1 /*
2 * String representation support for classes and permissions.
3 */
4 #include <sys/stat.h>
5 #include <dirent.h>
6 #include <fcntl.h>
7 #include <limits.h>
8 #include <unistd.h>
9 #include <errno.h>
10 #include <stddef.h>
11 #include <stdio.h>
12 #include <stdlib.h>
13 #include <string.h>
14 #include <stdint.h>
15 #include <ctype.h>
16 #include "selinux_internal.h"
17 #include "policy.h"
18 #include "mapping.h"
19
20 #define MAXVECTORS 8*sizeof(access_vector_t)
21
22 struct discover_class_node {
23 char *name;
24 security_class_t value;
25 char **perms;
26
27 struct discover_class_node *next;
28 };
29
30 static struct discover_class_node *discover_class_cache = NULL;
31
get_class_cache_entry_name(const char * s)32 static struct discover_class_node * get_class_cache_entry_name(const char *s)
33 {
34 struct discover_class_node *node = discover_class_cache;
35
36 for (; node != NULL && strcmp(s,node->name) != 0; node = node->next);
37
38 return node;
39 }
40
get_class_cache_entry_value(security_class_t c)41 static struct discover_class_node * get_class_cache_entry_value(security_class_t c)
42 {
43 struct discover_class_node *node = discover_class_cache;
44
45 for (; node != NULL && c != node->value; node = node->next);
46
47 return node;
48 }
49
discover_class(const char * s)50 static struct discover_class_node * discover_class(const char *s)
51 {
52 int fd, ret;
53 char path[PATH_MAX];
54 char buf[20];
55 DIR *dir;
56 struct dirent *dentry;
57 size_t i;
58
59 struct discover_class_node *node;
60
61 if (!selinux_mnt) {
62 errno = ENOENT;
63 return NULL;
64 }
65
66 /* allocate a node */
67 node = malloc(sizeof(struct discover_class_node));
68 if (node == NULL)
69 return NULL;
70
71 /* allocate array for perms */
72 node->perms = calloc(MAXVECTORS,sizeof(char*));
73 if (node->perms == NULL)
74 goto err1;
75
76 /* load up the name */
77 node->name = strdup(s);
78 if (node->name == NULL)
79 goto err2;
80
81 /* load up class index */
82 snprintf(path, sizeof path, "%s/class/%s/index", selinux_mnt,s);
83 fd = open(path, O_RDONLY | O_CLOEXEC);
84 if (fd < 0)
85 goto err3;
86
87 memset(buf, 0, sizeof(buf));
88 ret = read(fd, buf, sizeof(buf) - 1);
89 close(fd);
90 if (ret < 0)
91 goto err3;
92
93 if (sscanf(buf, "%hu", &node->value) != 1)
94 goto err3;
95
96 /* load up permission indices */
97 snprintf(path, sizeof path, "%s/class/%s/perms",selinux_mnt,s);
98 dir = opendir(path);
99 if (dir == NULL)
100 goto err3;
101
102 dentry = readdir(dir);
103 while (dentry != NULL) {
104 unsigned int value;
105 struct stat m;
106
107 snprintf(path, sizeof path, "%s/class/%s/perms/%s", selinux_mnt,s,dentry->d_name);
108 fd = open(path, O_RDONLY | O_CLOEXEC);
109 if (fd < 0)
110 goto err4;
111
112 if (fstat(fd, &m) < 0) {
113 close(fd);
114 goto err4;
115 }
116
117 if (m.st_mode & S_IFDIR) {
118 close(fd);
119 dentry = readdir(dir);
120 continue;
121 }
122
123 memset(buf, 0, sizeof(buf));
124 ret = read(fd, buf, sizeof(buf) - 1);
125 close(fd);
126 if (ret < 0)
127 goto err4;
128
129 if (sscanf(buf, "%u", &value) != 1)
130 goto err4;
131
132 if (value == 0 || value > MAXVECTORS)
133 goto err4;
134
135 node->perms[value-1] = strdup(dentry->d_name);
136 if (node->perms[value-1] == NULL)
137 goto err4;
138
139 dentry = readdir(dir);
140 }
141 closedir(dir);
142
143 node->next = discover_class_cache;
144 discover_class_cache = node;
145
146 return node;
147
148 err4:
149 closedir(dir);
150 for (i = 0; i < MAXVECTORS; i++)
151 free(node->perms[i]);
152 err3:
153 free(node->name);
154 err2:
155 free(node->perms);
156 err1:
157 free(node);
158 return NULL;
159 }
160
selinux_flush_class_cache(void)161 void selinux_flush_class_cache(void)
162 {
163 struct discover_class_node *cur = discover_class_cache, *prev = NULL;
164 size_t i;
165
166 while (cur != NULL) {
167 free(cur->name);
168
169 for (i = 0; i < MAXVECTORS; i++)
170 free(cur->perms[i]);
171
172 free(cur->perms);
173
174 prev = cur;
175 cur = cur->next;
176
