1 /* 2 * Implementation of the security services. 3 * 4 * Authors : Stephen Smalley, <sds@epoch.ncsc.mil> 5 * James Morris <jmorris@redhat.com> 6 * 7 * Updated: Trusted Computer Solutions, Inc. <dgoeddel@trustedcs.com> 8 * 9 * Support for enhanced MLS infrastructure. 10 * Support for context based audit filters. 11 * 12 * Updated: Frank Mayer <mayerf@tresys.com> and Karl MacMillan <kmacmillan@tresys.com> 13 * 14 * Added conditional policy language extensions 15 * 16 * Updated: Hewlett-Packard <paul@paul-moore.com> 17 * 18 * Added support for NetLabel 19 * Added support for the policy capability bitmap 20 * 21 * Updated: Chad Sellers <csellers@tresys.com> 22 * 23 * Added validation of kernel classes and permissions 24 * 25 * Updated: KaiGai Kohei <kaigai@ak.jp.nec.com> 26 * 27 * Added support for bounds domain and audit messaged on masked permissions 28 * 29 * Updated: Guido Trentalancia <guido@trentalancia.com> 30 * 31 * Added support for runtime switching of the policy type 32 * 33 * Copyright (C) 2008, 2009 NEC Corporation 34 * Copyright (C) 2006, 2007 Hewlett-Packard Development Company, L.P. 35 * Copyright (C) 2004-2006 Trusted Computer Solutions, Inc. 36 * Copyright (C) 2003 - 2004, 2006 Tresys Technology, LLC 37 * Copyright (C) 2003 Red Hat, Inc., James Morris <jmorris@redhat.com> 38 * This program is free software; you can redistribute it and/or modify 39 * it under the terms of the GNU General Public License as published by 40 * the Free Software Foundation, version 2. 41 */ 42 #include <linux/kernel.h> 43 #include <linux/slab.h> 44 #include <linux/string.h> 45 #include <linux/spinlock.h> 46 #include <linux/rcupdate.h> 47 #include <linux/errno.h> 48 #include <linux/in.h> 49 #include <linux/sched.h> 50 #include <linux/audit.h> 51 #include <linux/mutex.h> 52 #include <linux/selinux.h> 53 #include <linux/flex_array.h> 54 #include <linux/vmalloc.h> 55 #include <net/netlabel.h> 56 57 #include "flask.h" 58 #include "avc.h" 59 #include "avc_ss.h" 60 #include "security.h" 61 #include "context.h" 62 #include "policydb.h" 63 #include "sidtab.h" 64 #include "services.h" 65 #include "conditional.h" 66 #include "mls.h" 67 #include "objsec.h" 68 #include "netlabel.h" 69 #include "xfrm.h" 70 #include "ebitmap.h" 71 #include "audit.h" 72 73 int selinux_policycap_netpeer; 74 int selinux_policycap_openperm; 75 int selinux_policycap_alwaysnetwork; 76 77 static DEFINE_RWLOCK(policy_rwlock); 78 79 static struct sidtab sidtab; 80 struct policydb policydb; 81 int ss_initialized; 82 83 /* 84 * The largest sequence number that has been used when 85 * providing an access decision to the access vector cache. 86 * The sequence number only changes when a policy change 87 * occurs. 88 */ 89 static u32 latest_granting; 90 91 /* Forward declaration. */ 92 static int context_struct_to_string(struct context *context, char **scontext, 93 u32 *scontext_len); 94 95 static void context_struct_compute_av(struct context *scontext, 96 struct context *tcontext, 97 u16 tclass, 98 struct av_decision *avd, 99 struct extended_perms *xperms); 100 101 struct selinux_mapping { 102 u16 value; /* policy value */ 103 unsigned num_perms; 104 u32 perms[sizeof(u32) * 8]; 105 }; 106 107 static struct selinux_mapping *current_mapping; 108 static u16 current_mapping_size; 109 110 static int selinux_set_mapping(struct policydb *pol, 111 struct security_class_mapping *map, 112 struct selinux_mapping **out_map_p, 113 u16 *out_map_size) 114 { 115 struct selinux_mapping *out_map = NULL; 116 size_t size = sizeof(struct selinux_mapping); 117 u16 i, j; 118 unsigned k; 119 bool print_unknown_handle = false; 120 121 /* Find number of classes in the input mapping */ 122 if (!map) 123 return -EINVAL; 124 i = 0; 125 while (map[i].name) 126 i++; 127 128 /* Allocate space for the class records, plus one for class zero */ 129 out_map = kcalloc(++i, size, GFP_ATOMIC); 130 if (!out_map) 131 return -ENOMEM; 132 133 /* Store the raw class and permission values */ 134 j = 0; 135 while (map[j].name) { 136 struct security_class_mapping *p_in = map + (j++); 137 struct selinux_mapping *p_out = out_map + j; 138 139 /* An empty class string skips ahead */ 140 if (!strcmp(p_in->name, "")) { 141 p_out->num_perms = 0; 142 continue; 143 } 144 145 p_out->value = string_to_security_class(pol, p_in->name); 146 if (!p_out->value) { 147 printk(KERN_INFO 148 "SELinux: Class %s not defined in policy.\n", 149 p_in->name); 150 if (pol->reject_unknown) 151 goto err; 152 p_out->num_perms = 0; 153 print_unknown_handle = true; 154 continue; 155 } 156 157 k = 0; 158 while (p_in->perms && p_in->perms[k]) { 159 /* An empty permission string skips ahead */ 160 if (!*p_in->perms[k]) { 161 k++; 162 continue; 163 } 164 p_out->perms[k] = string_to_av_perm(pol, p_out->value, 165 p_in->perms[k]); 166 if (!p_out->perms[k]) { 167 printk(KERN_INFO 168 "SELinux: Permission %s in class %s not defined in policy.\n", 169 p_in->perms[k], p_in->name); 170 if (pol->reject_unknown) 171 goto err; 172 print_unknown_handle = true; 173 } 174 175 k++; 176 } 177 p_out->num_perms = k; 178 } 179 180 if (print_unknown_handle) 181 printk(KERN_INFO "SELinux: the above unknown classes and permissions will be %s\n", 182 pol->allow_unknown ? "allowed" : "denied"); 183 184 *out_map_p = out_map; 185 *out_map_size = i; 186 return 0; 187 err: 188 kfree(out_map); 189 return -EINVAL; 190 } 191 192 /* 193 * Get real, policy values from mapped values 194 */ 195 196 static u16 unmap_class(u16 tclass) 197 { 198 if (tclass < current_mapping_size) 199 return current_mapping[tclass].value; 200 201 return tclass; 202 } 203 204 /* 205 * Get kernel value for class from its policy value 206 */ 207 static u16 map_class(u16 pol_value) 208 { 209 u16 i; 210 211 for (i = 1; i < current_mapping_size; i++) { 212 if (current_mapping[i].value == pol_value) 213 return i; 214 } 215 216 return SECCLASS_NULL; 217 } 218 219 static void map_decision(u16 tclass, struct av_decision *avd, 220 int allow_unknown) 221 { 222 if (tclass < current_mapping_size) { 223 unsigned i, n = current_mapping[tclass].num_perms; 224 u32 result; 225 226 for (i = 0, result = 0; i < n; i++) { 227 if (avd->allowed & current_mapping[tclass].perms[i]) 228 result |= 1<<i; 229 if (allow_unknown && !current_mapping[tclass].perms[i]) 230 result |= 1<<i; 231 } 232 avd->allowed = result; 233 234 for (i = 0, result = 0; i < n; i++) 235 if (avd->auditallow & current_mapping[tclass].perms[i]) 236 result |= 1<<i; 237 avd->auditallow = result; 238 239 for (i = 0, result = 0; i < n; i++) { 240 if (avd->auditdeny & current_mapping[tclass].perms[i]) 241 result |= 1<<i; 242 if (!allow_unknown && !current_mapping[tclass].perms[i]) 243 result |= 1<<i; 244 } 245 /* 246 * In case the kernel has a bug and requests a permission 247 * between num_perms and the maximum permission number, we 248 * should audit that denial 249 */ 250 for (; i < (sizeof(u32)*8); i++) 251 result |= 1<<i; 252 avd->auditdeny = result; 253 } 254 } 255 256 int security_mls_enabled(void) 257 { 258 return policydb.mls_enabled; 259 } 260 261 /* 262 * Return the boolean value of a constraint expression 263 * when it is applied to the specified source and target 264 * security contexts. 265 * 266 * xcontext is a special beast... It is used by the validatetrans rules 267 * only. For these rules, scontext is the context before the transition, 268 * tcontext is the context after the transition, and xcontext is the context 269 * of the process performing the transition. All other callers of 270 * constraint_expr_eval should pass in NULL for xcontext. 271 */ 272 static int constraint_expr_eval(struct context *scontext, 273 struct context *tcontext, 274 struct context *xcontext, 275 struct constraint_expr *cexpr) 276 { 277 u32 val1, val2; 278 struct context *c; 279 struct role_datum *r1, *r2; 280 struct mls_level *l1, *l2; 281 struct constraint_expr *e; 282 int s[CEXPR_MAXDEPTH]; 283 int sp = -1; 284 285 for (e = cexpr; e; e = e->next) { 286 switch (e->expr_type) { 287 case CEXPR_NOT: 288 BUG_ON(sp < 0); 289 s[sp] = !s[sp]; 290 break; 291 case CEXPR_AND: 292 BUG_ON(sp < 1); 293 sp--; 294 s[sp] &= s[sp + 1]; 295 break; 296 case CEXPR_OR: 297 BUG_ON(sp < 1); 298 sp--; 299 s[sp] |= s[sp + 1]; 300 break; 301 case CEXPR_ATTR: 302 if (sp == (CEXPR_MAXDEPTH - 1)) 303 return 0; 304 switch (e->attr) { 305 case CEXPR_USER: 306 val1 = scontext->user; 307 val2 = tcontext->user; 308 break; 309 case CEXPR_TYPE: 310 val1 = scontext->type; 311 val2 = tcontext->type; 312 break; 313 case CEXPR_ROLE: 314 val1 = scontext->role; 315 val2 = tcontext->role; 316 r1 = policydb.role_val_to_struct[val1 - 1]; 317 r2 = policydb.role_val_to_struct[val2 - 1]; 318 switch (e->op) { 319 case CEXPR_DOM: 320 s[++sp] = ebitmap_get_bit(&r1->dominates, 321 val2 - 1); 322 continue; 323 case CEXPR_DOMBY: 324 s[++sp] = ebitmap_get_bit(&r2->dominates, 325 val1 - 1); 326 continue; 327 case CEXPR_INCOMP: 328 s[++sp] = (!ebitmap_get_bit(&r1->dominates, 329 val2 - 1) && 330 !ebitmap_get_bit(&r2->dominates, 331 val1 - 1)); 332 continue; 333 default: 334 break; 335 } 336 break; 337 case CEXPR_L1L2: 338 l1 = &(scontext->range.level[0]); 339 l2 = &(tcontext->range.level[0]); 340 goto mls_ops; 341 case CEXPR_L1H2: 342 l1 = &(scontext->range.level[0]); 343 l2 = &(tcontext->range.level[1]); 344 goto mls_ops; 345 case CEXPR_H1L2: 346 l1 = &(scontext->range.level[1]); 347 l2 = &(tcontext->range.level[0]); 348 goto mls_ops; 349 case CEXPR_H1H2: 350 l1 = &(scontext->range.level[1]); 351 l2 = &(tcontext->range.level[1]); 352 goto mls_ops; 353 case CEXPR_L1H1: 354 l1 = &(scontext->range.level[0]); 355 l2 = &(scontext->range.level[1]); 356 goto mls_ops; 357 case CEXPR_L2H2: 358 l1 = &(tcontext->range.level[0]); 359 l2 = &(tcontext->range.level[1]); 360 goto mls_ops; 361 mls_ops: 362 switch (e->op) { 363 case CEXPR_EQ: 364 s[++sp] = mls_level_eq(l1, l2); 365 continue; 366 case CEXPR_NEQ: 367 s[++sp] = !mls_level_eq(l1, l2); 368 continue; 369 case CEXPR_DOM: 370 s[++sp] = mls_level_dom(l1, l2); 371 continue; 372 case CEXPR_DOMBY: 373 s[++sp] = mls_level_dom(l2, l1); 374 continue; 375 case CEXPR_INCOMP: 376 s[++sp] = mls_level_incomp(l2, l1); 377 continue; 378 default: 379 BUG(); 380 return 0; 381 } 382 break; 383 default: 384 BUG(); 385 return 0; 386 } 387 388 switch (e->op) { 389 case CEXPR_EQ: 390 s[++sp] = (val1 == val2); 391 break; 392 case CEXPR_NEQ: 393 s[++sp] = (val1 != val2); 394 break; 395 default: 396 BUG(); 397 return 0; 398 } 399 break; 400 case CEXPR_NAMES: 401 if (sp == (CEXPR_MAXDEPTH-1)) 402 return 0; 403 c = scontext; 404 if (e->attr & CEXPR_TARGET) 405 c = tcontext; 406 else if (e->attr & CEXPR_XTARGET) { 407 c = xcontext; 408 if (!c) { 409 BUG(); 410 return 0; 411 } 412 } 413 if (e->attr & CEXPR_USER) 414 val1 = c->user; 415 else if (e->attr & CEXPR_ROLE) 416 val1 = c->role; 417 else if (e->attr & CEXPR_TYPE) 418 val1 = c->type; 419 else { 420 BUG(); 421 return 0; 422 } 423 424 switch (e->op) { 425 case CEXPR_EQ: 426 s[++sp] = ebitmap_get_bit(&e->names, val1 - 1); 427 break; 428 case CEXPR_NEQ: 429 s[++sp] = !ebitmap_get_bit(&e->names, val1 - 1); 430 break; 431 default: 432 BUG(); 433 return 0; 434 } 435 break; 436 default: 437 BUG(); 438 return 0; 439 } 440 } 441 442 BUG_ON(sp != 0); 443 return s[0]; 444 } 445 446 /* 447 * security_dump_masked_av - dumps masked permissions during 448 * security_compute_av due to RBAC, MLS/Constraint and Type bounds. 