• Home
  • Line#
  • Scopes#
  • Navigate#
  • Raw
  • Download
1 /*
2  * Author : Stephen Smalley, <sds@tycho.nsa.gov>
3  */
4 
5 /*
6  * Updated: Trusted Computer Solutions, Inc. <dgoeddel@trustedcs.com>
7  *
8  *	Support for enhanced MLS infrastructure.
9  *
10  * Updated: David Caplan, <dac@tresys.com>
11  *
12  * 	Added conditional policy language extensions
13  *
14  * Updated: Joshua Brindle <jbrindle@tresys.com>
15  *	    Karl MacMillan <kmacmillan@mentalrootkit.com>
16  *          Jason Tang     <jtang@tresys.com>
17  *
18  *	Added support for binary policy modules
19  *
20  * Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
21  * Copyright (C) 2003 - 2008 Tresys Technology, LLC
22  * Copyright (C) 2007 Red Hat Inc.
23  * Copyright (C) 2017 Mellanox Techonologies Inc.
24  *	This program is free software; you can redistribute it and/or modify
25  *  	it under the terms of the GNU General Public License as published by
26  *	the Free Software Foundation, version 2.
27  */
28 
29 /* FLASK */
30 
31 #include <sys/types.h>
32 #include <assert.h>
33 #include <stdarg.h>
34 #include <stdint.h>
35 #include <stdio.h>
36 #include <stdlib.h>
37 #include <string.h>
38 #include <sys/socket.h>
39 #include <netinet/in.h>
40 #ifndef IPPROTO_DCCP
41 #define IPPROTO_DCCP 33
42 #endif
43 #ifndef IPPROTO_SCTP
44 #define IPPROTO_SCTP 132
45 #endif
46 #include <arpa/inet.h>
47 #include <stdlib.h>
48 #include <limits.h>
49 #include <inttypes.h>
50 #include <ctype.h>
51 
52 #include <sepol/policydb/expand.h>
53 #include <sepol/policydb/policydb.h>
54 #include <sepol/policydb/services.h>
55 #include <sepol/policydb/conditional.h>
56 #include <sepol/policydb/hierarchy.h>
57 #include <sepol/policydb/polcaps.h>
58 #include "queue.h"
59 #include "checkpolicy.h"
60 #include "module_compiler.h"
61 #include "policy_define.h"
62 
63 extern void init_parser(int pass_number);
64 __attribute__ ((format(printf, 1, 2)))
65 extern void yyerror2(const char *fmt, ...);
66 
67 policydb_t *policydbp;
68 queue_t id_queue = 0;
69 unsigned int pass;
70 int mlspol = 0;
71 
72 extern unsigned long policydb_lineno;
73 extern unsigned long source_lineno;
74 extern unsigned int policydb_errors;
75 extern char source_file[PATH_MAX];
76 
77 extern int yywarn(const char *msg);
78 extern int yyerror(const char *msg);
79 
80 /* initialize all of the state variables for the scanner/parser */
init_parser(int pass_number)81 void init_parser(int pass_number)
82 {
83 	policydb_lineno = 1;
84 	source_lineno = 1;
85 	policydb_errors = 0;
86 	pass = pass_number;
87 }
88 
yyerror2(const char * fmt,...)89 void yyerror2(const char *fmt, ...)
90 {
91 	char errormsg[256];
92 	va_list ap;
93 	va_start(ap, fmt);
94 	vsnprintf(errormsg, sizeof(errormsg), fmt, ap);
95 	yyerror(errormsg);
96 	va_end(ap);
97 }
98 
insert_separator(int push)99 int insert_separator(int push)
100 {
101 	int error;
102 
103 	if (push)
104 		error = queue_push(id_queue, 0);
105 	else
106 		error = queue_insert(id_queue, 0);
107 
108 	if (error) {
109 		yyerror("queue overflow");
110 		return -1;
111 	}
112 	return 0;
113 }
114 
insert_id(const char * id,int push)115 int insert_id(const char *id, int push)
116 {
117 	char *newid = 0;
118 	int error;
119 
120 	newid = strdup(id);
121 	if (!newid) {
122 		yyerror("out of memory");
123 		return -1;
124 	}
125 	if (push)
126 		error = queue_push(id_queue, (queue_element_t) newid);
127 	else
128 		error = queue_insert(id_queue, (queue_element_t) newid);
129 
130 	if (error) {
131 		yyerror("queue overflow");
132 		free(newid);
133 		return -1;
134 	}
135 	return 0;
136 }
137 
138 /* If the identifier has a dot within it and that its first character
139    is not a dot then return 1, else return 0. */
id_has_dot(const char * id)140 static int id_has_dot(const char *id)
141 {
142 	if (strchr(id, '.') >= id + 1) {
143 		return 1;
144 	}
145 	return 0;
146 }
147 
define_class(void)148 int define_class(void)
149 {
150 	char *id = 0;
151 	class_datum_t *datum = 0;
152 	int ret;
153 	uint32_t value;
154 
155 	if (pass == 2) {
156 		id = queue_remove(id_queue);
157 		free(id);
158 		return 0;
159 	}
160 
161 	id = (char *)queue_remove(id_queue);
162 	if (!id) {
163 		yyerror("no class name for class definition?");
164 		return -1;
165 	}
166 	datum = (class_datum_t *) malloc(sizeof(class_datum_t));
167 	if (!datum) {
168 		yyerror("out of memory");
169 		goto bad;
170 	}
171 	memset(datum, 0, sizeof(class_datum_t));
172 	ret = declare_symbol(SYM_CLASSES, id, datum, &value, &value);
173 	switch (ret) {
174 	case -3:{
175 			yyerror("Out of memory!");
176 			goto bad;
177 		}
178 	case -2:{
179 			yyerror2("duplicate declaration of class %s", id);
180 			goto bad;
181 		}
182 	case -1:{
183 			yyerror("could not declare class here");
184 			goto bad;
185 		}
186 	case 0:
187 	case 1:{
188 			break;
189 		}
190 	default:{
191 			assert(0);	/* should never get here */
192 		}
193 	}
194 	datum->s.value = value;
195 	return 0;
196 
197       bad:
198 	if (id)
199 		free(id);
200 	if (datum)
201 		free(datum);
202 	return -1;
203 }
204 
define_permissive(void)205 int define_permissive(void)
206 {
207 	char *type = NULL;
208 	struct type_datum *t;
209 	int rc = 0;
210 
211 	type = queue_remove(id_queue);
212 
213 	if (!type) {
214 		yyerror2("forgot to include type in permissive definition?");
215 		rc = -1;
216 		goto out;
217 	}
218 
219 	if (pass == 1)
220 		goto out;
221 
222 	if (!is_id_in_scope(SYM_TYPES, type)) {
223 		yyerror2("type %s is not within scope", type);
224 		rc = -1;
225 		goto out;
226 	}
227 
228 	t = hashtab_search(policydbp->p_types.table, type);
229 	if (!t) {
230 		yyerror2("type is not defined: %s", type);
231 		rc = -1;
232 		goto out;
233 	}
234 
235 	if (t->flavor == TYPE_ATTRIB) {
236 		yyerror2("attributes may not be permissive: %s\n", type);
237 		rc = -1;
238 		goto out;
239 	}
240 
241 	t->flags |= TYPE_FLAGS_PERMISSIVE;
242 
243 out:
244 	free(type);
245 	return rc;
246 }
247 
define_polcap(void)248 int define_polcap(void)
249 {
250 	char *id = 0;
251 	int capnum;
252 
253 	if (pass == 2) {
254 		id = queue_remove(id_queue);
255 		free(id);
256 		return 0;
257 	}
258 
259 	id = (char *)queue_remove(id_queue);
260 	if (!id) {
261 		yyerror("no capability name for policycap definition?");
262 		goto bad;
263 	}
264 
265 	/* Check for valid cap name -> number mapping */
266 	capnum = sepol_polcap_getnum(id);
267 	if (capnum < 0) {
268 		yyerror2("invalid policy capability name %s", id);
269 		goto bad;
270 	}
271 
272 	/* Store it */
273 	if (ebitmap_set_bit(&policydbp->policycaps, capnum, TRUE)) {
274 		yyerror("out of memory");
275 		goto bad;
276 	}
277 
278 	free(id);
279 	return 0;
280 
281       bad:
282 	free(id);
283 	return -1;
284 }
285 
define_initial_sid(void)286 int define_initial_sid(void)
287 {
288 	char *id = 0;
289 	ocontext_t *newc = 0, *c, *head;
290 
291 	if (pass == 2) {
292 		id = queue_remove(id_queue);
293 		free(id);
294 		return 0;
295 	}
296 
297 	id = (char *)queue_remove(id_queue);
298 	if (!id) {
299 		yyerror("no sid name for SID definition?");
300 		return -1;
301 	}
302 	newc = (ocontext_t *) malloc(sizeof(ocontext_t));
303 	if (!newc) {
304 		yyerror("out of memory");
305 		goto bad;
306 	}
307 	memset(newc, 0, sizeof(ocontext_t));
308 	newc->u.name = id;
309 	context_init(&newc->context[0]);
310 	head = policydbp->ocontexts[OCON_ISID];
311 
312 	for (c = head; c; c = c->next) {
313 		if (!strcmp(newc->u.name, c->u.name)) {
314 			yyerror2("duplicate initial SID %s", id);
315 			goto bad;
316 		}
317 	}
318 
319 	if (head) {
320 		newc->sid[0] = head->sid[0] + 1;
321 	} else {
322 		newc->sid[0] = 1;
323 	}
324 	newc->next = head;
325 	policydbp->ocontexts[OCON_ISID] = newc;
326 
327 	return 0;
328 
329       bad:
330 	if (id)
331 		free(id);
332 	if (newc)
333 		free(newc);
334 	return -1;
335 }
336 
read_classes(ebitmap_t * e_classes)337 static int read_classes(ebitmap_t *e_classes)
338 {
339 	char *id;
340 	class_datum_t *cladatum;
341 
342 	while ((id = queue_remove(id_queue))) {
343 		if (!is_id_in_scope(SYM_CLASSES, id)) {
344 			yyerror2("class %s is not within scope", id);
345 			return -1;
346 		}
347 		cladatum = hashtab_search(policydbp->p_classes.table, id);
348 		if (!cladatum) {
349 			yyerror2("unknown class %s", id);
350 			free(id);
351 			return -1;
352 		}
353 		free(id);
354 		if (ebitmap_set_bit(e_classes, cladatum->s.value - 1, TRUE)) {
355 			yyerror("Out of memory");
356 			return -1;
357 		}
358 	}
359 	return 0;
360 }
361 
define_default_user(int which)362 int define_default_user(int which)
363 {
364 	char *id;
365 	class_datum_t *cladatum;
366 
367 	if (pass == 1) {
368 		while ((id = queue_remove(id_queue)))
369 			free(id);
370 		return 0;
371 	}
372 
373 	while ((id = queue_remove(id_queue))) {
374 		if (!is_id_in_scope(SYM_CLASSES, id)) {
375 			yyerror2("class %s is not within scope", id);
376 			return -1;
377 		}
378 		cladatum = hashtab_search(policydbp->p_classes.table, id);
379 		if (!cladatum) {
380 			yyerror2("unknown class %s", id);
381 			return -1;
382 		}
383 		if (cladatum->default_user && cladatum->default_user != which) {
384 			yyerror2("conflicting default user information for class %s", id);
385 			return -1;
386 		}
387 		cladatum->default_user = which;
388 		free(id);
389 	}
390 
391 	return 0;
392 }
393 
define_default_role(int which)394 int define_default_role(int which)
395 {
396 	char *id;
397 	class_datum_t *cladatum;
398 
399 	if (pass == 1) {
400 		while ((id = queue_remove(id_queue)))
401 			free(id);
402 		return 0;
403 	}
404 
405 	while ((id = queue_remove(id_queue))) {
406 		if (!is_id_in_scope(SYM_CLASSES, id)) {
407 			yyerror2("class %s is not within scope", id);
408 			return -1;
409 		}
410 		cladatum = hashtab_search(policydbp->p_classes.table, id);
411 		if (!cladatum) {
412 			yyerror2("unknown class %s", id);
413 			return -1;
414 		}
415 		if (cladatum->default_role && cladatum->default_role != which) {
416 			yyerror2("conflicting default role information for class %s", id);
417 			return -1;
418 		}
419 		cladatum->default_role = which;
420 		free(id);
421 	}
422 
423 	return 0;
424 }
425 
define_default_type(int which)426 int define_default_type(int which)
427 {
428 	char *id;
429 	class_datum_t *cladatum;
430 
431 	if (pass == 1) {
432 		while ((id = queue_remove(id_queue)))
433 			free(id);
434 		return 0;
435 	}
436 
437 	while ((id = queue_remove(id_queue))) {
438 		if (!is_id_in_scope(SYM_CLASSES, id)) {
439 			yyerror2("class %s is not within scope", id);
440 			return -1;
441 		}
442 		cladatum = hashtab_search(policydbp->p_classes.table, id);
443 		if (!cladatum) {
444 			yyerror2("unknown class %s", id);
445 			return -1;
446 		}
447 		if (cladatum->default_type && cladatum->default_type != which) {
448 			yyerror2("conflicting default type information for class %s", id);
449 			return -1;
450 		}
451 		cladatum->default_type = which;
452 		free(id);
453 	}
454 
455 	return 0;
456 }
457 
define_default_range(int which)458 int define_default_range(int which)
459 {
460 	char *id;
461 	class_datum_t *cladatum;
462 
463 	if (pass == 1) {
464 		while ((id = queue_remove(id_queue)))
465 			free(id);
466 		return 0;
467 	}
468 
469 	while ((id = queue_remove(id_queue))) {
470 		if (!is_id_in_scope(SYM_CLASSES, id)) {
471 			yyerror2("class %s is not within scope", id);
472 			return -1;
473 		}
474 		cladatum = hashtab_search(policydbp->p_classes.table, id);
475 		if (!cladatum) {
476 			yyerror2("unknown class %s", id);
477 			return -1;
478 		}
479 		if (cladatum->default_range && cladatum->default_range != which) {
480 			yyerror2("conflicting default range information for class %s", id);
481 			return -1;
482 		}
483 		cladatum->default_range = which;
484 		free(id);
485 	}
486 
487 	return 0;
488 }
489 
define_common_perms(void)490 int define_common_perms(void)
491 {
492 	char *id = 0, *perm = 0;
493 	common_datum_t *comdatum = 0;
494 	perm_datum_t *perdatum = 0;
495 	int ret;
496 
497 	if (pass == 2) {
498 		while ((id = queue_remove(id_queue)))
499 			free(id);
500 		return 0;
501 	}
502 
503 	id = (char *)queue_remove(id_queue);
504 	if (!id) {
505 		yyerror("no common name for common perm definition?");
506 		return -1;
507 	}
508 	comdatum = hashtab_search(policydbp->p_commons.table, id);
509 	if (comdatum) {
510 		yyerror2("duplicate declaration for common %s\n", id);
511 		return -1;
512 	}
513 	comdatum = (common_datum_t *) malloc(sizeof(common_datum_t));
514 	if (!comdatum) {
515 		yyerror("out of memory");
516 		goto bad;
517 	}
518 	memset(comdatum, 0, sizeof(common_datum_t));
519 	ret = hashtab_insert(policydbp->p_commons.table,
520 			     (hashtab_key_t) id, (hashtab_datum_t) comdatum);
521 
522 	if (ret == SEPOL_EEXIST) {
523 		yyerror("duplicate common definition");
524 		goto bad;
525 	}
526 	if (ret == SEPOL_ENOMEM) {
527 		yyerror("hash table overflow");
528 		goto bad;
529 	}
530 	comdatum->s.value = policydbp->p_commons.nprim + 1;
531 	if (symtab_init(&comdatum->permissions, PERM_SYMTAB_SIZE)) {
532 		yyerror("out of memory");
533 		goto bad;
534 	}
535 	policydbp->p_commons.nprim++;
536 	while ((perm = queue_remove(id_queue))) {
537 		perdatum = (perm_datum_t *) malloc(sizeof(perm_datum_t));
538 		if (!perdatum) {
539 			yyerror("out of memory");
540 			goto bad_perm;
541 		}
542 		memset(perdatum, 0, sizeof(perm_datum_t));
543 		perdatum->s.value = comdatum->permissions.nprim + 1;
544 
545 		if (perdatum->s.value > (sizeof(sepol_access_vector_t) * 8)) {
546 			yyerror
547 			    ("too many permissions to fit in an access vector");
548 			goto bad_perm;
549 		}
550 		ret = hashtab_insert(comdatum->permissions.table,
551 				     (hashtab_key_t) perm,
552 				     (hashtab_datum_t) perdatum);
553 
554 		if (ret == SEPOL_EEXIST) {
555 			yyerror2("duplicate permission %s in common %s", perm,
556 				 id);
557 			goto bad_perm;
558 		}
559 		if (ret == SEPOL_ENOMEM) {
560 			yyerror("hash table overflow");
561 			goto bad_perm;
562 		}
563 		comdatum->permissions.nprim++;
564 	}
565 
566 	return 0;
567 
568       bad:
569 	if (id)
570 		free(id);
571 	if (comdatum)
572 		free(comdatum);
573 	return -1;
574 
575       bad_perm:
576 	if (perm)
577 		free(perm);
578 	if (perdatum)
579 		free(perdatum);
580 	return -1;
581 }
582 
define_av_perms(int inherits)583 int define_av_perms(int inherits)
584 {
585 	char *id;
586 	class_datum_t *cladatum;
587 	common_datum_t *comdatum;
588 	perm_datum_t *perdatum = 0, *perdatum2 = 0;
589 	int ret;
590 
591 	if (pass == 2) {
592 		while ((id = queue_remove(id_queue)))
593 			free(id);
594 		return 0;
595 	}
596 
597 	id = (char *)queue_remove(id_queue);
598 	if (!id) {
599 		yyerror("no tclass name for av perm definition?");
600 		return -1;
601 	}
602 	cladatum = (class_datum_t *) hashtab_search(policydbp->p_classes.table,
603 						    (hashtab_key_t) id);
604 	if (!cladatum) {
605 		yyerror2("class %s is not defined", id);
606 		goto bad;
607 	}
608 	free(id);
609 
610 	if (cladatum->comdatum || cladatum->permissions.nprim) {
611 		yyerror("duplicate access vector definition");
612 		return -1;
613 	}
614 	if (symtab_init(&cladatum->permissions, PERM_SYMTAB_SIZE)) {
615 		yyerror("out of memory");
616 		return -1;
617 	}
618 	if (inherits) {
619 		id = (char *)queue_remove(id_queue);
620 		if (!id) {
621 			yyerror
622 			    ("no inherits name for access vector definition?");
623 			return -1;
624 		}
625 		comdatum =
626 		    (common_datum_t *) hashtab_search(policydbp->p_commons.
627 						      table,
628 						      (hashtab_key_t) id);
629 
630 		if (!comdatum) {
631 			yyerror2("common %s is not defined", id);
632 			goto bad;
633 		}
634 		cladatum->comkey = id;
635 		cladatum->comdatum = comdatum;
636 
637 		/*
638 		 * Class-specific permissions start with values
639 		 * after the last common permission.
640 		 */
641 		cladatum->permissions.nprim += comdatum->permissions.nprim;
642 	}
643 	while ((id = queue_remove(id_queue))) {
644 		perdatum = (perm_datum_t *) malloc(sizeof(perm_datum_t));
645 		if (!perdatum) {
646 			yyerror("out of memory");
647 			goto bad;
648 		}
649 		memset(perdatum, 0, sizeof(perm_datum_t));
650 		perdatum->s.value = ++cladatum->permissions.nprim;
651 
652 		if (perdatum->s.value > (sizeof(sepol_access_vector_t) * 8)) {
653 			yyerror
654 			    ("too many permissions to fit in an access vector");
655 			goto bad;
656 		}
657 		if (inherits) {
658 			/*
659 			 * Class-specific permissions and
660 			 * common permissions exist in the same
661 			 * name space.
