; 1467 } else { 1468 if ((tclass == policydb.process_class) || (sock == true)) 1469 newcontext.role = scontext->role; 1470 else 1471 newcontext.role = OBJECT_R_VAL; 1472 } 1473 1474 /* Set the type to default values. */ 1475 if (cladatum && cladatum->default_type == DEFAULT_SOURCE) { 1476 newcontext.type = scontext->type; 1477 } else if (cladatum && cladatum->default_type == DEFAULT_TARGET) { 1478 newcontext.type = tcontext->type; 1479 } else { 1480 if ((tclass == policydb.process_class) || (sock == true)) { 1481 /* Use the type of process. */ 1482 newcontext.type = scontext->type; 1483 } else { 1484 /* Use the type of the related object. */ 1485 newcontext.type = tcontext->type; 1486 } 1487 } 1488 1489 /* Look for a type transition/member/change rule. */ 1490 avkey.source_type = scontext->type; 1491 avkey.target_type = tcontext->type; 1492 avkey.target_class = tclass; 1493 avkey.specified = specified; 1494 avdatum = avtab_search(&policydb.te_avtab, &avkey); 1495 1496 /* If no permanent rule, also check for enabled conditional rules */ 1497 if (!avdatum) { 1498 node = avtab_search_node(&policydb.te_cond_avtab, &avkey); 1499 for (; node; node = avtab_search_node_next(node, specified)) { 1500 if (node->key.specified & AVTAB_ENABLED) { 1501 avdatum = &node->datum; 1502 break; 1503 } 1504 } 1505 } 1506 1507 if (avdatum) { 1508 /* Use the type from the type transition/member/change rule. */ 1509 newcontext.type = avdatum->data; 1510 } 1511 1512 /* if we have a objname this is a file trans check so check those rules */ 1513 if (objname) 1514 filename_compute_type(&policydb, &newcontext, scontext->type, 1515 tcontext->type, tclass, objname); 1516 1517 /* Check for class-specific changes. */ 1518 if (specified & AVTAB_TRANSITION) { 1519 /* Look for a role transition rule. */ 1520 for (roletr = policydb.role_tr; roletr; roletr = roletr->next) { 1521 if ((roletr->role == scontext->role) && 1522 (roletr->type == tcontext->type) && 1523 (roletr->tclass == tclass)) { 1524 /* Use the role transition rule. */ 1525 newcontext.role = roletr->new_role; 1526 break; 1527 } 1528 } 1529 } 1530 1531 /* Set the MLS attributes. 1532 This is done last because it may allocate memory. */ 1533 rc = mls_compute_sid(scontext, tcontext, tclass, specified, 1534 &newcontext, sock); 1535 if (rc) 1536 goto out_unlock; 1537 1538 /* Check the validity of the context. */ 1539 if (!policydb_context_isvalid(&policydb, &newcontext)) { 1540 rc = compute_sid_handle_invalid_context(scontext, 1541 tcontext, 1542 tclass, 1543 &newcontext); 1544 if (rc) 1545 goto out_unlock; 1546 } 1547 /* Obtain the sid for the context. */ 1548 rc = sidtab_context_to_sid(&sidtab, &newcontext, out_sid); 1549out_unlock: 1550 read_unlock(&policy_rwlock); 1551 context_destroy(&newcontext); 1552out: 1553 return rc; 1554} 1555 1556/** 1557 * security_transition_sid - Compute the SID for a new subject/object. 1558 * @ssid: source security identifier 1559 * @tsid: target security identifier 1560 * @tclass: target security class 1561 * @out_sid: security identifier for new subject/object 1562 * 1563 * Compute a SID to use for labeling a new subject or object in the 1564 * class @tclass based on a SID pair (@ssid, @tsid). 1565 * Return -%EINVAL if any of the parameters are invalid, -%ENOMEM 1566 * if insufficient memory is available, or %0 if the new SID was 1567 * computed successfully. 1568 */ 1569int security_transition_sid(u32 ssid, u32 tsid, u16 tclass, 1570 const struct qstr *qstr, u32 *out_sid) 1571{ 1572 return security_compute_sid(ssid, tsid, tclass, AVTAB_TRANSITION, 1573 qstr ? qstr->name : NULL, out_sid, true); 1574} 1575 1576int security_transition_sid_user(u32 ssid, u32 tsid, u16 tclass, 1577 const char *objname, u32 *out_sid) 1578{ 1579 return security_compute_sid(ssid, tsid, tclass, AVTAB_TRANSITION, 1580 objname, out_sid, false); 1581} 1582 1583/** 1584 * security_member_sid - Compute the SID for member selection. 1585 * @ssid: source security identifier 1586 * @tsid: target security identifier 1587 * @tclass: target security class 1588 * @out_sid: security identifier for selected member 1589 * 1590 * Compute a SID to use when selecting a member of a polyinstantiated 1591 * object of class @tclass based on a SID pair (@ssid, @tsid). 1592 * Return -%EINVAL if any of the parameters are invalid, -%ENOMEM 1593 * if insufficient memory is available, or %0 if the SID was 1594 * computed successfully. 1595 */ 1596int security_member_sid(u32 ssid, 1597 u32 tsid, 1598 u16 tclass, 1599 u32 *out_sid) 1600{ 1601 return security_compute_sid(ssid, tsid, tclass, AVTAB_MEMBER, NULL, 1602 out_sid, false); 1603} 1604 1605/** 1606 * security_change_sid - Compute the SID for object relabeling. 1607 * @ssid: source security identifier 1608 * @tsid: target security identifier 1609 * @tclass: target security class 1610 * @out_sid: security identifier for selected member 1611 * 1612 * Compute a SID to use for relabeling an object of class @tclass 1613 * based on a SID pair (@ssid, @tsid). 1614 * Return -%EINVAL if any of the parameters are invalid, -%ENOMEM 1615 * if insufficient memory is available, or %0 if the SID was 1616 * computed successfully. 1617 */ 1618int security_change_sid(u32 ssid, 1619 u32 tsid, 1620 u16 tclass, 1621 u32 *out_sid) 1622{ 1623 return security_compute_sid(ssid, tsid, tclass, AVTAB_CHANGE, NULL, 1624 out_sid, false); 1625} 1626 1627/* Clone the SID into the new SID table. */ 1628static int clone_sid(u32 sid, 1629 struct context *context, 1630 void *arg) 1631{ 1632 struct sidtab *s = arg; 1633 1634 if (sid > SECINITSID_NUM) 1635 return sidtab_insert(s, sid, context); 1636 else 1637 return 0; 1638} 1639 1640static inline int convert_context_handle_invalid_context(struct context *context) 1641{ 1642 char *s; 1643 u32 len; 1644 1645 if (selinux_enforcing) 1646 return -EINVAL; 1647 1648 if (!context_struct_to_string(context, &s, &len)) { 1649 printk(KERN_WARNING "SELinux: Context %s would be invalid if enforcing\n", s); 1650 kfree(s); 1651 } 1652 return 0; 1653} 1654 1655struct convert_context_args { 1656 struct policydb *oldp; 1657 struct policydb *newp; 1658}; 1659 1660/* 1661 * Convert the values in the security context 1662 * structure `c' from the values specified 1663 * in the policy `p->oldp' to the values specified 1664 * in the policy `p->newp'. Verify that the 1665 * context is valid under the new policy. 