449 */ 450 static int dump_masked_av_helper(void *k, void *d, void *args) 451 { 452 struct perm_datum *pdatum = d; 453 char **permission_names = args; 454 455 BUG_ON(pdatum->value < 1 || pdatum->value > 32); 456 457 permission_names[pdatum->value - 1] = (char *)k; 458 459 return 0; 460 } 461 462 static void security_dump_masked_av(struct context *scontext, 463 struct context *tcontext, 464 u16 tclass, 465 u32 permissions, 466 const char *reason) 467 { 468 struct common_datum *common_dat; 469 struct class_datum *tclass_dat; 470 struct audit_buffer *ab; 471 char *tclass_name; 472 char *scontext_name = NULL; 473 char *tcontext_name = NULL; 474 char *permission_names[32]; 475 int index; 476 u32 length; 477 bool need_comma = false; 478 479 if (!permissions) 480 return; 481 482 tclass_name = sym_name(&policydb, SYM_CLASSES, tclass - 1); 483 tclass_dat = policydb.class_val_to_struct[tclass - 1]; 484 common_dat = tclass_dat->comdatum; 485 486 /* init permission_names */ 487 if (common_dat && 488 hashtab_map(common_dat->permissions.table, 489 dump_masked_av_helper, permission_names) < 0) 490 goto out; 491 492 if (hashtab_map(tclass_dat->permissions.table, 493 dump_masked_av_helper, permission_names) < 0) 494 goto out; 495 496 /* get scontext/tcontext in text form */ 497 if (context_struct_to_string(scontext, 498 &scontext_name, &length) < 0) 499 goto out; 500 501 if (context_struct_to_string(tcontext, 502 &tcontext_name, &length) < 0) 503 goto out; 504 505 /* audit a message */ 506 ab = audit_log_start(current->audit_context, 507 GFP_ATOMIC, AUDIT_SELINUX_ERR); 508 if (!ab) 509 goto out; 510 511 audit_log_format(ab, "op=security_compute_av reason=%s " 512 "scontext=%s tcontext=%s tclass=%s perms=", 513 reason, scontext_name, tcontext_name, tclass_name); 514 515 for (index = 0; index < 32; index++) { 516 u32 mask = (1 << index); 517 518 if ((mask & permissions) == 0) 519 continue; 520 521 audit_log_format(ab, "%s%s", 522 need_comma ? "," : "", 523 permission_names[index] 524 ? permission_names[index] : "????"); 525 need_comma = true; 526 } 527 audit_log_end(ab); 528 out: 529 /* release scontext/tcontext */ 530 kfree(tcontext_name); 531 kfree(scontext_name); 532 533 return; 534 } 535 536 /* 537 * security_boundary_permission - drops violated permissions 538 * on boundary constraint. 539 */ 540 static void type_attribute_bounds_av(struct context *scontext, 541 struct context *tcontext, 542 u16 tclass, 543 struct av_decision *avd) 544 { 545 struct context lo_scontext; 546 struct context lo_tcontext; 547 struct av_decision lo_avd; 548 struct type_datum *source; 549 struct type_datum *target; 550 u32 masked = 0; 551 552 source = flex_array_get_ptr(policydb.type_val_to_struct_array, 553 scontext->type - 1); 554 BUG_ON(!source); 555 556 target = flex_array_get_ptr(policydb.type_val_to_struct_array, 557 tcontext->type - 1); 558 BUG_ON(!target); 559 560 if (source->bounds) { 561 memset(&lo_avd, 0, sizeof(lo_avd)); 562 563 memcpy(&lo_scontext, scontext, sizeof(lo_scontext)); 564 lo_scontext.type = source->bounds; 565 566 context_struct_compute_av(&lo_scontext, 567 tcontext, 568 tclass, 569 &lo_avd, 570 NULL); 571 if ((lo_avd.allowed & avd->allowed) == avd->allowed) 572 return; /* no masked permission */ 573 masked = ~lo_avd.allowed & avd->allowed; 574 } 575 576 if (target->bounds) { 577 memset(&lo_avd, 0, sizeof(lo_avd)); 578 579 memcpy(&lo_tcontext, tcontext, sizeof(lo_tcontext)); 580 lo_tcontext.type = target->bounds; 581 582 context_struct_compute_av(scontext, 583 &lo_tcontext, 584 tclass, 585 &lo_avd, 586 NULL); 587 if ((lo_avd.allowed & avd->allowed) == avd->allowed) 588 return; /* no masked permission */ 589 masked = ~lo_avd.allowed & avd->allowed; 590 } 591 592 if (source->bounds && target->bounds) { 593 memset(&lo_avd, 0, sizeof(lo_avd)); 594 /* 595 * lo_scontext and lo_tcontext are already 596 * set up. 597 */ 598 599 context_struct_compute_av(&lo_scontext, 600 &lo_tcontext, 601 tclass, 602 &lo_avd, 603 NULL); 604 if ((lo_avd.allowed & avd->allowed) == avd->allowed) 605 return; /* no masked permission */ 606 masked = ~lo_avd.allowed & avd->allowed; 607 } 608 609 if (masked) { 610 /* mask violated permissions */ 611 avd->allowed &= ~masked; 612 613 /* audit masked permissions */ 614 security_dump_masked_av(scontext, tcontext, 615 tclass, masked, "bounds"); 616 } 617 } 618 619 /* 620 * flag which drivers have permissions 621 * only looking for ioctl based extended permssions 622 */ 623 void services_compute_xperms_drivers( 624 struct extended_perms *xperms, 625 struct avtab_node *node) 626 { 627 unsigned int i; 628 629 if (node->datum.u.xperms->specified == AVTAB_XPERMS_IOCTLDRIVER) { 630 /* if one or more driver has all permissions allowed */ 631 for (i = 0; i < ARRAY_SIZE(xperms->drivers.p); i++) 632 xperms->drivers.p[i] |= node->datum.u.xperms->perms.p[i]; 633 } else if (node->datum.u.xperms->specified == AVTAB_XPERMS_IOCTLFUNCTION) { 634 /* if allowing permissions within a driver */ 635 security_xperm_set(xperms->drivers.p, 636 node->datum.u.xperms->driver); 637 } 638 639 /* If no ioctl commands are allowed, ignore auditallow and auditdeny */ 640 if (node->key.specified & AVTAB_XPERMS_ALLOWED) 641 xperms->len = 1; 642 } 643 644 /* 645 * Compute access vectors and extended permissions based on a context 646 * structure pair for the permissions in a particular class. 647 */ 648 static void context_struct_compute_av(struct context *scontext, 649 struct context *tcontext, 650 u16 tclass, 651 struct av_decision *avd, 652 struct extended_perms *xperms) 653 { 654 struct constraint_node *constraint; 655 struct role_allow *ra; 656 struct avtab_key avkey; 657 struct avtab_node *node; 658 struct class_datum *tclass_datum; 659 struct ebitmap *sattr, *tattr; 660 struct ebitmap_node *snode, *tnode; 661 unsigned int i, j; 662 663 avd->allowed = 0; 664 avd->auditallow = 0; 665 avd->auditdeny = 0xffffffff; 666 if (xperms) { 667 memset(&xperms->drivers, 0, sizeof(xperms->drivers)); 668 xperms->len = 0; 669 } 670 671 if (unlikely(!tclass || tclass > policydb.p_classes.nprim)) { 672 if (printk_ratelimit()) 673 printk(KERN_WARNING "SELinux: Invalid class %hu\n", tclass); 674 return; 675 } 676 677 tclass_datum = policydb.class_val_to_struct[tclass - 1]; 678 679 /* 680 * If a specific type enforcement rule was defined for 681 * this permission check, then use it. 682 */ 683 avkey.target_class = tclass; 684 avkey.specified = AVTAB_AV | AVTAB_XPERMS; 685 sattr = flex_array_get(policydb.type_attr_map_array, scontext->type - 1); 686 BUG_ON(!sattr); 687 tattr = flex_array_get(policydb.type_attr_map_array, tcontext->type - 1); 688 BUG_ON(!tattr); 689 ebitmap_for_each_positive_bit(sattr, snode, i) { 690 ebitmap_for_each_positive_bit(tattr, tnode, j) { 691 avkey.source_type = i + 1; 692 avkey.target_type = j + 1; 693 for (node = avtab_search_node(&policydb.te_avtab, &avkey); 694 node; 695 node = avtab_search_node_next(node, avkey.specified)) { 696 if (node->key.specified == AVTAB_ALLOWED) 697 avd->allowed |= node->datum.u.data; 698 else if (node->key.specified == AVTAB_AUDITALLOW) 699 avd->auditallow |= node->datum.u.data; 700 else if (node->key.specified == AVTAB_AUDITDENY) 701 avd->auditdeny &= node->datum.u.data; 702 else if (xperms && (node->key.specified & AVTAB_XPERMS)) 703 services_compute_xperms_drivers(xperms, node); 704 } 705 706 /* Check conditional av table for additional permissions */ 707 cond_compute_av(&policydb.te_cond_avtab, &avkey, 708 avd, xperms); 709 710 } 711 } 712 713 /* 714 * Remove any permissions prohibited by a constraint (this includes 715 * the MLS policy). 716 */ 717 constraint = tclass_datum->constraints; 718 while (constraint) { 719 if ((constraint->permissions & (avd->allowed)) && 720 !constraint_expr_eval(scontext, tcontext, NULL, 721 constraint->expr)) { 722 avd->allowed &= ~(constraint->permissions); 723 } 724 constraint = constraint->next; 725 } 726 727 /* 728 * If checking process transition permission and the 729 * role is changing, then check the (current_role, new_role) 730 * pair. 731 */ 732 if (tclass == policydb.process_class && 733 (avd->allowed & policydb.process_trans_perms) && 734 scontext->role != tcontext->role) { 735 for (ra = policydb.role_allow; ra; ra = ra->next) { 736 if (scontext->role == ra->role && 737 tcontext->role == ra->new_role) 738 break; 739 } 740 if (!ra) 741 avd->allowed &= ~policydb.process_trans_perms; 742 } 743 744 /* 745 * If the given source and target types have boundary 746 * constraint, lazy checks have to mask any violated 747 * permission and notice it to userspace via audit. 748 */ 749 type_attribute_bounds_av(scontext, tcontext, 750 tclass, avd); 751 } 752 753 static int security_validtrans_handle_fail(struct context *ocontext, 754 struct context *ncontext, 755 struct context *tcontext, 756 u16 tclass) 757 { 758 char *o = NULL, *n = NULL, *t = NULL; 759 u32 olen, nlen, tlen; 760 761 if (context_struct_to_string(ocontext, &o, &olen)) 762 goto out; 763 if (context_struct_to_string(ncontext, &n, &nlen)) 764 goto out; 765 if (context_struct_to_string(tcontext, &t, &tlen)) 766 goto out; 767 audit_log(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR, 768 "op=security_validate_transition seresult=denied" 769 " oldcontext=%s newcontext=%s taskcontext=%s tclass=%s", 770 o, n, t, sym_name(&policydb, SYM_CLASSES, tclass-1)); 771 out: 772 kfree(o); 773 kfree(n); 774 kfree(t); 775 776 if (!selinux_enforcing) 777 return 0; 778 return -EPERM; 779 } 780 781 int security_validate_transition(u32 oldsid, u32 newsid, u32 tasksid, 782 u16 orig_tclass) 783 { 784 struct context *ocontext; 785 struct context *ncontext; 786 struct context *tcontext; 787 struct class_datum *tclass_datum; 788 struct constraint_node *constraint; 789 u16 tclass; 790 int rc = 0; 791 792 if (!ss_initialized) 793 return 0; 794 795 read_lock(&policy_rwlock); 796 797 tclass = unmap_class(orig_tclass); 798 799 if (!tclass || tclass > policydb.p_classes.nprim) { 800 printk(KERN_ERR "SELinux: %s: unrecognized class %d\n", 801 __func__, tclass); 802 rc = -EINVAL; 803 goto out; 804 } 805 tclass_datum = policydb.class_val_to_struct[tclass - 1]; 806 807 ocontext = sidtab_search(&sidtab, oldsid); 808 if (!ocontext) { 809 printk(KERN_ERR "SELinux: %s: unrecognized SID %d\n", 810 __func__, oldsid); 811 rc = -EINVAL; 812 goto out; 813 } 814 815 ncontext = sidtab_search(&sidtab, newsid); 816 if (!ncontext) { 817 printk(KERN_ERR "SELinux: %s: unrecognized SID %d\n", 818 __func__, newsid); 819 rc = -EINVAL; 820 goto out; 821 } 822 823 tcontext = sidtab_search(&sidtab, tasksid); 824 if (!tcontext) { 825 printk(KERN_ERR "SELinux: %s: unrecognized SID %d\n", 826 __func__, tasksid); 827 rc = -EINVAL; 828 goto out; 829 } 830 831 constraint = tclass_datum->validatetrans; 832 while (constraint) { 833 if (!constraint_expr_eval(ocontext, ncontext, tcontext, 834 constraint->expr)) { 835 rc = security_validtrans_handle_fail(ocontext, ncontext, 836 tcontext, tclass); 837 goto out; 838 } 839 constraint = constraint->next; 840 } 841 842 out: 843 read_unlock(&policy_rwlock); 844 return rc; 845 } 846 847 /* 848 * security_bounded_transition - check whether the given 849 * transition is directed to bounded, or not. 850 * It returns 0, if @newsid is bounded by @oldsid. 