1 /* Authors: Karl MacMillan <kmacmillan@tresys.com> 2 * Frank Mayer <mayerf@tresys.com> 3 * 4 * Copyright (C) 2003 - 2004 Tresys Technology, LLC 5 * This program is free software; you can redistribute it and/or modify 6 * it under the terms of the GNU General Public License as published by 7 * the Free Software Foundation, version 2. 8 */ 9 10 #include <linux/kernel.h> 11 #include <linux/errno.h> 12 #include <linux/string.h> 13 #include <linux/spinlock.h> 14 #include <asm/semaphore.h> 15 #include <linux/slab.h> 16 17 #include "security.h" 18 #include "conditional.h" 19 20 /* 21 * cond_evaluate_expr evaluates a conditional expr 22 * in reverse polish notation. It returns true (1), false (0), 23 * or undefined (-1). Undefined occurs when the expression 24 * exceeds the stack depth of COND_EXPR_MAXDEPTH. 25 */ 26 static int cond_evaluate_expr(struct policydb *p, struct cond_expr *expr) 27 { 28 29 struct cond_expr *cur; 30 int s[COND_EXPR_MAXDEPTH]; 31 int sp = -1; 32 33 for (cur = expr; cur != NULL; cur = cur->next) { 34 switch (cur->expr_type) { 35 case COND_BOOL: 36 if (sp == (COND_EXPR_MAXDEPTH - 1)) 37 return -1; 38 sp++; 39 s[sp] = p->bool_val_to_struct[cur->bool - 1]->state; 40 break; 41 case COND_NOT: 42 if (sp < 0) 43 return -1; 44 s[sp] = !s[sp]; 45 break; 46 case COND_OR: 47 if (sp < 1) 48 return -1; 49 sp--; 50 s[sp] |= s[sp + 1]; 51 break; 52 case COND_AND: 53 if (sp < 1) 54 return -1; 55 sp--; 56 s[sp] &= s[sp + 1]; 57 break; 58 case COND_XOR: 59 if (sp < 1) 60 return -1; 61 sp--; 62 s[sp] ^= s[sp + 1]; 63 break; 64 case COND_EQ: 65 if (sp < 1) 66 return -1; 67 sp--; 68 s[sp] = (s[sp] == s[sp + 1]); 69 break; 70 case COND_NEQ: 71 if (sp < 1) 72 return -1; 73 sp--; 74 s[sp] = (s[sp] != s[sp + 1]); 75 break; 76 default: 77 return -1; 78 } 79 } 80 return s[0]; 81 } 82 83 /* 84 * evaluate_cond_node evaluates the conditional stored in 85 * a struct cond_node and if the result is different than the 86 * current state of the node it sets the rules in the true/false 87 * list appropriately. If the result of the expression is undefined 88 * all of the rules are disabled for safety. 89 */ 90 int evaluate_cond_node(struct policydb *p, struct cond_node *node) 91 { 92 int new_state; 93 struct cond_av_list* cur; 94 95 new_state = cond_evaluate_expr(p, node->expr); 96 if (new_state != node->cur_state) { 97 node->cur_state = new_state; 98 if (new_state == -1) 99 printk(KERN_ERR "security: expression result was undefined - disabling all rules.\n"); 100 /* turn the rules on or off */ 101 for (cur = node->true_list; cur != NULL; cur = cur->next) { 102 if (new_state <= 0) { 103 cur->node->datum.specified &= ~AVTAB_ENABLED; 104 } else { 105 cur->node->datum.specified |= AVTAB_ENABLED; 106 } 107 } 108 109 for (cur = node->false_list; cur != NULL; cur = cur->next) { 110 /* -1 or 1 */ 111 if (new_state) { 112 cur->node->datum.specified &= ~AVTAB_ENABLED; 113 } else { 114 cur->node->datum.specified |= AVTAB_ENABLED; 115 } 116 } 117 } 118 return 0; 119 } 120 121 int