1 // SPDX-License-Identifier: GPL-2.0-only 2 /* 3 * Implementation of the security services. 4 * 5 * Authors : Stephen Smalley, <sds@tycho.nsa.gov> 6 * James Morris <jmorris@redhat.com> 7 * 8 * Updated: Trusted Computer Solutions, Inc. <dgoeddel@trustedcs.com> 9 * 10 * Support for enhanced MLS infrastructure. 11 * Support for context based audit filters. 12 * 13 * Updated: Frank Mayer <mayerf@tresys.com> and Karl MacMillan <kmacmillan@tresys.com> 14 * 15 * Added conditional policy language extensions 16 * 17 * Updated: Hewlett-Packard <paul@paul-moore.com> 18 * 19 * Added support for NetLabel 20 * Added support for the policy capability bitmap 21 * 22 * Updated: Chad Sellers <csellers@tresys.com> 23 * 24 * Added validation of kernel classes and permissions 25 * 26 * Updated: KaiGai Kohei <kaigai@ak.jp.nec.com> 27 * 28 * Added support for bounds domain and audit messaged on masked permissions 29 * 30 * Updated: Guido Trentalancia <guido@trentalancia.com> 31 * 32 * Added support for runtime switching of the policy type 33 * 34 * Copyright (C) 2008, 2009 NEC Corporation 35 * Copyright (C) 2006, 2007 Hewlett-Packard Development Company, L.P. 36 * Copyright (C) 2004-2006 Trusted Computer Solutions, Inc. 37 * Copyright (C) 2003 - 2004, 2006 Tresys Technology, LLC 38 * Copyright (C) 2003 Red Hat, Inc., James Morris <jmorris@redhat.com> 39 */ 40 #include <linux/kernel.h> 41 #include <linux/slab.h> 42 #include <linux/string.h> 43 #include <linux/spinlock.h> 44 #include <linux/rcupdate.h> 45 #include <linux/errno.h> 46 #include <linux/in.h> 47 #include <linux/sched.h> 48 #include <linux/audit.h> 49 #include <linux/vmalloc.h> 50 #include <linux/lsm_hooks.h> 51 #include <net/netlabel.h> 52 53 #include "flask.h" 54 #include "avc.h" 55 #include "avc_ss.h" 56 #include "security.h" 57 #include "context.h" 58 #include "policydb.h" 59 #include "sidtab.h" 60 #include "services.h" 61 #include "conditional.h" 62 #include "mls.h" 63 #include "objsec.h" 64 #include "netlabel.h" 65 #include "xfrm.h" 66 #include "ebitmap.h" 67 #include "audit.h" 68 #include "policycap_names.h" 69 #include "ima.h" 70 71 struct convert_context_args { 72 struct selinux_state *state; 73 struct policydb *oldp; 74 struct policydb *newp; 75 }; 76 77 struct selinux_policy_convert_data { 78 struct convert_context_args args; 79 struct sidtab_convert_params sidtab_params; 80 }; 81 82 /* Forward declaration. */ 83 static int context_struct_to_string(struct policydb *policydb, 84 struct context *context, 85 char **scontext, 86 u32 *scontext_len); 87 88 static int sidtab_entry_to_string(struct policydb *policydb, 89 struct sidtab *sidtab, 90 struct sidtab_entry *entry, 91 char **scontext, 92 u32 *scontext_len); 93 94 static void context_struct_compute_av(struct policydb *policydb, 95 struct context *scontext, 96 struct context *tcontext, 97 u16 tclass, 98 struct av_decision *avd, 99 struct extended_perms *xperms); 100 101 static int selinux_set_mapping(struct policydb *pol, 102 struct security_class_mapping *map, 103 struct selinux_map *out_map) 104 { 105 u16 i, j; 106 unsigned k; 107 bool print_unknown_handle = false; 108 109 /* Find number of classes in the input mapping */ 110 if (!map) 111 return -EINVAL; 112 i = 0; 113 while (map[i].name) 114 i++; 115 116 /* Allocate space for the class records, plus one for class zero */ 117 out_map->mapping = kcalloc(++i, sizeof(*out_map->mapping), GFP_ATOMIC); 118 if (!out_map->mapping) 119 return -ENOMEM; 120 121 /* Store the raw class and permission values */ 122 j = 0; 123 while (map[j].name) { 124 struct security_class_mapping *p_in = map + (j++); 125 struct selinux_mapping *p_out = out_map->mapping + j; 126 127 /* An empty class string skips ahead */ 128 if (!strcmp(p_in->name, "")) { 129 p_out->num_perms = 0; 130 continue; 131 } 132 133 p_out->value = string_to_security_class(pol, p_in->name); 134 if (!p_out->value) { 135 pr_info("SELinux: Class %s not defined in policy.\n", 136 p_in->name); 137 if (pol->reject_unknown) 138 goto err; 139 p_out->num_perms = 0; 140 print_unknown_handle = true; 141 continue; 142 } 143 144 k = 0; 145 while (p_in->perms[k]) { 146 /* An empty permission string skips ahead */ 147 if (!*p_in->perms[k]) { 148 k++; 149 continue; 150 } 151 p_out->perms[k] = string_to_av_perm(pol, p_out->value, 152 p_in->perms[k]); 153 if (!p_out->perms[k]) { 154 pr_info("SELinux: Permission %s in class %s not defined in policy.\n", 155 p_in->perms[k], p_in->name); 156 if (pol->reject_unknown) 157 goto err; 158 print_unknown_handle = true; 159 } 160 161 k++; 162 } 163 p_out->num_perms = k; 164 } 165 166 if (print_unknown_handle) 167 pr_info("SELinux: the above unknown classes and permissions will be %s\n", 168 pol->allow_unknown ? "allowed" : "denied"); 169 170 out_map->size = i; 171 return 0; 172 err: 173 kfree(out_map->mapping); 174 out_map->mapping = NULL; 175 return -EINVAL; 176 } 177 178 /* 179 * Get real, policy values from mapped values 180 */ 181 182 static u16 unmap_class(struct selinux_map *map, u16 tclass) 183 { 184 if (tclass < map->size) 185 return map->mapping[tclass].value; 186 187 return tclass; 188 } 189 190 /* 191 * Get kernel value for class from its policy value 192 */ 193 static u16 map_class(struct selinux_map *map, u16 pol_value) 194 { 195 u16 i; 196 197 for (i = 1; i < map->size; i++) { 198 if (map->mapping[i].value == pol_value) 199 return i; 200 } 201 202 return SECCLASS_NULL; 203 } 204 205 static void map_decision(struct selinux_map *map, 206 u16 tclass, struct av_decision *avd, 207 int allow_unknown) 208 { 209 if (tclass < map->size) { 210 struct selinux_mapping *mapping = &map->mapping[tclass]; 211 unsigned int i, n = mapping->num_perms; 212 u32 result; 213 214 for (i = 0, result = 0; i < n; i++) { 215 if (avd->allowed & mapping->perms[i]) 216 result |= 1<<i; 217 if (allow_unknown && !mapping->perms[i]) 218 result |= 1<<i; 219 } 220 avd->allowed = result; 221 222 for (i = 0, result = 0; i < n; i++) 223 if (avd->auditallow & mapping->perms[i]) 224 result |= 1<<i; 225 avd->auditallow = result; 226 227 for (i = 0, result = 0; i < n; i++) { 228 if (avd->auditdeny & mapping->perms[i]) 229 result |= 1<<i; 230 if (!allow_unknown && !mapping->perms[i]) 231 result |= 1<<i; 232 } 233 /* 234 * In case the kernel has a bug and requests a permission 235 * between num_perms and the maximum permission number, we 236 * should audit that denial 237 */ 238 for (; i < (sizeof(u32)*8); i++) 239 result |= 1<<i; 240 avd->auditdeny = result; 241 } 242 } 243 244 int security_mls_enabled(struct selinux_state *state) 245 { 246 int mls_enabled; 247 struct selinux_policy *policy; 248 249 if (!selinux_initialized(state)) 250 return 0; 251 252 rcu_read_lock(); 253 policy = rcu_dereference(state->policy); 254 mls_enabled = policy->policydb.mls_enabled; 255 rcu_read_unlock(); 256 return mls_enabled; 257 } 258 259 /* 260 * Return the boolean value of a constraint expression 261 * when it is applied to the specified source and target 262 * security contexts. 263 * 264 * xcontext is a special beast... It is used by the validatetrans rules 265 * only. For these rules, scontext is the context before the transition, 266 * tcontext is the context after the transition, and xcontext is the context 267 * of the process performing the transition. All other callers of 268 * constraint_expr_eval should pass in NULL for xcontext. 269 */ 270 static int constraint_expr_eval(struct policydb *policydb, 271 struct context *scontext, 272 struct context *tcontext, 273 struct context *xcontext, 274 struct constraint_expr *cexpr) 275 { 276 u32 val1, val2; 277 struct context *c; 278 struct role_datum *r1, *r2; 279 struct mls_level *l1, *l2; 280 struct constraint_expr *e; 281 int s[CEXPR_MAXDEPTH]; 282 int sp = -1; 283 284 for (e = cexpr; e; e = e->next) { 285 switch (e->expr_type) { 286 case CEXPR_NOT: 287 BUG_ON(sp < 0); 288 s[sp] = !s[sp]; 289 break; 290 case CEXPR_AND: 291 BUG_ON(sp < 1); 292 sp--; 293 s[sp] &= s[sp + 1]; 294 break; 295 case CEXPR_OR: 296 BUG_ON(sp < 1); 297 sp--; 298 s[sp] |= s[sp + 1]; 299 break; 300 case CEXPR_ATTR: 301 if (sp == (CEXPR_MAXDEPTH - 1)) 302 return 0; 303 switch (e->attr) { 304 case CEXPR_USER: 305 val1 = scontext->user; 306 val2 = tcontext->user; 307 break; 308 case CEXPR_TYPE: 309 val1 = scontext->type; 310 val2 = tcontext->type; 311 break; 312 case CEXPR_ROLE: 313 val1 = scontext->role; 314 val2 = tcontext->role; 315 r1 = policydb->role_val_to_struct[val1 - 1]; 316 r2 = policydb->role_val_to_struct[val2 - 1]; 317 switch (e->op) { 318 case CEXPR_DOM: 319 s[++sp] = ebitmap_get_bit(&r1->dominates, 320 val2 - 1); 321 continue; 322 case CEXPR_DOMBY: 323 s[++sp] = ebitmap_get_bit(&r2->dominates, 324 val1 - 1); 325 continue; 326 case CEXPR_INCOMP: 