2 * Implementation of the multi-level security (MLS) policy.
4 * Author : Stephen Smalley, <sds@epoch.ncsc.mil>
7 * Updated: Trusted Computer Solutions, Inc. <dgoeddel@trustedcs.com>
9 * Support for enhanced MLS infrastructure.
11 * Copyright (C) 2004-2006 Trusted Computer Solutions, Inc.
14 * Updated: Hewlett-Packard <paul.moore@hp.com>
16 * Added support to import/export the MLS label from NetLabel
18 * (c) Copyright Hewlett-Packard Development Company, L.P., 2006
21 #include <linux/kernel.h>
22 #include <linux/slab.h>
23 #include <linux/string.h>
24 #include <linux/errno.h>
25 #include <net/netlabel.h>
32 * Return the length in bytes for the MLS fields of the
33 * security context string representation of `context'.
35 int mls_compute_context_len(struct context
* context
)
37 int i
, l
, len
, head
, prev
;
40 struct ebitmap_node
*node
;
42 if (!selinux_mls_enabled
)
45 len
= 1; /* for the beginning ":" */
46 for (l
= 0; l
< 2; l
++) {
47 int index_sens
= context
->range
.level
[l
].sens
;
48 len
+= strlen(policydb
.p_sens_val_to_name
[index_sens
- 1]);
53 e
= &context
->range
.level
[l
].cat
;
54 ebitmap_for_each_positive_bit(e
, node
, i
) {
56 /* one or more negative bits are skipped */
58 nm
= policydb
.p_cat_val_to_name
[prev
];
59 len
+= strlen(nm
) + 1;
61 nm
= policydb
.p_cat_val_to_name
[i
];
62 len
+= strlen(nm
) + 1;
68 nm
= policydb
.p_cat_val_to_name
[prev
];
69 len
+= strlen(nm
) + 1;
72 if (mls_level_eq(&context
->range
.level
[0],
73 &context
->range
.level
[1]))
84 * Write the security context string representation of
85 * the MLS fields of `context' into the string `*scontext'.
86 * Update `*scontext' to point to the end of the MLS fields.
88 void mls_sid_to_context(struct context
*context
,
94 struct ebitmap_node
*node
;
96 if (!selinux_mls_enabled
)
99 scontextp
= *scontext
;
104 for (l
= 0; l
< 2; l
++) {
106 policydb
.p_sens_val_to_name
[context
->range
.level
[l
].sens
- 1]);
107 scontextp
+= strlen(scontextp
);
112 e
= &context
->range
.level
[l
].cat
;
113 ebitmap_for_each_positive_bit(e
, node
, i
) {
115 /* one or more negative bits are skipped */
121 nm
= policydb
.p_cat_val_to_name
[prev
];
122 strcpy(scontextp
, nm
);
123 scontextp
+= strlen(nm
);
129 nm
= policydb
.p_cat_val_to_name
[i
];
130 strcpy(scontextp
, nm
);
131 scontextp
+= strlen(nm
);
142 nm
= policydb
.p_cat_val_to_name
[prev
];
143 strcpy(scontextp
, nm
);
144 scontextp
+= strlen(nm
);
148 if (mls_level_eq(&context
->range
.level
[0],
149 &context
->range
.level
[1]))
156 *scontext
= scontextp
;
161 * Return 1 if the MLS fields in the security context
162 * structure `c' are valid. Return 0 otherwise.
164 int mls_context_isvalid(struct policydb
*p
, struct context
*c
)
166 struct level_datum
*levdatum
;
167 struct user_datum
*usrdatum
;
168 struct ebitmap_node
*node
;
171 if (!selinux_mls_enabled
)
175 * MLS range validity checks: high must dominate low, low level must
176 * be valid (category set <-> sensitivity check), and high level must
177 * be valid (category set <-> sensitivity check)
179 if (!mls_level_dom(&c
->range
.level
[1], &c
->range
.level
[0]))
180 /* High does not dominate low. */
183 for (l
= 0; l
< 2; l
++) {
184 if (!c
->range
.level
[l
].sens
|| c
->range
.level
[l
].sens
> p
->p_levels
.nprim
)
186 levdatum
= hashtab_search(p
->p_levels
.table
,
187 p
->p_sens_val_to_name
[c
->range
.level
[l
].sens
- 1]);
191 ebitmap_for_each_positive_bit(&c
->range
.level
[l
].cat
, node
, i
) {
192 if (i
> p
->p_cats
.nprim
)
194 if (!ebitmap_get_bit(&levdatum
->level
->cat
, i
))
196 * Category may not be associated with
197 * sensitivity in low level.