662 			 */
663 			perdatum2 =
664 			    (perm_datum_t *) hashtab_search(cladatum->comdatum->
665 							    permissions.table,
666 							    (hashtab_key_t) id);
667 			if (perdatum2) {
668 				yyerror2("permission %s conflicts with an "
669 					 "inherited permission", id);
670 				goto bad;
671 			}
672 		}
673 		ret = hashtab_insert(cladatum->permissions.table,
674 				     (hashtab_key_t) id,
675 				     (hashtab_datum_t) perdatum);
676 
677 		if (ret == SEPOL_EEXIST) {
678 			yyerror2("duplicate permission %s", id);
679 			goto bad;
680 		}
681 		if (ret == SEPOL_ENOMEM) {
682 			yyerror("hash table overflow");
683 			goto bad;
684 		}
685 		if (add_perm_to_class(perdatum->s.value, cladatum->s.value)) {
686 			yyerror("out of memory");
687 			goto bad;
688 		}
689 	}
690 
691 	return 0;
692 
693       bad:
694 	if (id)
695 		free(id);
696 	if (perdatum)
697 		free(perdatum);
698 	return -1;
699 }
700 
define_sens(void)701 int define_sens(void)
702 {
703 	char *id;
704 	mls_level_t *level = 0;
705 	level_datum_t *datum = 0, *aliasdatum = 0;
706 	int ret;
707 	uint32_t value;		/* dummy variable -- its value is never used */
708 
709 	if (!mlspol) {
710 		yyerror("sensitivity definition in non-MLS configuration");
711 		return -1;
712 	}
713 
714 	if (pass == 2) {
715 		while ((id = queue_remove(id_queue)))
716 			free(id);
717 		return 0;
718 	}
719 
720 	id = (char *)queue_remove(id_queue);
721 	if (!id) {
722 		yyerror("no sensitivity name for sensitivity definition?");
723 		return -1;
724 	}
725 	if (id_has_dot(id)) {
726 		yyerror("sensitivity identifiers may not contain periods");
727 		goto bad;
728 	}
729 	level = (mls_level_t *) malloc(sizeof(mls_level_t));
730 	if (!level) {
731 		yyerror("out of memory");
732 		goto bad;
733 	}
734 	mls_level_init(level);
735 	level->sens = 0;	/* actual value set in define_dominance */
736 	ebitmap_init(&level->cat);	/* actual value set in define_level */
737 
738 	datum = (level_datum_t *) malloc(sizeof(level_datum_t));
739 	if (!datum) {
740 		yyerror("out of memory");
741 		goto bad;
742 	}
743 	level_datum_init(datum);
744 	datum->isalias = FALSE;
745 	datum->level = level;
746 
747 	ret = declare_symbol(SYM_LEVELS, id, datum, &value, &value);
748 	switch (ret) {
749 	case -3:{
750 			yyerror("Out of memory!");
751 			goto bad;
752 		}
753 	case -2:{
754 			yyerror("duplicate declaration of sensitivity level");
755 			goto bad;
756 		}
757 	case -1:{
758 			yyerror("could not declare sensitivity level here");
759 			goto bad;
760 		}
761 	case 0:
762 	case 1:{
763 			break;
764 		}
765 	default:{
766 			assert(0);	/* should never get here */
767 		}
768 	}
769 
770 	while ((id = queue_remove(id_queue))) {
771 		if (id_has_dot(id)) {
772 			yyerror("sensitivity aliases may not contain periods");
773 			goto bad_alias;
774 		}
775 		aliasdatum = (level_datum_t *) malloc(sizeof(level_datum_t));
776 		if (!aliasdatum) {
777 			yyerror("out of memory");
778 			goto bad_alias;
779 		}
780 		level_datum_init(aliasdatum);
781 		aliasdatum->isalias = TRUE;
782 		aliasdatum->level = level;
783 
784 		ret = declare_symbol(SYM_LEVELS, id, aliasdatum, NULL, &value);
785 		switch (ret) {
786 		case -3:{
787 				yyerror("Out of memory!");
788 				goto bad_alias;
789 			}
790 		case -2:{
791 				yyerror
792 				    ("duplicate declaration of sensitivity alias");
793 				goto bad_alias;
794 			}
795 		case -1:{
796 				yyerror
797 				    ("could not declare sensitivity alias here");
798 				goto bad_alias;
799 			}
800 		case 0:
801 		case 1:{
802 				break;
803 			}
804 		default:{
805 				assert(0);	/* should never get here */
806 			}
807 		}
808 	}
809 
810 	return 0;
811 
812       bad:
813 	if (id)
814 		free(id);
815 	if (level)
816 		free(level);
817 	if (datum) {
818 		level_datum_destroy(datum);
819 		free(datum);
820 	}
821 	return -1;
822 
823       bad_alias:
824 	if (id)
825 		free(id);
826 	if (aliasdatum) {
827 		level_datum_destroy(aliasdatum);
828 		free(aliasdatum);
829 	}
830 	return -1;
831 }
832 
define_dominance(void)833 int define_dominance(void)
834 {
835 	level_datum_t *datum;
836 	uint32_t order;
837 	char *id;
838 
839 	if (!mlspol) {
840 		yyerror("dominance definition in non-MLS configuration");
841 		return -1;
842 	}
843 
844 	if (pass == 2) {
845 		while ((id = queue_remove(id_queue)))
846 			free(id);
847 		return 0;
848 	}
849 
850 	order = 0;
851 	while ((id = (char *)queue_remove(id_queue))) {
852 		datum =
853 		    (level_datum_t *) hashtab_search(policydbp->p_levels.table,
854 						     (hashtab_key_t) id);
855 		if (!datum) {
856 			yyerror2("unknown sensitivity %s used in dominance "
857 				 "definition", id);
858 			free(id);
859 			return -1;
860 		}
861 		if (datum->level->sens != 0) {
862 			yyerror2("sensitivity %s occurs multiply in dominance "
863 				 "definition", id);
864 			free(id);
865 			return -1;
866 		}
867 		datum->level->sens = ++order;
868 
869 		/* no need to keep sensitivity name */
870 		free(id);
871 	}
872 
873 	if (order != policydbp->p_levels.nprim) {
874 		yyerror
875 		    ("all sensitivities must be specified in dominance definition");
876 		return -1;
877 	}
878 	return 0;
879 }
880 
define_category(void)881 int define_category(void)
882 {
883 	char *id;
884 	cat_datum_t *datum = 0, *aliasdatum = 0;
885 	int ret;
886 	uint32_t value;
887 
888 	if (!mlspol) {
889 		yyerror("category definition in non-MLS configuration");
890 		return -1;
891 	}
892 
893 	if (pass == 2) {
894 		while ((id = queue_remove(id_queue)))
895 			free(id);
896 		return 0;
897 	}
898 
899 	id = (char *)queue_remove(id_queue);
900 	if (!id) {
901 		yyerror("no category name for category definition?");
902 		return -1;
903 	}
904 	if (id_has_dot(id)) {
905 		yyerror("category identifiers may not contain periods");
906 		goto bad;
907 	}
908 	datum = (cat_datum_t *) malloc(sizeof(cat_datum_t));
909 	if (!datum) {
910 		yyerror("out of memory");
911 		goto bad;
912 	}
913 	cat_datum_init(datum);
914 	datum->isalias = FALSE;
915 
916 	ret = declare_symbol(SYM_CATS, id, datum, &value, &value);
917 	switch (ret) {
918 	case -3:{
919 			yyerror("Out of memory!");
920 			goto bad;
921 		}
922 	case -2:{
923 			yyerror("duplicate declaration of category");
924 			goto bad;
925 		}
926 	case -1:{
927 			yyerror("could not declare category here");
928 			goto bad;
929 		}
930 	case 0:
931 	case 1:{
932 			break;
933 		}
934 	default:{
935 			assert(0);	/* should never get here */
936 		}
937 	}
938 	datum->s.value = value;
939 
940 	while ((id = queue_remove(id_queue))) {
941 		if (id_has_dot(id)) {
942 			yyerror("category aliases may not contain periods");
943 			goto bad_alias;
944 		}
945 		aliasdatum = (cat_datum_t *) malloc(sizeof(cat_datum_t));
946 		if (!aliasdatum) {
947 			yyerror("out of memory");
948 			goto bad_alias;
949 		}
950 		cat_datum_init(aliasdatum);
951 		aliasdatum->isalias = TRUE;
952 		aliasdatum->s.value = datum->s.value;
953 
954 		ret =
955 		    declare_symbol(SYM_CATS, id, aliasdatum, NULL,
956 				   &datum->s.value);
957 		switch (ret) {
958 		case -3:{
959 				yyerror("Out of memory!");
960 				goto bad_alias;
961 			}
962 		case -2:{
963 				yyerror
964 				    ("duplicate declaration of category aliases");
965 				goto bad_alias;
966 			}
967 		case -1:{
968 				yyerror
969 				    ("could not declare category aliases here");
970 				goto bad_alias;
971 			}
972 		case 0:
973 		case 1:{
974 				break;
975 			}
976 		default:{
977 				assert(0);	/* should never get here */
978 			}
979 		}
980 	}
981 
982 	return 0;
983 
984       bad:
985 	if (id)
986 		free(id);
987 	if (datum) {
988 		cat_datum_destroy(datum);
989 		free(datum);
990 	}
991 	return -1;
992 
993       bad_alias:
994 	if (id)
995 		free(id);
996 	if (aliasdatum) {
997 		cat_datum_destroy(aliasdatum);
998 		free(aliasdatum);
999 	}
1000 	return -1;
1001 }
1002 
clone_level(hashtab_key_t key,hashtab_datum_t datum,void * arg)1003 static int clone_level(hashtab_key_t key __attribute__ ((unused)), hashtab_datum_t datum, void *arg)
1004 {
1005 	level_datum_t *levdatum = (level_datum_t *) datum;
1006 	mls_level_t *level = (mls_level_t *) arg, *newlevel;
1007 
1008 	if (levdatum->level == level) {
1009 		levdatum->defined = 1;
1010 		if (!levdatum->isalias)
1011 			return 0;
1012 		newlevel = (mls_level_t *) malloc(sizeof(mls_level_t));
1013 		if (!newlevel)
1014 			return -1;
1015 		if (mls_level_cpy(newlevel, level)) {
1016 			free(newlevel);
1017 			return -1;
1018 		}
1019 		levdatum->level = newlevel;
1020 	}
1021 	return 0;
1022 }
1023 
define_level(void)1024 int define_level(void)
1025 {
1026 	char *id;
1027 	level_datum_t *levdatum;
1028 
1029 	if (!mlspol) {
1030 		yyerror("level definition in non-MLS configuration");
1031 		return -1;
1032 	}
1033 
1034 	if (pass == 2) {
1035 		while ((id = queue_remove(id_queue)))
1036 			free(id);
1037 		return 0;
1038 	}
1039 
1040 	id = (char *)queue_remove(id_queue);
1041 	if (!id) {
1042 		yyerror("no level name for level definition?");
1043 		return -1;
1044 	}
1045 	levdatum = (level_datum_t *) hashtab_search(policydbp->p_levels.table,
1046 						    (hashtab_key_t) id);
1047 	if (!levdatum) {
1048 		yyerror2("unknown sensitivity %s used in level definition", id);
1049 		free(id);
1050 		return -1;
1051 	}
1052 	if (ebitmap_length(&levdatum->level->cat)) {
1053 		yyerror2("sensitivity %s used in multiple level definitions",
1054 			 id);
1055 		free(id);
1056 		return -1;
1057 	}
1058 	free(id);
1059 
1060 	levdatum->defined = 1;
1061 
1062 	while ((id = queue_remove(id_queue))) {
1063 		cat_datum_t *cdatum;
1064 		int range_start, range_end, i;
1065 
1066 		if (id_has_dot(id)) {
1067 			char *id_start = id;
1068 			char *id_end = strchr(id, '.');
1069 
1070 			*(id_end++) = '\0';
1071 
1072 			cdatum =
1073 			    (cat_datum_t *) hashtab_search(policydbp->p_cats.
1074 							   table,
1075 							   (hashtab_key_t)
1076 							   id_start);
1077 			if (!cdatum) {
1078 				yyerror2("unknown category %s", id_start);
1079 				free(id);
1080 				return -1;
1081 			}
1082 			range_start = cdatum->s.value - 1;
1083 			cdatum =
1084 			    (cat_datum_t *) hashtab_search(policydbp->p_cats.
1085 							   table,
1086 							   (hashtab_key_t)
1087 							   id_end);
1088 			if (!cdatum) {
1089 				yyerror2("unknown category %s", id_end);
1090 				free(id);
1091 				return -1;
1092 			}
1093 			range_end = cdatum->s.value - 1;
1094 
1095 			if (range_end < range_start) {
1096 				yyerror2("category range is invalid");
1097 				free(id);
1098 				return -1;
1099 			}
1100 		} else {
1101 			cdatum =
1102 			    (cat_datum_t *) hashtab_search(policydbp->p_cats.
1103 							   table,
1104 							   (hashtab_key_t) id);
1105 			if (!cdatum) {
1106 				yyerror2("unknown category %s", id);
1107 				free(id);
1108 				return -1;
1109 			}
1110 			range_start = range_end = cdatum->s.value - 1;
1111 		}
1112 
1113 		for (i = range_start; i <= range_end; i++) {
1114 			if (ebitmap_set_bit(&levdatum->level->cat, i, TRUE)) {
1115 				yyerror("out of memory");
1116 				free(id);
1117 				return -1;
1118 			}
1119 		}
1120 
1121 		free(id);
1122 	}
1123 
1124 	if (hashtab_map
1125 	    (policydbp->p_levels.table, clone_level, levdatum->level)) {
1126 		yyerror("out of memory");
1127 		return -1;
1128 	}
1129 
1130 	return 0;
1131 }
1132 
define_attrib(void)1133 int define_attrib(void)
1134 {
1135 	if (pass == 2) {
1136 		free(queue_remove(id_queue));
1137 		return 0;
1138 	}
1139 
1140 	if (declare_type(TRUE, TRUE) == NULL) {
1141 		return -1;
1142 	}
1143 	return 0;
1144 }
1145 
expand_attrib(void)1146 int expand_attrib(void)
1147 {
1148 	char *id;
1149 	ebitmap_t attrs;
1150 	type_datum_t *attr;
1151 	ebitmap_node_t *node;
1152 	uint32_t i;
1153 	int rc = -1;
1154 	int flags = 0;
1155 
1156 	if (pass == 1) {
1157 		for (i = 0; i < 2; i++) {
1158 			while ((id = queue_remove(id_queue))) {
1159 				free(id);
1160 			}
1161 		}
1162 		return 0;
1163 	}
1164 
1165 	ebitmap_init(&attrs);
1166 	while ((id = queue_remove(id_queue))) {
1167 		if (!is_id_in_scope(SYM_TYPES, id)) {
1168 			yyerror2("attribute %s is not within scope", id);
1169 			goto exit;
1170 		}
1171 
1172 		attr = hashtab_search(policydbp->p_types.table, id);
1173 		if (!attr) {
1174 			yyerror2("attribute %s is not declared", id);
1175 			goto exit;
1176 		}
1177 
1178 		if (attr->flavor != TYPE_ATTRIB) {
1179 			yyerror2("%s is a type, not an attribute", id);
1180 			goto exit;
1181 		}
1182 
1183 		if (ebitmap_set_bit(&attrs, attr->s.value - 1, TRUE)) {
1184 			yyerror("Out of memory!");
1185 			goto exit;
1186 		}
1187 
1188 		free(id);
1189 	}
1190 
1191 	id = (char *) queue_remove(id_queue);
1192 	if (!id) {
1193 		yyerror("No option specified for attribute expansion.");
1194 		goto exit;
1195 	}
1196 
1197 	if (!strcmp(id, "T")) {
1198 		flags = TYPE_FLAGS_EXPAND_ATTR_TRUE;
1199 	} else {
1200 		flags = TYPE_FLAGS_EXPAND_ATTR_FALSE;
1201 	}
1202 
1203 	ebitmap_for_each_positive_bit(&attrs, node, i) {
1204 		attr = hashtab_search(policydbp->p_types.table,
1205 				policydbp->sym_val_to_name[SYM_TYPES][i]);
1206 		attr->flags |= flags;
1207 		if ((attr->flags & TYPE_FLAGS_EXPAND_ATTR_TRUE) &&
1208 				(attr->flags & TYPE_FLAGS_EXPAND_ATTR_FALSE)) {
1209 			yywarn("Expandattribute option was set to both true and false. "
1210 				"Resolving to false.");
1211 			attr->flags &= ~TYPE_FLAGS_EXPAND_ATTR_TRUE;
1212 		}
1213 	}
1214 
1215 	rc = 0;
1216 exit:
1217 	ebitmap_destroy(&attrs);
1218 	free(id);
1219 	return rc;
1220 }
1221 
add_aliases_to_type(type_datum_t * type)1222 static int add_aliases_to_type(type_datum_t * type)
1223 {
1224 	char *id;
1225 	type_datum_t *aliasdatum = NULL;
1226 	int ret;
1227 	while ((id = queue_remove(id_queue))) {
1228 		if (id_has_dot(id)) {
1229 			free(id);
1230 			yyerror
1231 			    ("type alias identifiers may not contain periods");
1232 			return -1;
1233 		}
1234 		aliasdatum = (type_datum_t *) malloc(sizeof(type_datum_t));
1235 		if (!aliasdatum) {
1236 			free(id);
1237 			yyerror("Out of memory!");
1238 			return -1;
1239 		}
1240 		memset(aliasdatum, 0, sizeof(type_datum_t));
1241 		aliasdatum->s.value = type->s.value;
1242 
1243 		ret = declare_symbol(SYM_TYPES, id, aliasdatum,
1244 				     NULL, &aliasdatum->s.value);
1245 		switch (ret) {
1246 		case -3:{
1247 				yyerror("Out of memory!");
1248 				goto cleanup;
1249 			}
1250 		case -2:{
1251 				yyerror2("duplicate declaration of alias %s",
1252 					 id);
1253 				goto cleanup;
1254 			}
1255 		case -1:{
1256 				yyerror("could not declare alias here");
1257 				goto cleanup;
1258 			}
1259 		case 0:	 	break;
1260 		case 1:{
1261 				/* ret == 1 means the alias was required and therefore already
1262 				 * has a value. Set it up as an alias with a different primary. */
1263 				type_datum_destroy(aliasdatum);
1264 				free(aliasdatum);
1265 
1266 				aliasdatum = hashtab_search(policydbp->symtab[SYM_TYPES].table, id);
1267 				assert(aliasdatum);
1268 
1269 				aliasdatum->primary = type->s.value;
1270 				aliasdatum->flavor = TYPE_ALIAS;
1271 
1272 				break;
1273 			}
1274 		default:{
1275 				assert(0);	/* should never get here */
1276 			}
1277 		}
1278 	}
1279 	return 0;
1280       cleanup:
1281 	free(id);
1282 	type_datum_destroy(aliasdatum);
1283 	free(aliasdatum);
1284 	return -1;
1285 }
1286 
define_typealias(void)1287 int define_typealias(void)
1288 {
1289 	char *id;
1290 	type_datum_t *t;
1291 
1292 	if (pass == 2) {
1293 		while ((id = queue_remove(id_queue)))
1294 			free(id);
1295 		return 0;
1296 	}
1297 
1298 	id = (char *)queue_remove(id_queue);
1299 	if (!id) {
1300 		yyerror("no type name for typealias definition?");
1301 		return -1;
1302 	}
1303 
1304 	if (!is_id_in_scope(SYM_TYPES, id)) {
1305 		yyerror2("type %s is not within scope", id);
1306 		free(id);
1307 		return -1;
1308 	}
1309 	t = hashtab_search(policydbp->p_types.table, id);
1310 	if (!t || t->flavor == TYPE_ATTRIB) {
1311 		yyerror2("unknown type %s, or it was already declared as an "
1312 			 "attribute", id);
1313 		free(id);
1314 		return -1;
1315 	}
1316 	free(id);
1317 	return add_aliases_to_type(t);
1318 }
1319 
define_typeattribute(void)1320 int define_typeattribute(void)
1321 {
1322 	char *id;
1323 	type_datum_t *t, *attr;
1324 
1325 	if (pass == 2) {
1326 		while ((id = queue_remove(id_queue)))
1327 			free(id);
1328 		return 0;
1329 	}
1330 
1331 	id = (char *)queue_remove(id_queue);
1332 	if (!id) {
1333 		yyerror("no type name for typeattribute definition?");
1334 		return -1;
1335 	}
1336 
1337 	if (!is_id_in_scope(SYM_TYPES, id)) {
1338 		yyerror2("type %s is not within scope", id);
1339 		free(id);
1340 		return -1;
1341 	}
1342 	t = hashtab_search(policydbp->p_types.table, id);
1343 	if (!t || t->flavor == TYPE_ATTRIB) {
1344 		yyerror2("unknown type %s", id);
1345 		free(id);
1346 		return -1;
1347 	}
1348 	free(id);
1349 
1350 	while ((id = queue_remove(id_queue))) {
1351 		if (!is_id_in_scope(SYM_TYPES, id)) {
1352 			yyerror2("attribute %s is not within scope", id);
1353 			free(id);
1354 			return -1;
1355 		}
1356 		attr = hashtab_search(policydbp->p_types.table, id);
1357 		if (!attr) {
1358 			/* treat it as a fatal error */
1359 			yyerror2("attribute %s is not declared", id);
1360 			free(id);
1361 			return -1;
1362 		}
1363 
1364 		if (attr->flavor != TYPE_ATTRIB) {
1365 			yyerror2("%s is a type, not an attribute", id);
1366 			free(id);
1367 			return -1;
1368 		}
1369 
1370 		if ((attr = get_local_type(id, attr->s.value, 1)) == NULL) {
1371 			yyerror("Out of memory!");
1372 			return -1;
1373 		}
1374 
1375 		if (ebitmap_set_bit(&attr->types, (t->s.value - 1), TRUE)) {
1376 			yyerror("out of memory");
1377 			return -1;
1378 		}
1379 	}
1380 
1381 	return 0;
1382 }
1383 
define_typebounds_helper(char * bounds_id,char * type_id)1384 static int define_typebounds_helper(char *bounds_id, char *type_id)
1385 {
1386 	type_datum_t *bounds, *type;
1387 
1388 	if (!is_id_in_scope(SYM_TYPES, bounds_id)) {
1389 		yyerror2("type %s is not within scope", bounds_id);
1390 		return -1;
1391 	}
1392 
1393 	bounds = hashtab_search(policydbp->p_types.table, bounds_id);
1394 	if (!bounds || bounds->flavor == TYPE_ATTRIB) {
1395 		yyerror2("hoge unknown type %s", bounds_id);
1396 		return -1;
1397 	}
1398 
1399 	if (!is_id_in_scope(SYM_TYPES, type_id)) {
1400 		yyerror2("type %s is not within scope", type_id);
1401 		return -1;
1402 	}
1403 
1404 	type = hashtab_search(policydbp->p_types.table, type_id);
1405 	if (!type || type->flavor == TYPE_ATTRIB) {
1406 		yyerror2("type %s is not declared", type_id);
1407 		return -1;
1408 	}
1409 
1410 	if (type->flavor == TYPE_TYPE && !type->primary) {
1411 		type = policydbp->type_val_to_struct[type->s.value - 1];
1412 	} else if (type->flavor == TYPE_ALIAS) {
1413 		type = policydbp->type_val_to_struct[type->primary - 1];
1414 	}
1415 
1416 	if (!type->bounds)
1417 		type->bounds = bounds->s.value;
1418 	else if (type->bounds != bounds->s.value) {
1419 		yyerror2("type %s has inconsistent bounds %s/%s",
1420 			 type_id,
1421 			 policydbp->p_type_val_to_name[type->bounds - 1],
1422 			 policydbp->p_type_val_to_name[bounds->s.value - 1]);
1423 		return -1;
1424 	}
1425 
1426 	return 0;
1427 }
1428 
define_typebounds(void)1429 int define_typebounds(void)
1430 {
1431 	char *bounds, *id;
1432 
1433 	if (pass == 1) {
1434 		while ((id = queue_remove(id_queue)))
1435 			free(id);
1436 		return 0;
1437 	}
1438 
1439 	bounds = (char *) queue_remove(id_queue);
1440 	if (!bounds) {
1441 		yyerror("no type name for typebounds definition?");
1442 		return -1;
1443 	}
1444 
1445 	while ((id = queue_remove(id_queue))) {
1446 		if (define_typebounds_helper(bounds, id))
1447 			return -1;
1448 		free(id);
1449 	}
1450 	free(bounds);
1451 
1452 	return 0;
1453 }
1454 
define_type(int alias)1455 int define_type(int alias)
1456 {
1457 	char *id;
1458 	type_datum_t *datum, *attr;
1459 
1460 	if (pass == 2) {
1461 		/*
1462 		 * If type name contains ".", we have to define boundary
1463 		 * relationship implicitly to keep compatibility with
1464 		 * old name based hierarchy.
1465 		 */
1466 		if ((id = queue_remove(id_queue))) {
1467 			char *bounds, *delim;
1468 
1469 			if ((delim = strrchr(id, '.'))
