1 /*
2 * Copyright 2011 Tresys Technology, LLC. All rights reserved.
3 *
4 * Redistribution and use in source and binary forms, with or without
5 * modification, are permitted provided that the following conditions are met:
6 *
7 * 1. Redistributions of source code must retain the above copyright notice,
8 * this list of conditions and the following disclaimer.
9 *
10 * 2. Redistributions in binary form must reproduce the above copyright notice,
11 * this list of conditions and the following disclaimer in the documentation
12 * and/or other materials provided with the distribution.
13 *
14 * THIS SOFTWARE IS PROVIDED BY TRESYS TECHNOLOGY, LLC ``AS IS'' AND ANY EXPRESS
15 * OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
16 * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO
17 * EVENT SHALL TRESYS TECHNOLOGY, LLC OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT,
18 * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
19 * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
20 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
21 * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE
22 * OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF
23 * ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
24 *
25 * The views and conclusions contained in the software and documentation are those
26 * of the authors and should not be interpreted as representing official policies,
27 * either expressed or implied, of Tresys Technology, LLC.
28 */
29
30 #include <stdlib.h>
31 #include <stdio.h>
32 #include <string.h>
33 #include <stdint.h>
34 #include <unistd.h>
35 #include <inttypes.h>
36
37 #include <sepol/policydb/conditional.h>
38 #include <sepol/errcodes.h>
39
40 #include "cil_internal.h"
41 #include "cil_flavor.h"
42 #include "cil_find.h"
43 #include "cil_mem.h"
44 #include "cil_policy.h"
45 #include "cil_tree.h"
46 #include "cil_list.h"
47 #include "cil_symtab.h"
48
49
50 enum cil_statement_list {
51 CIL_LIST_COMMON = 1,
52 CIL_LIST_DEFAULT_USER,
53 CIL_LIST_DEFAULT_ROLE,
54 CIL_LIST_DEFAULT_TYPE,
55 CIL_LIST_DEFAULT_RANGE,
56 CIL_LIST_SENSALIAS,
57 CIL_LIST_CATALIAS,
58 CIL_LIST_MLSCONSTRAIN,
59 CIL_LIST_MLSVALIDATETRANS,
60 CIL_LIST_POLICYCAP,
61 CIL_LIST_TYPEATTRIBUTE,
62 CIL_LIST_ROLEATTRIBUTE,
63 CIL_LIST_BOOL,
64 CIL_LIST_TYPE,
65 CIL_LIST_TYPEALIAS,
66 CIL_LIST_ROLE,
67 CIL_LIST_ROLEALLOW,
68 CIL_LIST_ROLETRANSITION,
69 CIL_LIST_USER,
70 CIL_LIST_CONSTRAINT,
71 CIL_LIST_VALIDATETRANS,
72 CIL_LIST_NUM_LISTS
73 };
74
__cil_gather_statements_helper(struct cil_tree_node * node,uint32_t * finished,void * extra_args)75 static int __cil_gather_statements_helper(struct cil_tree_node *node, uint32_t *finished, void *extra_args)
76 {
77 struct cil_list **lists;
78 int kind = 0;
79
80 lists = (struct cil_list **)extra_args;
81
82 switch (node->flavor) {
83 case CIL_BLOCK: {
84 struct cil_block *blk = node->data;
85 if (blk->is_abstract == CIL_TRUE) {
86 *finished = CIL_TREE_SKIP_HEAD;
87 }
88 break;
89 }
90 case CIL_MACRO:
91 *finished = CIL_TREE_SKIP_HEAD;
92 break;
93 case CIL_BOOLEANIF:
94 *finished = CIL_TREE_SKIP_HEAD;
95 break;
96 case CIL_COMMON:
97 kind = CIL_LIST_COMMON;
98 break;
99 case CIL_DEFAULTUSER:
100 kind = CIL_LIST_DEFAULT_USER;
101 break;
102 case CIL_DEFAULTROLE:
103 kind = CIL_LIST_DEFAULT_ROLE;
104 break;
105 case CIL_DEFAULTTYPE:
106 kind = CIL_LIST_DEFAULT_TYPE;
107 break;
108 case CIL_DEFAULTRANGE:
109 kind = CIL_LIST_DEFAULT_RANGE;
110 break;
111 case CIL_SENSALIAS:
112 kind = CIL_LIST_SENSALIAS;
113 break;
114 case CIL_CATALIAS:
115 kind = CIL_LIST_CATALIAS;
116 break;
117 case CIL_MLSCONSTRAIN:
118 kind = CIL_LIST_MLSCONSTRAIN;
119 break;
120 case CIL_MLSVALIDATETRANS:
121 kind = CIL_LIST_MLSVALIDATETRANS;
122 break;
123 case CIL_POLICYCAP:
124 kind = CIL_LIST_POLICYCAP;
125 break;
126 case CIL_TYPEATTRIBUTE: {
127 struct cil_typeattribute *attr = node->data;
128 if (strcmp(attr->datum.fqn, "cil_gen_require") != 0) {
129 kind = CIL_LIST_TYPEATTRIBUTE;
130 }
131 break;
132 }
133 case CIL_ROLEATTRIBUTE: {
134 struct cil_roleattribute *attr = node->data;
135 if (strcmp(attr->datum.fqn, "cil_gen_require") != 0) {
136 kind = CIL_LIST_ROLEATTRIBUTE;
137 }
138 break;
139 }
140 case CIL_BOOL:
141 kind = CIL_LIST_BOOL;
142 break;
143 case CIL_TYPE:
144 kind = CIL_LIST_TYPE;
145 break;
146 case CIL_TYPEALIAS:
147 kind = CIL_LIST_TYPEALIAS;
148 break;
149 case CIL_ROLE: {
150 struct cil_role *role = node->data;
151 if (strcmp(role->datum.fqn, "object_r") != 0) {
152 kind = CIL_LIST_ROLE;
153 }
154 break;
155 }
156 case CIL_ROLEALLOW:
157 kind = CIL_LIST_ROLEALLOW;
158 break;
159 case CIL_ROLETRANSITION:
160 kind = CIL_LIST_ROLETRANSITION;
161 break;
162 case CIL_USER:
163 kind = CIL_LIST_USER;
164 break;
165 case CIL_CONSTRAIN:
166 kind = CIL_LIST_CONSTRAINT;
167 break;
168 case CIL_VALIDATETRANS:
169 kind = CIL_LIST_VALIDATETRANS;
170 break;
171 default:
172 break;
173 }
174
175 if (kind > 0) {
176 cil_list_append(lists[kind], node->flavor, node->data);
177 }
178
179 return SEPOL_OK;
180 }
181
cil_gather_statements(struct cil_tree_node * start,struct cil_list * lists[])182 static void cil_gather_statements(struct cil_tree_node *start, struct cil_list *lists[])
183 {
184 cil_tree_walk(start, __cil_gather_statements_helper, NULL, NULL, lists);
185 }
186
cil_simple_rules_to_policy(FILE * out,struct cil_list * rules,const char * kind)187 static void cil_simple_rules_to_policy(FILE *out, struct cil_list *rules, const char *kind)
188 {
189 struct cil_list_item *i1;
190
191 cil_list_for_each(i1, rules) {
192 fprintf(out, "%s %s;\n", kind, DATUM(i1->data)->fqn);
193 }
194 }
195
cil_cats_to_policy(FILE * out,struct cil_cats * cats)196 static void cil_cats_to_policy(FILE *out, struct cil_cats *cats)
197 {
198 const char *lead = "";
199 struct cil_cat *first = NULL, *last = NULL, *cat;
200 struct cil_list_item *i1;
201
202 cil_list_for_each(i1, cats->datum_expr) {
203 cat = i1->data;
204 if (first == NULL) {
205 first = cat;
206 } else if (last == NULL) {
207 if (cat->value == first->value + 1) {
208 last = cat;
209 } else {
210 fprintf(out, "%s%s", lead, DATUM(first)->fqn);
211 lead = ",";
212 first = cat;
213 }
214 } else if (cat->value == last->value + 1) {
215 last = cat;
216 } else {
217 fprintf(out, "%s%s", lead, DATUM(first)->fqn);
218 lead = ",";
219 if (last->value >= first->value + 1) {
220 fprintf(out, ".");
221 } else {
222 fprintf(out, ",");
223 }
224 fprintf(out, "%s", DATUM(last)->fqn);
225 first = cat;
226 last = NULL;
227 }
228 }
229 if (first) {
230 fprintf(out, "%s%s", lead, DATUM(first)->fqn);
231 if (last != NULL) {
232 if (last->value >= first->value + 1) {
233 fprintf(out, ".");
234 } else {
235 fprintf(out, ",");
236 }
237 fprintf(out, "%s", DATUM(last)->fqn);
238 }
239 }
240 }
241
cil_level_to_policy(FILE * out,struct cil_level * level)242 static void cil_level_to_policy(FILE *out, struct cil_level *level)
243 {
244 fprintf(out, "%s", DATUM(level->sens)->fqn);
245 if (level->cats != NULL) {
246 fprintf(out, ":");
247 cil_cats_to_policy(out, level->cats);
248 }
249 }
250
cil_levels_simple_and_equal(struct cil_level * l1,struct cil_level * l2)251 static int cil_levels_simple_and_equal(struct cil_level *l1, struct cil_level *l2)
252 {
253 /* Mostly just want to detect s0 - s0 ranges */
254 if (l1 == l2)
255 return CIL_TRUE;
256
257 if (l1->sens == l2->sens && (l1->cats == NULL && l2->cats == NULL))
258 return CIL_TRUE;
259
260 return CIL_FALSE;
261 }
262
cil_levelrange_to_policy(FILE * out,struct cil_levelrange * lvlrange)263 static void cil_levelrange_to_policy(FILE *out, struct cil_levelrange *lvlrange)
264 {
265 cil_level_to_policy(out, lvlrange->low);
266 if (cil_levels_simple_and_equal(lvlrange->low, lvlrange->high) == CIL_FALSE) {
