1
2 /*
3 * Author : Stephen Smalley, <sds@epoch.ncsc.mil>
4 */
5 /*
6 * Updated: Trusted Computer Solutions, Inc. <dgoeddel@trustedcs.com>
7 *
8 * Support for enhanced MLS infrastructure.
9 *
10 * Updated: Frank Mayer <mayerf@tresys.com>
11 * and Karl MacMillan <kmacmillan@tresys.com>
12 *
13 * Added conditional policy language extensions
14 *
15 * Updated: Red Hat, Inc. James Morris <jmorris@redhat.com>
16 *
17 * Fine-grained netlink support
18 * IPv6 support
19 * Code cleanup
20 *
21 * Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
22 * Copyright (C) 2003 - 2004 Tresys Technology, LLC
23 * Copyright (C) 2003 - 2004 Red Hat, Inc.
24 *
25 * This library is free software; you can redistribute it and/or
26 * modify it under the terms of the GNU Lesser General Public
27 * License as published by the Free Software Foundation; either
28 * version 2.1 of the License, or (at your option) any later version.
29 *
30 * This library is distributed in the hope that it will be useful,
31 * but WITHOUT ANY WARRANTY; without even the implied warranty of
32 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
33 * Lesser General Public License for more details.
34 *
35 * You should have received a copy of the GNU Lesser General Public
36 * License along with this library; if not, write to the Free Software
37 * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA
38 */
39
40 /* FLASK */
41
42 /*
43 * Implementation of the security services.
44 */
45
46 /* Initial sizes malloc'd for sepol_compute_av_reason_buffer() support */
47 #define REASON_BUF_SIZE 2048
48 #define EXPR_BUF_SIZE 1024
49 #define STACK_LEN 32
50
51 #include <stdlib.h>
52 #include <sys/types.h>
53 #include <sys/socket.h>
54 #include <netinet/in.h>
55 #include <arpa/inet.h>
56
57 #include <sepol/policydb/policydb.h>
58 #include <sepol/policydb/sidtab.h>
59 #include <sepol/policydb/services.h>
60 #include <sepol/policydb/conditional.h>
61 #include <sepol/policydb/flask.h>
62 #include <sepol/policydb/util.h>
63
64 #include "debug.h"
65 #include "private.h"
66 #include "context.h"
67 #include "av_permissions.h"
68 #include "dso.h"
69 #include "mls.h"
70
71 #define BUG() do { ERR(NULL, "Badness at %s:%d", __FILE__, __LINE__); } while (0)
72 #define BUG_ON(x) do { if (x) ERR(NULL, "Badness at %s:%d", __FILE__, __LINE__); } while (0)
73
74 static int selinux_enforcing = 1;
75
76 static sidtab_t mysidtab, *sidtab = &mysidtab;
77 static policydb_t mypolicydb, *policydb = &mypolicydb;
78
79 /* Used by sepol_compute_av_reason_buffer() to keep track of entries */
80 static int reason_buf_used;
81 static int reason_buf_len;
82
83 /* Stack services for RPN to infix conversion. */
84 static char **stack;
85 static int stack_len;
86 static int next_stack_entry;
87
push(char * expr_ptr)88 static void push(char *expr_ptr)
89 {
90 if (next_stack_entry >= stack_len) {
91 char **new_stack = stack;
92 int new_stack_len;
93
94 if (stack_len == 0)
95 new_stack_len = STACK_LEN;
96 else
97 new_stack_len = stack_len * 2;
98
99 new_stack = realloc(stack, new_stack_len * sizeof(*stack));
100 if (!new_stack) {
101 ERR(NULL, "unable to allocate stack space");
102 return;
103 }
104 stack_len = new_stack_len;
105 stack = new_stack;
106 }
107 stack[next_stack_entry] = expr_ptr;
108 next_stack_entry++;
109 }
110
pop(void)111 static char *pop(void)
112 {
113 next_stack_entry--;
114 if (next_stack_entry < 0) {
115 next_stack_entry = 0;
116 ERR(NULL, "pop called with no stack entries");
117 return NULL;
118 }
119 return stack[next_stack_entry];
120 }
121 /* End Stack services */
122
sepol_set_sidtab(sidtab_t * s)123 int hidden sepol_set_sidtab(sidtab_t * s)
124 {
125 sidtab = s;
126 return 0;
127 }
128
sepol_set_policydb(policydb_t * p)129 int hidden sepol_set_policydb(policydb_t * p)
130 {
131 policydb = p;
132 return 0;
133 }
134
sepol_set_policydb_from_file(FILE * fp)135 int sepol_set_policydb_from_file(FILE * fp)
136 {
137 struct policy_file pf;
138
139 policy_file_init(&pf);
140 pf.fp = fp;
141 pf.type = PF_USE_STDIO;
142 if (mypolicydb.policy_type)
143 policydb_destroy(&mypolicydb);
144 if (policydb_init(&mypolicydb)) {
145 ERR(NULL, "Out of memory!");
146 return -1;
147 }
148 if (policydb_read(&mypolicydb, &pf, 0)) {
149 policydb_destroy(&mypolicydb);
150 ERR(NULL, "can't read binary policy: %s", strerror(errno));
151 return -1;
152 }
153 policydb = &mypolicydb;
154 return sepol_sidtab_init(sidtab);
155 }
156
157 /*
158 * The largest sequence number that has been used when
159 * providing an access decision to the access vector cache.
160 * The sequence number only changes when a policy change
161 * occurs.
162 */
163 static uint32_t latest_granting = 0;
164
165 /*
166 * cat_expr_buf adds a string to an expression buffer and handles
167 * realloc's if buffer is too small. The array of expression text
168 * buffer pointers and its counter are globally defined here as
169 * constraint_expr_eval_reason() sets them up and cat_expr_buf
170 * updates the e_buf pointer.
171 */
172 static int expr_counter;
173 static char **expr_list;
174 static int expr_buf_used;
175 static int expr_buf_len;
176
cat_expr_buf(char * e_buf,const char * string)177 static void cat_expr_buf(char *e_buf, const char *string)
178 {
179 int len, new_buf_len;
180 char *p, *new_buf = e_buf;
181
182 while (1) {
183 p = e_buf + expr_buf_used;
184 len = snprintf(p, expr_buf_len - expr_buf_used, "%s", string);
185 if (len < 0 || len >= expr_buf_len - expr_buf_used) {
186 new_buf_len = expr_buf_len + EXPR_BUF_SIZE;
187 new_buf = realloc(e_buf, new_buf_len);
188 if (!new_buf) {
189 ERR(NULL, "failed to realloc expr buffer");
190 return;
191 }
192 /* Update new ptr in expr list and locally + new len */
193 expr_list[expr_counter] = new_buf;
194 e_buf = new_buf;
195 expr_buf_len = new_buf_len;
196 } else {
197 expr_buf_used += len;
198 return;
199 }
200 }
201 }
202
203 /*
204 * If the POLICY_KERN version is >= POLICYDB_VERSION_CONSTRAINT_NAMES,
205 * then for 'types' only, read the types_names->types list as it will
206 * contain a list of types and attributes that were defined in the
207 * policy source.
208 * For user and role plus types (for policy vers <
209 * POLICYDB_VERSION_CONSTRAINT_NAMES) just read the e->names list.
210 */
get_name_list(constraint_expr_t * e,int type,const char * src,const char * op,int failed)211 static void get_name_list(constraint_expr_t *e, int type,
212 const char *src, const char *op, int failed)
213 {
214 ebitmap_t *types;
215 int rc = 0;
216 unsigned int i;
217 char tmp_buf[128];
218 int counter = 0;
219
220 if (policydb->policy_type == POLICY_KERN &&
221 policydb->policyvers >= POLICYDB_VERSION_CONSTRAINT_NAMES &&
222 type == CEXPR_TYPE)
223 types = &e->type_names->types;
224 else
225 types = &e->names;
226
227 /* Find out how many entries */
228 for (i = ebitmap_startbit(types); i < ebitmap_length(types); i++) {
229 rc = ebitmap_get_bit(types, i);
230 if (rc == 0)
231 continue;
232 else
233 counter++;
234 }
235 snprintf(tmp_buf, sizeof(tmp_buf), "(%s%s", src, op);
236 cat_expr_buf(expr_list[expr_counter], tmp_buf);
237
238 if (counter == 0)
239 cat_expr_buf(expr_list[expr_counter], "<empty_set> ");
240 if (counter > 1)
241 cat_expr_buf(expr_list[expr_counter], " {");
242 if (counter >= 1) {
243 for (i = ebitmap_startbit(types); i < ebitmap_length(types); i++) {
244 rc = ebitmap_get_bit(types, i);
245 if (rc == 0)
246 continue;
247
248 /* Collect entries */
249 switch (type) {
250 case CEXPR_USER:
251 snprintf(tmp_buf, sizeof(tmp_buf), " %s",
252 policydb->p_user_val_to_name[i]);
253 break;
254 case CEXPR_ROLE:
255 snprintf(tmp_buf, sizeof(tmp_buf), " %s",
256 policydb->p_role_val_to_name[i]);
257 break;
258 case CEXPR_TYPE:
259 snprintf(tmp_buf, sizeof(tmp_buf), " %s",
260 policydb->p_type_val_to_name[i]);
261 break;
262 }
263 cat_expr_buf(expr_list[expr_counter], tmp_buf);
264 }
265 }
266 if (counter > 1)
267 cat_expr_buf(expr_list[expr_counter], " }");
268 if (failed)
269 cat_expr_buf(expr_list[expr_counter], " -Fail-) ");
270 else
271 cat_expr_buf(expr_list[expr_counter], ") ");
272
273 return;
274 }
275
msgcat(const char * src,const char * tgt,const char * op,int failed)276 static void msgcat(const char *src, const char *tgt, const char *op, int failed)
277 {
278 char tmp_buf[128];
279 if (failed)
280 snprintf(tmp_buf, sizeof(tmp_buf), "(%s %s %s -Fail-) ",
281 src, op, tgt);
282 else
283 snprintf(tmp_buf, sizeof(tmp_buf), "(%s %s %s) ",
284 src, op, tgt);
285 cat_expr_buf(expr_list[expr_counter], tmp_buf);
286 }
287
288 /* Returns a buffer with class, statement type and permissions */
get_class_info(sepol_security_class_t tclass,constraint_node_t * constraint,context_struct_t * xcontext)289 static char *get_class_info(sepol_security_class_t tclass,
290 constraint_node_t *constraint,
291 context_struct_t *xcontext)
292 {
293 constraint_expr_t *e;
294 int mls, state_num;
295
296 /* Find if MLS statement or not */
297 mls = 0;
298 for (e = constraint->expr; e; e = e->next) {
299 if (e->attr >= CEXPR_L1L2) {
300 mls = 1;
301 break;
302 }
303 }
304
305 /* Determine statement type */
306 const char *statements[] = {
307 "constrain ", /* 0 */
308 "mlsconstrain ", /* 1 */
309 "validatetrans ", /* 2 */
310 "mlsvalidatetrans ", /* 3 */
311 0 };
312
313 if (xcontext == NULL)
314 state_num = mls + 0;
315 else
316 state_num = mls + 2;
317
318 int class_buf_len = 0;
319 int new_class_buf_len;
320 int len, buf_used;
321 char *class_buf = NULL, *p;
322 char *new_class_buf = NULL;
323
324 while (1) {
325 new_class_buf_len = class_buf_len + EXPR_BUF_SIZE;
326 new_class_buf = realloc(class_buf, new_class_buf_len);
327 if (!new_class_buf)
328 return NULL;
329 class_buf_len = new_class_buf_len;
330 class_buf = new_class_buf;
331 buf_used = 0;
332 p = class_buf;
333
334 /* Add statement type */
335 len = snprintf(p, class_buf_len - buf_used, "%s", statements[state_num]);
336 if (len < 0 || len >= class_buf_len - buf_used)
337 continue;
338
339 /* Add class entry */
340 p += len;
341 buf_used += len;
342 len = snprintf(p, class_buf_len - buf_used, "%s ",
343 policydb->p_class_val_to_name[tclass - 1]);
344 if (len < 0 || len >= class_buf_len - buf_used)
345 continue;
346
347 /* Add permission entries (validatetrans does not have perms) */
348 p += len;
349 buf_used += len;
350 if (state_num < 2) {
351 len = snprintf(p, class_buf_len - buf_used, "{%s } (",
352 sepol_av_to_string(policydb, tclass,
353 constraint->permissions));
354 } else {
355 len = snprintf(p, class_buf_len - buf_used, "(");
356 }
357 if (len < 0 || len >= class_buf_len - buf_used)
358 continue;
359 break;
360 }
361 return class_buf;
362 }
363
364 /*
365 * Modified version of constraint_expr_eval that will process each
366 * constraint as before but adds the information to text buffers that
367 * will hold various components. The expression will be in RPN format,
368 * therefore there is a stack based RPN to infix converter to produce
369 * the final readable constraint.
