xref: /linux/security/selinux/ss/services.c (revision d91517839e5d95adc0cf4b28caa7af62a71de526)
1 /*
2  * Implementation of the security services.
3  *
4  * Authors : Stephen Smalley, <sds@epoch.ncsc.mil>
5  *	     James Morris <jmorris@redhat.com>
6  *
7  * Updated: Trusted Computer Solutions, Inc. <dgoeddel@trustedcs.com>
8  *
9  *	Support for enhanced MLS infrastructure.
10  *	Support for context based audit filters.
11  *
12  * Updated: Frank Mayer <mayerf@tresys.com> and Karl MacMillan <kmacmillan@tresys.com>
13  *
14  *	Added conditional policy language extensions
15  *
16  * Updated: Hewlett-Packard <paul@paul-moore.com>
17  *
18  *      Added support for NetLabel
19  *      Added support for the policy capability bitmap
20  *
21  * Updated: Chad Sellers <csellers@tresys.com>
22  *
23  *  Added validation of kernel classes and permissions
24  *
25  * Updated: KaiGai Kohei <kaigai@ak.jp.nec.com>
26  *
27  *  Added support for bounds domain and audit messaged on masked permissions
28  *
29  * Updated: Guido Trentalancia <guido@trentalancia.com>
30  *
31  *  Added support for runtime switching of the policy type
32  *
33  * Copyright (C) 2008, 2009 NEC Corporation
34  * Copyright (C) 2006, 2007 Hewlett-Packard Development Company, L.P.
35  * Copyright (C) 2004-2006 Trusted Computer Solutions, Inc.
36  * Copyright (C) 2003 - 2004, 2006 Tresys Technology, LLC
37  * Copyright (C) 2003 Red Hat, Inc., James Morris <jmorris@redhat.com>
38  *	This program is free software; you can redistribute it and/or modify
39  *	it under the terms of the GNU General Public License as published by
40  *	the Free Software Foundation, version 2.
41  */
42 #include <linux/kernel.h>
43 #include <linux/slab.h>
44 #include <linux/string.h>
45 #include <linux/spinlock.h>
46 #include <linux/rcupdate.h>
47 #include <linux/errno.h>
48 #include <linux/in.h>
49 #include <linux/sched.h>
50 #include <linux/audit.h>
51 #include <linux/mutex.h>
52 #include <linux/selinux.h>
53 #include <linux/flex_array.h>
54 #include <linux/vmalloc.h>
55 #include <net/netlabel.h>
56 
57 #include "flask.h"
58 #include "avc.h"
59 #include "avc_ss.h"
60 #include "security.h"
61 #include "context.h"
62 #include "policydb.h"
63 #include "sidtab.h"
64 #include "services.h"
65 #include "conditional.h"
66 #include "mls.h"
67 #include "objsec.h"
68 #include "netlabel.h"
69 #include "xfrm.h"
70 #include "ebitmap.h"
71 #include "audit.h"
72 
73 int selinux_policycap_netpeer;
74 int selinux_policycap_openperm;
75 int selinux_policycap_alwaysnetwork;
76 
77 static DEFINE_RWLOCK(policy_rwlock);
78 
79 static struct sidtab sidtab;
80 struct policydb policydb;
81 int ss_initialized;
82 
83 /*
84  * The largest sequence number that has been used when
85  * providing an access decision to the access vector cache.
86  * The sequence number only changes when a policy change
87  * occurs.
88  */
89 static u32 latest_granting;
90 
91 /* Forward declaration. */
92 static int context_struct_to_string(struct context *context, char **scontext,
93 				    u32 *scontext_len);
94 
95 static void context_struct_compute_av(struct context *scontext,
96 				      struct context *tcontext,
97 				      u16 tclass,
98 				      struct av_decision *avd);
99 
100 struct selinux_mapping {
101 	u16 value; /* policy value */
102 	unsigned num_perms;
103 	u32 perms[sizeof(u32) * 8];
104 };
105 
106 static struct selinux_mapping *current_mapping;
107 static u16 current_mapping_size;
108 
109 static int selinux_set_mapping(struct policydb *pol,
110 			       struct security_class_mapping *map,
111 			       struct selinux_mapping **out_map_p,
112 			       u16 *out_map_size)
113 {
114 	struct selinux_mapping *out_map = NULL;
115 	size_t size = sizeof(struct selinux_mapping);
116 	u16 i, j;
117 	unsigned k;
118 	bool print_unknown_handle = false;
119 
120 	/* Find number of classes in the input mapping */
121 	if (!map)
122 		return -EINVAL;
123 	i = 0;
124 	while (map[i].name)
125 		i++;
126 
127 	/* Allocate space for the class records, plus one for class zero */
128 	out_map = kcalloc(++i, size, GFP_ATOMIC);
129 	if (!out_map)
130 		return -ENOMEM;
131 
132 	/* Store the raw class and permission values */
133 	j = 0;
134 	while (map[j].name) {
135 		struct security_class_mapping *p_in = map + (j++);
136 		struct selinux_mapping *p_out = out_map + j;
137 
138 		/* An empty class string skips ahead */
139 		if (!strcmp(p_in->name, "")) {
140 			p_out->num_perms = 0;
141 			continue;
142 		}
143 
144 		p_out->value = string_to_security_class(pol, p_in->name);
145 		if (!p_out->value) {
146 			printk(KERN_INFO
147 			       "SELinux:  Class %s not defined in policy.\n",
148 			       p_in->name);
149 			if (pol->reject_unknown)
150 				goto err;
151 			p_out->num_perms = 0;
152 			print_unknown_handle = true;
153 			continue;
154 		}
155 
156 		k = 0;
157 		while (p_in->perms && p_in->perms[k]) {
158 			/* An empty permission string skips ahead */
159 			if (!*p_in->perms[k]) {
160 				k++;
161 				continue;
162 			}
163 			p_out->perms[k] = string_to_av_perm(pol, p_out->value,
164 							    p_in->perms[k]);
165 			if (!p_out->perms[k]) {
166 				printk(KERN_INFO
167 				       "SELinux:  Permission %s in class %s not defined in policy.\n",
168 				       p_in->perms[k], p_in->name);
169 				if (pol->reject_unknown)
170 					goto err;
171 				print_unknown_handle = true;
172 			}
173 
174 			k++;
175 		}
176 		p_out->num_perms = k;
177 	}
178 
179 	if (print_unknown_handle)
180 		printk(KERN_INFO "SELinux: the above unknown classes and permissions will be %s\n",
181 		       pol->allow_unknown ? "allowed" : "denied");
182 
183 	*out_map_p = out_map;
184 	*out_map_size = i;
185 	return 0;
186 err:
187 	kfree(out_map);
188 	return -EINVAL;
189 }
190 
191 /*
192  * Get real, policy values from mapped values
193  */
194 
195 static u16 unmap_class(u16 tclass)
196 {
197 	if (tclass < current_mapping_size)
198 		return current_mapping[tclass].value;
199 
200 	return tclass;
201 }
202 
203 /*
204  * Get kernel value for class from its policy value
205  */
206 static u16 map_class(u16 pol_value)
207 {
208 	u16 i;
209 
210 	for (i = 1; i < current_mapping_size; i++) {
211 		if (current_mapping[i].value == pol_value)
212 			return i;
213 	}
214 
215 	return SECCLASS_NULL;
216 }
217 
218 static void map_decision(u16 tclass, struct av_decision *avd,
219 			 int allow_unknown)
220 {
221 	if (tclass < current_mapping_size) {
222 		unsigned i, n = current_mapping[tclass].num_perms;
223 		u32 result;
224 
225 		for (i = 0, result = 0; i < n; i++) {
226 			if (avd->allowed & current_mapping[tclass].perms[i])
227 				result |= 1<<i;
228 			if (allow_unknown && !current_mapping[tclass].perms[i])
229 				result |= 1<<i;
230 		}
231 		avd->allowed = result;
232 
233 		for (i = 0, result = 0; i < n; i++)
234 			if (avd->auditallow & current_mapping[tclass].perms[i])
235 				result |= 1<<i;
236 		avd->auditallow = result;
237 
238 		for (i = 0, result = 0; i < n; i++) {
239 			if (avd->auditdeny & current_mapping[tclass].perms[i])
240 				result |= 1<<i;
241 			if (!allow_unknown && !current_mapping[tclass].perms[i])
242 				result |= 1<<i;
243 		}
244 		/*
245 		 * In case the kernel has a bug and requests a permission
246 		 * between num_perms and the maximum permission number, we
247 		 * should audit that denial
248 		 */
249 		for (; i < (sizeof(u32)*8); i++)
250 			result |= 1<<i;
251 		avd->auditdeny = result;
252 	}
253 }
254 
255 int security_mls_enabled(void)
256 {
257 	return policydb.mls_enabled;
258 }
259 
260 /*
261  * Return the boolean value of a constraint expression
262  * when it is applied to the specified source and target
263  * security contexts.
264  *
265  * xcontext is a special beast...  It is used by the validatetrans rules
266  * only.  For these rules, scontext is the context before the transition,
267  * tcontext is the context after the transition, and xcontext is the context
268  * of the process performing the transition.  All other callers of
269  * constraint_expr_eval should pass in NULL for xcontext.
270  */
271 static int constraint_expr_eval(struct context *scontext,
272 				struct context *tcontext,
273 				struct context *xcontext,
274 				struct constraint_expr *cexpr)
275 {
276 	u32 val1, val2;
277 	struct context *c;
278 	struct role_datum *r1, *r2;
279 	struct mls_level *l1, *l2;
280 	struct constraint_expr *e;
281 	int s[CEXPR_MAXDEPTH];
282 	int sp = -1;
283 
284 	for (e = cexpr; e; e = e->next) {
285 		switch (e->expr_type) {
286 		case CEXPR_NOT:
287 			BUG_ON(sp < 0);
288 			s[sp] = !s[sp];
289 			break;
290 		case CEXPR_AND:
291 			BUG_ON(sp < 1);
292 			sp--;
293 			s[sp] &= s[sp + 1];
294 			break;
295 		case CEXPR_OR:
296 			BUG_ON(sp < 1);
297 			sp--;
298 			s[sp] |= s[sp + 1];
299 			break;
300 		case CEXPR_ATTR:
301 			if (sp == (CEXPR_MAXDEPTH - 1))
302 				return 0;
303 			switch (e->attr) {
304 			case CEXPR_USER:
305 				val1 = scontext->user;
306 				val2 = tcontext->user;
307 				break;
308 			case CEXPR_TYPE:
309 				val1 = scontext->type;
310 				val2 = tcontext->type;
311 				break;
312 			case CEXPR_ROLE:
313 				val1 = scontext->role;
314 				val2 = tcontext->role;
315 				r1 = policydb.role_val_to_struct[val1 - 1];
316 				r2 = policydb.role_val_to_struct[val2 - 1];
317 				switch (e->op) {
318 				case CEXPR_DOM:
319 					s[++sp] = ebitmap_get_bit(&r1->dominates,
320 								  val2 - 1);
321 					continue;
322 				case CEXPR_DOMBY:
323 					s[++sp] = ebitmap_get_bit(&r2->dominates,
324 								  val1 - 1);
325 					continue;
326 				case CEXPR_INCOMP:
327 					s[++sp] = (!ebitmap_get_bit(&r1->dominates,
328 								    val2 - 1) &&
329 						   !ebitmap_get_bit(&r2->dominates,
330 								    val1 - 1));
331 					continue;
332 				default:
333 					break;
334 				}
335 				break;
336 			case CEXPR_L1L2:
337 				l1 = &(scontext->range.level[0]);
338 				l2 = &(tcontext->range.level[0]);
339 				goto mls_ops;
340 			case CEXPR_L1H2:
341 				l1 = &(scontext->range.level[0]);
342 				l2 = &(tcontext->range.level[1]);
343 				goto mls_ops;
344 			case CEXPR_H1L2:
345 				l1 = &(scontext->range.level[1]);
346 				l2 = &(tcontext->range.level[0]);
347 				goto mls_ops;
348 			case CEXPR_H1H2:
349 				l1 = &(scontext->range.level[1]);
350 				l2 = &(tcontext->range.level[1]);
351 				goto mls_ops;
352 			case CEXPR_L1H1:
353 				l1 = &(scontext->range.level[0]);
354 				l2 = &(scontext->range.level[1]);
355 				goto mls_ops;
356 			case CEXPR_L2H2:
357 				l1 = &(tcontext->range.level[0]);
358 				l2 = &(tcontext->range.level[1]);
359 				goto mls_ops;
360 mls_ops:
361 			switch (e->op) {
362 			case CEXPR_EQ:
363 				s[++sp] = mls_level_eq(l1, l2);
364 				continue;
365 			case CEXPR_NEQ:
366 				s[++sp] = !mls_level_eq(l1, l2);
367 				continue;
368 			case CEXPR_DOM:
369 				s[++sp] = mls_level_dom(l1, l2);
370 				continue;
371 			case CEXPR_DOMBY:
372 				s[++sp] = mls_level_dom(l2, l1);
373 				continue;
374 			case CEXPR_INCOMP:
375 				s[++sp] = mls_level_incomp(l2, l1);
376 				continue;
377 			default:
378 				BUG();
379 				return 0;
380 			}
381 			break;
382 			default:
383 				BUG();
384 				return 0;
385 			}
386 
387 			switch (e->op) {
388 			case CEXPR_EQ:
389 				s[++sp] = (val1 == val2);
390 				break;
391 			case CEXPR_NEQ:
392 				s[++sp] = (val1 != val2);
393 				break;
394 			default:
395 				BUG();
396 				return 0;
397 			}
398 			break;
399 		case CEXPR_NAMES:
400 			if (sp == (CEXPR_MAXDEPTH-1))
401 				return 0;
402 			c = scontext;
403 			if (e->attr & CEXPR_TARGET)
404 				c = tcontext;
405 			else if (e->attr & CEXPR_XTARGET) {
406 				c = xcontext;
407 				if (!c) {
408 					BUG();
409 					return 0;
410 				}
411 			}
412 			if (e->attr & CEXPR_USER)
413 				val1 = c->user;
414 			else if (e->attr & CEXPR_ROLE)
415 				val1 = c->role;
416 			else if (e->attr & CEXPR_TYPE)
417 				val1 = c->type;
418 			else {
419 				BUG();
420 				return 0;
421 			}
422 
423 			switch (e->op) {
424 			case CEXPR_EQ:
425 				s[++sp] = ebitmap_get_bit(&e->names, val1 - 1);
426 				break;
427 			case CEXPR_NEQ:
428 				s[++sp] = !ebitmap_get_bit(&e->names, val1 - 1);
429 				break;
430 			default:
431 				BUG();
432 				return 0;
433 			}
434 			break;
435 		default:
436 			BUG();
437 			return 0;
438 		}
439 	}
440 
441 	BUG_ON(sp != 0);
442 	return s[0];
443 }
444 
445 /*
446  * security_dump_masked_av - dumps masked permissions during
447  * security_compute_av due to RBAC, MLS/Constraint and Type bounds.