267 fprintf(out, " - ");
268 cil_level_to_policy(out, lvlrange->high);
269 }
270 }
271
cil_context_to_policy(FILE * out,struct cil_context * context,int mls)272 static void cil_context_to_policy(FILE *out, struct cil_context *context, int mls)
273 {
274 fprintf(out, "%s:", DATUM(context->user)->fqn);
275 fprintf(out, "%s:", DATUM(context->role)->fqn);
276 fprintf(out, "%s", DATUM(context->type)->fqn);
277 if (mls) {
278 fprintf(out, ":");
279 cil_levelrange_to_policy(out, context->range);
280 }
281 }
282
cil_cond_expr_to_policy(FILE * out,struct cil_list * expr,int first)283 static void cil_cond_expr_to_policy(FILE *out, struct cil_list *expr, int first)
284 {
285 struct cil_list_item *i1 = expr->head;
286
287 if (i1->flavor == CIL_OP) {
288 enum cil_flavor op = (enum cil_flavor)(uintptr_t)i1->data;
289 fprintf(out, "(");
290 switch (op) {
291 case CIL_NOT:
292 fprintf(out, "! ");
293 cil_cond_expr_to_policy(out, i1->next->data, CIL_FALSE);
294 break;
295 case CIL_OR:
296 cil_cond_expr_to_policy(out, i1->next->data, CIL_FALSE);
297 fprintf(out, " || ");
298 cil_cond_expr_to_policy(out, i1->next->next->data, CIL_FALSE);
299 break;
300 case CIL_AND:
301 cil_cond_expr_to_policy(out, i1->next->data, CIL_FALSE);
302 fprintf(out, " && ");
303 cil_cond_expr_to_policy(out, i1->next->next->data, CIL_FALSE);
304 break;
305 case CIL_XOR:
306 cil_cond_expr_to_policy(out, i1->next->data, CIL_FALSE);
307 fprintf(out, " ^ ");
308 cil_cond_expr_to_policy(out, i1->next->next->data, CIL_FALSE);
309 break;
310 case CIL_EQ:
311 cil_cond_expr_to_policy(out, i1->next->data, CIL_FALSE);
312 fprintf(out, " == ");
313 cil_cond_expr_to_policy(out, i1->next->next->data, CIL_FALSE);
314 break;
315 case CIL_NEQ:
316 cil_cond_expr_to_policy(out, i1->next->data, CIL_FALSE);
317 fprintf(out, " != ");
318 cil_cond_expr_to_policy(out, i1->next->next->data, CIL_FALSE);
319 break;
320 default:
321 fprintf(out, "???");
322 break;
323 }
324 fprintf(out, ")");
325 } else if (i1->flavor == CIL_DATUM) {
326 if (first == CIL_TRUE) {
327 fprintf(out, "(");
328 }
329 fprintf(out, "%s", DATUM(i1->data)->fqn);
330 if (first == CIL_TRUE) {
331 fprintf(out, ")");
332 }
333 } else if (i1->flavor == CIL_LIST) {
334 cil_cond_expr_to_policy(out, i1->data, CIL_FALSE);
335 } else {
336 fprintf(out, "???");
337 }
338 }
339
__cil_userattribute_len(struct cil_db * db,struct cil_userattribute * attr)340 static size_t __cil_userattribute_len(struct cil_db *db, struct cil_userattribute *attr)
341 {
342 ebitmap_node_t *unode;
343 unsigned int i;
344 size_t len = 0;
345
346 ebitmap_for_each_positive_bit(attr->users, unode, i) {
347 len += strlen(DATUM(db->val_to_user[i])->fqn);
348 len++;
349 }
350
351 return len;
352 }
353
__cil_cons_leaf_operand_len(struct cil_db * db,struct cil_list_item * operand)354 static size_t __cil_cons_leaf_operand_len(struct cil_db *db, struct cil_list_item *operand)
355 {
356 struct cil_list_item *i1;
357 enum cil_flavor flavor = operand->flavor;
358 size_t len = 0;
359
360 if (flavor == CIL_CONS_OPERAND) {
361 len = 2;
362 } else if (flavor == CIL_DATUM) {
363 struct cil_tree_node *node = NODE(operand->data);
364 if (node->flavor == CIL_USERATTRIBUTE) {
365 len = __cil_userattribute_len(db, operand->data);
366 len++; /* "{" */
367 } else {
368 len = strlen(DATUM(operand->data)->fqn);
369 }
370 } else if (flavor == CIL_LIST) {
371 len = 1; /* "{" */
372 cil_list_for_each(i1, (struct cil_list *)operand->data) {
373 struct cil_tree_node *node = NODE(operand->data);
374 if (node->flavor == CIL_USERATTRIBUTE) {
375 len = __cil_userattribute_len(db, operand->data);
376 } else {
377 len += strlen(DATUM(operand->data)->fqn);
378 len++; /* " " or "}" */
379 }
380 }
381 }
382
383 return len;
384 }
385
__cil_cons_leaf_op_len(struct cil_list_item * op)386 static size_t __cil_cons_leaf_op_len(struct cil_list_item *op)
387 {
388 enum cil_flavor flavor = (enum cil_flavor)(uintptr_t)op->data;
389 size_t len;
390
391 switch (flavor) {
392 case CIL_EQ:
393 len = 4; /* " == " */
394 break;
395 case CIL_NEQ:
396 len = 4; /* " != " */
397 break;
398 case CIL_CONS_DOM:
399 len = 5; /* " dom " */
400 break;
401 case CIL_CONS_DOMBY:
402 len = 7; /* " domby " */
403 break;
404 case CIL_CONS_INCOMP:
405 len = 8; /* " incomp " */
406 break;
407 default:
408 /* Should be impossible to be here */
409 len = 5; /* " ??? " */
410 }
411
412 return len;
413 }
414
cil_cons_expr_len(struct cil_db * db,struct cil_list * cons_expr)415 static size_t cil_cons_expr_len(struct cil_db *db, struct cil_list *cons_expr)
416 {
417 struct cil_list_item *i1;
418 enum cil_flavor op;
419 size_t len;
420
421 i1 = cons_expr->head;
422
423 op = (enum cil_flavor)(uintptr_t)i1->data;
424 switch (op) {
425 case CIL_NOT:
426 len = 6; /* "(not )" */
427 len += cil_cons_expr_len(db, i1->next->data);
428 break;
429 case CIL_AND:
430 len = 7; /* "( and )" */
431 len += cil_cons_expr_len(db, i1->next->data);
432 len += cil_cons_expr_len(db, i1->next->next->data);
433 break;
434 case CIL_OR:
435 len = 6; /* "( or )" */
436 len += cil_cons_expr_len(db, i1->next->data);
437 len += cil_cons_expr_len(db, i1->next->next->data);
438 break;
439 default:
440 len = 2; /* "()" */
441 len += __cil_cons_leaf_operand_len(db, i1->next);
442 len += __cil_cons_leaf_op_len(i1);
443 len += __cil_cons_leaf_operand_len(db, i1->next->next);
444 }
445
446 return len;
447 }
448
__cil_userattribute_to_string(struct cil_db * db,struct cil_userattribute * attr,char * new)449 static char *__cil_userattribute_to_string(struct cil_db *db, struct cil_userattribute *attr, char *new)
450 {
451 ebitmap_node_t *unode;
452 unsigned int i;
453 char *str;
454 size_t len;
455
456 ebitmap_for_each_positive_bit(attr->users, unode, i) {
457 str = DATUM(db->val_to_user[i])->fqn;
458 len = strlen(str);
459 memcpy(new, str, len);
460 new += len;
461 *new++ = ' ';
462 }
463
464 return new;
465 }
466
__cil_cons_leaf_operand_to_string(struct cil_db * db,struct cil_list_item * operand,char * new)467 static char *__cil_cons_leaf_operand_to_string(struct cil_db *db, struct cil_list_item *operand, char *new)
468 {
469 struct cil_list_item *i1;
470 enum cil_flavor flavor = operand->flavor;
471 const char *o_str;
472 size_t o_len;
473
474 if (flavor == CIL_CONS_OPERAND) {
475 enum cil_flavor o_flavor = (enum cil_flavor)(uintptr_t)operand->data;
476 switch (o_flavor) {
477 case CIL_CONS_U1:
478 o_str = "u1";
479 break;
480 case CIL_CONS_U2:
481 o_str = "u2";
482 break;
483 case CIL_CONS_U3:
484 o_str = "u3";
485 break;
486 case CIL_CONS_R1:
487 o_str = "r1";
488 break;
489 case CIL_CONS_R2:
490 o_str = "r2";
491 break;
492 case CIL_CONS_R3:
493 o_str = "r3";
494 break;
495 case CIL_CONS_T1:
496 o_str = "t1";
497 break;
498 case CIL_CONS_T2:
499 o_str = "t2";
500 break;
501 case CIL_CONS_T3:
502 o_str = "t3";
503 break;
504 case CIL_CONS_L1:
505 o_str = "l1";
506 break;
507 case CIL_CONS_L2:
508 o_str = "l2";
509 break;
510 case CIL_CONS_H1:
511 o_str = "h1";
512 break;
513 case CIL_CONS_H2:
514 o_str = "h2";
515 break;
516 default:
517 /* Impossible */
518 o_str = "??";
519 }
520 strcpy(new, o_str);
521 new += 2;
522 } else if (flavor == CIL_DATUM) {
523 struct cil_tree_node *node = NODE(operand->data);
524 if (node->flavor == CIL_USERATTRIBUTE) {
525 *new++ = '{';
526 new = __cil_userattribute_to_string(db, operand->data, new);
527 new--;
528 *new++ = '}';
529 } else {
530 o_str = DATUM(operand->data)->fqn;
531 o_len = strlen(o_str);
532 memcpy(new, o_str, o_len);
533 new += o_len;
534 }
535 } else if (flavor == CIL_LIST) {
536 *new++ = '{';
537 cil_list_for_each(i1, (struct cil_list *)operand->data) {
538 struct cil_tree_node *node = NODE(operand->data);
539 if (node->flavor == CIL_USERATTRIBUTE) {