1666 */ 1667static int convert_context(u32 key, 1668 struct context *c, 1669 void *p) 1670{ 1671 struct convert_context_args *args; 1672 struct context oldc; 1673 struct ocontext *oc; 1674 struct mls_range *range; 1675 struct role_datum *role; 1676 struct type_datum *typdatum; 1677 struct user_datum *usrdatum; 1678 char *s; 1679 u32 len; 1680 int rc = 0; 1681 1682 if (key <= SECINITSID_NUM) 1683 goto out; 1684 1685 args = p; 1686 1687 if (c->str) { 1688 struct context ctx; 1689 1690 rc = -ENOMEM; 1691 s = kstrdup(c->str, GFP_KERNEL); 1692 if (!s) 1693 goto out; 1694 1695 rc = string_to_context_struct(args->newp, NULL, s, 1696 c->len, &ctx, SECSID_NULL); 1697 kfree(s); 1698 if (!rc) { 1699 printk(KERN_INFO "SELinux: Context %s became valid (mapped).\n", 1700 c->str); 1701 /* Replace string with mapped representation. */ 1702 kfree(c->str); 1703 memcpy(c, &ctx, sizeof(*c)); 1704 goto out; 1705 } else if (rc == -EINVAL) { 1706 /* Retain string representation for later mapping. */ 1707 rc = 0; 1708 goto out; 1709 } else { 1710 /* Other error condition, e.g. ENOMEM. */ 1711 printk(KERN_ERR "SELinux: Unable to map context %s, rc = %d.\n", 1712 c->str, -rc); 1713 goto out; 1714 } 1715 } 1716 1717 rc = context_cpy(&oldc, c); 1718 if (rc) 1719 goto out; 1720 1721 /* Convert the user. */ 1722 rc = -EINVAL; 1723 usrdatum = hashtab_search(args->newp->p_users.table, 1724 sym_name(args->oldp, SYM_USERS, c->user - 1)); 1725 if (!usrdatum) 1726 goto bad; 1727 c->user = usrdatum->value; 1728 1729 /* Convert the role. */ 1730 rc = -EINVAL; 1731 role = hashtab_search(args->newp->p_roles.table, 1732 sym_name(args->oldp, SYM_ROLES, c->role - 1)); 1733 if (!role) 1734 goto bad; 1735 c->role = role->value; 1736 1737 /* Convert the type. */ 1738 rc = -EINVAL; 1739 typdatum = hashtab_search(args->newp->p_types.table, 1740 sym_name(args->oldp, SYM_TYPES, c->type - 1)); 1741 if (!typdatum) 1742 goto bad; 1743 c->type = typdatum->value; 1744 1745 /* Convert the MLS fields if dealing with MLS policies */ 1746 if (args->oldp->mls_enabled && args->newp->mls_enabled) { 1747 rc = mls_convert_context(args->oldp, args->newp, c); 1748 if (rc) 1749 goto bad; 1750 } else if (args->oldp->mls_enabled && !args->newp->mls_enabled) { 1751 /* 1752 * Switching between MLS and non-MLS policy: 1753 * free any storage used by the MLS fields in the 1754 * context for all existing entries in the sidtab. 1755 */ 1756 mls_context_destroy(c); 1757 } else if (!args->oldp->mls_enabled && args->newp->mls_enabled) { 1758 /* 1759 * Switching between non-MLS and MLS policy: 1760 * ensure that the MLS fields of the context for all 1761 * existing entries in the sidtab are filled in with a 1762 * suitable default value, likely taken from one of the 1763 * initial SIDs. 1764 */ 1765 oc = args->newp->ocontexts[OCON_ISID]; 1766 while (oc && oc->sid[0] != SECINITSID_UNLABELED) 1767 oc = oc->next; 1768 rc = -EINVAL; 1769 if (!oc) { 1770 printk(KERN_ERR "SELinux: unable to look up" 1771 " the initial SIDs list\n"); 1772 goto bad; 1773 } 1774 range = &oc->context[0].range; 1775 rc = mls_range_set(c, range); 1776 if (rc) 1777 goto bad; 1778 } 1779 1780 /* Check the validity of the new context. */ 1781 if (!policydb_context_isvalid(args->newp, c)) { 1782 rc = convert_context_handle_invalid_context(&oldc); 1783 if (rc) 1784 goto bad; 1785 } 1786 1787 context_destroy(&oldc); 1788 1789 rc = 0; 1790out: 1791 return rc; 1792bad: 1793 /* Map old representation to string and save it. */ 1794 rc = context_struct_to_string(&oldc, &s, &len); 1795 if (rc) 1796 return rc; 1797 context_destroy(&oldc); 1798 context_destroy(c); 1799 c->str = s; 1800 c->len = len; 1801 printk(KERN_INFO "SELinux: Context %s became invalid (unmapped).\n", 1802 c->str); 1803 rc = 0; 1804 goto out; 1805} 1806 1807static void security_load_policycaps(void) 1808{ 1809 selinux_policycap_netpeer = ebitmap_get_bit(&policydb.policycaps, 1810 POLICYDB_CAPABILITY_NETPEER); 1811 selinux_policycap_openperm = ebitmap_get_bit(&policydb.policycaps, 1812 POLICYDB_CAPABILITY_OPENPERM); 1813} 1814 1815static int security_preserve_bools(struct policydb *p); 1816 1817/** 1818 * security_load_policy - Load a security policy configuration. 1819 * @data: binary policy data 1820 * @len: length of data in bytes 1821 * 1822 * Load a new set of security policy configuration data, 1823 * validate it and convert the SID table as necessary. 1824 * This function will flush the access vector cache after 1825 * loading the new policy. 