1 /*
2 * Media contexts backend for DB objects
3 *
4 * Author: KaiGai Kohei <kaigai@ak.jp.nec.com>
5 */
6
7 #include <sys/stat.h>
8 #include <string.h>
9 #include <stdio.h>
10 #include <stdio_ext.h>
11 #include <ctype.h>
12 #include <errno.h>
13 #include <limits.h>
14 #include <fnmatch.h>
15 #include "callbacks.h"
16 #include "label_internal.h"
17
18 /*
19 * Regular database object's security context interface
20 *
21 * It provides applications a regular security context for the given
22 * database objects. The pair of object's name and a security context
23 * are described in the specfile. In the default, it shall be stored
24 * in the /etc/selinux/$POLICYTYPE/contexts/sepgsql_contexts .
25 * (It assumes SE-PostgreSQL in the default. For other RDBMS, use the
26 * SELABEL_OPT_PATH option to specify different specfile.)
27 *
28 * Each line has the following format:
29 * <object class> <object name/identifier> <security context>
30 *
31 * For example:
32 * ----------------------------------------
33 * #
34 * # It is an example specfile for database obejcts
35 * #
36 * db_database template1 system_u:object_r:sepgsql_db_t:s0
37 *
38 * db_schema *.pg_catalog system_u:object_r:sepgsql_sys_schema_t:s0
39 *
40 * db_table *.pg_catalog.* system_u:object_r:sepgsql_sysobj_t:s0
41 * db_column *.pg_catalog.*.* system_u:object_r:sepgsql_sysobj_t:s0
42 * ----------------------------------------
43 *
44 * All the characters after the '#' are dealt as comments.
45 *
46 * The first token is object class. SELABEL_DB_* declared in label.h are
47 * corresponding to a certain database object.
48 *
49 * The object name/identifier is compared to the given key.
50 * A database object can have its own namespace hierarchy.
51 * In the case of SE-PgSQL, database is the top level object, and schema
52 * is deployed just under a database. A schema can contains various kind
53 * of objects, such as tables, procedures and so on.
54 * Thus, when we lookup an expected security context for a table of
55 * "pg_class", it is necessary to assume selabel_lookup() is called with
56 * "postgres.pg_catalog.pg_class", not just a "pg_class".
57 *
58 * Wildcards ('*' or '?') are available on the patterns, so if you want
59 * to match a table within any schema, you should set '*' on the upper
60 * namespaces of the table.
61 *
62 * The structure of namespace depends on RDBMS.
63 * For example, Trusted-RUBIX has an idea of "catalog" which performs
64 * as a namespace between a database and individual schemas. In this
65 * case, a table has upper three layers.
66 */
67
68 /*
69 * spec_t : It holds a pair of a key and an expected security context
70 */
71 typedef struct spec {
72 struct selabel_lookup_rec lr;
73 char *key;
74 int type;
75 int matches;
76 } spec_t;
77
78 /*
79 * catalog_t : An array of spec_t
80 */
81 typedef struct catalog {
82 unsigned int nspec; /* number of specs in use */
83 unsigned int limit; /* physical limitation of specs[] */
84 spec_t specs[0];
85 } catalog_t;
86
87 /*
88 * Helper function to parse a line read from the specfile
89 */
90 static int
process_line(const char * path,char * line_buf,unsigned int line_num,catalog_t * catalog)91 process_line(const char *path, char *line_buf, unsigned int line_num,
92 catalog_t *catalog)
93 {
94 spec_t *spec = &catalog->specs[catalog->nspec];
95 char *type, *key, *context, *temp;
96 int items;
97
98 /* Cut off comments */
99 temp = strchr(line_buf, '#');
100 if (temp)
101 *temp = '\0';
102
103 /*
104 * Every entry must have the following format
105 * <object class> <object name> <security context>
106 */
107 type = key = context = temp = NULL;
108 items = sscanf(line_buf, "%ms %ms %ms %ms",
109 &type, &key, &context, &temp);
110 if (items != 3) {
111 if (items > 0)
112 selinux_log(SELINUX_WARNING,
113 "%s: line %u has invalid format, skipped",
114 path, line_num);
115 goto skip;
116 }
117
118 /*
119 * Set up individual spec entry
120 */
121 memset(spec, 0, sizeof(spec_t));
122
123 if (!strcmp(type, "db_database"))
124 spec->type = SELABEL_DB_DATABASE;
125 else if (!strcmp(type, "db_schema"))
126 spec->type = SELABEL_DB_SCHEMA;
127 else if (!strcmp(type, "db_table"))
128 spec->type = SELABEL_DB_TABLE;
129 else if (!strcmp(type, "db_column"))
130 spec->type = SELABEL_DB_COLUMN;
131 else if (!strcmp(type, "db_sequence"))
132 spec->type = SELABEL_DB_SEQUENCE;
133 else if (!strcmp(type, "db_view"))
134 spec->type = SELABEL_DB_VIEW;
135 else if (!strcmp(type, "db_procedure"))
136 spec->type = SELABEL_DB_PROCEDURE;
137 else if (!strcmp(type, "db_blob"))
138 spec->type = SELABEL_DB_BLOB;
139 else if (!strcmp(type, "db_tuple"))
140 spec->type = SELABEL_DB_TUPLE;
141 else if (!strcmp(type, "db_language"))