540 new = __cil_userattribute_to_string(db, operand->data, new);
541 } else {
542 o_str = DATUM(operand->data)->fqn;
543 o_len = strlen(o_str);
544 memcpy(new, o_str, o_len);
545 new += o_len;
546 *new++ = ' ';
547 }
548 }
549 new--;
550 *new++ = '}';
551 }
552
553 return new;
554 }
555
__cil_cons_leaf_op_to_string(struct cil_list_item * op,char * new)556 static char *__cil_cons_leaf_op_to_string(struct cil_list_item *op, char *new)
557 {
558 enum cil_flavor flavor = (enum cil_flavor)(uintptr_t)op->data;
559 const char *op_str;
560 size_t len;
561
562 switch (flavor) {
563 case CIL_EQ:
564 op_str = " == ";
565 len = 4;
566 break;
567 case CIL_NEQ:
568 op_str = " != ";
569 len = 4;
570 break;
571 case CIL_CONS_DOM:
572 op_str = " dom ";
573 len = 5;
574 break;
575 case CIL_CONS_DOMBY:
576 op_str = " domby ";
577 len = 7;
578 break;
579 case CIL_CONS_INCOMP:
580 op_str = " incomp ";
581 len = 8;
582 break;
583 default:
584 /* Should be impossible to be here */
585 op_str = " ??? ";
586 len = 5;
587 }
588
589 strcpy(new, op_str);
590 new += len;
591
592 return new;
593 }
594
__cil_cons_expr_to_string(struct cil_db * db,struct cil_list * cons_expr,char * new)595 static char *__cil_cons_expr_to_string(struct cil_db *db, struct cil_list *cons_expr, char *new)
596 {
597 struct cil_list_item *i1;
598 enum cil_flavor op;
599
600 i1 = cons_expr->head;
601
602 op = (enum cil_flavor)(uintptr_t)i1->data;
603 switch (op) {
604 case CIL_NOT:
605 *new++ = '(';
606 strcpy(new, "not ");
607 new += 4;
608 new = __cil_cons_expr_to_string(db, i1->next->data, new);
609 *new++ = ')';
610 break;
611 case CIL_AND:
612 *new++ = '(';
613 new = __cil_cons_expr_to_string(db, i1->next->data, new);
614 strcpy(new, " and ");
615 new += 5;
616 new = __cil_cons_expr_to_string(db, i1->next->next->data, new);
617 *new++ = ')';
618 break;
619 case CIL_OR:
620 *new++ = '(';
621 new = __cil_cons_expr_to_string(db, i1->next->data, new);
622 strcpy(new, " or ");
623 new += 4;
624 new = __cil_cons_expr_to_string(db, i1->next->next->data, new);
625 *new++ = ')';
626 break;
627 default:
628 *new++ = '(';
629 new = __cil_cons_leaf_operand_to_string(db, i1->next, new);
630 new = __cil_cons_leaf_op_to_string(i1, new);
631 new = __cil_cons_leaf_operand_to_string(db, i1->next->next, new);
632 *new++ = ')';
633 }
634
635 return new;
636 }
637
cil_cons_expr_to_string(struct cil_db * db,struct cil_list * cons_expr)638 static char *cil_cons_expr_to_string(struct cil_db *db, struct cil_list *cons_expr)
639 {
640 char *new, *tail;
641 size_t len = cil_cons_expr_len(db, cons_expr);
642
643 new = cil_malloc(len+1);
644 tail = __cil_cons_expr_to_string(db, cons_expr, new);
645 *tail = '\0';
646
647 return new;
648 }
649
cil_classperms_to_string(struct cil_classperms * classperms,struct cil_list * classperms_strs)650 static void cil_classperms_to_string(struct cil_classperms *classperms, struct cil_list *classperms_strs)
651 {
652 struct cil_list_item *i1;
653 size_t len = 0;
654 char *new, *curr;
655
656 len += strlen(DATUM(classperms->class)->fqn) + 1;
657 cil_list_for_each(i1, classperms->perms) {
658 len += strlen(DATUM(i1->data)->fqn) + 1;
659 }
660 len += 4; /* for "{ " and " }" */
661
662 new = cil_malloc(len);
663 curr = new;
664
665 curr[len-1] = '\0';
666
667 len = strlen(DATUM(classperms->class)->fqn);
668 memcpy(curr, DATUM(classperms->class)->fqn, len);
669 curr += len;
670 *curr++ = ' ';
671
672 *curr++ = '{';
673 *curr++ = ' ';
674 cil_list_for_each(i1, classperms->perms) {
675 len = strlen(DATUM(i1->data)->fqn);
676 memcpy(curr, DATUM(i1->data)->fqn, len);
677 curr += len;
678 *curr++ = ' ';
679 }
680 *curr++ = '}';
681
682 cil_list_append(classperms_strs, CIL_STRING, new);
683 }
684
cil_classperms_to_strings(struct cil_list * classperms,struct cil_list * classperms_strs)685 static void cil_classperms_to_strings(struct cil_list *classperms, struct cil_list *classperms_strs)
686 {
687 struct cil_list_item *i1;
688
689 cil_list_for_each(i1, classperms) {
690 if (i1->flavor == CIL_CLASSPERMS) {
691 struct cil_classperms *cp = i1->data;
692 if (FLAVOR(cp->class) == CIL_CLASS) {
693 cil_classperms_to_string(cp, classperms_strs);
694 } else { /* MAP */
695 struct cil_list_item *i2 = NULL;
696 cil_list_for_each(i2, cp->perms) {
697 struct cil_perm *cmp = i2->data;
698 cil_classperms_to_strings(cmp->classperms, classperms_strs);
699 }
700 }
701 } else { /* SET */
702 struct cil_classperms_set *cp_set = i1->data;
703 struct cil_classpermission *cp = cp_set->set;
704 cil_classperms_to_strings(cp->classperms, classperms_strs);
705 }
706 }
707 }
708
cil_class_decls_to_policy(FILE * out,struct cil_list * classorder)709 static void cil_class_decls_to_policy(FILE *out, struct cil_list *classorder)
710 {
711 struct cil_list_item *i1;
712
713 cil_list_for_each(i1, classorder) {
714 fprintf(out, "class %s\n", DATUM(i1->data)->fqn);
715 }
716 }
717
cil_sid_decls_to_policy(FILE * out,struct cil_list * sidorder)718 static void cil_sid_decls_to_policy(FILE *out, struct cil_list *sidorder)
719 {
720 struct cil_list_item *i1;
721
722 cil_list_for_each(i1, sidorder) {
723 fprintf(out, "sid %s\n", DATUM(i1->data)->fqn);
724 }
725 }
726
cil_commons_to_policy(FILE * out,struct cil_list * commons)727 static void cil_commons_to_policy(FILE *out, struct cil_list *commons)
728 {
729 struct cil_list_item *i1;
730 struct cil_class* common;
731 struct cil_tree_node *node;
732 struct cil_tree_node *perm;
733
734 cil_list_for_each(i1, commons) {
735 common = i1->data;
736 node = NODE(&common->datum);
737 perm = node->cl_head;
738
739 fprintf(out, "common %s {", common->datum.fqn);
740 while (perm != NULL) {
741 fprintf(out, "%s ", DATUM(perm->data)->fqn);
742 perm = perm->next;
743 }
744 fprintf(out, "}\n");
745 }
746 }
747
cil_classes_to_policy(FILE * out,struct cil_list * classorder)748 static void cil_classes_to_policy(FILE *out, struct cil_list *classorder)
749 {
750 struct cil_list_item *i1;
751 struct cil_class *class;
752 struct cil_tree_node *node;
753
754 cil_list_for_each(i1, classorder) {
755 class = i1->data;
756 node = NODE(&class->datum);
757
758 fprintf(out, "class %s", class->datum.fqn);
759 if (class->common != NULL) {
760 fprintf(out, " inherits %s", class->common->datum.fqn);
761 }
762 if (node->cl_head != NULL) {
763 struct cil_tree_node *perm = node->cl_head;
764 fprintf(out, " {");
765 while (perm != NULL) {
766 fprintf(out, " %s", DATUM(perm->data)->fqn);
767 perm = perm->next;
768 }
769 fprintf(out, " }");
770 }
771 fprintf(out, "\n");
772 }
773 }
774
cil_defaults_to_policy(FILE * out,struct cil_list * defaults,const char * kind)775 static void cil_defaults_to_policy(FILE *out, struct cil_list *defaults, const char *kind)
776 {
777 struct cil_list_item *i1, *i2, *i3;
778 struct cil_default *def;
779 struct cil_list *class_list;
780
781 cil_list_for_each(i1, defaults) {
782 def = i1->data;
783 fprintf(out, "%s {",kind);
784 cil_list_for_each(i2, def->class_datums) {
785 class_list = cil_expand_class(i2->data);
786 cil_list_for_each(i3, class_list) {
787 fprintf(out, " %s", DATUM(i3->data)->fqn);
788 }
789 cil_list_destroy(&class_list, CIL_FALSE);
790 }
791 fprintf(out, " }");
792 if (def->object == CIL_DEFAULT_SOURCE) {
793 fprintf(out," %s",CIL_KEY_SOURCE);
794 } else if (def->object == CIL_DEFAULT_TARGET) {
795 fprintf(out," %s",CIL_KEY_TARGET);
796 }
797 fprintf(out,";\n");
798 }
799 }
800
cil_default_ranges_to_policy(FILE * out,struct cil_list * defaults)801 static void cil_default_ranges_to_policy(FILE *out, struct cil_list *defaults)
802 {
803 struct cil_list_item *i1, *i2, *i3;
804 struct cil_defaultrange *def;
805 struct cil_list *class_list;
806
807 cil_list_for_each(i1, defaults) {
808 def = i1->data;