327 s[++sp] = (!ebitmap_get_bit(&r1->dominates, 328 val2 - 1) && 329 !ebitmap_get_bit(&r2->dominates, 330 val1 - 1)); 331 continue; 332 default: 333 break; 334 } 335 break; 336 case CEXPR_L1L2: 337 l1 = &(scontext->range.level[0]); 338 l2 = &(tcontext->range.level[0]); 339 goto mls_ops; 340 case CEXPR_L1H2: 341 l1 = &(scontext->range.level[0]); 342 l2 = &(tcontext->range.level[1]); 343 goto mls_ops; 344 case CEXPR_H1L2: 345 l1 = &(scontext->range.level[1]); 346 l2 = &(tcontext->range.level[0]); 347 goto mls_ops; 348 case CEXPR_H1H2: 349 l1 = &(scontext->range.level[1]); 350 l2 = &(tcontext->range.level[1]); 351 goto mls_ops; 352 case CEXPR_L1H1: 353 l1 = &(scontext->range.level[0]); 354 l2 = &(scontext->range.level[1]); 355 goto mls_ops; 356 case CEXPR_L2H2: 357 l1 = &(tcontext->range.level[0]); 358 l2 = &(tcontext->range.level[1]); 359 goto mls_ops; 360 mls_ops: 361 switch (e->op) { 362 case CEXPR_EQ: 363 s[++sp] = mls_level_eq(l1, l2); 364 continue; 365 case CEXPR_NEQ: 366 s[++sp] = !mls_level_eq(l1, l2); 367 continue; 368 case CEXPR_DOM: 369 s[++sp] = mls_level_dom(l1, l2); 370 continue; 371 case CEXPR_DOMBY: 372 s[++sp] = mls_level_dom(l2, l1); 373 continue; 374 case CEXPR_INCOMP: 375 s[++sp] = mls_level_incomp(l2, l1); 376 continue; 377 default: 378 BUG(); 379 return 0; 380 } 381 break; 382 default: 383 BUG(); 384 return 0; 385 } 386 387 switch (e->op) { 388 case CEXPR_EQ: 389 s[++sp] = (val1 == val2); 390 break; 391 case CEXPR_NEQ: 392 s[++sp] = (val1 != val2); 393 break; 394 default: 395 BUG(); 396 return 0; 397 } 398 break; 399 case CEXPR_NAMES: 400 if (sp == (CEXPR_MAXDEPTH-1)) 401 return 0; 402 c = scontext; 403 if (e->attr & CEXPR_TARGET) 404 c = tcontext; 405 else if (e->attr & CEXPR_XTARGET) { 406 c = xcontext; 407 if (!c) { 408 BUG(); 409 return 0; 410 } 411 } 412 if (e->attr & CEXPR_USER) 413 val1 = c->user; 414 else if (e->attr & CEXPR_ROLE) 415 val1 = c->role; 416 else if (e->attr & CEXPR_TYPE) 417 val1 = c->type; 418 else { 419 BUG(); 420 return 0; 421 } 422 423 switch (e->op) { 424 case CEXPR_EQ: 425 s[++sp] = ebitmap_get_bit(&e->names, val1 - 1); 426 break; 427 case CEXPR_NEQ: 428 s[++sp] = !ebitmap_get_bit(&e->names, val1 - 1); 429 break; 430 default: 431 BUG(); 432 return 0; 433 } 434 break; 435 default: 436 BUG(); 437 return 0; 438 } 439 } 440 441 BUG_ON(sp != 0); 442 return s[0]; 443 } 444 445 /* 446 * security_dump_masked_av - dumps masked permissions during 447 * security_compute_av due to RBAC, MLS/Constraint and Type bounds. 448 */ 449 static int dump_masked_av_helper(void *k, void *d, void *args) 450 { 451 struct perm_datum *pdatum = d; 452 char **permission_names = args; 453 454 BUG_ON(pdatum->value < 1 || pdatum->value > 32); 455 456 permission_names[pdatum->value - 1] = (char *)k; 457 458 return 0; 459 } 460 461 static void security_dump_masked_av(struct policydb *policydb, 462 struct context *scontext, 463 struct context *tcontext, 464 u16 tclass, 465 u32 permissions, 466 const char *reason) 467 { 468 struct common_datum *common_dat; 469 struct class_datum *tclass_dat; 470 struct audit_buffer *ab; 471 char *tclass_name; 472 char *scontext_name = NULL; 473 char *tcontext_name = NULL; 474 char *permission_names[32]; 475 int index; 476 u32 length; 477 bool need_comma = false; 478 479 if (!permissions) 480 return; 481 482 tclass_name = sym_name(policydb, SYM_CLASSES, tclass - 1); 483 tclass_dat = policydb->class_val_to_struct[tclass - 1]; 484 common_dat = tclass_dat->comdatum; 485 486 /* init permission_names */ 487 if (common_dat && 488 hashtab_map(&common_dat->permissions.table, 489 dump_masked_av_helper, permission_names) < 0) 490 goto out; 491 492 if (hashtab_map(&tclass_dat->permissions.table, 493 dump_masked_av_helper, permission_names) < 0) 494 goto out; 495 496 /* get scontext/tcontext in text form */ 497 if (context_struct_to_string(policydb, scontext, 498 &scontext_name, &length) < 0) 499 goto out; 500 501 if (context_struct_to_string(policydb, tcontext, 502 &tcontext_name, &length) < 0) 503 goto out; 504 505 /* audit a message */ 506 ab = audit_log_start(audit_context(), 507 GFP_ATOMIC, AUDIT_SELINUX_ERR); 508 if (!ab) 509 goto out; 510 511 audit_log_format(ab, "op=security_compute_av reason=%s " 512 "scontext=%s tcontext=%s tclass=%s perms=", 513 reason, scontext_name, tcontext_name, tclass_name); 514 515 for (index = 0; index < 32; index++) { 516 u32 mask = (1 << index); 517 518 if ((mask & permissions) == 0) 519 continue; 520 521 audit_log_format(ab, "%s%s", 522 need_comma ? "," : "", 523 permission_names[index] 524 ? permission_names[index] : "????"); 525 need_comma = true; 526 } 527 audit_log_end(ab); 528 out: 529 /* release scontext/tcontext */ 530 kfree(tcontext_name); 531 kfree(scontext_name); 532 533 return; 534 } 535 536 /* 537 * security_boundary_permission - drops violated permissions 538 * on boundary constraint. 539 */ 540 static void type_attribute_bounds_av(struct policydb *policydb, 541 struct context *scontext, 542 struct context *tcontext, 543 u16 tclass, 544 struct av_decision *avd) 545 { 546 struct context lo_scontext; 547 struct context lo_tcontext, *tcontextp = tcontext; 548 struct av_decision lo_avd; 549 struct type_datum *source; 550 struct type_datum *target; 551 u32 masked = 0; 552 553 source = policydb->type_val_to_struct[scontext->type - 1]; 554 BUG_ON(!source); 555 556 if (!source->bounds) 557 return; 558 559 target = policydb->type_val_to_struct[tcontext->type - 1]; 560 BUG_ON(!target); 561 562 memset(&lo_avd, 0, sizeof(lo_avd)); 563 564 memcpy(&lo_scontext, scontext, sizeof(lo_scontext)); 565 lo_scontext.type = source->bounds; 566 567 if (target->bounds) { 568 memcpy(&lo_tcontext, tcontext, sizeof(lo_tcontext)); 569 lo_tcontext.type = target->bounds; 570 tcontextp = &lo_tcontext; 571 } 572 573 context_struct_compute_av(policydb, &lo_scontext, 574 tcontextp, 575 tclass, 576 &lo_avd, 577 NULL); 578 579 masked = ~lo_avd.allowed & avd->allowed; 580 581 if (likely(!masked)) 582 return; /* no masked permission */ 583 584 /* mask violated permissions */ 585 avd->allowed &= ~masked; 586 587 /* audit masked permissions */ 588 security_dump_masked_av(policydb, scontext, tcontext, 589 tclass, masked, "bounds"); 590 } 591 592 /* 593 * flag which drivers have permissions 594 * only looking for ioctl based extended permssions 595 */ 596 void services_compute_xperms_drivers( 597 struct extended_perms *xperms, 598 struct avtab_node *node) 599 { 600 unsigned int i; 601 602 if (node->datum.u.xperms->specified == AVTAB_XPERMS_IOCTLDRIVER) { 603 /* if one or more driver has all permissions allowed */ 604 for (i = 0; i < ARRAY_SIZE(xperms->drivers.p); i++) 605 xperms->drivers.p[i] |= node->datum.u.xperms->perms.p[i]; 606 } else if (node->datum.u.xperms->specified == AVTAB_XPERMS_IOCTLFUNCTION) { 607 /* if allowing permissions within a driver */ 608 security_xperm_set(xperms->drivers.p, 609 node->datum.u.xperms->driver); 610 } 611 612 xperms->len = 1; 613 } 614 615 /* 616 * Compute access vectors and extended permissions based on a context 617 * structure pair for the permissions in a particular class. 618 */ 619 static void context_struct_compute_av(struct policydb *policydb, 620 struct context *scontext, 621 struct context *tcontext, 622 u16 tclass, 623 struct av_decision *avd, 624 struct extended_perms *xperms) 625 { 626 struct constraint_node *constraint; 627 struct role_allow *ra; 628 struct avtab_key avkey; 629 struct avtab_node *node; 630 struct class_datum *tclass_datum; 631 struct ebitmap *sattr, *tattr; 632 struct ebitmap_node *snode, *tnode; 633 unsigned int i, j; 634 635 avd->allowed = 0; 636 avd->auditallow = 0; 637 avd->auditdeny = 0xffffffff; 638 if (xperms) { 639 memset(&xperms->drivers, 0, sizeof(xperms->drivers)); 640 xperms->len = 0; 641 } 642 643 if (unlikely(!tclass || tclass > policydb->p_classes.nprim)) { 644 if (printk_ratelimit()) 645 pr_warn("SELinux: Invalid class %hu\n", tclass); 646 return; 647 } 648 649 tclass_datum = policydb->class_val_to_struct[tclass - 1]; 650 651 /* 652 * If a specific type enforcement rule was defined for 653 * this permission check, then use it. 654 */ 655 avkey.target_class = tclass; 656 avkey.specified = AVTAB_AV | AVTAB_XPERMS; 657 sattr = &policydb->type_attr_map_array[scontext->type - 1]; 658 tattr = &policydb->type_attr_map_array[tcontext->type - 1]; 659 ebitmap_for_each_positive_bit(sattr, snode, i) { 660 ebitmap_for_each_positive_bit(tattr, tnode, j) { 661 avkey.source_type = i + 1; 662 avkey.target_type = j + 1; 663 for (node = avtab_search_node(&policydb->te_avtab, 664 &avkey); 665 node; 666 node = avtab_search_node_next(node, avkey.specified)) { 667 if (node->key.specified == AVTAB_ALLOWED) 668 avd->allowed |= node->datum.u.data; 669 else if (node->key.specified == AVTAB_AUDITALLOW) 670 avd->auditallow |= node->datum.u.data; 671 else if (node->key.specified == AVTAB_AUDITDENY) 672 avd->auditdeny &= node->datum.u.data; 673 else if (xperms && (node->key.specified & AVTAB_XPERMS)) 674 services_compute_xperms_drivers(xperms, node); 675 } 676 677 /* Check conditional av table for additional permissions */ 678 cond_compute_av(&policydb->te_cond_avtab, &avkey, 679 avd, xperms); 680 681 } 682 } 683 684 /* 685 * Remove any permissions prohibited by a constraint (this includes 686 * the MLS policy). 