448  */
449 static int dump_masked_av_helper(void *k, void *d, void *args)
450 {
451 	struct perm_datum *pdatum = d;
452 	char **permission_names = args;
453 
454 	BUG_ON(pdatum->value < 1 || pdatum->value > 32);
455 
456 	permission_names[pdatum->value - 1] = (char *)k;
457 
458 	return 0;
459 }
460 
461 static void security_dump_masked_av(struct context *scontext,
462 				    struct context *tcontext,
463 				    u16 tclass,
464 				    u32 permissions,
465 				    const char *reason)
466 {
467 	struct common_datum *common_dat;
468 	struct class_datum *tclass_dat;
469 	struct audit_buffer *ab;
470 	char *tclass_name;
471 	char *scontext_name = NULL;
472 	char *tcontext_name = NULL;
473 	char *permission_names[32];
474 	int index;
475 	u32 length;
476 	bool need_comma = false;
477 
478 	if (!permissions)
479 		return;
480 
481 	tclass_name = sym_name(&policydb, SYM_CLASSES, tclass - 1);
482 	tclass_dat = policydb.class_val_to_struct[tclass - 1];
483 	common_dat = tclass_dat->comdatum;
484 
485 	/* init permission_names */
486 	if (common_dat &&
487 	    hashtab_map(common_dat->permissions.table,
488 			dump_masked_av_helper, permission_names) < 0)
489 		goto out;
490 
491 	if (hashtab_map(tclass_dat->permissions.table,
492 			dump_masked_av_helper, permission_names) < 0)
493 		goto out;
494 
495 	/* get scontext/tcontext in text form */
496 	if (context_struct_to_string(scontext,
497 				     &scontext_name, &length) < 0)
498 		goto out;
499 
500 	if (context_struct_to_string(tcontext,
501 				     &tcontext_name, &length) < 0)
502 		goto out;
503 
504 	/* audit a message */
505 	ab = audit_log_start(current->audit_context,
506 			     GFP_ATOMIC, AUDIT_SELINUX_ERR);
507 	if (!ab)
508 		goto out;
509 
510 	audit_log_format(ab, "op=security_compute_av reason=%s "
511 			 "scontext=%s tcontext=%s tclass=%s perms=",
512 			 reason, scontext_name, tcontext_name, tclass_name);
513 
514 	for (index = 0; index < 32; index++) {
515 		u32 mask = (1 << index);
516 
517 		if ((mask & permissions) == 0)
518 			continue;
519 
520 		audit_log_format(ab, "%s%s",
521 				 need_comma ? "," : "",
522 				 permission_names[index]
523 				 ? permission_names[index] : "????");
524 		need_comma = true;
525 	}
526 	audit_log_end(ab);
527 out:
528 	/* release scontext/tcontext */
529 	kfree(tcontext_name);
530 	kfree(scontext_name);
531 
532 	return;
533 }
534 
535 /*
536  * security_boundary_permission - drops violated permissions
537  * on boundary constraint.
538  */
539 static void type_attribute_bounds_av(struct context *scontext,
540 				     struct context *tcontext,
541 				     u16 tclass,
542 				     struct av_decision *avd)
543 {
544 	struct context lo_scontext;
545 	struct context lo_tcontext;
546 	struct av_decision lo_avd;
547 	struct type_datum *source;
548 	struct type_datum *target;
549 	u32 masked = 0;
550 
551 	source = flex_array_get_ptr(policydb.type_val_to_struct_array,
552 				    scontext->type - 1);
553 	BUG_ON(!source);
554 
555 	target = flex_array_get_ptr(policydb.type_val_to_struct_array,
556 				    tcontext->type - 1);
557 	BUG_ON(!target);
558 
559 	if (source->bounds) {
560 		memset(&lo_avd, 0, sizeof(lo_avd));
561 
562 		memcpy(&lo_scontext, scontext, sizeof(lo_scontext));
563 		lo_scontext.type = source->bounds;
564 
565 		context_struct_compute_av(&lo_scontext,
566 					  tcontext,
567 					  tclass,
568 					  &lo_avd);
569 		if ((lo_avd.allowed & avd->allowed) == avd->allowed)
570 			return;		/* no masked permission */
571 		masked = ~lo_avd.allowed & avd->allowed;
572 	}
573 
574 	if (target->bounds) {
575 		memset(&lo_avd, 0, sizeof(lo_avd));
576 
577 		memcpy(&lo_tcontext, tcontext, sizeof(lo_tcontext));
578 		lo_tcontext.type = target->bounds;
579 
580 		context_struct_compute_av(scontext,
581 					  &lo_tcontext,
582 					  tclass,
583 					  &lo_avd);
584 		if ((lo_avd.allowed & avd->allowed) == avd->allowed)
585 			return;		/* no masked permission */
586 		masked = ~lo_avd.allowed & avd->allowed;
587 	}
588 
589 	if (source->bounds && target->bounds) {
590 		memset(&lo_avd, 0, sizeof(lo_avd));
591 		/*
592 		 * lo_scontext and lo_tcontext are already
593 		 * set up.
594 		 */
595 
596 		context_struct_compute_av(&lo_scontext,
597 					  &lo_tcontext,
598 					  tclass,
599 					  &lo_avd);
600 		if ((lo_avd.allowed & avd->allowed) == avd->allowed)
601 			return;		/* no masked permission */
602 		masked = ~lo_avd.allowed & avd->allowed;
603 	}
604 
605 	if (masked) {
606 		/* mask violated permissions */
607 		avd->allowed &= ~masked;
608 
609 		/* audit masked permissions */
610 		security_dump_masked_av(scontext, tcontext,
611 					tclass, masked, "bounds");
612 	}
613 }
614 
615 /*
616  * Compute access vectors based on a context structure pair for
617  * the permissions in a particular class.
618  */
619 static void context_struct_compute_av(struct context *scontext,
620 				      struct context *tcontext,
621 				      u16 tclass,
622 				      struct av_decision *avd)
623 {
624 	struct constraint_node *constraint;
625 	struct role_allow *ra;
626 	struct avtab_key avkey;
627 	struct avtab_node *node;
628 	struct class_datum *tclass_datum;
629 	struct ebitmap *sattr, *tattr;
630 	struct ebitmap_node *snode, *tnode;
631 	unsigned int i, j;
632 
633 	avd->allowed = 0;
634 	avd->auditallow = 0;
635 	avd->auditdeny = 0xffffffff;
636 
637 	if (unlikely(!tclass || tclass > policydb.p_classes.nprim)) {
638 		if (printk_ratelimit())
639 			printk(KERN_WARNING "SELinux:  Invalid class %hu\n", tclass);
640 		return;
641 	}
642 
643 	tclass_datum = policydb.class_val_to_struct[tclass - 1];
644 
645 	/*
646 	 * If a specific type enforcement rule was defined for
647 	 * this permission check, then use it.
648 	 */
649 	avkey.target_class = tclass;
650 	avkey.specified = AVTAB_AV;
651 	sattr = flex_array_get(policydb.type_attr_map_array, scontext->type - 1);
652 	BUG_ON(!sattr);
653 	tattr = flex_array_get(policydb.type_attr_map_array, tcontext->type - 1);
654 	BUG_ON(!tattr);
655 	ebitmap_for_each_positive_bit(sattr, snode, i) {
656 		ebitmap_for_each_positive_bit(tattr, tnode, j) {
657 			avkey.source_type = i + 1;
658 			avkey.target_type = j + 1;
659 			for (node = avtab_search_node(&policydb.te_avtab, &avkey);
660 			     node;
661 			     node = avtab_search_node_next(node, avkey.specified)) {
662 				if (node->key.specified == AVTAB_ALLOWED)
663 					avd->allowed |= node->datum.data;
664 				else if (node->key.specified == AVTAB_AUDITALLOW)
665 					avd->auditallow |= node->datum.data;
666 				else if (node->key.specified == AVTAB_AUDITDENY)
667 					avd->auditdeny &= node->datum.data;
668 			}
669 
670 			/* Check conditional av table for additional permissions */
671 			cond_compute_av(&policydb.te_cond_avtab, &avkey, avd);
672 
673 		}
674 	}
675 
676 	/*
677 	 * Remove any permissions prohibited by a constraint (this includes
678 	 * the MLS policy).
679 	 */
680 	constraint = tclass_datum->constraints;
681 	while (constraint) {
682 		if ((constraint->permissions & (avd->allowed)) &&
683 		    !constraint_expr_eval(scontext, tcontext, NULL,
684 					  constraint->expr)) {
685 			avd->allowed &= ~(constraint->permissions);
686 		}
687 		constraint = constraint->next;
688 	}
689 
690 	/*
691 	 * If checking process transition permission and the
692 	 * role is changing, then check the (current_role, new_role)
693 	 * pair.
694 	 */
695 	if (tclass == policydb.process_class &&
696 	    (avd->allowed & policydb.process_trans_perms) &&
697 	    scontext->role != tcontext->role) {
698 		for (ra = policydb.role_allow; ra; ra = ra->next) {
699 			if (scontext->role == ra->role &&
700 			    tcontext->role == ra->new_role)
701 				break;
702 		}
703 		if (!ra)
704 			avd->allowed &= ~policydb.process_trans_perms;
705 	}
706 
707 	/*
708 	 * If the given source and target types have boundary
709 	 * constraint, lazy checks have to mask any violated
710 	 * permission and notice it to userspace via audit.
711 	 */
712 	type_attribute_bounds_av(scontext, tcontext,
713 				 tclass, avd);
714 }
715 
716 static int security_validtrans_handle_fail(struct context *ocontext,
717 					   struct context *ncontext,
718 					   struct context *tcontext,
719 					   u16 tclass)
720 {
721 	char *o = NULL, *n = NULL, *t = NULL;
722 	u32 olen, nlen, tlen;
723 
724 	if (context_struct_to_string(ocontext, &o, &olen))
725 		goto out;
726 	if (context_struct_to_string(ncontext, &n, &nlen))
727 		goto out;
728 	if (context_struct_to_string(tcontext, &t, &tlen))
729 		goto out;
730 	audit_log(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR,
731 		  "security_validate_transition:  denied for"
732 		  " oldcontext=%s newcontext=%s taskcontext=%s tclass=%s",
733 		  o, n, t, sym_name(&policydb, SYM_CLASSES, tclass-1));
734 out:
735 	kfree(o);
736 	kfree(n);
737 	kfree(t);
738 
739 	if (!selinux_enforcing)
740 		return 0;
741 	return -EPERM;
742 }
743 
744 int security_validate_transition(u32 oldsid, u32 newsid, u32 tasksid,
745 				 u16 orig_tclass)
746 {
747 	struct context *ocontext;
748 	struct context *ncontext;
749 	struct context *tcontext;
750 	struct class_datum *tclass_datum;
751 	struct constraint_node *constraint;
752 	u16 tclass;
753 	int rc = 0;
754 
755 	if (!ss_initialized)
756 		return 0;
757 
758 	read_lock(&policy_rwlock);
759 
760 	tclass = unmap_class(orig_tclass);
761 
762 	if (!tclass || tclass > policydb.p_classes.nprim) {
763 		printk(KERN_ERR "SELinux: %s:  unrecognized class %d\n",
764 			__func__, tclass);
765 		rc = -EINVAL;
766 		goto out;
767 	}
768 	tclass_datum = policydb.class_val_to_struct[tclass - 1];
769 
770 	ocontext = sidtab_search(&sidtab, oldsid);
771 	if (!ocontext) {
772 		printk(KERN_ERR "SELinux: %s:  unrecognized SID %d\n",
773 			__func__, oldsid);
774 		rc = -EINVAL;
775 		goto out;
776 	}
777 
778 	ncontext = sidtab_search(&sidtab, newsid);
779 	if (!ncontext) {
780 		printk(KERN_ERR "SELinux: %s:  unrecognized SID %d\n",
781 			__func__, newsid);
782 		rc = -EINVAL;
783 		goto out;
784 	}
785 
786 	tcontext = sidtab_search(&sidtab, tasksid);
787 	if (!tcontext) {
788 		printk(KERN_ERR "SELinux: %s:  unrecognized SID %d\n",
789 			__func__, tasksid);
790 		rc = -EINVAL;
791 		goto out;
792 	}
793 
794 	constraint = tclass_datum->validatetrans;
795 	while (constraint) {
796 		if (!constraint_expr_eval(ocontext, ncontext, tcontext,
797 					  constraint->expr)) {
798 			rc = security_validtrans_handle_fail(ocontext, ncontext,
799 							     tcontext, tclass);
800 			goto out;
801 		}
802 		constraint = constraint->next;
803 	}
804 
805 out:
806 	read_unlock(&policy_rwlock);
807 	return rc;
808 }
809 
810 /*
811  * security_bounded_transition - check whether the given
812  * transition is directed to bounded, or not.
813  * It returns 0, if @newsid is bounded by @oldsid.
814  * Otherwise, it returns error code.