809 fprintf(out, "default_range {");
810 cil_list_for_each(i2, def->class_datums) {
811 class_list = cil_expand_class(i2->data);
812 cil_list_for_each(i3, class_list) {
813 fprintf(out, " %s", DATUM(i3->data)->fqn);
814 }
815 cil_list_destroy(&class_list, CIL_FALSE);
816 }
817 fprintf(out, " }");
818
819 switch (def->object_range) {
820 case CIL_DEFAULT_SOURCE_LOW:
821 fprintf(out," %s %s", CIL_KEY_SOURCE, CIL_KEY_LOW);
822 break;
823 case CIL_DEFAULT_SOURCE_HIGH:
824 fprintf(out," %s %s", CIL_KEY_SOURCE, CIL_KEY_HIGH);
825 break;
826 case CIL_DEFAULT_SOURCE_LOW_HIGH:
827 fprintf(out," %s %s", CIL_KEY_SOURCE, CIL_KEY_LOW_HIGH);
828 break;
829 case CIL_DEFAULT_TARGET_LOW:
830 fprintf(out," %s %s", CIL_KEY_TARGET, CIL_KEY_LOW);
831 break;
832 case CIL_DEFAULT_TARGET_HIGH:
833 fprintf(out," %s %s", CIL_KEY_TARGET, CIL_KEY_HIGH);
834 break;
835 case CIL_DEFAULT_TARGET_LOW_HIGH:
836 fprintf(out," %s %s", CIL_KEY_TARGET, CIL_KEY_LOW_HIGH);
837 break;
838 case CIL_DEFAULT_GLBLUB:
839 fprintf(out," %s", CIL_KEY_GLBLUB);
840 break;
841 default:
842 break;
843 }
844 fprintf(out,";\n");
845 }
846 }
847
cil_sensitivities_to_policy(FILE * out,struct cil_list * sensorder,struct cil_list * all_aliases)848 static void cil_sensitivities_to_policy(FILE *out, struct cil_list *sensorder, struct cil_list *all_aliases)
849 {
850 struct cil_list_item *i1, *i2;
851 struct cil_sens *sens;
852 struct cil_list *aliases = NULL;
853 struct cil_alias *alias;
854 struct cil_sens *actual;
855 int num_aliases;
856
857 cil_list_for_each(i1, sensorder) {
858 sens = i1->data;
859 num_aliases = 0;
860 cil_list_for_each(i2, all_aliases) {
861 alias = i2->data;
862 actual = alias->actual;
863 if (sens == actual) {
864 if (num_aliases == 0) {
865 cil_list_init(&aliases, CIL_LIST);
866 }
867 cil_list_append(aliases, CIL_SENSALIAS, alias);
868 num_aliases++;
869 }
870 }
871 fprintf(out, "sensitivity %s", sens->datum.fqn);
872 if (num_aliases > 0) {
873 fprintf(out, " alias");
874 if (num_aliases > 1) {
875 fprintf(out, " {");
876 }
877 cil_list_for_each(i2, aliases) {
878 alias = i2->data;
879 fprintf(out, " %s", alias->datum.fqn);
880 }
881 if (num_aliases > 1) {
882 fprintf(out, " }");
883 }
884 cil_list_destroy(&aliases, CIL_FALSE);
885 }
886 fprintf(out, ";\n");
887 }
888 }
889
cil_dominance_to_policy(FILE * out,struct cil_list * sensorder)890 static void cil_dominance_to_policy(FILE *out, struct cil_list *sensorder)
891 {
892 struct cil_list_item *item;
893 struct cil_sens *sens;
894
895 fprintf(out, "dominance {");
896 cil_list_for_each(item, sensorder) {
897 sens = item->data;
898 fprintf(out, " %s", sens->datum.fqn);
899 }
900 fprintf(out, " }\n");
901 }
902
cil_categories_to_policy(FILE * out,struct cil_list * catorder,struct cil_list * all_aliases)903 static void cil_categories_to_policy(FILE *out, struct cil_list *catorder, struct cil_list *all_aliases)
904 {
905 struct cil_list_item *i1, *i2;
906 struct cil_sens *cat;
907 struct cil_list *aliases = NULL;
908 struct cil_alias *alias;
909 struct cil_sens *actual;
910 int num_aliases;
911
912 cil_list_for_each(i1, catorder) {
913 cat = i1->data;
914 num_aliases = 0;
915 cil_list_for_each(i2, all_aliases) {
916 alias = i2->data;
917 actual = alias->actual;
918 if (cat == actual) {
919 if (num_aliases == 0) {
920 cil_list_init(&aliases, CIL_LIST);
921 }
922 cil_list_append(aliases, CIL_CATALIAS, alias);
923 num_aliases++;
924 }
925 }
926 fprintf(out, "category %s",cat->datum.fqn);
927 if (num_aliases > 0) {
928 fprintf(out, " alias");
929 if (num_aliases > 1) {
930 fprintf(out, " { ");
931 }
932 cil_list_for_each(i2, aliases) {
933 alias = i2->data;
934 fprintf(out, " %s", alias->datum.fqn);
935 }
936 if (num_aliases > 1) {
937 fprintf(out, " }");
938 }
939 cil_list_destroy(&aliases, CIL_FALSE);
940 }
941 fprintf(out, ";\n");
942 }
943 }
944
cil_levels_to_policy(FILE * out,struct cil_list * sensorder)945 static void cil_levels_to_policy(FILE *out, struct cil_list *sensorder)
946 {
947 struct cil_list_item *i1, *i2;
948 struct cil_sens *sens;
949
950 cil_list_for_each(i1, sensorder) {
951 sens = i1->data;
952 if (sens->cats_list) {
953 cil_list_for_each(i2, sens->cats_list) {
954 fprintf(out, "level %s:",sens->datum.fqn);
955 cil_cats_to_policy(out, i2->data);
956 fprintf(out,";\n");
957 }
958 } else {
959 fprintf(out, "level %s;\n",sens->datum.fqn);
960 }
961 }
962 }
963
cil_mlsconstrains_to_policy(FILE * out,struct cil_db * db,struct cil_list * mlsconstrains)964 static void cil_mlsconstrains_to_policy(FILE *out, struct cil_db *db, struct cil_list *mlsconstrains)
965 {
966 struct cil_list_item *i1, *i2;
967 struct cil_constrain *cons;
968 struct cil_list *classperms_strs;
969 char *cp_str;
970 char *expr_str;
971
972 cil_list_for_each(i1, mlsconstrains) {
973 cons = i1->data;
974 cil_list_init(&classperms_strs, CIL_LIST);
975 cil_classperms_to_strings(cons->classperms, classperms_strs);
976 expr_str = cil_cons_expr_to_string(db, cons->datum_expr);
977 cil_list_for_each(i2, classperms_strs) {
978 cp_str = i2->data;
979 fprintf(out, "mlsconstrain %s %s;\n", cp_str, expr_str);
980 free(cp_str);
981 }
982 free(expr_str);
983 cil_list_destroy(&classperms_strs, CIL_FALSE);
984 }
985 }
986
cil_validatetrans_to_policy(FILE * out,struct cil_db * db,struct cil_list * validatetrans,char * kind)987 static void cil_validatetrans_to_policy(FILE *out, struct cil_db *db, struct cil_list *validatetrans, char *kind)
988 {
989 struct cil_list_item *i1, *i2;
990 struct cil_validatetrans *trans;
991 struct cil_list *class_list;
992 struct cil_class *class;
993 char *expr_str;
994
995 cil_list_for_each(i1, validatetrans) {
996 trans = i1->data;
997 class_list = cil_expand_class(trans->class);
998 expr_str = cil_cons_expr_to_string(db, trans->datum_expr);
999 cil_list_for_each(i2, class_list) {
1000 class = i2->data;
1001 fprintf(out, "%s %s %s;\n", kind, class->datum.fqn, expr_str);
1002 }
1003 free(expr_str);
1004 cil_list_destroy(&class_list, CIL_FALSE);
1005 }
1006 }
1007
cil_bools_to_policy(FILE * out,struct cil_list * bools)1008 static void cil_bools_to_policy(FILE *out, struct cil_list *bools)
1009 {
1010 struct cil_list_item *i1;
1011 struct cil_bool *bool;
1012 const char *value;
1013
1014 cil_list_for_each(i1, bools) {
1015 bool = i1->data;
1016 value = bool->value ? "true" : "false";
1017 fprintf(out, "bool %s %s;\n", bool->datum.fqn, value);
1018 }
1019 }
1020
cil_typealiases_to_policy(FILE * out,struct cil_list * types,struct cil_list * all_aliases)1021 static void cil_typealiases_to_policy(FILE *out, struct cil_list *types, struct cil_list *all_aliases)
1022 {
1023 struct cil_list_item *i1, *i2;
1024 struct cil_type *type;
1025 struct cil_list *aliases = NULL;
1026 struct cil_alias *alias;
1027 struct cil_type *actual;
1028 int num_aliases;
1029
1030 cil_list_for_each(i1, types) {
1031 type = i1->data;
1032 num_aliases = 0;
1033 cil_list_for_each(i2, all_aliases) {
1034 alias = i2->data;
1035 actual = alias->actual;
1036 if (type == actual) {
1037 if (num_aliases == 0) {
1038 cil_list_init(&aliases, CIL_LIST);
1039 }
1040 cil_list_append(aliases, CIL_TYPEALIAS, alias);
1041 num_aliases++;
1042 }
1043 }
1044 if (num_aliases > 0) {
1045 fprintf(out, "typealias %s alias", type->datum.fqn);
1046 if (num_aliases > 1) {
1047 fprintf(out, " {");
1048 }
1049 cil_list_for_each(i2, aliases) {
1050 alias = i2->data;
1051 fprintf(out, " %s", alias->datum.fqn);
1052 }
1053 if (num_aliases > 1) {
1054 fprintf(out, " }");
1055 }
1056 fprintf(out, ";\n");
1057 cil_list_destroy(&aliases, CIL_FALSE);
1058 }
1059 }
1060 }
1061
cil_typebounds_to_policy(FILE * out,struct cil_list * types)1062 static void cil_typebounds_to_policy(FILE *out, struct cil_list *types)
1063 {
1064 struct cil_list_item *i1;