687 */ 688 constraint = tclass_datum->constraints; 689 while (constraint) { 690 if ((constraint->permissions & (avd->allowed)) && 691 !constraint_expr_eval(policydb, scontext, tcontext, NULL, 692 constraint->expr)) { 693 avd->allowed &= ~(constraint->permissions); 694 } 695 constraint = constraint->next; 696 } 697 698 /* 699 * If checking process transition permission and the 700 * role is changing, then check the (current_role, new_role) 701 * pair. 702 */ 703 if (tclass == policydb->process_class && 704 (avd->allowed & policydb->process_trans_perms) && 705 scontext->role != tcontext->role) { 706 for (ra = policydb->role_allow; ra; ra = ra->next) { 707 if (scontext->role == ra->role && 708 tcontext->role == ra->new_role) 709 break; 710 } 711 if (!ra) 712 avd->allowed &= ~policydb->process_trans_perms; 713 } 714 715 /* 716 * If the given source and target types have boundary 717 * constraint, lazy checks have to mask any violated 718 * permission and notice it to userspace via audit. 719 */ 720 type_attribute_bounds_av(policydb, scontext, tcontext, 721 tclass, avd); 722 } 723 724 static int security_validtrans_handle_fail(struct selinux_state *state, 725 struct selinux_policy *policy, 726 struct sidtab_entry *oentry, 727 struct sidtab_entry *nentry, 728 struct sidtab_entry *tentry, 729 u16 tclass) 730 { 731 struct policydb *p = &policy->policydb; 732 struct sidtab *sidtab = policy->sidtab; 733 char *o = NULL, *n = NULL, *t = NULL; 734 u32 olen, nlen, tlen; 735 736 if (sidtab_entry_to_string(p, sidtab, oentry, &o, &olen)) 737 goto out; 738 if (sidtab_entry_to_string(p, sidtab, nentry, &n, &nlen)) 739 goto out; 740 if (sidtab_entry_to_string(p, sidtab, tentry, &t, &tlen)) 741 goto out; 742 audit_log(audit_context(), GFP_ATOMIC, AUDIT_SELINUX_ERR, 743 "op=security_validate_transition seresult=denied" 744 " oldcontext=%s newcontext=%s taskcontext=%s tclass=%s", 745 o, n, t, sym_name(p, SYM_CLASSES, tclass-1)); 746 out: 747 kfree(o); 748 kfree(n); 749 kfree(t); 750 751 if (!enforcing_enabled(state)) 752 return 0; 753 return -EPERM; 754 } 755 756 static int security_compute_validatetrans(struct selinux_state *state, 757 u32 oldsid, u32 newsid, u32 tasksid, 758 u16 orig_tclass, bool user) 759 { 760 struct selinux_policy *policy; 761 struct policydb *policydb; 762 struct sidtab *sidtab; 763 struct sidtab_entry *oentry; 764 struct sidtab_entry *nentry; 765 struct sidtab_entry *tentry; 766 struct class_datum *tclass_datum; 767 struct constraint_node *constraint; 768 u16 tclass; 769 int rc = 0; 770 771 772 if (!selinux_initialized(state)) 773 return 0; 774 775 rcu_read_lock(); 776 777 policy = rcu_dereference(state->policy); 778 policydb = &policy->policydb; 779 sidtab = policy->sidtab; 780 781 if (!user) 782 tclass = unmap_class(&policy->map, orig_tclass); 783 else 784 tclass = orig_tclass; 785 786 if (!tclass || tclass > policydb->p_classes.nprim) { 787 rc = -EINVAL; 788 goto out; 789 } 790 tclass_datum = policydb->class_val_to_struct[tclass - 1]; 791 792 oentry = sidtab_search_entry(sidtab, oldsid); 793 if (!oentry) { 794 pr_err("SELinux: %s: unrecognized SID %d\n", 795 __func__, oldsid); 796 rc = -EINVAL; 797 goto out; 798 } 799 800 nentry = sidtab_search_entry(sidtab, newsid); 801 if (!nentry) { 802 pr_err("SELinux: %s: unrecognized SID %d\n", 803 __func__, newsid); 804 rc = -EINVAL; 805 goto out; 806 } 807 808 tentry = sidtab_search_entry(sidtab, tasksid); 809 if (!tentry) { 810 pr_err("SELinux: %s: unrecognized SID %d\n", 811 __func__, tasksid); 812 rc = -EINVAL; 813 goto out; 814 } 815 816 constraint = tclass_datum->validatetrans; 817 while (constraint) { 818 if (!constraint_expr_eval(policydb, &oentry->context, 819 &nentry->context, &tentry->context, 820 constraint->expr)) { 821 if (user) 822 rc = -EPERM; 823 else 824 rc = security_validtrans_handle_fail(state, 825 policy, 826 oentry, 827 nentry, 828 tentry, 829 tclass); 830 goto out; 831 } 832 constraint = constraint->next; 833 } 834 835 out: 836 rcu_read_unlock(); 837 return rc; 838 } 839 840 int security_validate_transition_user(struct selinux_state *state, 841 u32 oldsid, u32 newsid, u32 tasksid, 842 u16 tclass) 843 { 844 return security_compute_validatetrans(state, oldsid, newsid, tasksid, 845 tclass, true); 846 } 847 848 int security_validate_transition(struct selinux_state *state, 849 u32 oldsid, u32 newsid, u32 tasksid, 850 u16 orig_tclass) 851 { 852 return security_compute_validatetrans(state, oldsid, newsid, tasksid, 853 orig_tclass, false); 854 } 855 856 /* 857 * security_bounded_transition - check whether the given 858 * transition is directed to bounded, or not. 859 * It returns 0, if @newsid is bounded by @oldsid. 860 * Otherwise, it returns error code. 861 * 862 * @state: SELinux state 863 * @oldsid : current security identifier 864 * @newsid : destinated security identifier 865 */ 866 int security_bounded_transition(struct selinux_state *state, 867 u32 old_sid, u32 new_sid) 868 { 869 struct selinux_policy *policy; 870 struct policydb *policydb; 871 struct sidtab *sidtab; 872 struct sidtab_entry *old_entry, *new_entry; 873 struct type_datum *type; 874 int index; 875 int rc; 876 877 if (!selinux_initialized(state)) 878 return 0; 879 880 rcu_read_lock(); 881 policy = rcu_dereference(state->policy); 882 policydb = &policy->policydb; 883 sidtab = policy->sidtab; 884 885 rc = -EINVAL; 886 old_entry = sidtab_search_entry(sidtab, old_sid); 887 if (!old_entry) { 888 pr_err("SELinux: %s: unrecognized SID %u\n", 889 __func__, old_sid); 890 goto out; 891 } 892 893 rc = -EINVAL; 894 new_entry = sidtab_search_entry(sidtab, new_sid); 895 if (!new_entry) { 896 pr_err("SELinux: %s: unrecognized SID %u\n", 897 __func__, new_sid); 898 goto out; 899 } 900 901 rc = 0; 902 /* type/domain unchanged */ 903 if (old_entry->context.type == new_entry->context.type) 904 goto out; 905 906 index = new_entry->context.type; 907 while (true) { 908 type = policydb->type_val_to_struct[index - 1]; 909 BUG_ON(!type); 910 911 /* not bounded anymore */ 912 rc = -EPERM; 913 if (!type->bounds) 914 break; 915 916 /* @newsid is bounded by @oldsid */ 917 rc = 0; 918 if (type->bounds == old_entry->context.type) 919 break; 920 921 index = type->bounds; 922 } 923 924 if (rc) { 925 char *old_name = NULL; 926 char *new_name = NULL; 927 u32 length; 928 929 if (!sidtab_entry_to_string(policydb, sidtab, old_entry, 930 &old_name, &length) && 931 !sidtab_entry_to_string(policydb, sidtab, new_entry, 932 &new_name, &length)) { 933 audit_log(audit_context(), 934 GFP_ATOMIC, AUDIT_SELINUX_ERR, 935 "op=security_bounded_transition " 936 "seresult=denied " 937 "oldcontext=%s newcontext=%s", 938 old_name, new_name); 939 } 940 kfree(new_name); 941 kfree(old_name); 942 } 943 out: 944 rcu_read_unlock(); 945 946 return rc; 947 } 948 949 static void avd_init(struct selinux_policy *policy, struct av_decision *avd) 950 { 951 avd->allowed = 0; 952 avd->auditallow = 0; 953 avd->auditdeny = 0xffffffff; 954 if (policy) 955 avd->seqno = policy->latest_granting; 956 else 957 avd->seqno = 0; 958 avd->flags = 0; 959 } 960 961 void services_compute_xperms_decision(struct extended_perms_decision *xpermd, 962 struct avtab_node *node) 963 { 964 unsigned int i; 965 966 if (node->datum.u.xperms->specified == AVTAB_XPERMS_IOCTLFUNCTION) { 967 if (xpermd->driver != node->datum.u.xperms->driver) 968 return; 969 } else if (node->datum.u.xperms->specified == AVTAB_XPERMS_IOCTLDRIVER) { 970 if (!security_xperm_test(node->datum.u.xperms->perms.p, 971 xpermd->driver)) 972 return; 973 } else { 974 BUG(); 975 } 976 977 if (node->key.specified == AVTAB_XPERMS_ALLOWED) { 978 xpermd->used |= XPERMS_ALLOWED; 979 if (node->datum.u.xperms->specified == AVTAB_XPERMS_IOCTLDRIVER) { 980 memset(xpermd->allowed->p, 0xff, 981 sizeof(xpermd->allowed->p)); 982 } 983 if (node->datum.u.xperms->specified == AVTAB_XPERMS_IOCTLFUNCTION) { 984 for (i = 0; i < ARRAY_SIZE(xpermd->allowed->p); i++) 985 xpermd->allowed->p[i] |= 986 node->datum.u.xperms->perms.p[i]; 987 } 988 } else if (node->key.specified == AVTAB_XPERMS_AUDITALLOW) { 989 xpermd->used |= XPERMS_AUDITALLOW; 990 if (node->datum.u.xperms->specified == AVTAB_XPERMS_IOCTLDRIVER) { 991 