815  *
816  * @oldsid : current security identifier
817  * @newsid : destinated security identifier
818  */
819 int security_bounded_transition(u32 old_sid, u32 new_sid)
820 {
821 	struct context *old_context, *new_context;
822 	struct type_datum *type;
823 	int index;
824 	int rc;
825 
826 	read_lock(&policy_rwlock);
827 
828 	rc = -EINVAL;
829 	old_context = sidtab_search(&sidtab, old_sid);
830 	if (!old_context) {
831 		printk(KERN_ERR "SELinux: %s: unrecognized SID %u\n",
832 		       __func__, old_sid);
833 		goto out;
834 	}
835 
836 	rc = -EINVAL;
837 	new_context = sidtab_search(&sidtab, new_sid);
838 	if (!new_context) {
839 		printk(KERN_ERR "SELinux: %s: unrecognized SID %u\n",
840 		       __func__, new_sid);
841 		goto out;
842 	}
843 
844 	rc = 0;
845 	/* type/domain unchanged */
846 	if (old_context->type == new_context->type)
847 		goto out;
848 
849 	index = new_context->type;
850 	while (true) {
851 		type = flex_array_get_ptr(policydb.type_val_to_struct_array,
852 					  index - 1);
853 		BUG_ON(!type);
854 
855 		/* not bounded anymore */
856 		rc = -EPERM;
857 		if (!type->bounds)
858 			break;
859 
860 		/* @newsid is bounded by @oldsid */
861 		rc = 0;
862 		if (type->bounds == old_context->type)
863 			break;
864 
865 		index = type->bounds;
866 	}
867 
868 	if (rc) {
869 		char *old_name = NULL;
870 		char *new_name = NULL;
871 		u32 length;
872 
873 		if (!context_struct_to_string(old_context,
874 					      &old_name, &length) &&
875 		    !context_struct_to_string(new_context,
876 					      &new_name, &length)) {
877 			audit_log(current->audit_context,
878 				  GFP_ATOMIC, AUDIT_SELINUX_ERR,
879 				  "op=security_bounded_transition "
880 				  "result=denied "
881 				  "oldcontext=%s newcontext=%s",
882 				  old_name, new_name);
883 		}
884 		kfree(new_name);
885 		kfree(old_name);
886 	}
887 out:
888 	read_unlock(&policy_rwlock);
889 
890 	return rc;
891 }
892 
893 static void avd_init(struct av_decision *avd)
894 {
895 	avd->allowed = 0;
896 	avd->auditallow = 0;
897 	avd->auditdeny = 0xffffffff;
898 	avd->seqno = latest_granting;
899 	avd->flags = 0;
900 }
901 
902 
903 /**
904  * security_compute_av - Compute access vector decisions.
905  * @ssid: source security identifier
906  * @tsid: target security identifier
907  * @tclass: target security class
908  * @avd: access vector decisions
909  *
910  * Compute a set of access vector decisions based on the
911  * SID pair (@ssid, @tsid) for the permissions in @tclass.
912  */
913 void security_compute_av(u32 ssid,
914 			 u32 tsid,
915 			 u16 orig_tclass,
916 			 struct av_decision *avd)
917 {
918 	u16 tclass;
919 	struct context *scontext = NULL, *tcontext = NULL;
920 
921 	read_lock(&policy_rwlock);
922 	avd_init(avd);
923 	if (!ss_initialized)
924 		goto allow;
925 
926 	scontext = sidtab_search(&sidtab, ssid);
927 	if (!scontext) {
928 		printk(KERN_ERR "SELinux: %s:  unrecognized SID %d\n",
929 		       __func__, ssid);
930 		goto out;
931 	}
932 
933 	/* permissive domain? */
934 	if (ebitmap_get_bit(&policydb.permissive_map, scontext->type))
935 		avd->flags |= AVD_FLAGS_PERMISSIVE;
936 
937 	tcontext = sidtab_search(&sidtab, tsid);
938 	if (!tcontext) {
939 		printk(KERN_ERR "SELinux: %s:  unrecognized SID %d\n",
940 		       __func__, tsid);
941 		goto out;
942 	}
943 
944 	tclass = unmap_class(orig_tclass);
945 	if (unlikely(orig_tclass && !tclass)) {
946 		if (policydb.allow_unknown)
947 			goto allow;
948 		goto out;
949 	}
950 	context_struct_compute_av(scontext, tcontext, tclass, avd);
951 	map_decision(orig_tclass, avd, policydb.allow_unknown);
952 out:
953 	read_unlock(&policy_rwlock);
954 	return;
955 allow:
956 	avd->allowed = 0xffffffff;
957 	goto out;
958 }
959 
960 void security_compute_av_user(u32 ssid,
961 			      u32 tsid,
962 			      u16 tclass,
963 			      struct av_decision *avd)
964 {
965 	struct context *scontext = NULL, *tcontext = NULL;
966 
967 	read_lock(&policy_rwlock);
968 	avd_init(avd);
969 	if (!ss_initialized)
970 		goto allow;
971 
972 	scontext = sidtab_search(&sidtab, ssid);
973 	if (!scontext) {
974 		printk(KERN_ERR "SELinux: %s:  unrecognized SID %d\n",
975 		       __func__, ssid);
976 		goto out;
977 	}
978 
979 	/* permissive domain? */
980 	if (ebitmap_get_bit(&policydb.permissive_map, scontext->type))
981 		avd->flags |= AVD_FLAGS_PERMISSIVE;
982 
983 	tcontext = sidtab_search(&sidtab, tsid);
984 	if (!tcontext) {
985 		printk(KERN_ERR "SELinux: %s:  unrecognized SID %d\n",
986 		       __func__, tsid);
987 		goto out;
988 	}
989 
990 	if (unlikely(!tclass)) {
991 		if (policydb.allow_unknown)
992 			goto allow;
993 		goto out;
994 	}
995 
996 	context_struct_compute_av(scontext, tcontext, tclass, avd);
997  out:
998 	read_unlock(&policy_rwlock);
999 	return;
1000 allow:
1001 	avd->allowed = 0xffffffff;
1002 	goto out;
1003 }
1004 
1005 /*
1006  * Write the security context string representation of
1007  * the context structure `context' into a dynamically
1008  * allocated string of the correct size.  Set `*scontext'
1009  * to point to this string and set `*scontext_len' to
1010  * the length of the string.
1011  */
1012 static int context_struct_to_string(struct context *context, char **scontext, u32 *scontext_len)
1013 {
1014 	char *scontextp;
1015 
1016 	if (scontext)
1017 		*scontext = NULL;
1018 	*scontext_len = 0;
1019 
1020 	if (context->len) {
1021 		*scontext_len = context->len;
1022 		if (scontext) {
1023 			*scontext = kstrdup(context->str, GFP_ATOMIC);
1024 			if (!(*scontext))
1025 				return -ENOMEM;
1026 		}
1027 		return 0;
1028 	}
1029 
1030 	/* Compute the size of the context. */
1031 	*scontext_len += strlen(sym_name(&policydb, SYM_USERS, context->user - 1)) + 1;
1032 	*scontext_len += strlen(sym_name(&policydb, SYM_ROLES, context->role - 1)) + 1;
1033 	*scontext_len += strlen(sym_name(&policydb, SYM_TYPES, context->type - 1)) + 1;
1034 	*scontext_len += mls_compute_context_len(context);
1035 
1036 	if (!scontext)
1037 		return 0;
1038 
1039 	/* Allocate space for the context; caller must free this space. */
1040 	scontextp = kmalloc(*scontext_len, GFP_ATOMIC);
1041 	if (!scontextp)
1042 		return -ENOMEM;
1043 	*scontext = scontextp;
1044 
1045 	/*
1046 	 * Copy the user name, role name and type name into the context.
1047 	 */
1048 	sprintf(scontextp, "%s:%s:%s",
1049 		sym_name(&policydb, SYM_USERS, context->user - 1),
1050 		sym_name(&policydb, SYM_ROLES, context->role - 1),
1051 		sym_name(&policydb, SYM_TYPES, context->type - 1));
1052 	scontextp += strlen(sym_name(&policydb, SYM_USERS, context->user - 1)) +
1053 		     1 + strlen(sym_name(&policydb, SYM_ROLES, context->role - 1)) +
1054 		     1 + strlen(sym_name(&policydb, SYM_TYPES, context->type - 1));
1055 
1056 	mls_sid_to_context(context, &scontextp);
1057 
1058 	*scontextp = 0;
1059 
1060 	return 0;
1061 }
1062 
1063 #include "initial_sid_to_string.h"
1064 
1065 const char *security_get_initial_sid_context(u32 sid)
1066 {
1067 	if (unlikely(sid > SECINITSID_NUM))
1068 		return NULL;
1069 	return initial_sid_to_string[sid];
1070 }
1071 
1072 static int security_sid_to_context_core(u32 sid, char **scontext,
1073 					u32 *scontext_len, int force)
1074 {
1075 	struct context *context;
1076 	int rc = 0;
1077 
1078 	if (scontext)
1079 		*scontext = NULL;
1080 	*scontext_len  = 0;
1081 
1082 	if (!ss_initialized) {
1083 		if (sid <= SECINITSID_NUM) {
1084 			char *scontextp;
1085 
1086 			*scontext_len = strlen(initial_sid_to_string[sid]) + 1;
1087 			if (!scontext)
1088 				goto out;
1089 			scontextp = kmalloc(*scontext_len, GFP_ATOMIC);
1090 			if (!scontextp) {
1091 				rc = -ENOMEM;
1092 				goto out;
1093 			}
1094 			strcpy(scontextp, initial_sid_to_string[sid]);
1095 			*scontext = scontextp;
1096 			goto out;
1097 		}
1098 		printk(KERN_ERR "SELinux: %s:  called before initial "
1099 		       "load_policy on unknown SID %d\n", __func__, sid);
1100 		rc = -EINVAL;
1101 		goto out;
1102 	}
1103 	read_lock(&policy_rwlock);
1104 	if (force)
1105 		context = sidtab_search_force(&sidtab, sid);
1106 	else
1107 		context = sidtab_search(&sidtab, sid);
1108 	if (!context) {
1109 		printk(KERN_ERR "SELinux: %s:  unrecognized SID %d\n",
1110 			__func__, sid);
1111 		rc = -EINVAL;
1112 		goto out_unlock;
1113 	}
1114 	rc = context_struct_to_string(context, scontext, scontext_len);
1115 out_unlock:
1116 	read_unlock(&policy_rwlock);
1117 out:
1118 	return rc;
1119 
1120 }
1121 
1122 /**
1123  * security_sid_to_context - Obtain a context for a given SID.
1124  * @sid: security identifier, SID
1125  * @scontext: security context
1126  * @scontext_len: length in bytes
1127  *
1128  * Write the string representation of the context associated with @sid
1129  * into a dynamically allocated string of the correct size.  Set @scontext
1130  * to point to this string and set @scontext_len to the length of the string.
1131  */
1132 int security_sid_to_context(u32 sid, char **scontext, u32 *scontext_len)
1133 {
1134 	return security_sid_to_context_core(sid, scontext, scontext_len, 0);
1135 }
1136 
1137 int security_sid_to_context_force(u32 sid, char **scontext, u32 *scontext_len)
1138 {
1139 	return security_sid_to_context_core(sid, scontext, scontext_len, 1);
1140 }
1141 
1142 /*
1143  * Caveat:  Mutates scontext.
1144  */
1145 static int string_to_context_struct(struct policydb *pol,
1146 				    struct sidtab *sidtabp,
1147 				    char *scontext,
1148 				    u32 scontext_len,
1149 				    struct context *ctx,
1150 				    u32 def_sid)
1151 {
1152 	struct role_datum *role;
1153 	struct type_datum *typdatum;
1154 	struct user_datum *usrdatum;
1155 	char *scontextp, *p, oldc;
1156 	int rc = 0;
1157 
1158 	context_init(ctx);
1159 
1160 	/* Parse the security context. */
1161 
1162 	rc = -EINVAL;
1163 	scontextp = (char *) scontext;
1164 
1165 	/* Extract the user. */
1166 	p = scontextp;
1167 	while (*p && *p != ':')
1168 		p++;
1169 
1170 	if (*p == 0)
1171 		goto out;
1172 
1173 	*p++ = 0;
1174 
1175 	usrdatum = hashtab_search(pol->p_users.table, scontextp);
1176 	if (!usrdatum)
1177 		goto out;
1178 
1179 	ctx->user = usrdatum->value;
1180 
1181 	/* Extract role. */
1182 	scontextp = p;
1183 	while (*p && *p != ':')
1184 		p++;
1185 
1186 	if (*p == 0)
1187 		goto out;
1188 
1189 	*p++ = 0;
1190 
1191 	role = hashtab_search(pol->p_roles.table, scontextp);
1192 	if (!role)
1193 		goto out;
1194 	ctx->role = role->value;
1195 
1196 	/* Extract type. */
1197 	scontextp = p;
1198 	while (*p && *p != ':')
1199 		p++;
1200 	oldc = *p;
1201 	*p++ = 0;
1202 
1203 	typdatum = hashtab_search(pol->p_types.table, scontextp);
1204 	if (!typdatum || typdatum->attribute)
1205 		goto out;
1206 
1207 	ctx->type = typdatum->value;
1208 
1209 	rc = mls_context_to_sid(pol, oldc, &p, ctx, sidtabp, def_sid);
1210 	if (rc)
1211 		goto out;
1212 
1213 	rc = -EINVAL;
1214 	if ((p - scontext) < scontext_len)
1215 		goto out;
1216 
1217 	/* Check the validity of the new context. */
1218 	if (!policydb_context_isvalid(pol, ctx))
1219 		goto out;
1220 	rc = 0;
1221 out:
1222 	if (rc)
1223 		context_destroy(ctx);
1224 	return rc;
1225 }
1226 
1227 static int security_context_to_sid_core(const char *scontext, u32 scontext_len,
1228 					u32 *sid, u32 def_sid, gfp_t gfp_flags,
1229 					int force)
1230 {
1231 	char *scontext2, *str = NULL;
1232 	struct context context;
1233 	int rc = 0;
1234 
1235 	if (!ss_initialized) {
1236 		int i;
1237 
1238 		for (i = 1; i < SECINITSID_NUM; i++) {
1239 			if (!strcmp(initial_sid_to_string[i], scontext)) {
1240 				*sid = i;
1241 				return 0;
1242 			}
1243 		}
1244 		*sid = SECINITSID_KERNEL;
1245 		return 0;
1246 	}
1247 	*sid = SECSID_NULL;
1248 
1249 	/* Copy the string so that we can modify the copy as we parse it. */
1250 	scontext2 = kmalloc(scontext_len + 1, gfp_flags);
1251 	if (!scontext2)
1252 		return -ENOMEM;
1253 	memcpy(scontext2, scontext, scontext_len);
1254 	scontext2[scontext_len] = 0;
1255 
1256 	if (force) {
1257 		/* Save another copy for storing in uninterpreted form */
1258 		rc = -ENOMEM;
1259 		str = kstrdup(scontext2, gfp_flags);
1260 		if (!str)
1261 			goto out;
1262 	}
1263 
1264 	read_lock(&policy_rwlock);
1265 	rc = string_to_context_struct(&policydb, &sidtab, scontext2,
1266 				      scontext_len, &context, def_sid);
1267 	if (rc == -EINVAL && force) {
1268 		context.str = str;
1269 		context.len = scontext_len;
1270 		str = NULL;
1271 	} else if (rc)
1272 		goto out_unlock;
1273 	rc = sidtab_context_to_sid(&sidtab, &context, sid);
1274 	context_destroy(&context);
1275 out_unlock:
1276 	read_unlock(&policy_rwlock);
1277 out:
1278 	kfree(scontext2);
1279 	kfree(str);
1280 	return rc;
1281 }
1282 
1283 /**
1284  * security_context_to_sid - Obtain a SID for a given security context.