1470 			    && (bounds = strdup(id))) {
1471 				bounds[(size_t)(delim - id)] = '\0';
1472 
1473 				if (define_typebounds_helper(bounds, id))
1474 					return -1;
1475 				free(bounds);
1476 			}
1477 			free(id);
1478 		}
1479 
1480 		if (alias) {
1481 			while ((id = queue_remove(id_queue)))
1482 				free(id);
1483 		}
1484 
1485 		while ((id = queue_remove(id_queue)))
1486 			free(id);
1487 		return 0;
1488 	}
1489 
1490 	if ((datum = declare_type(TRUE, FALSE)) == NULL) {
1491 		return -1;
1492 	}
1493 
1494 	if (alias) {
1495 		if (add_aliases_to_type(datum) == -1) {
1496 			return -1;
1497 		}
1498 	}
1499 
1500 	while ((id = queue_remove(id_queue))) {
1501 		if (!is_id_in_scope(SYM_TYPES, id)) {
1502 			yyerror2("attribute %s is not within scope", id);
1503 			free(id);
1504 			return -1;
1505 		}
1506 		attr = hashtab_search(policydbp->p_types.table, id);
1507 		if (!attr) {
1508 			/* treat it as a fatal error */
1509 			yyerror2("attribute %s is not declared", id);
1510 			free(id);
1511 			return -1;
1512 		}
1513 
1514 		if (attr->flavor != TYPE_ATTRIB) {
1515 			yyerror2("%s is a type, not an attribute", id);
1516 			free(id);
1517 			return -1;
1518 		}
1519 
1520 		if ((attr = get_local_type(id, attr->s.value, 1)) == NULL) {
1521 			yyerror("Out of memory!");
1522 			return -1;
1523 		}
1524 
1525 		if (ebitmap_set_bit(&attr->types, datum->s.value - 1, TRUE)) {
1526 			yyerror("Out of memory");
1527 			return -1;
1528 		}
1529 	}
1530 
1531 	return 0;
1532 }
1533 
1534 struct val_to_name {
1535 	unsigned int val;
1536 	char *name;
1537 };
1538 
1539 /* Adds a type, given by its textual name, to a typeset.  If *add is
1540    0, then add the type to the negative set; otherwise if *add is 1
1541    then add it to the positive side. */
set_types(type_set_t * set,char * id,int * add,char starallowed)1542 static int set_types(type_set_t * set, char *id, int *add, char starallowed)
1543 {
1544 	type_datum_t *t;
1545 
1546 	if (strcmp(id, "*") == 0) {
1547 		free(id);
1548 		if (!starallowed) {
1549 			yyerror("* not allowed in this type of rule");
1550 			return -1;
1551 		}
1552 		/* set TYPE_STAR flag */
1553 		set->flags = TYPE_STAR;
1554 		*add = 1;
1555 		return 0;
1556 	}
1557 
1558 	if (strcmp(id, "~") == 0) {
1559 		free(id);
1560 		if (!starallowed) {
1561 			yyerror("~ not allowed in this type of rule");
1562 			return -1;
1563 		}
1564 		/* complement the set */
1565 		set->flags = TYPE_COMP;
1566 		*add = 1;
1567 		return 0;
1568 	}
1569 
1570 	if (strcmp(id, "-") == 0) {
1571 		*add = 0;
1572 		free(id);
1573 		return 0;
1574 	}
1575 
1576 	if (!is_id_in_scope(SYM_TYPES, id)) {
1577 		yyerror2("type %s is not within scope", id);
1578 		free(id);
1579 		return -1;
1580 	}
1581 	t = hashtab_search(policydbp->p_types.table, id);
1582 	if (!t) {
1583 		yyerror2("unknown type %s", id);
1584 		free(id);
1585 		return -1;
1586 	}
1587 
1588 	if (*add == 0) {
1589 		if (ebitmap_set_bit(&set->negset, t->s.value - 1, TRUE))
1590 			goto oom;
1591 	} else {
1592 		if (ebitmap_set_bit(&set->types, t->s.value - 1, TRUE))
1593 			goto oom;
1594 	}
1595 	free(id);
1596 	*add = 1;
1597 	return 0;
1598       oom:
1599 	yyerror("Out of memory");
1600 	free(id);
1601 	return -1;
1602 }
1603 
define_compute_type_helper(int which,avrule_t ** rule)1604 static int define_compute_type_helper(int which, avrule_t ** rule)
1605 {
1606 	char *id;
1607 	type_datum_t *datum;
1608 	ebitmap_t tclasses;
1609 	ebitmap_node_t *node;
1610 	avrule_t *avrule;
1611 	class_perm_node_t *perm;
1612 	uint32_t i;
1613 	int add = 1;
1614 
1615 	avrule = malloc(sizeof(avrule_t));
1616 	if (!avrule) {
1617 		yyerror("out of memory");
1618 		return -1;
1619 	}
1620 	avrule_init(avrule);
1621 	avrule->specified = which;
1622 	avrule->line = policydb_lineno;
1623 	avrule->source_line = source_lineno;
1624 	avrule->source_filename = strdup(source_file);
1625 	if (!avrule->source_filename) {
1626 		yyerror("out of memory");
1627 		return -1;
1628 	}
1629 
1630 	while ((id = queue_remove(id_queue))) {
1631 		if (set_types(&avrule->stypes, id, &add, 0))
1632 			goto bad;
1633 	}
1634 	add = 1;
1635 	while ((id = queue_remove(id_queue))) {
1636 		if (strcmp(id, "self") == 0) {
1637 			free(id);
1638 			if (add == 0) {
1639 				yyerror("-self is not supported");
1640 				goto bad;
1641 			}
1642 			avrule->flags |= RULE_SELF;
1643 			continue;
1644 		}
1645 		if (set_types(&avrule->ttypes, id, &add, 0))
1646 			goto bad;
1647 	}
1648 
1649 	ebitmap_init(&tclasses);
1650 	if (read_classes(&tclasses))
1651 		goto bad;
1652 
1653 	id = (char *)queue_remove(id_queue);
1654 	if (!id) {
1655 		yyerror("no newtype?");
1656 		goto bad;
1657 	}
1658 	if (!is_id_in_scope(SYM_TYPES, id)) {
1659 		yyerror2("type %s is not within scope", id);
1660 		free(id);
1661 		goto bad;
1662 	}
1663 	datum = (type_datum_t *) hashtab_search(policydbp->p_types.table,
1664 						(hashtab_key_t) id);
1665 	if (!datum || datum->flavor == TYPE_ATTRIB) {
1666 		yyerror2("unknown type %s", id);
1667 		free(id);
1668 		goto bad;
1669 	}
1670 	free(id);
1671 
1672 	ebitmap_for_each_positive_bit(&tclasses, node, i) {
1673 		perm = malloc(sizeof(class_perm_node_t));
1674 		if (!perm) {
1675 			yyerror("out of memory");
1676 			goto bad;
1677 		}
1678 		class_perm_node_init(perm);
1679 		perm->tclass = i + 1;
1680 		perm->data = datum->s.value;
1681 		perm->next = avrule->perms;
1682 		avrule->perms = perm;
1683 	}
1684 	ebitmap_destroy(&tclasses);
1685 
1686 	*rule = avrule;
1687 	return 0;
1688 
1689       bad:
1690 	avrule_destroy(avrule);
1691 	free(avrule);
1692 	return -1;
1693 }
1694 
define_compute_type(int which)1695 int define_compute_type(int which)
1696 {
1697 	char *id;
1698 	avrule_t *avrule;
1699 
1700 	if (pass == 1) {
1701 		while ((id = queue_remove(id_queue)))
1702 			free(id);
1703 		while ((id = queue_remove(id_queue)))
1704 			free(id);
1705 		while ((id = queue_remove(id_queue)))
1706 			free(id);
1707 		id = queue_remove(id_queue);
1708 		free(id);
1709 		return 0;
1710 	}
1711 
1712 	if (define_compute_type_helper(which, &avrule))
1713 		return -1;
1714 
1715 	append_avrule(avrule);
1716 	return 0;
1717 }
1718 
define_cond_compute_type(int which)1719 avrule_t *define_cond_compute_type(int which)
1720 {
1721 	char *id;
1722 	avrule_t *avrule;
1723 
1724 	if (pass == 1) {
1725 		while ((id = queue_remove(id_queue)))
1726 			free(id);
1727 		while ((id = queue_remove(id_queue)))
1728 			free(id);
1729 		while ((id = queue_remove(id_queue)))
1730 			free(id);
1731 		id = queue_remove(id_queue);
1732 		free(id);
1733 		return (avrule_t *) 1;
1734 	}
1735 
1736 	if (define_compute_type_helper(which, &avrule))
1737 		return COND_ERR;
1738 
1739 	return avrule;
1740 }
1741 
define_bool_tunable(int is_tunable)1742 int define_bool_tunable(int is_tunable)
1743 {
1744 	char *id, *bool_value;
1745 	cond_bool_datum_t *datum;
1746 	int ret;
1747 	uint32_t value;
1748 
1749 	if (pass == 2) {
1750 		while ((id = queue_remove(id_queue)))
1751 			free(id);
1752 		return 0;
1753 	}
1754 
1755 	id = (char *)queue_remove(id_queue);
1756 	if (!id) {
1757 		yyerror("no identifier for bool definition?");
1758 		return -1;
1759 	}
1760 	if (id_has_dot(id)) {
1761 		free(id);
1762 		yyerror("boolean identifiers may not contain periods");
1763 		return -1;
1764 	}
1765 	datum = (cond_bool_datum_t *) malloc(sizeof(cond_bool_datum_t));
1766 	if (!datum) {
1767 		yyerror("out of memory");
1768 		free(id);
1769 		return -1;
1770 	}
1771 	memset(datum, 0, sizeof(cond_bool_datum_t));
1772 	if (is_tunable)
1773 		datum->flags |= COND_BOOL_FLAGS_TUNABLE;
1774 	ret = declare_symbol(SYM_BOOLS, id, datum, &value, &value);
1775 	switch (ret) {
1776 	case -3:{
1777 			yyerror("Out of memory!");
1778 			goto cleanup;
1779 		}
1780 	case -2:{
1781 			yyerror2("duplicate declaration of boolean %s", id);
1782 			goto cleanup;
1783 		}
1784 	case -1:{
1785 			yyerror("could not declare boolean here");
1786 			goto cleanup;
1787 		}
1788 	case 0:
1789 	case 1:{
1790 			break;
1791 		}
1792 	default:{
1793 			assert(0);	/* should never get here */
1794 		}
1795 	}
1796 	datum->s.value = value;
1797 
1798 	bool_value = (char *)queue_remove(id_queue);
1799 	if (!bool_value) {
1800 		yyerror("no default value for bool definition?");
1801 		return -1;
1802 	}
1803 
1804 	datum->state = (bool_value[0] == 'T') ? 1 : 0;
1805 	free(bool_value);
1806 	return 0;
1807       cleanup:
1808 	cond_destroy_bool(id, datum, NULL);
1809 	return -1;
1810 }
1811 
define_cond_pol_list(avrule_t * avlist,avrule_t * sl)1812 avrule_t *define_cond_pol_list(avrule_t * avlist, avrule_t * sl)
1813 {
1814 	if (pass == 1) {
1815 		/* return something so we get through pass 1 */
1816 		return (avrule_t *) 1;
1817 	}
1818 
1819 	if (sl == NULL) {
1820 		/* This is a require block, return previous list */
1821 		return avlist;
1822 	}
1823 
1824 	/* prepend the new avlist to the pre-existing one */
1825 	sl->next = avlist;
1826 	return sl;
1827 }
1828 
1829 typedef struct av_ioctl_range {
1830 	uint16_t low;
1831 	uint16_t high;
1832 } av_ioctl_range_t;
1833 
1834 struct av_ioctl_range_list {
1835 	uint8_t omit;
1836 	av_ioctl_range_t range;
1837 	struct av_ioctl_range_list *next;
1838 };
1839 
avrule_sort_ioctls(struct av_ioctl_range_list ** rangehead)1840 static int avrule_sort_ioctls(struct av_ioctl_range_list **rangehead)
1841 {
1842 	struct av_ioctl_range_list *r, *r2, *sorted, *sortedhead = NULL;
1843 
1844 	/* order list by range.low */
1845 	for (r = *rangehead; r != NULL; r = r->next) {
1846 		sorted = malloc(sizeof(struct av_ioctl_range_list));
1847 		if (sorted == NULL)
1848 			goto error;
1849 		memcpy(sorted, r, sizeof(struct av_ioctl_range_list));
1850 		sorted->next = NULL;
1851 		if (sortedhead == NULL) {
1852 			sortedhead = sorted;
1853 			continue;
1854 		}
1855 	        for (r2 = sortedhead; r2 != NULL; r2 = r2->next) {
1856 			if (sorted->range.low < r2->range.low) {
1857 				/* range is the new head */
1858 				sorted->next = r2;
1859 				sortedhead = sorted;
1860 				break;
1861 			} else if ((r2 ->next != NULL) &&
1862 					(r->range.low < r2->next->range.low)) {
1863 				/* insert range between elements */
1864 				sorted->next = r2->next;
1865 				r2->next = sorted;
1866 				break;
1867 			} else if (r2->next == NULL) {
1868 				/* range is the new tail*/
1869 				r2->next = sorted;
1870 				break;
1871 			}
1872 		}
1873 	}
1874 
1875 	r = *rangehead;
1876 	while (r != NULL) {
1877 		r2 = r;
1878 		r = r->next;
1879 		free(r2);
1880 	}
1881 	*rangehead = sortedhead;
1882 	return 0;
1883 error:
1884 	yyerror("out of memory");
1885 	return -1;
1886 }
1887 
avrule_merge_ioctls(struct av_ioctl_range_list ** rangehead)1888 static int avrule_merge_ioctls(struct av_ioctl_range_list **rangehead)
1889 {
1890 	struct av_ioctl_range_list *r, *tmp;
1891 	r = *rangehead;
1892 	while (r != NULL && r->next != NULL) {
1893 		/* merge */
1894 		if ((r->range.high + 1) >= r->next->range.low) {
1895 			/* keep the higher of the two */
1896 			if (r->range.high < r->next->range.high)
1897 				r->range.high = r->next->range.high;
1898 			tmp = r->next;
1899 			r->next = r->next->next;
1900 			free(tmp);
1901 			continue;
1902 		}
1903 		r = r->next;
1904 	}
1905 	return 0;
1906 }
1907 
avrule_read_ioctls(struct av_ioctl_range_list ** rangehead)1908 static int avrule_read_ioctls(struct av_ioctl_range_list **rangehead)
1909 {
1910 	char *id;
1911 	struct av_ioctl_range_list *rnew, *r = NULL;
1912 	uint8_t omit = 0;
1913 
1914 	*rangehead = NULL;
1915 
1916 	/* read in all the ioctl commands */
1917 	while ((id = queue_remove(id_queue))) {
1918 		if (strcmp(id,"~") == 0) {
1919 			/* these are values to be omitted */
1920 			free(id);
1921 			omit = 1;
1922 		} else if (strcmp(id,"-") == 0) {
1923 			/* high value of range */
1924 			free(id);
1925 			id = queue_remove(id_queue);
1926 			r->range.high = (uint16_t) strtoul(id,NULL,0);
1927 			if (r->range.high < r->range.low) {
1928 				yyerror("Ioctl ranges must be in ascending order.");
1929 				return -1;
1930 			}
1931 			free(id);
1932 		} else {
1933 			/* read in new low value */
1934 			rnew = malloc(sizeof(struct av_ioctl_range_list));
1935 			if (rnew == NULL)
1936 				goto error;
1937 			rnew->next = NULL;
1938 			if (*rangehead == NULL) {
1939 				*rangehead = rnew;
1940 				r = *rangehead;
1941 			} else {
1942 				r->next = rnew;
1943 				r = r->next;
1944 			}
1945 			rnew->range.low = (uint16_t) strtoul(id,NULL,0);
1946 			rnew->range.high = rnew->range.low;
1947 			free(id);
1948 		}
1949 	}
1950 	r = *rangehead;
1951 	if (r) {
1952 		r->omit = omit;
1953 	}
1954 	return 0;
1955 error:
1956 	yyerror("out of memory");
1957 	return -1;
1958 }
1959 
1960 /* flip to included ranges */
avrule_omit_ioctls(struct av_ioctl_range_list ** rangehead)1961 static int avrule_omit_ioctls(struct av_ioctl_range_list **rangehead)
1962 {
1963 	struct av_ioctl_range_list *rnew, *r, *newhead, *r2;
1964 
1965 	rnew = calloc(1, sizeof(struct av_ioctl_range_list));
1966 	if (!rnew)
1967 		goto error;
1968 
1969 	newhead = rnew;
1970 
1971 	r = *rangehead;
1972 	r2 = newhead;
1973 
1974 	if (r->range.low == 0) {
1975 		r2->range.low = r->range.high + 1;
1976 		r = r->next;
1977 	} else {
1978 		r2->range.low = 0;
1979 	}
1980 
1981 	while (r) {
1982 		r2->range.high = r->range.low - 1;
1983 		rnew = calloc(1, sizeof(struct av_ioctl_range_list));
1984 		if (!rnew)
1985 			goto error;
1986 		r2->next = rnew;
1987 		r2 = r2->next;
1988 
1989 		r2->range.low = r->range.high + 1;
1990 		if (!r->next)
1991 			r2->range.high = 0xffff;
1992 		r = r->next;
1993 	}
1994 
1995 	r = *rangehead;
1996 	while (r != NULL) {
1997 		r2 = r;
1998 		r = r->next;
1999 		free(r2);
2000 	}
2001 	*rangehead = newhead;
2002 	return 0;
2003 
2004 error:
2005 	yyerror("out of memory");
2006 	return -1;
2007 }
2008 
avrule_ioctl_ranges(struct av_ioctl_range_list ** rangelist)2009 static int avrule_ioctl_ranges(struct av_ioctl_range_list **rangelist)
2010 {
2011 	struct av_ioctl_range_list *rangehead;
2012 	uint8_t omit;
2013 
2014 	/* read in ranges to include and omit */
2015 	if (avrule_read_ioctls(&rangehead))
2016 		return -1;
2017 	if (rangehead == NULL) {
2018 		yyerror("error processing ioctl commands");
2019 		return -1;
2020 	}
2021 	omit = rangehead->omit;
2022 	/* sort and merge the input ioctls */
2023 	if (avrule_sort_ioctls(&rangehead))
2024 		return -1;
2025 	if (avrule_merge_ioctls(&rangehead))
2026 		return -1;
2027 	/* flip ranges if these are omitted */
2028 	if (omit) {
2029 		if (avrule_omit_ioctls(&rangehead))
2030 			return -1;
2031 	}
2032 
2033 	*rangelist = rangehead;
2034 	return 0;
2035 }
2036 
define_te_avtab_xperms_helper(int which,avrule_t ** rule)2037 static int define_te_avtab_xperms_helper(int which, avrule_t ** rule)
2038 {
2039 	char *id;
2040 	class_perm_node_t *perms, *tail = NULL, *cur_perms = NULL;
2041 	class_datum_t *cladatum;
2042 	perm_datum_t *perdatum = NULL;
2043 	ebitmap_t tclasses;
2044 	ebitmap_node_t *node;
2045 	avrule_t *avrule;
2046 	unsigned int i;
2047 	int add = 1, ret = 0;
2048 
2049 	avrule = (avrule_t *) malloc(sizeof(avrule_t));
2050 	if (!avrule) {
2051 		yyerror("out of memory");
2052 		ret = -1;
2053 		goto out;
2054 	}
2055 	avrule_init(avrule);
2056 	avrule->specified = which;
2057 	avrule->line = policydb_lineno;
2058 	avrule->source_line = source_lineno;
2059 	avrule->source_filename = strdup(source_file);
2060 	avrule->xperms = NULL;
2061 	if (!avrule->source_filename) {
2062 		yyerror("out of memory");
2063 		return -1;
2064 	}
2065 
2066 	while ((id = queue_remove(id_queue))) {
2067 		if (set_types
2068 		    (&avrule->stypes, id, &add,
2069 		     which == AVRULE_XPERMS_NEVERALLOW ? 1 : 0)) {
2070 			ret = -1;
2071 			goto out;
2072 		}
2073 	}
2074 	add = 1;
2075 	while ((id = queue_remove(id_queue))) {
2076 		if (strcmp(id, "self") == 0) {
2077 			free(id);
2078 			if (add == 0) {
2079 				yyerror("-self is not supported");
2080 				ret = -1;
2081 				goto out;
2082 			}
2083 			avrule->flags |= RULE_SELF;
2084 			continue;
2085 		}
2086 		if (set_types
2087 		    (&avrule->ttypes, id, &add,
2088 		     which == AVRULE_XPERMS_NEVERALLOW ? 1 : 0)) {
2089 			ret = -1;
2090 			goto out;
2091 		}
2092 	}
2093 
2094 	ebitmap_init(&tclasses);
2095 	ret = read_classes(&tclasses);
2096 	if (ret)
2097 		goto out;
2098 
2099 	perms = NULL;
2100 	id = queue_head(id_queue);
2101 	ebitmap_for_each_positive_bit(&tclasses, node, i) {
2102 		cur_perms =
2103 		    (class_perm_node_t *) malloc(sizeof(class_perm_node_t));
2104 		if (!cur_perms) {
2105 			yyerror("out of memory");
2106 			ret = -1;
2107 			goto out;
2108 		}
2109 		class_perm_node_init(cur_perms);
2110 		cur_perms->tclass = i + 1;
2111 		if (!perms)
2112 			perms = cur_perms;
2113 		if (tail)
2114 			tail->next = cur_perms;
2115 		tail = cur_perms;
2116 
2117 		cladatum = policydbp->class_val_to_struct[i];
2118 		perdatum = hashtab_search(cladatum->permissions.table, id);
2119 		if (!perdatum) {
2120 			if (cladatum->comdatum) {
2121 				perdatum = hashtab_search(cladatum->comdatum->
2122 							permissions.table,
2123 							id);
2124 			}
2125 		}
2126 		if (!perdatum) {
2127 			yyerror2("permission %s is not defined"
2128 				     " for class %s", id,
2129 				     policydbp->p_class_val_to_name[i]);
2130 			continue;
2131 		} else if (!is_perm_in_scope (id, policydbp->p_class_val_to_name[i])) {
2132 			yyerror2("permission %s of class %s is"
2133 			     " not within scope", id,
2134 			     policydbp->p_class_val_to_name[i]);
2135 			continue;
2136 		} else {
2137 			cur_perms->data |= UINT32_C(1) << (perdatum->s.value - 1);
2138 		}
2139 	}
2140 
2141 	ebitmap_destroy(&tclasses);
2142 
2143 	avrule->perms = perms;
2144 	*rule = avrule;
2145 
2146 out:
2147 	return ret;
2148 }
2149 
2150 /* index of the u32 containing the permission */
2151 #define XPERM_IDX(x) ((x) >> 5)
2152 /* set bits 0 through x-1 within the u32 */
2153 #define XPERM_SETBITS(x) ((UINT32_C(1) << ((x) & 0x1f)) - 1)
2154 /* low value for this u32 */
2155 #define XPERM_LOW(x) ((x) << 5)
2156 /* high value for this u32 */
2157 #define XPERM_HIGH(x) ((((x) + 1) << 5) - 1)
avrule_xperm_setrangebits(uint16_t low,uint16_t high,av_extended_perms_t * xperms)2158 static void avrule_xperm_setrangebits(uint16_t low, uint16_t high,
2159 				av_extended_perms_t *xperms)
2160 {
2161 	unsigned int i;
2162 	uint16_t h = high + 1;
2163 	/* for each u32 that this low-high range touches, set driver permissions */
2164 	for (i = XPERM_IDX(low); i <= XPERM_IDX(high); i++) {
2165 		/* set all bits in u32 */
2166 		if ((low <= XPERM_LOW(i)) && (high >= XPERM_HIGH(i)))
2167 			xperms->perms[i] |= ~0U;
2168 		/* set low bits */
2169 		else if ((low <= XPERM_LOW(i)) && (high < XPERM_HIGH(i)))
2170 			xperms->perms[i] |= XPERM_SETBITS(h);
2171 		/* set high bits */
2172 		else if ((low > XPERM_LOW(i)) && (high >= XPERM_HIGH(i)))
2173 			xperms->perms[i] |= ~0U - XPERM_SETBITS(low);
2174 		/* set middle bits */
2175 		else if ((low > XPERM_LOW(i)) && (high <= XPERM_HIGH(i)))
2176 			xperms->perms[i] |= XPERM_SETBITS(h) - XPERM_SETBITS(low);
2177 	}
2178 }
2179 
avrule_xperms_used(const av_extended_perms_t * xperms)2180 static int avrule_xperms_used(const av_extended_perms_t *xperms)
2181 {
2182 	unsigned int i;
2183 
2184 	for (i = 0; i < sizeof(xperms->perms)/sizeof(xperms->perms[0]); i++) {
2185 		if (xperms->perms[i])
2186 			return 1;
2187 	}
2188 	return 0;
2189 }
2190 
2191 /*
2192  * using definitions found in kernel document ioctl-number.txt
2193  * The kernel components of an ioctl command are:
2194  * dir, size, driver, and function. Only the driver and function fields
2195  * are considered here
2196  */
2197 #define IOC_DRIV(x) ((x) >> 8)
2198 #define IOC_FUNC(x) ((x) & 0xff)
2199 #define IOC_CMD(driver, func) (((driver) << 8) + (func))
avrule_ioctl_partialdriver(struct av_ioctl_range_list * rangelist,av_extended_perms_t * complete_driver,av_extended_perms_t ** extended_perms)2200 static int avrule_ioctl_partialdriver(struct av_ioctl_range_list *rangelist,
2201 				av_extended_perms_t *complete_driver,
2202 				av_extended_perms_t **extended_perms)
2203 {
2204 	struct av_ioctl_range_list *r;
2205 	av_extended_perms_t *xperms;
2206 	uint8_t low, high;
2207 
2208 	xperms = calloc(1, sizeof(av_extended_perms_t));
2209 	if (!xperms) {
2210 		yyerror("out of memory");
2211 		return -1;
2212 	}
2213 
2214 	r = rangelist;
2215 	while(r) {
2216 		low = IOC_DRIV(r->range.low);
2217 		high = IOC_DRIV(r->range.high);
2218 		if (complete_driver) {
2219 			if (!xperm_test(low, complete_driver->perms))
2220 				xperm_set(low, xperms->perms);
2221 			if (!xperm_test(high, complete_driver->perms))
2222 				xperm_set(high, xperms->perms);
2223 		} else {
2224 			xperm_set(low, xperms->perms);
2225 			xperm_set(high, xperms->perms);
2226 		}
2227 		r = r->next;
2228 	}
2229 	if (avrule_xperms_used(xperms)) {
2230 		*extended_perms = xperms;
2231 	} else {
2232 		free(xperms);
2233 		*extended_perms = NULL;
2234 	}
2235 	return 0;
2236 
2237 }
2238 
avrule_ioctl_completedriver(struct av_ioctl_range_list * rangelist,av_extended_perms_t ** extended_perms)2239 static int avrule_ioctl_completedriver(struct av_ioctl_range_list *rangelist,
2240 			av_extended_perms_t **extended_perms)
2241 {
2242 	struct av_ioctl_range_list *r;
2243 	av_extended_perms_t *xperms;
2244 	uint16_t low, high;
2245 	xperms = calloc(1, sizeof(av_extended_perms_t));
2246 	if (!xperms) {
2247 		yyerror("out of memory");
2248 		return -1;
2249 	}
2250 
2251 	r = rangelist;
2252 	while(r) {
2253 		/*
2254 		 * Any driver code that has sequence 0x00 - 0xff is a complete code,
2255 		 *
2256 		 * if command number = 0xff, then round high up to next code,
2257 		 * else 0x00 - 0xfe keep current code
2258 		 * of this range. temporarily u32 for the + 1
2259 		 * to account for possible rollover before right shift
2260 		 */
2261 		high = IOC_DRIV((uint32_t) (r->range.high + 1));
2262 		/* if 0x00 keep current driver code else 0x01 - 0xff round up to next code*/
2263 		low = IOC_DRIV(r->range.low);
2264 		if (IOC_FUNC(r->range.low))
2265 			low++;
2266 		if (high > low)
2267 			avrule_xperm_setrangebits(low, high - 1, xperms);
2268 		r = r->next;
2269 	}
2270 	if (avrule_xperms_used(xperms)) {
2271 		xperms->driver = 0x00;
2272 		xperms->specified = AVRULE_XPERMS_IOCTLDRIVER;
2273 		*extended_perms = xperms;
2274 	} else {
2275 		free(xperms);
2276 		*extended_perms = NULL;
2277 	}
2278 	return 0;
2279 }
2280 
avrule_ioctl_func(struct av_ioctl_range_list * rangelist,av_extended_perms_t ** extended_perms,unsigned int driver)2281 static int avrule_ioctl_func(struct av_ioctl_range_list *rangelist,
2282 		av_extended_perms_t **extended_perms, unsigned int driver)
2283 {
2284 	struct av_ioctl_range_list *r;
2285 	av_extended_perms_t *xperms;
2286 	uint16_t low, high;
2287 
2288 	*extended_perms = NULL;
2289 	xperms = calloc(1, sizeof(av_extended_perms_t));
2290 	if (!xperms) {
2291 		yyerror("out of memory");
2292 		return -1;
2293 	}
2294 
2295 	r = rangelist;
2296 	/* for the passed in driver code, find the ranges that apply */
2297 	while (r) {
2298 		low = r->range.low;
2299 		high = r->range.high;
2300 		if ((driver != IOC_DRIV(low)) && (driver != IOC_DRIV(high))) {
2301 			r = r->next;
2302 			continue;
2303 		}
2304 
2305 		if (driver == IOC_DRIV(low)) {
2306 			if (high > IOC_CMD(driver, 0xff))
2307 				high = IOC_CMD(driver, 0xff);
2308 
2309 		} else {
2310 			if (low < IOC_CMD(driver, 0))
2311 				low = IOC_CMD(driver, 0);
2312 		}
2313 
2314 		low = IOC_FUNC(low);
2315 		high = IOC_FUNC(high);
2316 		avrule_xperm_setrangebits(low, high, xperms);
2317 		xperms->driver = driver;
2318 		xperms->specified = AVRULE_XPERMS_IOCTLFUNCTION;
2319 		r = r->next;
2320 	}
2321 
2322 	if (avrule_xperms_used(xperms)) {
2323 		*extended_perms = xperms;
2324 	} else {
2325 		free(xperms);
2326 		*extended_perms = NULL;
2327 	}
2328 	return 0;
2329 }
2330 
xperms_for_each_bit(unsigned int * bit,av_extended_perms_t * xperms)2331 static unsigned int xperms_for_each_bit(unsigned int *bit, av_extended_perms_t *xperms)
2332 {
2333 	unsigned int i;
2334 	for (i = *bit; i < sizeof(xperms->perms)*8; i++) {
2335 		if (xperm_test(i,xperms->perms)) {
2336 			xperm_clear(i, xperms->perms);
2337 			*bit = i;
2338 			return 1;
2339 		}
2340 	}
2341 	return 0;
2342 }
2343 
avrule_cpy(avrule_t * dest,const avrule_t * src)2344 static int avrule_cpy(avrule_t *dest, const avrule_t *src)
2345 {
2346 	class_perm_node_t *src_perms;
2347 	class_perm_node_t *dest_perms, *dest_tail;
2348 	dest_tail = NULL;
2349 
2350 	avrule_init(dest);
2351 	dest->specified = src->specified;
2352 	dest->flags = src->flags;
2353 	if (type_set_cpy(&dest->stypes, &src->stypes)) {
2354 		yyerror("out of memory");
2355 		return -1;
2356 	}
2357 	if (type_set_cpy(&dest->ttypes, &src->ttypes)) {
2358 		yyerror("out of memory");
2359 		return -1;
2360 	}
2361 	dest->line = src->line;
2362 	dest->source_filename = strdup(source_file);
2363 	if (!dest->source_filename) {
2364 		yyerror("out of memory");
2365 		return -1;
2366 	}
2367 	dest->source_line = src->source_line;
2368 
2369 	/* increment through the class perms and copy over */
2370 	src_perms = src->perms;
2371 	while (src_perms) {
2372 		dest_perms = (class_perm_node_t *) calloc(1, sizeof(class_perm_node_t));
2373 		if (!dest_perms) {
2374 			yyerror("out of memory");
2375 			return -1;
2376 		}
2377 		class_perm_node_init(dest_perms);
2378 
2379 		if (!dest->perms)
2380 			dest->perms = dest_perms;
2381 		else
2382 			dest_tail->next = dest_perms;
2383 
2384 		dest_perms->tclass = src_perms->tclass;
2385 		dest_perms->data = src_perms->data;
2386 		dest_perms->next = NULL;
2387 		dest_tail = dest_perms;
2388 		src_perms = src_perms->next;
2389 	}
2390 	return 0;
2391 }
2392 
define_te_avtab_ioctl(const avrule_t * avrule_template)2393 static int define_te_avtab_ioctl(const avrule_t *avrule_template)
2394 {
2395 	avrule_t *avrule;
2396 	struct av_ioctl_range_list *rangelist, *r;
2397 	av_extended_perms_t *complete_driver, *partial_driver, *xperms;
2398 	unsigned int i;
2399 
2400 
2401 	/* organize ioctl ranges */
2402 	if (avrule_ioctl_ranges(&rangelist))
2403 		return -1;
2404 
2405 	/* create rule for ioctl driver types that are entirely enabled */
2406 	if (avrule_ioctl_completedriver(rangelist, &complete_driver))
2407 		return -1;
2408 	if (complete_driver) {
2409 		avrule = (avrule_t *) calloc(1, sizeof(avrule_t));
2410 		if (!avrule) {
2411 			yyerror("out of memory");
2412 			return -1;
2413 		}
2414 		if (avrule_cpy(avrule, avrule_template))
2415 			return -1;
2416 		avrule->xperms = complete_driver;
2417 		append_avrule(avrule);
2418 	}
2419 
2420 	/* flag ioctl driver codes that are partially enabled */
2421 	if (avrule_ioctl_partialdriver(rangelist, complete_driver, &partial_driver))
2422 		return -1;
2423 
2424 	if (!partial_driver || !avrule_xperms_used(partial_driver))
2425 		goto done;
2426 
2427 	/*
2428 	 * create rule for each partially used driver codes
2429 	 * "partially used" meaning that the code number e.g. socket 0x89
2430 	 * has some permission bits set and others not set.
