1 /* Authors: Karl MacMillan <kmacmillan@tresys.com> 2 * Frank Mayer <mayerf@tresys.com> 3 * 4 * Copyright (C) 2003 - 2004 Tresys Technology, LLC 5 * This program is free software; you can redistribute it and/or modify 6 * it under the terms of the GNU General Public License as published by 7 * the Free Software Foundation, version 2. 8 */ 9 10 #include <linux/kernel.h> 11 #include <linux/errno.h> 12 #include <linux/string.h> 13 #include <linux/spinlock.h> 14 #include <linux/slab.h> 15 16 #include "security.h" 17 #include "conditional.h" 18 #include "services.h" 19 20 /* 21 * cond_evaluate_expr evaluates a conditional expr 22 * in reverse polish notation. It returns true (1), false (0), 23 * or undefined (-1). Undefined occurs when the expression 24 * exceeds the stack depth of COND_EXPR_MAXDEPTH. 25 */ 26 static int cond_evaluate_expr(struct policydb *p, struct cond_expr *expr) 27 { 28 29 struct cond_expr *cur; 30 int s[COND_EXPR_MAXDEPTH]; 31 int sp = -1; 32 33 for (cur = expr; cur; cur = cur->next) { 34 switch (cur->expr_type) { 35 case COND_BOOL: 36 if (sp == (COND_EXPR_MAXDEPTH - 1)) 37 return -1; 38 sp++; 39 s[sp] = p->bool_val_to_struct[cur->bool - 1]->state; 40 break; 41 case COND_NOT: 42 if (sp < 0) 43 return -1; 44 s[sp] = !s[sp]; 45 break; 46 case COND_OR: 47 if (sp < 1) 48 return -1; 49 sp--; 50 s[sp] |= s[sp + 1]; 51 break; 52 case COND_AND: 53 if (sp < 1) 54 return -1; 55 sp--; 56 s[sp] &= s[sp + 1]; 57 break; 58 case COND_XOR: 59 if (sp < 1) 60 return -1; 61 sp--; 62 s[sp] ^= s[sp + 1]; 63 break; 64 case COND_EQ: 65 if (sp < 1) 66 return -1; 67 sp--; 68 s[sp] = (s[sp] == s[sp + 1]); 69 break; 70 case COND_NEQ: 71 if (sp < 1) 72 return -1; 73 sp--; 74 s[sp] = (s[sp] != s[sp + 1]); 75 break; 76 default: 77 return -1; 78 } 79 } 80 return s[0]; 81 } 82 83 /* 84 * evaluate_cond_node evaluates the conditional stored in 85 * a struct cond_node and if the result is different than the 86 * current state of the node it sets the rules in the true/false 87 * list appropriately. If the result of the expression is undefined 88 * all of the rules are disabled for safety. 89 */ 90 int evaluate_cond_node(struct policydb *p, struct cond_node *node) 91 { 92 int new_state; 93 struct cond_av_list *cur; 94 95 new_state = cond_evaluate_expr(p, node->expr); 96 if (new_state != node->cur_state) { 97 node->cur_state = new_state; 98 if (new_state == -1) 99 pr_err("SELinux: expression result was undefined - disabling all rules.\n"); 100 /* turn the rules on or off */ 101 for (cur = node->true_list; cur; cur = cur->next) { 102 if (new_state <= 0) 103 cur->node->key.specified &= ~AVTAB_ENABLED; 104 else 105 cur->node->key.specified |= AVTAB_ENABLED; 106 } 107 108 for (cur = node->false_list; cur; cur = cur->next) { 109 /* -1 or 1 */ 110 if (new_state) 111 cur->node->key.specified &= ~AVTAB_ENABLED; 112 else 113 cur->node->key.specified |= AVTAB_ENABLED; 114 } 115 } 116 return 0; 117 } 118 119 int cond_policydb_init(struct policydb *p) 120 { 121 int rc; 122 123 p->bool_val_to_struct = NULL; 124 p->cond_list = NULL; 125 126 rc = avtab_init(&p->te_cond_avtab); 127 if (rc) 128 return rc; 129 130 return 0; 131 } 132 133 static void cond_av_list_destroy(struct cond_av_list *list) 134 { 135 