cond_policydb_init(struct policydb *p) 122 { 123 p->bool_val_to_struct = NULL; 124 p->cond_list = NULL; 125 if (avtab_init(&p->te_cond_avtab)) 126 return -1; 127 128 return 0; 129 } 130 131 static void cond_av_list_destroy(struct cond_av_list *list) 132 { 133 struct cond_av_list *cur, *next; 134 for (cur = list; cur != NULL; cur = next) { 135 next = cur->next; 136 /* the avtab_ptr_t node is destroy by the avtab */ 137 kfree(cur); 138 } 139 } 140 141 static void cond_node_destroy(struct cond_node *node) 142 { 143 struct cond_expr *cur_expr, *next_expr; 144 145 for (cur_expr = node->expr; cur_expr != NULL; cur_expr = next_expr) { 146 next_expr = cur_expr->next; 147 kfree(cur_expr); 148 } 149 cond_av_list_destroy(node->true_list); 150 cond_av_list_destroy(node->false_list); 151 kfree(node); 152 } 153 154 static void cond_list_destroy(struct cond_node *list) 155 { 156 struct cond_node *next, *cur; 157 158 if (list == NULL) 159 return; 160 161 for (cur = list; cur != NULL; cur = next) { 162 next = cur->next; 163 cond_node_destroy(cur); 164 } 165 } 166 167 void cond_policydb_destroy(struct policydb *p) 168 { 169 kfree(p->bool_val_to_struct); 170 avtab_destroy(&p->te_cond_avtab); 171 cond_list_destroy(p->cond_list); 172 } 173 174 int cond_init_bool_indexes(struct policydb *p) 175 { 176 kfree(p->bool_val_to_struct); 177 p->bool_val_to_struct = (struct cond_bool_datum**) 178 kmalloc(p->p_bools.nprim * sizeof(struct cond_bool_datum*), GFP_KERNEL); 179 if (!p->bool_val_to_struct) 180 return -1; 181 return 0; 182 } 183 184 int cond_destroy_bool(void *key, void *datum, void *p) 185 { 186 kfree(key); 187 kfree(datum); 188 return 0; 189 } 190 191 int cond_index_bool(void *key, void *datum, void *datap) 192 { 193 struct policydb *p; 194 struct cond_bool_datum *booldatum; 195 196 booldatum = datum; 197 p = datap; 198 199 if (!booldatum->value || booldatum->value > p->p_bools.nprim) 200 return -EINVAL; 201 202 p->p_bool_val_to_name[booldatum->value - 1] = key; 203 p->bool_val_to_struct[booldatum->value -1] = booldatum; 204 205 return 0; 206 } 207 208 static int bool_isvalid(struct cond_bool_datum *b) 209 { 210 if (!(b->state == 0 || b->state == 1)) 211 return 0; 212 return 1; 213 } 214 215 int cond_read_bool(struct policydb *p, struct hashtab *h, void *fp) 216 { 217 char *key = NULL; 218 struct cond_bool_datum *booldatum; 219 u32 buf[3], len; 220 int rc; 221 222 booldatum = kmalloc(sizeof(struct cond_bool_datum), GFP_KERNEL); 223 if (!booldatum) 224 return -1; 225 memset(booldatum, 0, sizeof(struct cond_bool_datum)); 226 227 rc = next_entry(buf, fp, sizeof buf); 228 if (rc < 0) 229 goto err; 230 231 booldatum->value = le32_to_cpu(buf[0]); 232 booldatum->state = le32_to_cpu(buf[1]); 233 234 if (!bool_isvalid(booldatum)) 235 goto err; 236 237 len = le32_to_cpu(buf[2]); 238 239 key = kmalloc(len + 1, GFP_KERNEL); 240 if (!key) 241 goto err; 242 rc = next_entry(key, fp, len); 243 if (rc < 0) 244 goto err; 245 key[len] = 0; 246 if (hashtab_insert(h, key, booldatum)) 247 goto err; 248 249 return 0; 