1285  * @scontext: security context
1286  * @scontext_len: length in bytes
1287  * @sid: security identifier, SID
1288  *
1289  * Obtains a SID associated with the security context that
1290  * has the string representation specified by @scontext.
1291  * Returns -%EINVAL if the context is invalid, -%ENOMEM if insufficient
1292  * memory is available, or 0 on success.
1293  */
1294 int security_context_to_sid(const char *scontext, u32 scontext_len, u32 *sid)
1295 {
1296 	return security_context_to_sid_core(scontext, scontext_len,
1297 					    sid, SECSID_NULL, GFP_KERNEL, 0);
1298 }
1299 
1300 /**
1301  * security_context_to_sid_default - Obtain a SID for a given security context,
1302  * falling back to specified default if needed.
1303  *
1304  * @scontext: security context
1305  * @scontext_len: length in bytes
1306  * @sid: security identifier, SID
1307  * @def_sid: default SID to assign on error
1308  *
1309  * Obtains a SID associated with the security context that
1310  * has the string representation specified by @scontext.
1311  * The default SID is passed to the MLS layer to be used to allow
1312  * kernel labeling of the MLS field if the MLS field is not present
1313  * (for upgrading to MLS without full relabel).
1314  * Implicitly forces adding of the context even if it cannot be mapped yet.
1315  * Returns -%EINVAL if the context is invalid, -%ENOMEM if insufficient
1316  * memory is available, or 0 on success.
1317  */
1318 int security_context_to_sid_default(const char *scontext, u32 scontext_len,
1319 				    u32 *sid, u32 def_sid, gfp_t gfp_flags)
1320 {
1321 	return security_context_to_sid_core(scontext, scontext_len,
1322 					    sid, def_sid, gfp_flags, 1);
1323 }
1324 
1325 int security_context_to_sid_force(const char *scontext, u32 scontext_len,
1326 				  u32 *sid)
1327 {
1328 	return security_context_to_sid_core(scontext, scontext_len,
1329 					    sid, SECSID_NULL, GFP_KERNEL, 1);
1330 }
1331 
1332 static int compute_sid_handle_invalid_context(
1333 	struct context *scontext,
1334 	struct context *tcontext,
1335 	u16 tclass,
1336 	struct context *newcontext)
1337 {
1338 	char *s = NULL, *t = NULL, *n = NULL;
1339 	u32 slen, tlen, nlen;
1340 
1341 	if (context_struct_to_string(scontext, &s, &slen))
1342 		goto out;
1343 	if (context_struct_to_string(tcontext, &t, &tlen))
1344 		goto out;
1345 	if (context_struct_to_string(newcontext, &n, &nlen))
1346 		goto out;
1347 	audit_log(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR,
1348 		  "security_compute_sid:  invalid context %s"
1349 		  " for scontext=%s"
1350 		  " tcontext=%s"
1351 		  " tclass=%s",
1352 		  n, s, t, sym_name(&policydb, SYM_CLASSES, tclass-1));
1353 out:
1354 	kfree(s);
1355 	kfree(t);
1356 	kfree(n);
1357 	if (!selinux_enforcing)
1358 		return 0;
1359 	return -EACCES;
1360 }
1361 
1362 static void filename_compute_type(struct policydb *p, struct context *newcontext,
1363 				  u32 stype, u32 ttype, u16 tclass,
1364 				  const char *objname)
1365 {
1366 	struct filename_trans ft;
1367 	struct filename_trans_datum *otype;
1368 
1369 	/*
1370 	 * Most filename trans rules are going to live in specific directories
1371 	 * like /dev or /var/run.  This bitmap will quickly skip rule searches
1372 	 * if the ttype does not contain any rules.
1373 	 */
1374 	if (!ebitmap_get_bit(&p->filename_trans_ttypes, ttype))
1375 		return;
1376 
1377 	ft.stype = stype;
1378 	ft.ttype = ttype;
1379 	ft.tclass = tclass;
1380 	ft.name = objname;
1381 
1382 	otype = hashtab_search(p->filename_trans, &ft);
1383 	if (otype)
1384 		newcontext->type = otype->otype;
1385 }
1386 
1387 static int security_compute_sid(u32 ssid,
1388 				u32 tsid,
1389 				u16 orig_tclass,
1390 				u32 specified,
1391 				const char *objname,
1392 				u32 *out_sid,
1393 				bool kern)
1394 {
1395 	struct class_datum *cladatum = NULL;
1396 	struct context *scontext = NULL, *tcontext = NULL, newcontext;
1397 	struct role_trans *roletr = NULL;
1398 	struct avtab_key avkey;
1399 	struct avtab_datum *avdatum;
1400 	struct avtab_node *node;
1401 	u16 tclass;
1402 	int rc = 0;
1403 	bool sock;
1404 
1405 	if (!ss_initialized) {
1406 		switch (orig_tclass) {
1407 		case SECCLASS_PROCESS: /* kernel value */
1408 			*out_sid = ssid;
1409 			break;
1410 		default:
1411 			*out_sid = tsid;
1412 			break;
1413 		}
1414 		goto out;
1415 	}
1416 
1417 	context_init(&newcontext);
1418 
1419 	read_lock(&policy_rwlock);
1420 
1421 	if (kern) {
1422 		tclass = unmap_class(orig_tclass);
1423 		sock = security_is_socket_class(orig_tclass);
1424 	} else {
1425 		tclass = orig_tclass;
1426 		sock = security_is_socket_class(map_class(tclass));
1427 	}
1428 
1429 	scontext = sidtab_search(&sidtab, ssid);
1430 	if (!scontext) {
1431 		printk(KERN_ERR "SELinux: %s:  unrecognized SID %d\n",
1432 		       __func__, ssid);
1433 		rc = -EINVAL;
1434 		goto out_unlock;
1435 	}
1436 	tcontext = sidtab_search(&sidtab, tsid);
1437 	if (!tcontext) {
1438 		printk(KERN_ERR "SELinux: %s:  unrecognized SID %d\n",
1439 		       __func__, tsid);
1440 		rc = -EINVAL;
1441 		goto out_unlock;
1442 	}
1443 
1444 	if (tclass && tclass <= policydb.p_classes.nprim)
1445 		cladatum = policydb.class_val_to_struct[tclass - 1];
1446 
1447 	/* Set the user identity. */
1448 	switch (specified) {
1449 	case AVTAB_TRANSITION:
1450 	case AVTAB_CHANGE:
1451 		if (cladatum && cladatum->default_user == DEFAULT_TARGET) {
1452 			newcontext.user = tcontext->user;
1453 		} else {
1454 			/* notice this gets both DEFAULT_SOURCE and unset */
1455 			/* Use the process user identity. */
1456 			newcontext.user = scontext->user;
1457 		}
1458 		break;
1459 	case AVTAB_MEMBER:
1460 		/* Use the related object owner. */
1461 		newcontext.user = tcontext->user;
1462 		break;
1463 	}
1464 
1465 	/* Set the role to default values. */
1466 	if (cladatum && cladatum->default_role == DEFAULT_SOURCE) {
1467 		newcontext.role = scontext->role;
1468 	} else if (cladatum && cladatum->default_role == DEFAULT_TARGET) {
1469 		newcontext.role = tcontext->role;
1470 	} else {
1471 		if ((tclass == policydb.process_class) || (sock == true))
1472 			newcontext.role = scontext->role;
1473 		else
1474 			newcontext.role = OBJECT_R_VAL;
1475 	}
1476 
1477 	/* Set the type to default values. */
1478 	if (cladatum && cladatum->default_type == DEFAULT_SOURCE) {
1479 		newcontext.type = scontext->type;
1480 	} else if (cladatum && cladatum->default_type == DEFAULT_TARGET) {
1481 		newcontext.type = tcontext->type;
1482 	} else {
1483 		if ((tclass == policydb.process_class) || (sock == true)) {
1484 			/* Use the type of process. */
1485 			newcontext.type = scontext->type;
1486 		} else {
1487 			/* Use the type of the related object. */
1488 			newcontext.type = tcontext->type;
1489 		}
1490 	}
1491 
1492 	/* Look for a type transition/member/change rule. */
1493 	avkey.source_type = scontext->type;
1494 	avkey.target_type = tcontext->type;
1495 	avkey.target_class = tclass;
1496 	avkey.specified = specified;
1497 	avdatum = avtab_search(&policydb.te_avtab, &avkey);
1498 
1499 	/* If no permanent rule, also check for enabled conditional rules */
1500 	if (!avdatum) {
1501 		node = avtab_search_node(&policydb.te_cond_avtab, &avkey);
1502 		for (; node; node = avtab_search_node_next(node, specified)) {
1503 			if (node->key.specified & AVTAB_ENABLED) {
1504 				avdatum = &node->datum;
1505 				break;
1506 			}
1507 		}
1508 	}
1509 
1510 	if (avdatum) {
1511 		/* Use the type from the type transition/member/change rule. */
1512 		newcontext.type = avdatum->data;
1513 	}
1514 
1515 	/* if we have a objname this is a file trans check so check those rules */
1516 	if (objname)
1517 		filename_compute_type(&policydb, &newcontext, scontext->type,
1518 				      tcontext->type, tclass, objname);
1519 
1520 	/* Check for class-specific changes. */
1521 	if (specified & AVTAB_TRANSITION) {
1522 		/* Look for a role transition rule. */
1523 		for (roletr = policydb.role_tr; roletr; roletr = roletr->next) {
1524 			if ((roletr->role == scontext->role) &&
1525 			    (roletr->type == tcontext->type) &&
1526 			    (roletr->tclass == tclass)) {
1527 				/* Use the role transition rule. */
1528 				newcontext.role = roletr->new_role;
1529 				break;
1530 			}
1531 		}
1532 	}
1533 
1534 	/* Set the MLS attributes.
1535 	   This is done last because it may allocate memory. */
1536 	rc = mls_compute_sid(scontext, tcontext, tclass, specified,
1537 			     &newcontext, sock);
1538 	if (rc)
1539 		goto out_unlock;
1540 
1541 	/* Check the validity of the context. */
1542 	if (!policydb_context_isvalid(&policydb, &newcontext)) {
1543 		rc = compute_sid_handle_invalid_context(scontext,
1544 							tcontext,
1545 							tclass,
1546 							&newcontext);
1547 		if (rc)
1548 			goto out_unlock;
1549 	}
1550 	/* Obtain the sid for the context. */
1551 	rc = sidtab_context_to_sid(&sidtab, &newcontext, out_sid);
1552 out_unlock:
1553 	read_unlock(&policy_rwlock);
1554 	context_destroy(&newcontext);
1555 out:
1556 	return rc;
1557 }
1558 
1559 /**
1560  * security_transition_sid - Compute the SID for a new subject/object.
1561  * @ssid: source security identifier
1562  * @tsid: target security identifier
1563  * @tclass: target security class
1564  * @out_sid: security identifier for new subject/object
1565  *
1566  * Compute a SID to use for labeling a new subject or object in the
1567  * class @tclass based on a SID pair (@ssid, @tsid).
1568  * Return -%EINVAL if any of the parameters are invalid, -%ENOMEM
1569  * if insufficient memory is available, or %0 if the new SID was
1570  * computed successfully.
1571  */
1572 int security_transition_sid(u32 ssid, u32 tsid, u16 tclass,
1573 			    const struct qstr *qstr, u32 *out_sid)
1574 {
1575 	return security_compute_sid(ssid, tsid, tclass, AVTAB_TRANSITION,
1576 				    qstr ? qstr->name : NULL, out_sid, true);
1577 }
1578 
1579 int security_transition_sid_user(u32 ssid, u32 tsid, u16 tclass,
1580 				 const char *objname, u32 *out_sid)
1581 {
1582 	return security_compute_sid(ssid, tsid, tclass, AVTAB_TRANSITION,
1583 				    objname, out_sid, false);
1584 }
1585 
1586 /**
1587  * security_member_sid - Compute the SID for member selection.
1588  * @ssid: source security identifier
1589  * @tsid: target security identifier
1590  * @tclass: target security class
1591  * @out_sid: security identifier for selected member
1592  *
1593  * Compute a SID to use when selecting a member of a polyinstantiated
1594  * object of class @tclass based on a SID pair (@ssid, @tsid).
1595  * Return -%EINVAL if any of the parameters are invalid, -%ENOMEM
1596  * if insufficient memory is available, or %0 if the SID was
1597  * computed successfully.
1598  */
1599 int security_member_sid(u32 ssid,
1600 			u32 tsid,
1601 			u16 tclass,
1602 			u32 *out_sid)
1603 {
1604 	return security_compute_sid(ssid, tsid, tclass, AVTAB_MEMBER, NULL,
1605 				    out_sid, false);
1606 }
1607 
1608 /**
1609  * security_change_sid - Compute the SID for object relabeling.
1610  * @ssid: source security identifier
1611  * @tsid: target security identifier
1612  * @tclass: target security class
1613  * @out_sid: security identifier for selected member
1614  *
1615  * Compute a SID to use for relabeling an object of class @tclass
1616  * based on a SID pair (@ssid, @tsid).
1617  * Return -%EINVAL if any of the parameters are invalid, -%ENOMEM
1618  * if insufficient memory is available, or %0 if the SID was
1619  * computed successfully.