851 * Otherwise, it returns error code. 852 * 853 * @oldsid : current security identifier 854 * @newsid : destinated security identifier 855 */ 856 int security_bounded_transition(u32 old_sid, u32 new_sid) 857 { 858 struct context *old_context, *new_context; 859 struct type_datum *type; 860 int index; 861 int rc; 862 863 read_lock(&policy_rwlock); 864 865 rc = -EINVAL; 866 old_context = sidtab_search(&sidtab, old_sid); 867 if (!old_context) { 868 printk(KERN_ERR "SELinux: %s: unrecognized SID %u\n", 869 __func__, old_sid); 870 goto out; 871 } 872 873 rc = -EINVAL; 874 new_context = sidtab_search(&sidtab, new_sid); 875 if (!new_context) { 876 printk(KERN_ERR "SELinux: %s: unrecognized SID %u\n", 877 __func__, new_sid); 878 goto out; 879 } 880 881 rc = 0; 882 /* type/domain unchanged */ 883 if (old_context->type == new_context->type) 884 goto out; 885 886 index = new_context->type; 887 while (true) { 888 type = flex_array_get_ptr(policydb.type_val_to_struct_array, 889 index - 1); 890 BUG_ON(!type); 891 892 /* not bounded anymore */ 893 rc = -EPERM; 894 if (!type->bounds) 895 break; 896 897 /* @newsid is bounded by @oldsid */ 898 rc = 0; 899 if (type->bounds == old_context->type) 900 break; 901 902 index = type->bounds; 903 } 904 905 if (rc) { 906 char *old_name = NULL; 907 char *new_name = NULL; 908 u32 length; 909 910 if (!context_struct_to_string(old_context, 911 &old_name, &length) && 912 !context_struct_to_string(new_context, 913 &new_name, &length)) { 914 audit_log(current->audit_context, 915 GFP_ATOMIC, AUDIT_SELINUX_ERR, 916 "op=security_bounded_transition " 917 "seresult=denied " 918 "oldcontext=%s newcontext=%s", 919 old_name, new_name); 920 } 921 kfree(new_name); 922 kfree(old_name); 923 } 924 out: 925 read_unlock(&policy_rwlock); 926 927 return rc; 928 } 929 930 static void avd_init(struct av_decision *avd) 931 { 932 avd->allowed = 0; 933 avd->auditallow = 0; 934 avd->auditdeny = 0xffffffff; 935 avd->seqno = latest_granting; 936 avd->flags = 0; 937 } 938 939 void services_compute_xperms_decision(struct extended_perms_decision *xpermd, 940 struct avtab_node *node) 941 { 942 unsigned int i; 943 944 if (node->datum.u.xperms->specified == AVTAB_XPERMS_IOCTLFUNCTION) { 945 if (xpermd->driver != node->datum.u.xperms->driver) 946 return; 947 } else if (node->datum.u.xperms->specified == AVTAB_XPERMS_IOCTLDRIVER) { 948 if (!security_xperm_test(node->datum.u.xperms->perms.p, 949 xpermd->driver)) 950 return; 951 } else { 952 BUG(); 953 } 954 955 if (node->key.specified == AVTAB_XPERMS_ALLOWED) { 956 xpermd->used |= XPERMS_ALLOWED; 957 if (node->datum.u.xperms->specified == AVTAB_XPERMS_IOCTLDRIVER) { 958 memset(xpermd->allowed->p, 0xff, 959 sizeof(xpermd->allowed->p)); 960 } 961 if (node->datum.u.xperms->specified == AVTAB_XPERMS_IOCTLFUNCTION) { 962 for (i = 0; i < ARRAY_SIZE(xpermd->allowed->p); i++) 963 xpermd->allowed->p[i] |= 964 node->datum.u.xperms->perms.p[i]; 965 } 966 } else if (node->key.specified == AVTAB_XPERMS_AUDITALLOW) { 967 xpermd->used |= XPERMS_AUDITALLOW; 968 if (node->datum.u.xperms->specified == AVTAB_XPERMS_IOCTLDRIVER) { 969 memset(xpermd->auditallow->p, 0xff, 970 sizeof(xpermd->auditallow->p)); 971 } 972 if (node->datum.u.xperms->specified == AVTAB_XPERMS_IOCTLFUNCTION) { 973 for (i = 0; i < ARRAY_SIZE(xpermd->auditallow->p); i++) 974 xpermd->auditallow->p[i] |= 975 node->datum.u.xperms->perms.p[i]; 976 } 977 } else if (node->key.specified == AVTAB_XPERMS_DONTAUDIT) { 978 xpermd->used |= XPERMS_DONTAUDIT; 979 if (node->datum.u.xperms->specified == AVTAB_XPERMS_IOCTLDRIVER) { 980 memset(xpermd->dontaudit->p, 0xff, 981 sizeof(xpermd->dontaudit->p)); 982 } 983 if (node->datum.u.xperms->specified == AVTAB_XPERMS_IOCTLFUNCTION) { 984 for (i = 0; i < ARRAY_SIZE(xpermd->dontaudit->p); i++) 985 xpermd->dontaudit->p[i] |= 986 node->datum.u.xperms->perms.p[i]; 987 } 988 } else { 989 BUG(); 990 } 991 } 992 993 void security_compute_xperms_decision(u32 ssid, 994 u32 tsid, 995 u16 orig_tclass, 996 u8 driver, 997 struct extended_perms_decision *xpermd) 998 { 999 u16 tclass; 1000 struct context *scontext, *tcontext; 1001 struct avtab_key avkey; 1002 struct avtab_node *node; 1003 struct ebitmap *sattr, *tattr; 1004 struct ebitmap_node *snode, *tnode; 1005 unsigned int i, j; 1006 1007 xpermd->driver = driver; 1008 xpermd->used = 0; 1009 memset(xpermd->allowed->p, 0, sizeof(xpermd->allowed->p)); 1010 memset(xpermd->auditallow->p, 0, sizeof(xpermd->auditallow->p)); 1011 memset(xpermd->dontaudit->p, 0, sizeof(xpermd->dontaudit->p)); 1012 1013 read_lock(&policy_rwlock); 1014 if (!ss_initialized) 1015 goto allow; 1016 1017 scontext = sidtab_search(&sidtab, ssid); 1018 if (!scontext) { 1019 printk(KERN_ERR "SELinux: %s: unrecognized SID %d\n", 1020 __func__, ssid); 1021 goto out; 1022 } 1023 1024 tcontext = sidtab_search(&sidtab, tsid); 1025 if (!tcontext) { 1026 printk(KERN_ERR "SELinux: %s: unrecognized SID %d\n", 1027 __func__, tsid); 1028 goto out; 1029 } 1030 1031 tclass = unmap_class(orig_tclass); 1032 if (unlikely(orig_tclass && !tclass)) { 1033 if (policydb.allow_unknown) 1034 goto allow; 1035 goto out; 1036 } 1037 1038 1039 if (unlikely(!tclass || tclass > policydb.p_classes.nprim)) { 1040 pr_warn_ratelimited("SELinux: Invalid class %hu\n", tclass); 1041 goto out; 1042 } 1043 1044 avkey.target_class = tclass; 1045 avkey.specified = AVTAB_XPERMS; 1046 sattr = flex_array_get(policydb.type_attr_map_array, 1047 scontext->type - 1); 1048 BUG_ON(!sattr); 1049 tattr = flex_array_get(policydb.type_attr_map_array, 1050 tcontext->type - 1); 1051 BUG_ON(!tattr); 1052 ebitmap_for_each_positive_bit(sattr, snode, i) { 1053 ebitmap_for_each_positive_bit(tattr, tnode, j) { 1054 avkey.source_type = i + 1; 1055 avkey.target_type = j + 1; 1056 for (node = avtab_search_node(&policydb.te_avtab, &avkey); 1057 node; 1058 node = avtab_search_node_next(node, avkey.specified)) 1059 services_compute_xperms_decision(xpermd, node); 1060 1061 cond_compute_xperms(&policydb.te_cond_avtab, 1062 &avkey, xpermd); 1063 } 1064 } 1065 out: 1066 read_unlock(&policy_rwlock); 1067 return; 1068 allow: 1069 memset(xpermd->allowed->p, 0xff, sizeof(xpermd->allowed->p)); 1070 goto out; 1071 } 1072 1073 /** 1074 * security_compute_av - Compute access vector decisions. 1075 * @ssid: source security identifier 1076 * @tsid: target security identifier 1077 * @tclass: target security class 1078 * @avd: access vector decisions 1079 * @xperms: extended permissions 1080 * 1081 * Compute a set of access vector decisions based on the 1082 * SID pair (@ssid, @tsid) for the permissions in @tclass. 1083 */ 1084 void security_compute_av(u32 ssid, 1085 u32 tsid, 1086 u16 orig_tclass, 1087 struct av_decision *avd, 1088 struct extended_perms *xperms) 1089 { 1090 u16 tclass; 1091 struct context *scontext = NULL, *tcontext = NULL; 1092 1093 read_lock(&policy_rwlock); 1094 avd_init(avd); 1095 xperms->len = 0; 1096 if (!ss_initialized) 1097 goto allow; 1098 1099 scontext = sidtab_search(&sidtab, ssid); 1100 if (!scontext) { 1101 printk(KERN_ERR "SELinux: %s: unrecognized SID %d\n", 1102 __func__, ssid); 1103 goto out; 1104 } 1105 1106 /* permissive domain? */ 1107 if (ebitmap_get_bit(&policydb.permissive_map, scontext->type)) 1108 avd->flags |= AVD_FLAGS_PERMISSIVE; 1109 1110 tcontext = sidtab_search(&sidtab, tsid); 1111 if (!tcontext) { 1112 printk(KERN_ERR "SELinux: %s: unrecognized SID %d\n", 1113 __func__, tsid); 1114 goto out; 1115 } 1116 1117 tclass = unmap_class(orig_tclass); 1118 if (unlikely(orig_tclass && !tclass)) { 1119 if (policydb.allow_unknown) 1120 goto allow; 1121 goto out; 1122 } 1123 context_struct_compute_av(scontext, tcontext, tclass, avd, xperms); 1124 map_decision(orig_tclass, avd, policydb.allow_unknown); 1125 out: 1126 read_unlock(&policy_rwlock); 1127 return; 1128 allow: 1129 avd->allowed = 0xffffffff; 1130 goto out; 1131 } 1132 1133 void security_compute_av_user(u32 ssid, 1134 u32 tsid, 1135 u16 tclass, 1136 struct av_decision *avd) 1137 { 1138 struct context *scontext = NULL, *tcontext = NULL; 1139 1140 read_lock(&policy_rwlock); 1141 avd_init(avd); 1142 if (!ss_initialized) 1143 goto allow; 1144 1145 scontext = sidtab_search(&sidtab, ssid); 1146 if (!scontext) { 1147 printk(KERN_ERR "SELinux: %s: unrecognized SID %d\n", 1148 __func__, ssid); 1149 goto out; 1150 } 1151 1152 /* permissive domain? */ 1153 if (ebitmap_get_bit(&policydb.permissive_map, scontext->type)) 1154 avd->flags |= AVD_FLAGS_PERMISSIVE; 1155 1156 tcontext = sidtab_search(&sidtab, tsid); 1157 if (!tcontext) { 1158 printk(KERN_ERR "SELinux: %s: unrecognized SID %d\n", 1159 __func__, tsid); 1160 goto out; 1161 } 1162 1163 if (unlikely(!tclass)) { 1164 if (policydb.allow_unknown) 1165 goto allow; 1166 goto out; 1167 } 1168 1169 context_struct_compute_av(scontext, tcontext, tclass, avd, NULL); 1170 out: 1171 read_unlock(&policy_rwlock); 1172 return; 1173 allow: 1174 avd->allowed = 0xffffffff; 1175 goto out; 1176 } 1177 1178 /* 1179 * Write the security context string representation of 1180 * the context structure `context' into a dynamically 1181 * allocated string of the correct size. Set `*scontext' 1182 * to point to this string and set `*scontext_len' to 1183 * the length of the string. 1184 */ 1185 static int context_struct_to_string(struct context *context, char **scontext, u32 *scontext_len) 1186 { 1187 char *scontextp; 1188 1189 if (scontext) 1190 *scontext = NULL; 1191 *scontext_len = 0; 1192 1193 if (context->len) { 1194 *scontext_len = context->len; 1195 if (scontext) { 1196 *scontext = kstrdup(context->str, GFP_ATOMIC); 1197 if (!(*scontext)) 1198 return -ENOMEM; 1199 } 1200 return 0; 1201 } 1202 1203 /* Compute the size of the context. */ 1204 *scontext_len += strlen(sym_name(&policydb, SYM_USERS, context->user - 1)) + 1; 1205 *scontext_len += strlen(sym_name(&policydb, SYM_ROLES, context->role - 1)) + 1; 1206 *scontext_len += strlen(sym_name(&policydb, SYM_TYPES, context->type - 1)) + 1; 1207 *scontext_len += mls_compute_context_len(context); 1208 1209 if (!scontext) 1210 return 0; 1211 1212 /* Allocate space for the context; caller must free this space. */ 1213 scontextp = kmalloc(*scontext_len, GFP_ATOMIC); 1214 if (!scontextp) 1215 return -ENOMEM; 1216 *scontext = scontextp; 1217 1218 /* 1219 * Copy the user name, role name and type name into the context. 1220 */ 1221 sprintf(scontextp, "%s:%s:%s", 1222 sym_name(&policydb, SYM_USERS, context->user - 1), 1223 sym_name(&policydb, SYM_ROLES, context->role - 1), 1224 sym_name(&policydb, SYM_TYPES, context->type - 1)); 1225 scontextp += strlen(sym_name(&policydb, SYM_USERS, context->user - 1)) + 1226 1 + strlen(sym_name(&policydb, SYM_ROLES, context->role - 1)) + 1227 1 + strlen(sym_name(&policydb, SYM_TYPES, context->type - 1)); 1228 1229 mls_sid_to_context(context, &scontextp); 1230 1231 *scontextp = 0; 1232 1233 return 0; 1234 } 1235 1236 #include "initial_sid_to_string.h" 1237 1238 const char *security_get_initial_sid_context(u32 sid) 1239 { 1240 if (unlikely(sid > SECINITSID_NUM)) 1241 return NULL; 1242 return initial_sid_to_string[sid]; 1243 } 1244 1245 static int security_sid_to_context_core(u32 sid, char **scontext, 1246 u32 *scontext_len, int force) 1247 { 1248 struct context *context; 1249 int rc = 0; 1250 1251 if (scontext) 1252 *scontext = NULL; 1253 *scontext_len = 0; 1254 1255 if (!ss_initialized) { 1256 if (sid <= SECINITSID_NUM) { 1257 char *scontextp; 1258 1259 *scontext_len = strlen(initial_sid_to_string[sid]) + 1; 1260 if (!scontext) 1261 goto out; 1262 scontextp = kmalloc(*scontext_len, GFP_ATOMIC); 1263 if (!scontextp) { 1264 rc = -ENOMEM; 1265 goto out; 1266 } 1267 strcpy(scontextp, initial_sid_to_string[sid]); 1268 *scontext = scontextp; 1269 goto out; 1270 } 1271 printk(KERN_ERR "SELinux: %s: called before initial " 1272 "load_policy on unknown SID %d\n", __func__, sid); 1273 rc = -EINVAL; 1274 goto out; 1275 } 1276 read_lock(&policy_rwlock); 1277 if (force) 1278 context = sidtab_search_force(&sidtab, sid); 1279 else 1280 context = sidtab_search(&sidtab, sid); 1281 if (!context) { 1282 printk(KERN_ERR "SELinux: %s: unrecognized SID %d\n", 1283 __func__, sid); 1284 rc = -EINVAL; 1285 goto out_unlock; 1286 } 1287 rc = context_struct_to_string(context, scontext, scontext_len); 1288 out_unlock: 1289 read_unlock(&policy_rwlock); 1290 out: 1291 return rc; 1292 1293 } 1294 1295 /** 1296 * security_sid_to_context - Obtain a context for a given SID. 1297 * @sid: security identifier, SID 1298 * @scontext: security context 1299 * @scontext_len: length in bytes 1300 * 1301 * Write the string representation of the context associated with @sid 1302 * into a dynamically allocated string of the correct size. Set @scontext 1303 * to point to this string and set @scontext_len to the length of the string. 