250 err: 251 cond_destroy_bool(key, booldatum, NULL); 252 return -1; 253 } 254 255 static int cond_read_av_list(struct policydb *p, void *fp, struct cond_av_list **ret_list, 256 struct cond_av_list *other) 257 { 258 struct cond_av_list *list, *last = NULL, *cur; 259 struct avtab_key key; 260 struct avtab_datum datum; 261 struct avtab_node *node_ptr; 262 int rc; 263 u32 buf[1], i, len; 264 u8 found; 265 266 *ret_list = NULL; 267 268 len = 0; 269 rc = next_entry(buf, fp, sizeof buf); 270 if (rc < 0) 271 return -1; 272 273 len = le32_to_cpu(buf[0]); 274 if (len == 0) { 275 return 0; 276 } 277 278 for (i = 0; i < len; i++) { 279 if (avtab_read_item(fp, &datum, &key)) 280 goto err; 281 282 /* 283 * For type rules we have to make certain there aren't any 284 * conflicting rules by searching the te_avtab and the 285 * cond_te_avtab. 286 */ 287 if (datum.specified & AVTAB_TYPE) { 288 if (avtab_search(&p->te_avtab, &key, AVTAB_TYPE)) { 289 printk("security: type rule already exists outside of a conditional."); 290 goto err; 291 } 292 /* 293 * If we are reading the false list other will be a pointer to 294 * the true list. We can have duplicate entries if there is only 295 * 1 other entry and it is in our true list. 296 * 297 * If we are reading the true list (other == NULL) there shouldn't 298 * be any other entries. 299 */ 300 if (other) { 301 node_ptr = avtab_search_node(&p->te_cond_avtab, &key, AVTAB_TYPE); 302 if (node_ptr) { 303 if (avtab_search_node_next(node_ptr, AVTAB_TYPE)) { 304 printk("security: too many conflicting type rules."); 305 goto err; 306 } 307 found = 0; 308 for (cur = other; cur != NULL; cur = cur->next) { 309 if (cur->node == node_ptr) { 310 found = 1; 311 break; 312 } 313 } 314 if (!found) { 315 printk("security: conflicting type rules."); 316 goto err; 317 } 318 } 319 } else { 320 if (avtab_search(&p->te_cond_avtab, &key, AVTAB_TYPE)) { 321 printk("security: conflicting type rules when adding type rule for true."); 322 goto err; 323 } 324 } 325 } 326 node_ptr = avtab_insert_nonunique(&p->te_cond_avtab, &key, &datum); 327 if (!node_ptr) { 328 printk("security: could not insert rule."); 329 goto err; 330 } 331 332 list = kmalloc(sizeof(struct cond_av_list), GFP_KERNEL); 333 if (!list) 334 goto err; 335 memset(list, 0, sizeof(struct cond_av_list)); 336 337 list->node = node_ptr; 338 if (i == 0) 339 *ret_list = list; 340 else 341 last->next = list; 342 last = list; 343 344 } 345 346 return 0; 347 err: 348 cond_av_list_destroy(*ret_list); 349 *ret_list = NULL; 350 return -1; 351 } 352 353 static int expr_isvalid(struct policydb *p, struct cond_expr *expr) 354 { 355 if (expr->expr_type <= 0 || expr->expr_type > COND_LAST) { 356 printk("security: conditional expressions uses unknown operator.\n"); 357 return 0; 358 } 359 360 if (expr->bool > p->p_bools.nprim) { 361 printk("security: conditional expressions uses unknown bool.