1 /* Copyright (C) 2005 Red Hat, Inc. */
2
3 #include <stdlib.h>
4 #include "policy.h"
5 #include "handle.h"
6 #include "database.h"
7 #include "modules.h"
8 #include "debug.h"
9
10 /* Powers of two only */
11 #define MODE_SET 1
12 #define MODE_MODIFY 2
13 #define MODE_SORT 4
14
clear_obsolete(semanage_handle_t * handle,record_t ** records,unsigned int nrecords,dbase_config_t * src,dbase_config_t * dst)15 static int clear_obsolete(semanage_handle_t * handle,
16 record_t ** records,
17 unsigned int nrecords,
18 dbase_config_t * src, dbase_config_t * dst)
19 {
20
21 record_key_t *key = NULL;
22 unsigned int i;
23
24 dbase_table_t *src_dtable = src->dtable;
25 dbase_table_t *dst_dtable = dst->dtable;
26 record_table_t *rtable = src_dtable->get_rtable(src->dbase);
27
28 for (i = 0; i < nrecords; i++) {
29 int exists;
30
31 if (rtable->key_extract(handle, records[i], &key) < 0)
32 goto err;
33
34 if (dst_dtable->exists(handle, dst->dbase, key, &exists) < 0)
35 goto err;
36
37 if (!exists) {
38 if (src_dtable->del(handle, src->dbase, key) < 0)
39 goto err;
40
41 rtable->free(records[i]);
42 records[i] = NULL;
43
44 /* FIXME: notice to user */
45 /* INFO(handle, "boolean %s is obsolete, unsetting configured value..."); */
46 }
47
48 rtable->key_free(key);
49 }
50
51 return STATUS_SUCCESS;
52
53 err:
54 /* FIXME: handle error */
55 rtable->key_free(key);
56 return STATUS_ERR;
57 }
58
load_records(semanage_handle_t * handle,dbase_config_t * dst,record_t ** records,unsigned int nrecords,int mode)59 static int load_records(semanage_handle_t * handle,
60 dbase_config_t * dst,
61 record_t ** records, unsigned int nrecords, int mode)
62 {
63
64 unsigned int i;
65 record_key_t *rkey = NULL;
66
67 dbase_t *dbase = dst->dbase;
68 dbase_table_t *dtable = dst->dtable;
69 record_table_t *rtable = dtable->get_rtable(dbase);
70
71 for (i = 0; i < nrecords; i++) {
72
73 /* Possibly obsoleted */
74 if (!records[i])
75 continue;
76
77 if (rtable->key_extract(handle, records[i], &rkey) < 0)
78 goto err;
79
80 if (mode & MODE_SET &&
81 dtable->set(handle, dbase, rkey, records[i]) < 0)
82 goto err;
83
84 else if (mode & MODE_MODIFY &&
85 dtable->modify(handle, dbase, rkey, records[i]) < 0)
86 goto err;
87
88 rtable->key_free(rkey);
89 }
90
91 return STATUS_SUCCESS;
92
93 err:
94 /* FIXME: handle error */
95 rtable->key_free(rkey);
96 return STATUS_ERR;
97 }
98
99 typedef struct load_table {
100 dbase_config_t *src;
101 dbase_config_t *dst;
102 int mode;
103 } load_table_t;
104
105 /* This function must be called AFTER all modules are loaded.
106 * Modules could be represented as a database, in which case
107 * they should be loaded at the beginning of this function */
108
semanage_base_merge_components(semanage_handle_t * handle)109 int semanage_base_merge_components(semanage_handle_t * handle)
110 {
111
112 unsigned int i, j;
113 int rc = STATUS_SUCCESS;
114
115 /* Order is important here - change things carefully.
