?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
added 2.6.29.6 aldebaran kernel
[nao-ulib.git] / kernel / 2.6.29.6-aldebaran-rt / security / selinux / ss / policydb.c
blob72e4a54973aae503c9c9378aa392750f7f4adb20
1 /*
2 * Implementation of the policy database.
3 *
4 * Author : Stephen Smalley, <sds@epoch.ncsc.mil>
5 */
6
7 /*
8 * Updated: Trusted Computer Solutions, Inc. <dgoeddel@trustedcs.com>
9 *
10 * Support for enhanced MLS infrastructure.
11 *
12 * Updated: Frank Mayer <mayerf@tresys.com> and Karl MacMillan <kmacmillan@tresys.com>
13 *
14 * Added conditional policy language extensions
15 *
16 * Updated: Hewlett-Packard <paul.moore@hp.com>
17 *
18 * Added support for the policy capability bitmap
19 *
20 * Copyright (C) 2007 Hewlett-Packard Development Company, L.P.
21 * Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
22 * Copyright (C) 2003 - 2004 Tresys Technology, LLC
23 * This program is free software; you can redistribute it and/or modify
24 * it under the terms of the GNU General Public License as published by
25 * the Free Software Foundation, version 2.
26 */
27
28 #include <linux/kernel.h>
29 #include <linux/sched.h>
30 #include <linux/slab.h>
31 #include <linux/string.h>
32 #include <linux/errno.h>
33 #include <linux/audit.h>
34 #include "security.h"
35
36 #include "policydb.h"
37 #include "conditional.h"
38 #include "mls.h"
39
40 #define _DEBUG_HASHES
41
42 #ifdef DEBUG_HASHES
43 static char *symtab_name[SYM_NUM] = {
44 "common prefixes",
45 "classes",
46 "roles",
47 "types",
48 "users",
49 "bools",
50 "levels",
51 "categories",
52 };
53 #endif
54
55 int selinux_mls_enabled;
56
57 static unsigned int symtab_sizes[SYM_NUM] = {
58 2,
59 32,
60 16,
61 512,
62 128,
63 16,
64 16,
65 16,
66 };
67
68 struct policydb_compat_info {
69 int version;
70 int sym_num;
71 int ocon_num;
72 };
73
74 /* These need to be updated if SYM_NUM or OCON_NUM changes */
75 static struct policydb_compat_info policydb_compat[] = {
76 {
77 .version = POLICYDB_VERSION_BASE,
78 .sym_num = SYM_NUM - 3,
79 .ocon_num = OCON_NUM - 1,
80 },
81 {
82 .version = POLICYDB_VERSION_BOOL,
83 .sym_num = SYM_NUM - 2,
84 .ocon_num = OCON_NUM - 1,
85 },
86 {
87 .version = POLICYDB_VERSION_IPV6,
88 .sym_num = SYM_NUM - 2,
89 .ocon_num = OCON_NUM,
90 },
91 {
92 .version = POLICYDB_VERSION_NLCLASS,
93 .sym_num = SYM_NUM - 2,
94 .ocon_num = OCON_NUM,
95 },
96 {
97 .version = POLICYDB_VERSION_MLS,
98 .sym_num = SYM_NUM,
99 .ocon_num = OCON_NUM,
100 },
101 {
102 .version = POLICYDB_VERSION_AVTAB,
103 .sym_num = SYM_NUM,
104 .ocon_num = OCON_NUM,
105 },
106 {
107 .version = POLICYDB_VERSION_RANGETRANS,
108 .sym_num = SYM_NUM,
109 .ocon_num = OCON_NUM,
110 },
111 {
112 .version = POLICYDB_VERSION_POLCAP,
113 .sym_num = SYM_NUM,
114 .ocon_num = OCON_NUM,
115 },
116 {
117 .version = POLICYDB_VERSION_PERMISSIVE,
118 .sym_num = SYM_NUM,
119 .ocon_num = OCON_NUM,
120 },
121 {
122 .version = POLICYDB_VERSION_BOUNDARY,
123 .sym_num = SYM_NUM,
124 .ocon_num = OCON_NUM,
125 },
126 };
127
128 static struct policydb_compat_info *policydb_lookup_compat(int version)
129 {
130 int i;
131 struct policydb_compat_info *info = NULL;
132
133 for (i = 0; i < ARRAY_SIZE(policydb_compat); i++) {
134 if (policydb_compat[i].version == version) {
135 info = &policydb_compat[i];
136 break;
137 }
138 }
139 return info;
140 }
141
142 /*
143 * Initialize the role table.
144 */
145 static int roles_init(struct policydb *p)
146 {
147 char *key = NULL;
148 int rc;
149 struct role_datum *role;
150
151 role = kzalloc(sizeof(*role), GFP_KERNEL);
152 if (!role) {
153 rc = -ENOMEM;
154 goto out;
155 }
156 role->value = ++p->p_roles.nprim;
157 if (role->value != OBJECT_R_VAL) {
158 rc = -EINVAL;
159 goto out_free_role;
160 }
161 key = kmalloc(strlen(OBJECT_R)+1, GFP_KERNEL);
162 if (!key) {
163 rc = -ENOMEM;
164 goto out_free_role;
165 }
166 strcpy(key, OBJECT_R);
167 rc = hashtab_insert(p->p_roles.table, key, role);
168 if (rc)
169 goto out_free_key;
170 out:
171 return rc;
172
173 out_free_key:
174 kfree(key);
175 out_free_role:
176 kfree(role);
177 goto out;
178 }
179
180 /*
181 * Initialize a policy database structure.
182 */
183 static int policydb_init(struct policydb *p)
184 {
185 int i, rc;
186
187 memset(p, 0, sizeof(*p));
188
189 for (i = 0; i < SYM_NUM; i++) {
190 rc = symtab_init(&p->symtab[i], symtab_sizes[i]);
191 if (rc)
192 goto out_free_symtab;
193 }
194
195 rc = avtab_init(&p->te_avtab);
196 if (rc)
197 goto out_free_symtab;
198
199 rc = roles_init(p);
200 if (rc)
201 goto out_free_symtab;
202
203 rc = cond_policydb_init(p);
204 if (rc)
205 goto out_free_symtab;
206
207 ebitmap_init(&p->policycaps);
208 ebitmap_init(&p->permissive_map);
209
210 out:
211 return rc;
212
213 out_free_symtab:
214 for (i = 0; i < SYM_NUM; i++)
215 hashtab_destroy(p->symtab[i].table);
216 goto out;
217 }
218
219 /*
220 * The following *_index functions are used to
221 * define the val_to_name and val_to_struct arrays
222 * in a policy database structure. The val_to_name
223 * arrays are used when converting security context
224 * structures into string representations. The
225 * val_to_struct arrays are used when the attributes
226 * of a class, role, or user are needed.
227 */
228
229 static int common_index(void *key, void *datum, void *datap)
230 {
231 struct policydb *p;
232 struct common_datum *comdatum;
233
234 comdatum = datum;
235 p = datap;
236 if (!comdatum->value || comdatum->value > p->p_commons.nprim)
237 return -EINVAL;
238 p->p_common_val_to_name[comdatum->value - 1] = key;
239 return 0;
240 }
241
242 static int class_index(void *key, void *datum, void *datap)
243 {
244 struct policydb *p;
245 struct class_datum *cladatum;
246
247 cladatum = datum;
248 p = datap;
249 if (!cladatum->value || cladatum->value > p->p_classes.nprim)
250 return -EINVAL;
251 p->p_class_val_to_name[cladatum->value - 1] = key;
252 p->class_val_to_struct[cladatum->value - 1] = cladatum;
253 return 0;
254 }
255
256 static int role_index(void *key, void *datum, void *datap)
257 {
258 struct policydb *p;
259 struct role_datum *role;
260
261 role = datum;
262 p = datap;
263 if (!role->value
264 || role->value > p->p_roles.nprim
265 || role->bounds > p->p_roles.nprim)
266 return -EINVAL;
267 p->p_role_val_to_name[role->value - 1] = key;
268 p->role_val_to_struct[role->value - 1] = role;
269 return 0;
270 }
271
272 static int type_index(void *key, void *datum, void *datap)
273 {
274 struct policydb *p;
275 struct type_datum *typdatum;
276
277 typdatum = datum;
278 p = datap;
279
280 if (typdatum->primary) {
281 if (!typdatum->value
282 || typdatum->value > p->p_types.nprim
283 || typdatum->bounds > p->p_types.nprim)
284 return -EINVAL;
285 p->p_type_val_to_name[typdatum->value - 1] = key;
286 p->type_val_to_struct[typdatum->value - 1] = typdatum;
287 }
288
289 return 0;
290 }
291
292 static int user_index(void *key, void *datum, void *datap)
293 {
294 struct policydb *p;
295 struct user_datum *usrdatum;
296
297 usrdatum = datum;
298 p = datap;
299 if (!usrdatum->value
300 || usrdatum->value > p->p_users.nprim
301 || usrdatum->bounds > p->p_users.nprim)
302 return -EINVAL;
303 p->p_user_val_to_name[usrdatum->value - 1] = key;
304 p->user_val_to_struct[usrdatum->value - 1] = usrdatum;
305 return 0;
306 }
307
308 static int sens_index(void *key, void *datum, void *datap)
309 {
310 struct policydb *p;
311 struct level_datum *levdatum;
312
313 levdatum = datum;
314 p = datap;
315
316 if (!levdatum->isalias) {
317 if (!levdatum->level->sens ||
318 levdatum->level->sens > p->p_levels.nprim)
319 return -EINVAL;
320 p->p_sens_val_to_name[levdatum->level->sens - 1] = key;
321 }
322
323 return 0;
324 }
325
326 static int cat_index(void *key, void *datum, void *datap)
327 {
328 struct policydb *p;
329 struct cat_datum *catdatum;
330
331 catdatum = datum;
332 p = datap;
333
334 if (!catdatum->isalias) {
335 if (!catdatum->value || catdatum->value > p->p_cats.nprim)
336 return -EINVAL;
337 p->p_cat_val_to_name[catdatum->value - 1] = key;
338 }
339
340 return 0;
341 }
342
343 static int (*index_f[SYM_NUM]) (void *key, void *datum, void *datap) =
344 {
345 common_index,
346 class_index,
347 role_index,
348 type_index,
349 user_index,
350 cond_index_bool,
351 sens_index,
352 cat_index,
353 };
354
355 /*
356 * Define the common val_to_name array and the class
357 * val_to_name and val_to_struct arrays in a policy
358 * database structure.