1065 struct cil_type *child;
1066 struct cil_type *parent;
1067
1068 cil_list_for_each(i1, types) {
1069 child = i1->data;
1070 if (child->bounds != NULL) {
1071 parent = child->bounds;
1072 fprintf(out, "typebounds %s %s;\n", parent->datum.fqn, child->datum.fqn);
1073 }
1074 }
1075 }
1076
cil_typeattributes_to_policy(FILE * out,struct cil_list * types,struct cil_list * attributes)1077 static void cil_typeattributes_to_policy(FILE *out, struct cil_list *types, struct cil_list *attributes)
1078 {
1079 struct cil_list_item *i1, *i2;
1080 struct cil_type *type;
1081 struct cil_typeattribute *attribute;
1082 int first = CIL_TRUE;
1083
1084 cil_list_for_each(i1, types) {
1085 type = i1->data;
1086 cil_list_for_each(i2, attributes) {
1087 attribute = i2->data;
1088 if (!attribute->keep)
1089 continue;
1090 if (ebitmap_get_bit(attribute->types, type->value)) {
1091 if (first) {
1092 fprintf(out, "typeattribute %s %s", type->datum.fqn, attribute->datum.fqn);
1093 first = CIL_FALSE;
1094 } else {
1095 fprintf(out, ", %s", attribute->datum.fqn);
1096 }
1097 }
1098 }
1099 if (!first) {
1100 fprintf(out, ";\n");
1101 first = CIL_TRUE;
1102 }
1103 }
1104 }
1105
cil_xperms_to_policy(FILE * out,struct cil_permissionx * permx)1106 static void cil_xperms_to_policy(FILE *out, struct cil_permissionx *permx)
1107 {
1108 ebitmap_node_t *node;
1109 unsigned int i, first = 0, last = 0;
1110 int need_first = CIL_TRUE, need_last = CIL_TRUE;
1111 const char *kind;
1112
1113 if (permx->kind == CIL_PERMX_KIND_IOCTL) {
1114 kind = "ioctl";
1115 } else {
1116 kind = "???";
1117 }
1118
1119 fprintf(out, "%s %s {", DATUM(permx->obj)->fqn, kind);
1120
1121 ebitmap_for_each_positive_bit(permx->perms, node, i) {
1122 if (need_first == CIL_TRUE) {
1123 first = i;
1124 need_first = CIL_FALSE;
1125 } else if (need_last == CIL_TRUE) {
1126 if (i == first+1) {
1127 last = i;
1128 need_last = CIL_FALSE;
1129 } else {
1130 fprintf(out, " 0x%x", first);
1131 first = i;
1132 }
1133 } else if (i == last+1) {
1134 last = i;
1135 } else {
1136 if (last > first+1) {
1137 fprintf(out, " 0x%x-0x%x", first, last);
1138 } else {
1139 fprintf(out, " 0x%x 0x%x", first, last);
1140 }
1141 first = i;
1142 need_last = CIL_TRUE;
1143 }
1144 }
1145 if (need_first == CIL_FALSE) {
1146 if (need_last == CIL_FALSE) {
1147 fprintf(out, " 0x%x-0x%x", first, last);
1148 } else {
1149 fprintf(out, " 0x%x", first);
1150 }
1151 }
1152 fprintf(out," }");
1153 }
1154
cil_av_rulex_to_policy(FILE * out,struct cil_avrule * rule)1155 static void cil_av_rulex_to_policy(FILE *out, struct cil_avrule *rule)
1156 {
1157 const char *kind;
1158 struct cil_symtab_datum *src, *tgt;
1159
1160 src = rule->src;
1161 tgt = rule->tgt;
1162
1163 switch (rule->rule_kind) {
1164 case CIL_AVRULE_ALLOWED:
1165 kind = "allowxperm";
1166 break;
1167 case CIL_AVRULE_AUDITALLOW:
1168 kind = "auditallowxperm";
1169 break;
1170 case CIL_AVRULE_DONTAUDIT:
1171 kind = "dontauditxperm";
1172 break;
1173 case CIL_AVRULE_NEVERALLOW:
1174 kind = "neverallowxperm";
1175 break;
1176 default:
1177 kind = "???";
1178 break;
1179 }
1180
1181 fprintf(out, "%s %s %s : ", kind, src->fqn, tgt->fqn);
1182 cil_xperms_to_policy(out, rule->perms.x.permx);
1183 fprintf(out, ";\n");
1184 }
1185
cil_av_rule_to_policy(FILE * out,struct cil_avrule * rule)1186 static void cil_av_rule_to_policy(FILE *out, struct cil_avrule *rule)
1187 {
1188 const char *kind;
1189 struct cil_symtab_datum *src, *tgt;
1190 struct cil_list *classperms_strs;
1191 struct cil_list_item *i1;
1192
1193 src = rule->src;
1194 tgt = rule->tgt;
1195
1196 switch (rule->rule_kind) {
1197 case CIL_AVRULE_ALLOWED:
1198 kind = "allow";
1199 break;
1200 case CIL_AVRULE_AUDITALLOW:
1201 kind = "auditallow";
1202 break;
1203 case CIL_AVRULE_DONTAUDIT:
1204 kind = "dontaudit";
1205 break;
1206 case CIL_AVRULE_NEVERALLOW:
1207 kind = "neverallow";
1208 break;
1209 default:
1210 kind = "???";
1211 break;
1212 }
1213
1214 cil_list_init(&classperms_strs, CIL_LIST);
1215 cil_classperms_to_strings(rule->perms.classperms, classperms_strs);
1216 cil_list_for_each(i1, classperms_strs) {
1217 char *cp_str = i1->data;
1218 fprintf(out, "%s %s %s : %s;\n", kind, src->fqn, tgt->fqn, cp_str);
1219 free(cp_str);
1220 }
1221 cil_list_destroy(&classperms_strs, CIL_FALSE);
1222 }
1223
cil_type_rule_to_policy(FILE * out,struct cil_type_rule * rule)1224 static void cil_type_rule_to_policy(FILE *out, struct cil_type_rule *rule)
1225 {
1226 const char *kind;
1227 struct cil_symtab_datum *src, *tgt, *res;
1228 struct cil_list *class_list;
1229 struct cil_list_item *i1;
1230
1231 src = rule->src;
1232 tgt = rule->tgt;
1233 res = rule->result;
1234
1235 switch (rule->rule_kind) {
1236 case CIL_TYPE_TRANSITION:
1237 kind = "type_transition";
1238 break;
1239 case CIL_TYPE_MEMBER:
1240 kind = "type_member";
1241 break;
1242 case CIL_TYPE_CHANGE:
1243 kind = "type_change";
1244 break;
1245 default:
1246 kind = "???";
1247 break;
1248 }
1249
1250 class_list = cil_expand_class(rule->obj);
1251 cil_list_for_each(i1, class_list) {
1252 fprintf(out, "%s %s %s : %s %s;\n", kind, src->fqn, tgt->fqn, DATUM(i1->data)->fqn, res->fqn);
1253 }
1254 cil_list_destroy(&class_list, CIL_FALSE);
1255 }
1256
cil_nametypetransition_to_policy(FILE * out,struct cil_nametypetransition * trans)1257 static void cil_nametypetransition_to_policy(FILE *out, struct cil_nametypetransition *trans)
1258 {
1259 struct cil_symtab_datum *src, *tgt, *res;
1260 struct cil_name *name;
1261 struct cil_list *class_list;
1262 struct cil_list_item *i1;
1263
1264 src = trans->src;
1265 tgt = trans->tgt;
1266 name = trans->name;
1267 res = trans->result;
1268
1269 class_list = cil_expand_class(trans->obj);
1270 cil_list_for_each(i1, class_list) {
1271 fprintf(out, "type_transition %s %s : %s %s \"%s\";\n", src->fqn, tgt->fqn, DATUM(i1->data)->fqn, res->fqn, name->datum.fqn);
1272 }
1273 cil_list_destroy(&class_list, CIL_FALSE);
1274 }
1275
cil_rangetransition_to_policy(FILE * out,struct cil_rangetransition * trans)1276 static void cil_rangetransition_to_policy(FILE *out, struct cil_rangetransition *trans)
1277 {
1278 struct cil_symtab_datum *src, *exec;
1279 struct cil_list *class_list;
1280 struct cil_list_item *i1;
1281
1282 src = trans->src;
1283 exec = trans->exec;
1284
1285 class_list = cil_expand_class(trans->obj);
1286 cil_list_for_each(i1, class_list) {
1287 fprintf(out, "range_transition %s %s : %s ", src->fqn, exec->fqn, DATUM(i1->data)->fqn);
1288 cil_levelrange_to_policy(out, trans->range);
1289 fprintf(out, ";\n");
1290 }
1291 cil_list_destroy(&class_list, CIL_FALSE);
1292 }
1293
cil_typepermissive_to_policy(FILE * out,struct cil_typepermissive * rule)1294 static void cil_typepermissive_to_policy(FILE *out, struct cil_typepermissive *rule)
1295 {
1296 fprintf(out, "permissive %s;\n", DATUM(rule->type)->fqn);
1297 }
1298
1299 struct block_te_rules_extra {
1300 FILE *out;
1301 enum cil_flavor flavor;
1302 uint32_t rule_kind;
1303 };
1304
__cil_block_te_rules_to_policy_helper(struct cil_tree_node * node,uint32_t * finished,void * extra_args)1305 static int __cil_block_te_rules_to_policy_helper(struct cil_tree_node *node, uint32_t *finished, void *extra_args)
1306 {
1307 struct block_te_rules_extra *args = extra_args;
1308
1309 switch (node->flavor) {
1310 case CIL_BLOCK: {
1311 struct cil_block *blk = node->data;
1312 if (blk->is_abstract == CIL_TRUE) {
1313 *finished = CIL_TREE_SKIP_HEAD;
1314 }
1315 break;
1316 }
1317 case CIL_MACRO:
1318 *finished = CIL_TREE_SKIP_HEAD;
1319 break;
1320 case CIL_BOOLEANIF:
1321 *finished = CIL_TREE_SKIP_HEAD;
1322 break;
1323 case CIL_AVRULE:
1324 case CIL_AVRULEX:
1325 if (args->flavor == node->flavor) {
1326 struct cil_avrule *rule = node->data;