370 *
371 * Return the boolean value of a constraint expression
372 * when it is applied to the specified source and target
373 * security contexts.
374 *
375 * xcontext is a special beast... It is used by the validatetrans rules
376 * only. For these rules, scontext is the context before the transition,
377 * tcontext is the context after the transition, and xcontext is the
378 * context of the process performing the transition. All other callers
379 * of constraint_expr_eval_reason should pass in NULL for xcontext.
380 *
381 * This function will also build a buffer as the constraint is processed
382 * for analysis. If this option is not required, then:
383 * 'tclass' should be '0' and r_buf MUST be NULL.
384 */
constraint_expr_eval_reason(context_struct_t * scontext,context_struct_t * tcontext,context_struct_t * xcontext,sepol_security_class_t tclass,constraint_node_t * constraint,char ** r_buf,unsigned int flags)385 static int constraint_expr_eval_reason(context_struct_t *scontext,
386 context_struct_t *tcontext,
387 context_struct_t *xcontext,
388 sepol_security_class_t tclass,
389 constraint_node_t *constraint,
390 char **r_buf,
391 unsigned int flags)
392 {
393 uint32_t val1, val2;
394 context_struct_t *c;
395 role_datum_t *r1, *r2;
396 mls_level_t *l1, *l2;
397 constraint_expr_t *e;
398 int s[CEXPR_MAXDEPTH];
399 int sp = -1;
400 char tmp_buf[128];
401
402 /*
403 * Define the s_t_x_num values that make up r1, t2 etc. in text strings
404 * Set 1 = source, 2 = target, 3 = xcontext for validatetrans
405 */
406 #define SOURCE 1
407 #define TARGET 2
408 #define XTARGET 3
409
410 int s_t_x_num = SOURCE;
411
412 /* Set 0 = fail, u = CEXPR_USER, r = CEXPR_ROLE, t = CEXPR_TYPE */
413 int u_r_t = 0;
414
415 char *src = NULL;
416 char *tgt = NULL;
417 int rc = 0, x;
418 char *class_buf = NULL;
419
420 /*
421 * The array of expression answer buffer pointers and counter.
422 */
423 char **answer_list = NULL;
424 int answer_counter = 0;
425
426 class_buf = get_class_info(tclass, constraint, xcontext);
427 if (!class_buf) {
428 ERR(NULL, "failed to allocate class buffer");
429 return -ENOMEM;
430 }
431
432 /* Original function but with buffer support */
433 int expr_list_len = 0;
434 expr_counter = 0;
435 expr_list = NULL;
436 for (e = constraint->expr; e; e = e->next) {
437 /* Allocate a stack to hold expression buffer entries */
438 if (expr_counter >= expr_list_len) {
439 char **new_expr_list = expr_list;
440 int new_expr_list_len;
441
442 if (expr_list_len == 0)
443 new_expr_list_len = STACK_LEN;
444 else
445 new_expr_list_len = expr_list_len * 2;
446
447 new_expr_list = realloc(expr_list,
448 new_expr_list_len * sizeof(*expr_list));
449 if (!new_expr_list) {
450 ERR(NULL, "failed to allocate expr buffer stack");
451 rc = -ENOMEM;
452 goto out;
453 }
454 expr_list_len = new_expr_list_len;
455 expr_list = new_expr_list;
456 }
457
458 /*
459 * malloc a buffer to store each expression text component. If
460 * buffer is too small cat_expr_buf() will realloc extra space.
461 */
462 expr_buf_len = EXPR_BUF_SIZE;
463 expr_list[expr_counter] = malloc(expr_buf_len);
464 if (!expr_list[expr_counter]) {
465 ERR(NULL, "failed to allocate expr buffer");
466 rc = -ENOMEM;
467 goto out;
468 }
469 expr_buf_used = 0;
470
471 /* Now process each expression of the constraint */
472 switch (e->expr_type) {
473 case CEXPR_NOT:
474 BUG_ON(sp < 0);
475 s[sp] = !s[sp];
476 cat_expr_buf(expr_list[expr_counter], "not");
477 break;
478 case CEXPR_AND:
479 BUG_ON(sp < 1);
480 sp--;
481 s[sp] &= s[sp + 1];
482 cat_expr_buf(expr_list[expr_counter], "and");
483 break;
484 case CEXPR_OR:
485 BUG_ON(sp < 1);
486 sp--;
487 s[sp] |= s[sp + 1];
488 cat_expr_buf(expr_list[expr_counter], "or");
489 break;
490 case CEXPR_ATTR:
491 if (sp == (CEXPR_MAXDEPTH - 1))
492 goto out;
493
494 switch (e->attr) {
495 case CEXPR_USER:
496 val1 = scontext->user;
497 val2 = tcontext->user;
498 free(src); src = strdup("u1");
499 free(tgt); tgt = strdup("u2");
500 break;
501 case CEXPR_TYPE:
502 val1 = scontext->type;
503 val2 = tcontext->type;
504 free(src); src = strdup("t1");
505 free(tgt); tgt = strdup("t2");
506 break;
507 case CEXPR_ROLE:
508 val1 = scontext->role;
509 val2 = tcontext->role;
510 r1 = policydb->role_val_to_struct[val1 - 1];
511 r2 = policydb->role_val_to_struct[val2 - 1];
512 free(src); src = strdup("r1");
513 free(tgt); tgt = strdup("r2");
514
515 switch (e->op) {
516 case CEXPR_DOM:
517 s[++sp] = ebitmap_get_bit(&r1->dominates, val2 - 1);
518 msgcat(src, tgt, "dom", s[sp] == 0);
519 expr_counter++;
520 continue;
521 case CEXPR_DOMBY:
522 s[++sp] = ebitmap_get_bit(&r2->dominates, val1 - 1);
523 msgcat(src, tgt, "domby", s[sp] == 0);
524 expr_counter++;
525 continue;
526 case CEXPR_INCOMP:
527 s[++sp] = (!ebitmap_get_bit(&r1->dominates, val2 - 1)
528 && !ebitmap_get_bit(&r2->dominates, val1 - 1));
529 msgcat(src, tgt, "incomp", s[sp] == 0);
530 expr_counter++;
531 continue;
532 default:
533 break;
534 }
535 break;
536 case CEXPR_L1L2:
537 l1 = &(scontext->range.level[0]);
538 l2 = &(tcontext->range.level[0]);
539 free(src); src = strdup("l1");
540 free(tgt); tgt = strdup("l2");
541 goto mls_ops;
542 case CEXPR_L1H2:
543 l1 = &(scontext->range.level[0]);
544 l2 = &(tcontext->range.level[1]);
545 free(src); src = strdup("l1");
546 free(tgt); tgt = strdup("h2");
547 goto mls_ops;
548 case CEXPR_H1L2:
549 l1 = &(scontext->range.level[1]);
550 l2 = &(tcontext->range.level[0]);
551 free(src); src = strdup("h1");
552 free(tgt); tgt = strdup("l2");
553 goto mls_ops;
554 case CEXPR_H1H2:
555 l1 = &(scontext->range.level[1]);
556 l2 = &(tcontext->range.level[1]);
557 free(src); src = strdup("h1");
558 free(tgt); tgt = strdup("h2");
559 goto mls_ops;
560 case CEXPR_L1H1:
561 l1 = &(scontext->range.level[0]);
562 l2 = &(scontext->range.level[1]);
563 free(src); src = strdup("l1");
564 free(tgt); tgt = strdup("h1");
565 goto mls_ops;
566 case CEXPR_L2H2:
567 l1 = &(tcontext->range.level[0]);
568 l2 = &(tcontext->range.level[1]);
569 free(src); src = strdup("l2");
570 free(tgt); tgt = strdup("h2");
571 mls_ops:
572 switch (e->op) {
573 case CEXPR_EQ:
574 s[++sp] = mls_level_eq(l1, l2);
575 msgcat(src, tgt, "eq", s[sp] == 0);
576 expr_counter++;
577 continue;
578 case CEXPR_NEQ:
579 s[++sp] = !mls_level_eq(l1, l2);
580 msgcat(src, tgt, "!=", s[sp] == 0);
581 expr_counter++;
582 continue;
583 case CEXPR_DOM:
584 s[++sp] = mls_level_dom(l1, l2);
585 msgcat(src, tgt, "dom", s[sp] == 0);
586 expr_counter++;
587 continue;
588 case CEXPR_DOMBY:
589 s[++sp] = mls_level_dom(l2, l1);
590 msgcat(src, tgt, "domby", s[sp] == 0);
591 expr_counter++;
592 continue;
593 case CEXPR_INCOMP:
594 s[++sp] = mls_level_incomp(l2, l1);
595 msgcat(src, tgt, "incomp", s[sp] == 0);
596 expr_counter++;
597 continue;
598 default:
599 BUG();
600 goto out;
601 }
602 break;
603 default:
604 BUG();
605 goto out;
606 }
607
608 switch (e->op) {
609 case CEXPR_EQ:
610 s[++sp] = (val1 == val2);
611 msgcat(src, tgt, "==", s[sp] == 0);
612 break;
613 case CEXPR_NEQ:
614 s[++sp] = (val1 != val2);
615 msgcat(src, tgt, "!=", s[sp] == 0);
616 break;
617 default:
618 BUG();
619 goto out;
620 }
621 break;
622 case CEXPR_NAMES:
623 if (sp == (CEXPR_MAXDEPTH - 1))
624 goto out;