359 *
360 * Caller must clean up upon failure.
361 */
362 static int policydb_index_classes(struct policydb *p)
363 {
364 int rc;
365
366 p->p_common_val_to_name =
367 kmalloc(p->p_commons.nprim * sizeof(char *), GFP_KERNEL);
368 if (!p->p_common_val_to_name) {
369 rc = -ENOMEM;
370 goto out;
371 }
372
373 rc = hashtab_map(p->p_commons.table, common_index, p);
374 if (rc)
375 goto out;
376
377 p->class_val_to_struct =
378 kmalloc(p->p_classes.nprim * sizeof(*(p->class_val_to_struct)), GFP_KERNEL);
379 if (!p->class_val_to_struct) {
380 rc = -ENOMEM;
381 goto out;
382 }
383
384 p->p_class_val_to_name =
385 kmalloc(p->p_classes.nprim * sizeof(char *), GFP_KERNEL);
386 if (!p->p_class_val_to_name) {
387 rc = -ENOMEM;
388 goto out;
389 }
390
391 rc = hashtab_map(p->p_classes.table, class_index, p);
392 out:
393 return rc;
394 }
395
396 #ifdef DEBUG_HASHES
397 static void symtab_hash_eval(struct symtab *s)
398 {
399 int i;
400
401 for (i = 0; i < SYM_NUM; i++) {
402 struct hashtab *h = s[i].table;
403 struct hashtab_info info;
404
405 hashtab_stat(h, &info);
406 printk(KERN_DEBUG "SELinux: %s: %d entries and %d/%d buckets used, "
407 "longest chain length %d\n", symtab_name[i], h->nel,
408 info.slots_used, h->size, info.max_chain_len);
409 }
410 }
411 #endif
412
413 /*
414 * Define the other val_to_name and val_to_struct arrays
415 * in a policy database structure.
416 *
417 * Caller must clean up on failure.
418 */
419 static int policydb_index_others(struct policydb *p)
420 {
421 int i, rc = 0;
422
423 printk(KERN_DEBUG "SELinux: %d users, %d roles, %d types, %d bools",
424 p->p_users.nprim, p->p_roles.nprim, p->p_types.nprim, p->p_bools.nprim);
425 if (selinux_mls_enabled)
426 printk(", %d sens, %d cats", p->p_levels.nprim,
427 p->p_cats.nprim);
428 printk("\n");
429
430 printk(KERN_DEBUG "SELinux: %d classes, %d rules\n",
431 p->p_classes.nprim, p->te_avtab.nel);
432
433 #ifdef DEBUG_HASHES
434 avtab_hash_eval(&p->te_avtab, "rules");
435 symtab_hash_eval(p->symtab);
436 #endif
437
438 p->role_val_to_struct =
439 kmalloc(p->p_roles.nprim * sizeof(*(p->role_val_to_struct)),
440 GFP_KERNEL);
441 if (!p->role_val_to_struct) {
442 rc = -ENOMEM;
443 goto out;
444 }
445
446 p->user_val_to_struct =
447 kmalloc(p->p_users.nprim * sizeof(*(p->user_val_to_struct)),
448 GFP_KERNEL);
449 if (!p->user_val_to_struct) {
450 rc = -ENOMEM;
451 goto out;
452 }
453
454 p->type_val_to_struct =
455 kmalloc(p->p_types.nprim * sizeof(*(p->type_val_to_struct)),
456 GFP_KERNEL);
457 if (!p->type_val_to_struct) {
458 rc = -ENOMEM;
459 goto out;
460 }
461
462 if (cond_init_bool_indexes(p)) {
463 rc = -ENOMEM;
464 goto out;
465 }
466
467 for (i = SYM_ROLES; i < SYM_NUM; i++) {
468 p->sym_val_to_name[i] =
469 kmalloc(p->symtab[i].nprim * sizeof(char *), GFP_KERNEL);
470 if (!p->sym_val_to_name[i]) {
471 rc = -ENOMEM;
472 goto out;
473 }
474 rc = hashtab_map(p->symtab[i].table, index_f[i], p);
475 if (rc)
476 goto out;
477 }
478
479 out:
480 return rc;
481 }
482
483 /*
484 * The following *_destroy functions are used to
485 * free any memory allocated for each kind of
486 * symbol data in the policy database.
487 */
488
489 static int perm_destroy(void *key, void *datum, void *p)
490 {
491 kfree(key);
492 kfree(datum);
493 return 0;
494 }
495
496 static int common_destroy(void *key, void *datum, void *p)
497 {
498 struct common_datum *comdatum;
499
500 kfree(key);
501 comdatum = datum;
502 hashtab_map(comdatum->permissions.table, perm_destroy, NULL);
503 hashtab_destroy(comdatum->permissions.table);
504 kfree(datum);
505 return 0;
506 }
507
508 static int cls_destroy(void *key, void *datum, void *p)
509 {
510 struct class_datum *cladatum;
511 struct constraint_node *constraint, *ctemp;
512 struct constraint_expr *e, *etmp;
513
514 kfree(key);
515 cladatum = datum;
516 hashtab_map(cladatum->permissions.table, perm_destroy, NULL);
517 hashtab_destroy(cladatum->permissions.table);
518 constraint = cladatum->constraints;
519 while (constraint) {
520 e = constraint->expr;
521 while (e) {
522 ebitmap_destroy(&e->names);
523 etmp = e;
524 e = e->next;
525 kfree(etmp);
526 }
527 ctemp = constraint;
528 constraint = constraint->next;
529 kfree(ctemp);
530 }
531
532 constraint = cladatum->validatetrans;
533 while (constraint) {
534 e = constraint->expr;
535 while (e) {
536 ebitmap_destroy(&e->names);
537 etmp = e;
538 e = e->next;
539 kfree(etmp);
540 }
541 ctemp = constraint;
542 constraint = constraint->next;
543 kfree(ctemp);
544 }
545
546 kfree(cladatum->comkey);
547 kfree(datum);
548 return 0;
549 }
550
551 static int role_destroy(void *key, void *datum, void *p)
552 {
553 struct role_datum *role;
554
555 kfree(key);
556 role = datum;
557 ebitmap_destroy(&role->dominates);
558 ebitmap_destroy(&role->types);
559 kfree(datum);
560 return 0;
561 }
562
563 static int type_destroy(void *key, void *datum, void *p)
564 {
565 kfree(key);
566 kfree(datum);
567 return 0;
568 }
569
570 static int user_destroy(void *key, void *datum, void *p)
571 {
572 struct user_datum *usrdatum;
573
574 kfree(key);
575 usrdatum = datum;
576 ebitmap_destroy(&usrdatum->roles);
577 ebitmap_destroy(&usrdatum->range.level[0].cat);
578 ebitmap_destroy(&usrdatum->range.level[1].cat);
579 ebitmap_destroy(&usrdatum->dfltlevel.cat);
580 kfree(datum);
581 return 0;
582 }
583
584 static int sens_destroy(void *key, void *datum, void *p)
585 {
586 struct level_datum *levdatum;
587
588 kfree(key);
589 levdatum = datum;
590 ebitmap_destroy(&levdatum->level->cat);
591 kfree(levdatum->level);
592 kfree(datum);
593 return 0;
594 }
595
596 static int cat_destroy(void *key, void *datum, void *p)
597 {
598 kfree(key);
599 kfree(datum);
600 return 0;
601 }
602
603 static int (*destroy_f[SYM_NUM]) (void *key, void *datum, void *datap) =
604 {
605 common_destroy,
606 cls_destroy,
607 role_destroy,
608 type_destroy,
609 user_destroy,
610 cond_destroy_bool,
611 sens_destroy,
612 cat_destroy,
613 };
614
615 static void ocontext_destroy(struct ocontext *c, int i)
616 {
617 context_destroy(&c->context[0]);
618 context_destroy(&c->context[1]);
619 if (i == OCON_ISID || i == OCON_FS ||
620 i == OCON_NETIF || i == OCON_FSUSE)
621 kfree(c->u.name);
622 kfree(c);
623 }
624
625 /*
626 * Free any memory allocated by a policy database structure.