1304 */ 1305 int security_sid_to_context(u32 sid, char **scontext, u32 *scontext_len) 1306 { 1307 return security_sid_to_context_core(sid, scontext, scontext_len, 0); 1308 } 1309 1310 int security_sid_to_context_force(u32 sid, char **scontext, u32 *scontext_len) 1311 { 1312 return security_sid_to_context_core(sid, scontext, scontext_len, 1); 1313 } 1314 1315 /* 1316 * Caveat: Mutates scontext. 1317 */ 1318 static int string_to_context_struct(struct policydb *pol, 1319 struct sidtab *sidtabp, 1320 char *scontext, 1321 u32 scontext_len, 1322 struct context *ctx, 1323 u32 def_sid) 1324 { 1325 struct role_datum *role; 1326 struct type_datum *typdatum; 1327 struct user_datum *usrdatum; 1328 char *scontextp, *p, oldc; 1329 int rc = 0; 1330 1331 context_init(ctx); 1332 1333 /* Parse the security context. */ 1334 1335 rc = -EINVAL; 1336 scontextp = (char *) scontext; 1337 1338 /* Extract the user. */ 1339 p = scontextp; 1340 while (*p && *p != ':') 1341 p++; 1342 1343 if (*p == 0) 1344 goto out; 1345 1346 *p++ = 0; 1347 1348 usrdatum = hashtab_search(pol->p_users.table, scontextp); 1349 if (!usrdatum) 1350 goto out; 1351 1352 ctx->user = usrdatum->value; 1353 1354 /* Extract role. */ 1355 scontextp = p; 1356 while (*p && *p != ':') 1357 p++; 1358 1359 if (*p == 0) 1360 goto out; 1361 1362 *p++ = 0; 1363 1364 role = hashtab_search(pol->p_roles.table, scontextp); 1365 if (!role) 1366 goto out; 1367 ctx->role = role->value; 1368 1369 /* Extract type. */ 1370 scontextp = p; 1371 while (*p && *p != ':') 1372 p++; 1373 oldc = *p; 1374 *p++ = 0; 1375 1376 typdatum = hashtab_search(pol->p_types.table, scontextp); 1377 if (!typdatum || typdatum->attribute) 1378 goto out; 1379 1380 ctx->type = typdatum->value; 1381 1382 rc = mls_context_to_sid(pol, oldc, &p, ctx, sidtabp, def_sid); 1383 if (rc) 1384 goto out; 1385 1386 rc = -EINVAL; 1387 if ((p - scontext) < scontext_len) 1388 goto out; 1389 1390 /* Check the validity of the new context. */ 1391 if (!policydb_context_isvalid(pol, ctx)) 1392 goto out; 1393 rc = 0; 1394 out: 1395 if (rc) 1396 context_destroy(ctx); 1397 return rc; 1398 } 1399 1400 static int security_context_to_sid_core(const char *scontext, u32 scontext_len, 1401 u32 *sid, u32 def_sid, gfp_t gfp_flags, 1402 int force) 1403 { 1404 char *scontext2, *str = NULL; 1405 struct context context; 1406 int rc = 0; 1407 1408 /* An empty security context is never valid. */ 1409 if (!scontext_len) 1410 return -EINVAL; 1411 1412 if (!ss_initialized) { 1413 int i; 1414 1415 for (i = 1; i < SECINITSID_NUM; i++) { 1416 if (!strcmp(initial_sid_to_string[i], scontext)) { 1417 *sid = i; 1418 return 0; 1419 } 1420 } 1421 *sid = SECINITSID_KERNEL; 1422 return 0; 1423 } 1424 *sid = SECSID_NULL; 1425 1426 /* Copy the string so that we can modify the copy as we parse it. */ 1427 scontext2 = kmalloc(scontext_len + 1, gfp_flags); 1428 if (!scontext2) 1429 return -ENOMEM; 1430 memcpy(scontext2, scontext, scontext_len); 1431 scontext2[scontext_len] = 0; 1432 1433 if (force) { 1434 /* Save another copy for storing in uninterpreted form */ 1435 rc = -ENOMEM; 1436 str = kstrdup(scontext2, gfp_flags); 1437 if (!str) 1438 goto out; 1439 } 1440 1441 read_lock(&policy_rwlock); 1442 rc = string_to_context_struct(&policydb, &sidtab, scontext2, 1443 scontext_len, &context, def_sid); 1444 if (rc == -EINVAL && force) { 1445 context.str = str; 1446 context.len = scontext_len; 1447 str = NULL; 1448 } else if (rc) 1449 goto out_unlock; 1450 rc = sidtab_context_to_sid(&sidtab, &context, sid); 1451 context_destroy(&context); 1452 out_unlock: 1453 read_unlock(&policy_rwlock); 1454 out: 1455 kfree(scontext2); 1456 kfree(str); 1457 return rc; 1458 } 1459 1460 /** 1461 * security_context_to_sid - Obtain a SID for a given security context. 1462 * @scontext: security context 1463 * @scontext_len: length in bytes 1464 * @sid: security identifier, SID 1465 * @gfp: context for the allocation 1466 * 1467 * Obtains a SID associated with the security context that 1468 * has the string representation specified by @scontext. 1469 * Returns -%EINVAL if the context is invalid, -%ENOMEM if insufficient 1470 * memory is available, or 0 on success. 1471 */ 1472 int security_context_to_sid(const char *scontext, u32 scontext_len, u32 *sid, 1473 gfp_t gfp) 1474 { 1475 return security_context_to_sid_core(scontext, scontext_len, 1476 sid, SECSID_NULL, gfp, 0); 1477 } 1478 1479 /** 1480 * security_context_to_sid_default - Obtain a SID for a given security context, 1481 * falling back to specified default if needed. 1482 * 1483 * @scontext: security context 1484 * @scontext_len: length in bytes 1485 * @sid: security identifier, SID 1486 * @def_sid: default SID to assign on error 1487 * 1488 * Obtains a SID associated with the security context that 1489 * has the string representation specified by @scontext. 1490 * The default SID is passed to the MLS layer to be used to allow 1491 * kernel labeling of the MLS field if the MLS field is not present 1492 * (for upgrading to MLS without full relabel). 1493 * Implicitly forces adding of the context even if it cannot be mapped yet. 1494 * Returns -%EINVAL if the context is invalid, -%ENOMEM if insufficient 1495 * memory is available, or 0 on success. 1496 */ 1497 int security_context_to_sid_default(const char *scontext, u32 scontext_len, 1498 u32 *sid, u32 def_sid, gfp_t gfp_flags) 1499 { 1500 return security_context_to_sid_core(scontext, scontext_len, 1501 sid, def_sid, gfp_flags, 1); 1502 } 1503 1504 int security_context_to_sid_force(const char *scontext, u32 scontext_len, 1505 u32 *sid) 1506 { 1507 return security_context_to_sid_core(scontext, scontext_len, 1508 sid, SECSID_NULL, GFP_KERNEL, 1); 1509 } 1510 1511 static int compute_sid_handle_invalid_context( 1512 struct context *scontext, 1513 struct context *tcontext, 1514 u16 tclass, 1515 struct context *newcontext) 1516 { 1517 char *s = NULL, *t = NULL, *n = NULL; 1518 u32 slen, tlen, nlen; 1519 1520 if (context_struct_to_string(scontext, &s, &slen)) 1521 goto out; 1522 if (context_struct_to_string(tcontext, &t, &tlen)) 1523 goto out; 1524 if (context_struct_to_string(newcontext, &n, &nlen)) 1525 goto out; 1526 audit_log(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR, 1527 "op=security_compute_sid invalid_context=%s" 1528 " scontext=%s" 1529 " tcontext=%s" 1530 " tclass=%s", 1531 n, s, t, sym_name(&policydb, SYM_CLASSES, tclass-1)); 1532 out: 1533 kfree(s); 1534 kfree(t); 1535 kfree(n); 1536 if (!selinux_enforcing) 1537 return 0; 1538 return -EACCES; 1539 } 1540 1541 static void filename_compute_type(struct policydb *p, struct context *newcontext, 1542 u32 stype, u32 ttype, u16 tclass, 1543 const char *objname) 1544 { 1545 struct filename_trans ft; 1546 struct filename_trans_datum *otype; 1547 1548 /* 1549 * Most filename trans rules are going to live in specific directories 1550 * like /dev or /var/run. This bitmap will quickly skip rule searches 1551 * if the ttype does not contain any rules. 1552 */ 1553 if (!ebitmap_get_bit(&p->filename_trans_ttypes, ttype)) 1554 return; 1555 1556 ft.stype = stype; 1557 ft.ttype = ttype; 1558 ft.tclass = tclass; 1559 ft.name = objname; 1560 1561 otype = hashtab_search(p->filename_trans, &ft); 1562 if (otype) 1563 newcontext->type = otype->otype; 1564 } 1565 1566 static int security_compute_sid(u32 ssid, 1567 u32 tsid, 1568 u16 orig_tclass, 1569 u32 specified, 1570 const char *objname, 1571 u32 *out_sid, 1572 bool kern) 1573 { 1574 struct class_datum *cladatum = NULL; 1575 struct context *scontext = NULL, *tcontext = NULL, newcontext; 1576 struct role_trans *roletr = NULL; 1577 struct avtab_key avkey; 1578 struct avtab_datum *avdatum; 1579 struct avtab_node *node; 1580 u16 tclass; 1581 int rc = 0; 1582 bool sock; 1583 1584 if (!ss_initialized) { 1585 switch (orig_tclass) { 1586 case SECCLASS_PROCESS: /* kernel value */ 1587 *out_sid = ssid; 1588 break; 1589 default: 1590 *out_sid = tsid; 1591 break; 1592 } 1593 goto out; 1594 } 1595 1596 context_init(&newcontext); 1597 1598 read_lock(&policy_rwlock); 1599 1600 if (kern) { 1601 tclass = unmap_class(orig_tclass); 1602 sock = security_is_socket_class(orig_tclass); 1603 } else { 1604 tclass = orig_tclass; 1605 sock = security_is_socket_class(map_class(tclass)); 1606 } 1607 1608 scontext = sidtab_search(&sidtab, ssid); 1609 if (!scontext) { 1610 printk(KERN_ERR "SELinux: %s: unrecognized SID %d\n", 1611 __func__, ssid); 1612 rc = -EINVAL; 1613 goto out_unlock; 1614 } 1615 tcontext = sidtab_search(&sidtab, tsid); 1616 if (!tcontext) { 1617 printk(KERN_ERR "SELinux: %s: unrecognized SID %d\n", 1618 __func__, tsid); 1619 rc = -EINVAL; 1620 goto out_unlock; 1621 } 1622 1623 if (tclass && tclass <= policydb.p_classes.nprim) 1624 cladatum = policydb.class_val_to_struct[tclass - 1]; 1625 1626 /* Set the user identity. */ 1627 switch (specified) { 1628 case AVTAB_TRANSITION: 1629 case AVTAB_CHANGE: 1630 if (cladatum && cladatum->default_user == DEFAULT_TARGET) { 1631 newcontext.user = tcontext->user; 1632 } else { 1633 /* notice this gets both DEFAULT_SOURCE and unset */ 1634 /* Use the process user identity. */ 1635 newcontext.user = scontext->user; 1636 } 1637 break; 1638 case AVTAB_MEMBER: 1639 /* Use the related object owner. */ 1640 newcontext.user = tcontext->user; 1641 break; 1642 } 1643 1644 /* Set the role to default values. */ 1645 if (cladatum && cladatum->default_role == DEFAULT_SOURCE) { 1646 newcontext.role = scontext->role; 1647 } else if (cladatum && cladatum->default_role == DEFAULT_TARGET) { 1648 newcontext.role = tcontext->role; 1649 } else { 1650 if ((tclass == policydb.process_class) || (sock == true)) 1651 newcontext.role = scontext->role; 1652 else 1653 newcontext.role = OBJECT_R_VAL; 1654 } 1655 1656 /* Set the type to default values. */ 1657 if (cladatum && cladatum->default_type == DEFAULT_SOURCE) { 1658 newcontext.type = scontext->type; 1659 } else if (cladatum && cladatum->default_type == DEFAULT_TARGET) { 1660 newcontext.type = tcontext->type; 1661 } else { 1662 if ((tclass == policydb.process_class) || (sock == true)) { 1663 /* Use the type of process. */ 1664 newcontext.type = scontext->type; 1665 } else { 1666 /* Use the type of the related object. */ 1667 newcontext.type = tcontext->type; 1668 } 1669 } 1670 1671 /* Look for a type transition/member/change rule. */ 1672 avkey.source_type = scontext->type; 1673 avkey.target_type = tcontext->type; 1674 avkey.target_class = tclass; 1675 avkey.specified = specified; 1676 avdatum = avtab_search(&policydb.te_avtab, &avkey); 1677 1678 /* If no permanent rule, also check for enabled conditional rules */ 1679 if (!avdatum) { 1680 node = avtab_search_node(&policydb.te_cond_avtab, &avkey); 1681 for (; node; node = avtab_search_node_next(node, specified)) { 1682 if (node->key.specified & AVTAB_ENABLED) { 1683 avdatum = &node->datum; 1684 break; 1685 } 1686 } 1687 } 1688 1689 if (avdatum) { 1690 /* Use the type from the type transition/member/change rule. */ 1691 newcontext.type = avdatum->u.data; 1692 } 1693 1694 /* if we have a objname this is a file trans check so check those rules */ 1695 if (objname) 1696 filename_compute_type(&policydb, &newcontext, scontext->type, 1697 tcontext->type, tclass, objname); 1698 1699 /* Check for class-specific changes. */ 1700 if (specified & AVTAB_TRANSITION) { 1701 /* Look for a role transition rule. */ 1702 for (roletr = policydb.role_tr; roletr; roletr = roletr->next) { 1703 if ((roletr->role == scontext->role) && 1704 (roletr->type == tcontext->type) && 1705 (roletr->tclass == tclass)) { 1706 /* Use the role transition rule. */ 1707 newcontext.role = roletr->new_role; 1708 break; 1709 } 1710 } 1711 } 1712 1713 /* Set the MLS attributes. 