203 if (c
->role
== OBJECT_R_VAL
)
207 * User must be authorized for the MLS range.
209 if (!c
->user
|| c
->user
> p
->p_users
.nprim
)
211 usrdatum
= p
->user_val_to_struct
[c
->user
- 1];
212 if (!mls_range_contains(usrdatum
->range
, c
->range
))
213 return 0; /* user may not be associated with range */
219 * Set the MLS fields in the security context structure
220 * `context' based on the string representation in
221 * the string `*scontext'. Update `*scontext' to
222 * point to the end of the string representation of
225 * This function modifies the string in place, inserting
226 * NULL characters to terminate the MLS fields.
228 * If a def_sid is provided and no MLS field is present,
229 * copy the MLS field of the associated default context.
230 * Used for upgraded to MLS systems where objects may lack
233 * Policy read-lock must be held for sidtab lookup.
236 int mls_context_to_sid(char oldc
,
238 struct context
*context
,
244 char *scontextp
, *p
, *rngptr
;
245 struct level_datum
*levdatum
;
246 struct cat_datum
*catdatum
, *rngdatum
;
249 if (!selinux_mls_enabled
) {
250 if (def_sid
!= SECSID_NULL
&& oldc
)
251 *scontext
+= strlen(*scontext
)+1;
256 * No MLS component to the security context, try and map to
257 * default if provided.
260 struct context
*defcon
;
262 if (def_sid
== SECSID_NULL
)
265 defcon
= sidtab_search(s
, def_sid
);
269 rc
= mls_context_cpy(context
, defcon
);
273 /* Extract low sensitivity. */
274 scontextp
= p
= *scontext
;
275 while (*p
&& *p
!= ':' && *p
!= '-')
282 for (l
= 0; l
< 2; l
++) {
283 levdatum
= hashtab_search(policydb
.p_levels
.table
, scontextp
);
289 context
->range
.level
[l
].sens
= levdatum
->level
->sens
;
292 /* Extract category set. */
295 while (*p
&& *p
!= ',' && *p
!= '-')
301 /* Separate into range if exists */
302 if ((rngptr
= strchr(scontextp
, '.')) != NULL
) {
307 catdatum
= hashtab_search(policydb
.p_cats
.table
,
314 rc
= ebitmap_set_bit(&context
->range
.level
[l
].cat
,
315 catdatum
->value
- 1, 1);
319 /* If range, set all categories in range */
323 rngdatum
= hashtab_search(policydb
.p_cats
.table
, rngptr
);
329 if (catdatum
->value
>= rngdatum
->value
) {
334 for (i
= catdatum
->value
; i
< rngdatum
->value
; i
++) {
335 rc
= ebitmap_set_bit(&context
->range
.level
[l
].cat
, i
, 1);
346 /* Extract high sensitivity. */
348 while (*p
&& *p
!= ':')
359 context
->range
.level
[1].sens
= context
->range
.level
[0].sens
;
360 rc
= ebitmap_cpy(&context
->range
.level
[1].cat
,
361 &context
->range
.level
[0].cat
);
372 * Set the MLS fields in the security context structure
373 * `context' based on the string representation in
374 * the string `str'. This function will allocate temporary memory with the
375 * given constraints of gfp_mask.