struct cond_av_list *cur, *next; 136 for (cur = list; cur; cur = next) { 137 next = cur->next; 138 /* the avtab_ptr_t node is destroy by the avtab */ 139 kfree(cur); 140 } 141 } 142 143 static void cond_node_destroy(struct cond_node *node) 144 { 145 struct cond_expr *cur_expr, *next_expr; 146 147 for (cur_expr = node->expr; cur_expr; cur_expr = next_expr) { 148 next_expr = cur_expr->next; 149 kfree(cur_expr); 150 } 151 cond_av_list_destroy(node->true_list); 152 cond_av_list_destroy(node->false_list); 153 kfree(node); 154 } 155 156 static void cond_list_destroy(struct cond_node *list) 157 { 158 struct cond_node *next, *cur; 159 160 if (list == NULL) 161 return; 162 163 for (cur = list; cur; cur = next) { 164 next = cur->next; 165 cond_node_destroy(cur); 166 } 167 } 168 169 void cond_policydb_destroy(struct policydb *p) 170 { 171 kfree(p->bool_val_to_struct); 172 avtab_destroy(&p->te_cond_avtab); 173 cond_list_destroy(p->cond_list); 174 } 175 176 int cond_init_bool_indexes(struct policydb *p) 177 { 178 kfree(p->bool_val_to_struct); 179 p->bool_val_to_struct = kmalloc_array(p->p_bools.nprim, 180 sizeof(*p->bool_val_to_struct), 181 GFP_KERNEL); 182 if (!p->bool_val_to_struct) 183 return -ENOMEM; 184 return 0; 185 } 186 187 int cond_destroy_bool(void *key, void *datum, void *p) 188 { 189 kfree(key); 190 kfree(datum); 191 return 0; 192 } 193 194 int cond_index_bool(void *key, void *datum, void *datap) 195 { 196 struct policydb *p; 197 struct cond_bool_datum *booldatum; 198 199 booldatum = datum; 200 p = datap; 201 202 if (!booldatum->value || booldatum->value > p->p_bools.nprim) 203 return -EINVAL; 204 205 p->sym_val_to_name[SYM_BOOLS][booldatum->value - 1] = key; 206 p->bool_val_to_struct[booldatum->value - 1] = booldatum; 207 208 return 0; 209 } 210 211 static int bool_isvalid(struct cond_bool_datum *b) 212 { 213 if (!(b->state == 0 || b->state == 1)) 214 return 0; 215 return 1; 216 } 217 218 int cond_read_bool(struct policydb *p, struct hashtab *h, void *fp) 219 { 220 char *key = NULL; 221 struct cond_bool_datum *booldatum; 222 __le32 buf[3]; 223 u32 len; 224 int rc; 225 226 booldatum = kzalloc(sizeof(*booldatum), GFP_KERNEL); 227 if (!booldatum) 228 return -ENOMEM; 229 230 rc = next_entry(buf, fp, sizeof buf); 231 if (rc) 232 goto err; 233 234 booldatum->value = le32_to_cpu(buf[0]); 235 booldatum->state = le32_to_cpu(buf[1]); 236 237 rc = -EINVAL; 238 if (!bool_isvalid(booldatum)) 239 goto err; 240 241 len = le32_to_cpu(buf[2]); 242 if (((len == 0) || (len == (u32)-1))) 243 goto err; 244 245 rc = -ENOMEM; 246 key = kmalloc(len + 1, GFP_KERNEL); 247 if (!key) 248 goto err; 249 rc = next_entry(key, fp, len); 250 if (rc) 251 goto err; 252 key[len] = '\0'; 253 rc = hashtab_insert(h, key, booldatum); 254 if (rc) 255 goto err; 256 257 return 0; 258 err: 259 cond_destroy_bool(key, booldatum, NULL); 260 return rc; 261 } 262 263 struct cond_insertf_data { 264 struct policydb *p; 265 struct cond_av_list *other; 266 struct cond_av_list *head; 267 struct cond_av_list *tail; 268 }; 269 270 static int cond_insertf(struct avtab *a, struct avtab_key *k, struct avtab_datum *d, void *ptr) 271 { 272 struct cond_insertf_data *data = ptr; 273 struct policydb *p = data->p; 274 struct cond_av_list *other = data->other, *list, *cur; 275 struct avtab_node *node_ptr; 276 u8 found; 277 int rc = -EINVAL; 278 279 /* 280 * For type rules we have to make certain there aren't any 281 * conflicting rules by searching the te_avtab and the 282 * cond_te_avtab. 