1826 */ 1827int security_load_policy(void *data, size_t len) 1828{ 1829 struct policydb oldpolicydb, newpolicydb; 1830 struct sidtab oldsidtab, newsidtab; 1831 struct selinux_mapping *oldmap, *map = NULL; 1832 struct convert_context_args args; 1833 u32 seqno; 1834 u16 map_size; 1835 int rc = 0; 1836 struct policy_file file = { data, len }, *fp = &file; 1837 1838 if (!ss_initialized) { 1839 avtab_cache_init(); 1840 rc = policydb_read(&policydb, fp); 1841 if (rc) { 1842 avtab_cache_destroy(); 1843 return rc; 1844 } 1845 1846 policydb.len = len; 1847 rc = selinux_set_mapping(&policydb, secclass_map, 1848 ¤t_mapping, 1849 ¤t_mapping_size); 1850 if (rc) { 1851 policydb_destroy(&policydb); 1852 avtab_cache_destroy(); 1853 return rc; 1854 } 1855 1856 rc = policydb_load_isids(&policydb, &sidtab); 1857 if (rc) { 1858 policydb_destroy(&policydb); 1859 avtab_cache_destroy(); 1860 return rc; 1861 } 1862 1863 security_load_policycaps(); 1864 ss_initialized = 1; 1865 seqno = ++latest_granting; 1866 selinux_complete_init(); 1867 avc_ss_reset(seqno); 1868 selnl_notify_policyload(seqno); 1869 selinux_status_update_policyload(seqno); 1870 selinux_netlbl_cache_invalidate(); 1871 selinux_xfrm_notify_policyload(); 1872 return 0; 1873 } 1874 1875#if 0 1876 sidtab_hash_eval(&sidtab, "sids"); 1877#endif 1878 1879 rc = policydb_read(&newpolicydb, fp); 1880 if (rc) 1881 return rc; 1882 1883 newpolicydb.len = len; 1884 /* If switching between different policy types, log MLS status */ 1885 if (policydb.mls_enabled && !newpolicydb.mls_enabled) 1886 printk(KERN_INFO "SELinux: Disabling MLS support...\n"); 1887 else if (!policydb.mls_enabled && newpolicydb.mls_enabled) 1888 printk(KERN_INFO "SELinux: Enabling MLS support...\n"); 1889 1890 rc = policydb_load_isids(&newpolicydb, &newsidtab); 1891 if (rc) { 1892 printk(KERN_ERR "SELinux: unable to load the initial SIDs\n"); 1893 policydb_destroy(&newpolicydb); 1894 return rc; 1895 } 1896 1897 rc = selinux_set_mapping(&newpolicydb, secclass_map, &map, &map_size); 1898 if (rc) 1899 goto err; 1900 1901 rc = security_preserve_bools(&newpolicydb); 1902 if (rc) { 1903 printk(KERN_ERR "SELinux: unable to preserve booleans\n"); 1904 goto err; 1905 } 1906 1907 /* Clone the SID table. */ 1908 sidtab_shutdown(&sidtab); 1909 1910 rc = sidtab_map(&sidtab, clone_sid, &newsidtab); 1911 if (rc) 1912 goto err; 1913 1914 /* 1915 * Convert the internal representations of contexts 1916 * in the new SID table. 1917 */ 1918 args.oldp = &policydb; 1919 args.newp = &newpolicydb; 1920 rc = sidtab_map(&newsidtab, convert_context, &args); 1921 if (rc) { 1922 printk(KERN_ERR "SELinux: unable to convert the internal" 1923 " representation of contexts in the new SID" 1924 " table\n"); 1925 goto err; 1926 } 1927 1928 /* Save the old policydb and SID table to free later. */ 1929 memcpy(&oldpolicydb, &policydb, sizeof policydb); 1930 sidtab_set(&oldsidtab, &sidtab); 1931 1932 /* Install the new policydb and SID table. */ 1933 write_lock_irq(&policy_rwlock); 1934 memcpy(&policydb, &newpolicydb, sizeof policydb); 1935 sidtab_set(&sidtab, &newsidtab); 1936 security_load_policycaps(); 1937 oldmap = current_mapping; 1938 current_mapping = map; 1939 current_mapping_size = map_size; 1940 seqno = ++latest_granting; 1941 write_unlock_irq(&policy_rwlock); 1942 1943 /* Free the old policydb and SID table. */ 1944 policydb_destroy(&oldpolicydb); 1945 sidtab_destroy(&oldsidtab); 1946 kfree(oldmap); 1947 1948 avc_ss_reset(seqno); 1949 selnl_notify_policyload(seqno); 1950 selinux_status_update_policyload(seqno); 1951 selinux_netlbl_cache_invalidate(); 1952 selinux_xfrm_notify_policyload(); 1953 1954 return 0; 1955 1956err: 1957 kfree(map); 1958 sidtab_destroy(&newsidtab); 1959 policydb_destroy(&newpolicydb); 1960 return rc; 1961 1962} 1963 1964size_t security_policydb_len(void) 1965{ 1966 size_t len; 1967 1968 read_lock(&policy_rwlock); 1969 len = policydb.len; 1970 read_unlock(&policy_rwlock); 1971 1972 return len; 1973} 1974 1975/** 1976 * security_port_sid - Obtain the SID for a port. 1977 * @protocol: protocol number 1978 * @port: port number 1979 * @out_sid: security identifier 1980 */ 1981int security_port_sid(u8 protocol, u16 port, u32 *out_sid) 1982{ 1983 struct ocontext *c; 1984 int rc = 0; 1985 1986 read_lock(&policy_rwlock); 1987 1988 c = policydb.ocontexts[OCON_PORT]; 1989 while (c) { 1990 if (c->u.port.protocol == protocol && 1991 c->u.port.low_port <= port && 1992 c->u.port.high_port >= port) 1993 break; 1994 c = c->next; 1995 } 1996 1997 if (c) { 1998 if (!c->sid[0]) { 1999 rc = sidtab_context_to_sid(&sidtab, 2000 &c->context[0], 2001 &c->sid[0]); 2002 if (rc) 2003 goto out; 2004 } 2005 *out_sid = c->sid[0]; 2006 } else { 2007 *out_sid = SECINITSID_PORT; 2008 } 2009 2010out: 2011 read_unlock(&policy_rwlock); 2012 return rc; 2013} 2014 2015/** 2016 * security_netif_sid - Obtain the SID for a network interface. 2017 * @name: interface name 2018 * @if_sid: interface SID 2019 */ 2020int security_netif_sid(char *name, u32 *if_sid) 2021{ 2022 int rc = 0; 2023 struct ocontext *c; 2024 2025 read_lock(&policy_rwlock); 2026 2027 c = policydb.ocontexts[OCON_NETIF]; 2028 while (c) { 2029 if (strcmp(name, c->u.name) == 0) 2030 break; 2031 c = c->next; 2032 } 2033 2034 if (c) { 2035 if (!c->sid[0] || !c->sid[1]) { 2036 rc = sidtab_context_to_sid(&sidtab, 2037 &c->context[0], 2038 &c->sid[0]); 2039 if (rc) 2040 goto out; 2041 rc = sidtab_context_to_sid(&sidtab, 2042 &c->context[1], 2043 &c->sid[1]); 2044 if (rc) 2045 goto out; 2046 } 2047 *if_sid = c->sid[0]; 2048 } else 2049 *if_sid = SECINITSID_NETIF; 2050 2051out: 2052 read_unlock(&policy_rwlock); 2053 return rc; 2054} 2055 2056static int match_ipv6_addrmask(u32 *input, u32 *addr, u32 *mask) 2057{ 2058 int i, fail = 0; 2059 2060 for (i = 0; i < 4; i++) 2061 if (addr[i] != (input[i] & mask[i])) { 2062 fail = 1; 2063 break; 2064 } 2065 2066 return !fail; 2067} 2068 2069/** 2070 * security_node_sid - Obtain the SID for a node (host). 