xref: /openbmc/linux/security/selinux/ss/policydb.c (revision 99b75a4e)
1 /*
2  * Implementation of the policy database.
3  *
4  * Author : Stephen Smalley, <sds@tycho.nsa.gov>
5  */
6 
7 /*
8  * Updated: Trusted Computer Solutions, Inc. <dgoeddel@trustedcs.com>
9  *
10  *	Support for enhanced MLS infrastructure.
11  *
12  * Updated: Frank Mayer <mayerf@tresys.com> and Karl MacMillan <kmacmillan@tresys.com>
13  *
14  *	Added conditional policy language extensions
15  *
16  * Updated: Hewlett-Packard <paul@paul-moore.com>
17  *
18  *      Added support for the policy capability bitmap
19  *
20  * Update: Mellanox Techonologies
21  *
22  *	Added Infiniband support
23  *
24  * Copyright (C) 2016 Mellanox Techonologies
25  * Copyright (C) 2007 Hewlett-Packard Development Company, L.P.
26  * Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
27  * Copyright (C) 2003 - 2004 Tresys Technology, LLC
28  *	This program is free software; you can redistribute it and/or modify
29  *	it under the terms of the GNU General Public License as published by
30  *	the Free Software Foundation, version 2.
31  */
32 
33 #include <linux/kernel.h>
34 #include <linux/sched.h>
35 #include <linux/slab.h>
36 #include <linux/string.h>
37 #include <linux/errno.h>
38 #include <linux/audit.h>
39 #include "security.h"
40 
41 #include "policydb.h"
42 #include "conditional.h"
43 #include "mls.h"
44 #include "services.h"
45 
46 #define _DEBUG_HASHES
47 
48 #ifdef DEBUG_HASHES
49 static const char *symtab_name[SYM_NUM] = {
50 	"common prefixes",
51 	"classes",
52 	"roles",
53 	"types",
54 	"users",
55 	"bools",
56 	"levels",
57 	"categories",
58 };
59 #endif
60 
61 static unsigned int symtab_sizes[SYM_NUM] = {
62 	2,
63 	32,
64 	16,
65 	512,
66 	128,
67 	16,
68 	16,
69 	16,
70 };
71 
72 struct policydb_compat_info {
73 	int version;
74 	int sym_num;
75 	int ocon_num;
76 };
77 
78 /* These need to be updated if SYM_NUM or OCON_NUM changes */
79 static struct policydb_compat_info policydb_compat[] = {
80 	{
81 		.version	= POLICYDB_VERSION_BASE,
82 		.sym_num	= SYM_NUM - 3,
83 		.ocon_num	= OCON_NUM - 3,
84 	},
85 	{
86 		.version	= POLICYDB_VERSION_BOOL,
87 		.sym_num	= SYM_NUM - 2,
88 		.ocon_num	= OCON_NUM - 3,
89 	},
90 	{
91 		.version	= POLICYDB_VERSION_IPV6,
92 		.sym_num	= SYM_NUM - 2,
93 		.ocon_num	= OCON_NUM - 2,
94 	},
95 	{
96 		.version	= POLICYDB_VERSION_NLCLASS,
97 		.sym_num	= SYM_NUM - 2,
98 		.ocon_num	= OCON_NUM - 2,
99 	},
100 	{
101 		.version	= POLICYDB_VERSION_MLS,
102 		.sym_num	= SYM_NUM,
103 		.ocon_num	= OCON_NUM - 2,
104 	},
105 	{
106 		.version	= POLICYDB_VERSION_AVTAB,
107 		.sym_num	= SYM_NUM,
108 		.ocon_num	= OCON_NUM - 2,
109 	},
110 	{
111 		.version	= POLICYDB_VERSION_RANGETRANS,
112 		.sym_num	= SYM_NUM,
113 		.ocon_num	= OCON_NUM - 2,
114 	},
115 	{
116 		.version	= POLICYDB_VERSION_POLCAP,
117 		.sym_num	= SYM_NUM,
118 		.ocon_num	= OCON_NUM - 2,
119 	},
120 	{
121 		.version	= POLICYDB_VERSION_PERMISSIVE,
122 		.sym_num	= SYM_NUM,
123 		.ocon_num	= OCON_NUM - 2,
124 	},
125 	{
126 		.version	= POLICYDB_VERSION_BOUNDARY,
127 		.sym_num	= SYM_NUM,
128 		.ocon_num	= OCON_NUM - 2,
129 	},
130 	{
131 		.version	= POLICYDB_VERSION_FILENAME_TRANS,
132 		.sym_num	= SYM_NUM,
133 		.ocon_num	= OCON_NUM - 2,
134 	},
135 	{
136 		.version	= POLICYDB_VERSION_ROLETRANS,
137 		.sym_num	= SYM_NUM,
138 		.ocon_num	= OCON_NUM - 2,
139 	},
140 	{
141 		.version	= POLICYDB_VERSION_NEW_OBJECT_DEFAULTS,
142 		.sym_num	= SYM_NUM,
143 		.ocon_num	= OCON_NUM - 2,
144 	},
145 	{
146 		.version	= POLICYDB_VERSION_DEFAULT_TYPE,
147 		.sym_num	= SYM_NUM,
148 		.ocon_num	= OCON_NUM - 2,
149 	},
150 	{
151 		.version	= POLICYDB_VERSION_CONSTRAINT_NAMES,
152 		.sym_num	= SYM_NUM,
153 		.ocon_num	= OCON_NUM - 2,
154 	},
155 	{
156 		.version	= POLICYDB_VERSION_XPERMS_IOCTL,
157 		.sym_num	= SYM_NUM,
158 		.ocon_num	= OCON_NUM - 2,
159 	},
160 	{
161 		.version	= POLICYDB_VERSION_INFINIBAND,
162 		.sym_num	= SYM_NUM,
163 		.ocon_num	= OCON_NUM,
164 	},
165 };
166 
167 static struct policydb_compat_info *policydb_lookup_compat(int version)
168 {
169 	int i;
170 	struct policydb_compat_info *info = NULL;
171 
172 	for (i = 0; i < ARRAY_SIZE(policydb_compat); i++) {
173 		if (policydb_compat[i].version == version) {
174 			info = &policydb_compat[i];
175 			break;
176 		}
177 	}
178 	return info;
179 }
180 
181 /*
182  * Initialize the role table.
183  */
184 static int roles_init(struct policydb *p)
185 {
186 	char *key = NULL;
187 	int rc;
188 	struct role_datum *role;
189 
190 	role = kzalloc(sizeof(*role), GFP_KERNEL);
191 	if (!role)
192 		return -ENOMEM;
193 
194 	rc = -EINVAL;
195 	role->value = ++p->p_roles.nprim;
196 	if (role->value != OBJECT_R_VAL)
197 		goto out;
198 
199 	rc = -ENOMEM;
200 	key = kstrdup(OBJECT_R, GFP_KERNEL);
201 	if (!key)
202 		goto out;
203 
204 	rc = hashtab_insert(p->p_roles.table, key, role);
205 	if (rc)
206 		goto out;
207 
208 	return 0;
209 out:
210 	kfree(key);
211 	kfree(role);
212 	return rc;
213 }
214 
215 static u32 filenametr_hash(struct hashtab *h, const void *k)
216 {
217 	const struct filename_trans *ft = k;
218 	unsigned long hash;
219 	unsigned int byte_num;
220 	unsigned char focus;
221 
222 	hash = ft->stype ^ ft->ttype ^ ft->tclass;
223 
224 	byte_num = 0;
225 	while ((focus = ft->name[byte_num++]))
226 		hash = partial_name_hash(focus, hash);
227 	return hash & (h->size - 1);
228 }
229 
230 static int filenametr_cmp(struct hashtab *h, const void *k1, const void *k2)
231 {
232 	const struct filename_trans *ft1 = k1;
233 	const struct filename_trans *ft2 = k2;
234 	int v;
235 
236 	v = ft1->stype - ft2->stype;
237 	if (v)
238 		return v;
239 
240 	v = ft1->ttype - ft2->ttype;
241 	if (v)
242 		return v;
243 
244 	v = ft1->tclass - ft2->tclass;
245 	if (v)
246 		return v;
247 
248 	return strcmp(ft1->name, ft2->name);
249 
250 }
251 
252 static u32 rangetr_hash(struct hashtab *h, const void *k)
253 {
254 	const struct range_trans *key = k;
255 	return (key->source_type + (key->target_type << 3) +
256 		(key->target_class << 5)) & (h->size - 1);
257 }
258 
259 static int rangetr_cmp(struct hashtab *h, const void *k1, const void *k2)
260 {
261 	const struct range_trans *key1 = k1, *key2 = k2;
262 	int v;
263 
264 	v = key1->source_type - key2->source_type;
265 	if (v)
266 		return v;
267 
268 	v = key1->target_type - key2->target_type;
269 	if (v)
270 		return v;
271 
272 	v = key1->target_class - key2->target_class;
273 
274 	return v;
275 }
276 
277 /*
278  * Initialize a policy database structure.
279  */
280 static int policydb_init(struct policydb *p)
281 {
282 	int i, rc;
283 
284 	memset(p, 0, sizeof(*p));
285 
286 	for (i = 0; i < SYM_NUM; i++) {
287 		rc = symtab_init(&p->symtab[i], symtab_sizes[i]);
288 		if (rc)
289 			goto out;
290 	}
291 
292 	rc = avtab_init(&p->te_avtab);
293 	if (rc)
294 		goto out;
295 
296 	rc = roles_init(p);
297 	if (rc)
298 		goto out;
299 
300 	rc = cond_policydb_init(p);
301 	if (rc)
302 		goto out;
303 
304 	p->filename_trans = hashtab_create(filenametr_hash, filenametr_cmp, (1 << 10));
305 	if (!p->filename_trans) {
306 		rc = -ENOMEM;
307 		goto out;
308 	}
309 
310 	p->range_tr = hashtab_create(rangetr_hash, rangetr_cmp, 256);
311 	if (!p->range_tr) {
312 		rc = -ENOMEM;
313 		goto out;
314 	}
315 
316 	ebitmap_init(&p->filename_trans_ttypes);
317 	ebitmap_init(&p->policycaps);
318 	ebitmap_init(&p->permissive_map);
319 
320 	return 0;
321 out:
322 	hashtab_destroy(p->filename_trans);
323 	hashtab_destroy(p->range_tr);
324 	for (i = 0; i < SYM_NUM; i++)
325 		hashtab_destroy(p->symtab[i].table);
326 	return rc;
327 }
328 
329 /*
330  * The following *_index functions are used to
331  * define the val_to_name and val_to_struct arrays
332  * in a policy database structure.  The val_to_name
333  * arrays are used when converting security context
334  * structures into string representations.  The
335  * val_to_struct arrays are used when the attributes
336  * of a class, role, or user are needed.
337  */
338 
339 static int common_index(void *key, void *datum, void *datap)
340 {
341 	struct policydb *p;
342 	struct common_datum *comdatum;
343 
344 	comdatum = datum;
345 	p = datap;
346 	if (!comdatum->value || comdatum->value > p->p_commons.nprim)
347 		return -EINVAL;
348 
349 	p->sym_val_to_name[SYM_COMMONS][comdatum->value - 1] = key;
350 
351 	return 0;
352 }
353 
354 static int class_index(void *key, void *datum, void *datap)
355 {
356 	struct policydb *p;
357 	struct class_datum *cladatum;
358 
359 	cladatum = datum;
360 	p = datap;
361 	if (!cladatum->value || cladatum->value > p->p_classes.nprim)
362 		return -EINVAL;
363 
364 	p->sym_val_to_name[SYM_CLASSES][cladatum->value - 1] = key;
365 	p->class_val_to_struct[cladatum->value - 1] = cladatum;
366 	return 0;
367 }
368 
369 static int role_index(void *key, void *datum, void *datap)
370 {
371 	struct policydb *p;
372 	struct role_datum *role;
373 
374 	role = datum;
375 	p = datap;
376 	if (!role->value
377 	    || role->value > p->p_roles.nprim
378 	    || role->bounds > p->p_roles.nprim)
379 		return -EINVAL;
380 
381 	p->sym_val_to_name[SYM_ROLES][role->value - 1] = key;
382 	p->role_val_to_struct[role->value - 1] = role;
383 	return 0;
384 }
385 
386 static int type_index(void *key, void *datum, void *datap)
387 {
388 	struct policydb *p;
389 	struct type_datum *typdatum;
390 
391 	typdatum = datum;
392 	p = datap;
393 
394 	if (typdatum->primary) {
395 		if (!typdatum->value
396 		    || typdatum->value > p->p_types.nprim
397 		    || typdatum->bounds > p->p_types.nprim)
398 			return -EINVAL;
399 		p->sym_val_to_name[SYM_TYPES][typdatum->value - 1] = key;
400 		p->type_val_to_struct_array[typdatum->value - 1] = typdatum;
401 	}
402 
403 	return 0;
404 }
405 
406 static int user_index(void *key, void *datum, void *datap)
407 {
408 	struct policydb *p;
409 	struct user_datum *usrdatum;
410 
411 	usrdatum = datum;
412 	p = datap;
413 	if (!usrdatum->value
414 	    || usrdatum->value > p->p_users.nprim
415 	    || usrdatum->bounds > p->p_users.nprim)
416 		return -EINVAL;
417 
418 	p->sym_val_to_name[SYM_USERS][usrdatum->value - 1] = key;
419 	p->user_val_to_struct[usrdatum->value - 1] = usrdatum;
420 	return 0;
421 }
422 
423 static int sens_index(void *key, void *datum, void *datap)
424 {
425 	struct policydb *p;
426 	struct level_datum *levdatum;
427 
428 	levdatum = datum;
429 	p = datap;
430 
431 	if (!levdatum->isalias) {
432 		if (!levdatum->level->sens ||
433 		    levdatum->level->sens > p->p_levels.nprim)
434 			return -EINVAL;
435 
436 		p->sym_val_to_name[SYM_LEVELS][levdatum->level->sens - 1] = key;
437 	}
438 
439 	return 0;
440 }
441 
442 static int cat_index(void *key, void *datum, void *datap)
443 {
444 	struct policydb *p;
445 	struct cat_datum *catdatum;
446 
447 	catdatum = datum;
448 	p = datap;
449 
450 	if (!catdatum->isalias) {
451 		if (!catdatum->value || catdatum->value > p->p_cats.nprim)
452 			return -EINVAL;
453 
454 		p->sym_val_to_name[SYM_CATS][catdatum->value - 1] = key;
455 	}
456 
457 	return 0;
458 }
459 
460 static int (*index_f[SYM_NUM]) (void *key, void *datum, void *datap) =
461 {
462 	common_index,
463 	class_index,
464 	role_index,
465 	type_index,
466 	user_index,
467 	cond_index_bool,
468 	sens_index,
469 	cat_index,
470 };
471 
472 #ifdef DEBUG_HASHES
473 static void hash_eval(struct hashtab *h, const char *hash_name)
474 {
475 	struct hashtab_info info;
476 
477 	hashtab_stat(h, &info);
478 	pr_debug("SELinux: %s:  %d entries and %d/%d buckets used, "
479 	       "longest chain length %d\n", hash_name, h->nel,
480 	       info.slots_used, h->size, info.max_chain_len);
481 }
482 
483 static void symtab_hash_eval(struct symtab *s)
484 {
485 	int i;
486 
487 	for (i = 0; i < SYM_NUM; i++)
488 		hash_eval(s[i].table, symtab_name[i]);
489 }
490 
491 #else
492 static inline void hash_eval(struct hashtab *h, char *hash_name)
493 {
494 }
495 #endif
496 
497 /*
498  * Define the other val_to_name and val_to_struct arrays
499  * in a policy database structure.