283 */ 284 if (k->specified & AVTAB_TYPE) { 285 if (avtab_search(&p->te_avtab, k)) { 286 pr_err("SELinux: type rule already exists outside of a conditional.\n"); 287 goto err; 288 } 289 /* 290 * If we are reading the false list other will be a pointer to 291 * the true list. We can have duplicate entries if there is only 292 * 1 other entry and it is in our true list. 293 * 294 * If we are reading the true list (other == NULL) there shouldn't 295 * be any other entries. 296 */ 297 if (other) { 298 node_ptr = avtab_search_node(&p->te_cond_avtab, k); 299 if (node_ptr) { 300 if (avtab_search_node_next(node_ptr, k->specified)) { 301 pr_err("SELinux: too many conflicting type rules.\n"); 302 goto err; 303 } 304 found = 0; 305 for (cur = other; cur; cur = cur->next) { 306 if (cur->node == node_ptr) { 307 found = 1; 308 break; 309 } 310 } 311 if (!found) { 312 pr_err("SELinux: conflicting type rules.\n"); 313 goto err; 314 } 315 } 316 } else { 317 if (avtab_search(&p->te_cond_avtab, k)) { 318 pr_err("SELinux: conflicting type rules when adding type rule for true.\n"); 319 goto err; 320 } 321 } 322 } 323 324 node_ptr = avtab_insert_nonunique(&p->te_cond_avtab, k, d); 325 if (!node_ptr) { 326 pr_err("SELinux: could not insert rule.\n"); 327 rc = -ENOMEM; 328 goto err; 329 } 330 331 list = kzalloc(sizeof(*list), GFP_KERNEL); 332 if (!list) { 333 rc = -ENOMEM; 334 goto err; 335 } 336 337 list->node = node_ptr; 338 if (!data->head) 339 data->head = list; 340 else 341 data->tail->next = list; 342 data->tail = list; 343 return 0; 344 345 err: 346 cond_av_list_destroy(data->head); 347 data->head = NULL; 348 return rc; 349 } 350 351 static int cond_read_av_list(struct policydb *p, void *fp, struct cond_av_list **ret_list, struct cond_av_list *other) 352 { 353 int i, rc; 354 __le32 buf[1]; 355 u32 len; 356 struct cond_insertf_data data; 357 358 *ret_list = NULL; 359 360 rc = next_entry(buf, fp, sizeof(u32)); 361 if (rc) 362 return rc; 363 364 len = le32_to_cpu(buf[0]); 365 if (len == 0) 366 return 0; 367 368 data.p = p; 369 data.other = other; 370 data.head = NULL; 371 data.tail = NULL; 372 for (i = 0; i < len; i++) { 373 rc = avtab_read_item(&p->te_cond_avtab, fp, p, cond_insertf, 374 &data); 375 if (rc) 376 return rc; 377 } 378 379 *ret_list = data.head; 380 return 0; 381 } 382 383 static int expr_isvalid(struct policydb *p, struct cond_expr *expr) 384 { 385 if (expr->expr_type <= 0 || expr->expr_type > COND_LAST) { 386 pr_err("SELinux: conditional expressions uses unknown operator.\n"); 387 return 0; 388 } 389 390 if (expr->bool > p->p_bools.nprim) { 391 pr_err("SELinux: conditional expressions uses unknown bool.