625 s_t_x_num = SOURCE;
626 c = scontext;
627 if (e->attr & CEXPR_TARGET) {
628 s_t_x_num = TARGET;
629 c = tcontext;
630 } else if (e->attr & CEXPR_XTARGET) {
631 s_t_x_num = XTARGET;
632 c = xcontext;
633 }
634 if (!c) {
635 BUG();
636 goto out;
637 }
638 if (e->attr & CEXPR_USER) {
639 u_r_t = CEXPR_USER;
640 val1 = c->user;
641 snprintf(tmp_buf, sizeof(tmp_buf), "u%d ", s_t_x_num);
642 free(src); src = strdup(tmp_buf);
643 } else if (e->attr & CEXPR_ROLE) {
644 u_r_t = CEXPR_ROLE;
645 val1 = c->role;
646 snprintf(tmp_buf, sizeof(tmp_buf), "r%d ", s_t_x_num);
647 free(src); src = strdup(tmp_buf);
648 } else if (e->attr & CEXPR_TYPE) {
649 u_r_t = CEXPR_TYPE;
650 val1 = c->type;
651 snprintf(tmp_buf, sizeof(tmp_buf), "t%d ", s_t_x_num);
652 free(src); src = strdup(tmp_buf);
653 } else {
654 BUG();
655 goto out;
656 }
657
658 switch (e->op) {
659 case CEXPR_EQ:
660 s[++sp] = ebitmap_get_bit(&e->names, val1 - 1);
661 get_name_list(e, u_r_t, src, "==", s[sp] == 0);
662 break;
663
664 case CEXPR_NEQ:
665 s[++sp] = !ebitmap_get_bit(&e->names, val1 - 1);
666 get_name_list(e, u_r_t, src, "!=", s[sp] == 0);
667 break;
668 default:
669 BUG();
670 goto out;
671 }
672 break;
673 default:
674 BUG();
675 goto out;
676 }
677 expr_counter++;
678 }
679
680 /*
681 * At this point each expression of the constraint is in
682 * expr_list[n+1] and in RPN format. Now convert to 'infix'
683 */
684
685 /*
686 * Save expr count but zero expr_counter to detect if
687 * 'BUG(); goto out;' was called as we need to release any used
688 * expr_list malloc's. Normally they are released by the RPN to
689 * infix code.
690 */
691 int expr_count = expr_counter;
692 expr_counter = 0;
693
694 /*
695 * Generate the same number of answer buffer entries as expression
696 * buffers (as there will never be more).
697 */
698 answer_list = malloc(expr_count * sizeof(*answer_list));
699 if (!answer_list) {
700 ERR(NULL, "failed to allocate answer stack");
701 rc = -ENOMEM;
702 goto out;
703 }
704
705 /* The pop operands */
706 char *a;
707 char *b;
708 int a_len, b_len;
709
710 /* Convert constraint from RPN to infix notation. */
711 for (x = 0; x != expr_count; x++) {
712 if (strncmp(expr_list[x], "and", 3) == 0 || strncmp(expr_list[x],
713 "or", 2) == 0) {
714 b = pop();
715 b_len = strlen(b);
716 a = pop();
717 a_len = strlen(a);
718
719 /* get a buffer to hold the answer */
720 answer_list[answer_counter] = malloc(a_len + b_len + 8);
721 if (!answer_list[answer_counter]) {
722 ERR(NULL, "failed to allocate answer buffer");
723 rc = -ENOMEM;
724 goto out;
725 }
726 memset(answer_list[answer_counter], '\0', a_len + b_len + 8);
727
728 sprintf(answer_list[answer_counter], "%s %s %s", a,
729 expr_list[x], b);
730 push(answer_list[answer_counter++]);
731 free(a);
732 free(b);
733 free(expr_list[x]);
734 } else if (strncmp(expr_list[x], "not", 3) == 0) {
735 b = pop();
736 b_len = strlen(b);
737
738 answer_list[answer_counter] = malloc(b_len + 8);
739 if (!answer_list[answer_counter]) {
740 ERR(NULL, "failed to allocate answer buffer");
741 rc = -ENOMEM;
742 goto out;
743 }
744 memset(answer_list[answer_counter], '\0', b_len + 8);
745
746 if (strncmp(b, "not", 3) == 0)
747 sprintf(answer_list[answer_counter], "%s (%s)",
748 expr_list[x], b);
749 else
750 sprintf(answer_list[answer_counter], "%s%s",
751 expr_list[x], b);
752 push(answer_list[answer_counter++]);
753 free(b);
754 free(expr_list[x]);
755 } else {
756 push(expr_list[x]);
757 }
758 }
759 /* Get the final answer from tos and build constraint text */
760 a = pop();
761
762 /* validatetrans / constraint calculation:
763 rc = 0 is denied, rc = 1 is granted */
764 sprintf(tmp_buf, "%s %s\n",
765 xcontext ? "Validatetrans" : "Constraint",
766 s[0] ? "GRANTED" : "DENIED");
767
768 int len, new_buf_len;
769 char *p, **new_buf = r_buf;
770 /*
771 * These contain the constraint components that are added to the
772 * callers reason buffer.
773 */
774 const char *buffers[] = { class_buf, a, "); ", tmp_buf, 0 };
775
776 /*
777 * This will add the constraints to the callers reason buffer (who is
778 * responsible for freeing the memory). It will handle any realloc's
779 * should the buffer be too short.
780 * The reason_buf_used and reason_buf_len counters are defined
781 * globally as multiple constraints can be in the buffer.
782 */
783
784 if (r_buf && ((s[0] == 0) || ((s[0] == 1 &&
785 (flags & SHOW_GRANTED) == SHOW_GRANTED)))) {
786 for (x = 0; buffers[x] != NULL; x++) {
787 while (1) {
788 p = *r_buf + reason_buf_used;
789 len = snprintf(p, reason_buf_len - reason_buf_used,
790 "%s", buffers[x]);
791 if (len < 0 || len >= reason_buf_len - reason_buf_used) {
792 new_buf_len = reason_buf_len + REASON_BUF_SIZE;
793 *new_buf = realloc(*r_buf, new_buf_len);
794 if (!new_buf) {
795 ERR(NULL, "failed to realloc reason buffer");
796 goto out1;
797 }
798 **r_buf = **new_buf;
799 reason_buf_len = new_buf_len;
800 continue;
801 } else {
802 reason_buf_used += len;
803 break;
804 }
805 }
806 }
807 }
808
809 out1:
810 rc = s[0];
811 free(a);
812
813 out:
814 free(class_buf);
815 free(src);
816 free(tgt);
817
818 if (expr_counter) {
819 for (x = 0; expr_list[x] != NULL; x++)
820 free(expr_list[x]);
821 }
822 free(answer_list);
823 free(expr_list);
824 return rc;
825 }
826
827 /* Forward declaration */
828 static int context_struct_compute_av(context_struct_t * scontext,
829 context_struct_t * tcontext,
830 sepol_security_class_t tclass,
831 sepol_access_vector_t requested,
832 struct sepol_av_decision *avd,
833 unsigned int *reason,
834 char **r_buf,
835 unsigned int flags);
836
type_attribute_bounds_av(context_struct_t * scontext,context_struct_t * tcontext,sepol_security_class_t tclass,sepol_access_vector_t requested,struct sepol_av_decision * avd,unsigned int * reason)837 static void type_attribute_bounds_av(context_struct_t *scontext,
838 context_struct_t *tcontext,
839 sepol_security_class_t tclass,
840 sepol_access_vector_t requested,
841 struct sepol_av_decision *avd,
842 unsigned int *reason)
843 {
844 context_struct_t lo_scontext;
845 context_struct_t lo_tcontext, *tcontextp = tcontext;
846 struct sepol_av_decision lo_avd;
847 type_datum_t *source;
848 type_datum_t *target;
849 sepol_access_vector_t masked = 0;
850
851 source = policydb->type_val_to_struct[scontext->type - 1];
852 if (!source->bounds)
853 return;
854
855 target = policydb->type_val_to_struct[tcontext->type - 1];
856
857 memset(&lo_avd, 0, sizeof(lo_avd));
858
859 memcpy(&lo_scontext, scontext, sizeof(lo_scontext));
860 lo_scontext.type = source->bounds;
861
862 if (target->bounds) {
863 memcpy(&lo_tcontext, tcontext, sizeof(lo_tcontext));
864 lo_tcontext.type = target->bounds;
865 tcontextp = &lo_tcontext;
866 }
867
868 context_struct_compute_av(&lo_scontext,
869 tcontextp,
870 tclass,
871 requested,
872 &lo_avd,
873 NULL, /* reason intentionally omitted */
874 NULL,
875 0);
876
877 masked = ~lo_avd.allowed & avd->allowed;
878
879 if (!masked)
880 return; /* no masked permission */
881
882 /* mask violated permissions */
883 avd->allowed &= ~masked;
884
885 *reason |= SEPOL_COMPUTEAV_BOUNDS;
886 }
887
888 /*
889 * Compute access vectors based on a context structure pair for
890 * the permissions in a particular class.