116 * System components first, local next. Verify runs with
117 * mutual dependencies are ran after everything is merged */
118 load_table_t components[] = {
119
120 {semanage_user_base_dbase_local(handle),
121 semanage_user_base_dbase_policy(handle), MODE_MODIFY},
122
123 {semanage_user_extra_dbase_local(handle),
124 semanage_user_extra_dbase_policy(handle), MODE_MODIFY},
125
126 {semanage_port_dbase_local(handle),
127 semanage_port_dbase_policy(handle), MODE_MODIFY},
128
129 {semanage_iface_dbase_local(handle),
130 semanage_iface_dbase_policy(handle), MODE_MODIFY},
131
132 {semanage_bool_dbase_local(handle),
133 semanage_bool_dbase_policy(handle), MODE_SET},
134
135 {semanage_seuser_dbase_local(handle),
136 semanage_seuser_dbase_policy(handle), MODE_MODIFY},
137
138 {semanage_node_dbase_local(handle),
139 semanage_node_dbase_policy(handle), MODE_MODIFY | MODE_SORT},
140 };
141 const unsigned int CCOUNT = sizeof(components) / sizeof(components[0]);
142
143 /* Merge components into policy (and validate) */
144 for (i = 0; i < CCOUNT; i++) {
145
146 record_t **records = NULL;
147 unsigned int nrecords = 0;
148
149 dbase_config_t *src = components[i].src;
150 dbase_config_t *dst = components[i].dst;
151 int mode = components[i].mode;
152 record_table_t *rtable = src->dtable->get_rtable(src->dbase);
153
154 /* Must invoke cache function first */
155 if (src->dtable->cache(handle, src->dbase) < 0)
156 goto err;
157 if (dst->dtable->cache(handle, dst->dbase) < 0)
158 goto err;
159
160 /* List all records */
161 if (src->dtable->list(handle, src->dbase,
162 &records, &nrecords) < 0)
163 goto err;
164
165 /* Sort records on MODE_SORT */
166 if (mode & MODE_SORT) {
167 qsort(records, nrecords, sizeof(record_t *),
168 (int (*)(const void *, const void *))rtable->
169 compare2_qsort);
170 }
171
172 /* Clear obsolete ones for MODE_SET */
173 if (mode & MODE_SET &&
174 clear_obsolete(handle, records, nrecords, src, dst) < 0) {
175 rc = STATUS_ERR;
176 goto dbase_exit;
177 }
178
179 /* Load records */
180 if (load_records(handle, dst, records, nrecords, mode) < 0) {
181
182 rc = STATUS_ERR;
183 goto dbase_exit;
184 }
185
186 /* Cleanup */
187 dbase_exit:
188 for (j = 0; j < nrecords; j++)
189 rtable->free(records[j]);
190 free(records);
191
192 /* Abort on error */
193 if (rc < 0)
194 goto err;
195 }
196
197 return rc;
198
199 err:
200 ERR(handle, "could not merge local modifications into policy");
201 return STATUS_ERR;
202 }
203
semanage_commit_components(semanage_handle_t * handle)204 int semanage_commit_components(semanage_handle_t * handle)
205 {
206
207 int i;
208 dbase_config_t *components[] = {
209 semanage_iface_dbase_local(handle),
210 semanage_bool_dbase_local(handle),
211 semanage_user_base_dbase_local(handle),
212 semanage_user_extra_dbase_local(handle),
213 semanage_user_extra_dbase_policy(handle),
214 semanage_port_dbase_local(handle),
215 semanage_fcontext_dbase_local(handle),
216 semanage_fcontext_dbase_policy(handle),
217 semanage_seuser_dbase_local(handle),
218 semanage_seuser_dbase_policy(handle),
219 semanage_bool_dbase_active(handle),
220 semanage_node_dbase_local(handle),
221 };
222 const int CCOUNT = sizeof(components) / sizeof(components[0]);
223
224 for (i = 0; i < CCOUNT; i++) {
225 /* Flush to disk */
226 if (components[i]->dtable->flush(handle, components[i]->dbase) <
227 0)
228 goto err;
229 }
230
231 return STATUS_SUCCESS;
232
233 err:
234 ERR(handle, "could not commit local/active modifications");
235
236 for (i = 0; i < CCOUNT; i++)
237 components[i]->dtable->drop_cache(components[i]->dbase);
238 return STATUS_ERR;
239 }
240