500  *
501  * Caller must clean up on failure.
502  */
503 static int policydb_index(struct policydb *p)
504 {
505 	int i, rc;
506 
507 	if (p->mls_enabled)
508 		pr_debug("SELinux:  %d users, %d roles, %d types, %d bools, %d sens, %d cats\n",
509 			 p->p_users.nprim, p->p_roles.nprim, p->p_types.nprim,
510 			 p->p_bools.nprim, p->p_levels.nprim, p->p_cats.nprim);
511 	else
512 		pr_debug("SELinux:  %d users, %d roles, %d types, %d bools\n",
513 			 p->p_users.nprim, p->p_roles.nprim, p->p_types.nprim,
514 			 p->p_bools.nprim);
515 
516 	pr_debug("SELinux:  %d classes, %d rules\n",
517 		 p->p_classes.nprim, p->te_avtab.nel);
518 
519 #ifdef DEBUG_HASHES
520 	avtab_hash_eval(&p->te_avtab, "rules");
521 	symtab_hash_eval(p->symtab);
522 #endif
523 
524 	p->class_val_to_struct = kcalloc(p->p_classes.nprim,
525 					 sizeof(*p->class_val_to_struct),
526 					 GFP_KERNEL);
527 	if (!p->class_val_to_struct)
528 		return -ENOMEM;
529 
530 	p->role_val_to_struct = kcalloc(p->p_roles.nprim,
531 					sizeof(*p->role_val_to_struct),
532 					GFP_KERNEL);
533 	if (!p->role_val_to_struct)
534 		return -ENOMEM;
535 
536 	p->user_val_to_struct = kcalloc(p->p_users.nprim,
537 					sizeof(*p->user_val_to_struct),
538 					GFP_KERNEL);
539 	if (!p->user_val_to_struct)
540 		return -ENOMEM;
541 
542 	p->type_val_to_struct_array = kvcalloc(p->p_types.nprim,
543 					       sizeof(*p->type_val_to_struct_array),
544 					       GFP_KERNEL);
545 	if (!p->type_val_to_struct_array)
546 		return -ENOMEM;
547 
548 	rc = cond_init_bool_indexes(p);
549 	if (rc)
550 		goto out;
551 
552 	for (i = 0; i < SYM_NUM; i++) {
553 		p->sym_val_to_name[i] = kvcalloc(p->symtab[i].nprim,
554 						 sizeof(char *),
555 						 GFP_KERNEL);
556 		if (!p->sym_val_to_name[i])
557 			return -ENOMEM;
558 
559 		rc = hashtab_map(p->symtab[i].table, index_f[i], p);
560 		if (rc)
561 			goto out;
562 	}
563 	rc = 0;
564 out:
565 	return rc;
566 }
567 
568 /*
569  * The following *_destroy functions are used to
570  * free any memory allocated for each kind of
571  * symbol data in the policy database.
572  */
573 
574 static int perm_destroy(void *key, void *datum, void *p)
575 {
576 	kfree(key);
577 	kfree(datum);
578 	return 0;
579 }
580 
581 static int common_destroy(void *key, void *datum, void *p)
582 {
583 	struct common_datum *comdatum;
584 
585 	kfree(key);
586 	if (datum) {
587 		comdatum = datum;
588 		hashtab_map(comdatum->permissions.table, perm_destroy, NULL);
589 		hashtab_destroy(comdatum->permissions.table);
590 	}
591 	kfree(datum);
592 	return 0;
593 }
594 
595 static void constraint_expr_destroy(struct constraint_expr *expr)
596 {
597 	if (expr) {
598 		ebitmap_destroy(&expr->names);
599 		if (expr->type_names) {
600 			ebitmap_destroy(&expr->type_names->types);
601 			ebitmap_destroy(&expr->type_names->negset);
602 			kfree(expr->type_names);
603 		}
604 		kfree(expr);
605 	}
606 }
607 
608 static int cls_destroy(void *key, void *datum, void *p)
609 {
610 	struct class_datum *cladatum;
611 	struct constraint_node *constraint, *ctemp;
612 	struct constraint_expr *e, *etmp;
613 
614 	kfree(key);
615 	if (datum) {
616 		cladatum = datum;
617 		hashtab_map(cladatum->permissions.table, perm_destroy, NULL);
618 		hashtab_destroy(cladatum->permissions.table);
619 		constraint = cladatum->constraints;
620 		while (constraint) {
621 			e = constraint->expr;
622 			while (e) {
623 				etmp = e;
624 				e = e->next;
625 				constraint_expr_destroy(etmp);
626 			}
627 			ctemp = constraint;
628 			constraint = constraint->next;
629 			kfree(ctemp);
630 		}
631 
632 		constraint = cladatum->validatetrans;
633 		while (constraint) {
634 			e = constraint->expr;
635 			while (e) {
636 				etmp = e;
637 				e = e->next;
638 				constraint_expr_destroy(etmp);
639 			}
640 			ctemp = constraint;
641 			constraint = constraint->next;
642 			kfree(ctemp);
643 		}
644 		kfree(cladatum->comkey);
645 	}
646 	kfree(datum);
647 	return 0;
648 }
649 
650 static int role_destroy(void *key, void *datum, void *p)
651 {
652 	struct role_datum *role;
653 
654 	kfree(key);
655 	if (datum) {
656 		role = datum;
657 		ebitmap_destroy(&role->dominates);
658 		ebitmap_destroy(&role->types);
659 	}
660 	kfree(datum);
661 	return 0;
662 }
663 
664 static int type_destroy(void *key, void *datum, void *p)
665 {
666 	kfree(key);
667 	kfree(datum);
668 	return 0;
669 }
670 
671 static int user_destroy(void *key, void *datum, void *p)
672 {
673 	struct user_datum *usrdatum;
674 
675 	kfree(key);
676 	if (datum) {
677 		usrdatum = datum;
678 		ebitmap_destroy(&usrdatum->roles);
679 		ebitmap_destroy(&usrdatum->range.level[0].cat);
680 		ebitmap_destroy(&usrdatum->range.level[1].cat);
681 		ebitmap_destroy(&usrdatum->dfltlevel.cat);
682 	}
683 	kfree(datum);
684 	return 0;
685 }
686 
687 static int sens_destroy(void *key, void *datum, void *p)
688 {
689 	struct level_datum *levdatum;
690 
691 	kfree(key);
692 	if (datum) {
693 		levdatum = datum;
694 		if (levdatum->level)
695 			ebitmap_destroy(&levdatum->level->cat);
696 		kfree(levdatum->level);
697 	}
698 	kfree(datum);
699 	return 0;
700 }
701 
702 static int cat_destroy(void *key, void *datum, void *p)
703 {
704 	kfree(key);
705 	kfree(datum);
706 	return 0;
707 }
708 
709 static int (*destroy_f[SYM_NUM]) (void *key, void *datum, void *datap) =
710 {
711 	common_destroy,
712 	cls_destroy,
713 	role_destroy,
714 	type_destroy,
715 	user_destroy,
716 	cond_destroy_bool,
717 	sens_destroy,
718 	cat_destroy,
719 };
720 
721 static int filenametr_destroy(void *key, void *datum, void *p)
722 {
723 	struct filename_trans *ft = key;
724 	kfree(ft->name);
725 	kfree(key);
726 	kfree(datum);
727 	cond_resched();
728 	return 0;
729 }
730 
731 static int range_tr_destroy(void *key, void *datum, void *p)
732 {
733 	struct mls_range *rt = datum;
734 	kfree(key);
735 	ebitmap_destroy(&rt->level[0].cat);
736 	ebitmap_destroy(&rt->level[1].cat);
737 	kfree(datum);
738 	cond_resched();
739 	return 0;
740 }
741 
742 static void ocontext_destroy(struct ocontext *c, int i)
743 {
744 	if (!c)
745 		return;
746 
747 	context_destroy(&c->context[0]);
748 	context_destroy(&c->context[1]);
749 	if (i == OCON_ISID || i == OCON_FS ||
750 	    i == OCON_NETIF || i == OCON_FSUSE)
751 		kfree(c->u.name);
752 	kfree(c);
753 }
754 
755 /*
756  * Free any memory allocated by a policy database structure.
757  */
758 void policydb_destroy(struct policydb *p)
759 {
760 	struct ocontext *c, *ctmp;
761 	struct genfs *g, *gtmp;
762 	int i;
763 	struct role_allow *ra, *lra = NULL;
764 	struct role_trans *tr, *ltr = NULL;
765 
766 	for (i = 0; i < SYM_NUM; i++) {
767 		cond_resched();
768 		hashtab_map(p->symtab[i].table, destroy_f[i], NULL);
769 		hashtab_destroy(p->symtab[i].table);
770 	}
771 
772 	for (i = 0; i < SYM_NUM; i++)
773 		kvfree(p->sym_val_to_name[i]);
774 
775 	kfree(p->class_val_to_struct);
776 	kfree(p->role_val_to_struct);
777 	kfree(p->user_val_to_struct);
778 	kvfree(p->type_val_to_struct_array);
779 
780 	avtab_destroy(&p->te_avtab);
781 
782 	for (i = 0; i < OCON_NUM; i++) {
783 		cond_resched();
784 		c = p->ocontexts[i];
785 		while (c) {
786 			ctmp = c;
787 			c = c->next;
788 			ocontext_destroy(ctmp, i);
789 		}
790 		p->ocontexts[i] = NULL;
791 	}
792 
793 	g = p->genfs;
794 	while (g) {
795 		cond_resched();
796 		kfree(g->fstype);
797 		c = g->head;
798 		while (c) {
799 			ctmp = c;
800 			c = c->next;
801 			ocontext_destroy(ctmp, OCON_FSUSE);
802 		}
803 		gtmp = g;
804 		g = g->next;
805 		kfree(gtmp);
806 	}
807 	p->genfs = NULL;
808 
809 	cond_policydb_destroy(p);
810 
811 	for (tr = p->role_tr; tr; tr = tr->next) {
812 		cond_resched();
813 		kfree(ltr);
814 		ltr = tr;
815 	}
816 	kfree(ltr);
817 
818 	for (ra = p->role_allow; ra; ra = ra->next) {
819 		cond_resched();
820 		kfree(lra);
821 		lra = ra;
822 	}
823 	kfree(lra);
824 
825 	hashtab_map(p->filename_trans, filenametr_destroy, NULL);
826 	hashtab_destroy(p->filename_trans);
827 
828 	hashtab_map(p->range_tr, range_tr_destroy, NULL);
829 	hashtab_destroy(p->range_tr);
830 
831 	if (p->type_attr_map_array) {
832 		for (i = 0; i < p->p_types.nprim; i++)
833 			ebitmap_destroy(&p->type_attr_map_array[i]);
834 		kvfree(p->type_attr_map_array);
835 	}
836 
837 	ebitmap_destroy(&p->filename_trans_ttypes);
838 	ebitmap_destroy(&p->policycaps);
839 	ebitmap_destroy(&p->permissive_map);
840 }
841 
842 /*
843  * Load the initial SIDs specified in a policy database
844  * structure into a SID table.
845  */
846 int policydb_load_isids(struct policydb *p, struct sidtab *s)
847 {
848 	struct ocontext *head, *c;
849 	int rc;
850 
851 	rc = sidtab_init(s);
852 	if (rc) {
853 		pr_err("SELinux:  out of memory on SID table init\n");
854 		goto out;
855 	}
856 
857 	head = p->ocontexts[OCON_ISID];
858 	for (c = head; c; c = c->next) {
859 		rc = -EINVAL;
860 		if (!c->context[0].user) {
861 			pr_err("SELinux:  SID %s was never defined.\n",
862 				c->u.name);
863 			sidtab_destroy(s);
864 			goto out;
865 		}
866 		if (c->sid[0] == SECSID_NULL || c->sid[0] > SECINITSID_NUM) {
867 			pr_err("SELinux:  Initial SID %s out of range.\n",
868 				c->u.name);
869 			sidtab_destroy(s);
870 			goto out;
871 		}
872 
873 		rc = sidtab_set_initial(s, c->sid[0], &c->context[0]);
874 		if (rc) {
875 			pr_err("SELinux:  unable to load initial SID %s.\n",
876 				c->u.name);
877 			sidtab_destroy(s);
878 			goto out;
879 		}
880 	}
881 	rc = 0;
882 out:
883 	return rc;
884 }
885 
886 int policydb_class_isvalid(struct policydb *p, unsigned int class)
887 {
888 	if (!class || class > p->p_classes.nprim)
889 		return 0;
890 	return 1;
891 }
892 
893 int policydb_role_isvalid(struct policydb *p, unsigned int role)
894 {
895 	if (!role || role > p->p_roles.nprim)
896 		return 0;
897 	return 1;
898 }
899 
900 int policydb_type_isvalid(struct policydb *p, unsigned int type)
901 {
902 	if (!type || type > p->p_types.nprim)
903 		return 0;
904 	return 1;
905 }
906 
907 /*
908  * Return 1 if the fields in the security context
909  * structure `c' are valid.  Return 0 otherwise.
910  */
911 int policydb_context_isvalid(struct policydb *p, struct context *c)
912 {
913 	struct role_datum *role;
914 	struct user_datum *usrdatum;
915 
916 	if (!c->role || c->role > p->p_roles.nprim)
917 		return 0;
918 
919 	if (!c->user || c->user > p->p_users.nprim)
920 		return 0;
921 
922 	if (!c->type || c->type > p->p_types.nprim)
923 		return 0;
924 
925 	if (c->role != OBJECT_R_VAL) {
926 		/*
927 		 * Role must be authorized for the type.
928 		 */
929 		role = p->role_val_to_struct[c->role - 1];
930 		if (!role || !ebitmap_get_bit(&role->types, c->type - 1))
931 			/* role may not be associated with type */
932 			return 0;
933 
934 		/*
935 		 * User must be authorized for the role.
936 		 */
937 		usrdatum = p->user_val_to_struct[c->user - 1];
938 		if (!usrdatum)
939 			return 0;
940 
941 		if (!ebitmap_get_bit(&usrdatum->roles, c->role - 1))
942 			/* user may not be associated with role */
943 			return 0;
944 	}
945 
946 	if (!mls_context_isvalid(p, c))
947 		return 0;
948 
949 	return 1;
950 }
951 
952 /*
953  * Read a MLS range structure from a policydb binary
954  * representation file.