891 */
context_struct_compute_av(context_struct_t * scontext,context_struct_t * tcontext,sepol_security_class_t tclass,sepol_access_vector_t requested,struct sepol_av_decision * avd,unsigned int * reason,char ** r_buf,unsigned int flags)892 static int context_struct_compute_av(context_struct_t * scontext,
893 context_struct_t * tcontext,
894 sepol_security_class_t tclass,
895 sepol_access_vector_t requested,
896 struct sepol_av_decision *avd,
897 unsigned int *reason,
898 char **r_buf,
899 unsigned int flags)
900 {
901 constraint_node_t *constraint;
902 struct role_allow *ra;
903 avtab_key_t avkey;
904 class_datum_t *tclass_datum;
905 avtab_ptr_t node;
906 ebitmap_t *sattr, *tattr;
907 ebitmap_node_t *snode, *tnode;
908 unsigned int i, j;
909
910 if (!tclass || tclass > policydb->p_classes.nprim) {
911 ERR(NULL, "unrecognized class %d", tclass);
912 return -EINVAL;
913 }
914 tclass_datum = policydb->class_val_to_struct[tclass - 1];
915
916 /*
917 * Initialize the access vectors to the default values.
918 */
919 avd->allowed = 0;
920 avd->decided = 0xffffffff;
921 avd->auditallow = 0;
922 avd->auditdeny = 0xffffffff;
923 avd->seqno = latest_granting;
924 if (reason)
925 *reason = 0;
926
927 /*
928 * If a specific type enforcement rule was defined for
929 * this permission check, then use it.
930 */
931 avkey.target_class = tclass;
932 avkey.specified = AVTAB_AV;
933 sattr = &policydb->type_attr_map[scontext->type - 1];
934 tattr = &policydb->type_attr_map[tcontext->type - 1];
935 ebitmap_for_each_bit(sattr, snode, i) {
936 if (!ebitmap_node_get_bit(snode, i))
937 continue;
938 ebitmap_for_each_bit(tattr, tnode, j) {
939 if (!ebitmap_node_get_bit(tnode, j))
940 continue;
941 avkey.source_type = i + 1;
942 avkey.target_type = j + 1;
943 for (node =
944 avtab_search_node(&policydb->te_avtab, &avkey);
945 node != NULL;
946 node =
947 avtab_search_node_next(node, avkey.specified)) {
948 if (node->key.specified == AVTAB_ALLOWED)
949 avd->allowed |= node->datum.data;
950 else if (node->key.specified ==
951 AVTAB_AUDITALLOW)
952 avd->auditallow |= node->datum.data;
953 else if (node->key.specified == AVTAB_AUDITDENY)
954 avd->auditdeny &= node->datum.data;
955 }
956
957 /* Check conditional av table for additional permissions */
958 cond_compute_av(&policydb->te_cond_avtab, &avkey, avd);
959
960 }
961 }
962
963 if (requested & ~avd->allowed) {
964 if (reason)
965 *reason |= SEPOL_COMPUTEAV_TE;
966 requested &= avd->allowed;
967 }
968
969 /*
970 * Remove any permissions prohibited by a constraint (this includes
971 * the MLS policy).
972 */
973 constraint = tclass_datum->constraints;
974 while (constraint) {
975 if ((constraint->permissions & (avd->allowed)) &&
976 !constraint_expr_eval_reason(scontext, tcontext, NULL,
977 tclass, constraint, r_buf, flags)) {
978 avd->allowed =
979 (avd->allowed) & ~(constraint->permissions);
980 }
981 constraint = constraint->next;
982 }
983
984 if (requested & ~avd->allowed) {
985 if (reason)
986 *reason |= SEPOL_COMPUTEAV_CONS;
987 requested &= avd->allowed;
988 }
989
990 /*
991 * If checking process transition permission and the
992 * role is changing, then check the (current_role, new_role)
993 * pair.
994 */
995 if (tclass == SECCLASS_PROCESS &&
996 (avd->allowed & (PROCESS__TRANSITION | PROCESS__DYNTRANSITION)) &&
997 scontext->role != tcontext->role) {
998 for (ra = policydb->role_allow; ra; ra = ra->next) {
999 if (scontext->role == ra->role &&
1000 tcontext->role == ra->new_role)
1001 break;
1002 }
1003 if (!ra)
1004 avd->allowed = (avd->allowed) & ~(PROCESS__TRANSITION |
1005 PROCESS__DYNTRANSITION);
1006 }
1007
1008 if (requested & ~avd->allowed) {
1009 if (reason)
1010 *reason |= SEPOL_COMPUTEAV_RBAC;
1011 requested &= avd->allowed;
1012 }
1013
1014 type_attribute_bounds_av(scontext, tcontext, tclass, requested, avd,
1015 reason);
1016 return 0;
1017 }
1018
sepol_validate_transition(sepol_security_id_t oldsid,sepol_security_id_t newsid,sepol_security_id_t tasksid,sepol_security_class_t tclass)1019 int hidden sepol_validate_transition(sepol_security_id_t oldsid,
1020 sepol_security_id_t newsid,
1021 sepol_security_id_t tasksid,
1022 sepol_security_class_t tclass)
1023 {
1024 context_struct_t *ocontext;
1025 context_struct_t *ncontext;
1026 context_struct_t *tcontext;
1027 class_datum_t *tclass_datum;
1028 constraint_node_t *constraint;
1029
1030 if (!tclass || tclass > policydb->p_classes.nprim) {
1031 ERR(NULL, "unrecognized class %d", tclass);
1032 return -EINVAL;
1033 }
1034 tclass_datum = policydb->class_val_to_struct[tclass - 1];
1035
1036 ocontext = sepol_sidtab_search(sidtab, oldsid);
1037 if (!ocontext) {
1038 ERR(NULL, "unrecognized SID %d", oldsid);
1039 return -EINVAL;
1040 }
1041
1042 ncontext = sepol_sidtab_search(sidtab, newsid);
1043 if (!ncontext) {
1044 ERR(NULL, "unrecognized SID %d", newsid);
1045 return -EINVAL;
1046 }
1047
1048 tcontext = sepol_sidtab_search(sidtab, tasksid);
1049 if (!tcontext) {
1050 ERR(NULL, "unrecognized SID %d", tasksid);
1051 return -EINVAL;
1052 }
1053
1054 constraint = tclass_datum->validatetrans;
1055 while (constraint) {
1056 if (!constraint_expr_eval_reason(ocontext, ncontext, tcontext,
1057 0, constraint, NULL, 0)) {
1058 return -EPERM;
1059 }
1060 constraint = constraint->next;
1061 }
1062
1063 return 0;
1064 }
1065
1066 /*
1067 * sepol_validate_transition_reason_buffer - the reason buffer is realloc'd
1068 * in the constraint_expr_eval_reason() function.
1069 */
sepol_validate_transition_reason_buffer(sepol_security_id_t oldsid,sepol_security_id_t newsid,sepol_security_id_t tasksid,sepol_security_class_t tclass,char ** reason_buf,unsigned int flags)1070 int hidden sepol_validate_transition_reason_buffer(sepol_security_id_t oldsid,
1071 sepol_security_id_t newsid,
1072 sepol_security_id_t tasksid,
1073 sepol_security_class_t tclass,
1074 char **reason_buf,
1075 unsigned int flags)
1076 {
1077 context_struct_t *ocontext;
1078 context_struct_t *ncontext;
1079 context_struct_t *tcontext;
1080 class_datum_t *tclass_datum;
1081 constraint_node_t *constraint;
1082
1083 if (!tclass || tclass > policydb->p_classes.nprim) {
1084 ERR(NULL, "unrecognized class %d", tclass);
1085 return -EINVAL;
1086 }
1087 tclass_datum = policydb->class_val_to_struct[tclass - 1];
1088
1089 ocontext = sepol_sidtab_search(sidtab, oldsid);
1090 if (!ocontext) {
1091 ERR(NULL, "unrecognized SID %d", oldsid);
1092 return -EINVAL;
1093 }
1094
1095 ncontext = sepol_sidtab_search(sidtab, newsid);
1096 if (!ncontext) {
1097 ERR(NULL, "unrecognized SID %d", newsid);
1098 return -EINVAL;
1099 }
1100
1101 tcontext = sepol_sidtab_search(sidtab, tasksid);
1102 if (!tcontext) {
1103 ERR(NULL, "unrecognized SID %d", tasksid);
1104 return -EINVAL;
1105 }
1106
1107 /*
1108 * Set the buffer to NULL as mls/validatetrans may not be processed.
1109 * If a buffer is required, then the routines in
1110 * constraint_expr_eval_reason will realloc in REASON_BUF_SIZE
1111 * chunks (as it gets called for each mls/validatetrans processed).
1112 * We just make sure these start from zero.