627 */
628 void policydb_destroy(struct policydb *p)
629 {
630 struct ocontext *c, *ctmp;
631 struct genfs *g, *gtmp;
632 int i;
633 struct role_allow *ra, *lra = NULL;
634 struct role_trans *tr, *ltr = NULL;
635 struct range_trans *rt, *lrt = NULL;
636
637 for (i = 0; i < SYM_NUM; i++) {
638 cond_resched();
639 hashtab_map(p->symtab[i].table, destroy_f[i], NULL);
640 hashtab_destroy(p->symtab[i].table);
641 }
642
643 for (i = 0; i < SYM_NUM; i++)
644 kfree(p->sym_val_to_name[i]);
645
646 kfree(p->class_val_to_struct);
647 kfree(p->role_val_to_struct);
648 kfree(p->user_val_to_struct);
649 kfree(p->type_val_to_struct);
650
651 avtab_destroy(&p->te_avtab);
652
653 for (i = 0; i < OCON_NUM; i++) {
654 cond_resched();
655 c = p->ocontexts[i];
656 while (c) {
657 ctmp = c;
658 c = c->next;
659 ocontext_destroy(ctmp, i);
660 }
661 p->ocontexts[i] = NULL;
662 }
663
664 g = p->genfs;
665 while (g) {
666 cond_resched();
667 kfree(g->fstype);
668 c = g->head;
669 while (c) {
670 ctmp = c;
671 c = c->next;
672 ocontext_destroy(ctmp, OCON_FSUSE);
673 }
674 gtmp = g;
675 g = g->next;
676 kfree(gtmp);
677 }
678 p->genfs = NULL;
679
680 cond_policydb_destroy(p);
681
682 for (tr = p->role_tr; tr; tr = tr->next) {
683 cond_resched();
684 kfree(ltr);
685 ltr = tr;
686 }
687 kfree(ltr);
688
689 for (ra = p->role_allow; ra; ra = ra->next) {
690 cond_resched();
691 kfree(lra);
692 lra = ra;
693 }
694 kfree(lra);
695
696 for (rt = p->range_tr; rt; rt = rt->next) {
697 cond_resched();
698 if (lrt) {
699 ebitmap_destroy(&lrt->target_range.level[0].cat);
700 ebitmap_destroy(&lrt->target_range.level[1].cat);
701 kfree(lrt);
702 }
703 lrt = rt;
704 }
705 if (lrt) {
706 ebitmap_destroy(&lrt->target_range.level[0].cat);
707 ebitmap_destroy(&lrt->target_range.level[1].cat);
708 kfree(lrt);
709 }
710
711 if (p->type_attr_map) {
712 for (i = 0; i < p->p_types.nprim; i++)
713 ebitmap_destroy(&p->type_attr_map[i]);
714 }
715 kfree(p->type_attr_map);
716 kfree(p->undefined_perms);
717 ebitmap_destroy(&p->policycaps);
718 ebitmap_destroy(&p->permissive_map);
719
720 return;
721 }
722
723 /*
724 * Load the initial SIDs specified in a policy database
725 * structure into a SID table.
726 */
727 int policydb_load_isids(struct policydb *p, struct sidtab *s)
728 {
729 struct ocontext *head, *c;
730 int rc;
731
732 rc = sidtab_init(s);
733 if (rc) {
734 printk(KERN_ERR "SELinux: out of memory on SID table init\n");
735 goto out;
736 }
737
738 head = p->ocontexts[OCON_ISID];
739 for (c = head; c; c = c->next) {
740 if (!c->context[0].user) {
741 printk(KERN_ERR "SELinux: SID %s was never "
742 "defined.\n", c->u.name);
743 rc = -EINVAL;
744 goto out;
745 }
746 if (sidtab_insert(s, c->sid[0], &c->context[0])) {
747 printk(KERN_ERR "SELinux: unable to load initial "
748 "SID %s.\n", c->u.name);
749 rc = -EINVAL;
750 goto out;
751 }
752 }
753 out:
754 return rc;
755 }
756
757 int policydb_class_isvalid(struct policydb *p, unsigned int class)
758 {
759 if (!class || class > p->p_classes.nprim)
760 return 0;
761 return 1;
762 }
763
764 int policydb_role_isvalid(struct policydb *p, unsigned int role)
765 {
766 if (!role || role > p->p_roles.nprim)
767 return 0;
768 return 1;
769 }
770
771 int policydb_type_isvalid(struct policydb *p, unsigned int type)
772 {
773 if (!type || type > p->p_types.nprim)
774 return 0;
775 return 1;
776 }
777
778 /*
779 * Return 1 if the fields in the security context
780 * structure `c' are valid. Return 0 otherwise.
781 */
782 int policydb_context_isvalid(struct policydb *p, struct context *c)
783 {
784 struct role_datum *role;
785 struct user_datum *usrdatum;
786
787 if (!c->role || c->role > p->p_roles.nprim)
788 return 0;
789
790 if (!c->user || c->user > p->p_users.nprim)
791 return 0;
792
793 if (!c->type || c->type > p->p_types.nprim)
794 return 0;
795
796 if (c->role != OBJECT_R_VAL) {
797 /*
798 * Role must be authorized for the type.
799 */
800 role = p->role_val_to_struct[c->role - 1];
801 if (!ebitmap_get_bit(&role->types,
802 c->type - 1))
803 /* role may not be associated with type */
804 return 0;
805
806 /*
807 * User must be authorized for the role.
808 */
809 usrdatum = p->user_val_to_struct[c->user - 1];
810 if (!usrdatum)
811 return 0;
812
813 if (!ebitmap_get_bit(&usrdatum->roles,
814 c->role - 1))
815 /* user may not be associated with role */
816 return 0;
817 }
818
819 if (!mls_context_isvalid(p, c))
820 return 0;
821
822 return 1;
823 }
824
825 /*
826 * Read a MLS range structure from a policydb binary
827 * representation file.
828 */
829 static int mls_read_range_helper(struct mls_range *r, void *fp)
830 {
831 __le32 buf[2];
832 u32 items;
833 int rc;
834
835 rc = next_entry(buf, fp, sizeof(u32));
836 if (rc < 0)
837 goto out;
838
839 items = le32_to_cpu(buf[0]);
840 if (items > ARRAY_SIZE(buf)) {
841 printk(KERN_ERR "SELinux: mls: range overflow\n");
842 rc = -EINVAL;
843 goto out;
844 }
845 rc = next_entry(buf, fp, sizeof(u32) * items);
846 if (rc < 0) {
847 printk(KERN_ERR "SELinux: mls: truncated range\n");
848 goto out;
849 }
850 r->level[0].sens = le32_to_cpu(buf[0]);
851 if (items > 1)
852 r->level[1].sens = le32_to_cpu(buf[1]);
853 else
854 r->level[1].sens = r->level[0].sens;
855
856 rc = ebitmap_read(&r->level[0].cat, fp);
857 if (rc) {
858 printk(KERN_ERR "SELinux: mls: error reading low "
859 "categories\n");
860 goto out;
861 }
862 if (items > 1) {
863 rc = ebitmap_read(&r->level[1].cat, fp);
864 if (rc) {
865 printk(KERN_ERR "SELinux: mls: error reading high "
866 "categories\n");
867 goto bad_high;
868 }
869 } else {
870 rc = ebitmap_cpy(&r->level[1].cat, &r->level[0].cat);
871 if (rc) {
872 printk(KERN_ERR "SELinux: mls: out of memory\n");
873 goto bad_high;
874 }
875 }
876
877 rc = 0;
878 out:
879 return rc;
880 bad_high:
881 ebitmap_destroy(&r->level[0].cat);
882 goto out;
883 }
884
885 /*
886 * Read and validate a security context structure
887 * from a policydb binary representation file.