955  */
956 static int mls_read_range_helper(struct mls_range *r, void *fp)
957 {
958 	__le32 buf[2];
959 	u32 items;
960 	int rc;
961 
962 	rc = next_entry(buf, fp, sizeof(u32));
963 	if (rc)
964 		goto out;
965 
966 	rc = -EINVAL;
967 	items = le32_to_cpu(buf[0]);
968 	if (items > ARRAY_SIZE(buf)) {
969 		pr_err("SELinux: mls:  range overflow\n");
970 		goto out;
971 	}
972 
973 	rc = next_entry(buf, fp, sizeof(u32) * items);
974 	if (rc) {
975 		pr_err("SELinux: mls:  truncated range\n");
976 		goto out;
977 	}
978 
979 	r->level[0].sens = le32_to_cpu(buf[0]);
980 	if (items > 1)
981 		r->level[1].sens = le32_to_cpu(buf[1]);
982 	else
983 		r->level[1].sens = r->level[0].sens;
984 
985 	rc = ebitmap_read(&r->level[0].cat, fp);
986 	if (rc) {
987 		pr_err("SELinux: mls:  error reading low categories\n");
988 		goto out;
989 	}
990 	if (items > 1) {
991 		rc = ebitmap_read(&r->level[1].cat, fp);
992 		if (rc) {
993 			pr_err("SELinux: mls:  error reading high categories\n");
994 			goto bad_high;
995 		}
996 	} else {
997 		rc = ebitmap_cpy(&r->level[1].cat, &r->level[0].cat);
998 		if (rc) {
999 			pr_err("SELinux: mls:  out of memory\n");
1000 			goto bad_high;
1001 		}
1002 	}
1003 
1004 	return 0;
1005 bad_high:
1006 	ebitmap_destroy(&r->level[0].cat);
1007 out:
1008 	return rc;
1009 }
1010 
1011 /*
1012  * Read and validate a security context structure
1013  * from a policydb binary representation file.
1014  */
1015 static int context_read_and_validate(struct context *c,
1016 				     struct policydb *p,
1017 				     void *fp)
1018 {
1019 	__le32 buf[3];
1020 	int rc;
1021 
1022 	rc = next_entry(buf, fp, sizeof buf);
1023 	if (rc) {
1024 		pr_err("SELinux: context truncated\n");
1025 		goto out;
1026 	}
1027 	c->user = le32_to_cpu(buf[0]);
1028 	c->role = le32_to_cpu(buf[1]);
1029 	c->type = le32_to_cpu(buf[2]);
1030 	if (p->policyvers >= POLICYDB_VERSION_MLS) {
1031 		rc = mls_read_range_helper(&c->range, fp);
1032 		if (rc) {
1033 			pr_err("SELinux: error reading MLS range of context\n");
1034 			goto out;
1035 		}
1036 	}
1037 
1038 	rc = -EINVAL;
1039 	if (!policydb_context_isvalid(p, c)) {
1040 		pr_err("SELinux:  invalid security context\n");
1041 		context_destroy(c);
1042 		goto out;
1043 	}
1044 	rc = 0;
1045 out:
1046 	return rc;
1047 }
1048 
1049 /*
1050  * The following *_read functions are used to
1051  * read the symbol data from a policy database
1052  * binary representation file.
1053  */
1054 
1055 static int str_read(char **strp, gfp_t flags, void *fp, u32 len)
1056 {
1057 	int rc;
1058 	char *str;
1059 
1060 	if ((len == 0) || (len == (u32)-1))
1061 		return -EINVAL;
1062 
1063 	str = kmalloc(len + 1, flags | __GFP_NOWARN);
1064 	if (!str)
1065 		return -ENOMEM;
1066 
1067 	/* it's expected the caller should free the str */
1068 	*strp = str;
1069 
1070 	rc = next_entry(str, fp, len);
1071 	if (rc)
1072 		return rc;
1073 
1074 	str[len] = '\0';
1075 	return 0;
1076 }
1077 
1078 static int perm_read(struct policydb *p, struct hashtab *h, void *fp)
1079 {
1080 	char *key = NULL;
1081 	struct perm_datum *perdatum;
1082 	int rc;
1083 	__le32 buf[2];
1084 	u32 len;
1085 
1086 	perdatum = kzalloc(sizeof(*perdatum), GFP_KERNEL);
1087 	if (!perdatum)
1088 		return -ENOMEM;
1089 
1090 	rc = next_entry(buf, fp, sizeof buf);
1091 	if (rc)
1092 		goto bad;
1093 
1094 	len = le32_to_cpu(buf[0]);
1095 	perdatum->value = le32_to_cpu(buf[1]);
1096 
1097 	rc = str_read(&key, GFP_KERNEL, fp, len);
1098 	if (rc)
1099 		goto bad;
1100 
1101 	rc = hashtab_insert(h, key, perdatum);
1102 	if (rc)
1103 		goto bad;
1104 
1105 	return 0;
1106 bad:
1107 	perm_destroy(key, perdatum, NULL);
1108 	return rc;
1109 }
1110 
1111 static int common_read(struct policydb *p, struct hashtab *h, void *fp)
1112 {
1113 	char *key = NULL;
1114 	struct common_datum *comdatum;
1115 	__le32 buf[4];
1116 	u32 len, nel;
1117 	int i, rc;
1118 
1119 	comdatum = kzalloc(sizeof(*comdatum), GFP_KERNEL);
1120 	if (!comdatum)
1121 		return -ENOMEM;
1122 
1123 	rc = next_entry(buf, fp, sizeof buf);
1124 	if (rc)
1125 		goto bad;
1126 
1127 	len = le32_to_cpu(buf[0]);
1128 	comdatum->value = le32_to_cpu(buf[1]);
1129 
1130 	rc = symtab_init(&comdatum->permissions, PERM_SYMTAB_SIZE);
1131 	if (rc)
1132 		goto bad;
1133 	comdatum->permissions.nprim = le32_to_cpu(buf[2]);
1134 	nel = le32_to_cpu(buf[3]);
1135 
1136 	rc = str_read(&key, GFP_KERNEL, fp, len);
1137 	if (rc)
1138 		goto bad;
1139 
1140 	for (i = 0; i < nel; i++) {
1141 		rc = perm_read(p, comdatum->permissions.table, fp);
1142 		if (rc)
1143 			goto bad;
1144 	}
1145 
1146 	rc = hashtab_insert(h, key, comdatum);
1147 	if (rc)
1148 		goto bad;
1149 	return 0;
1150 bad:
1151 	common_destroy(key, comdatum, NULL);
1152 	return rc;
1153 }
1154 
1155 static void type_set_init(struct type_set *t)
1156 {
1157 	ebitmap_init(&t->types);
1158 	ebitmap_init(&t->negset);
1159 }
1160 
1161 static int type_set_read(struct type_set *t, void *fp)
1162 {
1163 	__le32 buf[1];
1164 	int rc;
1165 
1166 	if (ebitmap_read(&t->types, fp))
1167 		return -EINVAL;
1168 	if (ebitmap_read(&t->negset, fp))
1169 		return -EINVAL;
1170 
1171 	rc = next_entry(buf, fp, sizeof(u32));
1172 	if (rc < 0)
1173 		return -EINVAL;
1174 	t->flags = le32_to_cpu(buf[0]);
1175 
1176 	return 0;
1177 }
1178 
1179 
1180 static int read_cons_helper(struct policydb *p,
1181 				struct constraint_node **nodep,
1182 				int ncons, int allowxtarget, void *fp)
1183 {
1184 	struct constraint_node *c, *lc;
1185 	struct constraint_expr *e, *le;
1186 	__le32 buf[3];
1187 	u32 nexpr;
1188 	int rc, i, j, depth;
1189 
1190 	lc = NULL;
1191 	for (i = 0; i < ncons; i++) {
1192 		c = kzalloc(sizeof(*c), GFP_KERNEL);
1193 		if (!c)
1194 			return -ENOMEM;
1195 
1196 		if (lc)
1197 			lc->next = c;
1198 		else
1199 			*nodep = c;
1200 
1201 		rc = next_entry(buf, fp, (sizeof(u32) * 2));
1202 		if (rc)
1203 			return rc;
1204 		c->permissions = le32_to_cpu(buf[0]);
1205 		nexpr = le32_to_cpu(buf[1]);
1206 		le = NULL;
1207 		depth = -1;
1208 		for (j = 0; j < nexpr; j++) {
1209 			e = kzalloc(sizeof(*e), GFP_KERNEL);
1210 			if (!e)
1211 				return -ENOMEM;
1212 
1213 			if (le)
1214 				le->next = e;
1215 			else
1216 				c->expr = e;
1217 
1218 			rc = next_entry(buf, fp, (sizeof(u32) * 3));
1219 			if (rc)
1220 				return rc;
1221 			e->expr_type = le32_to_cpu(buf[0]);
1222 			e->attr = le32_to_cpu(buf[1]);
1223 			e->op = le32_to_cpu(buf[2]);
1224 
1225 			switch (e->expr_type) {
1226 			case CEXPR_NOT:
1227 				if (depth < 0)
1228 					return -EINVAL;
1229 				break;
1230 			case CEXPR_AND:
1231 			case CEXPR_OR:
1232 				if (depth < 1)
1233 					return -EINVAL;
1234 				depth--;
1235 				break;
1236 			case CEXPR_ATTR:
1237 				if (depth == (CEXPR_MAXDEPTH - 1))
1238 					return -EINVAL;
1239 				depth++;
1240 				break;
1241 			case CEXPR_NAMES:
1242 				if (!allowxtarget && (e->attr & CEXPR_XTARGET))
1243 					return -EINVAL;
1244 				if (depth == (CEXPR_MAXDEPTH - 1))
1245 					return -EINVAL;
1246 				depth++;
1247 				rc = ebitmap_read(&e->names, fp);
1248 				if (rc)
1249 					return rc;
1250 				if (p->policyvers >=
1251 					POLICYDB_VERSION_CONSTRAINT_NAMES) {
1252 						e->type_names = kzalloc(sizeof
1253 						(*e->type_names),
1254 						GFP_KERNEL);
1255 					if (!e->type_names)
1256 						return -ENOMEM;
1257 					type_set_init(e->type_names);
1258 					rc = type_set_read(e->type_names, fp);
1259 					if (rc)
1260 						return rc;
1261 				}
1262 				break;
1263 			default:
1264 				return -EINVAL;
1265 			}
1266 			le = e;
1267 		}
1268 		if (depth != 0)
1269 			return -EINVAL;
1270 		lc = c;
1271 	}
1272 
1273 	return 0;
1274 }
1275 
1276 static int class_read(struct policydb *p, struct hashtab *h, void *fp)
1277 {
1278 	char *key = NULL;
1279 	struct class_datum *cladatum;
1280 	__le32 buf[6];
1281 	u32 len, len2, ncons, nel;
1282 	int i, rc;
1283 
1284 	cladatum = kzalloc(sizeof(*cladatum), GFP_KERNEL);
1285 	if (!cladatum)
1286 		return -ENOMEM;
1287 
1288 	rc = next_entry(buf, fp, sizeof(u32)*6);
1289 	if (rc)
1290 		goto bad;
1291 
1292 	len = le32_to_cpu(buf[0]);
1293 	len2 = le32_to_cpu(buf[1]);
1294 	cladatum->value = le32_to_cpu(buf[2]);
1295 
1296 	rc = symtab_init(&cladatum->permissions, PERM_SYMTAB_SIZE);
1297 	if (rc)
1298 		goto bad;
1299 	cladatum->permissions.nprim = le32_to_cpu(buf[3]);
1300 	nel = le32_to_cpu(buf[4]);
1301 
1302 	ncons = le32_to_cpu(buf[5]);
1303 
1304 	rc = str_read(&key, GFP_KERNEL, fp, len);
1305 	if (rc)
1306 		goto bad;
1307 
1308 	if (len2) {
1309 		rc = str_read(&cladatum->comkey, GFP_KERNEL, fp, len2);
1310 		if (rc)
1311 			goto bad;
1312 
1313 		rc = -EINVAL;
1314 		cladatum->comdatum = hashtab_search(p->p_commons.table, cladatum->comkey);
1315 		if (!cladatum->comdatum) {
1316 			pr_err("SELinux:  unknown common %s\n",
1317 			       cladatum->comkey);
1318 			goto bad;
1319 		}
1320 	}
1321 	for (i = 0; i < nel; i++) {
1322 		rc = perm_read(p, cladatum->permissions.table, fp);
1323 		if (rc)
1324 			goto bad;
1325 	}
1326 
1327 	rc = read_cons_helper(p, &cladatum->constraints, ncons, 0, fp);
1328 	if (rc)
1329 		goto bad;
1330 
1331 	if (p->policyvers >= POLICYDB_VERSION_VALIDATETRANS) {
1332 		/* grab the validatetrans rules */
1333 		rc = next_entry(buf, fp, sizeof(u32));
1334 		if (rc)
1335 			goto bad;
1336 		ncons = le32_to_cpu(buf[0]);
1337 		rc = read_cons_helper(p, &cladatum->validatetrans,
1338 				ncons, 1, fp);
1339 		if (rc)
1340 			goto bad;
1341 	}
1342 
1343 	if (p->policyvers >= POLICYDB_VERSION_NEW_OBJECT_DEFAULTS) {
1344 		rc = next_entry(buf, fp, sizeof(u32) * 3);
1345 		if (rc)
1346 			goto bad;
1347 
1348 		cladatum->default_user = le32_to_cpu(buf[0]);
1349 		cladatum->default_role = le32_to_cpu(buf[1]);
1350 		cladatum->default_range = le32_to_cpu(buf[2]);
1351 	}
1352 
1353 	if (p->policyvers >= POLICYDB_VERSION_DEFAULT_TYPE) {
1354 		rc = next_entry(buf, fp, sizeof(u32) * 1);
1355 		if (rc)
1356 			goto bad;
1357 		cladatum->default_type = le32_to_cpu(buf[0]);
1358 	}
1359 
1360 	rc = hashtab_insert(h, key, cladatum);
1361 	if (rc)
1362 		goto bad;
1363 
1364 	return 0;
1365 bad:
1366 	cls_destroy(key, cladatum, NULL);
1367 	return rc;
1368 }
1369 
1370 static int role_read(struct policydb *p, struct hashtab *h, void *fp)
1371 {
1372 	char *key = NULL;
1373 	struct role_datum *role;
1374 	int rc, to_read = 2;
1375 	__le32 buf[3];
1376 	u32 len;
1377 
1378 	role = kzalloc(sizeof(*role), GFP_KERNEL);
1379 	if (!role)
1380 		return -ENOMEM;
1381 
1382 	if (p->policyvers >= POLICYDB_VERSION_BOUNDARY)
1383 		to_read = 3;
1384 
1385 	rc = next_entry(buf, fp, sizeof(buf[0]) * to_read);
1386 	if (rc)
1387 		goto bad;
1388 
1389 	len = le32_to_cpu(buf[0]);
1390 	role->value = le32_to_cpu(buf[1]);
1391 	if (p->policyvers >= POLICYDB_VERSION_BOUNDARY)
1392 		role->bounds = le32_to_cpu(buf[2]);
1393 
1394 	rc = str_read(&key, GFP_KERNEL, fp, len);
1395 	if (rc)
1396 		goto bad;
1397 
1398 	rc = ebitmap_read(&role->dominates, fp);
1399 	if (rc)
1400 		goto bad;
1401 
1402 	rc = ebitmap_read(&role->types, fp);
1403 	if (rc)
1404 		goto bad;
1405 
1406 	if (strcmp(key, OBJECT_R) == 0) {
1407 		rc = -EINVAL;
1408 		if (role->value != OBJECT_R_VAL) {
1409 			pr_err("SELinux: Role %s has wrong value %d\n",
1410 			       OBJECT_R, role->value);
1411 			goto bad;
1412 		}
1413 		rc = 0;
1414 		goto bad;
1415 	}
1416 
1417 	rc = hashtab_insert(h, key, role);
1418 	if (rc)
1419 		goto bad;
1420 	return 0;
1421 bad:
1422 	role_destroy(key, role, NULL);
1423 	return rc;
1424 }
1425 
1426 static int type_read(struct policydb *p, struct hashtab *h, void *fp)
1427 {
1428 	char *key = NULL;
1429 	struct type_datum *typdatum;
1430 	int rc, to_read = 3;
1431 	__le32 buf[4];
1432 	u32 len;
1433 
1434 	typdatum = kzalloc(sizeof(*typdatum), GFP_KERNEL);
1435 	if (!typdatum)
1436 		return -ENOMEM;
1437 
1438 	if (p->policyvers >= POLICYDB_VERSION_BOUNDARY)
1439 		to_read = 4;
1440 
1441 	rc = next_entry(buf, fp, sizeof(buf[0]) * to_read);
1442 	if (rc)
1443 		goto bad;
1444 
1445 	len = le32_to_cpu(buf[0]);
1446 	typdatum->value = le32_to_cpu(buf[1]);
1447 	if (p->policyvers >= POLICYDB_VERSION_BOUNDARY) {
1448 		u32 prop = le32_to_cpu(buf[2]);
1449 
1450 		if (prop & TYPEDATUM_PROPERTY_PRIMARY)
1451 			typdatum->primary = 1;
1452 		if (prop & TYPEDATUM_PROPERTY_ATTRIBUTE)
1453 			typdatum->attribute = 1;
1454 
1455 		typdatum->bounds = le32_to_cpu(buf[3]);
1456 	} else {
1457 		typdatum->primary = le32_to_cpu(buf[2]);
1458 	}
1459 
1460 	rc = str_read(&key, GFP_KERNEL, fp, len);
1461 	if (rc)
1462 		goto bad;
1463 
1464 	rc = hashtab_insert(h, key, typdatum);
1465 	if (rc)
1466 		goto bad;
1467 	return 0;
1468 bad:
1469 	type_destroy(key, typdatum, NULL);
1470 	return rc;
1471 }
1472 
1473 
1474 /*
1475  * Read a MLS level structure from a policydb binary
1476  * representation file.