1113 */
1114 *reason_buf = NULL;
1115 reason_buf_used = 0;
1116 reason_buf_len = 0;
1117 constraint = tclass_datum->validatetrans;
1118 while (constraint) {
1119 if (!constraint_expr_eval_reason(ocontext, ncontext, tcontext,
1120 tclass, constraint, reason_buf, flags)) {
1121 return -EPERM;
1122 }
1123 constraint = constraint->next;
1124 }
1125 return 0;
1126 }
1127
sepol_compute_av_reason(sepol_security_id_t ssid,sepol_security_id_t tsid,sepol_security_class_t tclass,sepol_access_vector_t requested,struct sepol_av_decision * avd,unsigned int * reason)1128 int hidden sepol_compute_av_reason(sepol_security_id_t ssid,
1129 sepol_security_id_t tsid,
1130 sepol_security_class_t tclass,
1131 sepol_access_vector_t requested,
1132 struct sepol_av_decision *avd,
1133 unsigned int *reason)
1134 {
1135 context_struct_t *scontext = 0, *tcontext = 0;
1136 int rc = 0;
1137
1138 scontext = sepol_sidtab_search(sidtab, ssid);
1139 if (!scontext) {
1140 ERR(NULL, "unrecognized SID %d", ssid);
1141 rc = -EINVAL;
1142 goto out;
1143 }
1144 tcontext = sepol_sidtab_search(sidtab, tsid);
1145 if (!tcontext) {
1146 ERR(NULL, "unrecognized SID %d", tsid);
1147 rc = -EINVAL;
1148 goto out;
1149 }
1150
1151 rc = context_struct_compute_av(scontext, tcontext, tclass,
1152 requested, avd, reason, NULL, 0);
1153 out:
1154 return rc;
1155 }
1156
1157 /*
1158 * sepol_compute_av_reason_buffer - the reason buffer is malloc'd to
1159 * REASON_BUF_SIZE. If the buffer size is exceeded, then it is realloc'd
1160 * in the constraint_expr_eval_reason() function.
1161 */
sepol_compute_av_reason_buffer(sepol_security_id_t ssid,sepol_security_id_t tsid,sepol_security_class_t tclass,sepol_access_vector_t requested,struct sepol_av_decision * avd,unsigned int * reason,char ** reason_buf,unsigned int flags)1162 int hidden sepol_compute_av_reason_buffer(sepol_security_id_t ssid,
1163 sepol_security_id_t tsid,
1164 sepol_security_class_t tclass,
1165 sepol_access_vector_t requested,
1166 struct sepol_av_decision *avd,
1167 unsigned int *reason,
1168 char **reason_buf,
1169 unsigned int flags)
1170 {
1171 context_struct_t *scontext = 0, *tcontext = 0;
1172 int rc = 0;
1173
1174 scontext = sepol_sidtab_search(sidtab, ssid);
1175 if (!scontext) {
1176 ERR(NULL, "unrecognized SID %d", ssid);
1177 rc = -EINVAL;
1178 goto out;
1179 }
1180 tcontext = sepol_sidtab_search(sidtab, tsid);
1181 if (!tcontext) {
1182 ERR(NULL, "unrecognized SID %d", tsid);
1183 rc = -EINVAL;
1184 goto out;
1185 }
1186
1187 /*
1188 * Set the buffer to NULL as constraints may not be processed.
1189 * If a buffer is required, then the routines in
1190 * constraint_expr_eval_reason will realloc in REASON_BUF_SIZE
1191 * chunks (as it gets called for each constraint processed).
1192 * We just make sure these start from zero.
1193 */
1194 *reason_buf = NULL;
1195 reason_buf_used = 0;
1196 reason_buf_len = 0;
1197
1198 rc = context_struct_compute_av(scontext, tcontext, tclass,
1199 requested, avd, reason, reason_buf, flags);
1200 out:
1201 return rc;
1202 }
1203
sepol_compute_av(sepol_security_id_t ssid,sepol_security_id_t tsid,sepol_security_class_t tclass,sepol_access_vector_t requested,struct sepol_av_decision * avd)1204 int hidden sepol_compute_av(sepol_security_id_t ssid,
1205 sepol_security_id_t tsid,
1206 sepol_security_class_t tclass,
1207 sepol_access_vector_t requested,
1208 struct sepol_av_decision *avd)
1209 {
1210 unsigned int reason = 0;
1211 return sepol_compute_av_reason(ssid, tsid, tclass, requested, avd,
1212 &reason);
1213 }
1214
1215 /*
1216 * Return a class ID associated with the class string specified by
1217 * class_name.
1218 */
sepol_string_to_security_class(const char * class_name,sepol_security_class_t * tclass)1219 int hidden sepol_string_to_security_class(const char *class_name,
1220 sepol_security_class_t *tclass)
1221 {
1222 class_datum_t *tclass_datum;
1223
1224 tclass_datum = hashtab_search(policydb->p_classes.table,
1225 (hashtab_key_t) class_name);
1226 if (!tclass_datum) {
1227 ERR(NULL, "unrecognized class %s", class_name);
1228 return STATUS_ERR;
1229 }
1230 *tclass = tclass_datum->s.value;
1231 return STATUS_SUCCESS;
1232 }
1233
1234 /*
1235 * Return access vector bit associated with the class ID and permission
1236 * string.
1237 */
sepol_string_to_av_perm(sepol_security_class_t tclass,const char * perm_name,sepol_access_vector_t * av)1238 int hidden sepol_string_to_av_perm(sepol_security_class_t tclass,
1239 const char *perm_name,
1240 sepol_access_vector_t *av)
1241 {
1242 class_datum_t *tclass_datum;
1243 perm_datum_t *perm_datum;
1244
1245 if (!tclass || tclass > policydb->p_classes.nprim) {
1246 ERR(NULL, "unrecognized class %d", tclass);
1247 return -EINVAL;
1248 }
1249 tclass_datum = policydb->class_val_to_struct[tclass - 1];
1250
1251 /* Check for unique perms then the common ones (if any) */
1252 perm_datum = (perm_datum_t *)
1253 hashtab_search(tclass_datum->permissions.table,
1254 (hashtab_key_t)perm_name);
1255 if (perm_datum != NULL) {
1256 *av = 0x1 << (perm_datum->s.value - 1);
1257 return STATUS_SUCCESS;
1258 }
1259
1260 if (tclass_datum->comdatum == NULL)
1261 goto out;
1262
1263 perm_datum = (perm_datum_t *)
1264 hashtab_search(tclass_datum->comdatum->permissions.table,
1265 (hashtab_key_t)perm_name);
1266
1267 if (perm_datum != NULL) {
1268 *av = 0x1 << (perm_datum->s.value - 1);
1269 return STATUS_SUCCESS;
1270 }
1271 out:
1272 ERR(NULL, "could not convert %s to av bit", perm_name);
1273 return STATUS_ERR;
1274 }
1275
1276 /*
1277 * Write the security context string representation of
1278 * the context associated with `sid' into a dynamically
1279 * allocated string of the correct size. Set `*scontext'
1280 * to point to this string and set `*scontext_len' to
1281 * the length of the string.
1282 */
sepol_sid_to_context(sepol_security_id_t sid,sepol_security_context_t * scontext,size_t * scontext_len)1283 int hidden sepol_sid_to_context(sepol_security_id_t sid,
1284 sepol_security_context_t * scontext,
1285 size_t * scontext_len)
1286 {
1287 context_struct_t *context;
1288 int rc = 0;
1289
1290 context = sepol_sidtab_search(sidtab, sid);
1291 if (!context) {
1292 ERR(NULL, "unrecognized SID %d", sid);
1293 rc = -EINVAL;
1294 goto out;
1295 }
1296 rc = context_to_string(NULL, policydb, context, scontext, scontext_len);
1297 out:
1298 return rc;
1299
1300 }
1301
1302 /*
1303 * Return a SID associated with the security context that
1304 * has the string representation specified by `scontext'.
1305 */
sepol_context_to_sid(const sepol_security_context_t scontext,size_t scontext_len,sepol_security_id_t * sid)1306 int hidden sepol_context_to_sid(const sepol_security_context_t scontext,
1307 size_t scontext_len, sepol_security_id_t * sid)
1308 {
1309
1310 context_struct_t *context = NULL;
1311
1312 /* First, create the context */
1313 if (context_from_string(NULL, policydb, &context,
1314 scontext, scontext_len) < 0)
1315 goto err;
1316
1317 /* Obtain the new sid */
1318 if (sid && (sepol_sidtab_context_to_sid(sidtab, context, sid) < 0))
1319 goto err;
1320
1321 context_destroy(context);
1322 free(context);
1323 return STATUS_SUCCESS;
1324
1325 err:
1326 if (context) {
1327 context_destroy(context);
1328 free(context);
1329 }
1330 ERR(NULL, "could not convert %s to sid", scontext);
1331 return STATUS_ERR;
1332 }
1333
compute_sid_handle_invalid_context(context_struct_t * scontext,context_struct_t * tcontext,sepol_security_class_t tclass,context_struct_t * newcontext)1334 static inline int compute_sid_handle_invalid_context(context_struct_t *
1335 scontext,
1336 context_struct_t *
1337 tcontext,
1338 sepol_security_class_t
1339 tclass,
1340 context_struct_t *
1341 newcontext)
1342 {
1343 if (selinux_enforcing) {
1344 return -EACCES;
1345 } else {
1346 sepol_security_context_t s, t, n;
1347 size_t slen, tlen, nlen;
1348
1349 context_to_string(NULL, policydb, scontext, &s, &slen);
1350 context_to_string(NULL, policydb, tcontext, &t, &tlen);
1351 context_to_string(NULL, policydb, newcontext, &n, &nlen);
1352 ERR(NULL, "invalid context %s for "
1353 "scontext=%s tcontext=%s tclass=%s",
1354 n, s, t, policydb->p_class_val_to_name[tclass - 1]);
1355 free(s);
1356 free(t);
1357 free(n);
1358 return 0;
1359 }
1360 }
1361
sepol_compute_sid(sepol_security_id_t ssid,sepol_security_id_t tsid,sepol_security_class_t tclass,uint32_t specified,sepol_security_id_t * out_sid)1362 static int sepol_compute_sid(sepol_security_id_t ssid,
1363 sepol_security_id_t tsid,
1364 sepol_security_class_t tclass,
1365 uint32_t specified, sepol_security_id_t * out_sid)
1366 {
1367 context_struct_t *scontext = 0, *tcontext = 0, newcontext;
1368 struct role_trans *roletr = 0;
1369 avtab_key_t avkey;
1370 avtab_datum_t *avdatum;
1371 avtab_ptr_t node;
1372 int rc = 0;
1373
1374 scontext = sepol_sidtab_search(sidtab, ssid);
1375 if (!scontext) {
1376 ERR(NULL, "unrecognized SID %d", ssid);
1377 rc = -EINVAL;
1378 goto out;
1379 }
1380 tcontext = sepol_sidtab_search(sidtab, tsid);
1381 if (!tcontext) {
1382 ERR(NULL, "unrecognized SID %d", tsid);
1383 rc = -EINVAL;
1384 goto out;
1385 }
1386
1387 context_init(&newcontext);
1388
1389 /* Set the user identity. */
1390 switch (specified) {
1391 case AVTAB_TRANSITION:
1392 case AVTAB_CHANGE:
1393 /* Use the process user identity. */
1394 newcontext.user = scontext->user;
1395 break;
1396 case AVTAB_MEMBER:
1397 /* Use the related object owner. */
1398 newcontext.user = tcontext->user;
1399 break;
1400 }
1401
1402 /* Set the role and type to default values. */
1403 switch (tclass) {
1404 case SECCLASS_PROCESS:
1405 /* Use the current role and type of process. */
1406 newcontext.role = scontext->role;
1407 newcontext.type = scontext->type;
1408 break;
1409 default:
1410 /* Use the well-defined object role. */
1411 newcontext.role = OBJECT_R_VAL;
1412 /* Use the type of the related object. */
1413 newcontext.type = tcontext->type;
1414 }
1415
1416 /* Look for a type transition/member/change rule. */
1417 avkey.source_type = scontext->type;
1418 avkey.target_type = tcontext->type;
1419 avkey.target_class = tclass;
1420 avkey.specified = specified;
1421 avdatum = avtab_search(&policydb->te_avtab, &avkey);
1422
1423 /* If no permanent rule, also check for enabled conditional rules */
1424 if (!avdatum) {
1425 node = avtab_search_node(&policydb->te_cond_avtab, &avkey);
1426 for (; node != NULL;
1427 node = avtab_search_node_next(node, specified)) {
1428 if (node->key.specified & AVTAB_ENABLED) {
1429 avdatum = &node->datum;
1430 break;
1431 }
1432 }
1433 }
1434
1435 if (avdatum) {
1436 /* Use the type from the type transition/member/change rule. */
1437 newcontext.type = avdatum->data;
1438 }
1439
1440 /* Check for class-specific changes. */
1441 switch (tclass) {
1442 case SECCLASS_PROCESS:
1443 if (specified & AVTAB_TRANSITION) {
1444 /* Look for a role transition rule. */
1445 for (roletr = policydb->role_tr; roletr;
1446 roletr = roletr->next) {
1447 if (roletr->role == scontext->role &&
1448 roletr->type == tcontext->type) {
1449 /* Use the role transition rule. */
1450 newcontext.role = roletr->new_role;
1451 break;
1452 }
1453 }
1454 }
1455 break;
1456 default:
1457 break;
1458 }
1459
1460 /* Set the MLS attributes.