888 */
889 static int context_read_and_validate(struct context *c,
890 struct policydb *p,
891 void *fp)
892 {
893 __le32 buf[3];
894 int rc;
895
896 rc = next_entry(buf, fp, sizeof buf);
897 if (rc < 0) {
898 printk(KERN_ERR "SELinux: context truncated\n");
899 goto out;
900 }
901 c->user = le32_to_cpu(buf[0]);
902 c->role = le32_to_cpu(buf[1]);
903 c->type = le32_to_cpu(buf[2]);
904 if (p->policyvers >= POLICYDB_VERSION_MLS) {
905 if (mls_read_range_helper(&c->range, fp)) {
906 printk(KERN_ERR "SELinux: error reading MLS range of "
907 "context\n");
908 rc = -EINVAL;
909 goto out;
910 }
911 }
912
913 if (!policydb_context_isvalid(p, c)) {
914 printk(KERN_ERR "SELinux: invalid security context\n");
915 context_destroy(c);
916 rc = -EINVAL;
917 }
918 out:
919 return rc;
920 }
921
922 /*
923 * The following *_read functions are used to
924 * read the symbol data from a policy database
925 * binary representation file.
926 */
927
928 static int perm_read(struct policydb *p, struct hashtab *h, void *fp)
929 {
930 char *key = NULL;
931 struct perm_datum *perdatum;
932 int rc;
933 __le32 buf[2];
934 u32 len;
935
936 perdatum = kzalloc(sizeof(*perdatum), GFP_KERNEL);
937 if (!perdatum) {
938 rc = -ENOMEM;
939 goto out;
940 }
941
942 rc = next_entry(buf, fp, sizeof buf);
943 if (rc < 0)
944 goto bad;
945
946 len = le32_to_cpu(buf[0]);
947 perdatum->value = le32_to_cpu(buf[1]);
948
949 key = kmalloc(len + 1, GFP_KERNEL);
950 if (!key) {
951 rc = -ENOMEM;
952 goto bad;
953 }
954 rc = next_entry(key, fp, len);
955 if (rc < 0)
956 goto bad;
957 key[len] = '\0';
958
959 rc = hashtab_insert(h, key, perdatum);
960 if (rc)
961 goto bad;
962 out:
963 return rc;
964 bad:
965 perm_destroy(key, perdatum, NULL);
966 goto out;
967 }
968
969 static int common_read(struct policydb *p, struct hashtab *h, void *fp)
970 {
971 char *key = NULL;
972 struct common_datum *comdatum;
973 __le32 buf[4];
974 u32 len, nel;
975 int i, rc;
976
977 comdatum = kzalloc(sizeof(*comdatum), GFP_KERNEL);
978 if (!comdatum) {
979 rc = -ENOMEM;
980 goto out;
981 }
982
983 rc = next_entry(buf, fp, sizeof buf);
984 if (rc < 0)
985 goto bad;
986
987 len = le32_to_cpu(buf[0]);
988 comdatum->value = le32_to_cpu(buf[1]);
989
990 rc = symtab_init(&comdatum->permissions, PERM_SYMTAB_SIZE);
991 if (rc)
992 goto bad;
993 comdatum->permissions.nprim = le32_to_cpu(buf[2]);
994 nel = le32_to_cpu(buf[3]);
995
996 key = kmalloc(len + 1, GFP_KERNEL);
997 if (!key) {
998 rc = -ENOMEM;
999 goto bad;
1000 }
1001 rc = next_entry(key, fp, len);
1002 if (rc < 0)
1003 goto bad;
1004 key[len] = '\0';
1005
1006 for (i = 0; i < nel; i++) {
1007 rc = perm_read(p, comdatum->permissions.table, fp);
1008 if (rc)
1009 goto bad;
1010 }
1011
1012 rc = hashtab_insert(h, key, comdatum);
1013 if (rc)
1014 goto bad;
1015 out:
1016 return rc;
1017 bad:
1018 common_destroy(key, comdatum, NULL);
1019 goto out;
1020 }
1021
1022 static int read_cons_helper(struct constraint_node **nodep, int ncons,
1023 int allowxtarget, void *fp)
1024 {
1025 struct constraint_node *c, *lc;
1026 struct constraint_expr *e, *le;
1027 __le32 buf[3];
1028 u32 nexpr;
1029 int rc, i, j, depth;
1030
1031 lc = NULL;
1032 for (i = 0; i < ncons; i++) {
1033 c = kzalloc(sizeof(*c), GFP_KERNEL);
1034 if (!c)
1035 return -ENOMEM;
1036
1037 if (lc)
1038 lc->next = c;
1039 else
1040 *nodep = c;
1041
1042 rc = next_entry(buf, fp, (sizeof(u32) * 2));
1043 if (rc < 0)
1044 return rc;
1045 c->permissions = le32_to_cpu(buf[0]);
1046 nexpr = le32_to_cpu(buf[1]);
1047 le = NULL;
1048 depth = -1;
1049 for (j = 0; j < nexpr; j++) {
1050 e = kzalloc(sizeof(*e), GFP_KERNEL);
1051 if (!e)
1052 return -ENOMEM;
1053
1054 if (le)
1055 le->next = e;
1056 else
1057 c->expr = e;
1058
1059 rc = next_entry(buf, fp, (sizeof(u32) * 3));
1060 if (rc < 0)
1061 return rc;
1062 e->expr_type = le32_to_cpu(buf[0]);
1063 e->attr = le32_to_cpu(buf[1]);
1064 e->op = le32_to_cpu(buf[2]);
1065
1066 switch (e->expr_type) {
1067 case CEXPR_NOT:
1068 if (depth < 0)
1069 return -EINVAL;
1070 break;
1071 case CEXPR_AND:
1072 case CEXPR_OR:
1073 if (depth < 1)
1074 return -EINVAL;
1075 depth--;
1076 break;
1077 case CEXPR_ATTR:
1078 if (depth == (CEXPR_MAXDEPTH - 1))
1079 return -EINVAL;
1080 depth++;
1081 break;
1082 case CEXPR_NAMES:
1083 if (!allowxtarget && (e->attr & CEXPR_XTARGET))
1084 return -EINVAL;
1085 if (depth == (CEXPR_MAXDEPTH - 1))
1086 return -EINVAL;
1087 depth++;
1088 if (ebitmap_read(&e->names, fp))
1089 return -EINVAL;
1090 break;
1091 default:
1092 return -EINVAL;
1093 }
1094 le = e;
1095 }
1096 if (depth != 0)
1097 return -EINVAL;
1098 lc = c;
1099 }
1100
1101 return 0;
1102 }
1103
1104 static int class_read(struct policydb *p, struct hashtab *h, void *fp)
1105 {
1106 char *key = NULL;
1107 struct class_datum *cladatum;
1108 __le32 buf[6];
1109 u32 len, len2, ncons, nel;
1110 int i, rc;
1111
1112 cladatum = kzalloc(sizeof(*cladatum), GFP_KERNEL);
1113 if (!cladatum) {
1114 rc = -ENOMEM;
1115 goto out;
1116 }
1117
1118 rc = next_entry(buf, fp, sizeof(u32)*6);
1119 if (rc < 0)
1120 goto bad;
1121
1122 len = le32_to_cpu(buf[0]);
1123 len2 = le32_to_cpu(buf[1]);
1124 cladatum->value = le32_to_cpu(buf[2]);
1125
1126 rc = symtab_init(&cladatum->permissions, PERM_SYMTAB_SIZE);
1127 if (rc)
1128 goto bad;
1129 cladatum->permissions.nprim = le32_to_cpu(buf[3]);
1130 nel = le32_to_cpu(buf[4]);
1131
1132 ncons = le32_to_cpu(buf[5]);
1133
1134 key = kmalloc(len + 1, GFP_KERNEL);
1135 if (!key) {
1136 rc = -ENOMEM;
1137 goto bad;
1138 }
1139 rc = next_entry(key, fp, len);
1140 if (rc < 0)
1141 goto bad;
1142 key[len] = '\0';
1143
1144 if (len2) {
1145 cladatum->comkey = kmalloc(len2 + 1, GFP_KERNEL);
1146 if (!cladatum->comkey) {