1620  */
1621 int security_change_sid(u32 ssid,
1622 			u32 tsid,
1623 			u16 tclass,
1624 			u32 *out_sid)
1625 {
1626 	return security_compute_sid(ssid, tsid, tclass, AVTAB_CHANGE, NULL,
1627 				    out_sid, false);
1628 }
1629 
1630 /* Clone the SID into the new SID table. */
1631 static int clone_sid(u32 sid,
1632 		     struct context *context,
1633 		     void *arg)
1634 {
1635 	struct sidtab *s = arg;
1636 
1637 	if (sid > SECINITSID_NUM)
1638 		return sidtab_insert(s, sid, context);
1639 	else
1640 		return 0;
1641 }
1642 
1643 static inline int convert_context_handle_invalid_context(struct context *context)
1644 {
1645 	char *s;
1646 	u32 len;
1647 
1648 	if (selinux_enforcing)
1649 		return -EINVAL;
1650 
1651 	if (!context_struct_to_string(context, &s, &len)) {
1652 		printk(KERN_WARNING "SELinux:  Context %s would be invalid if enforcing\n", s);
1653 		kfree(s);
1654 	}
1655 	return 0;
1656 }
1657 
1658 struct convert_context_args {
1659 	struct policydb *oldp;
1660 	struct policydb *newp;
1661 };
1662 
1663 /*
1664  * Convert the values in the security context
1665  * structure `c' from the values specified
1666  * in the policy `p->oldp' to the values specified
1667  * in the policy `p->newp'.  Verify that the
1668  * context is valid under the new policy.
1669  */
1670 static int convert_context(u32 key,
1671 			   struct context *c,
1672 			   void *p)
1673 {
1674 	struct convert_context_args *args;
1675 	struct context oldc;
1676 	struct ocontext *oc;
1677 	struct mls_range *range;
1678 	struct role_datum *role;
1679 	struct type_datum *typdatum;
1680 	struct user_datum *usrdatum;
1681 	char *s;
1682 	u32 len;
1683 	int rc = 0;
1684 
1685 	if (key <= SECINITSID_NUM)
1686 		goto out;
1687 
1688 	args = p;
1689 
1690 	if (c->str) {
1691 		struct context ctx;
1692 
1693 		rc = -ENOMEM;
1694 		s = kstrdup(c->str, GFP_KERNEL);
1695 		if (!s)
1696 			goto out;
1697 
1698 		rc = string_to_context_struct(args->newp, NULL, s,
1699 					      c->len, &ctx, SECSID_NULL);
1700 		kfree(s);
1701 		if (!rc) {
1702 			printk(KERN_INFO "SELinux:  Context %s became valid (mapped).\n",
1703 			       c->str);
1704 			/* Replace string with mapped representation. */
1705 			kfree(c->str);
1706 			memcpy(c, &ctx, sizeof(*c));
1707 			goto out;
1708 		} else if (rc == -EINVAL) {
1709 			/* Retain string representation for later mapping. */
1710 			rc = 0;
1711 			goto out;
1712 		} else {
1713 			/* Other error condition, e.g. ENOMEM. */
1714 			printk(KERN_ERR "SELinux:   Unable to map context %s, rc = %d.\n",
1715 			       c->str, -rc);
1716 			goto out;
1717 		}
1718 	}
1719 
1720 	rc = context_cpy(&oldc, c);
1721 	if (rc)
1722 		goto out;
1723 
1724 	/* Convert the user. */
1725 	rc = -EINVAL;
1726 	usrdatum = hashtab_search(args->newp->p_users.table,
1727 				  sym_name(args->oldp, SYM_USERS, c->user - 1));
1728 	if (!usrdatum)
1729 		goto bad;
1730 	c->user = usrdatum->value;
1731 
1732 	/* Convert the role. */
1733 	rc = -EINVAL;
1734 	role = hashtab_search(args->newp->p_roles.table,
1735 			      sym_name(args->oldp, SYM_ROLES, c->role - 1));
1736 	if (!role)
1737 		goto bad;
1738 	c->role = role->value;
1739 
1740 	/* Convert the type. */
1741 	rc = -EINVAL;
1742 	typdatum = hashtab_search(args->newp->p_types.table,
1743 				  sym_name(args->oldp, SYM_TYPES, c->type - 1));
1744 	if (!typdatum)
1745 		goto bad;
1746 	c->type = typdatum->value;
1747 
1748 	/* Convert the MLS fields if dealing with MLS policies */
1749 	if (args->oldp->mls_enabled && args->newp->mls_enabled) {
1750 		rc = mls_convert_context(args->oldp, args->newp, c);
1751 		if (rc)
1752 			goto bad;
1753 	} else if (args->oldp->mls_enabled && !args->newp->mls_enabled) {
1754 		/*
1755 		 * Switching between MLS and non-MLS policy:
1756 		 * free any storage used by the MLS fields in the
1757 		 * context for all existing entries in the sidtab.
1758 		 */
1759 		mls_context_destroy(c);
1760 	} else if (!args->oldp->mls_enabled && args->newp->mls_enabled) {
1761 		/*
1762 		 * Switching between non-MLS and MLS policy:
1763 		 * ensure that the MLS fields of the context for all
1764 		 * existing entries in the sidtab are filled in with a
1765 		 * suitable default value, likely taken from one of the
1766 		 * initial SIDs.
1767 		 */
1768 		oc = args->newp->ocontexts[OCON_ISID];
1769 		while (oc && oc->sid[0] != SECINITSID_UNLABELED)
1770 			oc = oc->next;
1771 		rc = -EINVAL;
1772 		if (!oc) {
1773 			printk(KERN_ERR "SELinux:  unable to look up"
1774 				" the initial SIDs list\n");
1775 			goto bad;
1776 		}
1777 		range = &oc->context[0].range;
1778 		rc = mls_range_set(c, range);
1779 		if (rc)
1780 			goto bad;
1781 	}
1782 
1783 	/* Check the validity of the new context. */
1784 	if (!policydb_context_isvalid(args->newp, c)) {
1785 		rc = convert_context_handle_invalid_context(&oldc);
1786 		if (rc)
1787 			goto bad;
1788 	}
1789 
1790 	context_destroy(&oldc);
1791 
1792 	rc = 0;
1793 out:
1794 	return rc;
1795 bad:
1796 	/* Map old representation to string and save it. */
1797 	rc = context_struct_to_string(&oldc, &s, &len);
1798 	if (rc)
1799 		return rc;
1800 	context_destroy(&oldc);
1801 	context_destroy(c);
1802 	c->str = s;
1803 	c->len = len;
1804 	printk(KERN_INFO "SELinux:  Context %s became invalid (unmapped).\n",
1805 	       c->str);
1806 	rc = 0;
1807 	goto out;
1808 }
1809 
1810 static void security_load_policycaps(void)
1811 {
1812 	selinux_policycap_netpeer = ebitmap_get_bit(&policydb.policycaps,
1813 						  POLICYDB_CAPABILITY_NETPEER);
1814 	selinux_policycap_openperm = ebitmap_get_bit(&policydb.policycaps,
1815 						  POLICYDB_CAPABILITY_OPENPERM);
1816 	selinux_policycap_alwaysnetwork = ebitmap_get_bit(&policydb.policycaps,
1817 						  POLICYDB_CAPABILITY_ALWAYSNETWORK);
1818 }
1819 
1820 static int security_preserve_bools(struct policydb *p);
1821 
1822 /**
1823  * security_load_policy - Load a security policy configuration.
1824  * @data: binary policy data
1825  * @len: length of data in bytes
1826  *
1827  * Load a new set of security policy configuration data,
1828  * validate it and convert the SID table as necessary.
1829  * This function will flush the access vector cache after
1830  * loading the new policy.
1831  */
1832 int security_load_policy(void *data, size_t len)
1833 {
1834 	struct policydb *oldpolicydb, *newpolicydb;
1835 	struct sidtab oldsidtab, newsidtab;
1836 	struct selinux_mapping *oldmap, *map = NULL;
1837 	struct convert_context_args args;
1838 	u32 seqno;
1839 	u16 map_size;
1840 	int rc = 0;
1841 	struct policy_file file = { data, len }, *fp = &file;
1842 
1843 	oldpolicydb = kzalloc(2 * sizeof(*oldpolicydb), GFP_KERNEL);
1844 	if (!oldpolicydb) {
1845 		rc = -ENOMEM;
1846 		goto out;
1847 	}
1848 	newpolicydb = oldpolicydb + 1;
1849 
1850 	if (!ss_initialized) {
1851 		avtab_cache_init();
1852 		rc = policydb_read(&policydb, fp);
1853 		if (rc) {
1854 			avtab_cache_destroy();
1855 			goto out;
1856 		}
1857 
1858 		policydb.len = len;
1859 		rc = selinux_set_mapping(&policydb, secclass_map,
1860 					 &current_mapping,
1861 					 &current_mapping_size);
1862 		if (rc) {
1863 			policydb_destroy(&policydb);
1864 			avtab_cache_destroy();
1865 			goto out;
1866 		}
1867 
1868 		rc = policydb_load_isids(&policydb, &sidtab);
1869 		if (rc) {
1870 			policydb_destroy(&policydb);
1871 			avtab_cache_destroy();
1872 			goto out;
1873 		}
1874 
1875 		security_load_policycaps();
1876 		ss_initialized = 1;
1877 		seqno = ++latest_granting;
1878 		selinux_complete_init();
1879 		avc_ss_reset(seqno);
1880 		selnl_notify_policyload(seqno);
1881 		selinux_status_update_policyload(seqno);
1882 		selinux_netlbl_cache_invalidate();
1883 		selinux_xfrm_notify_policyload();
1884 		goto out;
1885 	}
1886 
1887 #if 0
1888 	sidtab_hash_eval(&sidtab, "sids");
1889 #endif
1890 
1891 	rc = policydb_read(newpolicydb, fp);
1892 	if (rc)
1893 		goto out;
1894 
1895 	newpolicydb->len = len;
1896 	/* If switching between different policy types, log MLS status */
1897 	if (policydb.mls_enabled && !newpolicydb->mls_enabled)
1898 		printk(KERN_INFO "SELinux: Disabling MLS support...\n");
1899 	else if (!policydb.mls_enabled && newpolicydb->mls_enabled)
1900 		printk(KERN_INFO "SELinux: Enabling MLS support...\n");
1901 
1902 	rc = policydb_load_isids(newpolicydb, &newsidtab);
1903 	if (rc) {
1904 		printk(KERN_ERR "SELinux:  unable to load the initial SIDs\n");
1905 		policydb_destroy(newpolicydb);
1906 		goto out;
1907 	}
1908 
1909 	rc = selinux_set_mapping(newpolicydb, secclass_map, &map, &map_size);
1910 	if (rc)
1911 		goto err;
1912 
1913 	rc = security_preserve_bools(newpolicydb);
1914 	if (rc) {
1915 		printk(KERN_ERR "SELinux:  unable to preserve booleans\n");
1916 		goto err;
1917 	}
1918 
1919 	/* Clone the SID table. */
1920 	sidtab_shutdown(&sidtab);
1921 
1922 	rc = sidtab_map(&sidtab, clone_sid, &newsidtab);
1923 	if (rc)
1924 		goto err;
1925 
1926 	/*
1927 	 * Convert the internal representations of contexts
1928 	 * in the new SID table.
1929 	 */
1930 	args.oldp = &policydb;
1931 	args.newp = newpolicydb;
1932 	rc = sidtab_map(&newsidtab, convert_context, &args);
1933 	if (rc) {
1934 		printk(KERN_ERR "SELinux:  unable to convert the internal"
1935 			" representation of contexts in the new SID"
1936 			" table\n");
1937 		goto err;
1938 	}
1939 
1940 	/* Save the old policydb and SID table to free later. */
1941 	memcpy(oldpolicydb, &policydb, sizeof(policydb));
1942 	sidtab_set(&oldsidtab, &sidtab);
1943 
1944 	/* Install the new policydb and SID table. */
1945 	write_lock_irq(&policy_rwlock);
1946 	memcpy(&policydb, newpolicydb, sizeof(policydb));
1947 	sidtab_set(&sidtab, &newsidtab);
1948 	security_load_policycaps();
1949 	oldmap = current_mapping;
1950 	current_mapping = map;
1951 	current_mapping_size = map_size;
1952 	seqno = ++latest_granting;
1953 	write_unlock_irq(&policy_rwlock);
1954 
1955 	/* Free the old policydb and SID table. */
1956 	policydb_destroy(oldpolicydb);
1957 	sidtab_destroy(&oldsidtab);
1958 	kfree(oldmap);
1959 
1960 	avc_ss_reset(seqno);
1961 	selnl_notify_policyload(seqno);
1962 	selinux_status_update_policyload(seqno);
1963 	selinux_netlbl_cache_invalidate();
1964 	selinux_xfrm_notify_policyload();
1965 
1966 	rc = 0;
1967 	goto out;
1968 
1969 err:
1970 	kfree(map);
1971 	sidtab_destroy(&newsidtab);
1972 	policydb_destroy(newpolicydb);
1973 
1974 out:
1975 	kfree(oldpolicydb);
1976 	return rc;
1977 }
1978 
1979 size_t security_policydb_len(void)
1980 {
1981 	size_t len;
1982 
1983 	read_lock(&policy_rwlock);
1984 	len = policydb.len;
1985 	read_unlock(&policy_rwlock);
1986 
1987 	return len;
1988 }
1989 
1990 /**
1991  * security_port_sid - Obtain the SID for a port.
1992  * @protocol: protocol number
1993  * @port: port number
1994  * @out_sid: security identifier
1995  */
1996 int security_port_sid(u8 protocol, u16 port, u32 *out_sid)
1997 {
1998 	struct ocontext *c;
1999 	int rc = 0;
2000 
2001 	read_lock(&policy_rwlock);
2002 
2003 	c = policydb.ocontexts[OCON_PORT];
2004 	while (c) {
2005 		if (c->u.port.protocol == protocol &&
2006 		    c->u.port.low_port <= port &&
2007 		    c->u.port.high_port >= port)
2008 			break;
2009 		c = c->next;
2010 	}
2011 
2012 	if (c) {
2013 		if (!c->sid[0]) {
2014 			rc = sidtab_context_to_sid(&sidtab,
2015 						   &c->context[0],
2016 						   &c->sid[0]);
2017 			if (rc)
2018 				goto out;
2019 		}
2020 		*out_sid = c->sid[0];
2021 	} else {
2022 		*out_sid = SECINITSID_PORT;
2023 	}
2024 
2025 out:
2026 	read_unlock(&policy_rwlock);
2027 	return rc;
2028 }
2029 
2030 /**
2031  * security_netif_sid - Obtain the SID for a network interface.