1461 This is done last because it may allocate memory. */
1462 rc = mls_compute_sid(policydb, scontext, tcontext, tclass, specified,
1463 &newcontext);
1464 if (rc)
1465 goto out;
1466
1467 /* Check the validity of the context. */
1468 if (!policydb_context_isvalid(policydb, &newcontext)) {
1469 rc = compute_sid_handle_invalid_context(scontext,
1470 tcontext,
1471 tclass, &newcontext);
1472 if (rc)
1473 goto out;
1474 }
1475 /* Obtain the sid for the context. */
1476 rc = sepol_sidtab_context_to_sid(sidtab, &newcontext, out_sid);
1477 out:
1478 context_destroy(&newcontext);
1479 return rc;
1480 }
1481
1482 /*
1483 * Compute a SID to use for labeling a new object in the
1484 * class `tclass' based on a SID pair.
1485 */
sepol_transition_sid(sepol_security_id_t ssid,sepol_security_id_t tsid,sepol_security_class_t tclass,sepol_security_id_t * out_sid)1486 int hidden sepol_transition_sid(sepol_security_id_t ssid,
1487 sepol_security_id_t tsid,
1488 sepol_security_class_t tclass,
1489 sepol_security_id_t * out_sid)
1490 {
1491 return sepol_compute_sid(ssid, tsid, tclass, AVTAB_TRANSITION, out_sid);
1492 }
1493
1494 /*
1495 * Compute a SID to use when selecting a member of a
1496 * polyinstantiated object of class `tclass' based on
1497 * a SID pair.
1498 */
sepol_member_sid(sepol_security_id_t ssid,sepol_security_id_t tsid,sepol_security_class_t tclass,sepol_security_id_t * out_sid)1499 int hidden sepol_member_sid(sepol_security_id_t ssid,
1500 sepol_security_id_t tsid,
1501 sepol_security_class_t tclass,
1502 sepol_security_id_t * out_sid)
1503 {
1504 return sepol_compute_sid(ssid, tsid, tclass, AVTAB_MEMBER, out_sid);
1505 }
1506
1507 /*
1508 * Compute a SID to use for relabeling an object in the
1509 * class `tclass' based on a SID pair.
1510 */
sepol_change_sid(sepol_security_id_t ssid,sepol_security_id_t tsid,sepol_security_class_t tclass,sepol_security_id_t * out_sid)1511 int hidden sepol_change_sid(sepol_security_id_t ssid,
1512 sepol_security_id_t tsid,
1513 sepol_security_class_t tclass,
1514 sepol_security_id_t * out_sid)
1515 {
1516 return sepol_compute_sid(ssid, tsid, tclass, AVTAB_CHANGE, out_sid);
1517 }
1518
1519 /*
1520 * Verify that each permission that is defined under the
1521 * existing policy is still defined with the same value
1522 * in the new policy.
1523 */
validate_perm(hashtab_key_t key,hashtab_datum_t datum,void * p)1524 static int validate_perm(hashtab_key_t key, hashtab_datum_t datum, void *p)
1525 {
1526 hashtab_t h;
1527 perm_datum_t *perdatum, *perdatum2;
1528
1529 h = (hashtab_t) p;
1530 perdatum = (perm_datum_t *) datum;
1531
1532 perdatum2 = (perm_datum_t *) hashtab_search(h, key);
1533 if (!perdatum2) {
1534 ERR(NULL, "permission %s disappeared", key);
1535 return -1;
1536 }
1537 if (perdatum->s.value != perdatum2->s.value) {
1538 ERR(NULL, "the value of permissions %s changed", key);
1539 return -1;
1540 }
1541 return 0;
1542 }
1543
1544 /*
1545 * Verify that each class that is defined under the
1546 * existing policy is still defined with the same
1547 * attributes in the new policy.
1548 */
validate_class(hashtab_key_t key,hashtab_datum_t datum,void * p)1549 static int validate_class(hashtab_key_t key, hashtab_datum_t datum, void *p)
1550 {
1551 policydb_t *newp;
1552 class_datum_t *cladatum, *cladatum2;
1553
1554 newp = (policydb_t *) p;
1555 cladatum = (class_datum_t *) datum;
1556
1557 cladatum2 =
1558 (class_datum_t *) hashtab_search(newp->p_classes.table, key);
1559 if (!cladatum2) {
1560 ERR(NULL, "class %s disappeared", key);
1561 return -1;
1562 }
1563 if (cladatum->s.value != cladatum2->s.value) {
1564 ERR(NULL, "the value of class %s changed", key);
1565 return -1;
1566 }
1567 if ((cladatum->comdatum && !cladatum2->comdatum) ||
1568 (!cladatum->comdatum && cladatum2->comdatum)) {
1569 ERR(NULL, "the inherits clause for the access "
1570 "vector definition for class %s changed", key);
1571 return -1;
1572 }
1573 if (cladatum->comdatum) {
1574 if (hashtab_map
1575 (cladatum->comdatum->permissions.table, validate_perm,
1576 cladatum2->comdatum->permissions.table)) {
1577 ERR(NULL,
1578 " in the access vector definition "
1579 "for class %s\n", key);
1580 return -1;
1581 }
1582 }
1583 if (hashtab_map(cladatum->permissions.table, validate_perm,
1584 cladatum2->permissions.table)) {
1585 ERR(NULL, " in access vector definition for class %s", key);
1586 return -1;
1587 }
1588 return 0;
1589 }
1590
1591 /* Clone the SID into the new SID table. */
clone_sid(sepol_security_id_t sid,context_struct_t * context,void * arg)1592 static int clone_sid(sepol_security_id_t sid,
1593 context_struct_t * context, void *arg)
1594 {
1595 sidtab_t *s = arg;
1596
1597 return sepol_sidtab_insert(s, sid, context);
1598 }
1599
convert_context_handle_invalid_context(context_struct_t * context)1600 static inline int convert_context_handle_invalid_context(context_struct_t *
1601 context)
1602 {
1603 if (selinux_enforcing) {
1604 return -EINVAL;
1605 } else {
1606 sepol_security_context_t s;
1607 size_t len;
1608
1609 context_to_string(NULL, policydb, context, &s, &len);
1610 ERR(NULL, "context %s is invalid", s);
1611 free(s);
1612 return 0;
1613 }
1614 }
1615
1616 typedef struct {
1617 policydb_t *oldp;
1618 policydb_t *newp;
1619 } convert_context_args_t;
1620
1621 /*
1622 * Convert the values in the security context
1623 * structure `c' from the values specified
1624 * in the policy `p->oldp' to the values specified
1625 * in the policy `p->newp'. Verify that the
1626 * context is valid under the new policy.