2071 * @domain: communication domain aka address family 2072 * @addrp: address 2073 * @addrlen: address length in bytes 2074 * @out_sid: security identifier 2075 */ 2076int security_node_sid(u16 domain, 2077 void *addrp, 2078 u32 addrlen, 2079 u32 *out_sid) 2080{ 2081 int rc; 2082 struct ocontext *c; 2083 2084 read_lock(&policy_rwlock); 2085 2086 switch (domain) { 2087 case AF_INET: { 2088 u32 addr; 2089 2090 rc = -EINVAL; 2091 if (addrlen != sizeof(u32)) 2092 goto out; 2093 2094 addr = *((u32 *)addrp); 2095 2096 c = policydb.ocontexts[OCON_NODE]; 2097 while (c) { 2098 if (c->u.node.addr == (addr & c->u.node.mask)) 2099 break; 2100 c = c->next; 2101 } 2102 break; 2103 } 2104 2105 case AF_INET6: 2106 rc = -EINVAL; 2107 if (addrlen != sizeof(u64) * 2) 2108 goto out; 2109 c = policydb.ocontexts[OCON_NODE6]; 2110 while (c) { 2111 if (match_ipv6_addrmask(addrp, c->u.node6.addr, 2112 c->u.node6.mask)) 2113 break; 2114 c = c->next; 2115 } 2116 break; 2117 2118 default: 2119 rc = 0; 2120 *out_sid = SECINITSID_NODE; 2121 goto out; 2122 } 2123 2124 if (c) { 2125 if (!c->sid[0]) { 2126 rc = sidtab_context_to_sid(&sidtab, 2127 &c->context[0], 2128 &c->sid[0]); 2129 if (rc) 2130 goto out; 2131 } 2132 *out_sid = c->sid[0]; 2133 } else { 2134 *out_sid = SECINITSID_NODE; 2135 } 2136 2137 rc = 0; 2138out: 2139 read_unlock(&policy_rwlock); 2140 return rc; 2141} 2142 2143#define SIDS_NEL 25 2144 2145/** 2146 * security_get_user_sids - Obtain reachable SIDs for a user. 2147 * @fromsid: starting SID 2148 * @username: username 2149 * @sids: array of reachable SIDs for user 2150 * @nel: number of elements in @sids 2151 * 2152 * Generate the set of SIDs for legal security contexts 2153 * for a given user that can be reached by @fromsid. 2154 * Set *@sids to point to a dynamically allocated 2155 * array containing the set of SIDs. Set *@nel to the 2156 * number of elements in the array. 2157 */ 2158 2159int security_get_user_sids(u32 fromsid, 2160 char *username, 2161 u32 **sids, 2162 u32 *nel) 2163{ 2164 struct context *fromcon, usercon; 2165 u32 *mysids = NULL, *mysids2, sid; 2166 u32 mynel = 0, maxnel = SIDS_NEL; 2167 struct user_datum *user; 2168 struct role_datum *role; 2169 struct ebitmap_node *rnode, *tnode; 2170 int rc = 0, i, j; 2171 2172 *sids = NULL; 2173 *nel = 0; 2174 2175 if (!ss_initialized) 2176 goto out; 2177 2178 read_lock(&policy_rwlock); 2179 2180 context_init(&usercon); 2181 2182 rc = -EINVAL; 2183 fromcon = sidtab_search(&sidtab, fromsid); 2184 if (!fromcon) 2185 goto out_unlock; 2186 2187 rc = -EINVAL; 2188 user = hashtab_search(policydb.p_users.table, username); 2189 if (!user) 2190 goto out_unlock; 2191 2192 usercon.user = user->value; 2193 2194 rc = -ENOMEM; 2195 mysids = kcalloc(maxnel, sizeof(*mysids), GFP_ATOMIC); 2196 if (!mysids) 2197 goto out_unlock; 2198 2199 ebitmap_for_each_positive_bit(&user->roles, rnode, i) { 2200 role = policydb.role_val_to_struct[i]; 2201 usercon.role = i + 1; 2202 ebitmap_for_each_positive_bit(&role->types, tnode, j) { 2203 usercon.type = j + 1; 2204 2205 if (mls_setup_user_range(fromcon, user, &usercon)) 2206 continue; 2207 2208 rc = sidtab_context_to_sid(&sidtab, &usercon, &sid); 2209 if (rc) 2210 goto out_unlock; 2211 if (mynel < maxnel) { 2212 mysids[mynel++] = sid; 2213 } else { 2214 rc = -ENOMEM; 2215 maxnel += SIDS_NEL; 2216 mysids2 = kcalloc(maxnel, sizeof(*mysids2), GFP_ATOMIC); 2217 if (!mysids2) 2218 goto out_unlock; 2219 memcpy(mysids2, mysids, mynel * sizeof(*mysids2)); 2220 kfree(mysids); 2221 mysids = mysids2; 2222 mysids[mynel++] = sid; 2223 } 2224 } 2225 } 2226 rc = 0; 2227out_unlock: 2228 read_unlock(&policy_rwlock); 2229 if (rc || !mynel) { 2230 kfree(mysids); 2231 goto out; 2232 } 2233 2234 rc = -ENOMEM; 2235 mysids2 = kcalloc(mynel, sizeof(*mysids2), GFP_KERNEL); 2236 if (!mysids2) { 2237 kfree(mysids); 2238 goto out; 2239 } 2240 for (i = 0, j = 0; i < mynel; i++) { 2241 struct av_decision dummy_avd; 2242 rc = avc_has_perm_noaudit(fromsid, mysids[i], 2243 SECCLASS_PROCESS, /* kernel value */ 2244 PROCESS__TRANSITION, AVC_STRICT, 2245 &dummy_avd); 2246 if (!rc) 2247 mysids2[j++] = mysids[i]; 2248 cond_resched(); 2249 } 2250 rc = 0; 2251 kfree(mysids); 2252 *sids = mysids2; 2253 *nel = j; 2254out: 2255 return rc; 2256} 2257 2258/** 2259 * security_genfs_sid - Obtain a SID for a file in a filesystem 2260 * @fstype: filesystem type 2261 * @path: path from root of mount 2262 * @sclass: file security class 2263 * @sid: SID for path 2264 * 2265 * Obtain a SID to use for a file in a filesystem that 2266 * cannot support xattr or use a fixed labeling behavior like 2267 * transition SIDs or task SIDs. 2268 */ 2269int security_genfs_sid(const char *fstype, 2270 char *path, 2271 u16 orig_sclass, 2272 u32 *sid) 2273{ 2274 int len; 2275 u16 sclass; 2276 struct genfs *genfs; 2277 struct ocontext *c; 2278 int rc, cmp = 0; 2279 2280 while (path[0] == '/' && path[1] == '/') 2281 path++; 2282 2283 read_lock(&policy_rwlock); 2284 2285 sclass = unmap_class(orig_sclass); 2286 *sid = SECINITSID_UNLABELED; 2287 2288 for (genfs = policydb.genfs; genfs; genfs = genfs->next) { 2289 cmp = strcmp(fstype, genfs->fstype); 2290 if (cmp <= 0) 2291 break; 2292 } 2293 2294 rc = -ENOENT; 2295 if (!genfs || cmp) 2296 goto out; 2297 2298 for (c = genfs->head; c; c = c->next) { 2299 len = strlen(c->u.name); 2300 if ((!c->v.sclass || sclass == c->v.sclass) && 2301 (strncmp(c->u.name, path, len) == 0)) 2302 break; 2303 } 2304 2305 rc = -ENOENT; 2306 if (!c) 2307 goto out; 2308 2309 if (!c->sid[0]) { 2310 rc = sidtab_context_to_sid(&sidtab, &c->context[0], &c->sid[0]); 2311 if (rc) 2312 goto out; 2313 } 2314 2315 *sid = c->sid[0]; 2316 rc = 0; 2317out: 2318 read_unlock(&policy_rwlock); 2319 return rc; 2320} 2321 2322/** 2323 * security_fs_use - Determine how to handle labeling for a filesystem. 2324 * @fstype: filesystem type 2325 * @behavior: labeling behavior 2326 * @sid: SID for filesystem (superblock) 2327 */ 2328int security_fs_use( 2329 const char *fstype, 2330 unsigned int *behavior, 2331 u32 *sid) 2332{ 2333 int rc = 0; 2334 struct ocontext *c; 2335 2336 read_lock(&policy_rwlock); 2337 2338 c = policydb.ocontexts[OCON_FSUSE]; 2339 while (c) { 2340 if (strcmp(fstype, c->u.name) == 0) 2341 break; 2342 c = c->next; 2343 } 2344 2345 if (c) { 2346 *behavior = c->v.behavior; 2347 if (!c->sid[0]) { 2348 rc = sidtab_context_to_sid(&sidtab, &c->context[0], 2349 &c->sid[0]); 2350 if (rc) 2351 goto out; 2352 } 2353 *sid = c->sid[0]; 2354 } else { 2355 rc = security_genfs_sid(fstype, "/", SECCLASS_DIR, sid); 2356 if (rc) { 2357 *behavior = SECURITY_FS_USE_NONE; 2358 rc = 0; 2359 } else { 2360 *behavior = SECURITY_FS_USE_GENFS; 2361 } 2362 } 2363 2364out: 2365 read_unlock(&policy_rwlock); 2366 return rc; 2367} 2368 2369int security_get_bools(int *len, char ***names, int **values) 2370{ 2371 int i, rc; 2372 2373 read_lock(&policy_rwlock); 2374 *names = NULL; 2375 *values = NULL; 2376 2377 rc = 0; 2378 *len = policydb.p_bools.nprim; 2379 if (!