1147 rc = -ENOMEM;
1148 goto bad;
1149 }
1150 rc = next_entry(cladatum->comkey, fp, len2);
1151 if (rc < 0)
1152 goto bad;
1153 cladatum->comkey[len2] = '\0';
1154
1155 cladatum->comdatum = hashtab_search(p->p_commons.table,
1156 cladatum->comkey);
1157 if (!cladatum->comdatum) {
1158 printk(KERN_ERR "SELinux: unknown common %s\n",
1159 cladatum->comkey);
1160 rc = -EINVAL;
1161 goto bad;
1162 }
1163 }
1164 for (i = 0; i < nel; i++) {
1165 rc = perm_read(p, cladatum->permissions.table, fp);
1166 if (rc)
1167 goto bad;
1168 }
1169
1170 rc = read_cons_helper(&cladatum->constraints, ncons, 0, fp);
1171 if (rc)
1172 goto bad;
1173
1174 if (p->policyvers >= POLICYDB_VERSION_VALIDATETRANS) {
1175 /* grab the validatetrans rules */
1176 rc = next_entry(buf, fp, sizeof(u32));
1177 if (rc < 0)
1178 goto bad;
1179 ncons = le32_to_cpu(buf[0]);
1180 rc = read_cons_helper(&cladatum->validatetrans, ncons, 1, fp);
1181 if (rc)
1182 goto bad;
1183 }
1184
1185 rc = hashtab_insert(h, key, cladatum);
1186 if (rc)
1187 goto bad;
1188
1189 rc = 0;
1190 out:
1191 return rc;
1192 bad:
1193 cls_destroy(key, cladatum, NULL);
1194 goto out;
1195 }
1196
1197 static int role_read(struct policydb *p, struct hashtab *h, void *fp)
1198 {
1199 char *key = NULL;
1200 struct role_datum *role;
1201 int rc, to_read = 2;
1202 __le32 buf[3];
1203 u32 len;
1204
1205 role = kzalloc(sizeof(*role), GFP_KERNEL);
1206 if (!role) {
1207 rc = -ENOMEM;
1208 goto out;
1209 }
1210
1211 if (p->policyvers >= POLICYDB_VERSION_BOUNDARY)
1212 to_read = 3;
1213
1214 rc = next_entry(buf, fp, sizeof(buf[0]) * to_read);
1215 if (rc < 0)
1216 goto bad;
1217
1218 len = le32_to_cpu(buf[0]);
1219 role->value = le32_to_cpu(buf[1]);
1220 if (p->policyvers >= POLICYDB_VERSION_BOUNDARY)
1221 role->bounds = le32_to_cpu(buf[2]);
1222
1223 key = kmalloc(len + 1, GFP_KERNEL);
1224 if (!key) {
1225 rc = -ENOMEM;
1226 goto bad;
1227 }
1228 rc = next_entry(key, fp, len);
1229 if (rc < 0)
1230 goto bad;
1231 key[len] = '\0';
1232
1233 rc = ebitmap_read(&role->dominates, fp);
1234 if (rc)
1235 goto bad;
1236
1237 rc = ebitmap_read(&role->types, fp);
1238 if (rc)
1239 goto bad;
1240
1241 if (strcmp(key, OBJECT_R) == 0) {
1242 if (role->value != OBJECT_R_VAL) {
1243 printk(KERN_ERR "SELinux: Role %s has wrong value %d\n",
1244 OBJECT_R, role->value);
1245 rc = -EINVAL;
1246 goto bad;
1247 }
1248 rc = 0;
1249 goto bad;
1250 }
1251
1252 rc = hashtab_insert(h, key, role);
1253 if (rc)
1254 goto bad;
1255 out:
1256 return rc;
1257 bad:
1258 role_destroy(key, role, NULL);
1259 goto out;
1260 }
1261
1262 static int type_read(struct policydb *p, struct hashtab *h, void *fp)
1263 {
1264 char *key = NULL;
1265 struct type_datum *typdatum;
1266 int rc, to_read = 3;
1267 __le32 buf[4];
1268 u32 len;
1269
1270 typdatum = kzalloc(sizeof(*typdatum), GFP_KERNEL);
1271 if (!typdatum) {
1272 rc = -ENOMEM;
1273 return rc;
1274 }
1275
1276 if (p->policyvers >= POLICYDB_VERSION_BOUNDARY)
1277 to_read = 4;
1278
1279 rc = next_entry(buf, fp, sizeof(buf[0]) * to_read);
1280 if (rc < 0)
1281 goto bad;
1282
1283 len = le32_to_cpu(buf[0]);
1284 typdatum->value = le32_to_cpu(buf[1]);
1285 if (p->policyvers >= POLICYDB_VERSION_BOUNDARY) {
1286 u32 prop = le32_to_cpu(buf[2]);
1287
1288 if (prop & TYPEDATUM_PROPERTY_PRIMARY)
1289 typdatum->primary = 1;
1290 if (prop & TYPEDATUM_PROPERTY_ATTRIBUTE)
1291 typdatum->attribute = 1;
1292
1293 typdatum->bounds = le32_to_cpu(buf[3]);
1294 } else {
1295 typdatum->primary = le32_to_cpu(buf[2]);
1296 }
1297
1298 key = kmalloc(len + 1, GFP_KERNEL);
1299 if (!key) {
1300 rc = -ENOMEM;
1301 goto bad;
1302 }
1303 rc = next_entry(key, fp, len);
1304 if (rc < 0)
1305 goto bad;
1306 key[len] = '\0';
1307
1308 rc = hashtab_insert(h, key, typdatum);
1309 if (rc)
1310 goto bad;
1311 out:
1312 return rc;
1313 bad:
1314 type_destroy(key, typdatum, NULL);
1315 goto out;
1316 }
1317
1318
1319 /*
1320 * Read a MLS level structure from a policydb binary
1321 * representation file.
1322 */
1323 static int mls_read_level(struct mls_level *lp, void *fp)
1324 {
1325 __le32 buf[1];
1326 int rc;
1327
1328 memset(lp, 0, sizeof(*lp));
1329
1330 rc = next_entry(buf, fp, sizeof buf);
1331 if (rc < 0) {
1332 printk(KERN_ERR "SELinux: mls: truncated level\n");
1333 goto bad;
1334 }
1335 lp->sens = le32_to_cpu(buf[0]);
1336
1337 if (ebitmap_read(&lp->cat, fp)) {
1338 printk(KERN_ERR "SELinux: mls: error reading level "
1339 "categories\n");
1340 goto bad;
1341 }
1342
1343 return 0;
1344
1345 bad:
1346 return -EINVAL;
1347 }
1348
1349 static int user_read(struct policydb *p, struct hashtab *h, void *fp)
1350 {
1351 char *key = NULL;
1352 struct user_datum *usrdatum;
1353 int rc, to_read = 2;
1354 __le32 buf[3];
1355 u32 len;
1356
1357 usrdatum = kzalloc(sizeof(*usrdatum), GFP_KERNEL);
1358 if (!usrdatum) {
1359 rc = -ENOMEM;
1360 goto out;
1361 }
1362
1363 if (p->policyvers >= POLICYDB_VERSION_BOUNDARY)
1364 to_read = 3;
1365
1366 rc = next_entry(buf, fp, sizeof(buf[0]) * to_read);
1367 if (rc < 0)
1368 goto bad;
1369
1370 len = le32_to_cpu(buf[0]);
1371 usrdatum->value = le32_to_cpu(buf[1]);
1372 if (p->policyvers >= POLICYDB_VERSION_BOUNDARY)
1373 usrdatum->bounds = le32_to_cpu(buf[2]);
1374
1375 key = kmalloc(len + 1, GFP_KERNEL);
1376 if (!key) {
1377 rc = -ENOMEM;
1378 goto bad;
1379 }
1380 rc = next_entry(key, fp, len);
1381 if (rc < 0)
1382 goto bad;
1383 key[len] = '\0';
1384
1385 rc = ebitmap_read(&usrdatum->roles, fp);
1386 if (rc)
1387 goto bad;
1388
1389 if (p->policyvers >= POLICYDB_VERSION_MLS) {
1390 rc = mls_read_range_helper(&usrdatum->range, fp);
1391 if (rc)
1392 goto bad;
1393 rc = mls_read_level(&usrdatum->dfltlevel, fp);
1394 if (rc)
1395 goto bad;
1396 }
1397