memset(xpermd->auditallow->p, 0xff, 992 sizeof(xpermd->auditallow->p)); 993 } 994 if (node->datum.u.xperms->specified == AVTAB_XPERMS_IOCTLFUNCTION) { 995 for (i = 0; i < ARRAY_SIZE(xpermd->auditallow->p); i++) 996 xpermd->auditallow->p[i] |= 997 node->datum.u.xperms->perms.p[i]; 998 } 999 } else if (node->key.specified == AVTAB_XPERMS_DONTAUDIT) { 1000 xpermd->used |= XPERMS_DONTAUDIT; 1001 if (node->datum.u.xperms->specified == AVTAB_XPERMS_IOCTLDRIVER) { 1002 memset(xpermd->dontaudit->p, 0xff, 1003 sizeof(xpermd->dontaudit->p)); 1004 } 1005 if (node->datum.u.xperms->specified == AVTAB_XPERMS_IOCTLFUNCTION) { 1006 for (i = 0; i < ARRAY_SIZE(xpermd->dontaudit->p); i++) 1007 xpermd->dontaudit->p[i] |= 1008 node->datum.u.xperms->perms.p[i]; 1009 } 1010 } else { 1011 BUG(); 1012 } 1013 } 1014 1015 void security_compute_xperms_decision(struct selinux_state *state, 1016 u32 ssid, 1017 u32 tsid, 1018 u16 orig_tclass, 1019 u8 driver, 1020 struct extended_perms_decision *xpermd) 1021 { 1022 struct selinux_policy *policy; 1023 struct policydb *policydb; 1024 struct sidtab *sidtab; 1025 u16 tclass; 1026 struct context *scontext, *tcontext; 1027 struct avtab_key avkey; 1028 struct avtab_node *node; 1029 struct ebitmap *sattr, *tattr; 1030 struct ebitmap_node *snode, *tnode; 1031 unsigned int i, j; 1032 1033 xpermd->driver = driver; 1034 xpermd->used = 0; 1035 memset(xpermd->allowed->p, 0, sizeof(xpermd->allowed->p)); 1036 memset(xpermd->auditallow->p, 0, sizeof(xpermd->auditallow->p)); 1037 memset(xpermd->dontaudit->p, 0, sizeof(xpermd->dontaudit->p)); 1038 1039 rcu_read_lock(); 1040 if (!selinux_initialized(state)) 1041 goto allow; 1042 1043 policy = rcu_dereference(state->policy); 1044 policydb = &policy->policydb; 1045 sidtab = policy->sidtab; 1046 1047 scontext = sidtab_search(sidtab, ssid); 1048 if (!scontext) { 1049 pr_err("SELinux: %s: unrecognized SID %d\n", 1050 __func__, ssid); 1051 goto out; 1052 } 1053 1054 tcontext = sidtab_search(sidtab, tsid); 1055 if (!tcontext) { 1056 pr_err("SELinux: %s: unrecognized SID %d\n", 1057 __func__, tsid); 1058 goto out; 1059 } 1060 1061 tclass = unmap_class(&policy->map, orig_tclass); 1062 if (unlikely(orig_tclass && !tclass)) { 1063 if (policydb->allow_unknown) 1064 goto allow; 1065 goto out; 1066 } 1067 1068 1069 if (unlikely(!tclass || tclass > policydb->p_classes.nprim)) { 1070 pr_warn_ratelimited("SELinux: Invalid class %hu\n", tclass); 1071 goto out; 1072 } 1073 1074 avkey.target_class = tclass; 1075 avkey.specified = AVTAB_XPERMS; 1076 sattr = &policydb->type_attr_map_array[scontext->type - 1]; 1077 tattr = &policydb->type_attr_map_array[tcontext->type - 1]; 1078 ebitmap_for_each_positive_bit(sattr, snode, i) { 1079 ebitmap_for_each_positive_bit(tattr, tnode, j) { 1080 avkey.source_type = i + 1; 1081 avkey.target_type = j + 1; 1082 for (node = avtab_search_node(&policydb->te_avtab, 1083 &avkey); 1084 node; 1085 node = avtab_search_node_next(node, avkey.specified)) 1086 services_compute_xperms_decision(xpermd, node); 1087 1088 cond_compute_xperms(&policydb->te_cond_avtab, 1089 &avkey, xpermd); 1090 } 1091 } 1092 out: 1093 rcu_read_unlock(); 1094 return; 1095 allow: 1096 memset(xpermd->allowed->p, 0xff, sizeof(xpermd->allowed->p)); 1097 goto out; 1098 } 1099 1100 /** 1101 * security_compute_av - Compute access vector decisions. 1102 * @state: SELinux state 1103 * @ssid: source security identifier 1104 * @tsid: target security identifier 1105 * @orig_tclass: target security class 1106 * @avd: access vector decisions 1107 * @xperms: extended permissions 1108 * 1109 * Compute a set of access vector decisions based on the 1110 * SID pair (@ssid, @tsid) for the permissions in @tclass. 1111 */ 1112 void security_compute_av(struct selinux_state *state, 1113 u32 ssid, 1114 u32 tsid, 1115 u16 orig_tclass, 1116 struct av_decision *avd, 1117 struct extended_perms *xperms) 1118 { 1119 struct selinux_policy *policy; 1120 struct policydb *policydb; 1121 struct sidtab *sidtab; 1122 u16 tclass; 1123 struct context *scontext = NULL, *tcontext = NULL; 1124 1125 rcu_read_lock(); 1126 policy = rcu_dereference(state->policy); 1127 avd_init(policy, avd); 1128 xperms->len = 0; 1129 if (!selinux_initialized(state)) 1130 goto allow; 1131 1132 policydb = &policy->policydb; 1133 sidtab = policy->sidtab; 1134 1135 scontext = sidtab_search(sidtab, ssid); 1136 if (!scontext) { 1137 pr_err("SELinux: %s: unrecognized SID %d\n", 1138 __func__, ssid); 1139 goto out; 1140 } 1141 1142 /* permissive domain? */ 1143 if (ebitmap_get_bit(&policydb->permissive_map, scontext->type)) 1144 avd->flags |= AVD_FLAGS_PERMISSIVE; 1145 1146 tcontext = sidtab_search(sidtab, tsid); 1147 if (!tcontext) { 1148 pr_err("SELinux: %s: unrecognized SID %d\n", 1149 __func__, tsid); 1150 goto out; 1151 } 1152 1153 tclass = unmap_class(&policy->map, orig_tclass); 1154 if (unlikely(orig_tclass && !tclass)) { 1155 if (policydb->allow_unknown) 1156 goto allow; 1157 goto out; 1158 } 1159 context_struct_compute_av(policydb, scontext, tcontext, tclass, avd, 1160 xperms); 1161 map_decision(&policy->map, orig_tclass, avd, 1162 policydb->allow_unknown); 1163 out: 1164 rcu_read_unlock(); 1165 return; 1166 allow: 1167 avd->allowed = 0xffffffff; 1168 goto out; 1169 } 1170 1171 void security_compute_av_user(struct selinux_state *state, 1172 u32 ssid, 1173 u32 tsid, 1174 u16 tclass, 1175 struct av_decision *avd) 1176 { 1177 struct selinux_policy *policy; 1178 struct policydb *policydb; 1179 struct sidtab *sidtab; 1180 struct context *scontext = NULL, *tcontext = NULL; 1181 1182 rcu_read_lock(); 1183 policy = rcu_dereference(state->policy); 1184 avd_init(policy, avd); 1185 if (!selinux_initialized(state)) 1186 goto allow; 1187 1188 policydb = &policy->policydb; 1189 sidtab = policy->sidtab; 1190 1191 scontext = sidtab_search(sidtab, ssid); 1192 if (!scontext) { 1193 pr_err("SELinux: %s: unrecognized SID %d\n", 1194 __func__, ssid); 1195 goto out; 1196 } 1197 1198 /* permissive domain? */ 1199 if (ebitmap_get_bit(&policydb->permissive_map, scontext->type)) 1200 avd->flags |= AVD_FLAGS_PERMISSIVE; 1201 1202 tcontext = sidtab_search(sidtab, tsid); 1203 if (!tcontext) { 1204 pr_err("SELinux: %s: unrecognized SID %d\n", 1205 __func__, tsid); 1206 goto out; 1207 } 1208 1209 if (unlikely(!tclass)) { 1210 if (policydb->allow_unknown) 1211 goto allow; 1212 goto out; 1213 } 1214 1215 context_struct_compute_av(policydb, scontext, tcontext, tclass, avd, 1216 NULL); 1217 out: 1218 rcu_read_unlock(); 1219 return; 1220 allow: 1221 avd->allowed = 0xffffffff; 1222 goto out; 1223 } 1224 1225 /* 1226 * Write the security context string representation of 1227 * the context structure `context' into a dynamically 1228 * allocated string of the correct size. Set `*scontext' 1229 * to point to this string and set `*scontext_len' to 1230 * the length of the string. 1231 */ 1232 static int context_struct_to_string(struct policydb *p, 1233 struct context *context, 1234 char **scontext, u32 *scontext_len) 1235 { 1236 char *scontextp; 1237 1238 if (scontext) 1239 *scontext = NULL; 1240 *scontext_len = 0; 1241 1242 if (context->len) { 1243 *scontext_len = context->len; 1244 if (scontext) { 1245 *scontext = kstrdup(context->str, GFP_ATOMIC); 1246 if (!(*scontext)) 1247 return -ENOMEM; 1248 } 1249 return 0; 1250 } 1251 1252 /* Compute the size of the context. */ 1253 *scontext_len += strlen(sym_name(p, SYM_USERS, context->user - 1)) + 1; 1254 *scontext_len += strlen(sym_name(p, SYM_ROLES, context->role - 1)) + 1; 1255 *scontext_len += strlen(sym_name(p, SYM_TYPES, context->type - 1)) + 1; 1256 *scontext_len += mls_compute_context_len(p, context); 1257 1258 if (!scontext) 1259 return 0; 1260 1261 /* Allocate space for the context; caller must free this space. */ 1262 scontextp = kmalloc(*scontext_len, GFP_ATOMIC); 1263 if (!scontextp) 1264 return -ENOMEM; 1265 *scontext = scontextp; 1266 1267 /* 1268 * Copy the user name, role name and type name into the context. 