2032  * @name: interface name
2033  * @if_sid: interface SID
2034  */
2035 int security_netif_sid(char *name, u32 *if_sid)
2036 {
2037 	int rc = 0;
2038 	struct ocontext *c;
2039 
2040 	read_lock(&policy_rwlock);
2041 
2042 	c = policydb.ocontexts[OCON_NETIF];
2043 	while (c) {
2044 		if (strcmp(name, c->u.name) == 0)
2045 			break;
2046 		c = c->next;
2047 	}
2048 
2049 	if (c) {
2050 		if (!c->sid[0] || !c->sid[1]) {
2051 			rc = sidtab_context_to_sid(&sidtab,
2052 						  &c->context[0],
2053 						  &c->sid[0]);
2054 			if (rc)
2055 				goto out;
2056 			rc = sidtab_context_to_sid(&sidtab,
2057 						   &c->context[1],
2058 						   &c->sid[1]);
2059 			if (rc)
2060 				goto out;
2061 		}
2062 		*if_sid = c->sid[0];
2063 	} else
2064 		*if_sid = SECINITSID_NETIF;
2065 
2066 out:
2067 	read_unlock(&policy_rwlock);
2068 	return rc;
2069 }
2070 
2071 static int match_ipv6_addrmask(u32 *input, u32 *addr, u32 *mask)
2072 {
2073 	int i, fail = 0;
2074 
2075 	for (i = 0; i < 4; i++)
2076 		if (addr[i] != (input[i] & mask[i])) {
2077 			fail = 1;
2078 			break;
2079 		}
2080 
2081 	return !fail;
2082 }
2083 
2084 /**
2085  * security_node_sid - Obtain the SID for a node (host).
2086  * @domain: communication domain aka address family
2087  * @addrp: address
2088  * @addrlen: address length in bytes
2089  * @out_sid: security identifier
2090  */
2091 int security_node_sid(u16 domain,
2092 		      void *addrp,
2093 		      u32 addrlen,
2094 		      u32 *out_sid)
2095 {
2096 	int rc;
2097 	struct ocontext *c;
2098 
2099 	read_lock(&policy_rwlock);
2100 
2101 	switch (domain) {
2102 	case AF_INET: {
2103 		u32 addr;
2104 
2105 		rc = -EINVAL;
2106 		if (addrlen != sizeof(u32))
2107 			goto out;
2108 
2109 		addr = *((u32 *)addrp);
2110 
2111 		c = policydb.ocontexts[OCON_NODE];
2112 		while (c) {
2113 			if (c->u.node.addr == (addr & c->u.node.mask))
2114 				break;
2115 			c = c->next;
2116 		}
2117 		break;
2118 	}
2119 
2120 	case AF_INET6:
2121 		rc = -EINVAL;
2122 		if (addrlen != sizeof(u64) * 2)
2123 			goto out;
2124 		c = policydb.ocontexts[OCON_NODE6];
2125 		while (c) {
2126 			if (match_ipv6_addrmask(addrp, c->u.node6.addr,
2127 						c->u.node6.mask))
2128 				break;
2129 			c = c->next;
2130 		}
2131 		break;
2132 
2133 	default:
2134 		rc = 0;
2135 		*out_sid = SECINITSID_NODE;
2136 		goto out;
2137 	}
2138 
2139 	if (c) {
2140 		if (!c->sid[0]) {
2141 			rc = sidtab_context_to_sid(&sidtab,
2142 						   &c->context[0],
2143 						   &c->sid[0]);
2144 			if (rc)
2145 				goto out;
2146 		}
2147 		*out_sid = c->sid[0];
2148 	} else {
2149 		*out_sid = SECINITSID_NODE;
2150 	}
2151 
2152 	rc = 0;
2153 out:
2154 	read_unlock(&policy_rwlock);
2155 	return rc;
2156 }
2157 
2158 #define SIDS_NEL 25
2159 
2160 /**
2161  * security_get_user_sids - Obtain reachable SIDs for a user.
2162  * @fromsid: starting SID
2163  * @username: username
2164  * @sids: array of reachable SIDs for user
2165  * @nel: number of elements in @sids
2166  *
2167  * Generate the set of SIDs for legal security contexts
2168  * for a given user that can be reached by @fromsid.
2169  * Set *@sids to point to a dynamically allocated
2170  * array containing the set of SIDs.  Set *@nel to the
2171  * number of elements in the array.
2172  */
2173 
2174 int security_get_user_sids(u32 fromsid,
2175 			   char *username,
2176 			   u32 **sids,
2177 			   u32 *nel)
2178 {
2179 	struct context *fromcon, usercon;
2180 	u32 *mysids = NULL, *mysids2, sid;
2181 	u32 mynel = 0, maxnel = SIDS_NEL;
2182 	struct user_datum *user;
2183 	struct role_datum *role;
2184 	struct ebitmap_node *rnode, *tnode;
2185 	int rc = 0, i, j;
2186 
2187 	*sids = NULL;
2188 	*nel = 0;
2189 
2190 	if (!ss_initialized)
2191 		goto out;
2192 
2193 	read_lock(&policy_rwlock);
2194 
2195 	context_init(&usercon);
2196 
2197 	rc = -EINVAL;
2198 	fromcon = sidtab_search(&sidtab, fromsid);
2199 	if (!fromcon)
2200 		goto out_unlock;
2201 
2202 	rc = -EINVAL;
2203 	user = hashtab_search(policydb.p_users.table, username);
2204 	if (!user)
2205 		goto out_unlock;
2206 
2207 	usercon.user = user->value;
2208 
2209 	rc = -ENOMEM;
2210 	mysids = kcalloc(maxnel, sizeof(*mysids), GFP_ATOMIC);
2211 	if (!mysids)
2212 		goto out_unlock;
2213 
2214 	ebitmap_for_each_positive_bit(&user->roles, rnode, i) {
2215 		role = policydb.role_val_to_struct[i];
2216 		usercon.role = i + 1;
2217 		ebitmap_for_each_positive_bit(&role->types, tnode, j) {
2218 			usercon.type = j + 1;
2219 
2220 			if (mls_setup_user_range(fromcon, user, &usercon))
2221 				continue;
2222 
2223 			rc = sidtab_context_to_sid(&sidtab, &usercon, &sid);
2224 			if (rc)
2225 				goto out_unlock;
2226 			if (mynel < maxnel) {
2227 				mysids[mynel++] = sid;
2228 			} else {
2229 				rc = -ENOMEM;
2230 				maxnel += SIDS_NEL;
2231 				mysids2 = kcalloc(maxnel, sizeof(*mysids2), GFP_ATOMIC);
2232 				if (!mysids2)
2233 					goto out_unlock;
2234 				memcpy(mysids2, mysids, mynel * sizeof(*mysids2));
2235 				kfree(mysids);
2236 				mysids = mysids2;
2237 				mysids[mynel++] = sid;
2238 			}
2239 		}
2240 	}
2241 	rc = 0;
2242 out_unlock:
2243 	read_unlock(&policy_rwlock);
2244 	if (rc || !mynel) {
2245 		kfree(mysids);
2246 		goto out;
2247 	}
2248 
2249 	rc = -ENOMEM;
2250 	mysids2 = kcalloc(mynel, sizeof(*mysids2), GFP_KERNEL);
2251 	if (!mysids2) {
2252 		kfree(mysids);
2253 		goto out;
2254 	}
2255 	for (i = 0, j = 0; i < mynel; i++) {
2256 		struct av_decision dummy_avd;
2257 		rc = avc_has_perm_noaudit(fromsid, mysids[i],
2258 					  SECCLASS_PROCESS, /* kernel value */
2259 					  PROCESS__TRANSITION, AVC_STRICT,
2260 					  &dummy_avd);
2261 		if (!rc)
2262 			mysids2[j++] = mysids[i];
2263 		cond_resched();
2264 	}
2265 	rc = 0;
2266 	kfree(mysids);
2267 	*sids = mysids2;
2268 	*nel = j;
2269 out:
2270 	return rc;
2271 }
2272 
2273 /**
2274  * security_genfs_sid - Obtain a SID for a file in a filesystem
2275  * @fstype: filesystem type
2276  * @path: path from root of mount
2277  * @sclass: file security class
2278  * @sid: SID for path
2279  *
2280  * Obtain a SID to use for a file in a filesystem that
2281  * cannot support xattr or use a fixed labeling behavior like
2282  * transition SIDs or task SIDs.
2283  */
2284 int security_genfs_sid(const char *fstype,
2285 		       char *path,
2286 		       u16 orig_sclass,
2287 		       u32 *sid)
2288 {
2289 	int len;
2290 	u16 sclass;
2291 	struct genfs *genfs;
2292 	struct ocontext *c;
2293 	int rc, cmp = 0;
2294 
2295 	while (path[0] == '/' && path[1] == '/')
2296 		path++;
2297 
2298 	read_lock(&policy_rwlock);
2299 
2300 	sclass = unmap_class(orig_sclass);
2301 	*sid = SECINITSID_UNLABELED;
2302 
2303 	for (genfs = policydb.genfs; genfs; genfs = genfs->next) {
2304 		cmp = strcmp(fstype, genfs->fstype);
2305 		if (cmp <= 0)
2306 			break;
2307 	}
2308 
2309 	rc = -ENOENT;
2310 	if (!genfs || cmp)
2311 		goto out;
2312 
2313 	for (c = genfs->head; c; c = c->next) {
2314 		len = strlen(c->u.name);
2315 		if ((!c->v.sclass || sclass == c->v.sclass) &&
2316 		    (strncmp(c->u.name, path, len) == 0))
2317 			break;
2318 	}
2319 
2320 	rc = -ENOENT;
2321 	if (!c)
2322 		goto out;
2323 
2324 	if (!c->sid[0]) {
2325 		rc = sidtab_context_to_sid(&sidtab, &c->context[0], &c->sid[0]);
2326 		if (rc)
2327 			goto out;
2328 	}
2329 
2330 	*sid = c->sid[0];
2331 	rc = 0;
2332 out:
2333 	read_unlock(&policy_rwlock);
2334 	return rc;
2335 }
2336 
2337 /**
2338  * security_fs_use - Determine how to handle labeling for a filesystem.
2339  * @sb: superblock in question
2340  */
2341 int security_fs_use(struct super_block *sb)
2342 {
2343 	int rc = 0;
2344 	struct ocontext *c;
2345 	struct superblock_security_struct *sbsec = sb->s_security;
2346 	const char *fstype = sb->s_type->name;
2347 
2348 	read_lock(&policy_rwlock);
2349 
2350 	c = policydb.ocontexts[OCON_FSUSE];
2351 	while (c) {
2352 		if (strcmp(fstype, c->u.name) == 0)
2353 			break;
2354 		c = c->next;
2355 	}
2356 
2357 	if (c) {
2358 		sbsec->behavior = c->v.behavior;
2359 		if (!c->sid[0]) {
2360 			rc = sidtab_context_to_sid(&sidtab, &c->context[0],
2361 						   &c->sid[0]);
2362 			if (rc)
2363 				goto out;
2364 		}
2365 		sbsec->sid = c->sid[0];
2366 	} else {
2367 		rc = security_genfs_sid(fstype, "/", SECCLASS_DIR, &sbsec->sid);
2368 		if (rc) {
2369 			sbsec->behavior = SECURITY_FS_USE_NONE;
2370 			rc = 0;
2371 		} else {
2372 			sbsec->behavior = SECURITY_FS_USE_GENFS;
2373 		}
2374 	}
2375 
2376 out:
2377 	read_unlock(&policy_rwlock);
2378 	return rc;
2379 }
2380 
2381 int security_get_bools(int *len, char ***names, int **values)
2382 {
2383 	int i, rc;
2384 
2385 	read_lock(&policy_rwlock);
2386 	*names = NULL;
2387 	*values = NULL;
2388 
2389 	rc = 0;
2390 	*len = policydb.p_bools.nprim;
2391 	if (!*len)
2392 		goto out;
2393 
2394 	rc = -ENOMEM;
2395 	*names = kcalloc(*len, sizeof(char *), GFP_ATOMIC);
2396 	if (!*names)
2397 		goto err;
2398 
2399 	rc = -ENOMEM;
2400 	*values = kcalloc(*len, sizeof(int), GFP_ATOMIC);
2401 	if (!*values)
2402 		goto err;
2403 
2404 	for (i = 0; i < *len; i++) {
2405 		size_t name_len;
2406 
2407 		(*values)[i] = policydb.bool_val_to_struct[i]->state;
2408 		name_len = strlen(sym_name(&policydb, SYM_BOOLS, i)) + 1;
2409 
2410 		rc = -ENOMEM;
2411 		(*names)[i] = kmalloc(sizeof(char) * name_len, GFP_ATOMIC);
2412 		if (!(*names)[i])
2413 			goto err;
2414 
2415 		strncpy((*names)[i], sym_name(&policydb, SYM_BOOLS, i), name_len);
2416 		(*names)[i][name_len - 1] = 0;
2417 	}
2418 	rc = 0;
2419 out:
2420 	read_unlock(&policy_rwlock);
2421 	return rc;
2422 err:
2423 	if (*names) {
2424 		for (i = 0; i < *len; i++)
2425 			kfree((*names)[i]);
2426 	}
2427 	kfree(*values);
2428 	goto out;
2429 }
2430 
2431 
2432 int security_set_bools(int len, int *values)
2433 {
2434 	int i, rc;
2435 	int lenp, seqno = 0;
2436 	struct cond_node *cur;
2437 
2438 	write_lock_irq(&policy_rwlock);
2439 
2440 	rc = -EFAULT;
2441 	lenp = policydb.p_bools.nprim;
2442 	if (len != lenp)
2443 		goto out;
2444 
2445 	for (i = 0; i < len; i++) {
2446 		if (!!values[i] != policydb.bool_val_to_struct[i]->state) {
2447 			audit_log(current->audit_context, GFP_ATOMIC,
2448 				AUDIT_MAC_CONFIG_CHANGE,
2449 				"bool=%s val=%d old_val=%d auid=%u ses=%u",
2450 				sym_name(&policydb, SYM_BOOLS, i),
2451 				!!values[i],
2452 				policydb.bool_val_to_struct[i]->state,
2453 				from_kuid(&init_user_ns, audit_get_loginuid(current)),
2454 				audit_get_sessionid(current));
2455 		}
2456 		if (values[i])
2457 			policydb.bool_val_to_struct[i]->state = 1;
2458 		else
2459 			policydb.bool_val_to_struct[i]->state = 0;
2460 	}
2461 
2462 	for (cur = policydb.cond_list; cur; cur = cur->next) {
2463 		rc = evaluate_cond_node(&policydb, cur);
2464 		if (rc)
2465 			goto out;
2466 	}
2467 
2468 	seqno = ++latest_granting;
2469 	rc = 0;
2470 out:
2471 	write_unlock_irq(&policy_rwlock);
2472 	if (!rc) {
2473 		avc_ss_reset(seqno);
2474 		selnl_notify_policyload(seqno);
2475 		selinux_status_update_policyload(seqno);
2476 		selinux_xfrm_notify_policyload();
2477 	}
2478 	return rc;
2479 }
2480 
2481 int security_get_bool_value(int bool)
2482 {
2483 	int rc;
2484 	int len;
2485 
2486 	read_lock(&policy_rwlock);
2487 
2488 	rc = -EFAULT;
2489 	len = policydb.p_bools.nprim;
2490 	if (bool >= len)
2491 		goto out;
2492 
2493 	rc = policydb.bool_val_to_struct[bool]->state;
2494 out:
2495 	read_unlock(&policy_rwlock);
2496 	return rc;
2497 }
2498 
2499 static int security_preserve_bools(struct policydb *p)
2500 {
2501 	int rc, nbools = 0, *bvalues = NULL, i;
2502 	char **bnames = NULL;
2503 	struct cond_bool_datum *booldatum;
2504 	struct cond_node *cur;
2505 
2506 	rc = security_get_bools(&nbools, &bnames, &bvalues);
2507 	if (rc)
2508 		goto out;
2509 	for (i = 0; i < nbools; i++) {
2510 		booldatum = hashtab_search(p->p_bools.table, bnames[i]);
2511 		if (booldatum)
2512 			booldatum->state = bvalues[i];
2513 	}
2514 	for (cur = p->cond_list; cur; cur = cur->next) {
2515 		rc = evaluate_cond_node(p, cur);
2516 		if (rc)
2517 			goto out;
2518 	}
2519 
2520 out:
2521 	if (bnames) {
2522 		for (i = 0; i < nbools; i++)
2523 			kfree(bnames[i]);
2524 	}
2525 	kfree(bnames);
2526 	kfree(bvalues);
2527 	return rc;
2528 }
2529 
2530 /*
2531  * security_sid_mls_copy() - computes a new sid based on the given
2532  * sid and the mls portion of mls_sid.