1398 rc = hashtab_insert(h, key, usrdatum);
1399 if (rc)
1400 goto bad;
1401 out:
1402 return rc;
1403 bad:
1404 user_destroy(key, usrdatum, NULL);
1405 goto out;
1406 }
1407
1408 static int sens_read(struct policydb *p, struct hashtab *h, void *fp)
1409 {
1410 char *key = NULL;
1411 struct level_datum *levdatum;
1412 int rc;
1413 __le32 buf[2];
1414 u32 len;
1415
1416 levdatum = kzalloc(sizeof(*levdatum), GFP_ATOMIC);
1417 if (!levdatum) {
1418 rc = -ENOMEM;
1419 goto out;
1420 }
1421
1422 rc = next_entry(buf, fp, sizeof buf);
1423 if (rc < 0)
1424 goto bad;
1425
1426 len = le32_to_cpu(buf[0]);
1427 levdatum->isalias = le32_to_cpu(buf[1]);
1428
1429 key = kmalloc(len + 1, GFP_ATOMIC);
1430 if (!key) {
1431 rc = -ENOMEM;
1432 goto bad;
1433 }
1434 rc = next_entry(key, fp, len);
1435 if (rc < 0)
1436 goto bad;
1437 key[len] = '\0';
1438
1439 levdatum->level = kmalloc(sizeof(struct mls_level), GFP_ATOMIC);
1440 if (!levdatum->level) {
1441 rc = -ENOMEM;
1442 goto bad;
1443 }
1444 if (mls_read_level(levdatum->level, fp)) {
1445 rc = -EINVAL;
1446 goto bad;
1447 }
1448
1449 rc = hashtab_insert(h, key, levdatum);
1450 if (rc)
1451 goto bad;
1452 out:
1453 return rc;
1454 bad:
1455 sens_destroy(key, levdatum, NULL);
1456 goto out;
1457 }
1458
1459 static int cat_read(struct policydb *p, struct hashtab *h, void *fp)
1460 {
1461 char *key = NULL;
1462 struct cat_datum *catdatum;
1463 int rc;
1464 __le32 buf[3];
1465 u32 len;
1466
1467 catdatum = kzalloc(sizeof(*catdatum), GFP_ATOMIC);
1468 if (!catdatum) {
1469 rc = -ENOMEM;
1470 goto out;
1471 }
1472
1473 rc = next_entry(buf, fp, sizeof buf);
1474 if (rc < 0)
1475 goto bad;
1476
1477 len = le32_to_cpu(buf[0]);
1478 catdatum->value = le32_to_cpu(buf[1]);
1479 catdatum->isalias = le32_to_cpu(buf[2]);
1480
1481 key = kmalloc(len + 1, GFP_ATOMIC);
1482 if (!key) {
1483 rc = -ENOMEM;
1484 goto bad;
1485 }
1486 rc = next_entry(key, fp, len);
1487 if (rc < 0)
1488 goto bad;
1489 key[len] = '\0';
1490
1491 rc = hashtab_insert(h, key, catdatum);
1492 if (rc)
1493 goto bad;
1494 out:
1495 return rc;
1496
1497 bad:
1498 cat_destroy(key, catdatum, NULL);
1499 goto out;
1500 }
1501
1502 static int (*read_f[SYM_NUM]) (struct policydb *p, struct hashtab *h, void *fp) =
1503 {
1504 common_read,
1505 class_read,
1506 role_read,
1507 type_read,
1508 user_read,
1509 cond_read_bool,
1510 sens_read,
1511 cat_read,
1512 };
1513
1514 static int user_bounds_sanity_check(void *key, void *datum, void *datap)
1515 {
1516 struct user_datum *upper, *user;
1517 struct policydb *p = datap;
1518 int depth = 0;
1519
1520 upper = user = datum;
1521 while (upper->bounds) {
1522 struct ebitmap_node *node;
1523 unsigned long bit;
1524
1525 if (++depth == POLICYDB_BOUNDS_MAXDEPTH) {
1526 printk(KERN_ERR "SELinux: user %s: "
1527 "too deep or looped boundary",
1528 (char *) key);
1529 return -EINVAL;
1530 }
1531
1532 upper = p->user_val_to_struct[upper->bounds - 1];
1533 ebitmap_for_each_positive_bit(&user->roles, node, bit) {
1534 if (ebitmap_get_bit(&upper->roles, bit))
1535 continue;
1536
1537 printk(KERN_ERR
1538 "SELinux: boundary violated policy: "
1539 "user=%s role=%s bounds=%s\n",
1540 p->p_user_val_to_name[user->value - 1],
1541 p->p_role_val_to_name[bit],
1542 p->p_user_val_to_name[upper->value - 1]);
1543
1544 return -EINVAL;
1545 }
1546 }
1547
1548 return 0;
1549 }
1550
1551 static int role_bounds_sanity_check(void *key, void *datum, void *datap)
1552 {
1553 struct role_datum *upper, *role;
1554 struct policydb *p = datap;
1555 int depth = 0;
1556
1557 upper = role = datum;
1558 while (upper->bounds) {
1559 struct ebitmap_node *node;
1560 unsigned long bit;
1561
1562 if (++depth == POLICYDB_BOUNDS_MAXDEPTH) {
1563 printk(KERN_ERR "SELinux: role %s: "
1564 "too deep or looped bounds\n",
1565 (char *) key);
1566 return -EINVAL;
1567 }
1568
1569 upper = p->role_val_to_struct[upper->bounds - 1];
1570 ebitmap_for_each_positive_bit(&role->types, node, bit) {
1571 if (ebitmap_get_bit(&upper->types, bit))
1572 continue;
1573
1574 printk(KERN_ERR
1575 "SELinux: boundary violated policy: "
1576 "role=%s type=%s bounds=%s\n",
1577 p->p_role_val_to_name[role->value - 1],
1578 p->p_type_val_to_name[bit],
1579 p->p_role_val_to_name[upper->value - 1]);
1580
1581 return -EINVAL;
1582 }
1583 }
1584
1585 return 0;
1586 }
1587
1588 static int type_bounds_sanity_check(void *key, void *datum, void *datap)
1589 {
1590 struct type_datum *upper, *type;
1591 struct policydb *p = datap;
1592 int depth = 0;
1593
1594 upper = type = datum;
1595 while (upper->bounds) {
1596 if (++depth == POLICYDB_BOUNDS_MAXDEPTH) {
1597 printk(KERN_ERR "SELinux: type %s: "
1598 "too deep or looped boundary\n",
1599 (char *) key);
1600 return -EINVAL;
1601 }
1602
1603 upper = p->type_val_to_struct[upper->bounds - 1];
1604 if (upper->attribute) {
1605 printk(KERN_ERR "SELinux: type %s: "
1606 "bounded by attribute %s",
1607 (char *) key,
1608 p->p_type_val_to_name[upper->value - 1]);
1609 return -EINVAL;
1610 }
1611 }
1612
1613 return 0;
1614 }
1615
1616 static int policydb_bounds_sanity_check(struct policydb *p)
1617 {
1618 int rc;
1619
1620 if (p->policyvers < POLICYDB_VERSION_BOUNDARY)
1621 return 0;
1622
1623 rc = hashtab_map(p->p_users.table,
1624 user_bounds_sanity_check, p);
1625 if (rc)
1626 return rc;
1627
1628 rc = hashtab_map(p->p_roles.table,
1629 role_bounds_sanity_check, p);
1630 if (rc)
1631 return rc;
1632
1633 rc = hashtab_map(p->p_types.table,
1634 type_bounds_sanity_check, p);
1635 if (rc)
1636 return rc;
1637
1638 return 0;
1639 }
1640
1641 extern int ss_initialized;
1642
1643 /*
1644 * Read the configuration data from a policy database binary
1645 * representation file into a policy database structure.