1627 */
convert_context(sepol_security_id_t key,context_struct_t * c,void * p)1628 static int convert_context(sepol_security_id_t key __attribute__ ((unused)),
1629 context_struct_t * c, void *p)
1630 {
1631 convert_context_args_t *args;
1632 context_struct_t oldc;
1633 role_datum_t *role;
1634 type_datum_t *typdatum;
1635 user_datum_t *usrdatum;
1636 sepol_security_context_t s;
1637 size_t len;
1638 int rc = -EINVAL;
1639
1640 args = (convert_context_args_t *) p;
1641
1642 if (context_cpy(&oldc, c))
1643 return -ENOMEM;
1644
1645 /* Convert the user. */
1646 usrdatum = (user_datum_t *) hashtab_search(args->newp->p_users.table,
1647 args->oldp->
1648 p_user_val_to_name[c->user -
1649 1]);
1650
1651 if (!usrdatum) {
1652 goto bad;
1653 }
1654 c->user = usrdatum->s.value;
1655
1656 /* Convert the role. */
1657 role = (role_datum_t *) hashtab_search(args->newp->p_roles.table,
1658 args->oldp->
1659 p_role_val_to_name[c->role - 1]);
1660 if (!role) {
1661 goto bad;
1662 }
1663 c->role = role->s.value;
1664
1665 /* Convert the type. */
1666 typdatum = (type_datum_t *)
1667 hashtab_search(args->newp->p_types.table,
1668 args->oldp->p_type_val_to_name[c->type - 1]);
1669 if (!typdatum) {
1670 goto bad;
1671 }
1672 c->type = typdatum->s.value;
1673
1674 rc = mls_convert_context(args->oldp, args->newp, c);
1675 if (rc)
1676 goto bad;
1677
1678 /* Check the validity of the new context. */
1679 if (!policydb_context_isvalid(args->newp, c)) {
1680 rc = convert_context_handle_invalid_context(&oldc);
1681 if (rc)
1682 goto bad;
1683 }
1684
1685 context_destroy(&oldc);
1686 return 0;
1687
1688 bad:
1689 context_to_string(NULL, policydb, &oldc, &s, &len);
1690 context_destroy(&oldc);
1691 ERR(NULL, "invalidating context %s", s);
1692 free(s);
1693 return rc;
1694 }
1695
1696 /* Reading from a policy "file". */
next_entry(void * buf,struct policy_file * fp,size_t bytes)1697 int hidden next_entry(void *buf, struct policy_file *fp, size_t bytes)
1698 {
1699 size_t nread;
1700
1701 switch (fp->type) {
1702 case PF_USE_STDIO:
1703 nread = fread(buf, bytes, 1, fp->fp);
1704
1705 if (nread != 1)
1706 return -1;
1707 break;
1708 case PF_USE_MEMORY:
1709 if (bytes > fp->len) {
1710 errno = EOVERFLOW;
1711 return -1;
1712 }
1713 memcpy(buf, fp->data, bytes);
1714 fp->data += bytes;
1715 fp->len -= bytes;
1716 break;
1717 default:
1718 errno = EINVAL;
1719 return -1;
1720 }
1721 return 0;
1722 }
1723
put_entry(const void * ptr,size_t size,size_t n,struct policy_file * fp)1724 size_t hidden put_entry(const void *ptr, size_t size, size_t n,
1725 struct policy_file *fp)
1726 {
1727 size_t bytes = size * n;
1728
1729 switch (fp->type) {
1730 case PF_USE_STDIO:
1731 return fwrite(ptr, size, n, fp->fp);
1732 case PF_USE_MEMORY:
1733 if (bytes > fp->len) {
1734 errno = ENOSPC;
1735 return 0;
1736 }
1737
1738 memcpy(fp->data, ptr, bytes);
1739 fp->data += bytes;
1740 fp->len -= bytes;
1741 return n;
1742 case PF_LEN:
1743 fp->len += bytes;
1744 return n;
1745 default:
1746 return 0;
1747 }
1748 return 0;
1749 }
1750
1751 /*
1752 * Reads a string and null terminates it from the policy file.
1753 * This is a port of str_read from the SE Linux kernel code.
1754 *
1755 * It returns:
1756 * 0 - Success
1757 * -1 - Failure with errno set
1758 */
str_read(char ** strp,struct policy_file * fp,size_t len)1759 int hidden str_read(char **strp, struct policy_file *fp, size_t len)
1760 {
1761 int rc;
1762 char *str;
1763
1764 if (zero_or_saturated(len)) {
1765 errno = EINVAL;
1766 return -1;
1767 }
1768
1769 str = malloc(len + 1);
1770 if (!str)
1771 return -1;
1772
1773 /* it's expected the caller should free the str */
1774 *strp = str;
1775
1776 /* next_entry sets errno */
1777 rc = next_entry(str, fp, len);
1778 if (rc)
1779 return rc;
1780
1781 str[len] = '\0';
1782 return 0;
1783 }
1784
1785 /*
1786 * Read a new set of configuration data from
1787 * a policy database binary representation file.
1788 *
1789 * Verify that each class that is defined under the
1790 * existing policy is still defined with the same
1791 * attributes in the new policy.
1792 *
1793 * Convert the context structures in the SID table to the
1794 * new representation and verify that all entries
1795 * in the SID table are valid under the new policy.
1796 *
1797 * Change the active policy database to use the new
1798 * configuration data.
1799 *
1800 * Reset the access vector cache.
1801 */
sepol_load_policy(void * data,size_t len)1802 int hidden sepol_load_policy(void *data, size_t len)
1803 {
1804 policydb_t oldpolicydb, newpolicydb;
1805 sidtab_t oldsidtab, newsidtab;
1806 convert_context_args_t args;
1807 int rc = 0;
1808 struct policy_file file, *fp;
1809
1810 policy_file_init(&file);
1811 file.type = PF_USE_MEMORY;
1812 file.data = data;
1813 file.len = len;
1814 fp = &file;
1815
1816 if (policydb_init(&newpolicydb))
1817 return -ENOMEM;
1818
1819 if (policydb_read(&newpolicydb, fp, 1)) {
1820 policydb_destroy(&mypolicydb);
1821 return -EINVAL;
1822 }
1823
1824 sepol_sidtab_init(&newsidtab);
1825
1826 /* Verify that the existing classes did not change. */
1827 if (hashtab_map
1828 (policydb->p_classes.table, validate_class, &newpolicydb)) {
1829 ERR(NULL, "the definition of an existing class changed");
1830 rc = -EINVAL;
1831 goto err;
1832 }
1833
1834 /* Clone the SID table. */
1835 sepol_sidtab_shutdown(sidtab);
1836 if (sepol_sidtab_map(sidtab, clone_sid, &newsidtab)) {
1837 rc = -ENOMEM;
1838 goto err;
1839 }
1840
1841 /* Convert the internal representations of contexts
1842 in the new SID table and remove invalid SIDs. */
1843 args.oldp = policydb;
1844 args.newp = &newpolicydb;
1845 sepol_sidtab_map_remove_on_error(&newsidtab, convert_context, &args);
1846
1847 /* Save the old policydb and SID table to free later. */
1848 memcpy(&oldpolicydb, policydb, sizeof *policydb);
1849 sepol_sidtab_set(&oldsidtab, sidtab);
1850
1851 /* Install the new policydb and SID table. */
1852 memcpy(policydb, &newpolicydb, sizeof *policydb);
1853 sepol_sidtab_set(sidtab, &newsidtab);
1854
1855 /* Free the old policydb and SID table. */
1856 policydb_destroy(&oldpolicydb);
1857 sepol_sidtab_destroy(&oldsidtab);
1858
1859 return 0;
1860
1861 err:
1862 sepol_sidtab_destroy(&newsidtab);
1863 policydb_destroy(&newpolicydb);
1864 return rc;
1865
1866 }
1867
1868 /*
1869 * Return the SIDs to use for an unlabeled file system
1870 * that is being mounted from the device with the
1871 * the kdevname `name'. The `fs_sid' SID is returned for
1872 * the file system and the `file_sid' SID is returned
1873 * for all files within that file system.
1874 */
sepol_fs_sid(char * name,sepol_security_id_t * fs_sid,sepol_security_id_t * file_sid)1875 int hidden sepol_fs_sid(char *name,
1876 sepol_security_id_t * fs_sid,
1877 sepol_security_id_t * file_sid)
1878 {
1879 int rc = 0;
1880 ocontext_t *c;
1881
1882 c = policydb->ocontexts[OCON_FS];
1883 while (c) {
1884 if (strcmp(c->u.name, name) == 0)
1885 break;
1886 c = c->next;
1887 }
1888
1889 if (c) {
1890 if (!c->sid[0] || !c->sid[1]) {
1891 rc = sepol_sidtab_context_to_sid(sidtab,
1892 &c->context[0],
1893 &c->sid[0]);
1894 if (rc)
1895 goto out;
1896 rc = sepol_sidtab_context_to_sid(sidtab,
1897 &c->context[1],
1898 &c->sid[1]);
1899 if (rc)
1900 goto out;
1901 }
1902 *fs_sid = c->sid[0];
1903 *file_sid = c->sid[1];
1904 } else {
1905 *fs_sid = SECINITSID_FS;
1906 *file_sid = SECINITSID_FILE;
1907 }
1908
1909 out:
1910 return rc;
1911 }
1912
1913 /*
1914 * Return the SID of the port specified by
1915 * `domain', `type', `protocol', and `port'.
1916 */
sepol_port_sid(uint16_t domain,uint16_t type,uint8_t protocol,uint16_t port,sepol_security_id_t * out_sid)1917 int hidden sepol_port_sid(uint16_t domain __attribute__ ((unused)),
1918 uint16_t type __attribute__ ((unused)),
1919 uint8_t protocol,
1920 uint16_t port, sepol_security_id_t * out_sid)
1921 {
1922 ocontext_t *c;
1923 int rc = 0;
1924
1925 c = policydb->ocontexts[OCON_PORT];
1926 while (c) {
1927 if (c->u.port.protocol == protocol &&
1928 c->u.port.low_port <= port && c->u.port.high_port >= port)
1929 break;
1930 c = c->next;
1931 }
1932
1933 if (c) {
1934 if (!c->sid[0]) {
1935 rc = sepol_sidtab_context_to_sid(sidtab,
1936 &c->context[0],
1937 &c->sid[0]);
1938 if (rc)
1939 goto out;
1940 }
1941 *out_sid = c->sid[0];
1942 } else {
1943 *out_sid = SECINITSID_PORT;
1944 }
1945
1946 out:
1947 return rc;
1948 }
1949
1950 /*
1951 * Return the SIDs to use for a network interface
1952 * with the name `name'. The `if_sid' SID is returned for
1953 * the interface and the `msg_sid' SID is returned as
1954 * the default SID for messages received on the
1955 * interface.