1714 This is done last because it may allocate memory. */ 1715 rc = mls_compute_sid(scontext, tcontext, tclass, specified, 1716 &newcontext, sock); 1717 if (rc) 1718 goto out_unlock; 1719 1720 /* Check the validity of the context. */ 1721 if (!policydb_context_isvalid(&policydb, &newcontext)) { 1722 rc = compute_sid_handle_invalid_context(scontext, 1723 tcontext, 1724 tclass, 1725 &newcontext); 1726 if (rc) 1727 goto out_unlock; 1728 } 1729 /* Obtain the sid for the context. */ 1730 rc = sidtab_context_to_sid(&sidtab, &newcontext, out_sid); 1731 out_unlock: 1732 read_unlock(&policy_rwlock); 1733 context_destroy(&newcontext); 1734 out: 1735 return rc; 1736 } 1737 1738 /** 1739 * security_transition_sid - Compute the SID for a new subject/object. 1740 * @ssid: source security identifier 1741 * @tsid: target security identifier 1742 * @tclass: target security class 1743 * @out_sid: security identifier for new subject/object 1744 * 1745 * Compute a SID to use for labeling a new subject or object in the 1746 * class @tclass based on a SID pair (@ssid, @tsid). 1747 * Return -%EINVAL if any of the parameters are invalid, -%ENOMEM 1748 * if insufficient memory is available, or %0 if the new SID was 1749 * computed successfully. 1750 */ 1751 int security_transition_sid(u32 ssid, u32 tsid, u16 tclass, 1752 const struct qstr *qstr, u32 *out_sid) 1753 { 1754 return security_compute_sid(ssid, tsid, tclass, AVTAB_TRANSITION, 1755 qstr ? qstr->name : NULL, out_sid, true); 1756 } 1757 1758 int security_transition_sid_user(u32 ssid, u32 tsid, u16 tclass, 1759 const char *objname, u32 *out_sid) 1760 { 1761 return security_compute_sid(ssid, tsid, tclass, AVTAB_TRANSITION, 1762 objname, out_sid, false); 1763 } 1764 1765 /** 1766 * security_member_sid - Compute the SID for member selection. 1767 * @ssid: source security identifier 1768 * @tsid: target security identifier 1769 * @tclass: target security class 1770 * @out_sid: security identifier for selected member 1771 * 1772 * Compute a SID to use when selecting a member of a polyinstantiated 1773 * object of class @tclass based on a SID pair (@ssid, @tsid). 1774 * Return -%EINVAL if any of the parameters are invalid, -%ENOMEM 1775 * if insufficient memory is available, or %0 if the SID was 1776 * computed successfully. 1777 */ 1778 int security_member_sid(u32 ssid, 1779 u32 tsid, 1780 u16 tclass, 1781 u32 *out_sid) 1782 { 1783 return security_compute_sid(ssid, tsid, tclass, AVTAB_MEMBER, NULL, 1784 out_sid, false); 1785 } 1786 1787 /** 1788 * security_change_sid - Compute the SID for object relabeling. 1789 * @ssid: source security identifier 1790 * @tsid: target security identifier 1791 * @tclass: target security class 1792 * @out_sid: security identifier for selected member 1793 * 1794 * Compute a SID to use for relabeling an object of class @tclass 1795 * based on a SID pair (@ssid, @tsid). 1796 * Return -%EINVAL if any of the parameters are invalid, -%ENOMEM 1797 * if insufficient memory is available, or %0 if the SID was 1798 * computed successfully. 1799 */ 1800 int security_change_sid(u32 ssid, 1801 u32 tsid, 1802 u16 tclass, 1803 u32 *out_sid) 1804 { 1805 return security_compute_sid(ssid, tsid, tclass, AVTAB_CHANGE, NULL, 1806 out_sid, false); 1807 } 1808 1809 /* Clone the SID into the new SID table. */ 1810 static int clone_sid(u32 sid, 1811 struct context *context, 1812 void *arg) 1813 { 1814 struct sidtab *s = arg; 1815 1816 if (sid > SECINITSID_NUM) 1817 return sidtab_insert(s, sid, context); 1818 else 1819 return 0; 1820 } 1821 1822 static inline int convert_context_handle_invalid_context(struct context *context) 1823 { 1824 char *s; 1825 u32 len; 1826 1827 if (selinux_enforcing) 1828 return -EINVAL; 1829 1830 if (!context_struct_to_string(context, &s, &len)) { 1831 printk(KERN_WARNING "SELinux: Context %s would be invalid if enforcing\n", s); 1832 kfree(s); 1833 } 1834 return 0; 1835 } 1836 1837 struct convert_context_args { 1838 struct policydb *oldp; 1839 struct policydb *newp; 1840 }; 1841 1842 /* 1843 * Convert the values in the security context 1844 * structure `c' from the values specified 1845 * in the policy `p->oldp' to the values specified 1846 * in the policy `p->newp'. Verify that the 1847 * context is valid under the new policy. 1848 */ 1849 static int convert_context(u32 key, 1850 struct context *c, 1851 void *p) 1852 { 1853 struct convert_context_args *args; 1854 struct context oldc; 1855 struct ocontext *oc; 1856 struct mls_range *range; 1857 struct role_datum *role; 1858 struct type_datum *typdatum; 1859 struct user_datum *usrdatum; 1860 char *s; 1861 u32 len; 1862 int rc = 0; 1863 1864 if (key <= SECINITSID_NUM) 1865 goto out; 1866 1867 args = p; 1868 1869 if (c->str) { 1870 struct context ctx; 1871 1872 rc = -ENOMEM; 1873 s = kstrdup(c->str, GFP_KERNEL); 1874 if (!s) 1875 goto out; 1876 1877 rc = string_to_context_struct(args->newp, NULL, s, 1878 c->len, &ctx, SECSID_NULL); 1879 kfree(s); 1880 if (!rc) { 1881 printk(KERN_INFO "SELinux: Context %s became valid (mapped).\n", 1882 c->str); 1883 /* Replace string with mapped representation. */ 1884 kfree(c->str); 1885 memcpy(c, &ctx, sizeof(*c)); 1886 goto out; 1887 } else if (rc == -EINVAL) { 1888 /* Retain string representation for later mapping. */ 1889 rc = 0; 1890 goto out; 1891 } else { 1892 /* Other error condition, e.g. ENOMEM. */ 1893 printk(KERN_ERR "SELinux: Unable to map context %s, rc = %d.\n", 1894 c->str, -rc); 1895 goto out; 1896 } 1897 } 1898 1899 rc = context_cpy(&oldc, c); 1900 if (rc) 1901 goto out; 1902 1903 /* Convert the user. */ 1904 rc = -EINVAL; 1905 usrdatum = hashtab_search(args->newp->p_users.table, 1906 sym_name(args->oldp, SYM_USERS, c->user - 1)); 1907 if (!usrdatum) 1908 goto bad; 1909 c->user = usrdatum->value; 1910 1911 /* Convert the role. */ 1912 rc = -EINVAL; 1913 role = hashtab_search(args->newp->p_roles.table, 1914 sym_name(args->oldp, SYM_ROLES, c->role - 1)); 1915 if (!role) 1916 goto bad; 1917 c->role = role->value; 1918 1919 /* Convert the type. */ 1920 rc = -EINVAL; 1921 typdatum = hashtab_search(args->newp->p_types.table, 1922 sym_name(args->oldp, SYM_TYPES, c->type - 1)); 1923 if (!typdatum) 1924 goto bad; 1925 c->type = typdatum->value; 1926 1927 /* Convert the MLS fields if dealing with MLS policies */ 1928 if (args->oldp->mls_enabled && args->newp->mls_enabled) { 1929 rc = mls_convert_context(args->oldp, args->newp, c); 1930 if (rc) 1931 goto bad; 1932 } else if (args->oldp->mls_enabled && !args->newp->mls_enabled) { 1933 /* 1934 * Switching between MLS and non-MLS policy: 1935 * free any storage used by the MLS fields in the 1936 * context for all existing entries in the sidtab. 1937 */ 1938 mls_context_destroy(c); 1939 } else if (!args->oldp->mls_enabled && args->newp->mls_enabled) { 1940 /* 1941 * Switching between non-MLS and MLS policy: 1942 * ensure that the MLS fields of the context for all 1943 * existing entries in the sidtab are filled in with a 1944 * suitable default value, likely taken from one of the 1945 * initial SIDs. 1946 */ 1947 oc = args->newp->ocontexts[OCON_ISID]; 1948 while (oc && oc->sid[0] != SECINITSID_UNLABELED) 1949 oc = oc->next; 1950 rc = -EINVAL; 1951 if (!oc) { 1952 printk(KERN_ERR "SELinux: unable to look up" 1953 " the initial SIDs list\n"); 1954 goto bad; 1955 } 1956 range = &oc->context[0].range; 1957 rc = mls_range_set(c, range); 1958 if (rc) 1959 goto bad; 1960 } 1961 1962 /* Check the validity of the new context. */ 1963 if (!policydb_context_isvalid(args->newp, c)) { 1964 rc = convert_context_handle_invalid_context(&oldc); 1965 if (rc) 1966 goto bad; 1967 } 1968 1969 context_destroy(&oldc); 1970 1971 rc = 0; 1972 out: 1973 return rc; 1974 bad: 1975 /* Map old representation to string and save it. */ 1976 rc = context_struct_to_string(&oldc, &s, &len); 1977 if (rc) 1978 return rc; 1979 context_destroy(&oldc); 1980 context_destroy(c); 1981 c->str = s; 1982 c->len = len; 1983 printk(KERN_INFO "SELinux: Context %s became invalid (unmapped).\n", 1984 c->str); 1985 rc = 0; 1986 goto out; 1987 } 1988 1989 static void security_load_policycaps(void) 1990 { 1991 selinux_policycap_netpeer = ebitmap_get_bit(&policydb.policycaps, 1992 POLICYDB_CAPABILITY_NETPEER); 1993 selinux_policycap_openperm = ebitmap_get_bit(&policydb.policycaps, 1994 POLICYDB_CAPABILITY_OPENPERM); 1995 selinux_policycap_alwaysnetwork = ebitmap_get_bit(&policydb.policycaps, 1996 POLICYDB_CAPABILITY_ALWAYSNETWORK); 1997 } 1998 1999 static int security_preserve_bools(struct policydb *p); 2000 2001 /** 2002 * security_load_policy - Load a security policy configuration. 2003 * @data: binary policy data 2004 * @len: length of data in bytes 2005 * 2006 * Load a new set of security policy configuration data, 2007 * validate it and convert the SID table as necessary. 2008 * This function will flush the access vector cache after 2009 * loading the new policy. 2010 */ 2011 int security_load_policy(void *data, size_t len) 2012 { 2013 struct policydb *oldpolicydb, *newpolicydb; 2014 struct sidtab oldsidtab, newsidtab; 2015 struct selinux_mapping *oldmap, *map = NULL; 2016 struct convert_context_args args; 2017 u32 seqno; 2018 u16 map_size; 2019 int rc = 0; 2020 struct policy_file file = { data, len }, *fp = &file; 2021 2022 oldpolicydb = kzalloc(2 * sizeof(*oldpolicydb), GFP_KERNEL); 2023 if (!oldpolicydb) { 2024 rc = -ENOMEM; 2025 goto out; 2026 } 2027 newpolicydb = oldpolicydb + 1; 2028 2029 if (!ss_initialized) { 2030 avtab_cache_init(); 2031 rc = policydb_read(&policydb, fp); 2032 if (rc) { 2033 avtab_cache_destroy(); 2034 goto out; 2035 } 2036 2037 policydb.len = len; 2038 rc = selinux_set_mapping(&policydb, secclass_map, 2039 ¤t_mapping, 2040 ¤t_mapping_size); 2041 if (rc) { 2042 policydb_destroy(&policydb); 2043 avtab_cache_destroy(); 2044 goto out; 2045 } 2046 2047 rc = policydb_load_isids(&policydb, &sidtab); 2048 if (rc) { 2049 policydb_destroy(&policydb); 2050 avtab_cache_destroy(); 2051 goto out; 2052 } 2053 2054 security_load_policycaps(); 2055 ss_initialized = 1; 2056 seqno = ++latest_granting; 2057 selinux_complete_init(); 2058 avc_ss_reset(seqno); 2059 selnl_notify_policyload(seqno); 2060 selinux_status_update_policyload(seqno); 2061 selinux_netlbl_cache_invalidate(); 2062 selinux_xfrm_notify_policyload(); 2063 goto out; 2064 } 2065 2066 #if 0 2067 sidtab_hash_eval(&sidtab, "sids"); 2068 #endif 2069 2070 rc = policydb_read(newpolicydb, fp); 2071 if (rc) 2072 goto out; 2073 2074 newpolicydb->len = len; 2075 /* If switching between different policy types, log MLS status */ 2076 if (policydb.mls_enabled && !newpolicydb->mls_enabled) 2077 printk(KERN_INFO "SELinux: Disabling MLS support...