*len) 2380 goto out; 2381 2382 rc = -ENOMEM; 2383 *names = kcalloc(*len, sizeof(char *), GFP_ATOMIC); 2384 if (!*names) 2385 goto err; 2386 2387 rc = -ENOMEM; 2388 *values = kcalloc(*len, sizeof(int), GFP_ATOMIC); 2389 if (!*values) 2390 goto err; 2391 2392 for (i = 0; i < *len; i++) { 2393 size_t name_len; 2394 2395 (*values)[i] = policydb.bool_val_to_struct[i]->state; 2396 name_len = strlen(sym_name(&policydb, SYM_BOOLS, i)) + 1; 2397 2398 rc = -ENOMEM; 2399 (*names)[i] = kmalloc(sizeof(char) * name_len, GFP_ATOMIC); 2400 if (!(*names)[i]) 2401 goto err; 2402 2403 strncpy((*names)[i], sym_name(&policydb, SYM_BOOLS, i), name_len); 2404 (*names)[i][name_len - 1] = 0; 2405 } 2406 rc = 0; 2407out: 2408 read_unlock(&policy_rwlock); 2409 return rc; 2410err: 2411 if (*names) { 2412 for (i = 0; i < *len; i++) 2413 kfree((*names)[i]); 2414 } 2415 kfree(*values); 2416 goto out; 2417} 2418 2419 2420int security_set_bools(int len, int *values) 2421{ 2422 int i, rc; 2423 int lenp, seqno = 0; 2424 struct cond_node *cur; 2425 2426 write_lock_irq(&policy_rwlock); 2427 2428 rc = -EFAULT; 2429 lenp = policydb.p_bools.nprim; 2430 if (len != lenp) 2431 goto out; 2432 2433 for (i = 0; i < len; i++) { 2434 if (!!values[i] != policydb.bool_val_to_struct[i]->state) { 2435 audit_log(current->audit_context, GFP_ATOMIC, 2436 AUDIT_MAC_CONFIG_CHANGE, 2437 "bool=%s val=%d old_val=%d auid=%u ses=%u", 2438 sym_name(&policydb, SYM_BOOLS, i), 2439 !!values[i], 2440 policydb.bool_val_to_struct[i]->state, 2441 audit_get_loginuid(current), 2442 audit_get_sessionid(current)); 2443 } 2444 if (values[i]) 2445 policydb.bool_val_to_struct[i]->state = 1; 2446 else 2447 policydb.bool_val_to_struct[i]->state = 0; 2448 } 2449 2450 for (cur = policydb.cond_list; cur; cur = cur->next) { 2451 rc = evaluate_cond_node(&policydb, cur); 2452 if (rc) 2453 goto out; 2454 } 2455 2456 seqno = ++latest_granting; 2457 rc = 0; 2458out: 2459 write_unlock_irq(&policy_rwlock); 2460 if (!rc) { 2461 avc_ss_reset(seqno); 2462 selnl_notify_policyload(seqno); 2463 selinux_status_update_policyload(seqno); 2464 selinux_xfrm_notify_policyload(); 2465 } 2466 return rc; 2467} 2468 2469int security_get_bool_value(int bool) 2470{ 2471 int rc; 2472 int len; 2473 2474 read_lock(&policy_rwlock); 2475 2476 rc = -EFAULT; 2477 len = policydb.p_bools.nprim; 2478 if (bool >= len) 2479 goto out; 2480 2481 rc = policydb.bool_val_to_struct[bool]->state; 2482out: 2483 read_unlock(&policy_rwlock); 2484 return rc; 2485} 2486 2487static int security_preserve_bools(struct policydb *p) 2488{ 2489 int rc, nbools = 0, *bvalues = NULL, i; 2490 char **bnames = NULL; 2491 struct cond_bool_datum *booldatum; 2492 struct cond_node *cur; 2493 2494 rc = security_get_bools(&nbools, &bnames, &bvalues); 2495 if (rc) 2496 goto out; 2497 for (i = 0; i < nbools; i++) { 2498 booldatum = hashtab_search(p->p_bools.table, bnames[i]); 2499 if (booldatum) 2500 booldatum->state = bvalues[i]; 2501 } 2502 for (cur = p->cond_list; cur; cur = cur->next) { 2503 rc = evaluate_cond_node(p, cur); 2504 if (rc) 2505 goto out; 2506 } 2507 2508out: 2509 if (bnames) { 2510 for (i = 0; i < nbools; i++) 2511 kfree(bnames[i]); 2512 } 2513 kfree(bnames); 2514 kfree(bvalues); 2515 return rc; 2516} 2517 2518/* 2519 * security_sid_mls_copy() - computes a new sid based on the given 2520 * sid and the mls portion of mls_sid. 2521 */ 2522int security_sid_mls_copy(u32 sid, u32 mls_sid, u32 *new_sid) 2523{ 2524 struct context *context1; 2525 struct context *context2; 2526 struct context newcon; 2527 char *s; 2528 u32 len; 2529 int rc; 2530 2531 rc = 0; 2532 if (!ss_initialized || !policydb.mls_enabled) { 2533 *new_sid = sid; 2534 goto out; 2535 } 2536 2537 context_init(&newcon); 2538 2539 read_lock(&policy_rwlock); 2540 2541 rc = -EINVAL; 2542 context1 = sidtab_search(&sidtab, sid); 2543 if (!context1) { 2544 printk(KERN_ERR "SELinux: %s: unrecognized SID %d\n", 2545 __func__, sid); 2546 goto out_unlock; 2547 } 2548 2549 rc = -EINVAL; 2550 context2 = sidtab_search(&sidtab, mls_sid); 2551 if (!context2) { 2552 printk(KERN_ERR "SELinux: %s: unrecognized SID %d\n", 2553 __func__, mls_sid); 2554 goto out_unlock; 2555 } 2556 2557 newcon.user = context1->user; 2558 newcon.role = context1->role; 2559 newcon.type = context1->type; 2560 rc = mls_context_cpy(&newcon, context2); 2561 if (rc) 2562 goto out_unlock; 2563 2564 /* Check the validity of the new context. */ 2565 if (!policydb_context_isvalid(&policydb, &newcon)) { 2566 rc = convert_context_handle_invalid_context(&newcon); 2567 if (rc) { 2568 if (!context_struct_to_string(&newcon, &s, &len)) { 2569 audit_log(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR, 2570 "security_sid_mls_copy: invalid context %s", s); 2571 kfree(s); 2572 } 2573 goto out_unlock; 2574 } 2575 } 2576 2577 rc = sidtab_context_to_sid(&sidtab, &newcon, new_sid); 2578out_unlock: 2579 read_unlock(&policy_rwlock); 2580 context_destroy(&newcon); 2581out: 2582 return rc; 2583} 2584 2585/** 2586 * security_net_peersid_resolve - Compare and resolve two network peer SIDs 2587 * @nlbl_sid: NetLabel SID 2588 * @nlbl_type: NetLabel labeling protocol type 2589 * @xfrm_sid: XFRM SID 2590 * 2591 * Description: 2592 * Compare the @nlbl_sid and @xfrm_sid values and if the two SIDs can be 2593 * resolved into a single SID it is returned via @peer_sid and the function 2594 * returns zero. Otherwise @peer_sid is set to SECSID_NULL and the function 2595 * returns a negative value. A table summarizing the behavior is below: 2596 * 2597 * | function return | @sid 2598 * ------------------------------+-----------------+----------------- 2599 * no peer labels | 0 | SECSID_NULL 2600 * single peer label | 0 | <peer_label> 2601 * multiple, consistent labels | 0 | <peer_label> 2602 * multiple, inconsistent labels | -<errno> | SECSID_NULL 2603 * 2604 */ 2605int security_net_peersid_resolve(u32 nlbl_sid, u32 nlbl_type, 2606 u32 xfrm_sid, 2607 u32 *peer_sid) 2608{ 2609 int rc; 2610 struct context *nlbl_ctx; 2611 struct context *xfrm_ctx; 2612 2613 *peer_sid = SECSID_NULL; 2614 2615 /* handle the common (which also happens to be the set of easy) cases 2616 * right away, these two if statements catch everything involving a 2617 * single or absent peer SID/label */ 2618 if (xfrm_sid == SECSID_NULL) { 2619 *peer_sid = nlbl_sid; 2620 return 0; 2621 } 2622 /* NOTE: an nlbl_type == NETLBL_NLTYPE_UNLABELED is a "fallback" label 2623 * and is treated as if nlbl_sid == SECSID_NULL when a XFRM SID/label 2624 * is present */ 2625 if (nlbl_sid == SECSID_NULL || nlbl_type == NETLBL_NLTYPE_UNLABELED) { 2626 *peer_sid = xfrm_sid; 2627 return 0; 2628 } 2629 2630 /* we don't need to check ss_initialized here since the only way both 2631 * nlbl_sid and xfrm_sid are not equal to SECSID_NULL would be if the 2632 * security server was initialized and ss_initialized was true */ 2633 if (!policydb.mls_enabled) 2634 return 0; 2635 2636 read_lock(&policy_rwlock); 2637 2638 rc = -EINVAL; 2639 nlbl_ctx = sidtab_search(&sidtab, nlbl_sid); 2640 if (!nlbl_ctx) { 2641 printk(KERN_ERR "SELinux: %s: unrecognized SID %d\n", 2642 __func__, nlbl_sid); 2643 goto out; 2644 } 2645 rc = -EINVAL; 2646 xfrm_ctx = sidtab_search(&sidtab, xfrm_sid); 2647 if (!xfrm_ctx) { 2648 printk(KERN_ERR "SELinux: %s: unrecognized SID %d\n", 2649 __func__, xfrm_sid); 2650 goto out; 2651 } 2652 rc = (mls_context_cmp(nlbl_ctx, xfrm_ctx) ? 0 : -EACCES); 2653 if (rc) 2654 goto out; 2655 2656 /* at present NetLabel SIDs/labels really only carry MLS 2657 * information so if the MLS portion of the NetLabel SID 2658 * matches the MLS portion of the labeled XFRM SID/label 2659 * then pass along the XFRM SID as it is the most 2660 * expressive */ 2661 *peer_sid = xfrm_sid; 2662out: 2663 read_unlock(&policy_rwlock); 2664 return rc; 2665} 2666 2667static int get_classes_callback(void *k, void *d, void *args) 2668{ 2669 struct class_datum *datum = d; 2670 char *name = k, **classes = args; 2671 int value = datum->value - 1; 2672 2673 classes[value] = kstrdup(name, GFP_ATOMIC); 2674 if (!classes[value]) 2675 return -ENOMEM; 2676 2677 return 0; 2678} 2679 2680int security_get_classes(char ***classes, int *nclasses) 2681{ 2682 int rc; 2683 2684 read_lock(&policy_rwlock); 2685 2686 rc = -ENOMEM; 2687 *nclasses = policydb.p_classes.nprim; 2688 *classes = kcalloc(*nclasses, sizeof(**classes), GFP_ATOMIC); 2689 if (!*classes) 2690 goto out; 2691 2692 rc = hashtab_map(policydb.p_classes.table, get_classes_callback, 2693 *classes); 2694 if (rc) { 2695 int i; 2696 for (i = 0; i < *nclasses; i++) 2697 kfree((*classes)[i]); 2698 kfree(*classes); 2699 } 2700 2701out: 2702 read_unlock(&policy_rwlock); 2703 return rc; 2704} 2705 2706static int get_permissions_callback(void *k, void *d, void *args) 2707{ 2708 struct perm_datum *datum = d; 2709 char *name = k, **perms = args; 2710 int value = datum->value - 1; 2711 2712 perms[value] = kstrdup(name, GFP_ATOMIC); 2713 if (!perms[value]) 2714 return -ENOMEM; 2715 2716 return 0; 2717} 2718 2719int security_get_permissions(char *class, char ***perms, int *nperms) 2720{ 2721 int rc, i; 2722 struct class_datum *match; 2723 2724 read_lock(&policy_rwlock); 2725 2726 rc = -EINVAL; 2727 match = hashtab_search(policydb.p_classes.table, class); 2728 if (!match) { 2729 printk(KERN_ERR "SELinux: %s: unrecognized class %s\n", 2730 __func__, class); 2731 goto out; 2732 } 2733 2734 rc = -ENOMEM; 2735 *nperms = match->permissions.nprim; 2736 *perms = kcalloc(*nperms, sizeof(**perms), GFP_ATOMIC); 2737 if (!*perms) 2738 goto out; 2739 2740 if (match->comdatum) { 2741 rc = hashtab_map(match->comdatum->permissions.table, 2742 get_permissions_callback, *perms); 2743 if (rc) 2744 goto err; 2745 } 2746 2747 rc = hashtab_map(match->permissions.table, get_permissions_callback, 2748 *perms); 2749 if (rc) 2750 goto err; 2751 2752out: 2753 read_unlock(&policy_rwlock); 2754 return rc; 2755 2756err: 2757 read_unlock(&policy_rwlock); 2758 for (i = 0; i < *nperms; i++) 2759 kfree((*perms)[i]); 2760 kfree(*perms); 2761 return rc; 2762} 2763 2764int security_get_reject_unknown(void) 2765{ 2766 return policydb.reject_unknown; 2767} 2768 2769int security_get_allow_unknown(void) 2770{ 2771 return policydb.allow_unknown; 2772} 2773 2774/** 2775 * security_policycap_supported - Check for a specific policy capability 2776 * @req_cap: capability 2777 * 2778 * Description: 2779 * This function queries the currently loaded policy to see if it supports the 2780 * capability specified by @req_cap. Returns true (1) if the capability is 2781 * supported, false (0) if it isn't supported. 