1269 */ 1270 scontextp += sprintf(scontextp, "%s:%s:%s", 1271 sym_name(p, SYM_USERS, context->user - 1), 1272 sym_name(p, SYM_ROLES, context->role - 1), 1273 sym_name(p, SYM_TYPES, context->type - 1)); 1274 1275 mls_sid_to_context(p, context, &scontextp); 1276 1277 *scontextp = 0; 1278 1279 return 0; 1280 } 1281 1282 static int sidtab_entry_to_string(struct policydb *p, 1283 struct sidtab *sidtab, 1284 struct sidtab_entry *entry, 1285 char **scontext, u32 *scontext_len) 1286 { 1287 int rc = sidtab_sid2str_get(sidtab, entry, scontext, scontext_len); 1288 1289 if (rc != -ENOENT) 1290 return rc; 1291 1292 rc = context_struct_to_string(p, &entry->context, scontext, 1293 scontext_len); 1294 if (!rc && scontext) 1295 sidtab_sid2str_put(sidtab, entry, *scontext, *scontext_len); 1296 return rc; 1297 } 1298 1299 #include "initial_sid_to_string.h" 1300 1301 int security_sidtab_hash_stats(struct selinux_state *state, char *page) 1302 { 1303 struct selinux_policy *policy; 1304 int rc; 1305 1306 if (!selinux_initialized(state)) { 1307 pr_err("SELinux: %s: called before initial load_policy\n", 1308 __func__); 1309 return -EINVAL; 1310 } 1311 1312 rcu_read_lock(); 1313 policy = rcu_dereference(state->policy); 1314 rc = sidtab_hash_stats(policy->sidtab, page); 1315 rcu_read_unlock(); 1316 1317 return rc; 1318 } 1319 1320 const char *security_get_initial_sid_context(u32 sid) 1321 { 1322 if (unlikely(sid > SECINITSID_NUM)) 1323 return NULL; 1324 return initial_sid_to_string[sid]; 1325 } 1326 1327 static int security_sid_to_context_core(struct selinux_state *state, 1328 u32 sid, char **scontext, 1329 u32 *scontext_len, int force, 1330 int only_invalid) 1331 { 1332 struct selinux_policy *policy; 1333 struct policydb *policydb; 1334 struct sidtab *sidtab; 1335 struct sidtab_entry *entry; 1336 int rc = 0; 1337 1338 if (scontext) 1339 *scontext = NULL; 1340 *scontext_len = 0; 1341 1342 if (!selinux_initialized(state)) { 1343 if (sid <= SECINITSID_NUM) { 1344 char *scontextp; 1345 const char *s = initial_sid_to_string[sid]; 1346 1347 if (!s) 1348 return -EINVAL; 1349 *scontext_len = strlen(s) + 1; 1350 if (!scontext) 1351 return 0; 1352 scontextp = kmemdup(s, *scontext_len, GFP_ATOMIC); 1353 if (!scontextp) 1354 return -ENOMEM; 1355 *scontext = scontextp; 1356 return 0; 1357 } 1358 pr_err("SELinux: %s: called before initial " 1359 "load_policy on unknown SID %d\n", __func__, sid); 1360 return -EINVAL; 1361 } 1362 rcu_read_lock(); 1363 policy = rcu_dereference(state->policy); 1364 policydb = &policy->policydb; 1365 sidtab = policy->sidtab; 1366 1367 if (force) 1368 entry = sidtab_search_entry_force(sidtab, sid); 1369 else 1370 entry = sidtab_search_entry(sidtab, sid); 1371 if (!entry) { 1372 pr_err("SELinux: %s: unrecognized SID %d\n", 1373 __func__, sid); 1374 rc = -EINVAL; 1375 goto out_unlock; 1376 } 1377 if (only_invalid && !entry->context.len) 1378 goto out_unlock; 1379 1380 rc = sidtab_entry_to_string(policydb, sidtab, entry, scontext, 1381 scontext_len); 1382 1383 out_unlock: 1384 rcu_read_unlock(); 1385 return rc; 1386 1387 } 1388 1389 /** 1390 * security_sid_to_context - Obtain a context for a given SID. 1391 * @state: SELinux state 1392 * @sid: security identifier, SID 1393 * @scontext: security context 1394 * @scontext_len: length in bytes 1395 * 1396 * Write the string representation of the context associated with @sid 1397 * into a dynamically allocated string of the correct size. Set @scontext 1398 * to point to this string and set @scontext_len to the length of the string. 1399 */ 1400 int security_sid_to_context(struct selinux_state *state, 1401 u32 sid, char **scontext, u32 *scontext_len) 1402 { 1403 return security_sid_to_context_core(state, sid, scontext, 1404 scontext_len, 0, 0); 1405 } 1406 1407 int security_sid_to_context_force(struct selinux_state *state, u32 sid, 1408 char **scontext, u32 *scontext_len) 1409 { 1410 return security_sid_to_context_core(state, sid, scontext, 1411 scontext_len, 1, 0); 1412 } 1413 1414 /** 1415 * security_sid_to_context_inval - Obtain a context for a given SID if it 1416 * is invalid. 1417 * @state: SELinux state 1418 * @sid: security identifier, SID 1419 * @scontext: security context 1420 * @scontext_len: length in bytes 1421 * 1422 * Write the string representation of the context associated with @sid 1423 * into a dynamically allocated string of the correct size, but only if the 1424 * context is invalid in the current policy. Set @scontext to point to 1425 * this string (or NULL if the context is valid) and set @scontext_len to 1426 * the length of the string (or 0 if the context is valid). 1427 */ 1428 int security_sid_to_context_inval(struct selinux_state *state, u32 sid, 1429 char **scontext, u32 *scontext_len) 1430 { 1431 return security_sid_to_context_core(state, sid, scontext, 1432 scontext_len, 1, 1); 1433 } 1434 1435 /* 1436 * Caveat: Mutates scontext. 1437 */ 1438 static int string_to_context_struct(struct policydb *pol, 1439 struct sidtab *sidtabp, 1440 char *scontext, 1441 struct context *ctx, 1442 u32 def_sid) 1443 { 1444 struct role_datum *role; 1445 struct type_datum *typdatum; 1446 struct user_datum *usrdatum; 1447 char *scontextp, *p, oldc; 1448 int rc = 0; 1449 1450 context_init(ctx); 1451 1452 /* Parse the security context. */ 1453 1454 rc = -EINVAL; 1455 scontextp = (char *) scontext; 1456 1457 /* Extract the user. */ 1458 p = scontextp; 1459 while (*p && *p != ':') 1460 p++; 1461 1462 if (*p == 0) 1463 goto out; 1464 1465 *p++ = 0; 1466 1467 usrdatum = symtab_search(&pol->p_users, scontextp); 1468 if (!usrdatum) 1469 goto out; 1470 1471 ctx->user = usrdatum->value; 1472 1473 /* Extract role. */ 1474 scontextp = p; 1475 while (*p && *p != ':') 1476 p++; 1477 1478 if (*p == 0) 1479 goto out; 1480 1481 *p++ = 0; 1482 1483 role = symtab_search(&pol->p_roles, scontextp); 1484 if (!role) 1485 goto out; 1486 ctx->role = role->value; 1487 1488 /* Extract type. */ 1489 scontextp = p; 1490 while (*p && *p != ':') 1491 p++; 1492 oldc = *p; 1493 *p++ = 0; 1494 1495 typdatum = symtab_search(&pol->p_types, scontextp); 1496 if (!typdatum || typdatum->attribute) 1497 goto out; 1498 1499 ctx->type = typdatum->value; 1500 1501 rc = mls_context_to_sid(pol, oldc, p, ctx, sidtabp, def_sid); 1502 if (rc) 1503 goto out; 1504 1505 /* Check the validity of the new context. */ 1506 rc = -EINVAL; 1507 if (!policydb_context_isvalid(pol, ctx)) 1508 goto out; 1509 rc = 0; 1510 out: 1511 if (rc) 1512 context_destroy(ctx); 1513 return rc; 1514 } 1515 1516 static int security_context_to_sid_core(struct selinux_state *state, 1517 const char *scontext, u32 scontext_len, 1518 u32 *sid, u32 def_sid, gfp_t gfp_flags, 1519 int force) 1520 { 1521 struct selinux_policy *policy; 1522 struct policydb *policydb; 1523 struct sidtab *sidtab; 1524 char *scontext2, *str = NULL; 1525 struct context context; 1526 int rc = 0; 1527 1528 /* An empty security context is never valid. */ 1529 if (!scontext_len) 1530 return -EINVAL; 1531 1532 /* Copy the string to allow changes and ensure a NUL terminator */ 1533 scontext2 = kmemdup_nul(scontext, scontext_len, gfp_flags); 1534 if (!scontext2) 1535 return -ENOMEM; 1536 1537 if (!selinux_initialized(state)) { 1538 int i; 1539 1540 for (i = 1; i < SECINITSID_NUM; i++) { 1541 const char *s = initial_sid_to_string[i]; 1542 1543 if (s && !strcmp(s, scontext2)) { 1544 *sid = i; 1545 goto out; 1546 } 1547 } 1548 *sid = SECINITSID_KERNEL; 1549 goto out; 1550 } 1551 *sid = SECSID_NULL; 1552 1553 if (force) { 1554 /* Save another copy for storing in uninterpreted form */ 1555 rc = -ENOMEM; 1556 str = kstrdup(scontext2, gfp_flags); 1557 if (!str) 1558 goto out; 1559 } 1560 retry: 1561 rcu_read_lock(); 1562 policy = rcu_dereference(state->policy); 1563 policydb = &policy->policydb; 1564 sidtab = policy->sidtab; 1565 rc = string_to_context_struct(policydb, sidtab, scontext2, 1566 &context, def_sid); 1567 if (rc == -EINVAL && force) { 1568 context.str = str; 1569 context.len = strlen(str) + 1; 1570 str = NULL; 1571 } else if (rc) 1572 goto out_unlock; 1573 rc = sidtab_context_to_sid(sidtab, &context, sid); 1574 if (rc == -ESTALE) { 1575 rcu_read_unlock(); 1576 if (context.str) { 1577 str = context.str; 1578 context.str = NULL; 1579 } 1580 context_destroy(&context); 1581 goto retry; 1582 } 1583 context_destroy(&context); 1584 out_unlock: 1585 rcu_read_unlock(); 1586 out: 1587 kfree(scontext2); 1588 kfree(str); 1589 return rc; 1590 } 1591 1592 /** 1593 * security_context_to_sid - Obtain a SID for a given security context. 1594 * @state: SELinux state 1595 * @scontext: security context 1596 * @scontext_len: length in bytes 1597 * @sid: security identifier, SID 1598 * @gfp: context for the allocation 1599 * 1600 * Obtains a SID associated with the security context that 1601 * has the string representation specified by @scontext. 1602 * Returns -%EINVAL if the context is invalid, -%ENOMEM if insufficient 1603 * memory is available, or 0 on success. 1604 */ 1605 int security_context_to_sid(struct selinux_state *state, 1606 const char *scontext, u32 scontext_len, u32 *sid, 1607 gfp_t gfp) 1608 { 1609 return security_context_to_sid_core(state, scontext, scontext_len, 1610 sid, SECSID_NULL, gfp, 0); 1611 } 1612 1613 int security_context_str_to_sid(struct selinux_state *state, 1614 const char *scontext, u32 *sid, gfp_t gfp) 1615 { 1616 return security_context_to_sid(state, scontext, strlen(scontext), 1617 sid, gfp); 1618 } 1619 1620 /** 1621 * security_context_to_sid_default - Obtain a SID for a given security context, 1622 * falling back to specified default if needed. 