377 int mls_from_string(char *str
, struct context
*context
, gfp_t gfp_mask
)
379 char *tmpstr
, *freestr
;
382 if (!selinux_mls_enabled
)
385 /* we need freestr because mls_context_to_sid will change
386 the value of tmpstr */
387 tmpstr
= freestr
= kstrdup(str
, gfp_mask
);
391 rc
= mls_context_to_sid(':', &tmpstr
, context
,
400 * Copies the MLS range `range' into `context'.
402 static inline int mls_range_set(struct context
*context
,
403 struct mls_range
*range
)
407 /* Copy the MLS range into the context */
408 for (l
= 0; l
< 2; l
++) {
409 context
->range
.level
[l
].sens
= range
->level
[l
].sens
;
410 rc
= ebitmap_cpy(&context
->range
.level
[l
].cat
,
411 &range
->level
[l
].cat
);
419 int mls_setup_user_range(struct context
*fromcon
, struct user_datum
*user
,
420 struct context
*usercon
)
422 if (selinux_mls_enabled
) {
423 struct mls_level
*fromcon_sen
= &(fromcon
->range
.level
[0]);
424 struct mls_level
*fromcon_clr
= &(fromcon
->range
.level
[1]);
425 struct mls_level
*user_low
= &(user
->range
.level
[0]);
426 struct mls_level
*user_clr
= &(user
->range
.level
[1]);
427 struct mls_level
*user_def
= &(user
->dfltlevel
);
428 struct mls_level
*usercon_sen
= &(usercon
->range
.level
[0]);
429 struct mls_level
*usercon_clr
= &(usercon
->range
.level
[1]);
431 /* Honor the user's default level if we can */
432 if (mls_level_between(user_def
, fromcon_sen
, fromcon_clr
)) {
433 *usercon_sen
= *user_def
;
434 } else if (mls_level_between(fromcon_sen
, user_def
, user_clr
)) {
435 *usercon_sen
= *fromcon_sen
;
436 } else if (mls_level_between(fromcon_clr
, user_low
, user_def
)) {
437 *usercon_sen
= *user_low
;
441 /* Lower the clearance of available contexts
442 if the clearance of "fromcon" is lower than
443 that of the user's default clearance (but
444 only if the "fromcon" clearance dominates
445 the user's computed sensitivity level) */
446 if (mls_level_dom(user_clr
, fromcon_clr
)) {
447 *usercon_clr
= *fromcon_clr
;
448 } else if (mls_level_dom(fromcon_clr
, user_clr
)) {
449 *usercon_clr
= *user_clr
;
458 * Convert the MLS fields in the security context
459 * structure `c' from the values specified in the
460 * policy `oldp' to the values specified in the policy `newp'.
462 int mls_convert_context(struct policydb
*oldp
,
463 struct policydb
*newp
,
466 struct level_datum
*levdatum
;
467 struct cat_datum
*catdatum
;
468 struct ebitmap bitmap
;
469 struct ebitmap_node
*node
;
472 if (!selinux_mls_enabled
)
475 for (l
= 0; l
< 2; l
++) {
476 levdatum
= hashtab_search(newp
->p_levels
.table
,
477 oldp
->p_sens_val_to_name
[c
->range
.level
[l
].sens
- 1]);
481 c
->range
.level
[l
].sens
= levdatum
->level
->sens
;
483 ebitmap_init(&bitmap
);
484 ebitmap_for_each_positive_bit(&c
->range
.level
[l
].cat
, node
, i
) {
487 catdatum
= hashtab_search(newp
->p_cats
.table
,
488 oldp
->p_cat_val_to_name
[i
]);
491 rc
= ebitmap_set_bit(&bitmap
, catdatum
->value
- 1, 1);
495 ebitmap_destroy(&c
->range
.level
[l
].cat
);
496 c
->range
.level
[l
].cat
= bitmap
;
502 int mls_compute_sid(struct context
*scontext
,
503 struct context
*tcontext
,
506 struct context
*newcontext
)
508 struct range_trans
*rtr
;
510 if (!selinux_mls_enabled
)
514 case AVTAB_TRANSITION
:
515 /* Look for a range transition rule. */
516 for (rtr
= policydb
.range_tr
; rtr
; rtr
= rtr
->next
) {
517 if (rtr
->source_type
== scontext
->type
&&
518 rtr
->target_type