1477  */
1478 static int mls_read_level(struct mls_level *lp, void *fp)
1479 {
1480 	__le32 buf[1];
1481 	int rc;
1482 
1483 	memset(lp, 0, sizeof(*lp));
1484 
1485 	rc = next_entry(buf, fp, sizeof buf);
1486 	if (rc) {
1487 		pr_err("SELinux: mls: truncated level\n");
1488 		return rc;
1489 	}
1490 	lp->sens = le32_to_cpu(buf[0]);
1491 
1492 	rc = ebitmap_read(&lp->cat, fp);
1493 	if (rc) {
1494 		pr_err("SELinux: mls:  error reading level categories\n");
1495 		return rc;
1496 	}
1497 	return 0;
1498 }
1499 
1500 static int user_read(struct policydb *p, struct hashtab *h, void *fp)
1501 {
1502 	char *key = NULL;
1503 	struct user_datum *usrdatum;
1504 	int rc, to_read = 2;
1505 	__le32 buf[3];
1506 	u32 len;
1507 
1508 	usrdatum = kzalloc(sizeof(*usrdatum), GFP_KERNEL);
1509 	if (!usrdatum)
1510 		return -ENOMEM;
1511 
1512 	if (p->policyvers >= POLICYDB_VERSION_BOUNDARY)
1513 		to_read = 3;
1514 
1515 	rc = next_entry(buf, fp, sizeof(buf[0]) * to_read);
1516 	if (rc)
1517 		goto bad;
1518 
1519 	len = le32_to_cpu(buf[0]);
1520 	usrdatum->value = le32_to_cpu(buf[1]);
1521 	if (p->policyvers >= POLICYDB_VERSION_BOUNDARY)
1522 		usrdatum->bounds = le32_to_cpu(buf[2]);
1523 
1524 	rc = str_read(&key, GFP_KERNEL, fp, len);
1525 	if (rc)
1526 		goto bad;
1527 
1528 	rc = ebitmap_read(&usrdatum->roles, fp);
1529 	if (rc)
1530 		goto bad;
1531 
1532 	if (p->policyvers >= POLICYDB_VERSION_MLS) {
1533 		rc = mls_read_range_helper(&usrdatum->range, fp);
1534 		if (rc)
1535 			goto bad;
1536 		rc = mls_read_level(&usrdatum->dfltlevel, fp);
1537 		if (rc)
1538 			goto bad;
1539 	}
1540 
1541 	rc = hashtab_insert(h, key, usrdatum);
1542 	if (rc)
1543 		goto bad;
1544 	return 0;
1545 bad:
1546 	user_destroy(key, usrdatum, NULL);
1547 	return rc;
1548 }
1549 
1550 static int sens_read(struct policydb *p, struct hashtab *h, void *fp)
1551 {
1552 	char *key = NULL;
1553 	struct level_datum *levdatum;
1554 	int rc;
1555 	__le32 buf[2];
1556 	u32 len;
1557 
1558 	levdatum = kzalloc(sizeof(*levdatum), GFP_ATOMIC);
1559 	if (!levdatum)
1560 		return -ENOMEM;
1561 
1562 	rc = next_entry(buf, fp, sizeof buf);
1563 	if (rc)
1564 		goto bad;
1565 
1566 	len = le32_to_cpu(buf[0]);
1567 	levdatum->isalias = le32_to_cpu(buf[1]);
1568 
1569 	rc = str_read(&key, GFP_ATOMIC, fp, len);
1570 	if (rc)
1571 		goto bad;
1572 
1573 	rc = -ENOMEM;
1574 	levdatum->level = kmalloc(sizeof(*levdatum->level), GFP_ATOMIC);
1575 	if (!levdatum->level)
1576 		goto bad;
1577 
1578 	rc = mls_read_level(levdatum->level, fp);
1579 	if (rc)
1580 		goto bad;
1581 
1582 	rc = hashtab_insert(h, key, levdatum);
1583 	if (rc)
1584 		goto bad;
1585 	return 0;
1586 bad:
1587 	sens_destroy(key, levdatum, NULL);
1588 	return rc;
1589 }
1590 
1591 static int cat_read(struct policydb *p, struct hashtab *h, void *fp)
1592 {
1593 	char *key = NULL;
1594 	struct cat_datum *catdatum;
1595 	int rc;
1596 	__le32 buf[3];
1597 	u32 len;
1598 
1599 	catdatum = kzalloc(sizeof(*catdatum), GFP_ATOMIC);
1600 	if (!catdatum)
1601 		return -ENOMEM;
1602 
1603 	rc = next_entry(buf, fp, sizeof buf);
1604 	if (rc)
1605 		goto bad;
1606 
1607 	len = le32_to_cpu(buf[0]);
1608 	catdatum->value = le32_to_cpu(buf[1]);
1609 	catdatum->isalias = le32_to_cpu(buf[2]);
1610 
1611 	rc = str_read(&key, GFP_ATOMIC, fp, len);
1612 	if (rc)
1613 		goto bad;
1614 
1615 	rc = hashtab_insert(h, key, catdatum);
1616 	if (rc)
1617 		goto bad;
1618 	return 0;
1619 bad:
1620 	cat_destroy(key, catdatum, NULL);
1621 	return rc;
1622 }
1623 
1624 static int (*read_f[SYM_NUM]) (struct policydb *p, struct hashtab *h, void *fp) =
1625 {
1626 	common_read,
1627 	class_read,
1628 	role_read,
1629 	type_read,
1630 	user_read,
1631 	cond_read_bool,
1632 	sens_read,
1633 	cat_read,
1634 };
1635 
1636 static int user_bounds_sanity_check(void *key, void *datum, void *datap)
1637 {
1638 	struct user_datum *upper, *user;
1639 	struct policydb *p = datap;
1640 	int depth = 0;
1641 
1642 	upper = user = datum;
1643 	while (upper->bounds) {
1644 		struct ebitmap_node *node;
1645 		unsigned long bit;
1646 
1647 		if (++depth == POLICYDB_BOUNDS_MAXDEPTH) {
1648 			pr_err("SELinux: user %s: "
1649 			       "too deep or looped boundary",
1650 			       (char *) key);
1651 			return -EINVAL;
1652 		}
1653 
1654 		upper = p->user_val_to_struct[upper->bounds - 1];
1655 		ebitmap_for_each_positive_bit(&user->roles, node, bit) {
1656 			if (ebitmap_get_bit(&upper->roles, bit))
1657 				continue;
1658 
1659 			pr_err("SELinux: boundary violated policy: "
1660 			       "user=%s role=%s bounds=%s\n",
1661 			       sym_name(p, SYM_USERS, user->value - 1),
1662 			       sym_name(p, SYM_ROLES, bit),
1663 			       sym_name(p, SYM_USERS, upper->value - 1));
1664 
1665 			return -EINVAL;
1666 		}
1667 	}
1668 
1669 	return 0;
1670 }
1671 
1672 static int role_bounds_sanity_check(void *key, void *datum, void *datap)
1673 {
1674 	struct role_datum *upper, *role;
1675 	struct policydb *p = datap;
1676 	int depth = 0;
1677 
1678 	upper = role = datum;
1679 	while (upper->bounds) {
1680 		struct ebitmap_node *node;
1681 		unsigned long bit;
1682 
1683 		if (++depth == POLICYDB_BOUNDS_MAXDEPTH) {
1684 			pr_err("SELinux: role %s: "
1685 			       "too deep or looped bounds\n",
1686 			       (char *) key);
1687 			return -EINVAL;
1688 		}
1689 
1690 		upper = p->role_val_to_struct[upper->bounds - 1];
1691 		ebitmap_for_each_positive_bit(&role->types, node, bit) {
1692 			if (ebitmap_get_bit(&upper->types, bit))
1693 				continue;
1694 
1695 			pr_err("SELinux: boundary violated policy: "
1696 			       "role=%s type=%s bounds=%s\n",
1697 			       sym_name(p, SYM_ROLES, role->value - 1),
1698 			       sym_name(p, SYM_TYPES, bit),
1699 			       sym_name(p, SYM_ROLES, upper->value - 1));
1700 
1701 			return -EINVAL;
1702 		}
1703 	}
1704 
1705 	return 0;
1706 }
1707 
1708 static int type_bounds_sanity_check(void *key, void *datum, void *datap)
1709 {
1710 	struct type_datum *upper;
1711 	struct policydb *p = datap;
1712 	int depth = 0;
1713 
1714 	upper = datum;
1715 	while (upper->bounds) {
1716 		if (++depth == POLICYDB_BOUNDS_MAXDEPTH) {
1717 			pr_err("SELinux: type %s: "
1718 			       "too deep or looped boundary\n",
1719 			       (char *) key);
1720 			return -EINVAL;
1721 		}
1722 
1723 		upper = p->type_val_to_struct_array[upper->bounds - 1];
1724 		BUG_ON(!upper);
1725 
1726 		if (upper->attribute) {
1727 			pr_err("SELinux: type %s: "
1728 			       "bounded by attribute %s",
1729 			       (char *) key,
1730 			       sym_name(p, SYM_TYPES, upper->value - 1));
1731 			return -EINVAL;
1732 		}
1733 	}
1734 
1735 	return 0;
1736 }
1737 
1738 static int policydb_bounds_sanity_check(struct policydb *p)
1739 {
1740 	int rc;
1741 
1742 	if (p->policyvers < POLICYDB_VERSION_BOUNDARY)
1743 		return 0;
1744 
1745 	rc = hashtab_map(p->p_users.table,
1746 			 user_bounds_sanity_check, p);
1747 	if (rc)
1748 		return rc;
1749 
1750 	rc = hashtab_map(p->p_roles.table,
1751 			 role_bounds_sanity_check, p);
1752 	if (rc)
1753 		return rc;
1754 
1755 	rc = hashtab_map(p->p_types.table,
1756 			 type_bounds_sanity_check, p);
1757 	if (rc)
1758 		return rc;
1759 
1760 	return 0;
1761 }
1762 
1763 u16 string_to_security_class(struct policydb *p, const char *name)
1764 {
1765 	struct class_datum *cladatum;
1766 
1767 	cladatum = hashtab_search(p->p_classes.table, name);
1768 	if (!cladatum)
1769 		return 0;
1770 
1771 	return cladatum->value;
1772 }
1773 
1774 u32 string_to_av_perm(struct policydb *p, u16 tclass, const char *name)
1775 {
1776 	struct class_datum *cladatum;
1777 	struct perm_datum *perdatum = NULL;
1778 	struct common_datum *comdatum;
1779 
1780 	if (!tclass || tclass > p->p_classes.nprim)
1781 		return 0;
1782 
1783 	cladatum = p->class_val_to_struct[tclass-1];
1784 	comdatum = cladatum->comdatum;
1785 	if (comdatum)
1786 		perdatum = hashtab_search(comdatum->permissions.table,
1787 					  name);
1788 	if (!perdatum)
1789 		perdatum = hashtab_search(cladatum->permissions.table,
1790 					  name);
1791 	if (!perdatum)
1792 		return 0;
1793 
1794 	return 1U << (perdatum->value-1);
1795 }
1796 
1797 static int range_read(struct policydb *p, void *fp)
1798 {
1799 	struct range_trans *rt = NULL;
1800 	struct mls_range *r = NULL;
1801 	int i, rc;
1802 	__le32 buf[2];
1803 	u32 nel;
1804 
1805 	if (p->policyvers < POLICYDB_VERSION_MLS)
1806 		return 0;
1807 
1808 	rc = next_entry(buf, fp, sizeof(u32));
1809 	if (rc)
1810 		return rc;
1811 
1812 	nel = le32_to_cpu(buf[0]);
1813 	for (i = 0; i < nel; i++) {
1814 		rc = -ENOMEM;
1815 		rt = kzalloc(sizeof(*rt), GFP_KERNEL);
1816 		if (!rt)
1817 			goto out;
1818 
1819 		rc = next_entry(buf, fp, (sizeof(u32) * 2));
1820 		if (rc)
1821 			goto out;
1822 
1823 		rt->source_type = le32_to_cpu(buf[0]);
1824 		rt->target_type = le32_to_cpu(buf[1]);
1825 		if (p->policyvers >= POLICYDB_VERSION_RANGETRANS) {
1826 			rc = next_entry(buf, fp, sizeof(u32));
1827 			if (rc)
1828 				goto out;
1829 			rt->target_class = le32_to_cpu(buf[0]);
1830 		} else
1831 			rt->target_class = p->process_class;
1832 
1833 		rc = -EINVAL;
1834 		if (!policydb_type_isvalid(p, rt->source_type) ||
1835 		    !policydb_type_isvalid(p, rt->target_type) ||
1836 		    !policydb_class_isvalid(p, rt->target_class))
1837 			goto out;
1838 
1839 		rc = -ENOMEM;
1840 		r = kzalloc(sizeof(*r), GFP_KERNEL);
1841 		if (!r)
1842 			goto out;
1843 
1844 		rc = mls_read_range_helper(r, fp);
1845 		if (rc)
1846 			goto out;
1847 
1848 		rc = -EINVAL;
1849 		if (!mls_range_isvalid(p, r)) {
1850 			pr_warn("SELinux:  rangetrans:  invalid range\n");
1851 			goto out;
1852 		}
1853 
1854 		rc = hashtab_insert(p->range_tr, rt, r);
1855 		if (rc)
1856 			goto out;
1857 
1858 		rt = NULL;
1859 		r = NULL;
1860 	}
1861 	hash_eval(p->range_tr, "rangetr");
1862 	rc = 0;
1863 out:
1864 	kfree(rt);
1865 	kfree(r);
1866 	return rc;
1867 }
1868 
1869 static int filename_trans_read(struct policydb *p, void *fp)
1870 {
1871 	struct filename_trans *ft;
1872 	struct filename_trans_datum *otype;
1873 	char *name;
1874 	u32 nel, len;
1875 	__le32 buf[4];
1876 	int rc, i;
1877 
1878 	if (p->policyvers < POLICYDB_VERSION_FILENAME_TRANS)
1879 		return 0;
1880 
1881 	rc = next_entry(buf, fp, sizeof(u32));
1882 	if (rc)
1883 		return rc;
1884 	nel = le32_to_cpu(buf[0]);
1885 
1886 	for (i = 0; i < nel; i++) {
1887 		otype = NULL;
1888 		name = NULL;
1889 
1890 		rc = -ENOMEM;
1891 		ft = kzalloc(sizeof(*ft), GFP_KERNEL);
1892 		if (!ft)
1893 			goto out;
1894 
1895 		rc = -ENOMEM;
1896 		otype = kmalloc(sizeof(*otype), GFP_KERNEL);
1897 		if (!otype)
1898 			goto out;
1899 
1900 		/* length of the path component string */
1901 		rc = next_entry(buf, fp, sizeof(u32));
1902 		if (rc)
1903 			goto out;
1904 		len = le32_to_cpu(buf[0]);
1905 
1906 		/* path component string */
1907 		rc = str_read(&name, GFP_KERNEL, fp, len);
1908 		if (rc)
1909 			goto out;
1910 
1911 		ft->name = name;
1912 
1913 		rc = next_entry(buf, fp, sizeof(u32) * 4);
1914 		if (rc)
1915 			goto out;
1916 
1917 		ft->stype = le32_to_cpu(buf[0]);
1918 		ft->ttype = le32_to_cpu(buf[1]);
1919 		ft->tclass = le32_to_cpu(buf[2]);
1920 
1921 		otype->otype = le32_to_cpu(buf[3]);
1922 
1923 		rc = ebitmap_set_bit(&p->filename_trans_ttypes, ft->ttype, 1);
1924 		if (rc)
1925 			goto out;
1926 
1927 		rc = hashtab_insert(p->filename_trans, ft, otype);
1928 		if (rc) {
1929 			/*
1930 			 * Do not return -EEXIST to the caller, or the system
1931 			 * will not boot.