\n"); 2078 else if (!policydb.mls_enabled && newpolicydb->mls_enabled) 2079 printk(KERN_INFO "SELinux: Enabling MLS support...\n"); 2080 2081 rc = policydb_load_isids(newpolicydb, &newsidtab); 2082 if (rc) { 2083 printk(KERN_ERR "SELinux: unable to load the initial SIDs\n"); 2084 policydb_destroy(newpolicydb); 2085 goto out; 2086 } 2087 2088 rc = selinux_set_mapping(newpolicydb, secclass_map, &map, &map_size); 2089 if (rc) 2090 goto err; 2091 2092 rc = security_preserve_bools(newpolicydb); 2093 if (rc) { 2094 printk(KERN_ERR "SELinux: unable to preserve booleans\n"); 2095 goto err; 2096 } 2097 2098 /* Clone the SID table. */ 2099 sidtab_shutdown(&sidtab); 2100 2101 rc = sidtab_map(&sidtab, clone_sid, &newsidtab); 2102 if (rc) 2103 goto err; 2104 2105 /* 2106 * Convert the internal representations of contexts 2107 * in the new SID table. 2108 */ 2109 args.oldp = &policydb; 2110 args.newp = newpolicydb; 2111 rc = sidtab_map(&newsidtab, convert_context, &args); 2112 if (rc) { 2113 printk(KERN_ERR "SELinux: unable to convert the internal" 2114 " representation of contexts in the new SID" 2115 " table\n"); 2116 goto err; 2117 } 2118 2119 /* Save the old policydb and SID table to free later. */ 2120 memcpy(oldpolicydb, &policydb, sizeof(policydb)); 2121 sidtab_set(&oldsidtab, &sidtab); 2122 2123 /* Install the new policydb and SID table. */ 2124 write_lock_irq(&policy_rwlock); 2125 memcpy(&policydb, newpolicydb, sizeof(policydb)); 2126 sidtab_set(&sidtab, &newsidtab); 2127 security_load_policycaps(); 2128 oldmap = current_mapping; 2129 current_mapping = map; 2130 current_mapping_size = map_size; 2131 seqno = ++latest_granting; 2132 write_unlock_irq(&policy_rwlock); 2133 2134 /* Free the old policydb and SID table. */ 2135 policydb_destroy(oldpolicydb); 2136 sidtab_destroy(&oldsidtab); 2137 kfree(oldmap); 2138 2139 avc_ss_reset(seqno); 2140 selnl_notify_policyload(seqno); 2141 selinux_status_update_policyload(seqno); 2142 selinux_netlbl_cache_invalidate(); 2143 selinux_xfrm_notify_policyload(); 2144 2145 rc = 0; 2146 goto out; 2147 2148 err: 2149 kfree(map); 2150 sidtab_destroy(&newsidtab); 2151 policydb_destroy(newpolicydb); 2152 2153 out: 2154 kfree(oldpolicydb); 2155 return rc; 2156 } 2157 2158 size_t security_policydb_len(void) 2159 { 2160 size_t len; 2161 2162 read_lock(&policy_rwlock); 2163 len = policydb.len; 2164 read_unlock(&policy_rwlock); 2165 2166 return len; 2167 } 2168 2169 /** 2170 * security_port_sid - Obtain the SID for a port. 2171 * @protocol: protocol number 2172 * @port: port number 2173 * @out_sid: security identifier 2174 */ 2175 int security_port_sid(u8 protocol, u16 port, u32 *out_sid) 2176 { 2177 struct ocontext *c; 2178 int rc = 0; 2179 2180 read_lock(&policy_rwlock); 2181 2182 c = policydb.ocontexts[OCON_PORT]; 2183 while (c) { 2184 if (c->u.port.protocol == protocol && 2185 c->u.port.low_port <= port && 2186 c->u.port.high_port >= port) 2187 break; 2188 c = c->next; 2189 } 2190 2191 if (c) { 2192 if (!c->sid[0]) { 2193 rc = sidtab_context_to_sid(&sidtab, 2194 &c->context[0], 2195 &c->sid[0]); 2196 if (rc) 2197 goto out; 2198 } 2199 *out_sid = c->sid[0]; 2200 } else { 2201 *out_sid = SECINITSID_PORT; 2202 } 2203 2204 out: 2205 read_unlock(&policy_rwlock); 2206 return rc; 2207 } 2208 2209 /** 2210 * security_netif_sid - Obtain the SID for a network interface. 2211 * @name: interface name 2212 * @if_sid: interface SID 2213 */ 2214 int security_netif_sid(char *name, u32 *if_sid) 2215 { 2216 int rc = 0; 2217 struct ocontext *c; 2218 2219 read_lock(&policy_rwlock); 2220 2221 c = policydb.ocontexts[OCON_NETIF]; 2222 while (c) { 2223 if (strcmp(name, c->u.name) == 0) 2224 break; 2225 c = c->next; 2226 } 2227 2228 if (c) { 2229 if (!c->sid[0] || !c->sid[1]) { 2230 rc = sidtab_context_to_sid(&sidtab, 2231 &c->context[0], 2232 &c->sid[0]); 2233 if (rc) 2234 goto out; 2235 rc = sidtab_context_to_sid(&sidtab, 2236 &c->context[1], 2237 &c->sid[1]); 2238 if (rc) 2239 goto out; 2240 } 2241 *if_sid = c->sid[0]; 2242 } else 2243 *if_sid = SECINITSID_NETIF; 2244 2245 out: 2246 read_unlock(&policy_rwlock); 2247 return rc; 2248 } 2249 2250 static int match_ipv6_addrmask(u32 *input, u32 *addr, u32 *mask) 2251 { 2252 int i, fail = 0; 2253 2254 for (i = 0; i < 4; i++) 2255 if (addr[i] != (input[i] & mask[i])) { 2256 fail = 1; 2257 break; 2258 } 2259 2260 return !fail; 2261 } 2262 2263 /** 2264 * security_node_sid - Obtain the SID for a node (host). 2265 * @domain: communication domain aka address family 2266 * @addrp: address 2267 * @addrlen: address length in bytes 2268 * @out_sid: security identifier 2269 */ 2270 int security_node_sid(u16 domain, 2271 void *addrp, 2272 u32 addrlen, 2273 u32 *out_sid) 2274 { 2275 int rc; 2276 struct ocontext *c; 2277 2278 read_lock(&policy_rwlock); 2279 2280 switch (domain) { 2281 case AF_INET: { 2282 u32 addr; 2283 2284 rc = -EINVAL; 2285 if (addrlen != sizeof(u32)) 2286 goto out; 2287 2288 addr = *((u32 *)addrp); 2289 2290 c = policydb.ocontexts[OCON_NODE]; 2291 while (c) { 2292 if (c->u.node.addr == (addr & c->u.node.mask)) 2293 break; 2294 c = c->next; 2295 } 2296 break; 2297 } 2298 2299 case AF_INET6: 2300 rc = -EINVAL; 2301 if (addrlen != sizeof(u64) * 2) 2302 goto out; 2303 c = policydb.ocontexts[OCON_NODE6]; 2304 while (c) { 2305 if (match_ipv6_addrmask(addrp, c->u.node6.addr, 2306 c->u.node6.mask)) 2307 break; 2308 c = c->next; 2309 } 2310 break; 2311 2312 default: 2313 rc = 0; 2314 *out_sid = SECINITSID_NODE; 2315 goto out; 2316 } 2317 2318 if (c) { 2319 if (!c->sid[0]) { 2320 rc = sidtab_context_to_sid(&sidtab, 2321 &c->context[0], 2322 &c->sid[0]); 2323 if (rc) 2324 goto out; 2325 } 2326 *out_sid = c->sid[0]; 2327 } else { 2328 *out_sid = SECINITSID_NODE; 2329 } 2330 2331 rc = 0; 2332 out: 2333 read_unlock(&policy_rwlock); 2334 return rc; 2335 } 2336 2337 #define SIDS_NEL 25 2338 2339 /** 2340 * security_get_user_sids - Obtain reachable SIDs for a user. 2341 * @fromsid: starting SID 2342 * @username: username 2343 * @sids: array of reachable SIDs for user 2344 * @nel: number of elements in @sids 2345 * 2346 * Generate the set of SIDs for legal security contexts 2347 * for a given user that can be reached by @fromsid. 2348 * Set *@sids to point to a dynamically allocated 2349 * array containing the set of SIDs. Set *@nel to the 2350 * number of elements in the array. 2351 */ 2352 2353 int security_get_user_sids(u32 fromsid, 2354 char *username, 2355 u32 **sids, 2356 u32 *nel) 2357 { 2358 struct context *fromcon, usercon; 2359 u32 *mysids = NULL, *mysids2, sid; 2360 u32 mynel = 0, maxnel = SIDS_NEL; 2361 struct user_datum *user; 2362 struct role_datum *role; 2363 struct ebitmap_node *rnode, *tnode; 2364 int rc = 0, i, j; 2365 2366 *sids = NULL; 2367 *nel = 0; 2368 2369 if (!ss_initialized) 2370 goto out; 2371 2372 read_lock(&policy_rwlock); 2373 2374 context_init(&usercon); 2375 2376 rc = -EINVAL; 2377 fromcon = sidtab_search(&sidtab, fromsid); 2378 if (!fromcon) 2379 goto out_unlock; 2380 2381 rc = -EINVAL; 2382 user = hashtab_search(policydb.p_users.table, username); 2383 if (!user) 2384 goto out_unlock; 2385 2386 usercon.user = user->value; 2387 2388 rc = -ENOMEM; 2389 mysids = kcalloc(maxnel, sizeof(*mysids), GFP_ATOMIC); 2390 if (!mysids) 2391 goto out_unlock; 2392 2393 ebitmap_for_each_positive_bit(&user->roles, rnode, i) { 2394 role = policydb.role_val_to_struct[i]; 2395 usercon.role = i + 1; 2396 ebitmap_for_each_positive_bit(&role->types, tnode, j) { 2397 usercon.type = j + 1; 2398 2399 if (mls_setup_user_range(fromcon, user, &usercon)) 2400 continue; 2401 2402 rc = sidtab_context_to_sid(&sidtab, &usercon, &sid); 2403 if (rc) 2404 goto out_unlock; 2405 if (mynel < maxnel) { 2406 mysids[mynel++] = sid; 2407 } else { 2408 rc = -ENOMEM; 2409 maxnel += SIDS_NEL; 2410 mysids2 = kcalloc(maxnel, sizeof(*mysids2), GFP_ATOMIC); 2411 if (!mysids2) 2412 goto out_unlock; 2413 memcpy(mysids2, mysids, mynel * sizeof(*mysids2)); 2414 kfree(mysids); 2415 mysids = mysids2; 2416 mysids[mynel++] = sid; 2417 } 2418 } 2419 } 2420 rc = 0; 2421 out_unlock: 2422 read_unlock(&policy_rwlock); 2423 if (rc || !mynel) { 2424 kfree(mysids); 2425 goto out; 2426 } 2427 2428 rc = -ENOMEM; 2429 mysids2 = kcalloc(mynel, sizeof(*mysids2), GFP_KERNEL); 2430 if (!mysids2) { 2431 kfree(mysids); 2432 goto out; 2433 } 2434 for (i = 0, j = 0; i < mynel; i++) { 2435 struct av_decision dummy_avd; 2436 rc = avc_has_perm_noaudit(fromsid, mysids[i], 2437 SECCLASS_PROCESS, /* kernel value */ 2438 PROCESS__TRANSITION, AVC_STRICT, 2439 &dummy_avd); 2440 if (!rc) 2441 mysids2[j++] = mysids[i]; 2442 cond_resched(); 2443 } 2444 rc = 0; 2445 kfree(mysids); 2446 *sids = mysids2; 2447 *nel = j; 2448 out: 2449 return rc; 2450 } 2451 2452 /** 2453 * __security_genfs_sid - Helper to obtain a SID for a file in a filesystem 2454 * @fstype: filesystem type 2455 * @path: path from root of mount 2456 * @sclass: file security class 2457 * @sid: SID for path 2458 * 2459 * Obtain a SID to use for a file in a filesystem that 2460 * cannot support xattr or use a fixed labeling behavior like 2461 * transition SIDs or task SIDs. 2462 * 2463 * The caller must acquire the policy_rwlock before calling this function. 2464 */ 2465 static inline int __security_genfs_sid(const char *fstype, 2466 char *path, 2467 u16 orig_sclass, 2468 u32 *sid) 2469 { 2470 int len; 2471 u16 sclass; 2472 struct genfs *genfs; 2473 struct ocontext *c; 2474 int rc, cmp = 0; 2475 2476 while (path[0] == '/' && path[1] == '/') 2477 path++; 2478 2479 sclass = unmap_class(orig_sclass); 2480 *sid = SECINITSID_UNLABELED; 2481 2482 for (genfs = policydb.genfs; genfs; genfs = genfs->next) { 2483 cmp = strcmp(fstype, genfs->fstype); 2484 if (cmp <= 0) 2485 break; 2486 } 2487 2488 rc = -ENOENT; 2489 if (!genfs || cmp) 2490 goto out; 2491 2492 for (c = genfs->head; c; c = c->next) { 2493 len = strlen(c->u.name); 2494 if ((!c->v.sclass || sclass == c->v.sclass) && 2495 (strncmp(c->u.name, path, len) == 0)) 2496 break; 2497 } 2498 2499 rc = -ENOENT; 2500 if (!c) 2501 goto out; 2502 2503 if (!c->sid[0]) { 2504 rc = sidtab_context_to_sid(&sidtab, &c->context[0], &c->sid[0]); 2505 if (rc) 2506 goto out; 2507 } 2508 2509 *sid = c->sid[0]; 2510 rc = 0; 2511 out: 2512 return rc; 2513 } 2514 2515 /** 2516 * security_genfs_sid - Obtain a SID for a file in a filesystem 2517 * @fstype: filesystem type 2518 * @path: path from root of mount 2519 * @sclass: file security class 2520 * @sid: SID for path 2521 * 2522 * Acquire policy_rwlock before calling __security_genfs_sid() and release 2523 * it afterward. 2524 */ 2525 int security_genfs_sid(const char *fstype, 2526 char *path, 2527 u16 orig_sclass, 2528 u32 *sid) 2529 { 2530 int retval; 2531 2532 read_lock(&policy_rwlock); 2533 retval = __security_genfs_sid(fstype, path, orig_sclass, sid); 2534 read_unlock(&policy_rwlock); 2535 return retval; 2536 } 2537 2538 /** 2539 * security_fs_use - Determine how to handle labeling for a filesystem. 2540 * @sb: superblock in question 2541 */ 2542 int security_fs_use(struct super_block *sb) 2543 { 2544 int rc = 0; 2545 struct ocontext *c; 2546 struct superblock_security_struct *sbsec = sb->s_security; 2547 const char *fstype = sb->s_type->name; 2548 2549 read_lock(&policy_rwlock); 2550 2551 c = policydb.ocontexts[OCON_FSUSE]; 2552 while (c) { 2553 if (strcmp(fstype, c->u.name) == 0) 2554 break; 2555 c = c->next; 2556 } 2557 2558 if (c) { 2559 sbsec->behavior = c->v.behavior; 2560 if (!c->sid[0]) { 2561 rc = sidtab_context_to_sid(&sidtab, &c->context[0], 2562 &c->sid[0]); 2563 if (rc) 2564 goto out; 2565 } 2566 sbsec->sid = c->sid[0]; 2567 } else { 2568 rc = __security_genfs_sid(fstype, "/", SECCLASS_DIR, 2569 &sbsec->sid); 2570 if (rc) { 2571 sbsec->behavior = SECURITY_FS_USE_NONE; 2572 rc = 0; 2573 } else { 2574 sbsec->behavior = SECURITY_FS_USE_GENFS; 2575 } 2576 } 2577 2578 out: 2579 read_unlock(&policy_rwlock); 2580 return rc; 2581 } 2582 2583 int security_get_bools(int *len, char ***names, int **values) 2584 { 2585 int i, rc; 2586 2587 read_lock(&policy_rwlock); 2588 *names = NULL; 2589 *values = NULL; 2590 2591 rc = 0; 2592 *len = policydb.p_bools.nprim; 2593 if (!