\n"); 392 return 0; 393 } 394 return 1; 395 } 396 397 static int cond_read_node(struct policydb *p, struct cond_node *node, void *fp) 398 { 399 __le32 buf[2]; 400 u32 len, i; 401 int rc; 402 struct cond_expr *expr = NULL, *last = NULL; 403 404 rc = next_entry(buf, fp, sizeof(u32) * 2); 405 if (rc) 406 goto err; 407 408 node->cur_state = le32_to_cpu(buf[0]); 409 410 /* expr */ 411 len = le32_to_cpu(buf[1]); 412 413 for (i = 0; i < len; i++) { 414 rc = next_entry(buf, fp, sizeof(u32) * 2); 415 if (rc) 416 goto err; 417 418 rc = -ENOMEM; 419 expr = kzalloc(sizeof(*expr), GFP_KERNEL); 420 if (!expr) 421 goto err; 422 423 expr->expr_type = le32_to_cpu(buf[0]); 424 expr->bool = le32_to_cpu(buf[1]); 425 426 if (!expr_isvalid(p, expr)) { 427 rc = -EINVAL; 428 kfree(expr); 429 goto err; 430 } 431 432 if (i == 0) 433 node->expr = expr; 434 else 435 last->next = expr; 436 last = expr; 437 } 438 439 rc = cond_read_av_list(p, fp, &node->true_list, NULL); 440 if (rc) 441 goto err; 442 rc = cond_read_av_list(p, fp, &node->false_list, node->true_list); 443 if (rc) 444 goto err; 445 return 0; 446 err: 447 cond_node_destroy(node); 448 return rc; 449 } 450 451 int cond_read_list(struct policydb *p, void *fp) 452 { 453 struct cond_node *node, *last = NULL; 454 __le32 buf[1]; 455 u32 i, len; 456 int rc; 457 458 rc = next_entry(buf, fp, sizeof buf); 459 if (rc) 460 return rc; 461 462 len = le32_to_cpu(buf[0]); 463 464 rc = avtab_alloc(&(p->te_cond_avtab), p->te_avtab.nel); 465 if (rc) 466 goto err; 467 468 for (i = 0; i < len; i++) { 469 rc = -ENOMEM; 470 node = kzalloc(sizeof(*node), GFP_KERNEL); 471 if (!node) 472 goto err; 473 474 rc = cond_read_node(p, node, fp); 475 if (rc) 476 goto err; 477 478 if (i == 0) 479 p->cond_list = node; 480 else 481 last->next = node; 482 last = node; 483 } 484 return 0; 485 err: 486 cond_list_destroy(p->cond_list); 487 p->cond_list = NULL; 488 return rc; 489 } 490 491 int cond_write_bool(void *vkey, void *datum, void *ptr) 492 { 493 char *key = vkey; 494 struct cond_bool_datum *booldatum = datum; 495 struct policy_data *pd = ptr; 496 void *fp = pd->fp; 497 __le32 buf[3]; 498 u32 len; 499 int rc; 500 501 len = strlen(key); 502 buf[0] = cpu_to_le32(booldatum->value); 503 buf[1] = cpu_to_le32(booldatum->state); 504 buf[2] = cpu_to_le32(len); 505 rc = put_entry(buf, sizeof(u32), 3, fp); 506 if (rc) 507 return rc; 508 rc = put_entry(key, 1, len, fp); 509 if (rc) 510 return rc; 511 return 0; 512 } 513 514 /* 515 * cond_write_cond_av_list doesn't write out the av_list nodes. 516 * Instead it writes out the key/value pairs from the avtab. This 517 * is necessary because there is no way to uniquely identifying rules 518 * in the avtab so it is not possible to associate individual rules 519 * in the avtab with a conditional without saving them as part of 520 * the conditional. This means that the avtab with the conditional 521 * rules will not be saved but will be rebuilt on policy load. 522 */ 523 static int cond_write_av_list(struct policydb *p, 524 struct cond_av_list *list, struct policy_file *fp) 525 { 526 __le32 buf[1]; 527 struct cond_av_list *cur_list; 528 u32 len; 529 int rc; 530 531 len = 0; 532 for (cur_list = list; cur_list != NULL; cur_list = cur_list->next) 533 len++; 534 535 buf[0] = cpu_to_le32(len); 536 rc = put_entry(buf, sizeof(u32), 1, fp); 537 if (rc) 538 return rc; 539 540 if (len == 0) 541 return 0; 542 543 for (cur_list = list; cur_list != NULL; cur_list = cur_list->next) { 544 rc = avtab_write_item(p, cur_list->node, fp); 545 if (rc) 546 return rc; 547 } 548 