1932 			 */
1933 			if (rc != -EEXIST)
1934 				goto out;
1935 			/* But free memory to avoid memory leak. */
1936 			kfree(ft);
1937 			kfree(name);
1938 			kfree(otype);
1939 		}
1940 	}
1941 	hash_eval(p->filename_trans, "filenametr");
1942 	return 0;
1943 out:
1944 	kfree(ft);
1945 	kfree(name);
1946 	kfree(otype);
1947 
1948 	return rc;
1949 }
1950 
1951 static int genfs_read(struct policydb *p, void *fp)
1952 {
1953 	int i, j, rc;
1954 	u32 nel, nel2, len, len2;
1955 	__le32 buf[1];
1956 	struct ocontext *l, *c;
1957 	struct ocontext *newc = NULL;
1958 	struct genfs *genfs_p, *genfs;
1959 	struct genfs *newgenfs = NULL;
1960 
1961 	rc = next_entry(buf, fp, sizeof(u32));
1962 	if (rc)
1963 		return rc;
1964 	nel = le32_to_cpu(buf[0]);
1965 
1966 	for (i = 0; i < nel; i++) {
1967 		rc = next_entry(buf, fp, sizeof(u32));
1968 		if (rc)
1969 			goto out;
1970 		len = le32_to_cpu(buf[0]);
1971 
1972 		rc = -ENOMEM;
1973 		newgenfs = kzalloc(sizeof(*newgenfs), GFP_KERNEL);
1974 		if (!newgenfs)
1975 			goto out;
1976 
1977 		rc = str_read(&newgenfs->fstype, GFP_KERNEL, fp, len);
1978 		if (rc)
1979 			goto out;
1980 
1981 		for (genfs_p = NULL, genfs = p->genfs; genfs;
1982 		     genfs_p = genfs, genfs = genfs->next) {
1983 			rc = -EINVAL;
1984 			if (strcmp(newgenfs->fstype, genfs->fstype) == 0) {
1985 				pr_err("SELinux:  dup genfs fstype %s\n",
1986 				       newgenfs->fstype);
1987 				goto out;
1988 			}
1989 			if (strcmp(newgenfs->fstype, genfs->fstype) < 0)
1990 				break;
1991 		}
1992 		newgenfs->next = genfs;
1993 		if (genfs_p)
1994 			genfs_p->next = newgenfs;
1995 		else
1996 			p->genfs = newgenfs;
1997 		genfs = newgenfs;
1998 		newgenfs = NULL;
1999 
2000 		rc = next_entry(buf, fp, sizeof(u32));
2001 		if (rc)
2002 			goto out;
2003 
2004 		nel2 = le32_to_cpu(buf[0]);
2005 		for (j = 0; j < nel2; j++) {
2006 			rc = next_entry(buf, fp, sizeof(u32));
2007 			if (rc)
2008 				goto out;
2009 			len = le32_to_cpu(buf[0]);
2010 
2011 			rc = -ENOMEM;
2012 			newc = kzalloc(sizeof(*newc), GFP_KERNEL);
2013 			if (!newc)
2014 				goto out;
2015 
2016 			rc = str_read(&newc->u.name, GFP_KERNEL, fp, len);
2017 			if (rc)
2018 				goto out;
2019 
2020 			rc = next_entry(buf, fp, sizeof(u32));
2021 			if (rc)
2022 				goto out;
2023 
2024 			newc->v.sclass = le32_to_cpu(buf[0]);
2025 			rc = context_read_and_validate(&newc->context[0], p, fp);
2026 			if (rc)
2027 				goto out;
2028 
2029 			for (l = NULL, c = genfs->head; c;
2030 			     l = c, c = c->next) {
2031 				rc = -EINVAL;
2032 				if (!strcmp(newc->u.name, c->u.name) &&
2033 				    (!c->v.sclass || !newc->v.sclass ||
2034 				     newc->v.sclass == c->v.sclass)) {
2035 					pr_err("SELinux:  dup genfs entry (%s,%s)\n",
2036 					       genfs->fstype, c->u.name);
2037 					goto out;
2038 				}
2039 				len = strlen(newc->u.name);
2040 				len2 = strlen(c->u.name);
2041 				if (len > len2)
2042 					break;
2043 			}
2044 
2045 			newc->next = c;
2046 			if (l)
2047 				l->next = newc;
2048 			else
2049 				genfs->head = newc;
2050 			newc = NULL;
2051 		}
2052 	}
2053 	rc = 0;
2054 out:
2055 	if (newgenfs) {
2056 		kfree(newgenfs->fstype);
2057 		kfree(newgenfs);
2058 	}
2059 	ocontext_destroy(newc, OCON_FSUSE);
2060 
2061 	return rc;
2062 }
2063 
2064 static int ocontext_read(struct policydb *p, struct policydb_compat_info *info,
2065 			 void *fp)
2066 {
2067 	int i, j, rc;
2068 	u32 nel, len;
2069 	__be64 prefixbuf[1];
2070 	__le32 buf[3];
2071 	struct ocontext *l, *c;
2072 	u32 nodebuf[8];
2073 
2074 	for (i = 0; i < info->ocon_num; i++) {
2075 		rc = next_entry(buf, fp, sizeof(u32));
2076 		if (rc)
2077 			goto out;
2078 		nel = le32_to_cpu(buf[0]);
2079 
2080 		l = NULL;
2081 		for (j = 0; j < nel; j++) {
2082 			rc = -ENOMEM;
2083 			c = kzalloc(sizeof(*c), GFP_KERNEL);
2084 			if (!c)
2085 				goto out;
2086 			if (l)
2087 				l->next = c;
2088 			else
2089 				p->ocontexts[i] = c;
2090 			l = c;
2091 
2092 			switch (i) {
2093 			case OCON_ISID:
2094 				rc = next_entry(buf, fp, sizeof(u32));
2095 				if (rc)
2096 					goto out;
2097 
2098 				c->sid[0] = le32_to_cpu(buf[0]);
2099 				rc = context_read_and_validate(&c->context[0], p, fp);
2100 				if (rc)
2101 					goto out;
2102 				break;
2103 			case OCON_FS:
2104 			case OCON_NETIF:
2105 				rc = next_entry(buf, fp, sizeof(u32));
2106 				if (rc)
2107 					goto out;
2108 				len = le32_to_cpu(buf[0]);
2109 
2110 				rc = str_read(&c->u.name, GFP_KERNEL, fp, len);
2111 				if (rc)
2112 					goto out;
2113 
2114 				rc = context_read_and_validate(&c->context[0], p, fp);
2115 				if (rc)
2116 					goto out;
2117 				rc = context_read_and_validate(&c->context[1], p, fp);
2118 				if (rc)
2119 					goto out;
2120 				break;
2121 			case OCON_PORT:
2122 				rc = next_entry(buf, fp, sizeof(u32)*3);
2123 				if (rc)
2124 					goto out;
2125 				c->u.port.protocol = le32_to_cpu(buf[0]);
2126 				c->u.port.low_port = le32_to_cpu(buf[1]);
2127 				c->u.port.high_port = le32_to_cpu(buf[2]);
2128 				rc = context_read_and_validate(&c->context[0], p, fp);
2129 				if (rc)
2130 					goto out;
2131 				break;
2132 			case OCON_NODE:
2133 				rc = next_entry(nodebuf, fp, sizeof(u32) * 2);
2134 				if (rc)
2135 					goto out;
2136 				c->u.node.addr = nodebuf[0]; /* network order */
2137 				c->u.node.mask = nodebuf[1]; /* network order */
2138 				rc = context_read_and_validate(&c->context[0], p, fp);
2139 				if (rc)
2140 					goto out;
2141 				break;
2142 			case OCON_FSUSE:
2143 				rc = next_entry(buf, fp, sizeof(u32)*2);
2144 				if (rc)
2145 					goto out;
2146 
2147 				rc = -EINVAL;
2148 				c->v.behavior = le32_to_cpu(buf[0]);
2149 				/* Determined at runtime, not in policy DB. */
2150 				if (c->v.behavior == SECURITY_FS_USE_MNTPOINT)
2151 					goto out;
2152 				if (c->v.behavior > SECURITY_FS_USE_MAX)
2153 					goto out;
2154 
2155 				len = le32_to_cpu(buf[1]);
2156 				rc = str_read(&c->u.name, GFP_KERNEL, fp, len);
2157 				if (rc)
2158 					goto out;
2159 
2160 				rc = context_read_and_validate(&c->context[0], p, fp);
2161 				if (rc)
2162 					goto out;
2163 				break;
2164 			case OCON_NODE6: {
2165 				int k;
2166 
2167 				rc = next_entry(nodebuf, fp, sizeof(u32) * 8);
2168 				if (rc)
2169 					goto out;
2170 				for (k = 0; k < 4; k++)
2171 					c->u.node6.addr[k] = nodebuf[k];
2172 				for (k = 0; k < 4; k++)
2173 					c->u.node6.mask[k] = nodebuf[k+4];
2174 				rc = context_read_and_validate(&c->context[0], p, fp);
2175 				if (rc)
2176 					goto out;
2177 				break;
2178 			}
2179 			case OCON_IBPKEY: {
2180 				u32 pkey_lo, pkey_hi;
2181 
2182 				rc = next_entry(prefixbuf, fp, sizeof(u64));
2183 				if (rc)
2184 					goto out;
2185 
2186 				/* we need to have subnet_prefix in CPU order */
2187 				c->u.ibpkey.subnet_prefix = be64_to_cpu(prefixbuf[0]);
2188 
2189 				rc = next_entry(buf, fp, sizeof(u32) * 2);
2190 				if (rc)
2191 					goto out;
2192 
2193 				pkey_lo = le32_to_cpu(buf[0]);
2194 				pkey_hi = le32_to_cpu(buf[1]);
2195 
2196 				if (pkey_lo > U16_MAX || pkey_hi > U16_MAX) {
2197 					rc = -EINVAL;
2198 					goto out;
2199 				}
2200 
2201 				c->u.ibpkey.low_pkey  = pkey_lo;
2202 				c->u.ibpkey.high_pkey = pkey_hi;
2203 
2204 				rc = context_read_and_validate(&c->context[0],
2205 							       p,
2206 							       fp);
2207 				if (rc)
2208 					goto out;
2209 				break;
2210 			}
2211 			case OCON_IBENDPORT: {
2212 				u32 port;
2213 
2214 				rc = next_entry(buf, fp, sizeof(u32) * 2);
2215 				if (rc)
2216 					goto out;
2217 				len = le32_to_cpu(buf[0]);
2218 
2219 				rc = str_read(&c->u.ibendport.dev_name, GFP_KERNEL, fp, len);
2220 				if (rc)
2221 					goto out;
2222 
2223 				port = le32_to_cpu(buf[1]);
2224 				if (port > U8_MAX || port == 0) {
2225 					rc = -EINVAL;
2226 					goto out;
2227 				}
2228 
2229 				c->u.ibendport.port = port;
2230 
2231 				rc = context_read_and_validate(&c->context[0],
2232 							       p,
2233 							       fp);
2234 				if (rc)
2235 					goto out;
2236 				break;
2237 			} /* end case */
2238 			} /* end switch */
2239 		}
2240 	}
2241 	rc = 0;
2242 out:
2243 	return rc;
2244 }
2245 
2246 /*
2247  * Read the configuration data from a policy database binary
2248  * representation file into a policy database structure.