142 spec->type = SELABEL_DB_LANGUAGE;
143 else if (!strcmp(type, "db_exception"))
144 spec->type = SELABEL_DB_EXCEPTION;
145 else if (!strcmp(type, "db_datatype"))
146 spec->type = SELABEL_DB_DATATYPE;
147 else {
148 selinux_log(SELINUX_WARNING,
149 "%s: line %u has invalid object type %s\n",
150 path, line_num, type);
151 goto skip;
152 }
153
154 free(type);
155 spec->key = key;
156 spec->lr.ctx_raw = context;
157
158 catalog->nspec++;
159
160 return 0;
161
162 skip:
163 free(type);
164 free(key);
165 free(context);
166 free(temp);
167
168 return 0;
169 }
170
171 /*
172 * selabel_close() handler
173 */
174 static void
db_close(struct selabel_handle * rec)175 db_close(struct selabel_handle *rec)
176 {
177 catalog_t *catalog = (catalog_t *)rec->data;
178 spec_t *spec;
179 unsigned int i;
180
181 for (i = 0; i < catalog->nspec; i++) {
182 spec = &catalog->specs[i];
183 free(spec->key);
184 free(spec->lr.ctx_raw);
185 free(spec->lr.ctx_trans);
186 }
187 free(catalog);
188 }
189
190 /*
191 * selabel_lookup() handler
192 */
193 static struct selabel_lookup_rec *
db_lookup(struct selabel_handle * rec,const char * key,int type)194 db_lookup(struct selabel_handle *rec, const char *key, int type)
195 {
196 catalog_t *catalog = (catalog_t *)rec->data;
197 spec_t *spec;
198 unsigned int i;
199
200 for (i = 0; i < catalog->nspec; i++) {
201 spec = &catalog->specs[i];
202
203 if (spec->type != type)
204 continue;
205 if (!fnmatch(spec->key, key, 0)) {
206 spec->matches++;
207
208 return &spec->lr;
209 }
210 }
211
212 /* No found */
213 errno = ENOENT;
214 return NULL;
215 }
216
217 /*
218 * selabel_stats() handler
219 */
220 static void
db_stats(struct selabel_handle * rec)221 db_stats(struct selabel_handle *rec)
222 {
223 catalog_t *catalog = (catalog_t *)rec->data;
224 unsigned int i, total = 0;
225
226 for (i = 0; i < catalog->nspec; i++)
227 total += catalog->specs[i].matches;
228
229 selinux_log(SELINUX_INFO, "%u entries, %u matches made\n",
230 catalog->nspec, total);
231 }
232
233 /*
234 * selabel_open() handler
235 */
236 static catalog_t *
db_init(struct selinux_opt * opts,unsigned nopts,struct selabel_handle * rec)237 db_init(struct selinux_opt *opts, unsigned nopts, struct selabel_handle *rec)
238 {
239 catalog_t *catalog;
240 FILE *filp;
241 const char *path = NULL;
242 char *line_buf = NULL;
243 size_t line_len = 0;
244 unsigned int line_num = 0;
245 unsigned int i;
246
247 /*
248 * Initialize catalog data structure
249 */
250 catalog = malloc(sizeof(catalog_t) + 32 * sizeof(spec_t));
251 if (!catalog)
252 return NULL;
253 catalog->limit = 32;
254 catalog->nspec = 0;
255
256 /*
257 * Process arguments
258 *
259 * SELABEL_OPT_PATH:
260 * It allows to specify an alternative specification file instead of
261 * the default one. If RDBMS is not SE-PostgreSQL, it may need to
262 * specify an explicit specfile for database objects.
263 */
264 while (nopts--) {
265 switch (opts[nopts].type) {
266 case SELABEL_OPT_PATH:
267 path = opts[nopts].value;
268 break;
269 }
270 }
271
272 /*
273 * Open the specification file
274 */
275 if (!path)
276 path = selinux_sepgsql_context_path();
277
278 if ((filp = fopen(path, "rb")) == NULL) {
279 free(catalog);
280 return NULL;
281 }
282 rec->spec_file = strdup(path);
283
284 /*
285 * Parse for each lines
286 */
287 while (getline(&line_buf, &line_len, filp) > 0) {
288 /*
289 * Expand catalog array, if necessary
290 */
291 if (catalog->limit == catalog->nspec) {
292 size_t length;
293 unsigned int new_limit = 2 * catalog->limit;
294 catalog_t *new_catalog;
295
296 length = sizeof(catalog_t)
297 + new_limit * sizeof(spec_t);
298 new_catalog = realloc(catalog, length);
299 if (!new_catalog)
300 goto out_error;
301
302 catalog = new_catalog;
303 catalog->limit = new_limit;
304 }
305
306 /*
307 * Parse a line
308 */
309 if (process_line(path, line_buf, ++line_num, catalog) < 0)
310 goto out_error;
311 }
312 free(line_buf);
313
314 fclose(filp);
315
316 return catalog;
317
318 out_error:
319 for (i = 0; i < catalog->nspec; i++) {
320 spec_t *spec = &catalog->specs[i];
321
322 free(spec->key);
323 free(spec->lr.ctx_raw);
324 free(spec->lr.ctx_trans);
325 }
326 free(catalog);
327
328 return NULL;
329 }
330
331 /*
332 * Initialize selabel_handle and load the entries of specfile
333 */
selabel_db_init(struct selabel_handle * rec,struct selinux_opt * opts,unsigned nopts)334 int selabel_db_init(struct selabel_handle *rec,
335 struct selinux_opt *opts, unsigned nopts)
336 {
337 rec->func_close = &db_close;
338 rec->func_lookup = &db_lookup;
339 rec->func_stats = &db_stats;
340 rec->data = db_init(opts, nopts, rec);
341
342 return !rec->data ? -1 : 0;
343 }
344