1327 if (args->rule_kind == rule->rule_kind) {
1328 if (rule->is_extended) {
1329 cil_av_rulex_to_policy(args->out, rule);
1330 } else {
1331 cil_av_rule_to_policy(args->out, rule);
1332 }
1333 }
1334 }
1335 break;
1336 case CIL_TYPE_RULE:
1337 if (args->flavor == node->flavor) {
1338 struct cil_type_rule *rule = node->data;
1339 if (args->rule_kind == rule->rule_kind) {
1340 cil_type_rule_to_policy(args->out, rule);
1341 }
1342 }
1343
1344 break;
1345 case CIL_NAMETYPETRANSITION:
1346 if (args->flavor == node->flavor) {
1347 cil_nametypetransition_to_policy(args->out, node->data);
1348 }
1349 break;
1350 case CIL_RANGETRANSITION:
1351 if (args->flavor == node->flavor) {
1352 cil_rangetransition_to_policy(args->out, node->data);
1353 }
1354
1355 break;
1356 case CIL_TYPEPERMISSIVE:
1357 if (args->flavor == node->flavor) {
1358 cil_typepermissive_to_policy(args->out, node->data);
1359 }
1360 break;
1361 default:
1362 break;
1363 }
1364
1365 return SEPOL_OK;
1366 }
1367
cil_block_te_rules_to_policy(FILE * out,struct cil_tree_node * start,int mls)1368 static void cil_block_te_rules_to_policy(FILE *out, struct cil_tree_node *start, int mls)
1369 {
1370 struct block_te_rules_extra args;
1371
1372 args.out = out;
1373
1374 args.flavor = CIL_TYPEPERMISSIVE;
1375 args.rule_kind = 0;
1376 cil_tree_walk(start, __cil_block_te_rules_to_policy_helper, NULL, NULL, &args);
1377
1378 args.flavor = CIL_AVRULE;
1379 args.rule_kind = CIL_AVRULE_ALLOWED;
1380 cil_tree_walk(start, __cil_block_te_rules_to_policy_helper, NULL, NULL, &args);
1381 args.rule_kind = CIL_AVRULE_AUDITALLOW;
1382 cil_tree_walk(start, __cil_block_te_rules_to_policy_helper, NULL, NULL, &args);
1383 args.rule_kind = CIL_AVRULE_DONTAUDIT;
1384 cil_tree_walk(start, __cil_block_te_rules_to_policy_helper, NULL, NULL, &args);
1385 args.rule_kind = CIL_AVRULE_NEVERALLOW;
1386 cil_tree_walk(start, __cil_block_te_rules_to_policy_helper, NULL, NULL, &args);
1387
1388 args.flavor = CIL_AVRULEX;
1389 args.rule_kind = CIL_AVRULE_ALLOWED;
1390 cil_tree_walk(start, __cil_block_te_rules_to_policy_helper, NULL, NULL, &args);
1391 args.rule_kind = CIL_AVRULE_AUDITALLOW;
1392 cil_tree_walk(start, __cil_block_te_rules_to_policy_helper, NULL, NULL, &args);
1393 args.rule_kind = CIL_AVRULE_DONTAUDIT;
1394 cil_tree_walk(start, __cil_block_te_rules_to_policy_helper, NULL, NULL, &args);
1395 args.rule_kind = CIL_AVRULE_NEVERALLOW;
1396 cil_tree_walk(start, __cil_block_te_rules_to_policy_helper, NULL, NULL, &args);
1397
1398 args.flavor = CIL_TYPE_RULE;
1399 args.rule_kind = CIL_TYPE_TRANSITION;
1400 cil_tree_walk(start, __cil_block_te_rules_to_policy_helper, NULL, NULL, &args);
1401 args.rule_kind = CIL_TYPE_MEMBER;
1402 cil_tree_walk(start, __cil_block_te_rules_to_policy_helper, NULL, NULL, &args);
1403 args.rule_kind = CIL_TYPE_CHANGE;
1404 cil_tree_walk(start, __cil_block_te_rules_to_policy_helper, NULL, NULL, &args);
1405 args.rule_kind = CIL_AVRULE_TYPE;
1406 cil_tree_walk(start, __cil_block_te_rules_to_policy_helper, NULL, NULL, &args);
1407
1408 args.flavor = CIL_NAMETYPETRANSITION;
1409 args.rule_kind = 0;
1410 cil_tree_walk(start, __cil_block_te_rules_to_policy_helper, NULL, NULL, &args);
1411
1412 if (mls == CIL_TRUE) {
1413 args.flavor = CIL_RANGETRANSITION;
1414 args.rule_kind = 0;
1415 cil_tree_walk(start, __cil_block_te_rules_to_policy_helper, NULL, NULL, &args);
1416 }
1417 }
1418
1419 struct te_rules_extra {
1420 FILE *out;
1421 int mls;
1422 };
1423
__cil_te_rules_to_policy_helper(struct cil_tree_node * node,uint32_t * finished,void * extra_args)1424 static int __cil_te_rules_to_policy_helper(struct cil_tree_node *node, uint32_t *finished, void *extra_args)
1425 {
1426 struct te_rules_extra *args = extra_args;
1427
1428 switch (node->flavor) {
1429 case CIL_BLOCK: {
1430 struct cil_block *blk = node->data;
1431 if (blk->is_abstract == CIL_TRUE) {
1432 *finished = CIL_TREE_SKIP_HEAD;
1433 }
1434 break;
1435 }
1436 case CIL_MACRO:
1437 *finished = CIL_TREE_SKIP_HEAD;
1438 break;
1439 case CIL_BOOLEANIF: {
1440 struct cil_booleanif *bool = node->data;
1441 struct cil_tree_node *n;
1442 struct cil_condblock *cb;
1443
1444 fprintf(args->out, "if ");
1445 cil_cond_expr_to_policy(args->out, bool->datum_expr, CIL_TRUE);
1446 fprintf(args->out," {\n");
1447 n = node->cl_head;
1448 cb = n != NULL ? n->data : NULL;
1449 if (cb && cb->flavor == CIL_CONDTRUE) {
1450 cil_block_te_rules_to_policy(args->out, n, args->mls);
1451 n = n->next;
1452 cb = n != NULL ? n->data : NULL;
1453 }
1454 if (cb && cb->flavor == CIL_CONDFALSE) {
1455 fprintf(args->out,"} else {\n");
1456 cil_block_te_rules_to_policy(args->out, n, args->mls);
1457 }
1458 fprintf(args->out,"}\n");
1459 *finished = CIL_TREE_SKIP_HEAD;
1460 break;
1461 }
1462 default:
1463 break;
1464 }
1465
1466 return SEPOL_OK;
1467 }
1468
cil_te_rules_to_policy(FILE * out,struct cil_tree_node * head,int mls)1469 static void cil_te_rules_to_policy(FILE *out, struct cil_tree_node *head, int mls)
1470 {
1471 struct te_rules_extra args;
1472
1473 args.out = out;
1474 args.mls = mls;
1475
1476 cil_block_te_rules_to_policy(out, head, mls);
1477 cil_tree_walk(head, __cil_te_rules_to_policy_helper, NULL, NULL, &args);
1478 }
1479
cil_roles_to_policy(FILE * out,struct cil_list * rules)1480 static void cil_roles_to_policy(FILE *out, struct cil_list *rules)
1481 {
1482 struct cil_list_item *i1;
1483 struct cil_role *role;
1484
1485 cil_list_for_each(i1, rules) {
1486 role = i1->data;
1487 if (strcmp(role->datum.fqn,"object_r") == 0)
1488 continue;
1489 fprintf(out, "role %s;\n", role->datum.fqn);
1490 }
1491 }
1492
cil_role_types_to_policy(FILE * out,struct cil_list * roles,struct cil_list * types)1493 static void cil_role_types_to_policy(FILE *out, struct cil_list *roles, struct cil_list *types)
1494 {
1495 struct cil_list_item *i1, *i2;
1496 struct cil_role *role;
1497 struct cil_type *type;
1498 int first = CIL_TRUE;
1499
1500 cil_list_for_each(i1, roles) {
1501 role = i1->data;
1502 if (strcmp(role->datum.fqn,"object_r") == 0)
1503 continue;
1504 if (role->types) {
1505 cil_list_for_each(i2, types) {
1506 type = i2->data;
1507 if (ebitmap_get_bit(role->types, type->value)) {
1508 if (first) {
1509 fprintf(out, "role %s types { %s", role->datum.fqn, type->datum.fqn);
1510 first = CIL_FALSE;
1511 } else {
1512 fprintf(out, " %s", type->datum.fqn);
1513 }
1514 }
1515 }
1516 if (!first) {
1517 fprintf(out, " }");
1518 first = CIL_TRUE;
1519 }
1520 fprintf(out, ";\n");
1521 }
1522 }
1523 }
1524
cil_roleattributes_to_policy(FILE * out,struct cil_list * roles,struct cil_list * attributes)1525 static void cil_roleattributes_to_policy(FILE *out, struct cil_list *roles, struct cil_list *attributes)
1526 {
1527 struct cil_list_item *i1, *i2;
1528 struct cil_role *role;
1529 struct cil_roleattribute *attribute;
1530 int first = CIL_TRUE;
1531
1532 cil_list_for_each(i1, roles) {
1533 role = i1->data;
1534 if (strcmp(role->datum.fqn,"object_r") == 0)
1535 continue;
1536 cil_list_for_each(i2, attributes) {
1537 attribute = i2->data;
1538 if (ebitmap_get_bit(attribute->roles, role->value)) {
1539 if (first) {
1540 fprintf(out, "roleattribute %s %s", role->datum.fqn, attribute->datum.fqn);
1541 first = CIL_FALSE;
1542 } else {
1543 fprintf(out, ", %s", attribute->datum.fqn);
1544 }
1545 }
1546 }
1547 if (!first) {
1548 fprintf(out, ";\n");
1549 first = CIL_TRUE;
1550 }
1551 }
1552 }
1553
cil_roleallows_to_policy(FILE * out,struct cil_list * roleallows)1554 static void cil_roleallows_to_policy(FILE *out, struct cil_list *roleallows)
1555 {
1556 struct cil_list_item *i1;
1557 struct cil_roleallow *allow;
1558
1559 cil_list_for_each(i1, roleallows) {
1560 allow = i1->data;
1561 fprintf(out, "allow %s %s;\n", DATUM(allow->src)->fqn, DATUM(allow->tgt)->fqn);