2249  */
2250 int policydb_read(struct policydb *p, void *fp)
2251 {
2252 	struct role_allow *ra, *lra;
2253 	struct role_trans *tr, *ltr;
2254 	int i, j, rc;
2255 	__le32 buf[4];
2256 	u32 len, nprim, nel;
2257 
2258 	char *policydb_str;
2259 	struct policydb_compat_info *info;
2260 
2261 	rc = policydb_init(p);
2262 	if (rc)
2263 		return rc;
2264 
2265 	/* Read the magic number and string length. */
2266 	rc = next_entry(buf, fp, sizeof(u32) * 2);
2267 	if (rc)
2268 		goto bad;
2269 
2270 	rc = -EINVAL;
2271 	if (le32_to_cpu(buf[0]) != POLICYDB_MAGIC) {
2272 		pr_err("SELinux:  policydb magic number 0x%x does "
2273 		       "not match expected magic number 0x%x\n",
2274 		       le32_to_cpu(buf[0]), POLICYDB_MAGIC);
2275 		goto bad;
2276 	}
2277 
2278 	rc = -EINVAL;
2279 	len = le32_to_cpu(buf[1]);
2280 	if (len != strlen(POLICYDB_STRING)) {
2281 		pr_err("SELinux:  policydb string length %d does not "
2282 		       "match expected length %zu\n",
2283 		       len, strlen(POLICYDB_STRING));
2284 		goto bad;
2285 	}
2286 
2287 	rc = -ENOMEM;
2288 	policydb_str = kmalloc(len + 1, GFP_KERNEL);
2289 	if (!policydb_str) {
2290 		pr_err("SELinux:  unable to allocate memory for policydb "
2291 		       "string of length %d\n", len);
2292 		goto bad;
2293 	}
2294 
2295 	rc = next_entry(policydb_str, fp, len);
2296 	if (rc) {
2297 		pr_err("SELinux:  truncated policydb string identifier\n");
2298 		kfree(policydb_str);
2299 		goto bad;
2300 	}
2301 
2302 	rc = -EINVAL;
2303 	policydb_str[len] = '\0';
2304 	if (strcmp(policydb_str, POLICYDB_STRING)) {
2305 		pr_err("SELinux:  policydb string %s does not match "
2306 		       "my string %s\n", policydb_str, POLICYDB_STRING);
2307 		kfree(policydb_str);
2308 		goto bad;
2309 	}
2310 	/* Done with policydb_str. */
2311 	kfree(policydb_str);
2312 	policydb_str = NULL;
2313 
2314 	/* Read the version and table sizes. */
2315 	rc = next_entry(buf, fp, sizeof(u32)*4);
2316 	if (rc)
2317 		goto bad;
2318 
2319 	rc = -EINVAL;
2320 	p->policyvers = le32_to_cpu(buf[0]);
2321 	if (p->policyvers < POLICYDB_VERSION_MIN ||
2322 	    p->policyvers > POLICYDB_VERSION_MAX) {
2323 		pr_err("SELinux:  policydb version %d does not match "
2324 		       "my version range %d-%d\n",
2325 		       le32_to_cpu(buf[0]), POLICYDB_VERSION_MIN, POLICYDB_VERSION_MAX);
2326 		goto bad;
2327 	}
2328 
2329 	if ((le32_to_cpu(buf[1]) & POLICYDB_CONFIG_MLS)) {
2330 		p->mls_enabled = 1;
2331 
2332 		rc = -EINVAL;
2333 		if (p->policyvers < POLICYDB_VERSION_MLS) {
2334 			pr_err("SELinux: security policydb version %d "
2335 				"(MLS) not backwards compatible\n",
2336 				p->policyvers);
2337 			goto bad;
2338 		}
2339 	}
2340 	p->reject_unknown = !!(le32_to_cpu(buf[1]) & REJECT_UNKNOWN);
2341 	p->allow_unknown = !!(le32_to_cpu(buf[1]) & ALLOW_UNKNOWN);
2342 
2343 	if (p->policyvers >= POLICYDB_VERSION_POLCAP) {
2344 		rc = ebitmap_read(&p->policycaps, fp);
2345 		if (rc)
2346 			goto bad;
2347 	}
2348 
2349 	if (p->policyvers >= POLICYDB_VERSION_PERMISSIVE) {
2350 		rc = ebitmap_read(&p->permissive_map, fp);
2351 		if (rc)
2352 			goto bad;
2353 	}
2354 
2355 	rc = -EINVAL;
2356 	info = policydb_lookup_compat(p->policyvers);
2357 	if (!info) {
2358 		pr_err("SELinux:  unable to find policy compat info "
2359 		       "for version %d\n", p->policyvers);
2360 		goto bad;
2361 	}
2362 
2363 	rc = -EINVAL;
2364 	if (le32_to_cpu(buf[2]) != info->sym_num ||
2365 		le32_to_cpu(buf[3]) != info->ocon_num) {
2366 		pr_err("SELinux:  policydb table sizes (%d,%d) do "
2367 		       "not match mine (%d,%d)\n", le32_to_cpu(buf[2]),
2368 			le32_to_cpu(buf[3]),
2369 		       info->sym_num, info->ocon_num);
2370 		goto bad;
2371 	}
2372 
2373 	for (i = 0; i < info->sym_num; i++) {
2374 		rc = next_entry(buf, fp, sizeof(u32)*2);
2375 		if (rc)
2376 			goto bad;
2377 		nprim = le32_to_cpu(buf[0]);
2378 		nel = le32_to_cpu(buf[1]);
2379 		for (j = 0; j < nel; j++) {
2380 			rc = read_f[i](p, p->symtab[i].table, fp);
2381 			if (rc)
2382 				goto bad;
2383 		}
2384 
2385 		p->symtab[i].nprim = nprim;
2386 	}
2387 
2388 	rc = -EINVAL;
2389 	p->process_class = string_to_security_class(p, "process");
2390 	if (!p->process_class)
2391 		goto bad;
2392 
2393 	rc = avtab_read(&p->te_avtab, fp, p);
2394 	if (rc)
2395 		goto bad;
2396 
2397 	if (p->policyvers >= POLICYDB_VERSION_BOOL) {
2398 		rc = cond_read_list(p, fp);
2399 		if (rc)
2400 			goto bad;
2401 	}
2402 
2403 	rc = next_entry(buf, fp, sizeof(u32));
2404 	if (rc)
2405 		goto bad;
2406 	nel = le32_to_cpu(buf[0]);
2407 	ltr = NULL;
2408 	for (i = 0; i < nel; i++) {
2409 		rc = -ENOMEM;
2410 		tr = kzalloc(sizeof(*tr), GFP_KERNEL);
2411 		if (!tr)
2412 			goto bad;
2413 		if (ltr)
2414 			ltr->next = tr;
2415 		else
2416 			p->role_tr = tr;
2417 		rc = next_entry(buf, fp, sizeof(u32)*3);
2418 		if (rc)
2419 			goto bad;
2420 
2421 		rc = -EINVAL;
2422 		tr->role = le32_to_cpu(buf[0]);
2423 		tr->type = le32_to_cpu(buf[1]);
2424 		tr->new_role = le32_to_cpu(buf[2]);
2425 		if (p->policyvers >= POLICYDB_VERSION_ROLETRANS) {
2426 			rc = next_entry(buf, fp, sizeof(u32));
2427 			if (rc)
2428 				goto bad;
2429 			tr->tclass = le32_to_cpu(buf[0]);
2430 		} else
2431 			tr->tclass = p->process_class;
2432 
2433 		rc = -EINVAL;
2434 		if (!policydb_role_isvalid(p, tr->role) ||
2435 		    !policydb_type_isvalid(p, tr->type) ||
2436 		    !policydb_class_isvalid(p, tr->tclass) ||
2437 		    !policydb_role_isvalid(p, tr->new_role))
2438 			goto bad;
2439 		ltr = tr;
2440 	}
2441 
2442 	rc = next_entry(buf, fp, sizeof(u32));
2443 	if (rc)
2444 		goto bad;
2445 	nel = le32_to_cpu(buf[0]);
2446 	lra = NULL;
2447 	for (i = 0; i < nel; i++) {
2448 		rc = -ENOMEM;
2449 		ra = kzalloc(sizeof(*ra), GFP_KERNEL);
2450 		if (!ra)
2451 			goto bad;
2452 		if (lra)
2453 			lra->next = ra;
2454 		else
2455 			p->role_allow = ra;
2456 		rc = next_entry(buf, fp, sizeof(u32)*2);
2457 		if (rc)
2458 			goto bad;
2459 
2460 		rc = -EINVAL;
2461 		ra->role = le32_to_cpu(buf[0]);
2462 		ra->new_role = le32_to_cpu(buf[1]);
2463 		if (!policydb_role_isvalid(p, ra->role) ||
2464 		    !policydb_role_isvalid(p, ra->new_role))
2465 			goto bad;
2466 		lra = ra;
2467 	}
2468 
2469 	rc = filename_trans_read(p, fp);
2470 	if (rc)
2471 		goto bad;
2472 
2473 	rc = policydb_index(p);
2474 	if (rc)
2475 		goto bad;
2476 
2477 	rc = -EINVAL;
2478 	p->process_trans_perms = string_to_av_perm(p, p->process_class, "transition");
2479 	p->process_trans_perms |= string_to_av_perm(p, p->process_class, "dyntransition");
2480 	if (!p->process_trans_perms)
2481 		goto bad;
2482 
2483 	rc = ocontext_read(p, info, fp);
2484 	if (rc)
2485 		goto bad;
2486 
2487 	rc = genfs_read(p, fp);
2488 	if (rc)
2489 		goto bad;
2490 
2491 	rc = range_read(p, fp);
2492 	if (rc)
2493 		goto bad;
2494 
2495 	p->type_attr_map_array = kvcalloc(p->p_types.nprim,
2496 					  sizeof(*p->type_attr_map_array),
2497 					  GFP_KERNEL);
2498 	if (!p->type_attr_map_array)
2499 		goto bad;
2500 
2501 	/* just in case ebitmap_init() becomes more than just a memset(0): */
2502 	for (i = 0; i < p->p_types.nprim; i++)
2503 		ebitmap_init(&p->type_attr_map_array[i]);
2504 
2505 	for (i = 0; i < p->p_types.nprim; i++) {
2506 		struct ebitmap *e = &p->type_attr_map_array[i];
2507 
2508 		if (p->policyvers >= POLICYDB_VERSION_AVTAB) {
2509 			rc = ebitmap_read(e, fp);
2510 			if (rc)
2511 				goto bad;
2512 		}
2513 		/* add the type itself as the degenerate case */
2514 		rc = ebitmap_set_bit(e, i, 1);
2515 		if (rc)
2516 			goto bad;
2517 	}
2518 
2519 	rc = policydb_bounds_sanity_check(p);
2520 	if (rc)
2521 		goto bad;
2522 
2523 	rc = 0;
2524 out:
2525 	return rc;
2526 bad:
2527 	policydb_destroy(p);
2528 	goto out;
2529 }
2530 
2531 /*
2532  * Write a MLS level structure to a policydb binary
2533  * representation file.
2534  */
2535 static int mls_write_level(struct mls_level *l, void *fp)
2536 {
2537 	__le32 buf[1];
2538 	int rc;
2539 
2540 	buf[0] = cpu_to_le32(l->sens);
2541 	rc = put_entry(buf, sizeof(u32), 1, fp);
2542 	if (rc)
2543 		return rc;
2544 
2545 	rc = ebitmap_write(&l->cat, fp);
2546 	if (rc)
2547 		return rc;
2548 
2549 	return 0;
2550 }
2551 
2552 /*
2553  * Write a MLS range structure to a policydb binary
2554  * representation file.
2555  */
2556 static int mls_write_range_helper(struct mls_range *r, void *fp)
2557 {
2558 	__le32 buf[3];
2559 	size_t items;
2560 	int rc, eq;
2561 
2562 	eq = mls_level_eq(&r->level[1], &r->level[0]);
2563 
2564 	if (eq)
2565 		items = 2;
2566 	else
2567 		items = 3;
2568 	buf[0] = cpu_to_le32(items-1);
2569 	buf[1] = cpu_to_le32(r->level[0].sens);
2570 	if (!eq)
2571 		buf[2] = cpu_to_le32(r->level[1].sens);
2572 
2573 	BUG_ON(items > ARRAY_SIZE(buf));
2574 
2575 	rc = put_entry(buf, sizeof(u32), items, fp);
2576 	if (rc)
2577 		return rc;
2578 
2579 	rc = ebitmap_write(&r->level[0].cat, fp);
2580 	if (rc)
2581 		return rc;
2582 	if (!eq) {
2583 		rc = ebitmap_write(&r->level[1].cat, fp);
2584 		if (rc)
2585 			return rc;
2586 	}
2587 
2588 	return 0;
2589 }
2590 
2591 static int sens_write(void *vkey, void *datum, void *ptr)
2592 {
2593 	char *key = vkey;
2594 	struct level_datum *levdatum = datum;
2595 	struct policy_data *pd = ptr;
2596 	void *fp = pd->fp;
2597 	__le32 buf[2];
2598 	size_t len;
2599 	int rc;
2600 
2601 	len = strlen(key);
2602 	buf[0] = cpu_to_le32(len);
2603 	buf[1] = cpu_to_le32(levdatum->isalias);
2604 	rc = put_entry(buf, sizeof(u32), 2, fp);
2605 	if (rc)
2606 		return rc;
2607 
2608 	rc = put_entry(key, 1, len, fp);
2609 	if (rc)
2610 		return rc;
2611 
2612 	rc = mls_write_level(levdatum->level, fp);
2613 	if (rc)
2614 		return rc;
2615 
2616 	return 0;
2617 }
2618 
2619 static int cat_write(void *vkey, void *datum, void *ptr)
2620 {
2621 	char *key = vkey;
2622 	struct cat_datum *catdatum = datum;
2623 	struct policy_data *pd = ptr;
2624 	void *fp = pd->fp;
2625 	__le32 buf[3];
2626 	size_t len;
2627 	int rc;
2628 
2629 	len = strlen(key);
2630 	buf[0] = cpu_to_le32(len);
2631 	buf[1] = cpu_to_le32(catdatum->value);
2632 	buf[2] = cpu_to_le32(catdatum->isalias);
2633 	rc = put_entry(buf, sizeof(u32), 3, fp);
2634 	if (rc)
2635 		return rc;
2636 
2637 	rc = put_entry(key, 1, len, fp);
2638 	if (rc)
2639 		return rc;
2640 
2641 	return 0;
2642 }
2643 
2644 static int role_trans_write(struct policydb *p, void *fp)
2645 {
2646 	struct role_trans *r = p->role_tr;
2647 	struct role_trans *tr;
2648 	u32 buf[3];
2649 	size_t nel;
2650 	int rc;
2651 
2652 	nel = 0;
2653 	for (tr = r; tr; tr = tr->next)
2654 		nel++;
2655 	buf[0] = cpu_to_le32(nel);
2656 	rc = put_entry(buf, sizeof(u32), 1, fp);
2657 	if (rc)
2658 		return rc;
2659 	for (tr = r; tr; tr = tr->next) {
2660 		buf[0] = cpu_to_le32(tr->role);
2661 		buf[1] = cpu_to_le32(tr->type);
2662 		buf[2] = cpu_to_le32(tr->new_role);
2663 		rc = put_entry(buf, sizeof(u32), 3, fp);
2664 		if (rc)
2665 			return rc;
2666 		if (p->policyvers >= POLICYDB_VERSION_ROLETRANS) {
2667 			buf[0] = cpu_to_le32(tr->tclass);
2668 			rc = put_entry(buf, sizeof(u32), 1, fp);
2669 			if (rc)
2670 				return rc;
2671 		}
2672 	}
2673 
2674 	return 0;
2675 }
2676 
2677 static int role_allow_write(struct role_allow *r, void *fp)
2678 {
2679 	struct role_allow *ra;
2680 	u32 buf[2];
2681 	size_t nel;
2682 	int rc;
2683 
2684 	nel = 0;
2685 	for (ra = r; ra; ra = ra->next)
2686 		nel++;
2687 	buf[0] = cpu_to_le32(nel);
2688 	rc = put_entry(buf, sizeof(u32), 1, fp);
2689 	if (rc)
2690 		return rc;
2691 	for (ra = r; ra; ra = ra->next) {
2692 		buf[0] = cpu_to_le32(ra->role);
2693 		buf[1] = cpu_to_le32(ra->new_role);
2694 		rc = put_entry(buf, sizeof(u32), 2, fp);
2695 		if (rc)
2696 			return rc;
2697 	}
2698 	return 0;
2699 }
2700 
2701 /*
2702  * Write a security context structure
2703  * to a policydb binary representation file.