== tcontext
->type
&&
519 rtr
->target_class
== tclass
) {
520 /* Set the range from the rule */
521 return mls_range_set(newcontext
,
527 if (tclass
== SECCLASS_PROCESS
)
528 /* Use the process MLS attributes. */
529 return mls_context_cpy(newcontext
, scontext
);
531 /* Use the process effective MLS attributes. */
532 return mls_context_cpy_low(newcontext
, scontext
);
534 /* Only polyinstantiate the MLS attributes if
535 the type is being polyinstantiated */
536 if (newcontext
->type
!= tcontext
->type
) {
537 /* Use the process effective MLS attributes. */
538 return mls_context_cpy_low(newcontext
, scontext
);
540 /* Use the related object MLS attributes. */
541 return mls_context_cpy(newcontext
, tcontext
);
549 #ifdef CONFIG_NETLABEL
551 * mls_export_netlbl_lvl - Export the MLS sensitivity levels to NetLabel
552 * @context: the security context
553 * @secattr: the NetLabel security attributes
556 * Given the security context copy the low MLS sensitivity level into the
557 * NetLabel MLS sensitivity level field.
560 void mls_export_netlbl_lvl(struct context
*context
,
561 struct netlbl_lsm_secattr
*secattr
)
563 if (!selinux_mls_enabled
)
566 secattr
->mls_lvl
= context
->range
.level
[0].sens
- 1;
567 secattr
->flags
|= NETLBL_SECATTR_MLS_LVL
;
571 * mls_import_netlbl_lvl - Import the NetLabel MLS sensitivity levels
572 * @context: the security context
573 * @secattr: the NetLabel security attributes
576 * Given the security context and the NetLabel security attributes, copy the
577 * NetLabel MLS sensitivity level into the context.
580 void mls_import_netlbl_lvl(struct context
*context
,
581 struct netlbl_lsm_secattr
*secattr
)
583 if (!selinux_mls_enabled
)
586 context
->range
.level
[0].sens
= secattr
->mls_lvl
+ 1;
587 context
->range
.level
[1].sens
= context
->range
.level
[0].sens
;
591 * mls_export_netlbl_cat - Export the MLS categories to NetLabel
592 * @context: the security context
593 * @secattr: the NetLabel security attributes
596 * Given the security context copy the low MLS categories into the NetLabel
597 * MLS category field. Returns zero on success, negative values on failure.
600 int mls_export_netlbl_cat(struct context
*context
,
601 struct netlbl_lsm_secattr
*secattr
)
605 if (!selinux_mls_enabled
)
608 rc
= ebitmap_netlbl_export(&context
->range
.level
[0].cat
,
610 if (rc
== 0 && secattr
->mls_cat
!= NULL
)
611 secattr
->flags
|= NETLBL_SECATTR_MLS_CAT
;
617 * mls_import_netlbl_cat - Import the MLS categories from NetLabel
618 * @context: the security context
619 * @secattr: the NetLabel security attributes
622 * Copy the NetLabel security attributes into the SELinux context; since the
623 * NetLabel security attribute only contains a single MLS category use it for
624 * both the low and high categories of the context. Returns zero on success,
625 * negative values on failure.
628 int mls_import_netlbl_cat(struct context
*context
,
629 struct netlbl_lsm_secattr
*secattr
)
633 if (!selinux_mls_enabled
)
636 rc
= ebitmap_netlbl_import(&context
->range
.level
[0].cat
,
639 goto import_netlbl_cat_failure
;
641 rc
= ebitmap_cpy(&context
->range
.level
[1].cat
,
642 &context
->range
.level
[0].cat
);
644 goto import_netlbl_cat_failure
;
648 import_netlbl_cat_failure
:
649 ebitmap_destroy(&context
->range
.level
[0].cat
);
650 ebitmap_destroy(&context
->range
.level
[1].cat
);
653 #endif /* CONFIG_NETLABEL */