2533  */
2534 int security_sid_mls_copy(u32 sid, u32 mls_sid, u32 *new_sid)
2535 {
2536 	struct context *context1;
2537 	struct context *context2;
2538 	struct context newcon;
2539 	char *s;
2540 	u32 len;
2541 	int rc;
2542 
2543 	rc = 0;
2544 	if (!ss_initialized || !policydb.mls_enabled) {
2545 		*new_sid = sid;
2546 		goto out;
2547 	}
2548 
2549 	context_init(&newcon);
2550 
2551 	read_lock(&policy_rwlock);
2552 
2553 	rc = -EINVAL;
2554 	context1 = sidtab_search(&sidtab, sid);
2555 	if (!context1) {
2556 		printk(KERN_ERR "SELinux: %s:  unrecognized SID %d\n",
2557 			__func__, sid);
2558 		goto out_unlock;
2559 	}
2560 
2561 	rc = -EINVAL;
2562 	context2 = sidtab_search(&sidtab, mls_sid);
2563 	if (!context2) {
2564 		printk(KERN_ERR "SELinux: %s:  unrecognized SID %d\n",
2565 			__func__, mls_sid);
2566 		goto out_unlock;
2567 	}
2568 
2569 	newcon.user = context1->user;
2570 	newcon.role = context1->role;
2571 	newcon.type = context1->type;
2572 	rc = mls_context_cpy(&newcon, context2);
2573 	if (rc)
2574 		goto out_unlock;
2575 
2576 	/* Check the validity of the new context. */
2577 	if (!policydb_context_isvalid(&policydb, &newcon)) {
2578 		rc = convert_context_handle_invalid_context(&newcon);
2579 		if (rc) {
2580 			if (!context_struct_to_string(&newcon, &s, &len)) {
2581 				audit_log(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR,
2582 					  "security_sid_mls_copy: invalid context %s", s);
2583 				kfree(s);
2584 			}
2585 			goto out_unlock;
2586 		}
2587 	}
2588 
2589 	rc = sidtab_context_to_sid(&sidtab, &newcon, new_sid);
2590 out_unlock:
2591 	read_unlock(&policy_rwlock);
2592 	context_destroy(&newcon);
2593 out:
2594 	return rc;
2595 }
2596 
2597 /**
2598  * security_net_peersid_resolve - Compare and resolve two network peer SIDs
2599  * @nlbl_sid: NetLabel SID
2600  * @nlbl_type: NetLabel labeling protocol type
2601  * @xfrm_sid: XFRM SID
2602  *
2603  * Description:
2604  * Compare the @nlbl_sid and @xfrm_sid values and if the two SIDs can be
2605  * resolved into a single SID it is returned via @peer_sid and the function
2606  * returns zero.  Otherwise @peer_sid is set to SECSID_NULL and the function
2607  * returns a negative value.  A table summarizing the behavior is below:
2608  *
2609  *                                 | function return |      @sid
2610  *   ------------------------------+-----------------+-----------------
2611  *   no peer labels                |        0        |    SECSID_NULL
2612  *   single peer label             |        0        |    <peer_label>
2613  *   multiple, consistent labels   |        0        |    <peer_label>
2614  *   multiple, inconsistent labels |    -<errno>     |    SECSID_NULL
2615  *
2616  */
2617 int security_net_peersid_resolve(u32 nlbl_sid, u32 nlbl_type,
2618 				 u32 xfrm_sid,
2619 				 u32 *peer_sid)
2620 {
2621 	int rc;
2622 	struct context *nlbl_ctx;
2623 	struct context *xfrm_ctx;
2624 
2625 	*peer_sid = SECSID_NULL;
2626 
2627 	/* handle the common (which also happens to be the set of easy) cases
2628 	 * right away, these two if statements catch everything involving a
2629 	 * single or absent peer SID/label */
2630 	if (xfrm_sid == SECSID_NULL) {
2631 		*peer_sid = nlbl_sid;
2632 		return 0;
2633 	}
2634 	/* NOTE: an nlbl_type == NETLBL_NLTYPE_UNLABELED is a "fallback" label
2635 	 * and is treated as if nlbl_sid == SECSID_NULL when a XFRM SID/label
2636 	 * is present */
2637 	if (nlbl_sid == SECSID_NULL || nlbl_type == NETLBL_NLTYPE_UNLABELED) {
2638 		*peer_sid = xfrm_sid;
2639 		return 0;
2640 	}
2641 
2642 	/* we don't need to check ss_initialized here since the only way both
2643 	 * nlbl_sid and xfrm_sid are not equal to SECSID_NULL would be if the
2644 	 * security server was initialized and ss_initialized was true */
2645 	if (!policydb.mls_enabled)
2646 		return 0;
2647 
2648 	read_lock(&policy_rwlock);
2649 
2650 	rc = -EINVAL;
2651 	nlbl_ctx = sidtab_search(&sidtab, nlbl_sid);
2652 	if (!nlbl_ctx) {
2653 		printk(KERN_ERR "SELinux: %s:  unrecognized SID %d\n",
2654 		       __func__, nlbl_sid);
2655 		goto out;
2656 	}
2657 	rc = -EINVAL;
2658 	xfrm_ctx = sidtab_search(&sidtab, xfrm_sid);
2659 	if (!xfrm_ctx) {
2660 		printk(KERN_ERR "SELinux: %s:  unrecognized SID %d\n",
2661 		       __func__, xfrm_sid);
2662 		goto out;
2663 	}
2664 	rc = (mls_context_cmp(nlbl_ctx, xfrm_ctx) ? 0 : -EACCES);
2665 	if (rc)
2666 		goto out;
2667 
2668 	/* at present NetLabel SIDs/labels really only carry MLS
2669 	 * information so if the MLS portion of the NetLabel SID
2670 	 * matches the MLS portion of the labeled XFRM SID/label
2671 	 * then pass along the XFRM SID as it is the most
2672 	 * expressive */
2673 	*peer_sid = xfrm_sid;
2674 out:
2675 	read_unlock(&policy_rwlock);
2676 	return rc;
2677 }
2678 
2679 static int get_classes_callback(void *k, void *d, void *args)
2680 {
2681 	struct class_datum *datum = d;
2682 	char *name = k, **classes = args;
2683 	int value = datum->value - 1;
2684 
2685 	classes[value] = kstrdup(name, GFP_ATOMIC);
2686 	if (!classes[value])
2687 		return -ENOMEM;
2688 
2689 	return 0;
2690 }
2691 
2692 int security_get_classes(char ***classes, int *nclasses)
2693 {
2694 	int rc;
2695 
2696 	read_lock(&policy_rwlock);
2697 
2698 	rc = -ENOMEM;
2699 	*nclasses = policydb.p_classes.nprim;
2700 	*classes = kcalloc(*nclasses, sizeof(**classes), GFP_ATOMIC);
2701 	if (!*classes)
2702 		goto out;
2703 
2704 	rc = hashtab_map(policydb.p_classes.table, get_classes_callback,
2705 			*classes);
2706 	if (rc) {
2707 		int i;
2708 		for (i = 0; i < *nclasses; i++)
2709 			kfree((*classes)[i]);
2710 		kfree(*classes);
2711 	}
2712 
2713 out:
2714 	read_unlock(&policy_rwlock);
2715 	return rc;
2716 }
2717 
2718 static int get_permissions_callback(void *k, void *d, void *args)
2719 {
2720 	struct perm_datum *datum = d;
2721 	char *name = k, **perms = args;
2722 	int value = datum->value - 1;
2723 
2724 	perms[value] = kstrdup(name, GFP_ATOMIC);
2725 	if (!perms[value])
2726 		return -ENOMEM;
2727 
2728 	return 0;
2729 }
2730 
2731 int security_get_permissions(char *class, char ***perms, int *nperms)
2732 {
2733 	int rc, i;
2734 	struct class_datum *match;
2735 
2736 	read_lock(&policy_rwlock);
2737 
2738 	rc = -EINVAL;
2739 	match = hashtab_search(policydb.p_classes.table, class);
2740 	if (!match) {
2741 		printk(KERN_ERR "SELinux: %s:  unrecognized class %s\n",
2742 			__func__, class);
2743 		goto out;
2744 	}
2745 
2746 	rc = -ENOMEM;
2747 	*nperms = match->permissions.nprim;
2748 	*perms = kcalloc(*nperms, sizeof(**perms), GFP_ATOMIC);
2749 	if (!*perms)
2750 		goto out;
2751 
2752 	if (match->comdatum) {
2753 		rc = hashtab_map(match->comdatum->permissions.table,
2754 				get_permissions_callback, *perms);
2755 		if (rc)
2756 			goto err;
2757 	}
2758 
2759 	rc = hashtab_map(match->permissions.table, get_permissions_callback,
2760 			*perms);
2761 	if (rc)
2762 		goto err;
2763 
2764 out:
2765 	read_unlock(&policy_rwlock);
2766 	return rc;
2767 
2768 err:
2769 	read_unlock(&policy_rwlock);
2770 	for (i = 0; i < *nperms; i++)
2771 		kfree((*perms)[i]);
2772 	kfree(*perms);
2773 	return rc;
2774 }
2775 
2776 int security_get_reject_unknown(void)
2777 {
2778 	return policydb.reject_unknown;
2779 }
2780 
2781 int security_get_allow_unknown(void)
2782 {
2783 	return policydb.allow_unknown;
2784 }
2785 
2786 /**
2787  * security_policycap_supported - Check for a specific policy capability
2788  * @req_cap: capability
2789  *
2790  * Description:
2791  * This function queries the currently loaded policy to see if it supports the
2792  * capability specified by @req_cap.  Returns true (1) if the capability is
2793  * supported, false (0) if it isn't supported.