2704  */
2705 static int context_write(struct policydb *p, struct context *c,
2706 			 void *fp)
2707 {
2708 	int rc;
2709 	__le32 buf[3];
2710 
2711 	buf[0] = cpu_to_le32(c->user);
2712 	buf[1] = cpu_to_le32(c->role);
2713 	buf[2] = cpu_to_le32(c->type);
2714 
2715 	rc = put_entry(buf, sizeof(u32), 3, fp);
2716 	if (rc)
2717 		return rc;
2718 
2719 	rc = mls_write_range_helper(&c->range, fp);
2720 	if (rc)
2721 		return rc;
2722 
2723 	return 0;
2724 }
2725 
2726 /*
2727  * The following *_write functions are used to
2728  * write the symbol data to a policy database
2729  * binary representation file.
2730  */
2731 
2732 static int perm_write(void *vkey, void *datum, void *fp)
2733 {
2734 	char *key = vkey;
2735 	struct perm_datum *perdatum = datum;
2736 	__le32 buf[2];
2737 	size_t len;
2738 	int rc;
2739 
2740 	len = strlen(key);
2741 	buf[0] = cpu_to_le32(len);
2742 	buf[1] = cpu_to_le32(perdatum->value);
2743 	rc = put_entry(buf, sizeof(u32), 2, fp);
2744 	if (rc)
2745 		return rc;
2746 
2747 	rc = put_entry(key, 1, len, fp);
2748 	if (rc)
2749 		return rc;
2750 
2751 	return 0;
2752 }
2753 
2754 static int common_write(void *vkey, void *datum, void *ptr)
2755 {
2756 	char *key = vkey;
2757 	struct common_datum *comdatum = datum;
2758 	struct policy_data *pd = ptr;
2759 	void *fp = pd->fp;
2760 	__le32 buf[4];
2761 	size_t len;
2762 	int rc;
2763 
2764 	len = strlen(key);
2765 	buf[0] = cpu_to_le32(len);
2766 	buf[1] = cpu_to_le32(comdatum->value);
2767 	buf[2] = cpu_to_le32(comdatum->permissions.nprim);
2768 	buf[3] = cpu_to_le32(comdatum->permissions.table->nel);
2769 	rc = put_entry(buf, sizeof(u32), 4, fp);
2770 	if (rc)
2771 		return rc;
2772 
2773 	rc = put_entry(key, 1, len, fp);
2774 	if (rc)
2775 		return rc;
2776 
2777 	rc = hashtab_map(comdatum->permissions.table, perm_write, fp);
2778 	if (rc)
2779 		return rc;
2780 
2781 	return 0;
2782 }
2783 
2784 static int type_set_write(struct type_set *t, void *fp)
2785 {
2786 	int rc;
2787 	__le32 buf[1];
2788 
2789 	if (ebitmap_write(&t->types, fp))
2790 		return -EINVAL;
2791 	if (ebitmap_write(&t->negset, fp))
2792 		return -EINVAL;
2793 
2794 	buf[0] = cpu_to_le32(t->flags);
2795 	rc = put_entry(buf, sizeof(u32), 1, fp);
2796 	if (rc)
2797 		return -EINVAL;
2798 
2799 	return 0;
2800 }
2801 
2802 static int write_cons_helper(struct policydb *p, struct constraint_node *node,
2803 			     void *fp)
2804 {
2805 	struct constraint_node *c;
2806 	struct constraint_expr *e;
2807 	__le32 buf[3];
2808 	u32 nel;
2809 	int rc;
2810 
2811 	for (c = node; c; c = c->next) {
2812 		nel = 0;
2813 		for (e = c->expr; e; e = e->next)
2814 			nel++;
2815 		buf[0] = cpu_to_le32(c->permissions);
2816 		buf[1] = cpu_to_le32(nel);
2817 		rc = put_entry(buf, sizeof(u32), 2, fp);
2818 		if (rc)
2819 			return rc;
2820 		for (e = c->expr; e; e = e->next) {
2821 			buf[0] = cpu_to_le32(e->expr_type);
2822 			buf[1] = cpu_to_le32(e->attr);
2823 			buf[2] = cpu_to_le32(e->op);
2824 			rc = put_entry(buf, sizeof(u32), 3, fp);
2825 			if (rc)
2826 				return rc;
2827 
2828 			switch (e->expr_type) {
2829 			case CEXPR_NAMES:
2830 				rc = ebitmap_write(&e->names, fp);
2831 				if (rc)
2832 					return rc;
2833 				if (p->policyvers >=
2834 					POLICYDB_VERSION_CONSTRAINT_NAMES) {
2835 					rc = type_set_write(e->type_names, fp);
2836 					if (rc)
2837 						return rc;
2838 				}
2839 				break;
2840 			default:
2841 				break;
2842 			}
2843 		}
2844 	}
2845 
2846 	return 0;
2847 }
2848 
2849 static int class_write(void *vkey, void *datum, void *ptr)
2850 {
2851 	char *key = vkey;
2852 	struct class_datum *cladatum = datum;
2853 	struct policy_data *pd = ptr;
2854 	void *fp = pd->fp;
2855 	struct policydb *p = pd->p;
2856 	struct constraint_node *c;
2857 	__le32 buf[6];
2858 	u32 ncons;
2859 	size_t len, len2;
2860 	int rc;
2861 
2862 	len = strlen(key);
2863 	if (cladatum->comkey)
2864 		len2 = strlen(cladatum->comkey);
2865 	else
2866 		len2 = 0;
2867 
2868 	ncons = 0;
2869 	for (c = cladatum->constraints; c; c = c->next)
2870 		ncons++;
2871 
2872 	buf[0] = cpu_to_le32(len);
2873 	buf[1] = cpu_to_le32(len2);
2874 	buf[2] = cpu_to_le32(cladatum->value);
2875 	buf[3] = cpu_to_le32(cladatum->permissions.nprim);
2876 	if (cladatum->permissions.table)
2877 		buf[4] = cpu_to_le32(cladatum->permissions.table->nel);
2878 	else
2879 		buf[4] = 0;
2880 	buf[5] = cpu_to_le32(ncons);
2881 	rc = put_entry(buf, sizeof(u32), 6, fp);
2882 	if (rc)
2883 		return rc;
2884 
2885 	rc = put_entry(key, 1, len, fp);
2886 	if (rc)
2887 		return rc;
2888 
2889 	if (cladatum->comkey) {
2890 		rc = put_entry(cladatum->comkey, 1, len2, fp);
2891 		if (rc)
2892 			return rc;
2893 	}
2894 
2895 	rc = hashtab_map(cladatum->permissions.table, perm_write, fp);
2896 	if (rc)
2897 		return rc;
2898 
2899 	rc = write_cons_helper(p, cladatum->constraints, fp);
2900 	if (rc)
2901 		return rc;
2902 
2903 	/* write out the validatetrans rule */
2904 	ncons = 0;
2905 	for (c = cladatum->validatetrans; c; c = c->next)
2906 		ncons++;
2907 
2908 	buf[0] = cpu_to_le32(ncons);
2909 	rc = put_entry(buf, sizeof(u32), 1, fp);
2910 	if (rc)
2911 		return rc;
2912 
2913 	rc = write_cons_helper(p, cladatum->validatetrans, fp);
2914 	if (rc)
2915 		return rc;
2916 
2917 	if (p->policyvers >= POLICYDB_VERSION_NEW_OBJECT_DEFAULTS) {
2918 		buf[0] = cpu_to_le32(cladatum->default_user);
2919 		buf[1] = cpu_to_le32(cladatum->default_role);
2920 		buf[2] = cpu_to_le32(cladatum->default_range);
2921 
2922 		rc = put_entry(buf, sizeof(uint32_t), 3, fp);
2923 		if (rc)
2924 			return rc;
2925 	}
2926 
2927 	if (p->policyvers >= POLICYDB_VERSION_DEFAULT_TYPE) {
2928 		buf[0] = cpu_to_le32(cladatum->default_type);
2929 		rc = put_entry(buf, sizeof(uint32_t), 1, fp);
2930 		if (rc)
2931 			return rc;
2932 	}
2933 
2934 	return 0;
2935 }
2936 
2937 static int role_write(void *vkey, void *datum, void *ptr)
2938 {
2939 	char *key = vkey;
2940 	struct role_datum *role = datum;
2941 	struct policy_data *pd = ptr;
2942 	void *fp = pd->fp;
2943 	struct policydb *p = pd->p;
2944 	__le32 buf[3];
2945 	size_t items, len;
2946 	int rc;
2947 
2948 	len = strlen(key);
2949 	items = 0;
2950 	buf[items++] = cpu_to_le32(len);
2951 	buf[items++] = cpu_to_le32(role->value);
2952 	if (p->policyvers >= POLICYDB_VERSION_BOUNDARY)
2953 		buf[items++] = cpu_to_le32(role->bounds);
2954 
2955 	BUG_ON(items > ARRAY_SIZE(buf));
2956 
2957 	rc = put_entry(buf, sizeof(u32), items, fp);
2958 	if (rc)
2959 		return rc;
2960 
2961 	rc = put_entry(key, 1, len, fp);
2962 	if (rc)
2963 		return rc;
2964 
2965 	rc = ebitmap_write(&role->dominates, fp);
2966 	if (rc)
2967 		return rc;
2968 
2969 	rc = ebitmap_write(&role->types, fp);
2970 	if (rc)
2971 		return rc;
2972 
2973 	return 0;
2974 }
2975 
2976 static int type_write(void *vkey, void *datum, void *ptr)
2977 {
2978 	char *key = vkey;
2979 	struct type_datum *typdatum = datum;
2980 	struct policy_data *pd = ptr;
2981 	struct policydb *p = pd->p;
2982 	void *fp = pd->fp;
2983 	__le32 buf[4];
2984 	int rc;
2985 	size_t items, len;
2986 
2987 	len = strlen(key);
2988 	items = 0;
2989 	buf[items++] = cpu_to_le32(len);
2990 	buf[items++] = cpu_to_le32(typdatum->value);
2991 	if (p->policyvers >= POLICYDB_VERSION_BOUNDARY) {
2992 		u32 properties = 0;
2993 
2994 		if (typdatum->primary)
2995 			properties |= TYPEDATUM_PROPERTY_PRIMARY;
2996 
2997 		if (typdatum->attribute)
2998 			properties |= TYPEDATUM_PROPERTY_ATTRIBUTE;
2999 
3000 		buf[items++] = cpu_to_le32(properties);
3001 		buf[items++] = cpu_to_le32(typdatum->bounds);
3002 	} else {
3003 		buf[items++] = cpu_to_le32(typdatum->primary);
3004 	}
3005 	BUG_ON(items > ARRAY_SIZE(buf));
3006 	rc = put_entry(buf, sizeof(u32), items, fp);
3007 	if (rc)
3008 		return rc;
3009 
3010 	rc = put_entry(key, 1, len, fp);
3011 	if (rc)
3012 		return rc;
3013 
3014 	return 0;
3015 }
3016 
3017 static int user_write(void *vkey, void *datum, void *ptr)
3018 {
3019 	char *key = vkey;
3020 	struct user_datum *usrdatum = datum;
3021 	struct policy_data *pd = ptr;
3022 	struct policydb *p = pd->p;
3023 	void *fp = pd->fp;
3024 	__le32 buf[3];
3025 	size_t items, len;
3026 	int rc;
3027 
3028 	len = strlen(key);
3029 	items = 0;
3030 	buf[items++] = cpu_to_le32(len);
3031 	buf[items++] = cpu_to_le32(usrdatum->value);
3032 	if (p->policyvers >= POLICYDB_VERSION_BOUNDARY)
3033 		buf[items++] = cpu_to_le32(usrdatum->bounds);
3034 	BUG_ON(items > ARRAY_SIZE(buf));
3035 	rc = put_entry(buf, sizeof(u32), items, fp);
3036 	if (rc)
3037 		return rc;
3038 
3039 	rc = put_entry(key, 1, len, fp);
3040 	if (rc)
3041 		return rc;
3042 
3043 	rc = ebitmap_write(&usrdatum->roles, fp);
3044 	if (rc)
3045 		return rc;
3046 
3047 	rc = mls_write_range_helper(&usrdatum->range, fp);
3048 	if (rc)
3049 		return rc;
3050 
3051 	rc = mls_write_level(&usrdatum->dfltlevel, fp);
3052 	if (rc)
3053 		return rc;
3054 
3055 	return 0;
3056 }
3057 
3058 static int (*write_f[SYM_NUM]) (void *key, void *datum,
3059 				void *datap) =
3060 {
3061 	common_write,
3062 	class_write,
3063 	role_write,
3064 	type_write,
3065 	user_write,
3066 	cond_write_bool,
3067 	sens_write,
3068 	cat_write,
3069 };
3070 
3071 static int ocontext_write(struct policydb *p, struct policydb_compat_info *info,
3072 			  void *fp)
3073 {
3074 	unsigned int i, j, rc;
3075 	size_t nel, len;
3076 	__be64 prefixbuf[1];
3077 	__le32 buf[3];
3078 	u32 nodebuf[8];
3079 	struct ocontext *c;
3080 	for (i = 0; i < info->ocon_num; i++) {
3081 		nel = 0;
3082 		for (c = p->ocontexts[i]; c; c = c->next)
3083 			nel++;
3084 		buf[0] = cpu_to_le32(nel);
3085 		rc = put_entry(buf, sizeof(u32), 1, fp);
3086 		if (rc)
3087 			return rc;
3088 		for (c = p->ocontexts[i]; c; c = c->next) {
3089 			switch (i) {
3090 			case OCON_ISID:
3091 				buf[0] = cpu_to_le32(c->sid[0]);
3092 				rc = put_entry(buf, sizeof(u32), 1, fp);
3093 				if (rc)
3094 					return rc;
3095 				rc = context_write(p, &c->context[0], fp);
3096 				if (rc)
3097 					return rc;
3098 				break;
3099 			case OCON_FS:
3100 			case OCON_NETIF:
3101 				len = strlen(c->u.name);
3102 				buf[0] = cpu_to_le32(len);
3103 				rc = put_entry(buf, sizeof(u32), 1, fp);
3104 				if (rc)
3105 					return rc;
3106 				rc = put_entry(c->u.name, 1, len, fp);
3107 				if (rc)
3108 					return rc;
3109 				rc = context_write(p, &c->context[0], fp);
3110 				if (rc)
3111 					return rc;
3112 				rc = context_write(p, &c->context[1], fp);
3113 				if (rc)
3114 					return rc;