1646 */
1647 int policydb_read(struct policydb *p, void *fp)
1648 {
1649 struct role_allow *ra, *lra;
1650 struct role_trans *tr, *ltr;
1651 struct ocontext *l, *c, *newc;
1652 struct genfs *genfs_p, *genfs, *newgenfs;
1653 int i, j, rc;
1654 __le32 buf[4];
1655 u32 nodebuf[8];
1656 u32 len, len2, config, nprim, nel, nel2;
1657 char *policydb_str;
1658 struct policydb_compat_info *info;
1659 struct range_trans *rt, *lrt;
1660
1661 config = 0;
1662
1663 rc = policydb_init(p);
1664 if (rc)
1665 goto out;
1666
1667 /* Read the magic number and string length. */
1668 rc = next_entry(buf, fp, sizeof(u32) * 2);
1669 if (rc < 0)
1670 goto bad;
1671
1672 if (le32_to_cpu(buf[0]) != POLICYDB_MAGIC) {
1673 printk(KERN_ERR "SELinux: policydb magic number 0x%x does "
1674 "not match expected magic number 0x%x\n",
1675 le32_to_cpu(buf[0]), POLICYDB_MAGIC);
1676 goto bad;
1677 }
1678
1679 len = le32_to_cpu(buf[1]);
1680 if (len != strlen(POLICYDB_STRING)) {
1681 printk(KERN_ERR "SELinux: policydb string length %d does not "
1682 "match expected length %Zu\n",
1683 len, strlen(POLICYDB_STRING));
1684 goto bad;
1685 }
1686 policydb_str = kmalloc(len + 1, GFP_KERNEL);
1687 if (!policydb_str) {
1688 printk(KERN_ERR "SELinux: unable to allocate memory for policydb "
1689 "string of length %d\n", len);
1690 rc = -ENOMEM;
1691 goto bad;
1692 }
1693 rc = next_entry(policydb_str, fp, len);
1694 if (rc < 0) {
1695 printk(KERN_ERR "SELinux: truncated policydb string identifier\n");
1696 kfree(policydb_str);
1697 goto bad;
1698 }
1699 policydb_str[len] = '\0';
1700 if (strcmp(policydb_str, POLICYDB_STRING)) {
1701 printk(KERN_ERR "SELinux: policydb string %s does not match "
1702 "my string %s\n", policydb_str, POLICYDB_STRING);
1703 kfree(policydb_str);
1704 goto bad;
1705 }
1706 /* Done with policydb_str. */
1707 kfree(policydb_str);
1708 policydb_str = NULL;
1709
1710 /* Read the version, config, and table sizes. */
1711 rc = next_entry(buf, fp, sizeof(u32)*4);
1712 if (rc < 0)
1713 goto bad;
1714
1715 p->policyvers = le32_to_cpu(buf[0]);
1716 if (p->policyvers < POLICYDB_VERSION_MIN ||
1717 p->policyvers > POLICYDB_VERSION_MAX) {
1718 printk(KERN_ERR "SELinux: policydb version %d does not match "
1719 "my version range %d-%d\n",
1720 le32_to_cpu(buf[0]), POLICYDB_VERSION_MIN, POLICYDB_VERSION_MAX);
1721 goto bad;
1722 }
1723
1724 if ((le32_to_cpu(buf[1]) & POLICYDB_CONFIG_MLS)) {
1725 if (ss_initialized && !selinux_mls_enabled) {
1726 printk(KERN_ERR "SELinux: Cannot switch between non-MLS"
1727 " and MLS policies\n");
1728 goto bad;
1729 }
1730 selinux_mls_enabled = 1;
1731 config |= POLICYDB_CONFIG_MLS;
1732
1733 if (p->policyvers < POLICYDB_VERSION_MLS) {
1734 printk(KERN_ERR "SELinux: security policydb version %d "
1735 "(MLS) not backwards compatible\n",
1736 p->policyvers);
1737 goto bad;
1738 }
1739 } else {
1740 if (ss_initialized && selinux_mls_enabled) {
1741 printk(KERN_ERR "SELinux: Cannot switch between MLS and"
1742 " non-MLS policies\n");
1743 goto bad;
1744 }
1745 }
1746 p->reject_unknown = !!(le32_to_cpu(buf[1]) & REJECT_UNKNOWN);
1747 p->allow_unknown = !!(le32_to_cpu(buf[1]) & ALLOW_UNKNOWN);
1748
1749 if (p->policyvers >= POLICYDB_VERSION_POLCAP &&
1750 ebitmap_read(&p->policycaps, fp) != 0)
1751 goto bad;
1752
1753 if (p->policyvers >= POLICYDB_VERSION_PERMISSIVE &&
1754 ebitmap_read(&p->permissive_map, fp) != 0)
1755 goto bad;
1756
1757 info = policydb_lookup_compat(p->policyvers);
1758 if (!info) {
1759 printk(KERN_ERR "SELinux: unable to find policy compat info "
1760 "for version %d\n", p->policyvers);
1761 goto bad;
1762 }
1763
1764 if (le32_to_cpu(buf[2]) != info->sym_num ||
1765 le32_to_cpu(buf[3]) != info->ocon_num) {
1766 printk(KERN_ERR "SELinux: policydb table sizes (%d,%d) do "
1767 "not match mine (%d,%d)\n", le32_to_cpu(buf[2]),
1768 le32_to_cpu(buf[3]),
1769 info->sym_num, info->ocon_num);
1770 goto bad;
1771 }
1772
1773 for (i = 0; i < info->sym_num; i++) {
1774 rc = next_entry(buf, fp, sizeof(u32)*2);
1775 if (rc < 0)
1776 goto bad;
1777 nprim = le32_to_cpu(buf[0]);
1778 nel = le32_to_cpu(buf[1]);
1779 for (j = 0; j < nel; j++) {
1780 rc = read_f[i](p, p->symtab[i].table, fp);
1781 if (rc)
1782 goto bad;
1783 }
1784
1785 p->symtab[i].nprim = nprim;
1786 }
1787
1788 rc = avtab_read(&p->te_avtab, fp, p);
1789 if (rc)
1790 goto bad;
1791
1792 if (p->policyvers >= POLICYDB_VERSION_BOOL) {
1793 rc = cond_read_list(p, fp);
1794 if (rc)
1795 goto bad;
1796 }
1797
1798 rc = next_entry(buf, fp, sizeof(u32));
1799 if (rc < 0)
1800 goto bad;
1801 nel = le32_to_cpu(buf[0]);
1802 ltr = NULL;
1803 for (i = 0; i < nel; i++) {
1804 tr = kzalloc(sizeof(*tr), GFP_KERNEL);
1805 if (!tr) {
1806 rc = -ENOMEM;
1807 goto bad;
1808 }
1809 if (ltr)
1810 ltr->next = tr;
1811 else
1812 p->role_tr = tr;
1813 rc = next_entry(buf, fp, sizeof(u32)*3);
1814 if (rc < 0)
1815 goto bad;
1816 tr->role = le32_to_cpu(buf[0]);
1817 tr->type = le32_to_cpu(buf[1]);
1818 tr->new_role = le32_to_cpu(buf[2]);
1819 if (!policydb_role_isvalid(p, tr->role) ||
1820 !policydb_type_isvalid(p, tr->type) ||
1821 !policydb_role_isvalid(p, tr->new_role)) {
1822 rc = -EINVAL;
1823 goto bad;
1824 }
1825 ltr = tr;
1826 }
1827
1828 rc = next_entry(buf, fp, sizeof(u32));
1829 if (rc < 0)
1830 goto bad;
1831 nel = le32_to_cpu(buf[0]);
1832 lra = NULL;
1833 for (i = 0; i < nel; i++) {
1834 ra = kzalloc(sizeof(*ra), GFP_KERNEL);
1835 if (!ra) {
1836 rc = -ENOMEM;
1837 goto bad;
1838 }
1839 if (lra)
1840 lra->next = ra;
1841 else
1842 p->role_allow = ra;
1843 rc = next_entry(buf, fp, sizeof(u32)*2);
1844 if (rc < 0)
1845 goto bad;
1846 ra->role = le32_to_cpu(buf[0]);
1847 ra->new_role = le32_to_cpu(buf[1]);
1848 if (!policydb_role_isvalid(p, ra->role) ||
1849 !policydb_role_isvalid(p, ra->new_role)) {
1850 rc = -EINVAL;
1851 goto bad;
1852 }
1853 lra = ra;
1854 }
1855
1856 rc = policydb_index_classes(p);
1857 if (rc)
1858 goto bad;
1859
1860 rc = policydb_index_others(p);
1861 if (rc)
1862 goto bad;
1863
1864 for (i = 0; i < info->ocon_num; i++) {
1865 rc = next_entry(buf, fp, sizeof(u32));
1866 if (rc < 0)
1867 goto bad;
1868 nel = le32_to_cpu(buf[0]);
1869 l = NULL;
1870 for (j = 0; j < nel; j++) {
1871 c = kzalloc(sizeof(*c), GFP_KERNEL);
1872 if (!c) {
1873 rc = -ENOMEM;
1874 goto bad;
1875 }
1876 if (l)
1877 l->next = c;
1878 else
1879 p->ocontexts[i] = c;
1880 l = c;
1881 rc = -EINVAL;
1882 switch (i) {
1883 case OCON_ISID:
1884 rc = next_entry(buf, fp, sizeof(u32));
1885 if (rc < 0)
1886 goto bad;
1887 c->sid[0] = le32_to_cpu(buf[0]);
1888 rc = context_read_and_validate(&c->context[0], p, fp);
1889 if (rc)
1890 goto bad;
1891 break;
1892 case OCON_FS:
1893 case OCON_NETIF:
1894 rc = next_entry(buf, fp, sizeof(u32));