*len) 2594 goto out; 2595 2596 rc = -ENOMEM; 2597 *names = kcalloc(*len, sizeof(char *), GFP_ATOMIC); 2598 if (!*names) 2599 goto err; 2600 2601 rc = -ENOMEM; 2602 *values = kcalloc(*len, sizeof(int), GFP_ATOMIC); 2603 if (!*values) 2604 goto err; 2605 2606 for (i = 0; i < *len; i++) { 2607 size_t name_len; 2608 2609 (*values)[i] = policydb.bool_val_to_struct[i]->state; 2610 name_len = strlen(sym_name(&policydb, SYM_BOOLS, i)) + 1; 2611 2612 rc = -ENOMEM; 2613 (*names)[i] = kmalloc(sizeof(char) * name_len, GFP_ATOMIC); 2614 if (!(*names)[i]) 2615 goto err; 2616 2617 strncpy((*names)[i], sym_name(&policydb, SYM_BOOLS, i), name_len); 2618 (*names)[i][name_len - 1] = 0; 2619 } 2620 rc = 0; 2621 out: 2622 read_unlock(&policy_rwlock); 2623 return rc; 2624 err: 2625 if (*names) { 2626 for (i = 0; i < *len; i++) 2627 kfree((*names)[i]); 2628 } 2629 kfree(*values); 2630 goto out; 2631 } 2632 2633 2634 int security_set_bools(int len, int *values) 2635 { 2636 int i, rc; 2637 int lenp, seqno = 0; 2638 struct cond_node *cur; 2639 2640 write_lock_irq(&policy_rwlock); 2641 2642 rc = -EFAULT; 2643 lenp = policydb.p_bools.nprim; 2644 if (len != lenp) 2645 goto out; 2646 2647 for (i = 0; i < len; i++) { 2648 if (!!values[i] != policydb.bool_val_to_struct[i]->state) { 2649 audit_log(current->audit_context, GFP_ATOMIC, 2650 AUDIT_MAC_CONFIG_CHANGE, 2651 "bool=%s val=%d old_val=%d auid=%u ses=%u", 2652 sym_name(&policydb, SYM_BOOLS, i), 2653 !!values[i], 2654 policydb.bool_val_to_struct[i]->state, 2655 from_kuid(&init_user_ns, audit_get_loginuid(current)), 2656 audit_get_sessionid(current)); 2657 } 2658 if (values[i]) 2659 policydb.bool_val_to_struct[i]->state = 1; 2660 else 2661 policydb.bool_val_to_struct[i]->state = 0; 2662 } 2663 2664 for (cur = policydb.cond_list; cur; cur = cur->next) { 2665 rc = evaluate_cond_node(&policydb, cur); 2666 if (rc) 2667 goto out; 2668 } 2669 2670 seqno = ++latest_granting; 2671 rc = 0; 2672 out: 2673 write_unlock_irq(&policy_rwlock); 2674 if (!rc) { 2675 avc_ss_reset(seqno); 2676 selnl_notify_policyload(seqno); 2677 selinux_status_update_policyload(seqno); 2678 selinux_xfrm_notify_policyload(); 2679 } 2680 return rc; 2681 } 2682 2683 int security_get_bool_value(int bool) 2684 { 2685 int rc; 2686 int len; 2687 2688 read_lock(&policy_rwlock); 2689 2690 rc = -EFAULT; 2691 len = policydb.p_bools.nprim; 2692 if (bool >= len) 2693 goto out; 2694 2695 rc = policydb.bool_val_to_struct[bool]->state; 2696 out: 2697 read_unlock(&policy_rwlock); 2698 return rc; 2699 } 2700 2701 static int security_preserve_bools(struct policydb *p) 2702 { 2703 int rc, nbools = 0, *bvalues = NULL, i; 2704 char **bnames = NULL; 2705 struct cond_bool_datum *booldatum; 2706 struct cond_node *cur; 2707 2708 rc = security_get_bools(&nbools, &bnames, &bvalues); 2709 if (rc) 2710 goto out; 2711 for (i = 0; i < nbools; i++) { 2712 booldatum = hashtab_search(p->p_bools.table, bnames[i]); 2713 if (booldatum) 2714 booldatum->state = bvalues[i]; 2715 } 2716 for (cur = p->cond_list; cur; cur = cur->next) { 2717 rc = evaluate_cond_node(p, cur); 2718 if (rc) 2719 goto out; 2720 } 2721 2722 out: 2723 if (bnames) { 2724 for (i = 0; i < nbools; i++) 2725 kfree(bnames[i]); 2726 } 2727 kfree(bnames); 2728 kfree(bvalues); 2729 return rc; 2730 } 2731 2732 /* 2733 * security_sid_mls_copy() - computes a new sid based on the given 2734 * sid and the mls portion of mls_sid. 2735 */ 2736 int security_sid_mls_copy(u32 sid, u32 mls_sid, u32 *new_sid) 2737 { 2738 struct context *context1; 2739 struct context *context2; 2740 struct context newcon; 2741 char *s; 2742 u32 len; 2743 int rc; 2744 2745 rc = 0; 2746 if (!ss_initialized || !policydb.mls_enabled) { 2747 *new_sid = sid; 2748 goto out; 2749 } 2750 2751 context_init(&newcon); 2752 2753 read_lock(&policy_rwlock); 2754 2755 rc = -EINVAL; 2756 context1 = sidtab_search(&sidtab, sid); 2757 if (!context1) { 2758 printk(KERN_ERR "SELinux: %s: unrecognized SID %d\n", 2759 __func__, sid); 2760 goto out_unlock; 2761 } 2762 2763 rc = -EINVAL; 2764 context2 = sidtab_search(&sidtab, mls_sid); 2765 if (!context2) { 2766 printk(KERN_ERR "SELinux: %s: unrecognized SID %d\n", 2767 __func__, mls_sid); 2768 goto out_unlock; 2769 } 2770 2771 newcon.user = context1->user; 2772 newcon.role = context1->role; 2773 newcon.type = context1->type; 2774 rc = mls_context_cpy(&newcon, context2); 2775 if (rc) 2776 goto out_unlock; 2777 2778 /* Check the validity of the new context. */ 2779 if (!policydb_context_isvalid(&policydb, &newcon)) { 2780 rc = convert_context_handle_invalid_context(&newcon); 2781 if (rc) { 2782 if (!context_struct_to_string(&newcon, &s, &len)) { 2783 audit_log(current->audit_context, 2784 GFP_ATOMIC, AUDIT_SELINUX_ERR, 2785 "op=security_sid_mls_copy " 2786 "invalid_context=%s", s); 2787 kfree(s); 2788 } 2789 goto out_unlock; 2790 } 2791 } 2792 2793 rc = sidtab_context_to_sid(&sidtab, &newcon, new_sid); 2794 out_unlock: 2795 read_unlock(&policy_rwlock); 2796 context_destroy(&newcon); 2797 out: 2798 return rc; 2799 } 2800 2801 /** 2802 * security_net_peersid_resolve - Compare and resolve two network peer SIDs 2803 * @nlbl_sid: NetLabel SID 2804 * @nlbl_type: NetLabel labeling protocol type 2805 * @xfrm_sid: XFRM SID 2806 * 2807 * Description: 2808 * Compare the @nlbl_sid and @xfrm_sid values and if the two SIDs can be 2809 * resolved into a single SID it is returned via @peer_sid and the function 2810 * returns zero. Otherwise @peer_sid is set to SECSID_NULL and the function 2811 * returns a negative value. A table summarizing the behavior is below: 2812 * 2813 * | function return | @sid 2814 * ------------------------------+-----------------+----------------- 2815 * no peer labels | 0 | SECSID_NULL 2816 * single peer label | 0 | <peer_label> 2817 * multiple, consistent labels | 0 | <peer_label> 2818 * multiple, inconsistent labels | -<errno> | SECSID_NULL 2819 * 2820 */ 2821 int security_net_peersid_resolve(u32 nlbl_sid, u32 nlbl_type, 2822 u32 xfrm_sid, 2823 u32 *peer_sid) 2824 { 2825 int rc; 2826 struct context *nlbl_ctx; 2827 struct context *xfrm_ctx; 2828 2829 *peer_sid = SECSID_NULL; 2830 2831 /* handle the common (which also happens to be the set of easy) cases 2832 * right away, these two if statements catch everything involving a 2833 * single or absent peer SID/label */ 2834 if (xfrm_sid == SECSID_NULL) { 2835 *peer_sid = nlbl_sid; 2836 return 0; 2837 } 2838 /* NOTE: an nlbl_type == NETLBL_NLTYPE_UNLABELED is a "fallback" label 2839 * and is treated as if nlbl_sid == SECSID_NULL when a XFRM SID/label 2840 * is present */ 2841 if (nlbl_sid == SECSID_NULL || nlbl_type == NETLBL_NLTYPE_UNLABELED) { 2842 *peer_sid = xfrm_sid; 2843 return 0; 2844 } 2845 2846 /* we don't need to check ss_initialized here since the only way both 2847 * nlbl_sid and xfrm_sid are not equal to SECSID_NULL would be if the 2848 * security server was initialized and ss_initialized was true */ 2849 if (!policydb.mls_enabled) 2850 return 0; 2851 2852 read_lock(&policy_rwlock); 2853 2854 rc = -EINVAL; 2855 nlbl_ctx = sidtab_search(&sidtab, nlbl_sid); 2856 if (!nlbl_ctx) { 2857 printk(KERN_ERR "SELinux: %s: unrecognized SID %d\n", 2858 __func__, nlbl_sid); 2859 goto out; 2860 } 2861 rc = -EINVAL; 2862 xfrm_ctx = sidtab_search(&sidtab, xfrm_sid); 2863 if (!xfrm_ctx) { 2864 printk(KERN_ERR "SELinux: %s: unrecognized SID %d\n", 2865 __func__, xfrm_sid); 2866 goto out; 2867 } 2868 rc = (mls_context_cmp(nlbl_ctx, xfrm_ctx) ? 0 : -EACCES); 2869 if (rc) 2870 goto out; 2871 2872 /* at present NetLabel SIDs/labels really only carry MLS 2873 * information so if the MLS portion of the NetLabel SID 2874 * matches the MLS portion of the labeled XFRM SID/label 2875 * then pass along the XFRM SID as it is the most 2876 * expressive */ 2877 *peer_sid = xfrm_sid; 2878 out: 2879 read_unlock(&policy_rwlock); 2880 return rc; 2881 } 2882 2883 static int get_classes_callback(void *k, void *d, void *args) 2884 { 2885 struct class_datum *datum = d; 2886 char *name = k, **classes = args; 2887 int value = datum->value - 1; 2888 2889 classes[value] = kstrdup(name, GFP_ATOMIC); 2890 if (!classes[value]) 2891 return -ENOMEM; 2892 2893 return 0; 2894 } 2895 2896 int security_get_classes(char ***classes, int *nclasses) 2897 { 2898 int rc; 2899 2900 read_lock(&policy_rwlock); 2901 2902 rc = -ENOMEM; 2903 *nclasses = policydb.p_classes.nprim; 2904 *classes = kcalloc(*nclasses, sizeof(**classes), GFP_ATOMIC); 2905 if (!*classes) 2906 goto out; 2907 2908 rc = hashtab_map(policydb.p_classes.table, get_classes_callback, 2909 *classes); 2910 if (rc) { 2911 int i; 2912 for (i = 0; i < *nclasses; i++) 2913 kfree((*classes)[i]); 2914 kfree(*classes); 2915 } 2916 2917 out: 2918 read_unlock(&policy_rwlock); 2919 return rc; 2920 } 2921 2922 static int get_permissions_callback(void *k, void *d, void *args) 2923 { 2924 struct perm_datum *datum = d; 2925 char *name = k, **perms = args; 2926 int value = datum->value - 1; 2927 2928 perms[value] = kstrdup(name, GFP_ATOMIC); 2929 if (!perms[value]) 2930 return -ENOMEM; 2931 2932 return 0; 2933 } 2934 2935 int security_get_permissions(char *class, char ***perms, int *nperms) 2936 { 2937 int rc, i; 2938 struct class_datum *match; 2939 2940 read_lock(&policy_rwlock); 2941 2942 rc = -EINVAL; 2943 match = hashtab_search(policydb.p_classes.table, class); 2944 if (!match) { 2945 printk(KERN_ERR "SELinux: %s: unrecognized class %s\n", 2946 __func__, class); 2947 goto out; 2948 } 2949 2950 rc = -ENOMEM; 2951 *nperms = match->permissions.nprim; 2952 *perms = kcalloc(*nperms, sizeof(**perms), GFP_ATOMIC); 2953 if (!*perms) 2954 goto out; 2955 2956 if (match->comdatum) { 2957 rc = hashtab_map(match->comdatum->permissions.table, 2958 get_permissions_callback, *perms); 2959 if (rc) 2960 goto err; 2961 } 2962 2963 rc = hashtab_map(match->permissions.table, get_permissions_callback, 2964 *perms); 2965 if (rc) 2966 goto err; 2967 2968 out: 2969 read_unlock(&policy_rwlock); 2970 return rc; 2971 2972 err: 2973 read_unlock(&policy_rwlock); 2974 for (i = 0; i < *nperms; i++) 2975 kfree((*perms)[i]); 2976 kfree(*perms); 2977 return rc; 2978 } 2979 2980 int security_get_reject_unknown(void) 2981 { 2982 return policydb.reject_unknown; 2983 } 2984 2985 int security_get_allow_unknown(void) 2986 { 2987 return policydb.allow_unknown; 2988 } 2989 2990 /** 2991 * security_policycap_supported - Check for a specific policy capability 2992 * @req_cap: capability 2993 * 2994 * Description: 2995 * This function queries the currently loaded policy to see if it supports the 2996 * capability specified by @req_cap. Returns true (1) if the capability is 2997 * supported, false (0) if it isn't supported. 