1956 */
sepol_netif_sid(char * name,sepol_security_id_t * if_sid,sepol_security_id_t * msg_sid)1957 int hidden sepol_netif_sid(char *name,
1958 sepol_security_id_t * if_sid,
1959 sepol_security_id_t * msg_sid)
1960 {
1961 int rc = 0;
1962 ocontext_t *c;
1963
1964 c = policydb->ocontexts[OCON_NETIF];
1965 while (c) {
1966 if (strcmp(name, c->u.name) == 0)
1967 break;
1968 c = c->next;
1969 }
1970
1971 if (c) {
1972 if (!c->sid[0] || !c->sid[1]) {
1973 rc = sepol_sidtab_context_to_sid(sidtab,
1974 &c->context[0],
1975 &c->sid[0]);
1976 if (rc)
1977 goto out;
1978 rc = sepol_sidtab_context_to_sid(sidtab,
1979 &c->context[1],
1980 &c->sid[1]);
1981 if (rc)
1982 goto out;
1983 }
1984 *if_sid = c->sid[0];
1985 *msg_sid = c->sid[1];
1986 } else {
1987 *if_sid = SECINITSID_NETIF;
1988 *msg_sid = SECINITSID_NETMSG;
1989 }
1990
1991 out:
1992 return rc;
1993 }
1994
match_ipv6_addrmask(uint32_t * input,uint32_t * addr,uint32_t * mask)1995 static int match_ipv6_addrmask(uint32_t * input, uint32_t * addr,
1996 uint32_t * mask)
1997 {
1998 int i, fail = 0;
1999
2000 for (i = 0; i < 4; i++)
2001 if (addr[i] != (input[i] & mask[i])) {
2002 fail = 1;
2003 break;
2004 }
2005
2006 return !fail;
2007 }
2008
2009 /*
2010 * Return the SID of the node specified by the address
2011 * `addrp' where `addrlen' is the length of the address
2012 * in bytes and `domain' is the communications domain or
2013 * address family in which the address should be interpreted.
2014 */
sepol_node_sid(uint16_t domain,void * addrp,size_t addrlen,sepol_security_id_t * out_sid)2015 int hidden sepol_node_sid(uint16_t domain,
2016 void *addrp,
2017 size_t addrlen, sepol_security_id_t * out_sid)
2018 {
2019 int rc = 0;
2020 ocontext_t *c;
2021
2022 switch (domain) {
2023 case AF_INET:{
2024 uint32_t addr;
2025
2026 if (addrlen != sizeof(uint32_t)) {
2027 rc = -EINVAL;
2028 goto out;
2029 }
2030
2031 addr = *((uint32_t *) addrp);
2032
2033 c = policydb->ocontexts[OCON_NODE];
2034 while (c) {
2035 if (c->u.node.addr == (addr & c->u.node.mask))
2036 break;
2037 c = c->next;
2038 }
2039 break;
2040 }
2041
2042 case AF_INET6:
2043 if (addrlen != sizeof(uint64_t) * 2) {
2044 rc = -EINVAL;
2045 goto out;
2046 }
2047
2048 c = policydb->ocontexts[OCON_NODE6];
2049 while (c) {
2050 if (match_ipv6_addrmask(addrp, c->u.node6.addr,
2051 c->u.node6.mask))
2052 break;
2053 c = c->next;
2054 }
2055 break;
2056
2057 default:
2058 *out_sid = SECINITSID_NODE;
2059 goto out;
2060 }
2061
2062 if (c) {
2063 if (!c->sid[0]) {
2064 rc = sepol_sidtab_context_to_sid(sidtab,
2065 &c->context[0],
2066 &c->sid[0]);
2067 if (rc)
2068 goto out;
2069 }
2070 *out_sid = c->sid[0];
2071 } else {
2072 *out_sid = SECINITSID_NODE;
2073 }
2074
2075 out:
2076 return rc;
2077 }
2078
2079 /*
2080 * Generate the set of SIDs for legal security contexts
2081 * for a given user that can be reached by `fromsid'.
2082 * Set `*sids' to point to a dynamically allocated
2083 * array containing the set of SIDs. Set `*nel' to the
2084 * number of elements in the array.
2085 */
2086 #define SIDS_NEL 25
2087
sepol_get_user_sids(sepol_security_id_t fromsid,char * username,sepol_security_id_t ** sids,uint32_t * nel)2088 int hidden sepol_get_user_sids(sepol_security_id_t fromsid,
2089 char *username,
2090 sepol_security_id_t ** sids, uint32_t * nel)
2091 {
2092 context_struct_t *fromcon, usercon;
2093 sepol_security_id_t *mysids, *mysids2, sid;
2094 uint32_t mynel = 0, maxnel = SIDS_NEL;
2095 user_datum_t *user;
2096 role_datum_t *role;
2097 struct sepol_av_decision avd;
2098 int rc = 0;
2099 unsigned int i, j, reason;
2100 ebitmap_node_t *rnode, *tnode;
2101
2102 fromcon = sepol_sidtab_search(sidtab, fromsid);
2103 if (!fromcon) {
2104 rc = -EINVAL;
2105 goto out;
2106 }
2107
2108 user = (user_datum_t *) hashtab_search(policydb->p_users.table,
2109 username);
2110 if (!user) {
2111 rc = -EINVAL;
2112 goto out;
2113 }
2114 usercon.user = user->s.value;
2115
2116 mysids = malloc(maxnel * sizeof(sepol_security_id_t));
2117 if (!mysids) {
2118 rc = -ENOMEM;
2119 goto out;
2120 }
2121 memset(mysids, 0, maxnel * sizeof(sepol_security_id_t));
2122
2123 ebitmap_for_each_bit(&user->roles.roles, rnode, i) {
2124 if (!ebitmap_node_get_bit(rnode, i))
2125 continue;
2126 role = policydb->role_val_to_struct[i];
2127 usercon.role = i + 1;
2128 ebitmap_for_each_bit(&role->types.types, tnode, j) {
2129 if (!ebitmap_node_get_bit(tnode, j))
2130 continue;
2131 usercon.type = j + 1;
2132 if (usercon.type == fromcon->type)
2133 continue;
2134
2135 if (mls_setup_user_range
2136 (fromcon, user, &usercon, policydb->mls))
2137 continue;
2138
2139 rc = context_struct_compute_av(fromcon, &usercon,
2140 SECCLASS_PROCESS,
2141 PROCESS__TRANSITION,
2142 &avd, &reason, NULL, 0);
2143 if (rc || !(avd.allowed & PROCESS__TRANSITION))
2144 continue;
2145 rc = sepol_sidtab_context_to_sid(sidtab, &usercon,
2146 &sid);
2147 if (rc) {
2148 free(mysids);
2149 goto out;
2150 }
2151 if (mynel < maxnel) {
2152 mysids[mynel++] = sid;
2153 } else {
2154 maxnel += SIDS_NEL;
2155 mysids2 =
2156 malloc(maxnel *
2157 sizeof(sepol_security_id_t));
2158
2159 if (!mysids2) {
2160 rc = -ENOMEM;
2161 free(mysids);
2162 goto out;
2163 }
2164 memset(mysids2, 0,
2165 maxnel * sizeof(sepol_security_id_t));
2166 memcpy(mysids2, mysids,
2167 mynel * sizeof(sepol_security_id_t));
2168 free(mysids);
2169 mysids = mysids2;
2170 mysids[mynel++] = sid;
2171 }
2172 }
2173 }
2174
2175 *sids = mysids;
2176 *nel = mynel;
2177
2178 out:
2179 return rc;
2180 }
2181
2182 /*
2183 * Return the SID to use for a file in a filesystem
2184 * that cannot support a persistent label mapping or use another
2185 * fixed labeling behavior like transition SIDs or task SIDs.
2186 */
sepol_genfs_sid(const char * fstype,const char * path,sepol_security_class_t sclass,sepol_security_id_t * sid)2187 int hidden sepol_genfs_sid(const char *fstype,
2188 const char *path,
2189 sepol_security_class_t sclass,
2190 sepol_security_id_t * sid)
2191 {
2192 size_t len;
2193 genfs_t *genfs;
2194 ocontext_t *c;
2195 int rc = 0, cmp = 0;
2196
2197 for (genfs = policydb->genfs; genfs; genfs = genfs->next) {
2198 cmp = strcmp(fstype, genfs->fstype);
2199 if (cmp <= 0)
2200 break;
2201 }
2202
2203 if (!genfs || cmp) {
2204 *sid = SECINITSID_UNLABELED;
2205 rc = -ENOENT;
2206 goto out;
2207 }
2208
2209 for (c = genfs->head; c; c = c->next) {
2210 len = strlen(c->u.name);
2211 if ((!c->v.sclass || sclass == c->v.sclass) &&
2212 (strncmp(c->u.name, path, len) == 0))
2213 break;
2214 }
2215
2216 if (!c) {
2217 *sid = SECINITSID_UNLABELED;
2218 rc = -ENOENT;
2219 goto out;
2220 }
2221
2222 if (!c->sid[0]) {
2223 rc = sepol_sidtab_context_to_sid(sidtab,
2224 &c->context[0], &c->sid[0]);
2225 if (rc)
2226 goto out;
2227 }
2228
2229 *sid = c->sid[0];
2230 out:
2231 return rc;
2232 }
2233
sepol_fs_use(const char * fstype,unsigned int * behavior,sepol_security_id_t * sid)2234 int hidden sepol_fs_use(const char *fstype,
2235 unsigned int *behavior, sepol_security_id_t * sid)
2236 {
2237 int rc = 0;
2238 ocontext_t *c;
2239
2240 c = policydb->ocontexts[OCON_FSUSE];
2241 while (c) {
2242 if (strcmp(fstype, c->u.name) == 0)
2243 break;
2244 c = c->next;
2245 }
2246
2247 if (c) {
2248 *behavior = c->v.behavior;
2249 if (!c->sid[0]) {
2250 rc = sepol_sidtab_context_to_sid(sidtab,
2251 &c->context[0],
2252 &c->sid[0]);
2253 if (rc)
2254 goto out;
2255 }
2256 *sid = c->sid[0];
2257 } else {
2258 rc = sepol_genfs_sid(fstype, "/", SECCLASS_DIR, sid);
2259 if (rc) {
2260 *behavior = SECURITY_FS_USE_NONE;
2261 rc = 0;
2262 } else {
2263 *behavior = SECURITY_FS_USE_GENFS;
2264 }
2265 }
2266
2267 out:
2268 return rc;
2269 }
2270
2271 /* FLASK */
2272