1623 * 1624 * @state: SELinux state 1625 * @scontext: security context 1626 * @scontext_len: length in bytes 1627 * @sid: security identifier, SID 1628 * @def_sid: default SID to assign on error 1629 * @gfp_flags: the allocator get-free-page (GFP) flags 1630 * 1631 * Obtains a SID associated with the security context that 1632 * has the string representation specified by @scontext. 1633 * The default SID is passed to the MLS layer to be used to allow 1634 * kernel labeling of the MLS field if the MLS field is not present 1635 * (for upgrading to MLS without full relabel). 1636 * Implicitly forces adding of the context even if it cannot be mapped yet. 1637 * Returns -%EINVAL if the context is invalid, -%ENOMEM if insufficient 1638 * memory is available, or 0 on success. 1639 */ 1640 int security_context_to_sid_default(struct selinux_state *state, 1641 const char *scontext, u32 scontext_len, 1642 u32 *sid, u32 def_sid, gfp_t gfp_flags) 1643 { 1644 return security_context_to_sid_core(state, scontext, scontext_len, 1645 sid, def_sid, gfp_flags, 1); 1646 } 1647 1648 int security_context_to_sid_force(struct selinux_state *state, 1649 const char *scontext, u32 scontext_len, 1650 u32 *sid) 1651 { 1652 return security_context_to_sid_core(state, scontext, scontext_len, 1653 sid, SECSID_NULL, GFP_KERNEL, 1); 1654 } 1655 1656 static int compute_sid_handle_invalid_context( 1657 struct selinux_state *state, 1658 struct selinux_policy *policy, 1659 struct sidtab_entry *sentry, 1660 struct sidtab_entry *tentry, 1661 u16 tclass, 1662 struct context *newcontext) 1663 { 1664 struct policydb *policydb = &policy->policydb; 1665 struct sidtab *sidtab = policy->sidtab; 1666 char *s = NULL, *t = NULL, *n = NULL; 1667 u32 slen, tlen, nlen; 1668 struct audit_buffer *ab; 1669 1670 if (sidtab_entry_to_string(policydb, sidtab, sentry, &s, &slen)) 1671 goto out; 1672 if (sidtab_entry_to_string(policydb, sidtab, tentry, &t, &tlen)) 1673 goto out; 1674 if (context_struct_to_string(policydb, newcontext, &n, &nlen)) 1675 goto out; 1676 ab = audit_log_start(audit_context(), GFP_ATOMIC, AUDIT_SELINUX_ERR); 1677 if (!ab) 1678 goto out; 1679 audit_log_format(ab, 1680 "op=security_compute_sid invalid_context="); 1681 /* no need to record the NUL with untrusted strings */ 1682 audit_log_n_untrustedstring(ab, n, nlen - 1); 1683 audit_log_format(ab, " scontext=%s tcontext=%s tclass=%s", 1684 s, t, sym_name(policydb, SYM_CLASSES, tclass-1)); 1685 audit_log_end(ab); 1686 out: 1687 kfree(s); 1688 kfree(t); 1689 kfree(n); 1690 if (!enforcing_enabled(state)) 1691 return 0; 1692 return -EACCES; 1693 } 1694 1695 static void filename_compute_type(struct policydb *policydb, 1696 struct context *newcontext, 1697 u32 stype, u32 ttype, u16 tclass, 1698 const char *objname) 1699 { 1700 struct filename_trans_key ft; 1701 struct filename_trans_datum *datum; 1702 1703 /* 1704 * Most filename trans rules are going to live in specific directories 1705 * like /dev or /var/run. This bitmap will quickly skip rule searches 1706 * if the ttype does not contain any rules. 1707 */ 1708 if (!ebitmap_get_bit(&policydb->filename_trans_ttypes, ttype)) 1709 return; 1710 1711 ft.ttype = ttype; 1712 ft.tclass = tclass; 1713 ft.name = objname; 1714 1715 datum = policydb_filenametr_search(policydb, &ft); 1716 while (datum) { 1717 if (ebitmap_get_bit(&datum->stypes, stype - 1)) { 1718 newcontext->type = datum->otype; 1719 return; 1720 } 1721 datum = datum->next; 1722 } 1723 } 1724 1725 static int security_compute_sid(struct selinux_state *state, 1726 u32 ssid, 1727 u32 tsid, 1728 u16 orig_tclass, 1729 u32 specified, 1730 const char *objname, 1731 u32 *out_sid, 1732 bool kern) 1733 { 1734 struct selinux_policy *policy; 1735 struct policydb *policydb; 1736 struct sidtab *sidtab; 1737 struct class_datum *cladatum; 1738 struct context *scontext, *tcontext, newcontext; 1739 struct sidtab_entry *sentry, *tentry; 1740 struct avtab_key avkey; 1741 struct avtab_datum *avdatum; 1742 struct avtab_node *node; 1743 u16 tclass; 1744 int rc = 0; 1745 bool sock; 1746 1747 if (!selinux_initialized(state)) { 1748 switch (orig_tclass) { 1749 case SECCLASS_PROCESS: /* kernel value */ 1750 *out_sid = ssid; 1751 break; 1752 default: 1753 *out_sid = tsid; 1754 break; 1755 } 1756 goto out; 1757 } 1758 1759 retry: 1760 cladatum = NULL; 1761 context_init(&newcontext); 1762 1763 rcu_read_lock(); 1764 1765 policy = rcu_dereference(state->policy); 1766 1767 if (kern) { 1768 tclass = unmap_class(&policy->map, orig_tclass); 1769 sock = security_is_socket_class(orig_tclass); 1770 } else { 1771 tclass = orig_tclass; 1772 sock = security_is_socket_class(map_class(&policy->map, 1773 tclass)); 1774 } 1775 1776 policydb = &policy->policydb; 1777 sidtab = policy->sidtab; 1778 1779 sentry = sidtab_search_entry(sidtab, ssid); 1780 if (!sentry) { 1781 pr_err("SELinux: %s: unrecognized SID %d\n", 1782 __func__, ssid); 1783 rc = -EINVAL; 1784 goto out_unlock; 1785 } 1786 tentry = sidtab_search_entry(sidtab, tsid); 1787 if (!tentry) { 1788 pr_err("SELinux: %s: unrecognized SID %d\n", 1789 __func__, tsid); 1790 rc = -EINVAL; 1791 goto out_unlock; 1792 } 1793 1794 scontext = &sentry->context; 1795 tcontext = &tentry->context; 1796 1797 if (tclass && tclass <= policydb->p_classes.nprim) 1798 cladatum = policydb->class_val_to_struct[tclass - 1]; 1799 1800 /* Set the user identity. */ 1801 switch (specified) { 1802 case AVTAB_TRANSITION: 1803 case AVTAB_CHANGE: 1804 if (cladatum && cladatum->default_user == DEFAULT_TARGET) { 1805 newcontext.user = tcontext->user; 1806 } else { 1807 /* notice this gets both DEFAULT_SOURCE and unset */ 1808 /* Use the process user identity. */ 1809 newcontext.user = scontext->user; 1810 } 1811 break; 1812 case AVTAB_MEMBER: 1813 /* Use the related object owner. */ 1814 newcontext.user = tcontext->user; 1815 break; 1816 } 1817 1818 /* Set the role to default values. */ 1819 if (cladatum && cladatum->default_role == DEFAULT_SOURCE) { 1820 newcontext.role = scontext->role; 1821 } else if (cladatum && cladatum->default_role == DEFAULT_TARGET) { 1822 newcontext.role = tcontext->role; 1823 } else { 1824 if ((tclass == policydb->process_class) || sock) 1825 newcontext.role = scontext->role; 1826 else 1827 newcontext.role = OBJECT_R_VAL; 1828 } 1829 1830 /* Set the type to default values. */ 1831 if (cladatum && cladatum->default_type == DEFAULT_SOURCE) { 1832 newcontext.type = scontext->type; 1833 } else if (cladatum && cladatum->default_type == DEFAULT_TARGET) { 1834 newcontext.type = tcontext->type; 1835 } else { 1836 if ((tclass == policydb->process_class) || sock) { 1837 /* Use the type of process. */ 1838 newcontext.type = scontext->type; 1839 } else { 1840 /* Use the type of the related object. */ 1841 newcontext.type = tcontext->type; 1842 } 1843 } 1844 1845 /* Look for a type transition/member/change rule. */ 1846 avkey.source_type = scontext->type; 1847 avkey.target_type = tcontext->type; 1848 avkey.target_class = tclass; 1849 avkey.specified = specified; 1850 avdatum = avtab_search(&policydb->te_avtab, &avkey); 1851 1852 /* If no permanent rule, also check for enabled conditional rules */ 1853 if (!avdatum) { 1854 node = avtab_search_node(&policydb->te_cond_avtab, &avkey); 1855 for (; node; node = avtab_search_node_next(node, specified)) { 1856 if (node->key.specified & AVTAB_ENABLED) { 1857 avdatum = &node->datum; 1858 break; 1859 } 1860 } 1861 } 1862 1863 if (avdatum) { 1864 /* Use the type from the type transition/member/change rule. */ 1865 newcontext.type = avdatum->u.data; 1866 } 1867 1868 /* if we have a objname this is a file trans check so check those rules */ 1869 if (objname) 1870 filename_compute_type(policydb, &newcontext, scontext->type, 1871 tcontext->type, tclass, objname); 1872 1873 /* Check for class-specific changes. */ 1874 if (specified & AVTAB_TRANSITION) { 1875 /* Look for a role transition rule. */ 1876 struct role_trans_datum *rtd; 1877 struct role_trans_key rtk = { 1878 .role = scontext->role, 1879 .type = tcontext->type, 1880 .tclass = tclass, 1881 }; 1882 1883 rtd = policydb_roletr_search(policydb, &rtk); 1884 if (rtd) 1885 newcontext.role = rtd->new_role; 1886 } 1887 1888 /* Set the MLS attributes. 1889 This is done last because it may allocate memory. */ 1890 rc = mls_compute_sid(policydb, scontext, tcontext, tclass, specified, 1891 &newcontext, sock); 1892 if (rc) 1893 goto out_unlock; 1894 1895 /* Check the validity of the context. */ 1896 if (!policydb_context_isvalid(policydb, &newcontext)) { 1897 rc = compute_sid_handle_invalid_context(state, policy, sentry, 1898 tentry, tclass, 1899 &newcontext); 1900 if (rc) 1901 goto out_unlock; 1902 } 1903 /* Obtain the sid for the context. */ 1904 rc = sidtab_context_to_sid(sidtab, &newcontext, out_sid); 1905 if (rc == -ESTALE) { 1906 rcu_read_unlock(); 1907 context_destroy(&newcontext); 1908 goto retry; 1909 } 1910 out_unlock: 1911 rcu_read_unlock(); 1912 context_destroy(&newcontext); 1913 out: 1914 return rc; 1915 } 1916 1917 /** 1918 * security_transition_sid - Compute the SID for a new subject/object. 