2431 	 */
2432 	i = 0;
2433 	while (xperms_for_each_bit(&i, partial_driver)) {
2434 		if (avrule_ioctl_func(rangelist, &xperms, i))
2435 			return -1;
2436 
2437 		if (xperms) {
2438 			avrule = (avrule_t *) calloc(1, sizeof(avrule_t));
2439 			if (!avrule) {
2440 				yyerror("out of memory");
2441 				return -1;
2442 			}
2443 			if (avrule_cpy(avrule, avrule_template))
2444 				return -1;
2445 			avrule->xperms = xperms;
2446 			append_avrule(avrule);
2447 		}
2448 	}
2449 
2450 done:
2451 	if (partial_driver)
2452 		free(partial_driver);
2453 
2454 	while (rangelist != NULL) {
2455 		r = rangelist;
2456 		rangelist = rangelist->next;
2457 		free(r);
2458 	}
2459 
2460 	return 0;
2461 }
2462 
define_te_avtab_extended_perms(int which)2463 int define_te_avtab_extended_perms(int which)
2464 {
2465 	char *id;
2466 	unsigned int i;
2467 	avrule_t *avrule_template;
2468 	int rc = 0;
2469 
2470 	if (pass == 1) {
2471 		for (i = 0; i < 4; i++) {
2472 			while ((id = queue_remove(id_queue)))
2473 				free(id);
2474 		}
2475 		return 0;
2476 	}
2477 
2478 	/* populate avrule template with source/target/tclass */
2479 	if (define_te_avtab_xperms_helper(which, &avrule_template))
2480 		return -1;
2481 
2482 	id = queue_remove(id_queue);
2483 	if (strcmp(id,"ioctl") == 0) {
2484 		rc = define_te_avtab_ioctl(avrule_template);
2485 	} else {
2486 		yyerror("only ioctl extended permissions are supported");
2487 		rc = -1;
2488 	}
2489 
2490 	free(id);
2491 	avrule_destroy(avrule_template);
2492 	free(avrule_template);
2493 
2494 	return rc;
2495 }
2496 
define_te_avtab_helper(int which,avrule_t ** rule)2497 static int define_te_avtab_helper(int which, avrule_t ** rule)
2498 {
2499 	char *id;
2500 	class_datum_t *cladatum;
2501 	perm_datum_t *perdatum = NULL;
2502 	class_perm_node_t *perms, *tail = NULL, *cur_perms = NULL;
2503 	ebitmap_t tclasses;
2504 	ebitmap_node_t *node;
2505 	avrule_t *avrule;
2506 	unsigned int i;
2507 	int add = 1, ret = 0;
2508 	int suppress = 0;
2509 
2510 	avrule = (avrule_t *) malloc(sizeof(avrule_t));
2511 	if (!avrule) {
2512 		yyerror("memory error");
2513 		ret = -1;
2514 		goto out;
2515 	}
2516 	avrule_init(avrule);
2517 	avrule->specified = which;
2518 	avrule->line = policydb_lineno;
2519 	avrule->source_line = source_lineno;
2520 	avrule->source_filename = strdup(source_file);
2521 	avrule->xperms = NULL;
2522 	if (!avrule->source_filename) {
2523 		yyerror("out of memory");
2524 		return -1;
2525 	}
2526 
2527 
2528 	while ((id = queue_remove(id_queue))) {
2529 		if (set_types
2530 		    (&avrule->stypes, id, &add,
2531 		     which == AVRULE_NEVERALLOW ? 1 : 0)) {
2532 			ret = -1;
2533 			goto out;
2534 		}
2535 	}
2536 	add = 1;
2537 	while ((id = queue_remove(id_queue))) {
2538 		if (strcmp(id, "self") == 0) {
2539 			free(id);
2540 			if (add == 0) {
2541 				yyerror("-self is not supported");
2542 				ret = -1;
2543 				goto out;
2544 			}
2545 			avrule->flags |= RULE_SELF;
2546 			continue;
2547 		}
2548 		if (set_types
2549 		    (&avrule->ttypes, id, &add,
2550 		     which == AVRULE_NEVERALLOW ? 1 : 0)) {
2551 			ret = -1;
2552 			goto out;
2553 		}
2554 	}
2555 
2556 	ebitmap_init(&tclasses);
2557 	ret = read_classes(&tclasses);
2558 	if (ret)
2559 		goto out;
2560 
2561 	perms = NULL;
2562 	ebitmap_for_each_positive_bit(&tclasses, node, i) {
2563 		cur_perms =
2564 		    (class_perm_node_t *) malloc(sizeof(class_perm_node_t));
2565 		if (!cur_perms) {
2566 			yyerror("out of memory");
2567 			ret = -1;
2568 			goto out;
2569 		}
2570 		class_perm_node_init(cur_perms);
2571 		cur_perms->tclass = i + 1;
2572 		if (!perms)
2573 			perms = cur_perms;
2574 		if (tail)
2575 			tail->next = cur_perms;
2576 		tail = cur_perms;
2577 	}
2578 
2579 	while ((id = queue_remove(id_queue))) {
2580 		cur_perms = perms;
2581 		ebitmap_for_each_positive_bit(&tclasses, node, i) {
2582 			cladatum = policydbp->class_val_to_struct[i];
2583 
2584 			if (strcmp(id, "*") == 0) {
2585 				/* set all permissions in the class */
2586 				cur_perms->data = ~0U;
2587 				goto next;
2588 			}
2589 
2590 			if (strcmp(id, "~") == 0) {
2591 				/* complement the set */
2592 				if (which == AVRULE_DONTAUDIT)
2593 					yywarn("dontaudit rule with a ~?");
2594 				cur_perms->data = ~cur_perms->data;
2595 				goto next;
2596 			}
2597 
2598 			perdatum =
2599 			    hashtab_search(cladatum->permissions.table, id);
2600 			if (!perdatum) {
2601 				if (cladatum->comdatum) {
2602 					perdatum =
2603 					    hashtab_search(cladatum->comdatum->
2604 							   permissions.table,
2605 							   id);
2606 				}
2607 			}
2608 			if (!perdatum) {
2609 				if (!suppress)
2610 					yyerror2("permission %s is not defined"
2611 					     " for class %s", id,
2612 					     policydbp->p_class_val_to_name[i]);
2613 				continue;
2614 			} else
2615 			    if (!is_perm_in_scope
2616 				(id, policydbp->p_class_val_to_name[i])) {
2617 				if (!suppress) {
2618 					yyerror2("permission %s of class %s is"
2619 					     " not within scope", id,
2620 					     policydbp->p_class_val_to_name[i]);
2621 				}
2622 				continue;
2623 			} else {
2624 				cur_perms->data |= UINT32_C(1) << (perdatum->s.value - 1);
2625 			}
2626 		      next:
2627 			cur_perms = cur_perms->next;
2628 		}
2629 
2630 		free(id);
2631 	}
2632 
2633 	ebitmap_destroy(&tclasses);
2634 
2635 	avrule->perms = perms;
2636 	*rule = avrule;
2637 
2638       out:
2639 	if (ret) {
2640 		avrule_destroy(avrule);
2641 		free(avrule);
2642 	}
2643 	return ret;
2644 
2645 }
2646 
define_cond_te_avtab(int which)2647 avrule_t *define_cond_te_avtab(int which)
2648 {
2649 	char *id;
2650 	avrule_t *avrule;
2651 	int i;
2652 
2653 	if (pass == 1) {
2654 		for (i = 0; i < 4; i++) {
2655 			while ((id = queue_remove(id_queue)))
2656 				free(id);
2657 		}
2658 		return (avrule_t *) 1;	/* any non-NULL value */
2659 	}
2660 
2661 	if (define_te_avtab_helper(which, &avrule))
2662 		return COND_ERR;
2663 
2664 	return avrule;
2665 }
2666 
define_te_avtab(int which)2667 int define_te_avtab(int which)
2668 {
2669 	char *id;
2670 	avrule_t *avrule;
2671 	int i;
2672 
2673 	if (pass == 1) {
2674 		for (i = 0; i < 4; i++) {
2675 			while ((id = queue_remove(id_queue)))
2676 				free(id);
2677 		}
2678 		return 0;
2679 	}
2680 
2681 	if (define_te_avtab_helper(which, &avrule))
2682 		return -1;
2683 
2684 	/* append this avrule to the end of the current rules list */
2685 	append_avrule(avrule);
2686 	return 0;
2687 }
2688 
2689 /* The role-types rule is no longer used to declare regular role or
2690  * role attribute, but solely aimed for declaring role-types associations.
2691  */
define_role_types(void)2692 int define_role_types(void)
2693 {
2694 	role_datum_t *role;
2695 	char *id;
2696 	int add = 1;
2697 
2698 	if (pass == 1) {
2699 		while ((id = queue_remove(id_queue)))
2700 			free(id);
2701 		return 0;
2702 	}
2703 
2704 	id = (char *)queue_remove(id_queue);
2705 	if (!id) {
2706 		yyerror("no role name for role-types rule?");
2707 		return -1;
2708 	}
2709 
2710 	if (!is_id_in_scope(SYM_ROLES, id)) {
2711 		yyerror2("role %s is not within scope", id);
2712 		free(id);
2713 		return -1;
2714 	}
2715 
2716 	role = hashtab_search(policydbp->p_roles.table, id);
2717 	if (!role) {
2718 		yyerror2("unknown role %s", id);
2719 		free(id);
2720 		return -1;
2721 	}
2722 	role = get_local_role(id, role->s.value, (role->flavor == ROLE_ATTRIB));
2723 
2724 	while ((id = queue_remove(id_queue))) {
2725 		if (set_types(&role->types, id, &add, 0))
2726 			return -1;
2727 	}
2728 
2729 	return 0;
2730 }
2731 
define_attrib_role(void)2732 int define_attrib_role(void)
2733 {
2734 	if (pass == 2) {
2735 		free(queue_remove(id_queue));
2736 		return 0;
2737 	}
2738 
2739 	/* Declare a role attribute */
2740 	if (declare_role(TRUE) == NULL)
2741 		return -1;
2742 
2743 	return 0;
2744 }
2745 
define_role_attr(void)2746 int define_role_attr(void)
2747 {
2748 	char *id;
2749 	role_datum_t *r, *attr;
2750 
2751 	if (pass == 2) {
2752 		while ((id = queue_remove(id_queue)))
2753 			free(id);
2754 		return 0;
2755 	}
2756 
2757 	/* Declare a regular role */
2758 	if ((r = declare_role(FALSE)) == NULL)
2759 		return -1;
2760 
2761 	while ((id = queue_remove(id_queue))) {
2762 		if (!is_id_in_scope(SYM_ROLES, id)) {
2763 			yyerror2("attribute %s is not within scope", id);
2764 			free(id);
2765 			return -1;
2766 		}
2767 		attr = hashtab_search(policydbp->p_roles.table, id);
2768 		if (!attr) {
2769 			/* treat it as a fatal error */
2770 			yyerror2("role attribute %s is not declared", id);
2771 			free(id);
2772 			return -1;
2773 		}
2774 
2775 		if (attr->flavor != ROLE_ATTRIB) {
2776 			yyerror2("%s is a regular role, not an attribute", id);
2777 			free(id);
2778 			return -1;
2779 		}
2780 
2781 		if ((attr = get_local_role(id, attr->s.value, 1)) == NULL) {
2782 			yyerror("Out of memory!");
2783 			return -1;
2784 		}
2785 
2786 		if (ebitmap_set_bit(&attr->roles, (r->s.value - 1), TRUE)) {
2787 			yyerror("out of memory");
2788 			return -1;
2789 		}
2790 	}
2791 
2792 	return 0;
2793 }
2794 
define_roleattribute(void)2795 int define_roleattribute(void)
2796 {
2797 	char *id;
2798 	role_datum_t *r, *attr;
2799 
2800 	if (pass == 2) {
2801 		while ((id = queue_remove(id_queue)))
2802 			free(id);
2803 		return 0;
2804 	}
2805 
2806 	id = (char *)queue_remove(id_queue);
2807 	if (!id) {
2808 		yyerror("no role name for roleattribute definition?");
2809 		return -1;
2810 	}
2811 
2812 	if (!is_id_in_scope(SYM_ROLES, id)) {
2813 		yyerror2("role %s is not within scope", id);
2814 		free(id);
2815 		return -1;
2816 	}
2817 	r = hashtab_search(policydbp->p_roles.table, id);
2818 	/* We support adding one role attribute into another */
2819 	if (!r) {
2820 		yyerror2("unknown role %s", id);
2821 		free(id);
2822 		return -1;
2823 	}
2824 	free(id);
2825 
2826 	while ((id = queue_remove(id_queue))) {
2827 		if (!is_id_in_scope(SYM_ROLES, id)) {
2828 			yyerror2("attribute %s is not within scope", id);
2829 			free(id);
2830 			return -1;
2831 		}
2832 		attr = hashtab_search(policydbp->p_roles.table, id);
2833 		if (!attr) {
2834 			/* treat it as a fatal error */
2835 			yyerror2("role attribute %s is not declared", id);
2836 			free(id);
2837 			return -1;
2838 		}
2839 
2840 		if (attr->flavor != ROLE_ATTRIB) {
2841 			yyerror2("%s is a regular role, not an attribute", id);
2842 			free(id);
2843 			return -1;
2844 		}
2845 
2846 		if ((attr = get_local_role(id, attr->s.value, 1)) == NULL) {
2847 			yyerror("Out of memory!");
2848 			return -1;
2849 		}
2850 
2851 		if (ebitmap_set_bit(&attr->roles, (r->s.value - 1), TRUE)) {
2852 			yyerror("out of memory");
2853 			return -1;
2854 		}
2855 	}
2856 
2857 	return 0;
2858 }
2859 
merge_roles_dom(role_datum_t * r1,role_datum_t * r2)2860 role_datum_t *merge_roles_dom(role_datum_t * r1, role_datum_t * r2)
2861 {
2862 	role_datum_t *new;
2863 
2864 	if (pass == 1) {
2865 		return (role_datum_t *) 1;	/* any non-NULL value */
2866 	}
2867 
2868 	new = malloc(sizeof(role_datum_t));
2869 	if (!new) {
2870 		yyerror("out of memory");
2871 		return NULL;
2872 	}
2873 	memset(new, 0, sizeof(role_datum_t));
2874 	new->s.value = 0;		/* temporary role */
2875 	if (ebitmap_or(&new->dominates, &r1->dominates, &r2->dominates)) {
2876 		yyerror("out of memory");
2877 		free(new);
2878 		return NULL;
2879 	}
2880 	if (ebitmap_or(&new->types.types, &r1->types.types, &r2->types.types)) {
2881 		yyerror("out of memory");
2882 		free(new);
2883 		return NULL;
2884 	}
2885 	if (!r1->s.value) {
2886 		/* free intermediate result */
2887 		type_set_destroy(&r1->types);
2888 		ebitmap_destroy(&r1->dominates);
2889 		free(r1);
2890 	}
2891 	if (!r2->s.value) {
2892 		/* free intermediate result */
2893 		yyerror("right hand role is temporary?");
2894 		type_set_destroy(&r2->types);
2895 		ebitmap_destroy(&r2->dominates);
2896 		free(r2);
2897 	}
2898 	return new;
2899 }
2900 
2901 /* This function eliminates the ordering dependency of role dominance rule */
dominate_role_recheck(hashtab_key_t key,hashtab_datum_t datum,void * arg)2902 static int dominate_role_recheck(hashtab_key_t key __attribute__ ((unused)),
2903 				 hashtab_datum_t datum, void *arg)
2904 {
2905 	role_datum_t *rdp = (role_datum_t *) arg;
2906 	role_datum_t *rdatum = (role_datum_t *) datum;
2907 	ebitmap_node_t *node;
2908 	uint32_t i;
2909 
2910 	/* Don't bother to process against self role */
2911 	if (rdatum->s.value == rdp->s.value)
2912 		return 0;
2913 
2914 	/* If a dominating role found */
2915 	if (ebitmap_get_bit(&(rdatum->dominates), rdp->s.value - 1)) {
2916 		ebitmap_t types;
2917 		ebitmap_init(&types);
2918 		if (type_set_expand(&rdp->types, &types, policydbp, 1)) {
2919 			ebitmap_destroy(&types);
2920 			return -1;
2921 		}
2922 		/* raise types and dominates from dominated role */
2923 		ebitmap_for_each_positive_bit(&rdp->dominates, node, i) {
2924 			if (ebitmap_set_bit(&rdatum->dominates, i, TRUE))
2925 				goto oom;
2926 		}
2927 		ebitmap_for_each_positive_bit(&types, node, i) {
2928 			if (ebitmap_set_bit(&rdatum->types.types, i, TRUE))
2929 				goto oom;
2930 		}
2931 		ebitmap_destroy(&types);
2932 	}
2933 
2934 	/* go through all the roles */
2935 	return 0;
2936       oom:
2937 	yyerror("Out of memory");
2938 	return -1;
2939 }
2940 
define_role_dom(role_datum_t * r)2941 role_datum_t *define_role_dom(role_datum_t * r)
2942 {
2943 	role_datum_t *role;
2944 	char *role_id;
2945 	ebitmap_node_t *node;
2946 	unsigned int i;
2947 	int ret;
2948 
2949 	if (pass == 1) {
2950 		role_id = queue_remove(id_queue);
2951 		free(role_id);
2952 		return (role_datum_t *) 1;	/* any non-NULL value */
2953 	}
2954 
2955 	yywarn("Role dominance has been deprecated");
2956 
2957 	role_id = queue_remove(id_queue);
2958 	if (!is_id_in_scope(SYM_ROLES, role_id)) {
2959 		yyerror2("role %s is not within scope", role_id);
2960 		free(role_id);
2961 		return NULL;
2962 	}
2963 	role = (role_datum_t *) hashtab_search(policydbp->p_roles.table,
2964 					       role_id);
2965 	if (!role) {
2966 		role = (role_datum_t *) malloc(sizeof(role_datum_t));
2967 		if (!role) {
2968 			yyerror("out of memory");
2969 			free(role_id);
2970 			return NULL;
2971 		}
2972 		memset(role, 0, sizeof(role_datum_t));
2973 		ret =
2974 		    declare_symbol(SYM_ROLES, (hashtab_key_t) role_id,
2975 				   (hashtab_datum_t) role, &role->s.value,
2976 				   &role->s.value);
2977 		switch (ret) {
2978 		case -3:{
2979 				yyerror("Out of memory!");
2980 				goto cleanup;
2981 			}
2982 		case -2:{
2983 				yyerror2("duplicate declaration of role %s",
2984 					 role_id);
2985 				goto cleanup;
2986 			}
2987 		case -1:{
2988 				yyerror("could not declare role here");
2989 				goto cleanup;
2990 			}
2991 		case 0:
2992 		case 1:{
2993 				break;
2994 			}
2995 		default:{
2996 				assert(0);	/* should never get here */
2997 			}
2998 		}
2999 		if (ebitmap_set_bit(&role->dominates, role->s.value - 1, TRUE)) {
3000 			yyerror("Out of memory!");
3001 			goto cleanup;
3002 		}
3003 	}
3004 	if (r) {
3005 		ebitmap_t types;
3006 		ebitmap_init(&types);
3007 		ebitmap_for_each_positive_bit(&r->dominates, node, i) {
3008 			if (ebitmap_set_bit(&role->dominates, i, TRUE))
3009 				goto oom;
3010 		}
3011 		if (type_set_expand(&r->types, &types, policydbp, 1)) {
3012 			ebitmap_destroy(&types);
3013 			return NULL;
3014 		}
3015 		ebitmap_for_each_positive_bit(&types, node, i) {
3016 			if (ebitmap_set_bit(&role->types.types, i, TRUE))
3017 				goto oom;
3018 		}
3019 		ebitmap_destroy(&types);
3020 		if (!r->s.value) {
3021 			/* free intermediate result */
3022 			type_set_destroy(&r->types);
3023 			ebitmap_destroy(&r->dominates);
3024 			free(r);
3025 		}
3026 		/*
3027 		 * Now go through all the roles and escalate this role's
3028 		 * dominates and types if a role dominates this role.