1562 }
1563 }
1564
cil_roletransitions_to_policy(FILE * out,struct cil_list * roletransitions)1565 static void cil_roletransitions_to_policy(FILE *out, struct cil_list *roletransitions)
1566 {
1567 struct cil_list_item *i1, *i2;
1568 struct cil_list *class_list;
1569 struct cil_roletransition *trans;
1570
1571
1572 cil_list_for_each(i1, roletransitions) {
1573 trans = i1->data;
1574 class_list = cil_expand_class(trans->obj);
1575 cil_list_for_each(i2, class_list) {
1576 fprintf(out, "role_transition %s %s : %s %s;\n", DATUM(trans->src)->fqn, DATUM(trans->tgt)->fqn, DATUM(i2->data)->fqn, DATUM(trans->result)->fqn);
1577 }
1578 cil_list_destroy(&class_list, CIL_FALSE);
1579 }
1580 }
1581
cil_users_to_policy(FILE * out,int mls,struct cil_list * users,struct cil_list * all_roles)1582 static void cil_users_to_policy(FILE *out, int mls, struct cil_list *users, struct cil_list *all_roles)
1583 {
1584 struct cil_list_item *i1, *i2;
1585 struct cil_user *user;
1586 struct cil_list *roles = NULL;
1587 struct cil_role *role;
1588 int num_roles;
1589
1590 cil_list_for_each(i1, users) {
1591 user = i1->data;
1592 num_roles = 0;
1593 fprintf(out, "user %s",user->datum.fqn);
1594 cil_list_for_each(i2, all_roles) {
1595 role = i2->data;
1596 if (ebitmap_get_bit(user->roles, role->value)) {
1597 if (num_roles == 0) {
1598 cil_list_init(&roles, CIL_LIST);
1599 }
1600 cil_list_append(roles, CIL_ROLE, role);
1601 num_roles++;
1602 }
1603 }
1604 if (num_roles > 0) {
1605 fprintf(out, " roles");
1606 if (num_roles > 1) {
1607 fprintf(out, " {");
1608 }
1609 cil_list_for_each(i2, roles) {
1610 role = i2->data;
1611 fprintf(out, " %s", role->datum.fqn);
1612 }
1613 if (num_roles > 1) {
1614 fprintf(out, " }");
1615 }
1616 cil_list_destroy(&roles, CIL_FALSE);
1617 }
1618
1619 if (mls == CIL_TRUE && user->dftlevel != NULL) {
1620 fprintf(out, " level ");
1621 cil_level_to_policy(out, user->dftlevel);
1622 }
1623
1624 if (mls == CIL_TRUE && user->range != NULL) {
1625 fprintf(out, " range ");
1626 cil_levelrange_to_policy(out, user->range);
1627 }
1628
1629 fprintf(out,";\n");
1630 }
1631 }
1632
cil_constrains_to_policy(FILE * out,struct cil_db * db,struct cil_list * constrains)1633 static void cil_constrains_to_policy(FILE *out, struct cil_db *db, struct cil_list *constrains)
1634 {
1635 struct cil_list_item *i1, *i2;
1636 struct cil_constrain *cons;
1637 struct cil_list *classperms_strs;
1638 char *cp_str;
1639 char *expr_str;
1640
1641 cil_list_for_each(i1, constrains) {
1642 cons = i1->data;
1643 cil_list_init(&classperms_strs, CIL_LIST);
1644 cil_classperms_to_strings(cons->classperms, classperms_strs);
1645 expr_str = cil_cons_expr_to_string(db, cons->datum_expr);
1646 cil_list_for_each(i2, classperms_strs) {
1647 cp_str = i2->data;
1648 fprintf(out, "constrain %s %s;\n",cp_str, expr_str);
1649 free(cp_str);
1650 }
1651 free(expr_str);
1652 cil_list_destroy(&classperms_strs, CIL_FALSE);
1653 }
1654 }
1655
cil_sid_contexts_to_policy(FILE * out,struct cil_list * sids,int mls)1656 static void cil_sid_contexts_to_policy(FILE *out, struct cil_list *sids, int mls)
1657 {
1658 struct cil_list_item *i1;
1659 struct cil_sid *sid;
1660
1661 cil_list_for_each(i1, sids) {
1662 sid = i1->data;
1663 if (sid->context) {
1664 fprintf(out, "sid %s ", sid->datum.fqn);
1665 cil_context_to_policy(out, sid->context, mls);
1666 fprintf(out,"\n");
1667 }
1668 }
1669 }
1670
cil_fsuses_to_policy(FILE * out,struct cil_sort * fsuses,int mls)1671 static void cil_fsuses_to_policy(FILE *out, struct cil_sort *fsuses, int mls)
1672 {
1673 unsigned i;
1674 struct cil_fsuse *fsuse;
1675
1676 for (i=0; i<fsuses->count; i++) {
1677 fsuse = fsuses->array[i];
1678 if (fsuse->type == CIL_FSUSE_XATTR) {
1679 fprintf(out, "fs_use_xattr %s ", fsuse->fs_str);
1680 cil_context_to_policy(out, fsuse->context, mls);
1681 fprintf(out,";\n");
1682 }
1683 }
1684
1685 for (i=0; i<fsuses->count; i++) {
1686 fsuse = fsuses->array[i];
1687 if (fsuse->type == CIL_FSUSE_TASK) {
1688 fprintf(out, "fs_use_task %s ", fsuse->fs_str);
1689 cil_context_to_policy(out, fsuse->context, mls);
1690 fprintf(out,";\n");
1691 }
1692 }
1693
1694 for (i=0; i<fsuses->count; i++) {
1695 fsuse = fsuses->array[i];
1696 if (fsuse->type == CIL_FSUSE_TRANS) {
1697 fprintf(out, "fs_use_trans %s ", fsuse->fs_str);
1698 cil_context_to_policy(out, fsuse->context, mls);
1699 fprintf(out,";\n");
1700 }
1701 }
1702 }
1703
cil_genfscons_to_policy(FILE * out,struct cil_sort * genfscons,int mls)1704 static void cil_genfscons_to_policy(FILE *out, struct cil_sort *genfscons, int mls)
1705 {
1706 unsigned i;
1707 struct cil_genfscon *genfscon;
1708
1709 for (i=0; i<genfscons->count; i++) {
1710 genfscon = genfscons->array[i];
1711 fprintf(out, "genfscon %s %s ", genfscon->fs_str, genfscon->path_str);
1712 cil_context_to_policy(out, genfscon->context, mls);
1713 fprintf(out, "\n");
1714 }
1715 }
1716
cil_ibpkeycons_to_policy(FILE * out,struct cil_sort * ibpkeycons,int mls)1717 static void cil_ibpkeycons_to_policy(FILE *out, struct cil_sort *ibpkeycons, int mls)
1718 {
1719 uint32_t i = 0;
1720
1721 for (i = 0; i < ibpkeycons->count; i++) {
1722 struct cil_ibpkeycon *ibpkeycon = (struct cil_ibpkeycon *)ibpkeycons->array[i];
1723
1724 fprintf(out, "ibpkeycon %s ", ibpkeycon->subnet_prefix_str);
1725 fprintf(out, "%d ", ibpkeycon->pkey_low);
1726 fprintf(out, "%d ", ibpkeycon->pkey_high);
1727 cil_context_to_policy(out, ibpkeycon->context, mls);
1728 fprintf(out, "\n");
1729 }
1730 }
1731
cil_ibendportcons_to_policy(FILE * out,struct cil_sort * ibendportcons,int mls)1732 static void cil_ibendportcons_to_policy(FILE *out, struct cil_sort *ibendportcons, int mls)
1733 {
1734 uint32_t i;
1735
1736 for (i = 0; i < ibendportcons->count; i++) {
1737 struct cil_ibendportcon *ibendportcon = (struct cil_ibendportcon *)ibendportcons->array[i];
1738
1739 fprintf(out, "ibendportcon %s ", ibendportcon->dev_name_str);
1740 fprintf(out, "%u ", ibendportcon->port);
1741 cil_context_to_policy(out, ibendportcon->context, mls);
1742 fprintf(out, "\n");
1743 }
1744 }
1745
cil_portcons_to_policy(FILE * out,struct cil_sort * portcons,int mls)1746 static void cil_portcons_to_policy(FILE *out, struct cil_sort *portcons, int mls)
1747 {
1748 unsigned i;
1749 struct cil_portcon *portcon;
1750
1751 for (i=0; i<portcons->count; i++) {
1752 portcon = portcons->array[i];
1753 fprintf(out, "portcon ");
1754 if (portcon->proto == CIL_PROTOCOL_UDP) {
1755 fprintf(out, "udp ");
1756 } else if (portcon->proto == CIL_PROTOCOL_TCP) {
1757 fprintf(out, "tcp ");
1758 } else if (portcon->proto == CIL_PROTOCOL_DCCP) {
1759 fprintf(out, "dccp ");
1760 } else if (portcon->proto == CIL_PROTOCOL_SCTP) {
1761 fprintf(out, "sctp ");
1762 }
1763 if (portcon->port_low == portcon->port_high) {
1764 fprintf(out, "%d ", portcon->port_low);
1765 } else {
1766 fprintf(out, "%d-%d ", portcon->port_low, portcon->port_high);
1767 }
1768 cil_context_to_policy(out, portcon->context, mls);
1769 fprintf(out, "\n");
1770 }
1771 }
1772
cil_netifcons_to_policy(FILE * out,struct cil_sort * netifcons,int mls)1773 static void cil_netifcons_to_policy(FILE *out, struct cil_sort *netifcons, int mls)
1774 {
1775 unsigned i;
1776 struct cil_netifcon *netifcon;
1777
1778 for (i=0; i<netifcons->count; i++) {
1779 netifcon = netifcons->array[i];
1780 fprintf(out, "netifcon %s ", netifcon->interface_str);
1781 cil_context_to_policy(out, netifcon->if_context, mls);
1782 fprintf(out, " ");
1783 cil_context_to_policy(out, netifcon->packet_context, mls);
1784 fprintf(out, "\n");
1785 }
1786 }
1787
cil_nodecons_to_policy(FILE * out,struct cil_sort * nodecons,int mls)1788 static void cil_nodecons_to_policy(FILE *out, struct cil_sort *nodecons, int mls)