177 free(prev);
178 }
179
180 discover_class_cache = NULL;
181 }
182
183
string_to_security_class(const char * s)184 security_class_t string_to_security_class(const char *s)
185 {
186 struct discover_class_node *node;
187
188 node = get_class_cache_entry_name(s);
189 if (node == NULL) {
190 node = discover_class(s);
191
192 if (node == NULL) {
193 errno = EINVAL;
194 return 0;
195 }
196 }
197
198 return map_class(node->value);
199 }
200
mode_to_security_class(mode_t m)201 security_class_t mode_to_security_class(mode_t m) {
202
203 if (S_ISREG(m))
204 return string_to_security_class("file");
205 if (S_ISDIR(m))
206 return string_to_security_class("dir");
207 if (S_ISCHR(m))
208 return string_to_security_class("chr_file");
209 if (S_ISBLK(m))
210 return string_to_security_class("blk_file");
211 if (S_ISFIFO(m))
212 return string_to_security_class("fifo_file");
213 if (S_ISLNK(m))
214 return string_to_security_class("lnk_file");
215 if (S_ISSOCK(m))
216 return string_to_security_class("sock_file");
217
218 errno = EINVAL;
219 return 0;
220 }
221
string_to_av_perm(security_class_t tclass,const char * s)222 access_vector_t string_to_av_perm(security_class_t tclass, const char *s)
223 {
224 struct discover_class_node *node;
225 security_class_t kclass = unmap_class(tclass);
226
227 node = get_class_cache_entry_value(kclass);
228 if (node != NULL) {
229 size_t i;
230 for (i = 0; i < MAXVECTORS && node->perms[i] != NULL; i++)
231 if (strcmp(node->perms[i],s) == 0)
232 return map_perm(tclass, UINT32_C(1)<<i);
233 }
234
235 errno = EINVAL;
236 return 0;
237 }
238
security_class_to_string(security_class_t tclass)239 const char *security_class_to_string(security_class_t tclass)
240 {
241 struct discover_class_node *node;
242
243 tclass = unmap_class(tclass);
244
245 node = get_class_cache_entry_value(tclass);
246 if (node == NULL)
247 return NULL;
248 else
249 return node->name;
250 }
251
security_av_perm_to_string(security_class_t tclass,access_vector_t av)252 const char *security_av_perm_to_string(security_class_t tclass,
253 access_vector_t av)
254 {
255 struct discover_class_node *node;
256 size_t i;
257
258 av = unmap_perm(tclass, av);
259 tclass = unmap_class(tclass);
260
261 node = get_class_cache_entry_value(tclass);
262 if (av && node)
263 for (i = 0; i<MAXVECTORS; i++)
264 if ((UINT32_C(1)<<i) & av)
265 return node->perms[i];
266
267 return NULL;
268 }
269
security_av_string(security_class_t tclass,access_vector_t av,char ** res)270 int security_av_string(security_class_t tclass, access_vector_t av, char **res)
271 {
272 unsigned int i;
273 size_t len = 5;
274 access_vector_t tmp = av;
275 int rc = 0;
276 const char *str;
277 char *ptr;
278
279 /* first pass computes the required length */
280 for (i = 0; tmp; tmp >>= 1, i++) {
281 if (tmp & 1) {
282 str = security_av_perm_to_string(tclass, av & (UINT32_C(1)<<i));
283 if (str)
284 len += strlen(str) + 1;
285 }
286 }
287
288 *res = malloc(len);
289 if (!*res) {
290 rc = -1;
291 goto out;
292 }
293
294 /* second pass constructs the string */
295 tmp = av;
296 ptr = *res;
297
298 if (!av) {
299 sprintf(ptr, "null");
300 goto out;
301 }
302
303 ptr += sprintf(ptr, "{ ");
304 for (i = 0; tmp; tmp >>= 1, i++) {
305 if (tmp & 1) {
306 str = security_av_perm_to_string(tclass, av & (UINT32_C(1)<<i));
307 if (str)
308 ptr += sprintf(ptr, "%s ", str);
309 }
310 }
311 sprintf(ptr, "}");
312 out:
313 return rc;
314 }
315
print_access_vector(security_class_t tclass,access_vector_t av)316 void print_access_vector(security_class_t tclass, access_vector_t av)
317 {
318 const char *permstr;
319 access_vector_t bit = 1;
320
321 if (av == 0) {
322 printf(" null");
323 return;
324 }
325
326 printf(" {");
327
328 while (av) {
329 if (av & bit) {
330 permstr = security_av_perm_to_string(tclass, bit);
331 if (!permstr)
332 break;
333 printf(" %s", permstr);
334 av &= ~bit;
335 }
336 bit <<= 1;
337 }
338
339 if (av)
340 printf(" 0x%x", av);
341 printf(" }");
342 }
343