3029 		 */
3030 		hashtab_map(policydbp->p_roles.table,
3031 			    dominate_role_recheck, role);
3032 	}
3033 	return role;
3034       cleanup:
3035 	free(role_id);
3036 	role_datum_destroy(role);
3037 	free(role);
3038 	return NULL;
3039       oom:
3040 	yyerror("Out of memory");
3041 	goto cleanup;
3042 }
3043 
role_val_to_name_helper(hashtab_key_t key,hashtab_datum_t datum,void * p)3044 static int role_val_to_name_helper(hashtab_key_t key, hashtab_datum_t datum,
3045 				   void *p)
3046 {
3047 	struct val_to_name *v = p;
3048 	role_datum_t *roldatum;
3049 
3050 	roldatum = (role_datum_t *) datum;
3051 
3052 	if (v->val == roldatum->s.value) {
3053 		v->name = key;
3054 		return 1;
3055 	}
3056 
3057 	return 0;
3058 }
3059 
role_val_to_name(unsigned int val)3060 static char *role_val_to_name(unsigned int val)
3061 {
3062 	struct val_to_name v;
3063 	int rc;
3064 
3065 	v.val = val;
3066 	rc = hashtab_map(policydbp->p_roles.table, role_val_to_name_helper, &v);
3067 	if (rc)
3068 		return v.name;
3069 	return NULL;
3070 }
3071 
set_roles(role_set_t * set,char * id)3072 static int set_roles(role_set_t * set, char *id)
3073 {
3074 	role_datum_t *r;
3075 
3076 	if (strcmp(id, "*") == 0) {
3077 		free(id);
3078 		yyerror("* is not allowed for role sets");
3079 		return -1;
3080 	}
3081 
3082 	if (strcmp(id, "~") == 0) {
3083 		free(id);
3084 		yyerror("~ is not allowed for role sets");
3085 		return -1;
3086 	}
3087 	if (!is_id_in_scope(SYM_ROLES, id)) {
3088 		yyerror2("role %s is not within scope", id);
3089 		free(id);
3090 		return -1;
3091 	}
3092 	r = hashtab_search(policydbp->p_roles.table, id);
3093 	if (!r) {
3094 		yyerror2("unknown role %s", id);
3095 		free(id);
3096 		return -1;
3097 	}
3098 
3099 	if (ebitmap_set_bit(&set->roles, r->s.value - 1, TRUE)) {
3100 		yyerror("out of memory");
3101 		free(id);
3102 		return -1;
3103 	}
3104 	free(id);
3105 	return 0;
3106 }
3107 
define_role_trans(int class_specified)3108 int define_role_trans(int class_specified)
3109 {
3110 	char *id;
3111 	role_datum_t *role;
3112 	role_set_t roles;
3113 	type_set_t types;
3114 	class_datum_t *cladatum;
3115 	ebitmap_t e_types, e_roles, e_classes;
3116 	ebitmap_node_t *tnode, *rnode, *cnode;
3117 	struct role_trans *tr = NULL;
3118 	struct role_trans_rule *rule = NULL;
3119 	unsigned int i, j, k;
3120 	int add = 1;
3121 
3122 	if (pass == 1) {
3123 		while ((id = queue_remove(id_queue)))
3124 			free(id);
3125 		while ((id = queue_remove(id_queue)))
3126 			free(id);
3127 		if (class_specified)
3128 			while ((id = queue_remove(id_queue)))
3129 				free(id);
3130 		id = queue_remove(id_queue);
3131 		free(id);
3132 		return 0;
3133 	}
3134 
3135 	role_set_init(&roles);
3136 	ebitmap_init(&e_roles);
3137 	type_set_init(&types);
3138 	ebitmap_init(&e_types);
3139 	ebitmap_init(&e_classes);
3140 
3141 	while ((id = queue_remove(id_queue))) {
3142 		if (set_roles(&roles, id))
3143 			return -1;
3144 	}
3145 	add = 1;
3146 	while ((id = queue_remove(id_queue))) {
3147 		if (set_types(&types, id, &add, 0))
3148 			return -1;
3149 	}
3150 
3151 	if (class_specified) {
3152 		if (read_classes(&e_classes))
3153 			return -1;
3154 	} else {
3155 		cladatum = hashtab_search(policydbp->p_classes.table,
3156 					  "process");
3157 		if (!cladatum) {
3158 			yyerror2("could not find process class for "
3159 				 "legacy role_transition statement");
3160 			return -1;
3161 		}
3162 
3163 		if (ebitmap_set_bit(&e_classes, cladatum->s.value - 1, TRUE)) {
3164 			yyerror("out of memory");
3165 			return -1;
3166 		}
3167 	}
3168 
3169 	id = (char *)queue_remove(id_queue);
3170 	if (!id) {
3171 		yyerror("no new role in transition definition?");
3172 		goto bad;
3173 	}
3174 	if (!is_id_in_scope(SYM_ROLES, id)) {
3175 		yyerror2("role %s is not within scope", id);
3176 		free(id);
3177 		goto bad;
3178 	}
3179 	role = hashtab_search(policydbp->p_roles.table, id);
3180 	if (!role) {
3181 		yyerror2("unknown role %s used in transition definition", id);
3182 		free(id);
3183 		goto bad;
3184 	}
3185 
3186 	if (role->flavor != ROLE_ROLE) {
3187 		yyerror2("the new role %s must be a regular role", id);
3188 		free(id);
3189 		goto bad;
3190 	}
3191 	free(id);
3192 
3193 	/* This ebitmap business is just to ensure that there are not conflicting role_trans rules */
3194 	if (role_set_expand(&roles, &e_roles, policydbp, NULL, NULL))
3195 		goto bad;
3196 
3197 	if (type_set_expand(&types, &e_types, policydbp, 1))
3198 		goto bad;
3199 
3200 	ebitmap_for_each_positive_bit(&e_roles, rnode, i) {
3201 		ebitmap_for_each_positive_bit(&e_types, tnode, j) {
3202 			ebitmap_for_each_positive_bit(&e_classes, cnode, k) {
3203 				for (tr = policydbp->role_tr; tr;
3204 				     tr = tr->next) {
3205 					if (tr->role == (i + 1) &&
3206 					    tr->type == (j + 1) &&
3207 					    tr->tclass == (k + 1)) {
3208 						yyerror2("duplicate role "
3209 							 "transition for "
3210 							 "(%s,%s,%s)",
3211 							 role_val_to_name(i+1),
3212 							 policydbp->p_type_val_to_name[j],
3213 							 policydbp->p_class_val_to_name[k]);
3214 						goto bad;
3215 					}
3216 				}
3217 
3218 				tr = malloc(sizeof(struct role_trans));
3219 				if (!tr) {
3220 					yyerror("out of memory");
3221 					return -1;
3222 				}
3223 				memset(tr, 0, sizeof(struct role_trans));
3224 				tr->role = i + 1;
3225 				tr->type = j + 1;
3226 				tr->tclass = k + 1;
3227 				tr->new_role = role->s.value;
3228 				tr->next = policydbp->role_tr;
3229 				policydbp->role_tr = tr;
3230 			}
3231 		}
3232 	}
3233 	/* Now add the real rule */
3234 	rule = malloc(sizeof(struct role_trans_rule));
3235 	if (!rule) {
3236 		yyerror("out of memory");
3237 		return -1;
3238 	}
3239 	memset(rule, 0, sizeof(struct role_trans_rule));
3240 	rule->roles = roles;
3241 	rule->types = types;
3242 	rule->classes = e_classes;
3243 	rule->new_role = role->s.value;
3244 
3245 	append_role_trans(rule);
3246 
3247 	ebitmap_destroy(&e_roles);
3248 	ebitmap_destroy(&e_types);
3249 
3250 	return 0;
3251 
3252       bad:
3253 	return -1;
3254 }
3255 
define_role_allow(void)3256 int define_role_allow(void)
3257 {
3258 	char *id;
3259 	struct role_allow_rule *ra = 0;
3260 
3261 	if (pass == 1) {
3262 		while ((id = queue_remove(id_queue)))
3263 			free(id);
3264 		while ((id = queue_remove(id_queue)))
3265 			free(id);
3266 		return 0;
3267 	}
3268 
3269 	ra = malloc(sizeof(role_allow_rule_t));
3270 	if (!ra) {
3271 		yyerror("out of memory");
3272 		return -1;
3273 	}
3274 	role_allow_rule_init(ra);
3275 
3276 	while ((id = queue_remove(id_queue))) {
3277 		if (set_roles(&ra->roles, id)) {
3278 			free(ra);
3279 			return -1;
3280 		}
3281 	}
3282 
3283 	while ((id = queue_remove(id_queue))) {
3284 		if (set_roles(&ra->new_roles, id)) {
3285 			free(ra);
3286 			return -1;
3287 		}
3288 	}
3289 
3290 	append_role_allow(ra);
3291 	return 0;
3292 }
3293 
define_cond_filename_trans(void)3294 avrule_t *define_cond_filename_trans(void)
3295 {
3296 	yyerror("type transitions with a filename not allowed inside "
3297 		"conditionals\n");
3298 	return COND_ERR;
3299 }
3300 
define_filename_trans(void)3301 int define_filename_trans(void)
3302 {
3303 	char *id, *name = NULL;
3304 	type_set_t stypes, ttypes;
3305 	ebitmap_t e_stypes, e_ttypes;
3306 	ebitmap_t e_tclasses;
3307 	ebitmap_node_t *snode, *tnode, *cnode;
3308 	filename_trans_rule_t *ftr;
3309 	type_datum_t *typdatum;
3310 	uint32_t otype;
3311 	unsigned int c, s, t;
3312 	int add, self, rc;
3313 
3314 	if (pass == 1) {
3315 		/* stype */
3316 		while ((id = queue_remove(id_queue)))
3317 			free(id);
3318 		/* ttype */
3319 		while ((id = queue_remove(id_queue)))
3320 			free(id);
3321 		/* tclass */
3322 		while ((id = queue_remove(id_queue)))
3323 			free(id);
3324 		/* otype */
3325 		id = queue_remove(id_queue);
3326 		free(id);
3327 		/* name */
3328 		id = queue_remove(id_queue);
3329 		free(id);
3330 		return 0;
3331 	}
3332 
3333 	type_set_init(&stypes);
3334 	type_set_init(&ttypes);
3335 	ebitmap_init(&e_stypes);
3336 	ebitmap_init(&e_ttypes);
3337 	ebitmap_init(&e_tclasses);
3338 
3339 	add = 1;
3340 	while ((id = queue_remove(id_queue))) {
3341 		if (set_types(&stypes, id, &add, 0))
3342 			goto bad;
3343 	}
3344 
3345 	self = 0;
3346 	add = 1;
3347 	while ((id = queue_remove(id_queue))) {
3348 		if (strcmp(id, "self") == 0) {
3349 			free(id);
3350 			if (add == 0) {
3351 				yyerror("-self is not supported");
3352 				goto bad;
3353 			}
3354 			self = 1;
3355 			continue;
3356 		}
3357 		if (set_types(&ttypes, id, &add, 0))
3358 			goto bad;
3359 	}
3360 
3361 	if (read_classes(&e_tclasses))
3362 		goto bad;
3363 
3364 	id = (char *)queue_remove(id_queue);
3365 	if (!id) {
3366 		yyerror("no otype in transition definition?");
3367 		goto bad;
3368 	}
3369 	if (!is_id_in_scope(SYM_TYPES, id)) {
3370 		yyerror2("type %s is not within scope", id);
3371 		free(id);
3372 		goto bad;
3373 	}
3374 	typdatum = hashtab_search(policydbp->p_types.table, id);
3375 	if (!typdatum) {
3376 		yyerror2("unknown type %s used in transition definition", id);
3377 		free(id);
3378 		goto bad;
3379 	}
3380 	free(id);
3381 	otype = typdatum->s.value;
3382 
3383 	name = queue_remove(id_queue);
3384 	if (!name) {
3385 		yyerror("no pathname specified in filename_trans definition?");
3386 		goto bad;
3387 	}
3388 
3389 	/* We expand the class set into separate rules.  We expand the types
3390 	 * just to make sure there are not duplicates.  They will get turned
3391 	 * into separate rules later */
3392 	if (type_set_expand(&stypes, &e_stypes, policydbp, 1))
3393 		goto bad;
3394 
3395 	if (type_set_expand(&ttypes, &e_ttypes, policydbp, 1))
3396 		goto bad;
3397 
3398 	ebitmap_for_each_positive_bit(&e_tclasses, cnode, c) {
3399 		ebitmap_for_each_positive_bit(&e_stypes, snode, s) {
3400 			ebitmap_for_each_positive_bit(&e_ttypes, tnode, t) {
3401 				rc = policydb_filetrans_insert(
3402 					policydbp, s+1, t+1, c+1, name,
3403 					NULL, otype, NULL
3404 				);
3405 				if (rc != SEPOL_OK) {
3406 					if (rc == SEPOL_EEXIST) {
3407 						yyerror2("duplicate filename transition for: filename_trans %s %s %s:%s",
3408 							name,
3409 							policydbp->p_type_val_to_name[s],
3410 							policydbp->p_type_val_to_name[t],
3411 							policydbp->p_class_val_to_name[c]);
3412 						goto bad;
3413 					}
3414 					yyerror("out of memory");
3415 					goto bad;
3416 				}
3417 			}
3418 			if (self) {
3419 				rc = policydb_filetrans_insert(
3420 					policydbp, s+1, s+1, c+1, name,
3421 					NULL, otype, NULL
3422 				);
3423 				if (rc != SEPOL_OK) {
3424 					if (rc == SEPOL_EEXIST) {
3425 						yyerror2("duplicate filename transition for: filename_trans %s %s %s:%s",
3426 							name,
3427 							policydbp->p_type_val_to_name[s],
3428 							policydbp->p_type_val_to_name[s],
3429 							policydbp->p_class_val_to_name[c]);
3430 						goto bad;
3431 					}
3432 					yyerror("out of memory");
3433 					goto bad;
3434 				}
3435 			}
3436 		}
3437 
3438 		/* Now add the real rule since we didn't find any duplicates */
3439 		ftr = malloc(sizeof(*ftr));
3440 		if (!ftr) {
3441 			yyerror("out of memory");
3442 			goto bad;
3443 		}
3444 		filename_trans_rule_init(ftr);
3445 		append_filename_trans(ftr);
3446 
3447 		ftr->name = strdup(name);
3448 		if (type_set_cpy(&ftr->stypes, &stypes)) {
3449 			yyerror("out of memory");
3450 			goto bad;
3451 		}
3452 		if (type_set_cpy(&ftr->ttypes, &ttypes)) {
3453 			yyerror("out of memory");
3454 			goto bad;
3455 		}
3456 		ftr->tclass = c + 1;
3457 		ftr->otype = otype;
3458 		ftr->flags = self ? RULE_SELF : 0;
3459 	}
3460 
3461 	free(name);
3462 	ebitmap_destroy(&e_stypes);
3463 	ebitmap_destroy(&e_ttypes);
3464 	ebitmap_destroy(&e_tclasses);
3465 	type_set_destroy(&stypes);
3466 	type_set_destroy(&ttypes);
3467 
3468 	return 0;
3469 
3470 bad:
3471 	free(name);
3472 	ebitmap_destroy(&e_stypes);
3473 	ebitmap_destroy(&e_ttypes);
3474 	ebitmap_destroy(&e_tclasses);
3475 	type_set_destroy(&stypes);
3476 	type_set_destroy(&ttypes);
3477 	return -1;
3478 }
3479 
constraint_expr_clone(const constraint_expr_t * expr)3480 static constraint_expr_t *constraint_expr_clone(const constraint_expr_t * expr)
3481 {
3482 	constraint_expr_t *h = NULL, *l = NULL, *newe;
3483 	const constraint_expr_t *e;
3484 	for (e = expr; e; e = e->next) {
3485 		newe = malloc(sizeof(*newe));
3486 		if (!newe)
3487 			goto oom;
3488 		if (constraint_expr_init(newe) == -1) {
3489 			free(newe);
3490 			goto oom;
3491 		}
3492 		if (l)
3493 			l->next = newe;
3494 		else
3495 			h = newe;
3496 		l = newe;
3497 		newe->expr_type = e->expr_type;
3498 		newe->attr = e->attr;
3499 		newe->op = e->op;
3500 		if (newe->expr_type == CEXPR_NAMES) {
3501 			if (newe->attr & CEXPR_TYPE) {
3502 				if (type_set_cpy
3503 				    (newe->type_names, e->type_names))
3504 					goto oom;
3505 			} else {
3506 				if (ebitmap_cpy(&newe->names, &e->names))
3507 					goto oom;
3508 			}
3509 		}
3510 	}
3511 
3512 	return h;
3513       oom:
3514 	constraint_expr_destroy(h);
3515 	return NULL;
3516 }
3517 
3518 #define PERMISSION_MASK(nprim) ((nprim) == PERM_SYMTAB_SIZE ? (~UINT32_C(0)) : ((UINT32_C(1) << (nprim)) - 1))
3519 
define_constraint(constraint_expr_t * expr)3520 int define_constraint(constraint_expr_t * expr)
3521 {
3522 	struct constraint_node *node;
3523 	char *id;
3524 	class_datum_t *cladatum;
3525 	perm_datum_t *perdatum;
3526 	ebitmap_t classmap;
3527 	ebitmap_node_t *enode;
3528 	constraint_expr_t *e;
3529 	unsigned int i;
3530 	int depth;
3531 	unsigned char useexpr = 1;
3532 
3533 	if (pass == 1) {
3534 		while ((id = queue_remove(id_queue)))
3535 			free(id);
3536 		while ((id = queue_remove(id_queue)))
3537 			free(id);
3538 		return 0;
3539 	}
3540 
3541 	depth = -1;
3542 	for (e = expr; e; e = e->next) {
3543 		switch (e->expr_type) {
3544 		case CEXPR_NOT:
3545 			if (depth < 0) {
3546 				yyerror("illegal constraint expression");
3547 				return -1;
3548 			}
3549 			break;
3550 		case CEXPR_AND:
3551 		case CEXPR_OR:
3552 			if (depth < 1) {
3553 				yyerror("illegal constraint expression");
3554 				return -1;
3555 			}
3556 			depth--;
3557 			break;
3558 		case CEXPR_ATTR:
3559 		case CEXPR_NAMES:
3560 			if (e->attr & CEXPR_XTARGET) {
3561 				yyerror("illegal constraint expression");
3562 				return -1;	/* only for validatetrans rules */
3563 			}
3564 			if (depth == (CEXPR_MAXDEPTH - 1)) {
3565 				yyerror("constraint expression is too deep");
3566 				return -1;
3567 			}
3568 			depth++;
3569 			break;
3570 		default:
3571 			yyerror("illegal constraint expression");
3572 			return -1;
3573 		}
3574 	}
3575 	if (depth != 0) {
3576 		yyerror("illegal constraint expression");
3577 		return -1;
3578 	}
3579 
3580 	ebitmap_init(&classmap);
3581 	while ((id = queue_remove(id_queue))) {
3582 		if (!is_id_in_scope(SYM_CLASSES, id)) {
3583 			yyerror2("class %s is not within scope", id);
3584 			free(id);
3585 			return -1;
3586 		}
3587 		cladatum =
3588 		    (class_datum_t *) hashtab_search(policydbp->p_classes.table,
3589 						     (hashtab_key_t) id);
3590 		if (!cladatum) {
3591 			yyerror2("class %s is not defined", id);
3592 			ebitmap_destroy(&classmap);
3593 			free(id);
3594 			return -1;
3595 		}
3596 		if (ebitmap_set_bit(&classmap, cladatum->s.value - 1, TRUE)) {
3597 			yyerror("out of memory");
3598 			ebitmap_destroy(&classmap);
3599 			free(id);
3600 			return -1;
3601 		}
3602 		node = malloc(sizeof(struct constraint_node));
3603 		if (!node) {
3604 			yyerror("out of memory");
3605 			free(node);
3606 			return -1;
3607 		}
3608 		memset(node, 0, sizeof(constraint_node_t));
3609 		if (useexpr) {
3610 			node->expr = expr;
3611 			useexpr = 0;
3612 		} else {
3613 			node->expr = constraint_expr_clone(expr);
3614 		}
3615 		if (!node->expr) {
3616 			yyerror("out of memory");
3617 			free(node);
3618 			return -1;
3619 		}
3620 		node->permissions = 0;
3621 
3622 		node->next = cladatum->constraints;
3623 		cladatum->constraints = node;
3624 
3625 		free(id);
3626 	}
3627 
3628 	while ((id = queue_remove(id_queue))) {
3629 		ebitmap_for_each_positive_bit(&classmap, enode, i) {
3630 			cladatum = policydbp->class_val_to_struct[i];
3631 			node = cladatum->constraints;
3632 
3633 			if (strcmp(id, "*") == 0) {
3634 				node->permissions = PERMISSION_MASK(cladatum->permissions.nprim);
3635 				continue;
3636 			}
3637 
3638 			if (strcmp(id, "~") == 0) {
3639 				node->permissions = ~node->permissions & PERMISSION_MASK(cladatum->permissions.nprim);
3640 				if (node->permissions == 0) {
3641 					yywarn("omitting constraint with no permission set");
3642 					cladatum->constraints = node->next;
3643 					constraint_expr_destroy(node->expr);
3644 					free(node);
3645 				}
3646 				continue;
3647 			}
3648 
3649 			perdatum =
3650 			    (perm_datum_t *) hashtab_search(cladatum->
3651 							    permissions.