549 return 0; 550 } 551 552 static int cond_write_node(struct policydb *p, struct cond_node *node, 553 struct policy_file *fp) 554 { 555 struct cond_expr *cur_expr; 556 __le32 buf[2]; 557 int rc; 558 u32 len = 0; 559 560 buf[0] = cpu_to_le32(node->cur_state); 561 rc = put_entry(buf, sizeof(u32), 1, fp); 562 if (rc) 563 return rc; 564 565 for (cur_expr = node->expr; cur_expr != NULL; cur_expr = cur_expr->next) 566 len++; 567 568 buf[0] = cpu_to_le32(len); 569 rc = put_entry(buf, sizeof(u32), 1, fp); 570 if (rc) 571 return rc; 572 573 for (cur_expr = node->expr; cur_expr != NULL; cur_expr = cur_expr->next) { 574 buf[0] = cpu_to_le32(cur_expr->expr_type); 575 buf[1] = cpu_to_le32(cur_expr->bool); 576 rc = put_entry(buf, sizeof(u32), 2, fp); 577 if (rc) 578 return rc; 579 } 580 581 rc = cond_write_av_list(p, node->true_list, fp); 582 if (rc) 583 return rc; 584 rc = cond_write_av_list(p, node->false_list, fp); 585 if (rc) 586 return rc; 587 588 return 0; 589 } 590 591 int cond_write_list(struct policydb *p, struct cond_node *list, void *fp) 592 { 593 struct cond_node *cur; 594 u32 len; 595 __le32 buf[1]; 596 int rc; 597 598 len = 0; 599 for (cur = list; cur != NULL; cur = cur->next) 600 len++; 601 buf[0] = cpu_to_le32(len); 602 rc = put_entry(buf, sizeof(u32), 1, fp); 603 if (rc) 604 return rc; 605 606 for (cur = list; cur != NULL; cur = cur->next) { 607 rc = cond_write_node(p, cur, fp); 608 if (rc) 609 return rc; 610 } 611 612 return 0; 613 } 614 615 void cond_compute_xperms(struct avtab *ctab, struct avtab_key *key, 616 struct extended_perms_decision *xpermd) 617 { 618 struct avtab_node *node; 619 620 if (!ctab || !key || !xpermd) 621 return; 622 623 for (node = avtab_search_node(ctab, key); node; 624 node = avtab_search_node_next(node, key->specified)) { 625 if (node->key.specified & AVTAB_ENABLED) 626 services_compute_xperms_decision(xpermd, node); 627 } 628 return; 629 630 } 631 /* Determine whether additional permissions are granted by the conditional 632 * av table, and if so, add them to the result 633 */ 634 void cond_compute_av(struct avtab *ctab, struct avtab_key *key, 635 struct av_decision *avd, struct extended_perms *xperms) 636 { 637 struct avtab_node *node; 638 639 if (!ctab || !key || !avd) 640 return; 641 642 for (node = avtab_search_node(ctab, key); node; 643 node = avtab_search_node_next(node, key->specified)) { 644 if ((u16)(AVTAB_ALLOWED|AVTAB_ENABLED) == 645 (node->key.specified & (AVTAB_ALLOWED|AVTAB_ENABLED))) 646 avd->allowed |= node->datum.u.data; 647 if ((u16)(AVTAB_AUDITDENY|AVTAB_ENABLED) == 648 (node->key.specified & (AVTAB_AUDITDENY|AVTAB_ENABLED))) 649 /* Since a '0' in an auditdeny mask represents a 650 * permission we do NOT want to audit (dontaudit), we use 651 * the '&' operand to ensure that all '0's in the mask 652 * are retained (much unlike the allow and auditallow cases). 653 */ 654 avd->auditdeny &= node->datum.u.data; 655 if ((u16)(AVTAB_AUDITALLOW|AVTAB_ENABLED) == 656 (node->key.specified & (AVTAB_AUDITALLOW|AVTAB_ENABLED))) 657 avd->auditallow |= node->datum.u.data; 658 if (xperms && (node->key.specified & AVTAB_ENABLED) && 659 (node->key.specified & AVTAB_XPERMS)) 660 services_compute_xperms_drivers(xperms, node); 661 } 662 } 663