2998 * 2999 */ 3000 int security_policycap_supported(unsigned int req_cap) 3001 { 3002 int rc; 3003 3004 read_lock(&policy_rwlock); 3005 rc = ebitmap_get_bit(&policydb.policycaps, req_cap); 3006 read_unlock(&policy_rwlock); 3007 3008 return rc; 3009 } 3010 3011 struct selinux_audit_rule { 3012 u32 au_seqno; 3013 struct context au_ctxt; 3014 }; 3015 3016 void selinux_audit_rule_free(void *vrule) 3017 { 3018 struct selinux_audit_rule *rule = vrule; 3019 3020 if (rule) { 3021 context_destroy(&rule->au_ctxt); 3022 kfree(rule); 3023 } 3024 } 3025 3026 int selinux_audit_rule_init(u32 field, u32 op, char *rulestr, void **vrule) 3027 { 3028 struct selinux_audit_rule *tmprule; 3029 struct role_datum *roledatum; 3030 struct type_datum *typedatum; 3031 struct user_datum *userdatum; 3032 struct selinux_audit_rule **rule = (struct selinux_audit_rule **)vrule; 3033 int rc = 0; 3034 3035 *rule = NULL; 3036 3037 if (!ss_initialized) 3038 return -EOPNOTSUPP; 3039 3040 switch (field) { 3041 case AUDIT_SUBJ_USER: 3042 case AUDIT_SUBJ_ROLE: 3043 case AUDIT_SUBJ_TYPE: 3044 case AUDIT_OBJ_USER: 3045 case AUDIT_OBJ_ROLE: 3046 case AUDIT_OBJ_TYPE: 3047 /* only 'equals' and 'not equals' fit user, role, and type */ 3048 if (op != Audit_equal && op != Audit_not_equal) 3049 return -EINVAL; 3050 break; 3051 case AUDIT_SUBJ_SEN: 3052 case AUDIT_SUBJ_CLR: 3053 case AUDIT_OBJ_LEV_LOW: 3054 case AUDIT_OBJ_LEV_HIGH: 3055 /* we do not allow a range, indicated by the presence of '-' */ 3056 if (strchr(rulestr, '-')) 3057 return -EINVAL; 3058 break; 3059 default: 3060 /* only the above fields are valid */ 3061 return -EINVAL; 3062 } 3063 3064 tmprule = kzalloc(sizeof(struct selinux_audit_rule), GFP_KERNEL); 3065 if (!tmprule) 3066 return -ENOMEM; 3067 3068 context_init(&tmprule->au_ctxt); 3069 3070 read_lock(&policy_rwlock); 3071 3072 tmprule->au_seqno = latest_granting; 3073 3074 switch (field) { 3075 case AUDIT_SUBJ_USER: 3076 case AUDIT_OBJ_USER: 3077 rc = -EINVAL; 3078 userdatum = hashtab_search(policydb.p_users.table, rulestr); 3079 if (!userdatum) 3080 goto out; 3081 tmprule->au_ctxt.user = userdatum->value; 3082 break; 3083 case AUDIT_SUBJ_ROLE: 3084 case AUDIT_OBJ_ROLE: 3085 rc = -EINVAL; 3086 roledatum = hashtab_search(policydb.p_roles.table, rulestr); 3087 if (!roledatum) 3088 goto out; 3089 tmprule->au_ctxt.role = roledatum->value; 3090 break; 3091 case AUDIT_SUBJ_TYPE: 3092 case AUDIT_OBJ_TYPE: 3093 rc = -EINVAL; 3094 typedatum = hashtab_search(policydb.p_types.table, rulestr); 3095 if (!typedatum) 3096 goto out; 3097 tmprule->au_ctxt.type = typedatum->value; 3098 break; 3099 case AUDIT_SUBJ_SEN: 3100 case AUDIT_SUBJ_CLR: 3101 case AUDIT_OBJ_LEV_LOW: 3102 case AUDIT_OBJ_LEV_HIGH: 3103 rc = mls_from_string(rulestr, &tmprule->au_ctxt, GFP_ATOMIC); 3104 if (rc) 3105 goto out; 3106 break; 3107 } 3108 rc = 0; 3109 out: 3110 read_unlock(&policy_rwlock); 3111 3112 if (rc) { 3113 selinux_audit_rule_free(tmprule); 3114 tmprule = NULL; 3115 } 3116 3117 *rule = tmprule; 3118 3119 return rc; 3120 } 3121 3122 /* Check to see if the rule contains any selinux fields */ 3123 int selinux_audit_rule_known(struct audit_krule *rule) 3124 { 3125 int i; 3126 3127 for (i = 0; i < rule->field_count; i++) { 3128 struct audit_field *f = &rule->fields[i]; 3129 switch (f->type) { 3130 case AUDIT_SUBJ_USER: 3131 case AUDIT_SUBJ_ROLE: 3132 case AUDIT_SUBJ_TYPE: 3133 case AUDIT_SUBJ_SEN: 3134 case AUDIT_SUBJ_CLR: 3135 case AUDIT_OBJ_USER: 3136 case AUDIT_OBJ_ROLE: 3137 case AUDIT_OBJ_TYPE: 3138 case AUDIT_OBJ_LEV_LOW: 3139 case AUDIT_OBJ_LEV_HIGH: 3140 return 1; 3141 } 3142 } 3143 3144 return 0; 3145 } 3146 3147 int selinux_audit_rule_match(u32 sid, u32 field, u32 op, void *vrule, 3148 struct audit_context *actx) 3149 { 3150 struct context *ctxt; 3151 struct mls_level *level; 3152 struct selinux_audit_rule *rule = vrule; 3153 int match = 0; 3154 3155 if (unlikely(!rule)) { 3156 WARN_ONCE(1, "selinux_audit_rule_match: missing rule\n"); 3157 return -ENOENT; 3158 } 3159 3160 read_lock(&policy_rwlock); 3161 3162 if (rule->au_seqno < latest_granting) { 3163 match = -ESTALE; 3164 goto out; 3165 } 3166 3167 ctxt = sidtab_search(&sidtab, sid); 3168 if (unlikely(!ctxt)) { 3169 WARN_ONCE(1, "selinux_audit_rule_match: unrecognized SID %d\n", 3170 sid); 3171 match = -ENOENT; 3172 goto out; 3173 } 3174 3175 /* a field/op pair that is not caught here will simply fall through 3176 without a match */ 3177 switch (field) { 3178 case AUDIT_SUBJ_USER: 3179 case AUDIT_OBJ_USER: 3180 switch (op) { 3181 case Audit_equal: 3182 match = (ctxt->user == rule->au_ctxt.user); 3183 break; 3184 case Audit_not_equal: 3185 match = (ctxt->user != rule->au_ctxt.user); 3186 break; 3187 } 3188 break; 3189 case AUDIT_SUBJ_ROLE: 3190 case AUDIT_OBJ_ROLE: 3191 switch (op) { 3192 case Audit_equal: 3193 match = (ctxt->role == rule->au_ctxt.role); 3194 break; 3195 case Audit_not_equal: 3196 match = (ctxt->role != rule->au_ctxt.role); 3197 break; 3198 } 3199 break; 3200 case AUDIT_SUBJ_TYPE: 3201 case AUDIT_OBJ_TYPE: 3202 switch (op) { 3203 case Audit_equal: 3204 match = (ctxt->type == rule->au_ctxt.type); 3205 break; 3206 case Audit_not_equal: 3207 match = (ctxt->type != rule->au_ctxt.type); 3208 break; 3209 } 3210 break; 3211 case AUDIT_SUBJ_SEN: 3212 case AUDIT_SUBJ_CLR: 3213 case AUDIT_OBJ_LEV_LOW: 3214 case AUDIT_OBJ_LEV_HIGH: 3215 level = ((field == AUDIT_SUBJ_SEN || 3216 field == AUDIT_OBJ_LEV_LOW) ? 3217 &ctxt->range.level[0] : &ctxt->range.level[1]); 3218 switch (op) { 3219 case Audit_equal: 3220 match = mls_level_eq(&rule->au_ctxt.range.level[0], 3221 level); 3222 break; 3223 case Audit_not_equal: 3224 match = !mls_level_eq(&rule->au_ctxt.range.level[0], 3225 level); 3226 break; 3227 case Audit_lt: 3228 match = (mls_level_dom(&rule->au_ctxt.range.level[0], 3229 level) && 3230 !mls_level_eq(&rule->au_ctxt.range.level[0], 3231 level)); 3232 break; 3233 case Audit_le: 3234 match = mls_level_dom(&rule->au_ctxt.range.level[0], 3235 level); 3236 break; 3237 case Audit_gt: 3238 match = (mls_level_dom(level, 3239 &rule->au_ctxt.range.level[0]) && 3240 !mls_level_eq(level, 3241 &rule->au_ctxt.range.level[0])); 3242 break; 3243 case Audit_ge: 3244 match = mls_level_dom(level, 3245 &rule->au_ctxt.range.level[0]); 3246 break; 3247 } 3248 } 3249 3250 out: 3251 read_unlock(&policy_rwlock); 3252 return match; 3253 } 3254 3255 static int (*aurule_callback)(void) = audit_update_lsm_rules; 3256 3257 static int aurule_avc_callback(u32 event) 3258 { 3259 int err = 0; 3260 3261 if (event == AVC_CALLBACK_RESET && aurule_callback) 3262 err = aurule_callback(); 3263 return err; 3264 } 3265 3266 static int __init aurule_init(void) 3267 { 3268 int err; 3269 3270 err = avc_add_callback(aurule_avc_callback, AVC_CALLBACK_RESET); 3271 if (err) 3272 panic("avc_add_callback() failed, error %d\n", err); 3273 3274 return err; 3275 } 3276 __initcall(aurule_init); 3277 3278 #ifdef CONFIG_NETLABEL 3279 /** 3280 * security_netlbl_cache_add - Add an entry to the NetLabel cache 3281 * @secattr: the NetLabel packet security attributes 3282 * @sid: the SELinux SID 3283 * 3284 * Description: 3285 * Attempt to cache the context in @ctx, which was derived from the packet in 3286 * @skb, in the NetLabel subsystem cache. This function assumes @secattr has 3287 * already been initialized. 3288 * 3289 */ 3290 static void security_netlbl_cache_add(struct netlbl_lsm_secattr *secattr, 3291 u32 sid) 3292 { 3293 u32 *sid_cache; 3294 3295 sid_cache = kmalloc(sizeof(*sid_cache), GFP_ATOMIC); 3296 if (sid_cache == NULL) 3297 return; 3298 secattr->cache = netlbl_secattr_cache_alloc(GFP_ATOMIC); 3299 if (secattr->cache == NULL) { 3300 kfree(sid_cache); 3301 return; 3302 } 3303 3304 *sid_cache = sid; 3305 secattr->cache->free = kfree; 3306 secattr->cache->data = sid_cache; 3307 secattr->flags |= NETLBL_SECATTR_CACHE; 3308 } 3309 3310 /** 3311 * security_netlbl_secattr_to_sid - Convert a NetLabel secattr to a SELinux SID 3312 * @secattr: the NetLabel packet security attributes 3313 * @sid: the SELinux SID 3314 * 3315 * Description: 3316 * Convert the given NetLabel security attributes in @secattr into a 3317 * SELinux SID. If the @secattr field does not contain a full SELinux 3318 * SID/context then use SECINITSID_NETMSG as the foundation. If possible the 3319 * 'cache' field of @secattr is set and the CACHE flag is set; this is to 3320 * allow the @secattr to be used by NetLabel to cache the secattr to SID 3321 * conversion for future lookups. Returns zero on success, negative values on 3322 * failure. 3323 * 3324 */ 3325 int security_netlbl_secattr_to_sid(struct netlbl_lsm_secattr *secattr, 3326 u32 *sid) 3327 { 3328 int rc; 3329 struct context *ctx; 3330 struct context ctx_new; 3331 3332 if (!ss_initialized) { 3333 *sid = SECSID_NULL; 3334 return 0; 3335 } 3336 3337 read_lock(&policy_rwlock); 3338 3339 if (secattr->flags & NETLBL_SECATTR_CACHE) 3340 *sid = *(u32 *)secattr->cache->data; 3341 else if (secattr->flags & NETLBL_SECATTR_SECID) 3342 *sid = secattr->attr.secid; 3343 else if (secattr->flags & NETLBL_SECATTR_MLS_LVL) { 3344 rc = -EIDRM; 3345 ctx = sidtab_search(&sidtab, SECINITSID_NETMSG); 3346 if (ctx == NULL) 3347 goto out; 3348 3349 context_init(&ctx_new); 3350 ctx_new.user = ctx->user; 3351 ctx_new.role = ctx->role; 3352 ctx_new.type = ctx->type; 3353 mls_import_netlbl_lvl(&ctx_new, secattr); 3354 if (secattr->flags & NETLBL_SECATTR_MLS_CAT) { 3355 rc = mls_import_netlbl_cat(&ctx_new, secattr); 3356 if (rc) 3357 goto out; 3358 } 3359 rc = -EIDRM; 3360 if (!mls_context_isvalid(&policydb, &ctx_new)) 3361 goto out_free; 3362 3363 rc = sidtab_context_to_sid(&sidtab, &ctx_new, sid); 3364 if (rc) 3365 goto out_free; 3366 3367 security_netlbl_cache_add(secattr, *sid); 3368 3369 ebitmap_destroy(&ctx_new.range.level[0].cat); 3370 } else 3371 *sid = SECSID_NULL; 3372 3373 read_unlock(&policy_rwlock); 3374 return 0; 3375 out_free: 3376 ebitmap_destroy(&ctx_new.range.level[0].cat); 3377 out: 3378 read_unlock(&policy_rwlock); 3379 return rc; 3380 } 3381 3382 /** 3383 * security_netlbl_sid_to_secattr - Convert a SELinux SID to a NetLabel secattr 3384 * @sid: the SELinux SID 3385 * @secattr: the NetLabel packet security attributes 3386 * 3387 * Description: 3388 * Convert the given SELinux SID in @sid into a NetLabel security attribute. 3389 * Returns zero on success, negative values on failure. 3390 * 3391 */ 3392 int security_netlbl_sid_to_secattr(u32 sid, struct netlbl_lsm_secattr *secattr) 3393 { 3394 int rc; 3395 struct context *ctx; 3396 3397 if (!ss_initialized) 3398 return 0; 3399 3400 read_lock(&policy_rwlock); 3401 3402 rc = -ENOENT; 3403 ctx = sidtab_search(&sidtab, sid); 3404 if (ctx == NULL) 3405 goto out; 3406 3407 rc = -ENOMEM; 3408 secattr->domain = kstrdup(sym_name(&policydb, SYM_TYPES, ctx->type - 1), 3409 GFP_ATOMIC); 3410 if (secattr->domain == NULL) 3411 goto out; 3412 3413 secattr->attr.secid = sid; 3414 secattr->flags |= NETLBL_SECATTR_DOMAIN_CPY | NETLBL_SECATTR_SECID; 3415 mls_export_netlbl_lvl(ctx, secattr); 3416 rc = mls_export_netlbl_cat(ctx, secattr); 3417 out: 3418 read_unlock(&policy_rwlock); 3419 return rc; 3420 } 3421 #endif /* CONFIG_NETLABEL */ 3422 3423 /** 3424 * security_read_policy - read the policy. 3425 * @data: binary policy data 3426 * @len: length of data in bytes 3427 * 3428 */ 3429 int security_read_policy(void **data, size_t *len) 3430 { 3431 int rc; 3432 struct policy_file fp; 3433 3434 if (!ss_initialized) 3435 return -EINVAL; 3436 3437 *len = security_policydb_len(); 3438 3439 *data = vmalloc_user(*len); 3440 if (!*data) 3441 return -ENOMEM; 3442 3443 fp.data = *data; 3444 fp.len = *len; 3445 3446 read_lock(&policy_rwlock); 3447 rc = policydb_write(&policydb, &fp); 3448 read_unlock(&policy_rwlock); 3449 3450 if (rc) 3451 return rc; 3452 3453 *len = (unsigned long)fp.data - (unsigned long)*data; 3454 return 0; 3455 3456 } 3457