3652 							    table,
3653 							    (hashtab_key_t)
3654 							    id);
3655 			if (!perdatum) {
3656 				if (cladatum->comdatum) {
3657 					perdatum =
3658 					    (perm_datum_t *)
3659 					    hashtab_search(cladatum->
3660 							   comdatum->
3661 							   permissions.
3662 							   table,
3663 							   (hashtab_key_t)
3664 							   id);
3665 				}
3666 				if (!perdatum) {
3667 					yyerror2("permission %s is not"
3668 						 " defined for class %s", id, policydbp->p_class_val_to_name[i]);
3669 					free(id);
3670 					ebitmap_destroy(&classmap);
3671 					return -1;
3672 				}
3673 			}
3674 			node->permissions |= (UINT32_C(1) << (perdatum->s.value - 1));
3675 		}
3676 		free(id);
3677 	}
3678 
3679 	ebitmap_destroy(&classmap);
3680 
3681 	return 0;
3682 }
3683 
define_validatetrans(constraint_expr_t * expr)3684 int define_validatetrans(constraint_expr_t * expr)
3685 {
3686 	struct constraint_node *node;
3687 	char *id;
3688 	class_datum_t *cladatum;
3689 	ebitmap_t classmap;
3690 	constraint_expr_t *e;
3691 	int depth;
3692 	unsigned char useexpr = 1;
3693 
3694 	if (pass == 1) {
3695 		while ((id = queue_remove(id_queue)))
3696 			free(id);
3697 		return 0;
3698 	}
3699 
3700 	depth = -1;
3701 	for (e = expr; e; e = e->next) {
3702 		switch (e->expr_type) {
3703 		case CEXPR_NOT:
3704 			if (depth < 0) {
3705 				yyerror("illegal validatetrans expression");
3706 				return -1;
3707 			}
3708 			break;
3709 		case CEXPR_AND:
3710 		case CEXPR_OR:
3711 			if (depth < 1) {
3712 				yyerror("illegal validatetrans expression");
3713 				return -1;
3714 			}
3715 			depth--;
3716 			break;
3717 		case CEXPR_ATTR:
3718 		case CEXPR_NAMES:
3719 			if (depth == (CEXPR_MAXDEPTH - 1)) {
3720 				yyerror("validatetrans expression is too deep");
3721 				return -1;
3722 			}
3723 			depth++;
3724 			break;
3725 		default:
3726 			yyerror("illegal validatetrans expression");
3727 			return -1;
3728 		}
3729 	}
3730 	if (depth != 0) {
3731 		yyerror("illegal validatetrans expression");
3732 		return -1;
3733 	}
3734 
3735 	ebitmap_init(&classmap);
3736 	while ((id = queue_remove(id_queue))) {
3737 		if (!is_id_in_scope(SYM_CLASSES, id)) {
3738 			yyerror2("class %s is not within scope", id);
3739 			free(id);
3740 			return -1;
3741 		}
3742 		cladatum =
3743 		    (class_datum_t *) hashtab_search(policydbp->p_classes.table,
3744 						     (hashtab_key_t) id);
3745 		if (!cladatum) {
3746 			yyerror2("class %s is not defined", id);
3747 			ebitmap_destroy(&classmap);
3748 			free(id);
3749 			return -1;
3750 		}
3751 		if (ebitmap_set_bit(&classmap, (cladatum->s.value - 1), TRUE)) {
3752 			yyerror("out of memory");
3753 			ebitmap_destroy(&classmap);
3754 			free(id);
3755 			return -1;
3756 		}
3757 
3758 		node = malloc(sizeof(struct constraint_node));
3759 		if (!node) {
3760 			yyerror("out of memory");
3761 			return -1;
3762 		}
3763 		memset(node, 0, sizeof(constraint_node_t));
3764 		if (useexpr) {
3765 			node->expr = expr;
3766 			useexpr = 0;
3767 		} else {
3768 			node->expr = constraint_expr_clone(expr);
3769 		}
3770 		node->permissions = 0;
3771 
3772 		node->next = cladatum->validatetrans;
3773 		cladatum->validatetrans = node;
3774 
3775 		free(id);
3776 	}
3777 
3778 	ebitmap_destroy(&classmap);
3779 
3780 	return 0;
3781 }
3782 
define_cexpr(uint32_t expr_type,uintptr_t arg1,uintptr_t arg2)3783 uintptr_t define_cexpr(uint32_t expr_type, uintptr_t arg1, uintptr_t arg2)
3784 {
3785 	struct constraint_expr *expr, *e1 = NULL, *e2;
3786 	user_datum_t *user;
3787 	role_datum_t *role;
3788 	ebitmap_t negset;
3789 	char *id;
3790 	uint32_t val;
3791 	int add = 1;
3792 
3793 	if (pass == 1) {
3794 		if (expr_type == CEXPR_NAMES) {
3795 			while ((id = queue_remove(id_queue)))
3796 				free(id);
3797 		}
3798 		return 1;	/* any non-NULL value */
3799 	}
3800 
3801 	if ((expr = malloc(sizeof(*expr))) == NULL ||
3802 	    constraint_expr_init(expr) == -1) {
3803 		yyerror("out of memory");
3804 		free(expr);
3805 		return 0;
3806 	}
3807 	expr->expr_type = expr_type;
3808 
3809 	switch (expr_type) {
3810 	case CEXPR_NOT:
3811 		e1 = NULL;
3812 		e2 = (struct constraint_expr *)arg1;
3813 		while (e2) {
3814 			e1 = e2;
3815 			e2 = e2->next;
3816 		}
3817 		if (!e1 || e1->next) {
3818 			yyerror("illegal constraint expression");
3819 			constraint_expr_destroy(expr);
3820 			return 0;
3821 		}
3822 		e1->next = expr;
3823 		return arg1;
3824 	case CEXPR_AND:
3825 	case CEXPR_OR:
3826 		e1 = NULL;
3827 		e2 = (struct constraint_expr *)arg1;
3828 		while (e2) {
3829 			e1 = e2;
3830 			e2 = e2->next;
3831 		}
3832 		if (!e1 || e1->next) {
3833 			yyerror("illegal constraint expression");
3834 			constraint_expr_destroy(expr);
3835 			return 0;
3836 		}
3837 		e1->next = (struct constraint_expr *)arg2;
3838 
3839 		e1 = NULL;
3840 		e2 = (struct constraint_expr *)arg2;
3841 		while (e2) {
3842 			e1 = e2;
3843 			e2 = e2->next;
3844 		}
3845 		if (!e1 || e1->next) {
3846 			yyerror("illegal constraint expression");
3847 			constraint_expr_destroy(expr);
3848 			return 0;
3849 		}
3850 		e1->next = expr;
3851 		return arg1;
3852 	case CEXPR_ATTR:
3853 		expr->attr = arg1;
3854 		expr->op = arg2;
3855 		return (uintptr_t) expr;
3856 	case CEXPR_NAMES:
3857 		add = 1;
3858 		expr->attr = arg1;
3859 		expr->op = arg2;
3860 		ebitmap_init(&negset);
3861 		while ((id = (char *)queue_remove(id_queue))) {
3862 			if (expr->attr & CEXPR_USER) {
3863 				if (!is_id_in_scope(SYM_USERS, id)) {
3864 					yyerror2("user %s is not within scope",
3865 						 id);
3866 					constraint_expr_destroy(expr);
3867 					return 0;
3868 				}
3869 				user =
3870 				    (user_datum_t *) hashtab_search(policydbp->
3871 								    p_users.
3872 								    table,
3873 								    (hashtab_key_t)
3874 								    id);
3875 				if (!user) {
3876 					yyerror2("unknown user %s", id);
3877 					constraint_expr_destroy(expr);
3878 					return 0;
3879 				}
3880 				val = user->s.value;
3881 			} else if (expr->attr & CEXPR_ROLE) {
3882 				if (!is_id_in_scope(SYM_ROLES, id)) {
3883 					yyerror2("role %s is not within scope",
3884 						 id);
3885 					constraint_expr_destroy(expr);
3886 					return 0;
3887 				}
3888 				role =
3889 				    (role_datum_t *) hashtab_search(policydbp->
3890 								    p_roles.
3891 								    table,
3892 								    (hashtab_key_t)
3893 								    id);
3894 				if (!role) {
3895 					yyerror2("unknown role %s", id);
3896 					constraint_expr_destroy(expr);
3897 					return 0;
3898 				}
3899 				val = role->s.value;
3900 			} else if (expr->attr & CEXPR_TYPE) {
3901 				if (set_types(expr->type_names, id, &add, 0)) {
3902 					constraint_expr_destroy(expr);
3903 					return 0;
3904 				}
3905 				continue;
3906 			} else {
3907 				yyerror("invalid constraint expression");
3908 				constraint_expr_destroy(expr);
3909 				return 0;
3910 			}
3911 			if (ebitmap_set_bit(&expr->names, val - 1, TRUE)) {
3912 				yyerror("out of memory");
3913 				ebitmap_destroy(&expr->names);
3914 				constraint_expr_destroy(expr);
3915 				return 0;
3916 			}
3917 			free(id);
3918 		}
3919 		ebitmap_destroy(&negset);
3920 		return (uintptr_t) expr;
3921 	default:
3922 		break;
3923 	}
3924 
3925 	yyerror("invalid constraint expression");
3926 	constraint_expr_destroy(expr);
3927 	return 0;
3928 }
3929 
define_conditional(cond_expr_t * expr,avrule_t * t,avrule_t * f)3930 int define_conditional(cond_expr_t * expr, avrule_t * t, avrule_t * f)
3931 {
3932 	cond_expr_t *e;
3933 	int depth;
3934 	cond_node_t cn, *cn_old;
3935 
3936 	/* expression cannot be NULL */
3937 	if (!expr) {
3938 		yyerror("illegal conditional expression");
3939 		return -1;
3940 	}
3941 	if (!t) {
3942 		if (!f) {
3943 			/* empty is fine, destroy expression and return */
3944 			cond_expr_destroy(expr);
3945 			return 0;
3946 		}
3947 		/* Invert */
3948 		t = f;
3949 		f = 0;
3950 		expr = define_cond_expr(COND_NOT, expr, 0);
3951 		if (!expr) {
3952 			yyerror("unable to invert");
3953 			return -1;
3954 		}
3955 	}
3956 
3957 	/* verify expression */
3958 	depth = -1;
3959 	for (e = expr; e; e = e->next) {
3960 		switch (e->expr_type) {
3961 		case COND_NOT:
3962 			if (depth < 0) {
3963 				yyerror
3964 				    ("illegal conditional expression; Bad NOT");
3965 				return -1;
3966 			}
3967 			break;
3968 		case COND_AND:
3969 		case COND_OR:
3970 		case COND_XOR:
3971 		case COND_EQ:
3972 		case COND_NEQ:
3973 			if (depth < 1) {
3974 				yyerror
3975 				    ("illegal conditional expression; Bad binary op");
3976 				return -1;
3977 			}
3978 			depth--;
3979 			break;
3980 		case COND_BOOL:
3981 			if (depth == (COND_EXPR_MAXDEPTH - 1)) {
3982 				yyerror
3983 				    ("conditional expression is like totally too deep");
3984 				return -1;
3985 			}
3986 			depth++;
3987 			break;
3988 		default:
3989 			yyerror("illegal conditional expression");
3990 			return -1;
3991 		}
3992 	}
3993 	if (depth != 0) {
3994 		yyerror("illegal conditional expression");
3995 		return -1;
3996 	}
3997 
3998 	/*  use tmp conditional node to partially build new node */
3999 	memset(&cn, 0, sizeof(cn));
4000 	cn.expr = expr;
4001 	cn.avtrue_list = t;
4002 	cn.avfalse_list = f;
4003 
4004 	/* normalize/precompute expression */
4005 	if (cond_normalize_expr(policydbp, &cn) < 0) {
4006 		yyerror("problem normalizing conditional expression");
4007 		return -1;
4008 	}
4009 
4010 	/* get the existing conditional node, or create a new one */
4011 	cn_old = get_current_cond_list(&cn);
4012 	if (!cn_old) {
4013 		return -1;
4014 	}
4015 
4016 	append_cond_list(&cn);
4017 
4018 	/* note that there is no check here for duplicate rules, nor
4019 	 * check that rule already exists in base -- that will be
4020 	 * handled during conditional expansion, in expand.c */
4021 
4022 	cn.avtrue_list = NULL;
4023 	cn.avfalse_list = NULL;
4024 	cond_node_destroy(&cn);
4025 
4026 	return 0;
4027 }
4028 
define_cond_expr(uint32_t expr_type,void * arg1,void * arg2)4029 cond_expr_t *define_cond_expr(uint32_t expr_type, void *arg1, void *arg2)
4030 {
4031 	struct cond_expr *expr, *e1 = NULL, *e2;
4032 	cond_bool_datum_t *bool_var;
4033 	char *id;
4034 
4035 	/* expressions are handled in the second pass */
4036 	if (pass == 1) {
4037 		if (expr_type == COND_BOOL) {
4038 			while ((id = queue_remove(id_queue))) {
4039 				free(id);
4040 			}
4041 		}
4042 		return (cond_expr_t *) 1;	/* any non-NULL value */
4043 	}
4044 
4045 	/* create a new expression struct */
4046 	expr = malloc(sizeof(struct cond_expr));
4047 	if (!expr) {
4048 		yyerror("out of memory");
4049 		return NULL;
4050 	}
4051 	memset(expr, 0, sizeof(cond_expr_t));
4052 	expr->expr_type = expr_type;
4053 
4054 	/* create the type asked for */
4055 	switch (expr_type) {
4056 	case COND_NOT:
4057 		e1 = NULL;
4058 		e2 = (struct cond_expr *)arg1;
4059 		while (e2) {
4060 			e1 = e2;
4061 			e2 = e2->next;
4062 		}
4063 		if (!e1 || e1->next) {
4064 			yyerror("illegal conditional NOT expression");
4065 			free(expr);
4066 			return NULL;
4067 		}
4068 		e1->next = expr;
4069 		return (struct cond_expr *)arg1;
4070 	case COND_AND:
4071 	case COND_OR:
4072 	case COND_XOR:
4073 	case COND_EQ:
4074 	case COND_NEQ:
4075 		e1 = NULL;
4076 		e2 = (struct cond_expr *)arg1;
4077 		while (e2) {
4078 			e1 = e2;
4079 			e2 = e2->next;
4080 		}
4081 		if (!e1 || e1->next) {
4082 			yyerror
4083 			    ("illegal left side of conditional binary op expression");
4084 			free(expr);
4085 			return NULL;
4086 		}
4087 		e1->next = (struct cond_expr *)arg2;
4088 
4089 		e1 = NULL;
4090 		e2 = (struct cond_expr *)arg2;
4091 		while (e2) {
4092 			e1 = e2;
4093 			e2 = e2->next;
4094 		}
4095 		if (!e1 || e1->next) {
4096 			yyerror
4097 			    ("illegal right side of conditional binary op expression");
4098 			free(expr);
4099 			return NULL;
4100 		}
4101 		e1->next = expr;
4102 		return (struct cond_expr *)arg1;
4103 	case COND_BOOL:
4104 		id = (char *)queue_remove(id_queue);
4105 		if (!id) {
4106 			yyerror("bad conditional; expected boolean id");
4107 			free(id);
4108 			free(expr);
4109 			return NULL;
4110 		}
4111 		if (!is_id_in_scope(SYM_BOOLS, id)) {
4112 			yyerror2("boolean %s is not within scope", id);
4113 			free(id);
4114 			free(expr);
4115 			return NULL;
4116 		}
4117 		bool_var =
4118 		    (cond_bool_datum_t *) hashtab_search(policydbp->p_bools.
4119 							 table,
4120 							 (hashtab_key_t) id);
4121 		if (!bool_var) {
4122 			yyerror2("unknown boolean %s in conditional expression",
4123 				 id);
4124 			free(expr);
4125 			free(id);
4126 			return NULL;
4127 		}
4128 		expr->bool = bool_var->s.value;
4129 		free(id);
4130 		return expr;
4131 	default:
4132 		yyerror("illegal conditional expression");
4133 		free(expr);
4134 		return NULL;
4135 	}
4136 }
4137 
set_user_roles(role_set_t * set,char * id)4138 static int set_user_roles(role_set_t * set, char *id)
4139 {
4140 	role_datum_t *r;
4141 
4142 	if (strcmp(id, "*") == 0) {
4143 		free(id);
4144 		yyerror("* is not allowed in user declarations");
4145 		return -1;
4146 	}
4147 
4148 	if (strcmp(id, "~") == 0) {
4149 		free(id);
4150 		yyerror("~ is not allowed in user declarations");
4151 		return -1;
4152 	}
4153 
4154 	if (!is_id_in_scope(SYM_ROLES, id)) {
4155 		yyerror2("role %s is not within scope", id);
4156 		free(id);
4157 		return -1;
4158 	}
4159 	r = hashtab_search(policydbp->p_roles.table, id);
4160 	if (!r) {
4161 		yyerror2("unknown role %s", id);
4162 		free(id);
4163 		return -1;
4164 	}
4165 
4166 	free(id);
4167 	if (ebitmap_set_bit(&set->roles, r->s.value - 1, TRUE))
4168 		goto oom;
4169 	return 0;
4170       oom:
4171 	yyerror("out of memory");
4172 	return -1;
4173 }
4174 
parse_categories(char * id,level_datum_t * levdatum,ebitmap_t * cats)4175 static int parse_categories(char *id, level_datum_t * levdatum, ebitmap_t * cats)
4176 {
4177 	cat_datum_t *cdatum;
4178 	int range_start, range_end, i;
4179 
4180 	if (id_has_dot(id)) {
4181 		char *id_start = id;
4182 		char *id_end = strchr(id, '.');
4183 
4184 		*(id_end++) = '\0';
4185 
4186 		cdatum = (cat_datum_t *) hashtab_search(policydbp->p_cats.table,
4187 							(hashtab_key_t)
4188 							id_start);
4189 		if (!cdatum) {
4190 			yyerror2("unknown category %s", id_start);
4191 			return -1;
4192 		}
4193 		range_start = cdatum->s.value - 1;
4194 		cdatum = (cat_datum_t *) hashtab_search(policydbp->p_cats.table,
4195 							(hashtab_key_t) id_end);
4196 		if (!cdatum) {
4197 			yyerror2("unknown category %s", id_end);
4198 			return -1;
4199 		}
4200 		range_end = cdatum->s.value - 1;
4201 
4202 		if (range_end < range_start) {
4203 			yyerror2("category range is invalid");
4204 			return -1;
4205 		}
4206 	} else {
4207 		cdatum = (cat_datum_t *) hashtab_search(policydbp->p_cats.table,
4208 							(hashtab_key_t) id);
4209 		if (!cdatum) {
4210 			yyerror2("unknown category %s", id);
4211 			return -1;
4212 		}
4213 		range_start = range_end = cdatum->s.value - 1;
4214 	}
4215 
4216 	for (i = range_start; i <= range_end; i++) {
4217 		if (!ebitmap_get_bit(&levdatum->level->cat, i)) {
4218 			uint32_t level_value = levdatum->level->sens - 1;
4219 			policydb_index_others(NULL, policydbp, 0);
4220 			yyerror2("category %s can not be associated "
4221 				 "with level %s",
4222 				 policydbp->p_cat_val_to_name[i],
4223 				 policydbp->p_sens_val_to_name[level_value]);
4224 			return -1;
4225 		}
4226 		if (ebitmap_set_bit(cats, i, TRUE)) {
4227 			yyerror("out of memory");
4228 			return -1;
4229 		}
4230 	}
4231 
4232 	return 0;
4233 }
4234 
parse_semantic_categories(char * id,level_datum_t * levdatum,mls_semantic_cat_t ** cats)4235 static int parse_semantic_categories(char *id, level_datum_t * levdatum __attribute__ ((unused)),
4236 				     mls_semantic_cat_t ** cats)
4237 {
4238 	cat_datum_t *cdatum;
4239 	mls_semantic_cat_t *newcat;
4240 	unsigned int range_start, range_end;
4241 
4242 	if (id_has_dot(id)) {
4243 		char *id_start = id;
4244 		char *id_end = strchr(id, '.');
4245 
4246 		*(id_end++) = '\0';
4247 
4248 		cdatum = (cat_datum_t *) hashtab_search(policydbp->p_cats.table,
4249 							(hashtab_key_t)
4250 							id_start);
4251 		if (!cdatum) {
4252 			yyerror2("unknown category %s", id_start);
4253 			return -1;
4254 		}
4255 		range_start = cdatum->s.value;
4256 
4257 		cdatum = (cat_datum_t *) hashtab_search(policydbp->p_cats.table,
4258 							(hashtab_key_t) id_end);
4259 		if (!cdatum) {
4260 			yyerror2("unknown category %s", id_end);
4261 			return -1;
4262 		}
4263 		range_end = cdatum->s.value;
4264 	} else {
4265 		cdatum = (cat_datum_t *) hashtab_search(policydbp->p_cats.table,
4266 							(hashtab_key_t) id);
4267 		if (!cdatum) {
4268 			yyerror2("unknown category %s", id);
4269 			return -1;
4270 		}
4271 		range_start = range_end = cdatum->s.value;
4272 	}
4273 
4274 	newcat = (mls_semantic_cat_t *) malloc(sizeof(mls_semantic_cat_t));
4275 	if (!newcat) {
4276 		yyerror("out of memory");
4277 		return -1;
4278 	}
4279 
4280 	mls_semantic_cat_init(newcat);
4281 	newcat->next = *cats;
4282 	newcat->low = range_start;
4283 	newcat->high = range_end;
4284 
4285 	*cats = newcat;
4286 
4287 	return 0;
4288 }
4289 
define_user(void)4290 int define_user(void)
4291 {
4292 	char *id;
4293 	user_datum_t *usrdatum;
4294 	level_datum_t *levdatum;
4295 	int l;
4296 
4297 	if (pass == 1) {
4298 		while ((id = queue_remove(id_queue)))
4299 			free(id);
4300 		if (mlspol) {
4301 			while ((id = queue_remove(id_queue)))
4302 				free(id);
4303 			id = queue_remove(id_queue);
4304 			free(id);
4305 			for (l = 0; l < 2; l++) {
4306 				while ((id = queue_remove(id_queue))) {
4307 					free(id);
4308 				}
4309 				id = queue_remove(id_queue);
4310 				if (!id)
4311 					break;
4312 				free(id);
4313 			}
4314 		}
4315 		return 0;
4316 	}
4317 
4318 	if ((usrdatum = declare_user()) == NULL) {
4319 		return -1;
4320 	}
4321 
4322 	while ((id = queue_remove(id_queue))) {
4323 		if (set_user_roles(&usrdatum->roles, id))
4324 			continue;
4325 	}
4326 
4327 	if (mlspol) {
4328 		id = queue_remove(id_queue);
4329 		if (!id) {
4330 			yyerror("no default level specified for user");
4331 			return -1;
4332 		}
4333 
4334 		levdatum = (level_datum_t *)
4335 		    hashtab_search(policydbp->p_levels.table,
4336 				   (hashtab_key_t) id);
4337 		if (!levdatum) {
4338 			yyerror2("unknown sensitivity %s used in user"
4339 				 " level definition", id);
4340 			free(id);
4341 			return -1;
4342 		}
4343 		free(id);
4344 
4345 		usrdatum->dfltlevel.sens = levdatum->level->sens;
4346 
4347 		while ((id = queue_remove(id_queue))) {
4348 			if (parse_semantic_categories(id, levdatum,
4349 			                            &usrdatum->dfltlevel.cat)) {
4350 				free(id);
4351 				return -1;
4352 			}
4353 			free(id);
4354 		}
4355 
4356 		id = queue_remove(id_queue);
4357 
4358 		for (l = 0; l < 2; l++) {
4359 			levdatum = (level_datum_t *)