2782 * 2783 */ 2784int security_policycap_supported(unsigned int req_cap) 2785{ 2786 int rc; 2787 2788 read_lock(&policy_rwlock); 2789 rc = ebitmap_get_bit(&policydb.policycaps, req_cap); 2790 read_unlock(&policy_rwlock); 2791 2792 return rc; 2793} 2794 2795struct selinux_audit_rule { 2796 u32 au_seqno; 2797 struct context au_ctxt; 2798}; 2799 2800void selinux_audit_rule_free(void *vrule) 2801{ 2802 struct selinux_audit_rule *rule = vrule; 2803 2804 if (rule) { 2805 context_destroy(&rule->au_ctxt); 2806 kfree(rule); 2807 } 2808} 2809 2810int selinux_audit_rule_init(u32 field, u32 op, char *rulestr, void **vrule) 2811{ 2812 struct selinux_audit_rule *tmprule; 2813 struct role_datum *roledatum; 2814 struct type_datum *typedatum; 2815 struct user_datum *userdatum; 2816 struct selinux_audit_rule **rule = (struct selinux_audit_rule **)vrule; 2817 int rc = 0; 2818 2819 *rule = NULL; 2820 2821 if (!ss_initialized) 2822 return -EOPNOTSUPP; 2823 2824 switch (field) { 2825 case AUDIT_SUBJ_USER: 2826 case AUDIT_SUBJ_ROLE: 2827 case AUDIT_SUBJ_TYPE: 2828 case AUDIT_OBJ_USER: 2829 case AUDIT_OBJ_ROLE: 2830 case AUDIT_OBJ_TYPE: 2831 /* only 'equals' and 'not equals' fit user, role, and type */ 2832 if (op != Audit_equal && op != Audit_not_equal) 2833 return -EINVAL; 2834 break; 2835 case AUDIT_SUBJ_SEN: 2836 case AUDIT_SUBJ_CLR: 2837 case AUDIT_OBJ_LEV_LOW: 2838 case AUDIT_OBJ_LEV_HIGH: 2839 /* we do not allow a range, indicated by the presence of '-' */ 2840 if (strchr(rulestr, '-')) 2841 return -EINVAL; 2842 break; 2843 default: 2844 /* only the above fields are valid */ 2845 return -EINVAL; 2846 } 2847 2848 tmprule = kzalloc(sizeof(struct selinux_audit_rule), GFP_KERNEL); 2849 if (!tmprule) 2850 return -ENOMEM; 2851 2852 context_init(&tmprule->au_ctxt); 2853 2854 read_lock(&policy_rwlock); 2855 2856 tmprule->au_seqno = latest_granting; 2857 2858 switch (field) { 2859 case AUDIT_SUBJ_USER: 2860 case AUDIT_OBJ_USER: 2861 rc = -EINVAL; 2862 userdatum = hashtab_search(policydb.p_users.table, rulestr); 2863 if (!userdatum) 2864 goto out; 2865 tmprule->au_ctxt.user = userdatum->value; 2866 break; 2867 case AUDIT_SUBJ_ROLE: 2868 case AUDIT_OBJ_ROLE: 2869 rc = -EINVAL; 2870 roledatum = hashtab_search(policydb.p_roles.table, rulestr); 2871 if (!roledatum) 2872 goto out; 2873 tmprule->au_ctxt.role = roledatum->value; 2874 break; 2875 case AUDIT_SUBJ_TYPE: 2876 case AUDIT_OBJ_TYPE: 2877 rc = -EINVAL; 2878 typedatum = hashtab_search(policydb.p_types.table, rulestr); 2879 if (!typedatum) 2880 goto out; 2881 tmprule->au_ctxt.type = typedatum->value; 2882 break; 2883 case AUDIT_SUBJ_SEN: 2884 case AUDIT_SUBJ_CLR: 2885 case AUDIT_OBJ_LEV_LOW: 2886 case AUDIT_OBJ_LEV_HIGH: 2887 rc = mls_from_string(rulestr, &tmprule->au_ctxt, GFP_ATOMIC); 2888 if (rc) 2889 goto out; 2890 break; 2891 } 2892 rc = 0; 2893out: 2894 read_unlock(&policy_rwlock); 2895 2896 if (rc) { 2897 selinux_audit_rule_free(tmprule); 2898 tmprule = NULL; 2899 } 2900 2901 *rule = tmprule; 2902 2903 return rc; 2904} 2905 2906/* Check to see if the rule contains any selinux fields */ 2907int selinux_audit_rule_known(struct audit_krule *rule) 2908{ 2909 int i; 2910 2911 for (i = 0; i < rule->field_count; i++) { 2912 struct audit_field *f = &rule->fields[i]; 2913 switch (f->type) { 2914 case AUDIT_SUBJ_USER: 2915 case AUDIT_SUBJ_ROLE: 2916 case AUDIT_SUBJ_TYPE: 2917 case AUDIT_SUBJ_SEN: 2918 case AUDIT_SUBJ_CLR: 2919 case AUDIT_OBJ_USER: 2920 case AUDIT_OBJ_ROLE: 2921 case AUDIT_OBJ_TYPE: 2922 case AUDIT_OBJ_LEV_LOW: 2923 case AUDIT_OBJ_LEV_HIGH: 2924 return 1; 2925 } 2926 } 2927 2928 return 0; 2929} 2930 2931int selinux_audit_rule_match(u32 sid, u32 field, u32 op, void *vrule, 2932 struct audit_context *actx) 2933{ 2934 struct context *ctxt; 2935 struct mls_level *level; 2936 struct selinux_audit_rule *rule = vrule; 2937 int match = 0; 2938 2939 if (!rule) { 2940 audit_log(actx, GFP_ATOMIC, AUDIT_SELINUX_ERR, 2941 "selinux_audit_rule_match: missing rule\n"); 2942 return -ENOENT; 2943 } 2944 2945 read_lock(&policy_rwlock); 2946 2947 if (rule->au_seqno < latest_granting) { 2948 audit_log(actx, GFP_ATOMIC, AUDIT_SELINUX_ERR, 2949 "selinux_audit_rule_match: stale rule\n"); 2950 match = -ESTALE; 2951 goto out; 2952 } 2953 2954 ctxt = sidtab_search(&sidtab, sid); 2955 if (!ctxt) { 2956 audit_log(actx, GFP_ATOMIC, AUDIT_SELINUX_ERR, 2957 "selinux_audit_rule_match: unrecognized SID %d\n", 2958 sid); 2959 match = -ENOENT; 2960 goto out; 2961 } 2962 2963 /* a field/op pair that is not caught here will simply fall through 2964 without a match */ 2965 switch (field) { 2966 case AUDIT_SUBJ_USER: 2967 case AUDIT_OBJ_USER: 2968 switch (op) { 2969 case Audit_equal: 2970 match = (ctxt->user == rule->au_ctxt.user); 2971 break; 2972 case Audit_not_equal: 2973 match = (ctxt->user != rule->au_ctxt.user); 2974 break; 2975 } 2976 break; 2977 case AUDIT_SUBJ_ROLE: 2978 case AUDIT_OBJ_ROLE: 2979 switch (op) { 2980 case Audit_equal: 2981 match = (ctxt->role == rule->au_ctxt.role); 2982 break; 2983 case Audit_not_equal: 2984 match = (ctxt->role != rule->au_ctxt.role); 2985 break; 2986 } 2987 break; 2988 case AUDIT_SUBJ_TYPE: 2989 case AUDIT_OBJ_TYPE: 2990 switch (op) { 2991 case Audit_equal: 2992 match = (ctxt->type == rule->au_ctxt.type); 2993 break; 2994 case Audit_not_equal: 2995 match = (ctxt->type != rule->au_ctxt.type); 2996 break; 2997 } 2998 break; 2999 case AUDIT_SUBJ_SEN: 3000 case AUDIT_SUBJ_CLR: 3001 case AUDIT_OBJ_LEV_LOW: 3002 case AUDIT_OBJ_LEV_HIGH: 3003 level = ((field == AUDIT_SUBJ_SEN || 3004 field == AUDIT_OBJ_LEV_LOW) ? 