3115 				break;
3116 			case OCON_PORT:
3117 				buf[0] = cpu_to_le32(c->u.port.protocol);
3118 				buf[1] = cpu_to_le32(c->u.port.low_port);
3119 				buf[2] = cpu_to_le32(c->u.port.high_port);
3120 				rc = put_entry(buf, sizeof(u32), 3, fp);
3121 				if (rc)
3122 					return rc;
3123 				rc = context_write(p, &c->context[0], fp);
3124 				if (rc)
3125 					return rc;
3126 				break;
3127 			case OCON_NODE:
3128 				nodebuf[0] = c->u.node.addr; /* network order */
3129 				nodebuf[1] = c->u.node.mask; /* network order */
3130 				rc = put_entry(nodebuf, sizeof(u32), 2, fp);
3131 				if (rc)
3132 					return rc;
3133 				rc = context_write(p, &c->context[0], fp);
3134 				if (rc)
3135 					return rc;
3136 				break;
3137 			case OCON_FSUSE:
3138 				buf[0] = cpu_to_le32(c->v.behavior);
3139 				len = strlen(c->u.name);
3140 				buf[1] = cpu_to_le32(len);
3141 				rc = put_entry(buf, sizeof(u32), 2, fp);
3142 				if (rc)
3143 					return rc;
3144 				rc = put_entry(c->u.name, 1, len, fp);
3145 				if (rc)
3146 					return rc;
3147 				rc = context_write(p, &c->context[0], fp);
3148 				if (rc)
3149 					return rc;
3150 				break;
3151 			case OCON_NODE6:
3152 				for (j = 0; j < 4; j++)
3153 					nodebuf[j] = c->u.node6.addr[j]; /* network order */
3154 				for (j = 0; j < 4; j++)
3155 					nodebuf[j + 4] = c->u.node6.mask[j]; /* network order */
3156 				rc = put_entry(nodebuf, sizeof(u32), 8, fp);
3157 				if (rc)
3158 					return rc;
3159 				rc = context_write(p, &c->context[0], fp);
3160 				if (rc)
3161 					return rc;
3162 				break;
3163 			case OCON_IBPKEY:
3164 				/* subnet_prefix is in CPU order */
3165 				prefixbuf[0] = cpu_to_be64(c->u.ibpkey.subnet_prefix);
3166 
3167 				rc = put_entry(prefixbuf, sizeof(u64), 1, fp);
3168 				if (rc)
3169 					return rc;
3170 
3171 				buf[0] = cpu_to_le32(c->u.ibpkey.low_pkey);
3172 				buf[1] = cpu_to_le32(c->u.ibpkey.high_pkey);
3173 
3174 				rc = put_entry(buf, sizeof(u32), 2, fp);
3175 				if (rc)
3176 					return rc;
3177 				rc = context_write(p, &c->context[0], fp);
3178 				if (rc)
3179 					return rc;
3180 				break;
3181 			case OCON_IBENDPORT:
3182 				len = strlen(c->u.ibendport.dev_name);
3183 				buf[0] = cpu_to_le32(len);
3184 				buf[1] = cpu_to_le32(c->u.ibendport.port);
3185 				rc = put_entry(buf, sizeof(u32), 2, fp);
3186 				if (rc)
3187 					return rc;
3188 				rc = put_entry(c->u.ibendport.dev_name, 1, len, fp);
3189 				if (rc)
3190 					return rc;
3191 				rc = context_write(p, &c->context[0], fp);
3192 				if (rc)
3193 					return rc;
3194 				break;
3195 			}
3196 		}
3197 	}
3198 	return 0;
3199 }
3200 
3201 static int genfs_write(struct policydb *p, void *fp)
3202 {
3203 	struct genfs *genfs;
3204 	struct ocontext *c;
3205 	size_t len;
3206 	__le32 buf[1];
3207 	int rc;
3208 
3209 	len = 0;
3210 	for (genfs = p->genfs; genfs; genfs = genfs->next)
3211 		len++;
3212 	buf[0] = cpu_to_le32(len);
3213 	rc = put_entry(buf, sizeof(u32), 1, fp);
3214 	if (rc)
3215 		return rc;
3216 	for (genfs = p->genfs; genfs; genfs = genfs->next) {
3217 		len = strlen(genfs->fstype);
3218 		buf[0] = cpu_to_le32(len);
3219 		rc = put_entry(buf, sizeof(u32), 1, fp);
3220 		if (rc)
3221 			return rc;
3222 		rc = put_entry(genfs->fstype, 1, len, fp);
3223 		if (rc)
3224 			return rc;
3225 		len = 0;
3226 		for (c = genfs->head; c; c = c->next)
3227 			len++;
3228 		buf[0] = cpu_to_le32(len);
3229 		rc = put_entry(buf, sizeof(u32), 1, fp);
3230 		if (rc)
3231 			return rc;
3232 		for (c = genfs->head; c; c = c->next) {
3233 			len = strlen(c->u.name);
3234 			buf[0] = cpu_to_le32(len);
3235 			rc = put_entry(buf, sizeof(u32), 1, fp);
3236 			if (rc)
3237 				return rc;
3238 			rc = put_entry(c->u.name, 1, len, fp);
3239 			if (rc)
3240 				return rc;
3241 			buf[0] = cpu_to_le32(c->v.sclass);
3242 			rc = put_entry(buf, sizeof(u32), 1, fp);
3243 			if (rc)
3244 				return rc;
3245 			rc = context_write(p, &c->context[0], fp);
3246 			if (rc)
3247 				return rc;
3248 		}
3249 	}
3250 	return 0;
3251 }
3252 
3253 static int hashtab_cnt(void *key, void *data, void *ptr)
3254 {
3255 	int *cnt = ptr;
3256 	*cnt = *cnt + 1;
3257 
3258 	return 0;
3259 }
3260 
3261 static int range_write_helper(void *key, void *data, void *ptr)
3262 {
3263 	__le32 buf[2];
3264 	struct range_trans *rt = key;
3265 	struct mls_range *r = data;
3266 	struct policy_data *pd = ptr;
3267 	void *fp = pd->fp;
3268 	struct policydb *p = pd->p;
3269 	int rc;
3270 
3271 	buf[0] = cpu_to_le32(rt->source_type);
3272 	buf[1] = cpu_to_le32(rt->target_type);
3273 	rc = put_entry(buf, sizeof(u32), 2, fp);
3274 	if (rc)
3275 		return rc;
3276 	if (p->policyvers >= POLICYDB_VERSION_RANGETRANS) {
3277 		buf[0] = cpu_to_le32(rt->target_class);
3278 		rc = put_entry(buf, sizeof(u32), 1, fp);
3279 		if (rc)
3280 			return rc;
3281 	}
3282 	rc = mls_write_range_helper(r, fp);
3283 	if (rc)
3284 		return rc;
3285 
3286 	return 0;
3287 }
3288 
3289 static int range_write(struct policydb *p, void *fp)
3290 {
3291 	__le32 buf[1];
3292 	int rc, nel;
3293 	struct policy_data pd;
3294 
3295 	pd.p = p;
3296 	pd.fp = fp;
3297 
3298 	/* count the number of entries in the hashtab */
3299 	nel = 0;
3300 	rc = hashtab_map(p->range_tr, hashtab_cnt, &nel);
3301 	if (rc)
3302 		return rc;
3303 
3304 	buf[0] = cpu_to_le32(nel);
3305 	rc = put_entry(buf, sizeof(u32), 1, fp);
3306 	if (rc)
3307 		return rc;
3308 
3309 	/* actually write all of the entries */
3310 	rc = hashtab_map(p->range_tr, range_write_helper, &pd);
3311 	if (rc)
3312 		return rc;
3313 
3314 	return 0;
3315 }
3316 
3317 static int filename_write_helper(void *key, void *data, void *ptr)
3318 {
3319 	__le32 buf[4];
3320 	struct filename_trans *ft = key;
3321 	struct filename_trans_datum *otype = data;
3322 	void *fp = ptr;
3323 	int rc;
3324 	u32 len;
3325 
3326 	len = strlen(ft->name);
3327 	buf[0] = cpu_to_le32(len);
3328 	rc = put_entry(buf, sizeof(u32), 1, fp);
3329 	if (rc)
3330 		return rc;
3331 
3332 	rc = put_entry(ft->name, sizeof(char), len, fp);
3333 	if (rc)
3334 		return rc;
3335 
3336 	buf[0] = cpu_to_le32(ft->stype);
3337 	buf[1] = cpu_to_le32(ft->ttype);
3338 	buf[2] = cpu_to_le32(ft->tclass);
3339 	buf[3] = cpu_to_le32(otype->otype);
3340 
3341 	rc = put_entry(buf, sizeof(u32), 4, fp);
3342 	if (rc)
3343 		return rc;
3344 
3345 	return 0;
3346 }
3347 
3348 static int filename_trans_write(struct policydb *p, void *fp)
3349 {
3350 	u32 nel;
3351 	__le32 buf[1];
3352 	int rc;
3353 
3354 	if (p->policyvers < POLICYDB_VERSION_FILENAME_TRANS)
3355 		return 0;
3356 
3357 	nel = 0;
3358 	rc = hashtab_map(p->filename_trans, hashtab_cnt, &nel);
3359 	if (rc)
3360 		return rc;
3361 
3362 	buf[0] = cpu_to_le32(nel);
3363 	rc = put_entry(buf, sizeof(u32), 1, fp);
3364 	if (rc)
3365 		return rc;
3366 
3367 	rc = hashtab_map(p->filename_trans, filename_write_helper, fp);
3368 	if (rc)
3369 		return rc;
3370 
3371 	return 0;
3372 }
3373 
3374 /*
3375  * Write the configuration data in a policy database
3376  * structure to a policy database binary representation
3377  * file.
3378  */
3379 int policydb_write(struct policydb *p, void *fp)
3380 {
3381 	unsigned int i, num_syms;
3382 	int rc;
3383 	__le32 buf[4];
3384 	u32 config;
3385 	size_t len;
3386 	struct policydb_compat_info *info;
3387 
3388 	/*
3389 	 * refuse to write policy older than compressed avtab
3390 	 * to simplify the writer.  There are other tests dropped
3391 	 * since we assume this throughout the writer code.  Be
3392 	 * careful if you ever try to remove this restriction
3393 	 */
3394 	if (p->policyvers < POLICYDB_VERSION_AVTAB) {
3395 		pr_err("SELinux: refusing to write policy version %d."
3396 		       "  Because it is less than version %d\n", p->policyvers,
3397 		       POLICYDB_VERSION_AVTAB);
3398 		return -EINVAL;
3399 	}
3400 
3401 	config = 0;
3402 	if (p->mls_enabled)
3403 		config |= POLICYDB_CONFIG_MLS;
3404 
3405 	if (p->reject_unknown)
3406 		config |= REJECT_UNKNOWN;
3407 	if (p->allow_unknown)
3408 		config |= ALLOW_UNKNOWN;
3409 
3410 	/* Write the magic number and string identifiers. */
3411 	buf[0] = cpu_to_le32(POLICYDB_MAGIC);
3412 	len = strlen(POLICYDB_STRING);
3413 	buf[1] = cpu_to_le32(len);
3414 	rc = put_entry(buf, sizeof(u32), 2, fp);
3415 	if (rc)
3416 		return rc;
3417 	rc = put_entry(POLICYDB_STRING, 1, len, fp);
3418 	if (rc)
3419 		return rc;
3420 
3421 	/* Write the version, config, and table sizes. */
3422 	info = policydb_lookup_compat(p->policyvers);
3423 	if (!info) {
3424 		pr_err("SELinux: compatibility lookup failed for policy "
3425 		    "version %d", p->policyvers);
3426 		return -EINVAL;
3427 	}
3428 
3429 	buf[0] = cpu_to_le32(p->policyvers);
3430 	buf[1] = cpu_to_le32(config);
3431 	buf[2] = cpu_to_le32(info->sym_num);
3432 	buf[3] = cpu_to_le32(info->ocon_num);
3433 
3434 	rc = put_entry(buf, sizeof(u32), 4, fp);
3435 	if (rc)
3436 		return rc;
3437 
3438 	if (p->policyvers >= POLICYDB_VERSION_POLCAP) {
3439 		rc = ebitmap_write(&p->policycaps, fp);
3440 		if (rc)
3441 			return rc;
3442 	}
3443 
3444 	if (p->policyvers >= POLICYDB_VERSION_PERMISSIVE) {
3445 		rc = ebitmap_write(&p->permissive_map, fp);
3446 		if (rc)
3447 			return rc;
3448 	}
3449 
3450 	num_syms = info->sym_num;
3451 	for (i = 0; i < num_syms; i++) {
3452 		struct policy_data pd;
3453 
3454 		pd.fp = fp;
3455 		pd.p = p;
3456 
3457 		buf[0] = cpu_to_le32(p->symtab[i].nprim);
3458 		buf[1] = cpu_to_le32(p->symtab[i].table->nel);
3459 
3460 		rc = put_entry(buf, sizeof(u32), 2, fp);
3461 		if (rc)
3462 			return rc;
3463 		rc = hashtab_map(p->symtab[i].table, write_f[i], &pd);
3464 		if (rc)
3465 			return rc;
3466 	}
3467 
3468 	rc = avtab_write(p, &p->te_avtab, fp);
3469 	if (rc)
3470 		return rc;
3471 
3472 	rc = cond_write_list(p, p->cond_list, fp);
3473 	if (rc)
3474 		return rc;
3475 
3476 	rc = role_trans_write(p, fp);
3477 	if (rc)
3478 		return rc;
3479 
3480 	rc = role_allow_write(p->role_allow, fp);
3481 	if (rc)
3482 		return rc;
3483 
3484 	rc = filename_trans_write(p, fp);
3485 	if (rc)
3486 		return rc;
3487 
3488 	rc = ocontext_write(p, info, fp);
3489 	if (rc)
3490 		return rc;
3491 
3492 	rc = genfs_write(p, fp);
3493 	if (rc)
3494 		return rc;
3495 
3496 	rc = range_write(p, fp);
3497 	if (rc)
3498 		return rc;
3499 
3500 	for (i = 0; i < p->p_types.nprim; i++) {
3501 		struct ebitmap *e = &p->type_attr_map_array[i];
3502 
3503 		rc = ebitmap_write(e, fp);
3504 		if (rc)
3505 			return rc;
3506 	}
3507 
3508 	return 0;
3509 }
3510