1919 * @state: SELinux state 1920 * @ssid: source security identifier 1921 * @tsid: target security identifier 1922 * @tclass: target security class 1923 * @qstr: object name 1924 * @out_sid: security identifier for new subject/object 1925 * 1926 * Compute a SID to use for labeling a new subject or object in the 1927 * class @tclass based on a SID pair (@ssid, @tsid). 1928 * Return -%EINVAL if any of the parameters are invalid, -%ENOMEM 1929 * if insufficient memory is available, or %0 if the new SID was 1930 * computed successfully. 1931 */ 1932 int security_transition_sid(struct selinux_state *state, 1933 u32 ssid, u32 tsid, u16 tclass, 1934 const struct qstr *qstr, u32 *out_sid) 1935 { 1936 return security_compute_sid(state, ssid, tsid, tclass, 1937 AVTAB_TRANSITION, 1938 qstr ? qstr->name : NULL, out_sid, true); 1939 } 1940 1941 int security_transition_sid_user(struct selinux_state *state, 1942 u32 ssid, u32 tsid, u16 tclass, 1943 const char *objname, u32 *out_sid) 1944 { 1945 return security_compute_sid(state, ssid, tsid, tclass, 1946 AVTAB_TRANSITION, 1947 objname, out_sid, false); 1948 } 1949 1950 /** 1951 * security_member_sid - Compute the SID for member selection. 1952 * @state: SELinux state 1953 * @ssid: source security identifier 1954 * @tsid: target security identifier 1955 * @tclass: target security class 1956 * @out_sid: security identifier for selected member 1957 * 1958 * Compute a SID to use when selecting a member of a polyinstantiated 1959 * object of class @tclass based on a SID pair (@ssid, @tsid). 1960 * Return -%EINVAL if any of the parameters are invalid, -%ENOMEM 1961 * if insufficient memory is available, or %0 if the SID was 1962 * computed successfully. 1963 */ 1964 int security_member_sid(struct selinux_state *state, 1965 u32 ssid, 1966 u32 tsid, 1967 u16 tclass, 1968 u32 *out_sid) 1969 { 1970 return security_compute_sid(state, ssid, tsid, tclass, 1971 AVTAB_MEMBER, NULL, 1972 out_sid, false); 1973 } 1974 1975 /** 1976 * security_change_sid - Compute the SID for object relabeling. 1977 * @state: SELinux state 1978 * @ssid: source security identifier 1979 * @tsid: target security identifier 1980 * @tclass: target security class 1981 * @out_sid: security identifier for selected member 1982 * 1983 * Compute a SID to use for relabeling an object of class @tclass 1984 * based on a SID pair (@ssid, @tsid). 1985 * Return -%EINVAL if any of the parameters are invalid, -%ENOMEM 1986 * if insufficient memory is available, or %0 if the SID was 1987 * computed successfully. 1988 */ 1989 int security_change_sid(struct selinux_state *state, 1990 u32 ssid, 1991 u32 tsid, 1992 u16 tclass, 1993 u32 *out_sid) 1994 { 1995 return security_compute_sid(state, 1996 ssid, tsid, tclass, AVTAB_CHANGE, NULL, 1997 out_sid, false); 1998 } 1999 2000 static inline int convert_context_handle_invalid_context( 2001 struct selinux_state *state, 2002 struct policydb *policydb, 2003 struct context *context) 2004 { 2005 char *s; 2006 u32 len; 2007 2008 if (enforcing_enabled(state)) 2009 return -EINVAL; 2010 2011 if (!context_struct_to_string(policydb, context, &s, &len)) { 2012 pr_warn("SELinux: Context %s would be invalid if enforcing\n", 2013 s); 2014 kfree(s); 2015 } 2016 return 0; 2017 } 2018 2019 /* 2020 * Convert the values in the security context 2021 * structure `oldc' from the values specified 2022 * in the policy `p->oldp' to the values specified 2023 * in the policy `p->newp', storing the new context 2024 * in `newc'. Verify that the context is valid 2025 * under the new policy. 2026 */ 2027 static int convert_context(struct context *oldc, struct context *newc, void *p) 2028 { 2029 struct convert_context_args *args; 2030 struct ocontext *oc; 2031 struct role_datum *role; 2032 struct type_datum *typdatum; 2033 struct user_datum *usrdatum; 2034 char *s; 2035 u32 len; 2036 int rc; 2037 2038 args = p; 2039 2040 if (oldc->str) { 2041 s = kstrdup(oldc->str, GFP_KERNEL); 2042 if (!s) 2043 return -ENOMEM; 2044 2045 rc = string_to_context_struct(args->newp, NULL, s, 2046 newc, SECSID_NULL); 2047 if (rc == -EINVAL) { 2048 /* 2049 * Retain string representation for later mapping. 2050 * 2051 * IMPORTANT: We need to copy the contents of oldc->str 2052 * back into s again because string_to_context_struct() 2053 * may have garbled it. 2054 */ 2055 memcpy(s, oldc->str, oldc->len); 2056 context_init(newc); 2057 newc->str = s; 2058 newc->len = oldc->len; 2059 return 0; 2060 } 2061 kfree(s); 2062 if (rc) { 2063 /* Other error condition, e.g. ENOMEM. */ 2064 pr_err("SELinux: Unable to map context %s, rc = %d.\n", 2065 oldc->str, -rc); 2066 return rc; 2067 } 2068 pr_info("SELinux: Context %s became valid (mapped).\n", 2069 oldc->str); 2070 return 0; 2071 } 2072 2073 context_init(newc); 2074 2075 /* Convert the user. */ 2076 usrdatum = symtab_search(&args->newp->p_users, 2077 sym_name(args->oldp, 2078 SYM_USERS, oldc->user - 1)); 2079 if (!usrdatum) 2080 goto bad; 2081 newc->user = usrdatum->value; 2082 2083 /* Convert the role. */ 2084 role = symtab_search(&args->newp->p_roles, 2085 sym_name(args->oldp, SYM_ROLES, oldc->role - 1)); 2086 if (!role) 2087 goto bad; 2088 newc->role = role->value; 2089 2090 /* Convert the type. */ 2091 typdatum = symtab_search(&args->newp->p_types, 2092 sym_name(args->oldp, 2093 SYM_TYPES, oldc->type - 1)); 2094 if (!typdatum) 2095 goto bad; 2096 newc->type = typdatum->value; 2097 2098 /* Convert the MLS fields if dealing with MLS policies */ 2099 if (args->oldp->mls_enabled && args->newp->mls_enabled) { 2100 rc = mls_convert_context(args->oldp, args->newp, oldc, newc); 2101 if (rc) 2102 goto bad; 2103 } else if (!args->oldp->mls_enabled && args->newp->mls_enabled) { 2104 /* 2105 * Switching between non-MLS and MLS policy: 2106 * ensure that the MLS fields of the context for all 2107 * existing entries in the sidtab are filled in with a 2108 * suitable default value, likely taken from one of the 2109 * initial SIDs. 2110 */ 2111 oc = args->newp->ocontexts[OCON_ISID]; 2112 while (oc && oc->sid[0] != SECINITSID_UNLABELED) 2113 oc = oc->next; 2114 if (!oc) { 2115 pr_err("SELinux: unable to look up" 2116 " the initial SIDs list\n"); 2117 goto bad; 2118 } 2119 rc = mls_range_set(newc, &oc->context[0].range); 2120 if (rc) 2121 goto bad; 2122 } 2123 2124 /* Check the validity of the new context. */ 2125 if (!policydb_context_isvalid(args->newp, newc)) { 2126 rc = convert_context_handle_invalid_context(args->state, 2127 args->oldp, 2128 oldc); 2129 if (rc) 2130 goto bad; 2131 } 2132 2133 return 0; 2134 bad: 2135 /* Map old representation to string and save it. */ 2136 rc = context_struct_to_string(args->oldp, oldc, &s, &len); 2137 if (rc) 2138 return rc; 2139 context_destroy(newc); 2140 newc->str = s; 2141 newc->len = len; 2142 pr_info("SELinux: Context %s became invalid (unmapped).\n", 2143 newc->str); 2144 return 0; 2145 } 2146 2147 static void security_load_policycaps(struct selinux_state *state, 2148 struct selinux_policy *policy) 2149 { 2150 struct policydb *p; 2151 unsigned int i; 2152 struct ebitmap_node *node; 2153 2154 p = &policy->policydb; 2155 2156 for (i = 0; i < ARRAY_SIZE(state->policycap); i++) 2157 WRITE_ONCE(state->policycap[i], 2158 ebitmap_get_bit(&p->policycaps, i)); 2159 2160 for (i = 0; i < ARRAY_SIZE(selinux_policycap_names); i++) 2161 pr_info("SELinux: policy capability %s=%d\n", 2162 selinux_policycap_names[i], 2163 ebitmap_get_bit(&p->policycaps, i)); 2164 2165 ebitmap_for_each_positive_bit(&p->policycaps, node, i) { 2166 if (i >= ARRAY_SIZE(selinux_policycap_names)) 2167 pr_info("SELinux: unknown policy capability %u\n", 2168 i); 2169 } 2170 } 2171 2172 static int security_preserve_bools(struct selinux_policy *oldpolicy, 2173 struct selinux_policy *newpolicy); 2174 2175 static void selinux_policy_free(struct selinux_policy *policy) 2176 { 2177 if (!policy) 2178 return; 2179 2180 sidtab_destroy(policy->sidtab); 2181 kfree(policy->map.mapping); 2182 policydb_destroy(&policy->policydb); 2183 kfree(policy->sidtab); 2184 kfree(policy); 2185 } 2186 2187 static void selinux_policy_cond_free(struct selinux_policy *policy) 2188 { 2189 cond_policydb_destroy_dup(&policy->policydb); 2190 kfree(policy); 2191 } 2192 2193 void selinux_policy_cancel(struct selinux_state *state, 2194 struct selinux_load_state *load_state) 2195 { 2196 struct selinux_policy *oldpolicy; 2197 2198 oldpolicy = rcu_dereference_protected(state->policy, 2199 lockdep_is_held(&state->policy_mutex)); 2200 2201 sidtab_cancel_convert(oldpolicy->sidtab); 2202 selinux_policy_free(load_state->policy); 2203 kfree(load_state->convert_data); 2204 } 2205 2206 static void selinux_notify_policy_change(struct selinux_state *state, 2207 u32 seqno) 2208 { 2209 /* Flush external caches and notify userspace of policy load */ 2210 avc_ss_reset(state->avc, seqno); 2211 selnl_notify_policyload(seqno); 2212 selinux_status_update_policyload(state, seqno); 2213 selinux_netlbl_cache_invalidate(); 2214 selinux_xfrm_notify_policyload(); 2215 selinux_ima_measure_state_locked(state); 2216 } 2217 2218 void selinux_policy_commit(struct selinux_state *state, 2219 struct selinux_load_state *load_state) 2220 { 2221 struct selinux_policy *oldpolicy, *newpolicy = load_state->policy; 2222 unsigned long flags; 2223 u32 seqno; 2224 2225 oldpolicy = rcu_dereference_protected(state->policy, 2226 lockdep_is_held(&state->policy_mutex)); 2227 2228 /* If switching between different policy types, log MLS status */ 2229 if (oldpolicy) { 2230 if (oldpolicy->policydb.mls_enabled && !newpolicy->policydb.mls_enabled) 2231 pr_info("SELinux: Disabling MLS support...