2794  *
2795  */
2796 int security_policycap_supported(unsigned int req_cap)
2797 {
2798 	int rc;
2799 
2800 	read_lock(&policy_rwlock);
2801 	rc = ebitmap_get_bit(&policydb.policycaps, req_cap);
2802 	read_unlock(&policy_rwlock);
2803 
2804 	return rc;
2805 }
2806 
2807 struct selinux_audit_rule {
2808 	u32 au_seqno;
2809 	struct context au_ctxt;
2810 };
2811 
2812 void selinux_audit_rule_free(void *vrule)
2813 {
2814 	struct selinux_audit_rule *rule = vrule;
2815 
2816 	if (rule) {
2817 		context_destroy(&rule->au_ctxt);
2818 		kfree(rule);
2819 	}
2820 }
2821 
2822 int selinux_audit_rule_init(u32 field, u32 op, char *rulestr, void **vrule)
2823 {
2824 	struct selinux_audit_rule *tmprule;
2825 	struct role_datum *roledatum;
2826 	struct type_datum *typedatum;
2827 	struct user_datum *userdatum;
2828 	struct selinux_audit_rule **rule = (struct selinux_audit_rule **)vrule;
2829 	int rc = 0;
2830 
2831 	*rule = NULL;
2832 
2833 	if (!ss_initialized)
2834 		return -EOPNOTSUPP;
2835 
2836 	switch (field) {
2837 	case AUDIT_SUBJ_USER:
2838 	case AUDIT_SUBJ_ROLE:
2839 	case AUDIT_SUBJ_TYPE:
2840 	case AUDIT_OBJ_USER:
2841 	case AUDIT_OBJ_ROLE:
2842 	case AUDIT_OBJ_TYPE:
2843 		/* only 'equals' and 'not equals' fit user, role, and type */
2844 		if (op != Audit_equal && op != Audit_not_equal)
2845 			return -EINVAL;
2846 		break;
2847 	case AUDIT_SUBJ_SEN:
2848 	case AUDIT_SUBJ_CLR:
2849 	case AUDIT_OBJ_LEV_LOW:
2850 	case AUDIT_OBJ_LEV_HIGH:
2851 		/* we do not allow a range, indicated by the presence of '-' */
2852 		if (strchr(rulestr, '-'))
2853 			return -EINVAL;
2854 		break;
2855 	default:
2856 		/* only the above fields are valid */
2857 		return -EINVAL;
2858 	}
2859 
2860 	tmprule = kzalloc(sizeof(struct selinux_audit_rule), GFP_KERNEL);
2861 	if (!tmprule)
2862 		return -ENOMEM;
2863 
2864 	context_init(&tmprule->au_ctxt);
2865 
2866 	read_lock(&policy_rwlock);
2867 
2868 	tmprule->au_seqno = latest_granting;
2869 
2870 	switch (field) {
2871 	case AUDIT_SUBJ_USER:
2872 	case AUDIT_OBJ_USER:
2873 		rc = -EINVAL;
2874 		userdatum = hashtab_search(policydb.p_users.table, rulestr);
2875 		if (!userdatum)
2876 			goto out;
2877 		tmprule->au_ctxt.user = userdatum->value;
2878 		break;
2879 	case AUDIT_SUBJ_ROLE:
2880 	case AUDIT_OBJ_ROLE:
2881 		rc = -EINVAL;
2882 		roledatum = hashtab_search(policydb.p_roles.table, rulestr);
2883 		if (!roledatum)
2884 			goto out;
2885 		tmprule->au_ctxt.role = roledatum->value;
2886 		break;
2887 	case AUDIT_SUBJ_TYPE:
2888 	case AUDIT_OBJ_TYPE:
2889 		rc = -EINVAL;
2890 		typedatum = hashtab_search(policydb.p_types.table, rulestr);
2891 		if (!typedatum)
2892 			goto out;
2893 		tmprule->au_ctxt.type = typedatum->value;
2894 		break;
2895 	case AUDIT_SUBJ_SEN:
2896 	case AUDIT_SUBJ_CLR:
2897 	case AUDIT_OBJ_LEV_LOW:
2898 	case AUDIT_OBJ_LEV_HIGH:
2899 		rc = mls_from_string(rulestr, &tmprule->au_ctxt, GFP_ATOMIC);
2900 		if (rc)
2901 			goto out;
2902 		break;
2903 	}
2904 	rc = 0;
2905 out:
2906 	read_unlock(&policy_rwlock);
2907 
2908 	if (rc) {
2909 		selinux_audit_rule_free(tmprule);
2910 		tmprule = NULL;
2911 	}
2912 
2913 	*rule = tmprule;
2914 
2915 	return rc;
2916 }
2917 
2918 /* Check to see if the rule contains any selinux fields */
2919 int selinux_audit_rule_known(struct audit_krule *rule)
2920 {
2921 	int i;
2922 
2923 	for (i = 0; i < rule->field_count; i++) {
2924 		struct audit_field *f = &rule->fields[i];
2925 		switch (f->type) {
2926 		case AUDIT_SUBJ_USER:
2927 		case AUDIT_SUBJ_ROLE:
2928 		case AUDIT_SUBJ_TYPE:
2929 		case AUDIT_SUBJ_SEN:
2930 		case AUDIT_SUBJ_CLR:
2931 		case AUDIT_OBJ_USER:
2932 		case AUDIT_OBJ_ROLE:
2933 		case AUDIT_OBJ_TYPE:
2934 		case AUDIT_OBJ_LEV_LOW:
2935 		case AUDIT_OBJ_LEV_HIGH:
2936 			return 1;
2937 		}
2938 	}
2939 
2940 	return 0;
2941 }
2942 
2943 int selinux_audit_rule_match(u32 sid, u32 field, u32 op, void *vrule,
2944 			     struct audit_context *actx)
2945 {
2946 	struct context *ctxt;
2947 	struct mls_level *level;
2948 	struct selinux_audit_rule *rule = vrule;
2949 	int match = 0;
2950 
2951 	if (unlikely(!rule)) {
2952 		WARN_ONCE(1, "selinux_audit_rule_match: missing rule\n");
2953 		return -ENOENT;
2954 	}
2955 
2956 	read_lock(&policy_rwlock);
2957 
2958 	if (rule->au_seqno < latest_granting) {
2959 		match = -ESTALE;
2960 		goto out;
2961 	}
2962 
2963 	ctxt = sidtab_search(&sidtab, sid);
2964 	if (unlikely(!ctxt)) {
2965 		WARN_ONCE(1, "selinux_audit_rule_match: unrecognized SID %d\n",
2966 			  sid);
2967 		match = -ENOENT;
2968 		goto out;
2969 	}
2970 
2971 	/* a field/op pair that is not caught here will simply fall through
2972 	   without a match */
2973 	switch (field) {
2974 	case AUDIT_SUBJ_USER:
2975 	case AUDIT_OBJ_USER:
2976 		switch (op) {
2977 		case Audit_equal:
2978 			match = (ctxt->user == rule->au_ctxt.user);
2979 			break;
2980 		case Audit_not_equal:
2981 			match = (ctxt->user != rule->au_ctxt.user);
2982 			break;
2983 		}
2984 		break;
2985 	case AUDIT_SUBJ_ROLE:
2986 	case AUDIT_OBJ_ROLE:
2987 		switch (op) {
2988 		case Audit_equal:
2989 			match = (ctxt->role == rule->au_ctxt.role);
2990 			break;
2991 		case Audit_not_equal:
2992 			match = (ctxt->role != rule->au_ctxt.role);
2993 			break;
2994 		}
2995 		break;
2996 	case AUDIT_SUBJ_TYPE:
2997 	case AUDIT_OBJ_TYPE:
2998 		switch (op) {
2999 		case Audit_equal:
3000 			match = (ctxt->type == rule->au_ctxt.type);
3001 			break;
3002 		case Audit_not_equal:
3003 			match = (ctxt->type != rule->au_ctxt.type);
3004 			break;
3005 		}
3006 		break;
3007 	case AUDIT_SUBJ_SEN:
3008 	case AUDIT_SUBJ_CLR:
3009 	case AUDIT_OBJ_LEV_LOW:
3010 	case AUDIT_OBJ_LEV_HIGH:
3011 		level = ((field == AUDIT_SUBJ_SEN ||
3012 			  field == AUDIT_OBJ_LEV_LOW) ?
3013 			 &ctxt->range.level[0] : &ctxt->range.level[1]);
3014 		switch (op) {
3015 		case Audit_equal:
3016 			match = mls_level_eq(&rule->au_ctxt.range.level[0],
3017 					     level);
3018 			break;
3019 		case Audit_not_equal:
3020 			match = !mls_level_eq(&rule->au_ctxt.range.level[0],
3021 					      level);
3022 			break;
3023 		case Audit_lt:
3024 			match = (mls_level_dom(&rule->au_ctxt.range.level[0],
3025 					       level) &&
3026 				 !mls_level_eq(&rule->au_ctxt.range.level[0],
3027 					       level));
3028 			break;
3029 		case Audit_le:
3030 			match = mls_level_dom(&rule->au_ctxt.range.level[0],
3031 					      level);
3032 			break;
3033 		case Audit_gt:
3034 			match = (mls_level_dom(level,
3035 					      &rule->au_ctxt.range.level[0]) &&
3036 				 !mls_level_eq(level,
3037 					       &rule->au_ctxt.range.level[0]));
3038 			break;
3039 		case Audit_ge:
3040 			match = mls_level_dom(level,
3041 					      &rule->au_ctxt.range.level[0]);
3042 			break;
3043 		}
3044 	}
3045 
3046 out:
3047 	read_unlock(&policy_rwlock);
3048 	return match;
3049 }
3050 
3051 static int (*aurule_callback)(void) = audit_update_lsm_rules;
3052 
3053 static int aurule_avc_callback(u32 event)
3054 {
3055 	int err = 0;
3056 
3057 	if (event == AVC_CALLBACK_RESET && aurule_callback)
3058 		err = aurule_callback();
3059 	return err;
3060 }
3061 
3062 static int __init aurule_init(void)
3063 {
3064 	int err;
3065 
3066 	err = avc_add_callback(aurule_avc_callback, AVC_CALLBACK_RESET);
3067 	if (err)
3068 		panic("avc_add_callback() failed, error %d\n", err);
3069 
3070 	return err;
3071 }
3072 __initcall(aurule_init);
3073 
3074 #ifdef CONFIG_NETLABEL
3075 /**
3076  * security_netlbl_cache_add - Add an entry to the NetLabel cache
3077  * @secattr: the NetLabel packet security attributes
3078  * @sid: the SELinux SID
3079  *
3080  * Description:
3081  * Attempt to cache the context in @ctx, which was derived from the packet in
3082  * @skb, in the NetLabel subsystem cache.  This function assumes @secattr has
3083  * already been initialized.
3084  *
3085  */
3086 static void security_netlbl_cache_add(struct netlbl_lsm_secattr *secattr,
3087 				      u32 sid)
3088 {
3089 	u32 *sid_cache;
3090 
3091 	sid_cache = kmalloc(sizeof(*sid_cache), GFP_ATOMIC);
3092 	if (sid_cache == NULL)
3093 		return;
3094 	secattr->cache = netlbl_secattr_cache_alloc(GFP_ATOMIC);
3095 	if (secattr->cache == NULL) {
3096 		kfree(sid_cache);
3097 		return;
3098 	}
3099 
3100 	*sid_cache = sid;
3101 	secattr->cache->free = kfree;
3102 	secattr->cache->data = sid_cache;
3103 	secattr->flags |= NETLBL_SECATTR_CACHE;
3104 }
3105 
3106 /**
3107  * security_netlbl_secattr_to_sid - Convert a NetLabel secattr to a SELinux SID
3108  * @secattr: the NetLabel packet security attributes
3109  * @sid: the SELinux SID
3110  *
3111  * Description:
3112  * Convert the given NetLabel security attributes in @secattr into a
3113  * SELinux SID.  If the @secattr field does not contain a full SELinux
3114  * SID/context then use SECINITSID_NETMSG as the foundation.  If possible the
3115  * 'cache' field of @secattr is set and the CACHE flag is set; this is to
3116  * allow the @secattr to be used by NetLabel to cache the secattr to SID
3117  * conversion for future lookups.  Returns zero on success, negative values on
3118  * failure.
3119  *
3120  */
3121 int security_netlbl_secattr_to_sid(struct netlbl_lsm_secattr *secattr,
3122 				   u32 *sid)
3123 {
3124 	int rc;
3125 	struct context *ctx;
3126 	struct context ctx_new;
3127 
3128 	if (!ss_initialized) {
3129 		*sid = SECSID_NULL;
3130 		return 0;
3131 	}
3132 
3133 	read_lock(&policy_rwlock);
3134 
3135 	if (secattr->flags & NETLBL_SECATTR_CACHE)
3136 		*sid = *(u32 *)secattr->cache->data;
3137 	else if (secattr->flags & NETLBL_SECATTR_SECID)
3138 		*sid = secattr->attr.secid;
3139 	else if (secattr->flags & NETLBL_SECATTR_MLS_LVL) {
3140 		rc = -EIDRM;
3141 		ctx = sidtab_search(&sidtab, SECINITSID_NETMSG);
3142 		if (ctx == NULL)
3143 			goto out;
3144 
3145 		context_init(&ctx_new);
3146 		ctx_new.user = ctx->user;
3147 		ctx_new.role = ctx->role;
3148 		ctx_new.type = ctx->type;
3149 		mls_import_netlbl_lvl(&ctx_new, secattr);
3150 		if (secattr->flags & NETLBL_SECATTR_MLS_CAT) {
3151 			rc = ebitmap_netlbl_import(&ctx_new.range.level[0].cat,
3152 						   secattr->attr.mls.cat);
3153 			if (rc)
3154 				goto out;
3155 			memcpy(&ctx_new.range.level[1].cat,
3156 			       &ctx_new.range.level[0].cat,
3157 			       sizeof(ctx_new.range.level[0].cat));
3158 		}
3159 		rc = -EIDRM;
3160 		if (!mls_context_isvalid(&policydb, &ctx_new))
3161 			goto out_free;
3162 
3163 		rc = sidtab_context_to_sid(&sidtab, &ctx_new, sid);
3164 		if (rc)
3165 			goto out_free;
3166 
3167 		security_netlbl_cache_add(secattr, *sid);
3168 
3169 		ebitmap_destroy(&ctx_new.range.level[0].cat);
3170 	} else
3171 		*sid = SECSID_NULL;
3172 
3173 	read_unlock(&policy_rwlock);
3174 	return 0;
3175 out_free:
3176 	ebitmap_destroy(&ctx_new.range.level[0].cat);
3177 out:
3178 	read_unlock(&policy_rwlock);
3179 	return rc;
3180 }
3181 
3182 /**
3183  * security_netlbl_sid_to_secattr - Convert a SELinux SID to a NetLabel secattr
3184  * @sid: the SELinux SID
3185  * @secattr: the NetLabel packet security attributes
3186  *
3187  * Description:
3188  * Convert the given SELinux SID in @sid into a NetLabel security attribute.
3189  * Returns zero on success, negative values on failure.
3190  *
3191  */
3192 int security_netlbl_sid_to_secattr(u32 sid, struct netlbl_lsm_secattr *secattr)
3193 {
3194 	int rc;
3195 	struct context *ctx;
3196 
3197 	if (!ss_initialized)
3198 		return 0;
3199 
3200 	read_lock(&policy_rwlock);
3201 
3202 	rc = -ENOENT;
3203 	ctx = sidtab_search(&sidtab, sid);
3204 	if (ctx == NULL)
3205 		goto out;
3206 
3207 	rc = -ENOMEM;
3208 	secattr->domain = kstrdup(sym_name(&policydb, SYM_TYPES, ctx->type - 1),
3209 				  GFP_ATOMIC);
3210 	if (secattr->domain == NULL)
3211 		goto out;
3212 
3213 	secattr->attr.secid = sid;
3214 	secattr->flags |= NETLBL_SECATTR_DOMAIN_CPY | NETLBL_SECATTR_SECID;
3215 	mls_export_netlbl_lvl(ctx, secattr);
3216 	rc = mls_export_netlbl_cat(ctx, secattr);
3217 out:
3218 	read_unlock(&policy_rwlock);
3219 	return rc;
3220 }
3221 #endif /* CONFIG_NETLABEL */
3222 
3223 /**
3224  * security_read_policy - read the policy.
3225  * @data: binary policy data
3226  * @len: length of data in bytes
3227  *
3228  */
3229 int security_read_policy(void **data, size_t *len)
3230 {
3231 	int rc;
3232 	struct policy_file fp;
3233 
3234 	if (!ss_initialized)
3235 		return -EINVAL;
3236 
3237 	*len = security_policydb_len();
3238 
3239 	*data = vmalloc_user(*len);
3240 	if (!*data)
3241 		return -ENOMEM;
3242 
3243 	fp.data = *data;
3244 	fp.len = *len;
3245 
3246 	read_lock(&policy_rwlock);
3247 	rc = policydb_write(&policydb, &fp);
3248 	read_unlock(&policy_rwlock);
3249 
3250 	if (rc)
3251 		return rc;
3252 
3253 	*len = (unsigned long)fp.data - (unsigned long)*data;
3254 	return 0;
3255 
3256 }
3257