\n"); 362 return 0; 363 } 364 return 1; 365 } 366 367 static int cond_read_node(struct policydb *p, struct cond_node *node, void *fp) 368 { 369 u32 buf[2], len, i; 370 int rc; 371 struct cond_expr *expr = NULL, *last = NULL; 372 373 rc = next_entry(buf, fp, sizeof(u32)); 374 if (rc < 0) 375 return -1; 376 377 node->cur_state = le32_to_cpu(buf[0]); 378 379 len = 0; 380 rc = next_entry(buf, fp, sizeof(u32)); 381 if (rc < 0) 382 return -1; 383 384 /* expr */ 385 len = le32_to_cpu(buf[0]); 386 387 for (i = 0; i < len; i++ ) { 388 rc = next_entry(buf, fp, sizeof(u32) * 2); 389 if (rc < 0) 390 goto err; 391 392 expr = kmalloc(sizeof(struct cond_expr), GFP_KERNEL); 393 if (!expr) { 394 goto err; 395 } 396 memset(expr, 0, sizeof(struct cond_expr)); 397 398 expr->expr_type = le32_to_cpu(buf[0]); 399 expr->bool = le32_to_cpu(buf[1]); 400 401 if (!expr_isvalid(p, expr)) { 402 kfree(expr); 403 goto err; 404 } 405 406 if (i == 0) { 407 node->expr = expr; 408 } else { 409 last->next = expr; 410 } 411 last = expr; 412 } 413 414 if (cond_read_av_list(p, fp, &node->true_list, NULL) != 0) 415 goto err; 416 if (cond_read_av_list(p, fp, &node->false_list, node->true_list) != 0) 417 goto err; 418 return 0; 419 err: 420 cond_node_destroy(node); 421 return -1; 422 } 423 424 int cond_read_list(struct policydb *p, void *fp) 425 { 426 struct cond_node *node, *last = NULL; 427 u32 buf[1], i, len; 428 int rc; 429 430 rc = next_entry(buf, fp, sizeof buf); 431 if (rc < 0) 432 return -1; 433 434 len = le32_to_cpu(buf[0]); 435 436 for (i = 0; i < len; i++) { 437 node = kmalloc(sizeof(struct cond_node), GFP_KERNEL); 438 if (!node) 439 goto err; 440 memset(node, 0, sizeof(struct cond_node)); 441 442 if (cond_read_node(p, node, fp) != 0) 443 goto err; 444 445 if (i == 0) { 446 p->cond_list = node; 447 } else { 448 last->next = node; 449 } 450 last = node; 451 } 452 return 0; 453 err: 454 cond_list_destroy(p->cond_list); 455 return -1; 456 } 457 458 /* Determine whether additional permissions are granted by the conditional 459 * av table, and if so, add them to the result 460 */ 461 void cond_compute_av(struct avtab *ctab, struct avtab_key *key, struct av_decision *avd) 462 { 463 struct avtab_node *node; 464 465 if(!ctab || !key || !avd) 466 return; 467 468 for(node = avtab_search_node(ctab, key, AVTAB_AV); node != NULL; 469 node = avtab_search_node_next(node, AVTAB_AV)) { 470 if ( (__u32) (AVTAB_ALLOWED|AVTAB_ENABLED) == 471 (node->datum.specified & (AVTAB_ALLOWED|AVTAB_ENABLED))) 472 avd->allowed |= avtab_allowed(&node->datum); 473 if ( (__u32) (AVTAB_AUDITDENY|AVTAB_ENABLED) == 474 (node->datum.specified & (AVTAB_AUDITDENY|AVTAB_ENABLED))) 475 /* Since a '0' in an auditdeny mask represents a 476 * permission we do NOT want to audit (dontaudit), we use 477 * the '&' operand to ensure that all '0's in the mask 478 * are retained (much unlike the allow and auditallow cases). 479 */ 480 avd->auditdeny &= avtab_auditdeny(&node->datum); 481 if ( (__u32) (AVTAB_AUDITALLOW|AVTAB_ENABLED) == 482 (node->datum.specified & (AVTAB_AUDITALLOW|AVTAB_ENABLED))) 483 avd->auditallow |= avtab_auditallow(&node->datum); 484 } 485 return; 486 } 487