1789 {
1790 unsigned i;
1791 struct cil_nodecon *nodecon;
1792 char *addr, *mask;
1793
1794 for (i=0; i<nodecons->count; i++) {
1795 nodecon = nodecons->array[i];
1796 fprintf(out, "nodecon ");
1797
1798 if (nodecon->addr->family == AF_INET) {
1799 errno = 0;
1800 addr = cil_malloc(INET_ADDRSTRLEN);
1801 inet_ntop(nodecon->addr->family, &nodecon->addr->ip.v4, addr, INET_ADDRSTRLEN);
1802 if (errno == 0) {
1803 fprintf(out, "%s ",addr);
1804 } else {
1805 fprintf(out, "[INVALID] ");
1806 }
1807 free(addr);
1808
1809 errno = 0;
1810 mask = cil_malloc(INET_ADDRSTRLEN);
1811 inet_ntop(nodecon->mask->family, &nodecon->mask->ip.v4, mask, INET_ADDRSTRLEN);
1812 if (errno == 0) {
1813 fprintf(out, "%s ",mask);
1814 } else {
1815 fprintf(out, "[INVALID] ");
1816 }
1817 free(mask);
1818 } else {
1819 errno = 0;
1820 addr = cil_malloc(INET6_ADDRSTRLEN);
1821 inet_ntop(nodecon->addr->family, &nodecon->addr->ip.v6, addr, INET6_ADDRSTRLEN);
1822 if (errno == 0) {
1823 fprintf(out, "%s ",addr);
1824 } else {
1825 fprintf(out, "[INVALID] ");
1826 }
1827 free(addr);
1828
1829 errno = 0;
1830 mask = cil_malloc(INET6_ADDRSTRLEN);
1831 inet_ntop(nodecon->mask->family, &nodecon->mask->ip.v6, mask, INET6_ADDRSTRLEN);
1832 if (errno == 0) {
1833 fprintf(out, "%s ",mask);
1834 } else {
1835 fprintf(out, "[INVALID] ");
1836 }
1837 free(mask);
1838 }
1839
1840 cil_context_to_policy(out, nodecon->context, mls);
1841 fprintf(out, "\n");
1842 }
1843 }
1844
cil_pirqcons_to_policy(FILE * out,struct cil_sort * pirqcons,int mls)1845 static void cil_pirqcons_to_policy(FILE *out, struct cil_sort *pirqcons, int mls)
1846 {
1847 unsigned i;
1848 struct cil_pirqcon *pirqcon;
1849
1850 for (i = 0; i<pirqcons->count; i++) {
1851 pirqcon = pirqcons->array[i];
1852 fprintf(out, "pirqcon %d ", pirqcon->pirq);
1853 cil_context_to_policy(out, pirqcon->context, mls);
1854 fprintf(out, ";\n");
1855 }
1856 }
1857
cil_iomemcons_to_policy(FILE * out,struct cil_sort * iomemcons,int mls)1858 static void cil_iomemcons_to_policy(FILE *out, struct cil_sort *iomemcons, int mls)
1859 {
1860 unsigned i;
1861 struct cil_iomemcon *iomemcon;
1862
1863 for (i = 0; i<iomemcons->count; i++) {
1864 iomemcon = iomemcons->array[i];
1865 if (iomemcon->iomem_low == iomemcon->iomem_high) {
1866 fprintf(out, "iomemcon %"PRIx64" ", iomemcon->iomem_low);
1867 } else {
1868 fprintf(out, "iomemcon %"PRIx64"-%"PRIx64" ", iomemcon->iomem_low, iomemcon->iomem_high);
1869 }
1870 cil_context_to_policy(out, iomemcon->context, mls);
1871 fprintf(out, ";\n");
1872 }
1873 }
1874
cil_ioportcons_to_policy(FILE * out,struct cil_sort * ioportcons,int mls)1875 static void cil_ioportcons_to_policy(FILE *out, struct cil_sort *ioportcons, int mls)
1876 {
1877 unsigned i;
1878 struct cil_ioportcon *ioportcon;
1879
1880 for (i = 0; i < ioportcons->count; i++) {
1881 ioportcon = ioportcons->array[i];
1882 fprintf(out, "ioportcon 0x%x-0x%x ", ioportcon->ioport_low, ioportcon->ioport_high);
1883 cil_context_to_policy(out, ioportcon->context, mls);
1884 fprintf(out, ";\n");
1885 }
1886 }
1887
cil_pcidevicecons_to_policy(FILE * out,struct cil_sort * pcidevicecons,int mls)1888 static void cil_pcidevicecons_to_policy(FILE *out, struct cil_sort *pcidevicecons, int mls)
1889 {
1890 unsigned i;
1891 struct cil_pcidevicecon *pcidevicecon;
1892
1893 for (i = 0; i < pcidevicecons->count; i++) {
1894 pcidevicecon = pcidevicecons->array[i];
1895 fprintf(out, "pcidevicecon 0x%x ", pcidevicecon->dev);
1896 cil_context_to_policy(out, pcidevicecon->context, mls);
1897 fprintf(out, ";\n");
1898 }
1899 }
1900
cil_devicetreecons_to_policy(FILE * out,struct cil_sort * devicetreecons,int mls)1901 static void cil_devicetreecons_to_policy(FILE *out, struct cil_sort *devicetreecons, int mls)
1902 {
1903 unsigned i;
1904 struct cil_devicetreecon *devicetreecon;
1905
1906 for (i = 0; i < devicetreecons->count; i++) {
1907 devicetreecon = devicetreecons->array[i];
1908 fprintf(out, "devicetreecon %s ", devicetreecon->path);
1909 cil_context_to_policy(out, devicetreecon->context, mls);
1910 fprintf(out, ";\n");
1911 }
1912 }
1913
cil_gen_policy(FILE * out,struct cil_db * db)1914 void cil_gen_policy(FILE *out, struct cil_db *db)
1915 {
1916 unsigned i;
1917 struct cil_tree_node *head = db->ast->root;
1918 struct cil_list *lists[CIL_LIST_NUM_LISTS];
1919
1920 for (i=0; i<CIL_LIST_NUM_LISTS; i++) {
1921 cil_list_init(&lists[i], CIL_LIST);
1922 }
1923
1924 cil_gather_statements(head, lists);
1925
1926 cil_class_decls_to_policy(out, db->classorder);
1927
1928 cil_sid_decls_to_policy(out, db->sidorder);
1929
1930 cil_commons_to_policy(out, lists[CIL_LIST_COMMON]);
1931 cil_classes_to_policy(out, db->classorder);
1932
1933 cil_defaults_to_policy(out, lists[CIL_LIST_DEFAULT_USER], "default_user");
1934 cil_defaults_to_policy(out, lists[CIL_LIST_DEFAULT_ROLE], "default_role");
1935 cil_defaults_to_policy(out, lists[CIL_LIST_DEFAULT_TYPE], "default_type");
1936
1937 if (db->mls == CIL_TRUE) {
1938 cil_default_ranges_to_policy(out, lists[CIL_LIST_DEFAULT_RANGE]);
1939 cil_sensitivities_to_policy(out, db->sensitivityorder, lists[CIL_LIST_SENSALIAS]);
1940 cil_dominance_to_policy(out, db->sensitivityorder);
1941 cil_categories_to_policy(out, db->catorder, lists[CIL_LIST_CATALIAS]);
1942 cil_levels_to_policy(out, db->sensitivityorder);
1943 cil_mlsconstrains_to_policy(out, db, lists[CIL_LIST_MLSCONSTRAIN]);
1944 cil_validatetrans_to_policy(out, db, lists[CIL_LIST_MLSVALIDATETRANS], CIL_KEY_MLSVALIDATETRANS);
1945 }
1946
1947 cil_simple_rules_to_policy(out, lists[CIL_LIST_POLICYCAP], CIL_KEY_POLICYCAP);
1948
1949 cil_simple_rules_to_policy(out, lists[CIL_LIST_TYPEATTRIBUTE], "attribute");
1950 cil_simple_rules_to_policy(out, lists[CIL_LIST_ROLEATTRIBUTE], "attribute_role");
1951
1952 cil_bools_to_policy(out, lists[CIL_LIST_BOOL]);
1953
1954 cil_simple_rules_to_policy(out, lists[CIL_LIST_TYPE], "type");
1955 cil_typealiases_to_policy(out, lists[CIL_LIST_TYPE], lists[CIL_LIST_TYPEALIAS]);
1956 cil_typebounds_to_policy(out, lists[CIL_LIST_TYPE]);
1957 cil_typeattributes_to_policy(out, lists[CIL_LIST_TYPE], lists[CIL_LIST_TYPEATTRIBUTE]);
1958 cil_te_rules_to_policy(out, head, db->mls);
1959
1960 cil_roles_to_policy(out, lists[CIL_LIST_ROLE]);
1961 cil_role_types_to_policy(out, lists[CIL_LIST_ROLE], lists[CIL_LIST_TYPE]);
1962 cil_roleattributes_to_policy(out, lists[CIL_LIST_ROLE], lists[CIL_LIST_ROLEATTRIBUTE]);
1963 cil_roleallows_to_policy(out, lists[CIL_LIST_ROLEALLOW]);
1964 cil_roletransitions_to_policy(out, lists[CIL_LIST_ROLETRANSITION]);
1965
1966 cil_users_to_policy(out, db->mls, lists[CIL_LIST_USER], lists[CIL_LIST_ROLE]);
1967
1968 cil_constrains_to_policy(out, db, lists[CIL_LIST_CONSTRAINT]);
1969 cil_validatetrans_to_policy(out, db, lists[CIL_LIST_VALIDATETRANS], CIL_KEY_VALIDATETRANS);
1970
1971 cil_sid_contexts_to_policy(out, db->sidorder, db->mls);
1972 cil_fsuses_to_policy(out, db->fsuse, db->mls);
1973 cil_genfscons_to_policy(out, db->genfscon, db->mls);
1974 cil_portcons_to_policy(out, db->portcon, db->mls);
1975 cil_netifcons_to_policy(out, db->netifcon, db->mls);
1976 cil_ibpkeycons_to_policy(out, db->ibpkeycon, db->mls);
1977 cil_ibendportcons_to_policy(out, db->ibendportcon, db->mls);
1978 cil_nodecons_to_policy(out, db->nodecon, db->mls);
1979 cil_pirqcons_to_policy(out, db->pirqcon, db->mls);
1980 cil_iomemcons_to_policy(out, db->iomemcon, db->mls);
1981 cil_ioportcons_to_policy(out, db->ioportcon, db->mls);
1982 cil_pcidevicecons_to_policy(out, db->pcidevicecon, db->mls);
1983 cil_devicetreecons_to_policy(out, db->devicetreecon, db->mls);
1984
1985 for (i=0; i<CIL_LIST_NUM_LISTS; i++) {
1986 cil_list_destroy(&lists[i], CIL_FALSE);
1987 }
1988
1989 }
1990