3005 &ctxt->range.level[0] : &ctxt->range.level[1]); 3006 switch (op) { 3007 case Audit_equal: 3008 match = mls_level_eq(&rule->au_ctxt.range.level[0], 3009 level); 3010 break; 3011 case Audit_not_equal: 3012 match = !mls_level_eq(&rule->au_ctxt.range.level[0], 3013 level); 3014 break; 3015 case Audit_lt: 3016 match = (mls_level_dom(&rule->au_ctxt.range.level[0], 3017 level) && 3018 !mls_level_eq(&rule->au_ctxt.range.level[0], 3019 level)); 3020 break; 3021 case Audit_le: 3022 match = mls_level_dom(&rule->au_ctxt.range.level[0], 3023 level); 3024 break; 3025 case Audit_gt: 3026 match = (mls_level_dom(level, 3027 &rule->au_ctxt.range.level[0]) && 3028 !mls_level_eq(level, 3029 &rule->au_ctxt.range.level[0])); 3030 break; 3031 case Audit_ge: 3032 match = mls_level_dom(level, 3033 &rule->au_ctxt.range.level[0]); 3034 break; 3035 } 3036 } 3037 3038out: 3039 read_unlock(&policy_rwlock); 3040 return match; 3041} 3042 3043static int (*aurule_callback)(void) = audit_update_lsm_rules; 3044 3045static int aurule_avc_callback(u32 event, u32 ssid, u32 tsid, 3046 u16 class, u32 perms, u32 *retained) 3047{ 3048 int err = 0; 3049 3050 if (event == AVC_CALLBACK_RESET && aurule_callback) 3051 err = aurule_callback(); 3052 return err; 3053} 3054 3055static int __init aurule_init(void) 3056{ 3057 int err; 3058 3059 err = avc_add_callback(aurule_avc_callback, AVC_CALLBACK_RESET, 3060 SECSID_NULL, SECSID_NULL, SECCLASS_NULL, 0); 3061 if (err) 3062 panic("avc_add_callback() failed, error %d\n", err); 3063 3064 return err; 3065} 3066__initcall(aurule_init); 3067 3068#ifdef CONFIG_NETLABEL 3069/** 3070 * security_netlbl_cache_add - Add an entry to the NetLabel cache 3071 * @secattr: the NetLabel packet security attributes 3072 * @sid: the SELinux SID 3073 * 3074 * Description: 3075 * Attempt to cache the context in @ctx, which was derived from the packet in 3076 * @skb, in the NetLabel subsystem cache. This function assumes @secattr has 3077 * already been initialized. 3078 * 3079 */ 3080static void security_netlbl_cache_add(struct netlbl_lsm_secattr *secattr, 3081 u32 sid) 3082{ 3083 u32 *sid_cache; 3084 3085 sid_cache = kmalloc(sizeof(*sid_cache), GFP_ATOMIC); 3086 if (sid_cache == NULL) 3087 return; 3088 secattr->cache = netlbl_secattr_cache_alloc(GFP_ATOMIC); 3089 if (secattr->cache == NULL) { 3090 kfree(sid_cache); 3091 return; 3092 } 3093 3094 *sid_cache = sid; 3095 secattr->cache->free = kfree; 3096 secattr->cache->data = sid_cache; 3097 secattr->flags |= NETLBL_SECATTR_CACHE; 3098} 3099 3100/** 3101 * security_netlbl_secattr_to_sid - Convert a NetLabel secattr to a SELinux SID 3102 * @secattr: the NetLabel packet security attributes 3103 * @sid: the SELinux SID 3104 * 3105 * Description: 3106 * Convert the given NetLabel security attributes in @secattr into a 3107 * SELinux SID. If the @secattr field does not contain a full SELinux 3108 * SID/context then use SECINITSID_NETMSG as the foundation. If possible the 3109 * 'cache' field of @secattr is set and the CACHE flag is set; this is to 3110 * allow the @secattr to be used by NetLabel to cache the secattr to SID 3111 * conversion for future lookups. Returns zero on success, negative values on 3112 * failure. 3113 * 3114 */ 3115int security_netlbl_secattr_to_sid(struct netlbl_lsm_secattr *secattr, 3116 u32 *sid) 3117{ 3118 int rc; 3119 struct context *ctx; 3120 struct context ctx_new; 3121 3122 if (!ss_initialized) { 3123 *sid = SECSID_NULL; 3124 return 0; 3125 } 3126 3127 read_lock(&policy_rwlock); 3128 3129 if (secattr->flags & NETLBL_SECATTR_CACHE) 3130 *sid = *(u32 *)secattr->cache->data; 3131 else if (secattr->flags & NETLBL_SECATTR_SECID) 3132 *sid = secattr->attr.secid; 3133 else if (secattr->flags & NETLBL_SECATTR_MLS_LVL) { 3134 rc = -EIDRM; 3135 ctx = sidtab_search(&sidtab, SECINITSID_NETMSG); 3136 if (ctx == NULL) 3137 goto out; 3138 3139 context_init(&ctx_new); 3140 ctx_new.user = ctx->user; 3141 ctx_new.role = ctx->role; 3142 ctx_new.type = ctx->type; 3143 mls_import_netlbl_lvl(&ctx_new, secattr); 3144 if (secattr->flags & NETLBL_SECATTR_MLS_CAT) { 3145 rc = ebitmap_netlbl_import(&ctx_new.range.level[0].cat, 3146 secattr->attr.mls.cat); 3147 if (rc) 3148 goto out; 3149 memcpy(&ctx_new.range.level[1].cat, 3150 &ctx_new.range.level[0].cat, 3151 sizeof(ctx_new.range.level[0].cat)); 3152 } 3153 rc = -EIDRM; 3154 if (!mls_context_isvalid(&policydb, &ctx_new)) 3155 goto out_free; 3156 3157 rc = sidtab_context_to_sid(&sidtab, &ctx_new, sid); 3158 if (rc) 3159 goto out_free; 3160 3161 security_netlbl_cache_add(secattr, *sid); 3162 3163 ebitmap_destroy(&ctx_new.range.level[0].cat); 3164 } else 3165 *sid = SECSID_NULL; 3166 3167 read_unlock(&policy_rwlock); 3168 return 0; 3169out_free: 3170 ebitmap_destroy(&ctx_new.range.level[0].cat); 3171out: 3172 read_unlock(&policy_rwlock); 3173 return rc; 3174} 3175 3176/** 3177 * security_netlbl_sid_to_secattr - Convert a SELinux SID to a NetLabel secattr 3178 * @sid: the SELinux SID 3179 * @secattr: the NetLabel packet security attributes 3180 * 3181 * Description: 3182 * Convert the given SELinux SID in @sid into a NetLabel security attribute. 3183 * Returns zero on success, negative values on failure. 3184 * 3185 */ 3186int security_netlbl_sid_to_secattr(u32 sid, struct netlbl_lsm_secattr *secattr) 3187{ 3188 int rc; 3189 struct context *ctx; 3190 3191 if (!ss_initialized) 3192 return 0; 3193 3194 read_lock(&policy_rwlock); 3195 3196 rc = -ENOENT; 3197 ctx = sidtab_search(&sidtab, sid); 3198 if (ctx == NULL) 3199 goto out; 3200 3201 rc = -ENOMEM; 3202 secattr->domain = kstrdup(sym_name(&policydb, SYM_TYPES, ctx->type - 1), 3203 GFP_ATOMIC); 3204 if (secattr->domain == NULL) 3205 goto out; 3206 3207 secattr->attr.secid = sid; 3208 secattr->flags |= NETLBL_SECATTR_DOMAIN_CPY | NETLBL_SECATTR_SECID; 3209 mls_export_netlbl_lvl(ctx, secattr); 3210 rc = mls_export_netlbl_cat(ctx, secattr); 3211out: 3212 read_unlock(&policy_rwlock); 3213 return rc; 3214} 3215#endif /* CONFIG_NETLABEL */ 3216 3217/** 3218 * security_read_policy - read the policy. 3219 * @data: binary policy data 3220 * @len: length of data in bytes 3221 * 3222 */ 3223int security_read_policy(void **data, size_t *len) 3224{ 3225 int rc; 3226 struct policy_file fp; 3227 3228 if (!ss_initialized) 3229 return -EINVAL; 3230 3231 *len = security_policydb_len(); 3232 3233 *data = vmalloc_user(*len); 3234 if (!*data) 3235 return -ENOMEM; 3236 3237 fp.data = *data; 3238 fp.len = *len; 3239 3240 read_lock(&policy_rwlock); 3241 rc = policydb_write(&policydb, &fp); 3242 read_unlock(&policy_rwlock); 3243 3244 if (rc) 3245 return rc; 3246 3247 *len = (unsigned long)fp.data - (unsigned long)*data; 3248 return 0; 3249 3250} 3251