1895 if (rc < 0)
1896 goto bad;
1897 len = le32_to_cpu(buf[0]);
1898 c->u.name = kmalloc(len + 1, GFP_KERNEL);
1899 if (!c->u.name) {
1900 rc = -ENOMEM;
1901 goto bad;
1902 }
1903 rc = next_entry(c->u.name, fp, len);
1904 if (rc < 0)
1905 goto bad;
1906 c->u.name[len] = 0;
1907 rc = context_read_and_validate(&c->context[0], p, fp);
1908 if (rc)
1909 goto bad;
1910 rc = context_read_and_validate(&c->context[1], p, fp);
1911 if (rc)
1912 goto bad;
1913 break;
1914 case OCON_PORT:
1915 rc = next_entry(buf, fp, sizeof(u32)*3);
1916 if (rc < 0)
1917 goto bad;
1918 c->u.port.protocol = le32_to_cpu(buf[0]);
1919 c->u.port.low_port = le32_to_cpu(buf[1]);
1920 c->u.port.high_port = le32_to_cpu(buf[2]);
1921 rc = context_read_and_validate(&c->context[0], p, fp);
1922 if (rc)
1923 goto bad;
1924 break;
1925 case OCON_NODE:
1926 rc = next_entry(nodebuf, fp, sizeof(u32) * 2);
1927 if (rc < 0)
1928 goto bad;
1929 c->u.node.addr = nodebuf[0]; /* network order */
1930 c->u.node.mask = nodebuf[1]; /* network order */
1931 rc = context_read_and_validate(&c->context[0], p, fp);
1932 if (rc)
1933 goto bad;
1934 break;
1935 case OCON_FSUSE:
1936 rc = next_entry(buf, fp, sizeof(u32)*2);
1937 if (rc < 0)
1938 goto bad;
1939 c->v.behavior = le32_to_cpu(buf[0]);
1940 if (c->v.behavior > SECURITY_FS_USE_NONE)
1941 goto bad;
1942 len = le32_to_cpu(buf[1]);
1943 c->u.name = kmalloc(len + 1, GFP_KERNEL);
1944 if (!c->u.name) {
1945 rc = -ENOMEM;
1946 goto bad;
1947 }
1948 rc = next_entry(c->u.name, fp, len);
1949 if (rc < 0)
1950 goto bad;
1951 c->u.name[len] = 0;
1952 rc = context_read_and_validate(&c->context[0], p, fp);
1953 if (rc)
1954 goto bad;
1955 break;
1956 case OCON_NODE6: {
1957 int k;
1958
1959 rc = next_entry(nodebuf, fp, sizeof(u32) * 8);
1960 if (rc < 0)
1961 goto bad;
1962 for (k = 0; k < 4; k++)
1963 c->u.node6.addr[k] = nodebuf[k];
1964 for (k = 0; k < 4; k++)
1965 c->u.node6.mask[k] = nodebuf[k+4];
1966 if (context_read_and_validate(&c->context[0], p, fp))
1967 goto bad;
1968 break;
1969 }
1970 }
1971 }
1972 }
1973
1974 rc = next_entry(buf, fp, sizeof(u32));
1975 if (rc < 0)
1976 goto bad;
1977 nel = le32_to_cpu(buf[0]);
1978 genfs_p = NULL;
1979 rc = -EINVAL;
1980 for (i = 0; i < nel; i++) {
1981 rc = next_entry(buf, fp, sizeof(u32));
1982 if (rc < 0)
1983 goto bad;
1984 len = le32_to_cpu(buf[0]);
1985 newgenfs = kzalloc(sizeof(*newgenfs), GFP_KERNEL);
1986 if (!newgenfs) {
1987 rc = -ENOMEM;
1988 goto bad;
1989 }
1990
1991 newgenfs->fstype = kmalloc(len + 1, GFP_KERNEL);
1992 if (!newgenfs->fstype) {
1993 rc = -ENOMEM;
1994 kfree(newgenfs);
1995 goto bad;
1996 }
1997 rc = next_entry(newgenfs->fstype, fp, len);
1998 if (rc < 0) {
1999 kfree(newgenfs->fstype);
2000 kfree(newgenfs);
2001 goto bad;
2002 }
2003 newgenfs->fstype[len] = 0;
2004 for (genfs_p = NULL, genfs = p->genfs; genfs;
2005 genfs_p = genfs, genfs = genfs->next) {
2006 if (strcmp(newgenfs->fstype, genfs->fstype) == 0) {
2007 printk(KERN_ERR "SELinux: dup genfs "
2008 "fstype %s\n", newgenfs->fstype);
2009 kfree(newgenfs->fstype);
2010 kfree(newgenfs);
2011 goto bad;
2012 }
2013 if (strcmp(newgenfs->fstype, genfs->fstype) < 0)
2014 break;
2015 }
2016 newgenfs->next = genfs;
2017 if (genfs_p)
2018 genfs_p->next = newgenfs;
2019 else
2020 p->genfs = newgenfs;
2021 rc = next_entry(buf, fp, sizeof(u32));
2022 if (rc < 0)
2023 goto bad;
2024 nel2 = le32_to_cpu(buf[0]);
2025 for (j = 0; j < nel2; j++) {
2026 rc = next_entry(buf, fp, sizeof(u32));
2027 if (rc < 0)
2028 goto bad;
2029 len = le32_to_cpu(buf[0]);
2030
2031 newc = kzalloc(sizeof(*newc), GFP_KERNEL);
2032 if (!newc) {
2033 rc = -ENOMEM;
2034 goto bad;
2035 }
2036
2037 newc->u.name = kmalloc(len + 1, GFP_KERNEL);
2038 if (!newc->u.name) {
2039 rc = -ENOMEM;
2040 goto bad_newc;
2041 }
2042 rc = next_entry(newc->u.name, fp, len);
2043 if (rc < 0)
2044 goto bad_newc;
2045 newc->u.name[len] = 0;
2046 rc = next_entry(buf, fp, sizeof(u32));
2047 if (rc < 0)
2048 goto bad_newc;
2049 newc->v.sclass = le32_to_cpu(buf[0]);
2050 if (context_read_and_validate(&newc->context[0], p, fp))
2051 goto bad_newc;
2052 for (l = NULL, c = newgenfs->head; c;
2053 l = c, c = c->next) {
2054 if (!strcmp(newc->u.name, c->u.name) &&
2055 (!c->v.sclass || !newc->v.sclass ||
2056 newc->v.sclass == c->v.sclass)) {
2057 printk(KERN_ERR "SELinux: dup genfs "
2058 "entry (%s,%s)\n",
2059 newgenfs->fstype, c->u.name);
2060 goto bad_newc;
2061 }
2062 len = strlen(newc->u.name);
2063 len2 = strlen(c->u.name);
2064 if (len > len2)
2065 break;
2066 }
2067
2068 newc->next = c;
2069 if (l)
2070 l->next = newc;
2071 else
2072 newgenfs->head = newc;
2073 }
2074 }
2075
2076 if (p->policyvers >= POLICYDB_VERSION_MLS) {
2077 int new_rangetr = p->policyvers >= POLICYDB_VERSION_RANGETRANS;
2078 rc = next_entry(buf, fp, sizeof(u32));
2079 if (rc < 0)
2080 goto bad;
2081 nel = le32_to_cpu(buf[0]);
2082 lrt = NULL;
2083 for (i = 0; i < nel; i++) {
2084 rt = kzalloc(sizeof(*rt), GFP_KERNEL);
2085 if (!rt) {
2086 rc = -ENOMEM;
2087 goto bad;
2088 }
2089 if (lrt)
2090 lrt->next = rt;
2091 else
2092 p->range_tr = rt;
2093 rc = next_entry(buf, fp, (sizeof(u32) * 2));
2094 if (rc < 0)
2095 goto bad;
2096 rt->source_type = le32_to_cpu(buf[0]);
2097 rt->target_type = le32_to_cpu(buf[1]);
2098 if (new_rangetr) {
2099 rc = next_entry(buf, fp, sizeof(u32));
2100 if (rc < 0)
2101 goto bad;
2102 rt->target_class = le32_to_cpu(buf[0]);
2103 } else
2104 rt->target_class = SECCLASS_PROCESS;
2105 if (!policydb_type_isvalid(p, rt->source_type) ||
2106 !policydb_type_isvalid(p, rt->target_type) ||
2107 !policydb_class_isvalid(p, rt->target_class)) {
2108 rc = -EINVAL;
2109 goto bad;
2110 }
2111 rc = mls_read_range_helper(&rt->target_range, fp);
2112 if (rc)
2113 goto bad;
2114 if (!mls_range_isvalid(p, &rt->target_range)) {
2115 printk(KERN_WARNING "SELinux: rangetrans: invalid range\n");
2116 goto bad;
2117 }
2118 lrt = rt;
2119 }
2120 }
2121
2122 p->type_attr_map = kmalloc(p->p_types.nprim*sizeof(struct ebitmap), GFP_KERNEL);
2123 if (!p->type_attr_map)
2124 goto bad;
2125
2126 for (i = 0; i < p->p_types.nprim; i++) {
2127 ebitmap_init(&p->type_attr_map[i]);
2128 if (p->policyvers >= POLICYDB_VERSION_AVTAB) {
2129 if (ebitmap_read(&p->type_attr_map[i], fp))
2130 goto bad;
2131 }
2132 /* add the type itself as the degenerate case */
2133 if (ebitmap_set_bit(&p->type_attr_map[i], i, 1))
2134 goto bad;
2135 }
2136
2137 rc = policydb_bounds_sanity_check(p);
2138 if (rc)
2139 goto bad;
2140
2141 rc = 0;
2142 out:
2143 return rc;
2144 bad_newc:
2145 ocontext_destroy(newc, OCON_FSUSE);
2146 bad:
2147 if (!rc)
2148 rc = -EINVAL;
2149 policydb_destroy(p);
2150 goto out;
2151 }
Nao low-level kernelspace/userspace library that runs on our robots, Nao-Team HTWK