4360 			    hashtab_search(policydbp->p_levels.table,
4361 					   (hashtab_key_t) id);
4362 			if (!levdatum) {
4363 				yyerror2("unknown sensitivity %s used in user"
4364 					 " range definition", id);
4365 				free(id);
4366 				return -1;
4367 			}
4368 			free(id);
4369 
4370 			usrdatum->range.level[l].sens = levdatum->level->sens;
4371 
4372 			while ((id = queue_remove(id_queue))) {
4373 				if (parse_semantic_categories(id, levdatum,
4374 				               &usrdatum->range.level[l].cat)) {
4375 					free(id);
4376 					return -1;
4377 				}
4378 				free(id);
4379 			}
4380 
4381 			id = queue_remove(id_queue);
4382 			if (!id)
4383 				break;
4384 		}
4385 
4386 		if (l == 0) {
4387 			if (mls_semantic_level_cpy(&usrdatum->range.level[1],
4388 			                           &usrdatum->range.level[0])) {
4389 				yyerror("out of memory");
4390 				return -1;
4391 			}
4392 		}
4393 	}
4394 	return 0;
4395 }
4396 
parse_security_context(context_struct_t * c)4397 static int parse_security_context(context_struct_t * c)
4398 {
4399 	char *id;
4400 	role_datum_t *role;
4401 	type_datum_t *typdatum;
4402 	user_datum_t *usrdatum;
4403 	level_datum_t *levdatum;
4404 	int l;
4405 
4406 	if (pass == 1) {
4407 		id = queue_remove(id_queue);
4408 		free(id);	/* user  */
4409 		id = queue_remove(id_queue);
4410 		free(id);	/* role  */
4411 		id = queue_remove(id_queue);
4412 		free(id);	/* type  */
4413 		if (mlspol) {
4414 			id = queue_remove(id_queue);
4415 			free(id);
4416 			for (l = 0; l < 2; l++) {
4417 				while ((id = queue_remove(id_queue))) {
4418 					free(id);
4419 				}
4420 				id = queue_remove(id_queue);
4421 				if (!id)
4422 					break;
4423 				free(id);
4424 			}
4425 		}
4426 		return 0;
4427 	}
4428 
4429 	/* check context c to make sure ok to dereference c later */
4430 	if (c == NULL) {
4431 		yyerror("null context pointer!");
4432 		return -1;
4433 	}
4434 
4435 	context_init(c);
4436 
4437 	/* extract the user */
4438 	id = queue_remove(id_queue);
4439 	if (!id) {
4440 		yyerror("no effective user?");
4441 		goto bad;
4442 	}
4443 	if (!is_id_in_scope(SYM_USERS, id)) {
4444 		yyerror2("user %s is not within scope", id);
4445 		free(id);
4446 		goto bad;
4447 	}
4448 	usrdatum = (user_datum_t *) hashtab_search(policydbp->p_users.table,
4449 						   (hashtab_key_t) id);
4450 	if (!usrdatum) {
4451 		yyerror2("user %s is not defined", id);
4452 		free(id);
4453 		goto bad;
4454 	}
4455 	c->user = usrdatum->s.value;
4456 
4457 	/* no need to keep the user name */
4458 	free(id);
4459 
4460 	/* extract the role */
4461 	id = (char *)queue_remove(id_queue);
4462 	if (!id) {
4463 		yyerror("no role name for sid context definition?");
4464 		return -1;
4465 	}
4466 	if (!is_id_in_scope(SYM_ROLES, id)) {
4467 		yyerror2("role %s is not within scope", id);
4468 		free(id);
4469 		return -1;
4470 	}
4471 	role = (role_datum_t *) hashtab_search(policydbp->p_roles.table,
4472 					       (hashtab_key_t) id);
4473 	if (!role) {
4474 		yyerror2("role %s is not defined", id);
4475 		free(id);
4476 		return -1;
4477 	}
4478 	c->role = role->s.value;
4479 
4480 	/* no need to keep the role name */
4481 	free(id);
4482 
4483 	/* extract the type */
4484 	id = (char *)queue_remove(id_queue);
4485 	if (!id) {
4486 		yyerror("no type name for sid context definition?");
4487 		return -1;
4488 	}
4489 	if (!is_id_in_scope(SYM_TYPES, id)) {
4490 		yyerror2("type %s is not within scope", id);
4491 		free(id);
4492 		return -1;
4493 	}
4494 	typdatum = (type_datum_t *) hashtab_search(policydbp->p_types.table,
4495 						   (hashtab_key_t) id);
4496 	if (!typdatum || typdatum->flavor == TYPE_ATTRIB) {
4497 		yyerror2("type %s is not defined or is an attribute", id);
4498 		free(id);
4499 		return -1;
4500 	}
4501 	c->type = typdatum->s.value;
4502 
4503 	/* no need to keep the type name */
4504 	free(id);
4505 
4506 	if (mlspol) {
4507 		/* extract the low sensitivity */
4508 		id = (char *)queue_head(id_queue);
4509 		if (!id) {
4510 			yyerror("no sensitivity name for sid context"
4511 				" definition?");
4512 			return -1;
4513 		}
4514 
4515 		id = (char *)queue_remove(id_queue);
4516 		for (l = 0; l < 2; l++) {
4517 			levdatum = (level_datum_t *)
4518 			    hashtab_search(policydbp->p_levels.table,
4519 					   (hashtab_key_t) id);
4520 			if (!levdatum) {
4521 				yyerror2("Sensitivity %s is not defined", id);
4522 				free(id);
4523 				return -1;
4524 			}
4525 			free(id);
4526 			c->range.level[l].sens = levdatum->level->sens;
4527 
4528 			/* extract low category set */
4529 			while ((id = queue_remove(id_queue))) {
4530 				if (parse_categories(id, levdatum,
4531 						     &c->range.level[l].cat)) {
4532 					free(id);
4533 					return -1;
4534 				}
4535 				free(id);
4536 			}
4537 
4538 			/* extract high sensitivity */
4539 			id = (char *)queue_remove(id_queue);
4540 			if (!id)
4541 				break;
4542 		}
4543 
4544 		if (l == 0) {
4545 			c->range.level[1].sens = c->range.level[0].sens;
4546 			if (ebitmap_cpy(&c->range.level[1].cat,
4547 					&c->range.level[0].cat)) {
4548 
4549 				yyerror("out of memory");
4550 				goto bad;
4551 			}
4552 		}
4553 	}
4554 
4555 	if (!policydb_context_isvalid(policydbp, c)) {
4556 		yyerror("invalid security context");
4557 		goto bad;
4558 	}
4559 	return 0;
4560 
4561       bad:
4562 	context_destroy(c);
4563 
4564 	return -1;
4565 }
4566 
define_initial_sid_context(void)4567 int define_initial_sid_context(void)
4568 {
4569 	char *id;
4570 	ocontext_t *c, *head;
4571 
4572 	if (pass == 1) {
4573 		id = (char *)queue_remove(id_queue);
4574 		free(id);
4575 		parse_security_context(NULL);
4576 		return 0;
4577 	}
4578 
4579 	id = (char *)queue_remove(id_queue);
4580 	if (!id) {
4581 		yyerror("no sid name for SID context definition?");
4582 		return -1;
4583 	}
4584 	head = policydbp->ocontexts[OCON_ISID];
4585 	for (c = head; c; c = c->next) {
4586 		if (!strcmp(id, c->u.name))
4587 			break;
4588 	}
4589 
4590 	if (!c) {
4591 		yyerror2("SID %s is not defined", id);
4592 		free(id);
4593 		return -1;
4594 	}
4595 	if (c->context[0].user) {
4596 		yyerror2("The context for SID %s is multiply defined", id);
4597 		free(id);
4598 		return -1;
4599 	}
4600 	/* no need to keep the sid name */
4601 	free(id);
4602 
4603 	if (parse_security_context(&c->context[0]))
4604 		return -1;
4605 
4606 	return 0;
4607 }
4608 
define_fs_context(unsigned int major,unsigned int minor)4609 int define_fs_context(unsigned int major, unsigned int minor)
4610 {
4611 	ocontext_t *newc, *c, *head;
4612 
4613 	if (policydbp->target_platform != SEPOL_TARGET_SELINUX) {
4614 		yyerror("fscon not supported for target");
4615 		return -1;
4616 	}
4617 
4618 	if (pass == 1) {
4619 		parse_security_context(NULL);
4620 		parse_security_context(NULL);
4621 		return 0;
4622 	}
4623 
4624 	newc = (ocontext_t *) malloc(sizeof(ocontext_t));
4625 	if (!newc) {
4626 		yyerror("out of memory");
4627 		return -1;
4628 	}
4629 	memset(newc, 0, sizeof(ocontext_t));
4630 
4631 	newc->u.name = (char *)malloc(6);
4632 	if (!newc->u.name) {
4633 		yyerror("out of memory");
4634 		free(newc);
4635 		return -1;
4636 	}
4637 	sprintf(newc->u.name, "%02x:%02x", major, minor);
4638 
4639 	if (parse_security_context(&newc->context[0])) {
4640 		free(newc->u.name);
4641 		free(newc);
4642 		return -1;
4643 	}
4644 	if (parse_security_context(&newc->context[1])) {
4645 		context_destroy(&newc->context[0]);
4646 		free(newc->u.name);
4647 		free(newc);
4648 		return -1;
4649 	}
4650 	head = policydbp->ocontexts[OCON_FS];
4651 
4652 	for (c = head; c; c = c->next) {
4653 		if (!strcmp(newc->u.name, c->u.name)) {
4654 			yyerror2("duplicate entry for file system %s",
4655 				 newc->u.name);
4656 			context_destroy(&newc->context[0]);
4657 			context_destroy(&newc->context[1]);
4658 			free(newc->u.name);
4659 			free(newc);
4660 			return -1;
4661 		}
4662 	}
4663 
4664 	newc->next = head;
4665 	policydbp->ocontexts[OCON_FS] = newc;
4666 
4667 	return 0;
4668 }
4669 
define_pirq_context(unsigned int pirq)4670 int define_pirq_context(unsigned int pirq)
4671 {
4672 	ocontext_t *newc, *c, *l, *head;
4673 	char *id;
4674 
4675 	if (policydbp->target_platform != SEPOL_TARGET_XEN) {
4676 		yyerror("pirqcon not supported for target");
4677 		return -1;
4678 	}
4679 
4680 	if (pass == 1) {
4681 		id = (char *) queue_remove(id_queue);
4682 		free(id);
4683 		parse_security_context(NULL);
4684 		return 0;
4685 	}
4686 
4687 	newc = malloc(sizeof(ocontext_t));
4688 	if (!newc) {
4689 		yyerror("out of memory");
4690 		return -1;
4691 	}
4692 	memset(newc, 0, sizeof(ocontext_t));
4693 
4694 	newc->u.pirq = pirq;
4695 
4696 	if (parse_security_context(&newc->context[0])) {
4697 		free(newc);
4698 		return -1;
4699 	}
4700 
4701 	head = policydbp->ocontexts[OCON_XEN_PIRQ];
4702 	for (l = NULL, c = head; c; l = c, c = c->next) {
4703 		unsigned int pirq2;
4704 
4705 		pirq2 = c->u.pirq;
4706 		if (pirq == pirq2) {
4707 			yyerror2("duplicate pirqcon entry for %d ", pirq);
4708 			goto bad;
4709 		}
4710 	}
4711 
4712 	if (l)
4713 		l->next = newc;
4714 	else
4715 		policydbp->ocontexts[OCON_XEN_PIRQ] = newc;
4716 
4717 	return 0;
4718 
4719 bad:
4720 	free(newc);
4721 	return -1;
4722 }
4723 
define_iomem_context(uint64_t low,uint64_t high)4724 int define_iomem_context(uint64_t low, uint64_t high)
4725 {
4726 	ocontext_t *newc, *c, *l, *head;
4727 	char *id;
4728 
4729 	if (policydbp->target_platform != SEPOL_TARGET_XEN) {
4730 		yyerror("iomemcon not supported for target");
4731 		return -1;
4732 	}
4733 
4734 	if (pass == 1) {
4735 		id = (char *)queue_remove(id_queue);
4736 		free(id);
4737 		parse_security_context(NULL);
4738 		return 0;
4739 	}
4740 
4741 	newc = malloc(sizeof(ocontext_t));
4742 	if (!newc) {
4743 		yyerror("out of memory");
4744 		return -1;
4745 	}
4746 	memset(newc, 0, sizeof(ocontext_t));
4747 
4748 	newc->u.iomem.low_iomem  = low;
4749 	newc->u.iomem.high_iomem = high;
4750 
4751 	if (low > high) {
4752 		yyerror2("low memory 0x%"PRIx64" exceeds high memory 0x%"PRIx64"", low, high);
4753 		free(newc);
4754 		return -1;
4755 	}
4756 
4757 	if (parse_security_context(&newc->context[0])) {
4758 		free(newc);
4759 		return -1;
4760 	}
4761 
4762 	head = policydbp->ocontexts[OCON_XEN_IOMEM];
4763 	for (l = NULL, c = head; c; l = c, c = c->next) {
4764 		uint64_t low2, high2;
4765 
4766 		low2 = c->u.iomem.low_iomem;
4767 		high2 = c->u.iomem.high_iomem;
4768 		if (low <= high2 && low2 <= high) {
4769 			yyerror2("iomemcon entry for 0x%"PRIx64"-0x%"PRIx64" overlaps with "
4770 				"earlier entry 0x%"PRIx64"-0x%"PRIx64"", low, high,
4771 				low2, high2);
4772 			goto bad;
4773 		}
4774 	}
4775 
4776 	if (l)
4777 		l->next = newc;
4778 	else
4779 		policydbp->ocontexts[OCON_XEN_IOMEM] = newc;
4780 
4781 	return 0;
4782 
4783 bad:
4784 	free(newc);
4785 	return -1;
4786 }
4787 
define_ioport_context(unsigned long low,unsigned long high)4788 int define_ioport_context(unsigned long low, unsigned long high)
4789 {
4790 	ocontext_t *newc, *c, *l, *head;
4791 	char *id;
4792 
4793 	if (policydbp->target_platform != SEPOL_TARGET_XEN) {
4794 		yyerror("ioportcon not supported for target");
4795 		return -1;
4796 	}
4797 
4798 	if (pass == 1) {
4799 		id = (char *)queue_remove(id_queue);
4800 		free(id);
4801 		parse_security_context(NULL);
4802 		return 0;
4803 	}
4804 
4805 	newc = malloc(sizeof(ocontext_t));
4806 	if (!newc) {
4807 		yyerror("out of memory");
4808 		return -1;
4809 	}
4810 	memset(newc, 0, sizeof(ocontext_t));
4811 
4812 	newc->u.ioport.low_ioport  = low;
4813 	newc->u.ioport.high_ioport = high;
4814 
4815 	if (low > high) {
4816 		yyerror2("low ioport 0x%lx exceeds high ioport 0x%lx", low, high);
4817 		free(newc);
4818 		return -1;
4819 	}
4820 
4821 	if (parse_security_context(&newc->context[0])) {
4822 		free(newc);
4823 		return -1;
4824 	}
4825 
4826 	head = policydbp->ocontexts[OCON_XEN_IOPORT];
4827 	for (l = NULL, c = head; c; l = c, c = c->next) {
4828 		uint32_t low2, high2;
4829 
4830 		low2 = c->u.ioport.low_ioport;
4831 		high2 = c->u.ioport.high_ioport;
4832 		if (low <= high2 && low2 <= high) {
4833 			yyerror2("ioportcon entry for 0x%lx-0x%lx overlaps with"
4834 				"earlier entry 0x%x-0x%x", low, high,
4835 				low2, high2);
4836 			goto bad;
4837 		}
4838 	}
4839 
4840 	if (l)
4841 		l->next = newc;
4842 	else
4843 		policydbp->ocontexts[OCON_XEN_IOPORT] = newc;
4844 
4845 	return 0;
4846 
4847 bad:
4848 	free(newc);
4849 	return -1;
4850 }
4851 
define_pcidevice_context(unsigned long device)4852 int define_pcidevice_context(unsigned long device)
4853 {
4854 	ocontext_t *newc, *c, *l, *head;
4855 	char *id;
4856 
4857 	if (policydbp->target_platform != SEPOL_TARGET_XEN) {
4858 		yyerror("pcidevicecon not supported for target");
4859 		return -1;
4860 	}
4861 
4862 	if (pass == 1) {
4863 		id = (char *) queue_remove(id_queue);
4864 		free(id);
4865 		parse_security_context(NULL);
4866 		return 0;
4867 	}
4868 
4869 	newc = malloc(sizeof(ocontext_t));
4870 	if (!newc) {
4871 		yyerror("out of memory");
4872 		return -1;
4873 	}
4874 	memset(newc, 0, sizeof(ocontext_t));
4875 
4876 	newc->u.device = device;
4877 
4878 	if (parse_security_context(&newc->context[0])) {
4879 		free(newc);
4880 		return -1;
4881 	}
4882 
4883 	head = policydbp->ocontexts[OCON_XEN_PCIDEVICE];
4884 	for (l = NULL, c = head; c; l = c, c = c->next) {
4885 		unsigned int device2;
4886 
4887 		device2 = c->u.device;
4888 		if (device == device2) {
4889 			yyerror2("duplicate pcidevicecon entry for 0x%lx",
4890 				 device);
4891 			goto bad;
4892 		}
4893 	}
4894 
4895 	if (l)
4896 		l->next = newc;
4897 	else
4898 		policydbp->ocontexts[OCON_XEN_PCIDEVICE] = newc;
4899 
4900 	return 0;
4901 
4902 bad:
4903 	free(newc);
4904 	return -1;
4905 }
4906 
define_devicetree_context(void)4907 int define_devicetree_context(void)
4908 {
4909 	ocontext_t *newc, *c, *l, *head;
4910 
4911 	if (policydbp->target_platform != SEPOL_TARGET_XEN) {
4912 		yyerror("devicetreecon not supported for target");
4913 		return -1;
4914 	}
4915 
4916 	if (pass == 1) {
4917 		free(queue_remove(id_queue));
4918 		parse_security_context(NULL);
4919 		return 0;
4920 	}
4921 
4922 	newc = malloc(sizeof(ocontext_t));
4923 	if (!newc) {
4924 		yyerror("out of memory");
4925 		return -1;
4926 	}
4927 	memset(newc, 0, sizeof(ocontext_t));
4928 
4929 	newc->u.name = (char *)queue_remove(id_queue);
4930 	if (!newc->u.name) {
4931 		free(newc);
4932 		return -1;
4933 	}
4934 
4935 	if (parse_security_context(&newc->context[0])) {
4936 		free(newc->u.name);
4937 		free(newc);
4938 		return -1;
4939 	}
4940 
4941 	head = policydbp->ocontexts[OCON_XEN_DEVICETREE];
4942 	for (l = NULL, c = head; c; l = c, c = c->next) {
4943 		if (strcmp(newc->u.name, c->u.name) == 0) {
4944 			yyerror2("duplicate devicetree entry for '%s'", newc->u.name);
4945 			goto bad;
4946 		}
4947 	}
4948 
4949 	if (l)
4950 		l->next = newc;
4951 	else
4952 		policydbp->ocontexts[OCON_XEN_DEVICETREE] = newc;
4953 
4954 	return 0;
4955 
4956 bad:
4957 	free(newc->u.name);
4958 	free(newc);
4959 	return -1;
4960 }
4961 
define_port_context(unsigned int low,unsigned int high)4962 int define_port_context(unsigned int low, unsigned int high)
4963 {
4964 	ocontext_t *newc, *c, *l, *head;
4965 	unsigned int protocol;
4966 	char *id;
4967 
4968 	if (policydbp->target_platform != SEPOL_TARGET_SELINUX) {
4969 		yyerror("portcon not supported for target");
4970 		return -1;
4971 	}
4972 
4973 	if (pass == 1) {
4974 		id = (char *)queue_remove(id_queue);
4975 		free(id);
4976 		parse_security_context(NULL);
4977 		return 0;
4978 	}
4979 
4980 	newc = malloc(sizeof(ocontext_t));
4981 	if (!newc) {
4982 		yyerror("out of memory");
4983 		return -1;
4984 	}
4985 	memset(newc, 0, sizeof(ocontext_t));
4986 
4987 	id = (char *)queue_remove(id_queue);
4988 	if (!id) {
4989 		free(newc);
4990 		return -1;
4991 	}
4992 	if ((strcmp(id, "tcp") == 0) || (strcmp(id, "TCP") == 0)) {
4993 		protocol = IPPROTO_TCP;
4994 	} else if ((strcmp(id, "udp") == 0) || (strcmp(id, "UDP") == 0)) {
4995 		protocol = IPPROTO_UDP;
4996 	} else if ((strcmp(id, "dccp") == 0) || (strcmp(id, "DCCP") == 0)) {
4997 		protocol = IPPROTO_DCCP;
4998 	} else if ((strcmp(id, "sctp") == 0) || (strcmp(id, "SCTP") == 0)) {
4999 		protocol = IPPROTO_SCTP;
5000 	} else {
5001 		yyerror2("unrecognized protocol %s", id);
5002 		goto bad;
5003 	}
5004 
5005 	newc->u.port.protocol = protocol;
5006 	newc->u.port.low_port = low;
5007 	newc->u.port.high_port = high;
5008 
5009 	if (low > high) {
5010 		yyerror2("low port %d exceeds high port %d", low, high);
5011 		goto bad;
5012 	}
5013 
5014 	if (parse_security_context(&newc->context[0])) {
5015 		goto bad;
5016 	}
5017 
5018 	/* Preserve the matching order specified in the configuration. */
5019 	head = policydbp->ocontexts[OCON_PORT];
5020 	for (l = NULL, c = head; c; l = c, c = c->next) {
5021 		unsigned int prot2, low2, high2;
5022 
5023 		prot2 = c->u.port.protocol;
5024 		low2 = c->u.port.low_port;
5025 		high2 = c->u.port.high_port;
5026 		if (protocol != prot2)
5027 			continue;
5028 		if (low == low2 && high == high2) {
5029 			yyerror2("duplicate portcon entry for %s %d-%d ", id,
5030 				 low, high);
5031 			goto bad;
5032 		}
5033 		if (low2 <= low && high2 >= high) {
5034 			yyerror2("portcon entry for %s %d-%d hidden by earlier "
5035 				 "entry for %d-%d", id, low, high, low2, high2);
5036 			goto bad;
5037 		}
5038 	}
5039 
5040 	if (l)
5041 		l->next = newc;
5042 	else
5043 		policydbp->ocontexts[OCON_PORT] = newc;
5044 
5045 	free(id);
5046 	return 0;
5047 
5048       bad:
5049 	free(id);
5050 	free(newc);
5051 	return -1;
5052 }
5053 
define_ibpkey_context(unsigned int low,unsigned int high)5054 int define_ibpkey_context(unsigned int low, unsigned int high)
5055 {
5056 	ocontext_t *newc, *c, *l, *head;
5057 	struct in6_addr subnet_prefix;
5058 	char *id;
5059 	int rc = 0;
5060 
5061 	if (policydbp->target_platform != SEPOL_TARGET_SELINUX) {
5062 		yyerror("ibpkeycon not supported for target");
5063 		return -1;
5064 	}
5065 
5066 	if (pass == 1) {
5067 		id = (char *)queue_remove(id_queue);
5068 		free(id);
5069 		parse_security_context(NULL);
5070 		return 0;
5071 	}
5072 
5073 	newc = malloc(sizeof(*newc));
5074 	if (!newc) {
5075 		yyerror("out of memory");
5076 		return -1;
5077 	}
5078 	memset(newc, 0, sizeof(*newc));
5079 
5080 	id = queue_remove(id_queue);
5081 	if (!id) {
5082 		yyerror("failed to read the subnet prefix");
5083 		rc = -1;
5084 		goto out;
5085 	}
5086 
5087 	rc = inet_pton(AF_INET6, id, &subnet_prefix);
5088 	free(id);
5089 	if (rc < 1) {
5090 		yyerror("failed to parse the subnet prefix");
5091 		if (rc == 0)
5092 			rc = -1;
5093 		goto out;
5094 	}
5095 
5096 	if (subnet_prefix.s6_addr[2] || subnet_prefix.s6_addr[3]) {
5097 		yyerror("subnet prefix should be 0's in the low order 64 bits.");
5098 		rc = -1;
5099 		goto out;
5100 	}
5101 
5102 	if (low > 0xffff || high > 0xffff) {
5103 		yyerror("pkey value too large, pkeys are 16 bits.");
5104 		rc = -1;
5105 		goto out;
5106 	}
5107 
5108 	memcpy(&newc->u.ibpkey.subnet_prefix, &subnet_prefix.s6_addr[0],
5109 	       sizeof(newc->u.ibpkey.subnet_prefix));
5110 
5111 	newc->u.ibpkey.low_pkey = low;
5112 	newc->u.ibpkey.high_pkey = high;
5113 
5114 	if (low > high) {
5115 		yyerror2("low pkey %d exceeds high pkey %d", low, high);
5116 		rc = -1;
5117 		goto out;
5118 	}
5119 
5120 	rc = parse_security_context(&newc->context[0]);
5121 	if (rc)
5122 		goto out;
5123 
5124 	/* Preserve the matching order specified in the configuration. */
5125 	head = policydbp->ocontexts[OCON_IBPKEY];
5126 	for (l = NULL, c = head; c; l = c, c = c->next) {
5127 		unsigned int low2, high2;
5128 
5129 		low2 = c->u.ibpkey.low_pkey;
5130 		high2 = c->u.ibpkey.high_pkey;
5131 
5132 		if (low == low2 && high == high2 &&
5133 		    c->u.ibpkey.subnet_prefix == newc->u.ibpkey.subnet_prefix) {
5134 			yyerror2("duplicate ibpkeycon entry for %d-%d ",
5135 				 low, high);
5136 			rc = -1;
5137 			goto out;
5138 		}
5139 		if (low2 <= low && high2 >= high &&
5140 		    c->u.ibpkey.subnet_prefix == newc->u.ibpkey.subnet_prefix) {
5141 			yyerror2("ibpkeycon entry for %d-%d hidden by earlier entry for %d-%d",
5142 				 low, high, low2, high2);
5143 			rc = -1;
5144 			goto out;
5145 		}
5146 	}
5147 
5148 	if (l)
5149 		l->next = newc;
5150 	else
5151 		policydbp->ocontexts[OCON_IBPKEY] = newc;
5152 
5153 	return 0;
5154 
5155 out:
5156 	free(newc);
5157 	return rc;
5158 }
5159 
define_ibendport_context(unsigned int port)5160 int define_ibendport_context(unsigned int port)
5161 {
5162 	ocontext_t *newc, *c, *l, *head;
5163 	char *id;
5164 	int rc = 0;
5165 
5166 	if (policydbp->target_platform != SEPOL_TARGET_SELINUX) {
5167 		yyerror("ibendportcon not supported for target");
5168 		return -1;
5169 	}
5170 
5171 	if (pass == 1) {
5172 		id = (char *)queue_remove(id_queue);
5173 		free(id);
5174 		parse_security_context(NULL);
5175 		return 0;
5176 	}
5177 
5178 	if (port > 0xff || port == 0) {
5179 		yyerror("Invalid ibendport port number, should be 0 < port < 256");
5180 		return -1;
5181 	}
5182 
5183 	newc = malloc(sizeof(*newc));
5184 	if (!newc) {
5185 		yyerror("out of memory");
5186 		return -1;
5187 	}
5188 	memset(newc, 0, sizeof(*newc));
5189 
5190 	newc->u.ibendport.dev_name = queue_remove(id_queue);
5191 	if (!newc->u.ibendport.dev_name) {
5192 		yyerror("failed to read infiniband device name.");
5193 		rc = -1;
5194 		goto out;
5195 	}
5196 
5197 	if (strlen(newc->u.ibendport.dev_name) > IB_DEVICE_NAME_MAX - 1) {
5198 		yyerror("infiniband device name exceeds max length of 63.");
5199 		rc = -1;
5200 		goto out;
5201 	}
5202 
5203 	newc->u.ibendport.port = port;
5204 
5205 	if (parse_security_context(&newc->context[0])) {
5206 		free(newc);
5207 		return -1;
5208 	}
5209 
5210 	/* Preserve the matching order specified in the configuration. */
5211 	head = policydbp->ocontexts[OCON_IBENDPORT];
5212 	for (l = NULL, c = head; c; l = c, c = c->next) {
5213 		unsigned int port2;
5214 
5215 		port2 = c->u.ibendport.port;
5216 
5217 		if (port == port2 &&
5218 		    !strcmp(c->u.ibendport.dev_name,
5219 			     newc->u.ibendport.dev_name)) {
5220 			yyerror2("duplicate ibendportcon entry for %s port %u",
5221 				 newc->u.ibendport.dev_name, port);
5222 			rc = -1;
5223 			goto out;
5224 		}
5225 	}
5226 
5227 	if (l)
5228 		l->next = newc;
5229 	else
5230 		policydbp->ocontexts[OCON_IBENDPORT] = newc;
5231 
5232 	return 0;
5233 
5234 out:
5235 	free(newc->u.ibendport.dev_name);
5236 	free(newc);
5237 	return rc;
5238 }
5239 
define_netif_context(void)5240 int define_netif_context(void)
5241 {
5242 	ocontext_t *newc, *c, *head;
5243 
5244 	if (policydbp->target_platform != SEPOL_TARGET_SELINUX) {
5245 		yyerror("netifcon not supported for target");
5246 		return -1;
5247 	}
5248 
5249 	if (pass == 1) {
5250 		free(queue_remove(id_queue));
5251 		parse_security_context(NULL);
5252 		parse_security_context(NULL);
5253 		return 0;
5254 	}
5255 
5256 	newc = (ocontext_t *) malloc(sizeof(ocontext_t));
5257 	if (!newc) {
5258 		yyerror("out of memory");
5259 		return -1;
5260 	}
5261 	memset(newc, 0, sizeof(ocontext_t));
5262 
5263 	newc->u.name = (char *)queue_remove(id_queue);
5264 	if (!newc->u.name) {
5265 		free(newc);
5266 		return -1;
5267 	}
5268 	if (parse_security_context(&newc->context[0])) {
5269 		free(newc->u.name);
5270 		free(newc);
5271 		return -1;
5272 	}
5273 	if (parse_security_context(&newc->context[1])) {
5274 		context_destroy(&newc->context[0]);
5275 		free(newc->u.name);
5276 		free(newc);
5277 		return -1;
5278 	}
5279 	head = policydbp->ocontexts[OCON_NETIF];
5280 
5281 	for (c = head; c; c = c->next) {
5282 		if (!strcmp(newc->u.name, c->u.name)) {
5283 			yyerror2("duplicate entry for network interface %s",
5284 				 newc->u.name);
5285 			context_destroy(&newc->context[0]);
5286 			context_destroy(&newc->context[1]);
5287 			free(newc->u.name);
5288 			free(newc);
5289 			return -1;
5290 		}
5291 	}
5292 
5293 	newc->next = head;
5294 	policydbp->ocontexts[OCON_NETIF] = newc;
5295 	return 0;
5296 }
5297 
define_ipv4_node_context(void)5298 int define_ipv4_node_context(void)
5299 {
5300 	char *id;
5301 	int rc = 0;
5302 	struct in_addr addr, mask;
5303 	ocontext_t *newc, *c, *l, *head;
5304 
5305 	if (policydbp->target_platform != SEPOL_TARGET_SELINUX) {
5306 		yyerror("nodecon not supported for target");
5307 		return -1;
5308 	}
5309 
5310 	if (pass == 1) {
5311 		free(queue_remove(id_queue));
5312 		free(queue_remove(id_queue));
5313 		parse_security_context(NULL);
5314 		goto out;
5315 	}
5316 
5317 	id = queue_remove(id_queue);
5318 	if (!id) {
5319 		yyerror("failed to read ipv4 address");
5320 		rc = -1;
5321 		goto out;
5322 	}
5323 
5324 	rc = inet_pton(AF_INET, id, &addr);
5325 	free(id);
5326 	if (rc < 1) {
5327 		yyerror("failed to parse ipv4 address");
5328 		if (rc == 0)
5329 			rc = -1;
5330 		goto out;
5331 	}
5332 
5333 	id = queue_remove(id_queue);
5334 	if (!id) {
5335 		yyerror("failed to read ipv4 address");
5336 		rc = -1;
5337 		goto out;
5338 	}
5339 
5340 	rc = inet_pton(AF_INET, id, &mask);
5341 	free(id);
5342 	if (rc < 1) {
5343 		yyerror("failed to parse ipv4 mask");
5344 		if (rc == 0)
5345 			rc = -1;
5346 		goto out;
5347 	}
5348 
5349 	if (mask.s_addr != 0 && ((~mask.s_addr + 1) & ~mask.s_addr) != 0) {
5350 		yywarn("ipv4 mask is not contiguous");
5351 	}
5352 
5353 	if ((~mask.s_addr & addr.s_addr) != 0) {
5354 		yywarn("host bits in ipv4 address set");
5355 	}
5356 
5357 	newc = malloc(sizeof(ocontext_t));
5358 	if (!newc) {
5359 		yyerror("out of memory");
5360 		rc = -1;
5361 		goto out;
5362 	}
5363 
5364 	memset(newc, 0, sizeof(ocontext_t));
5365 	newc->u.node.addr = addr.s_addr;
5366 	newc->u.node.mask = mask.s_addr;
5367 
5368 	if (parse_security_context(&newc->context[0])) {
5369 		free(newc);
5370 		return -1;
5371 	}
5372 
5373 	/* Create order of most specific to least retaining
5374 	   the order specified in the configuration. */
5375 	head = policydbp->ocontexts[OCON_NODE];
5376 	for (l = NULL, c = head; c; l = c, c = c->next) {
5377 		if (newc->u.node.mask > c->u.node.mask)
5378 			break;
5379 	}
5380 
5381 	newc->next = c;
5382 
5383 	if (l)
5384 		l->next = newc;
5385 	else
5386 		policydbp->ocontexts[OCON_NODE] = newc;
5387 	rc = 0;
5388 out:
5389 	return rc;
5390 }
5391 
ipv6_is_mask_contiguous(const struct in6_addr * mask)5392 static int ipv6_is_mask_contiguous(const struct in6_addr *mask)
5393 {
5394 	int filled = 1;
5395 	unsigned i;
5396 
5397 	for (i = 0; i < 16; i++) {
5398 		if ((((~mask->s6_addr[i] & 0xFF) + 1) & (~mask->s6_addr[i] & 0xFF)) != 0) {
5399 			return 0;
5400 		}
5401 		if (!filled && mask->s6_addr[i] != 0) {
5402 			return 0;
5403 		}
5404 
5405 		if (filled && mask->s6_addr[i] != 0xFF) {
5406 			filled = 0;
5407 		}
5408 	}
5409 
5410 	return 1;
5411 }
5412 
ipv6_has_host_bits_set(const struct in6_addr * addr,const struct in6_addr * mask)5413 static int ipv6_has_host_bits_set(const struct in6_addr *addr, const struct in6_addr *mask)
5414 {
5415 	unsigned i;
5416 
5417 	for (i = 0; i < 16; i++) {
5418 		if ((addr->s6_addr[i] & ~mask->s6_addr[i]) != 0) {
5419 			return 1;
5420 		}
5421 	}
5422 
5423 	return 0;
5424 }
5425 
define_ipv6_node_context(void)5426 int define_ipv6_node_context(void)
5427 {
5428 	char *id;
5429 	int rc = 0;
5430 	struct in6_addr addr, mask;
5431 	ocontext_t *newc, *c, *l, *head;
5432 
5433 	if (policydbp->target_platform != SEPOL_TARGET_SELINUX) {
5434 		yyerror("nodecon not supported for target");
5435 		return -1;
5436 	}
5437 
5438 	if (pass == 1) {
5439 		free(queue_remove(id_queue));
5440 		free(queue_remove(id_queue));
5441 		parse_security_context(NULL);
5442 		goto out;
5443 	}
5444 
5445 	id = queue_remove(id_queue);
5446 	if (!id) {
5447 		yyerror("failed to read ipv6 address");
5448 		rc = -1;
5449 		goto out;
5450 	}
5451 
5452 	rc = inet_pton(AF_INET6, id, &addr);
5453 	free(id);
5454 	if (rc < 1) {
5455 		yyerror("failed to parse ipv6 address");
5456 		if (rc == 0)
5457 			rc = -1;
5458 		goto out;
5459 	}
5460 
5461 	id = queue_remove(id_queue);
5462 	if (!id) {
5463 		yyerror("failed to read ipv6 address");
5464 		rc = -1;
5465 		goto out;
5466 	}
5467 
5468 	rc = inet_pton(AF_INET6, id, &mask);
5469 	free(id);
5470 	if (rc < 1) {
5471 		yyerror("failed to parse ipv6 mask");
5472 		if (rc == 0)
5473 			rc = -1;
5474 		goto out;
5475 	}
5476 
5477 	if (!ipv6_is_mask_contiguous(&mask)) {
5478 		yywarn("ipv6 mask is not contiguous");
5479 	}
5480 
5481 	if (ipv6_has_host_bits_set(&addr, &mask)) {
5482 		yywarn("host bits in ipv6 address set");
5483 	}
5484 
5485 	newc = malloc(sizeof(ocontext_t));
5486 	if (!newc) {
5487 		yyerror("out of memory");
5488 		rc = -1;
5489 		goto out;
5490 	}
5491 
5492 	memset(newc, 0, sizeof(ocontext_t));
5493 	memcpy(&newc->u.node6.addr[0], &addr.s6_addr[0], 16);
5494 	memcpy(&newc->u.node6.mask[0], &mask.s6_addr[0], 16);
5495 
5496 	if (parse_security_context(&newc->context[0])) {
5497 		free(newc);
5498 		rc = -1;
5499 		goto out;
5500 	}
5501 
5502 	/* Create order of most specific to least retaining
5503 	   the order specified in the configuration. */
5504 	head = policydbp->ocontexts[OCON_NODE6];
5505 	for (l = NULL, c = head; c; l = c, c = c->next) {
5506 		if (memcmp(&newc->u.node6.mask, &c->u.node6.mask, 16) > 0)
5507 			break;
5508 	}
5509 
5510 	newc->next = c;
5511 
5512 	if (l)
5513 		l->next = newc;
5514 	else
5515 		policydbp->ocontexts[OCON_NODE6] = newc;
5516 
5517 	rc = 0;
5518       out:
5519 	return rc;
5520 }
5521 
define_fs_use(int behavior)5522 int define_fs_use(int behavior)
5523 {
5524 	ocontext_t *newc, *c, *head;
5525 
5526 	if (policydbp->target_platform != SEPOL_TARGET_SELINUX) {
5527 		yyerror("fsuse not supported for target");
5528 		return -1;
5529 	}
5530 
5531 	if (pass == 1) {
5532 		free(queue_remove(id_queue));
5533 		parse_security_context(NULL);
5534 		return 0;
5535 	}
5536 
5537 	newc = (ocontext_t *) malloc(sizeof(ocontext_t));
5538 	if (!newc) {
5539 		yyerror("out of memory");
5540 		return -1;
5541 	}
5542 	memset(newc, 0, sizeof(ocontext_t));
5543 
5544 	newc->u.name = (char *)queue_remove(id_queue);
5545 	if (!newc->u.name) {
5546 		free(newc);
5547 		return -1;
5548 	}
5549 	newc->v.behavior = behavior;
5550 	if (parse_security_context(&newc->context[0])) {
5551 		free(newc->u.name);
5552 		free(newc);
5553 		return -1;
5554 	}
5555 
5556 	head = policydbp->ocontexts[OCON_FSUSE];
5557 
5558 	for (c = head; c; c = c->next) {
5559 		if (!strcmp(newc->u.name, c->u.name)) {
5560 			yyerror2("duplicate fs_use entry for filesystem type %s",
5561 				 newc->u.name);
5562 			context_destroy(&newc->context[0]);
5563 			free(newc->u.name);
5564 			free(newc);
5565 			return -1;
5566 		}
5567 	}
5568 
5569 	newc->next = head;
5570 	policydbp->ocontexts[OCON_FSUSE] = newc;
5571 	return 0;
5572 }
5573 
define_genfs_context_helper(char * fstype,int has_type)5574 static int define_genfs_context_helper(char *fstype, int has_type)
5575 {
5576 	struct genfs *genfs_p, *genfs, *newgenfs;
5577 	ocontext_t *newc, *c, *head, *p;
5578 	class_datum_t *cladatum;
5579 	char *type = NULL;
5580 	const char *sclass;
5581 	int len, len2;
5582 
5583 	if (policydbp->target_platform != SEPOL_TARGET_SELINUX) {
5584 		yyerror("genfs not supported for target");
5585 		return -1;
5586 	}
5587 
5588 	if (pass == 1) {
5589 		free(fstype);
5590 		free(queue_remove(id_queue));
5591 		if (has_type)
5592 			free(queue_remove(id_queue));
5593 		parse_security_context(NULL);
5594 		return 0;
5595 	}
5596 
5597 	for (genfs_p = NULL, genfs = policydbp->genfs;
5598 	     genfs; genfs_p = genfs, genfs = genfs->next) {
5599 		if (strcmp(fstype, genfs->fstype) <= 0)
5600 			break;
5601 	}
5602 
5603 	if (!genfs || strcmp(fstype, genfs->fstype)) {
5604 		newgenfs = malloc(sizeof(struct genfs));
5605 		if (!newgenfs) {
5606 			yyerror("out of memory");
5607 			return -1;
5608 		}
5609 		memset(newgenfs, 0, sizeof(struct genfs));
5610 		newgenfs->fstype = fstype;
5611 		newgenfs->next = genfs;
5612 		if (genfs_p)
5613 			genfs_p->next = newgenfs;
5614 		else
5615 			policydbp->genfs = newgenfs;
5616 		genfs = newgenfs;
5617 	} else {
5618 		free(fstype);
5619 		fstype = NULL;
5620 	}
5621 
5622 	newc = (ocontext_t *) malloc(sizeof(ocontext_t));
5623 	if (!newc) {
5624 		yyerror("out of memory");
5625 		return -1;
5626 	}
5627 	memset(newc, 0, sizeof(ocontext_t));
5628 
5629 	newc->u.name = (char *)queue_remove(id_queue);
5630 	if (!newc->u.name)
5631 		goto fail;
5632 	if (has_type) {
5633 		type = (char *)queue_remove(id_queue);
5634 		if (!type)
5635 			goto fail;
5636 		if (type[1] != 0) {
5637 			yyerror2("invalid type %s", type);
5638 			goto fail;
5639 		}
5640 		switch (type[0]) {
5641 		case 'b':
5642 			sclass = "blk_file";
5643 			break;
5644 		case 'c':
5645 			sclass = "chr_file";
5646 			break;
5647 		case 'd':
5648 			sclass = "dir";
5649 			break;
5650 		case 'p':
5651 			sclass = "fifo_file";
5652 			break;
5653 		case 'l':
5654 			sclass = "lnk_file";
5655 			break;
5656 		case 's':
5657 			sclass = "sock_file";
5658 			break;
5659 		case '-':
5660 			sclass = "file";
5661 			break;
5662 		default:
5663 			yyerror2("invalid type %s", type);
5664 			goto fail;
5665 		}
5666 
5667 		cladatum = hashtab_search(policydbp->p_classes.table,
5668 					  sclass);
5669 		if (!cladatum) {
5670 			yyerror2("could not find class %s for "
5671 				 "genfscon statement", sclass);
5672 			goto fail;
5673 		}
5674 		newc->v.sclass = cladatum->s.value;
5675 	}
5676 	if (parse_security_context(&newc->context[0]))
5677 		goto fail;
5678 
5679 	head = genfs->head;
5680 
5681 	for (p = NULL, c = head; c; p = c, c = c->next) {
5682 		if (!strcmp(newc->u.name, c->u.name) &&
5683 		    (!newc->v.sclass || !c->v.sclass
5684 		     || newc->v.sclass == c->v.sclass)) {
5685 			yyerror2("duplicate entry for genfs entry (%s, %s)",
5686 				 genfs->fstype, newc->u.name);
5687 			goto fail;
5688 		}
5689 		len = strlen(newc->u.name);
5690 		len2 = strlen(c->u.name);
5691 		if (len > len2)
5692 			break;
5693 	}
5694 
5695 	newc->next = c;
5696 	if (p)
5697 		p->next = newc;
5698 	else
5699 		genfs->head = newc;
5700 	free(type);
5701 	return 0;
5702       fail:
5703 	if (type)
5704 		free(type);
5705 	context_destroy(&newc->context[0]);
5706 	if (fstype)
5707 		free(fstype);
5708 	if (newc->u.name)
5709 		free(newc->u.name);
5710 	free(newc);
5711 	return -1;
5712 }
5713 
define_genfs_context(int has_type)5714 int define_genfs_context(int has_type)
5715 {
5716 	return define_genfs_context_helper(queue_remove(id_queue), has_type);
5717 }
5718 
define_range_trans(int class_specified)5719 int define_range_trans(int class_specified)
5720 {
5721 	char *id;
5722 	level_datum_t *levdatum = 0;
5723 	class_datum_t *cladatum;
5724 	range_trans_rule_t *rule;
5725 	int l, add = 1;
5726 
5727 	if (!mlspol) {
5728 		yyerror("range_transition rule in non-MLS configuration");
5729 		return -1;
5730 	}
5731 
5732 	if (pass == 1) {
5733 		while ((id = queue_remove(id_queue)))
5734 			free(id);
5735 		while ((id = queue_remove(id_queue)))
5736 			free(id);
5737 		if (class_specified)
5738 			while ((id = queue_remove(id_queue)))
5739 				free(id);
5740 		id = queue_remove(id_queue);
5741 		free(id);
5742 		for (l = 0; l < 2; l++) {
5743 			while ((id = queue_remove(id_queue))) {
5744 				free(id);
5745 			}
5746 			id = queue_remove(id_queue);
5747 			if (!id)
5748 				break;
5749 			free(id);
5750 		}
5751 		return 0;
5752 	}
5753 
5754 	rule = malloc(sizeof(struct range_trans_rule));
5755 	if (!rule) {
5756 		yyerror("out of memory");
5757 		return -1;
5758 	}
5759 	range_trans_rule_init(rule);
5760 
5761 	while ((id = queue_remove(id_queue))) {
5762 		if (set_types(&rule->stypes, id, &add, 0))
5763 			goto out;
5764 	}
5765 	add = 1;
5766 	while ((id = queue_remove(id_queue))) {
5767 		if (set_types(&rule->ttypes, id, &add, 0))
5768 			goto out;
5769 	}
5770 
5771 	if (class_specified) {
5772 		if (read_classes(&rule->tclasses))
5773 			goto out;
5774 	} else {
5775 		cladatum = hashtab_search(policydbp->p_classes.table,
5776 		                          "process");
5777 		if (!cladatum) {
5778 			yyerror2("could not find process class for "
5779 			         "legacy range_transition statement");
5780 			goto out;
5781 		}
5782 
5783 		if (ebitmap_set_bit(&rule->tclasses, cladatum->s.value - 1, TRUE)) {
5784 			yyerror("out of memory");
5785 			goto out;
5786 		}
5787 	}
5788 
5789 	id = (char *)queue_remove(id_queue);
5790 	if (!id) {
5791 		yyerror("no range in range_transition definition?");
5792 		goto out;
5793 	}
5794 	for (l = 0; l < 2; l++) {
5795 		levdatum = hashtab_search(policydbp->p_levels.table, id);
5796 		if (!levdatum) {
5797 			yyerror2("unknown level %s used in range_transition "
5798 			         "definition", id);
5799 			free(id);
5800 			goto out;
5801 		}
5802 		free(id);
5803 
5804 		rule->trange.level[l].sens = levdatum->level->sens;
5805 
5806 		while ((id = queue_remove(id_queue))) {
5807 			if (parse_semantic_categories(id, levdatum,
5808 			                          &rule->trange.level[l].cat)) {
5809 				free(id);
5810 				goto out;
5811 			}
5812 			free(id);
5813 		}
5814 
5815 		id = (char *)queue_remove(id_queue);
5816 		if (!id)
5817 			break;
5818 	}
5819 	if (l == 0) {
5820 		if (mls_semantic_level_cpy(&rule->trange.level[1],
5821 		                           &rule->trange.level[0])) {
5822 			yyerror("out of memory");
5823 			goto out;
5824 		}
5825 	}
5826 
5827 	append_range_trans(rule);
5828 	return 0;
5829 
5830 out:
5831 	range_trans_rule_destroy(rule);
5832 	free(rule);
5833 	return -1;
5834 }
5835 
5836 /* FLASK */
5837