\n"); 2232 else if (!oldpolicy->policydb.mls_enabled && newpolicy->policydb.mls_enabled) 2233 pr_info("SELinux: Enabling MLS support...\n"); 2234 } 2235 2236 /* Set latest granting seqno for new policy. */ 2237 if (oldpolicy) 2238 newpolicy->latest_granting = oldpolicy->latest_granting + 1; 2239 else 2240 newpolicy->latest_granting = 1; 2241 seqno = newpolicy->latest_granting; 2242 2243 /* Install the new policy. */ 2244 if (oldpolicy) { 2245 sidtab_freeze_begin(oldpolicy->sidtab, &flags); 2246 rcu_assign_pointer(state->policy, newpolicy); 2247 sidtab_freeze_end(oldpolicy->sidtab, &flags); 2248 } else { 2249 rcu_assign_pointer(state->policy, newpolicy); 2250 } 2251 2252 /* Load the policycaps from the new policy */ 2253 security_load_policycaps(state, newpolicy); 2254 2255 if (!selinux_initialized(state)) { 2256 /* 2257 * After first policy load, the security server is 2258 * marked as initialized and ready to handle requests and 2259 * any objects created prior to policy load are then labeled. 2260 */ 2261 selinux_mark_initialized(state); 2262 selinux_complete_init(); 2263 } 2264 2265 /* Free the old policy */ 2266 synchronize_rcu(); 2267 selinux_policy_free(oldpolicy); 2268 kfree(load_state->convert_data); 2269 2270 /* Notify others of the policy change */ 2271 selinux_notify_policy_change(state, seqno); 2272 } 2273 2274 /** 2275 * security_load_policy - Load a security policy configuration. 2276 * @state: SELinux state 2277 * @data: binary policy data 2278 * @len: length of data in bytes 2279 * @load_state: policy load state 2280 * 2281 * Load a new set of security policy configuration data, 2282 * validate it and convert the SID table as necessary. 2283 * This function will flush the access vector cache after 2284 * loading the new policy. 2285 */ 2286 int security_load_policy(struct selinux_state *state, void *data, size_t len, 2287 struct selinux_load_state *load_state) 2288 { 2289 struct selinux_policy *newpolicy, *oldpolicy; 2290 struct selinux_policy_convert_data *convert_data; 2291 int rc = 0; 2292 struct policy_file file = { data, len }, *fp = &file; 2293 2294 newpolicy = kzalloc(sizeof(*newpolicy), GFP_KERNEL); 2295 if (!newpolicy) 2296 return -ENOMEM; 2297 2298 newpolicy->sidtab = kzalloc(sizeof(*newpolicy->sidtab), GFP_KERNEL); 2299 if (!newpolicy->sidtab) { 2300 rc = -ENOMEM; 2301 goto err_policy; 2302 } 2303 2304 rc = policydb_read(&newpolicy->policydb, fp); 2305 if (rc) 2306 goto err_sidtab; 2307 2308 newpolicy->policydb.len = len; 2309 rc = selinux_set_mapping(&newpolicy->policydb, secclass_map, 2310 &newpolicy->map); 2311 if (rc) 2312 goto err_policydb; 2313 2314 rc = policydb_load_isids(&newpolicy->policydb, newpolicy->sidtab); 2315 if (rc) { 2316 pr_err("SELinux: unable to load the initial SIDs\n"); 2317 goto err_mapping; 2318 } 2319 2320 if (!selinux_initialized(state)) { 2321 /* First policy load, so no need to preserve state from old policy */ 2322 load_state->policy = newpolicy; 2323 load_state->convert_data = NULL; 2324 return 0; 2325 } 2326 2327 oldpolicy = rcu_dereference_protected(state->policy, 2328 lockdep_is_held(&state->policy_mutex)); 2329 2330 /* Preserve active boolean values from the old policy */ 2331 rc = security_preserve_bools(oldpolicy, newpolicy); 2332 if (rc) { 2333 pr_err("SELinux: unable to preserve booleans\n"); 2334 goto err_free_isids; 2335 } 2336 2337 convert_data = kmalloc(sizeof(*convert_data), GFP_KERNEL); 2338 if (!convert_data) { 2339 rc = -ENOMEM; 2340 goto err_free_isids; 2341 } 2342 2343 /* 2344 * Convert the internal representations of contexts 2345 * in the new SID table. 2346 */ 2347 convert_data->args.state = state; 2348 convert_data->args.oldp = &oldpolicy->policydb; 2349 convert_data->args.newp = &newpolicy->policydb; 2350 2351 convert_data->sidtab_params.func = convert_context; 2352 convert_data->sidtab_params.args = &convert_data->args; 2353 convert_data->sidtab_params.target = newpolicy->sidtab; 2354 2355 rc = sidtab_convert(oldpolicy->sidtab, &convert_data->sidtab_params); 2356 if (rc) { 2357 pr_err("SELinux: unable to convert the internal" 2358 " representation of contexts in the new SID" 2359 " table\n"); 2360 goto err_free_convert_data; 2361 } 2362 2363 load_state->policy = newpolicy; 2364 load_state->convert_data = convert_data; 2365 return 0; 2366 2367 err_free_convert_data: 2368 kfree(convert_data); 2369 err_free_isids: 2370 sidtab_destroy(newpolicy->sidtab); 2371 err_mapping: 2372 kfree(newpolicy->map.mapping); 2373 err_policydb: 2374 policydb_destroy(&newpolicy->policydb); 2375 err_sidtab: 2376 kfree(newpolicy->sidtab); 2377 err_policy: 2378 kfree(newpolicy); 2379 2380 return rc; 2381 } 2382 2383 /** 2384 * ocontext_to_sid - Helper to safely get sid for an ocontext 2385 * @sidtab: SID table 2386 * @c: ocontext structure 2387 * @index: index of the context entry (0 or 1) 2388 * @out_sid: pointer to the resulting SID value 2389 * 2390 * For all ocontexts except OCON_ISID the SID fields are populated 2391 * on-demand when needed. Since updating the SID value is an SMP-sensitive 2392 * operation, this helper must be used to do that safely. 2393 * 2394 * WARNING: This function may return -ESTALE, indicating that the caller 2395 * must retry the operation after re-acquiring the policy pointer! 2396 */ 2397 static int ocontext_to_sid(struct sidtab *sidtab, struct ocontext *c, 2398 size_t index, u32 *out_sid) 2399 { 2400 int rc; 2401 u32 sid; 2402 2403 /* Ensure the associated sidtab entry is visible to this thread. */ 2404 sid = smp_load_acquire(&c->sid[index]); 2405 if (!sid) { 2406 rc = sidtab_context_to_sid(sidtab, &c->context[index], &sid); 2407 if (rc) 2408 return rc; 2409 2410 /* 2411 * Ensure the new sidtab entry is visible to other threads 2412 * when they see the SID. 2413 */ 2414 smp_store_release(&c->sid[index], sid); 2415 } 2416 *out_sid = sid; 2417 return 0; 2418 } 2419 2420 /** 2421 * security_port_sid - Obtain the SID for a port. 2422 * @state: SELinux state 2423 * @protocol: protocol number 2424 * @port: port number 2425 * @out_sid: security identifier 2426 */ 2427 int security_port_sid(struct selinux_state *state, 2428 u8 protocol, u16 port, u32 *out_sid) 2429 { 2430 struct selinux_policy *policy; 2431 struct policydb *policydb; 2432 struct sidtab *sidtab; 2433 struct ocontext *c; 2434 int rc; 2435 2436 if (!selinux_initialized(state)) { 2437 *out_sid = SECINITSID_PORT; 2438 return 0; 2439 } 2440 2441 retry: 2442 rc = 0; 2443 rcu_read_lock(); 2444 policy = rcu_dereference(state->policy); 2445 policydb = &policy->policydb; 2446 sidtab = policy->sidtab; 2447 2448 c = policydb->ocontexts[OCON_PORT]; 2449 while (c) { 2450 if (c->u.port.protocol == protocol && 2451 c->u.port.low_port <= port && 2452 c->u.port.high_port >= port) 2453 break; 2454 c = c->next; 2455 } 2456 2457 if (c) { 2458 rc = ocontext_to_sid(sidtab, c, 0, out_sid); 2459 if (rc == -ESTALE) { 2460 rcu_read_unlock(); 2461 goto retry; 2462 } 2463 if (rc) 2464 goto out; 2465 } else { 2466 *out_sid = SECINITSID_PORT; 2467 } 2468 2469 out: 2470 rcu_read_unlock(); 2471 return rc; 2472 } 2473 2474 /** 2475 * security_ib_pkey_sid - Obtain the SID for a pkey. 2476 * @state: SELinux state 2477 * @subnet_prefix: Subnet Prefix 2478 * @pkey_num: pkey number 2479 * @out_sid: security identifier 2480 */ 2481 int security_ib_pkey_sid(struct selinux_state *state, 2482 u64 subnet_prefix, u16 pkey_num, u32 *out_sid) 2483 { 2484 struct selinux_policy *policy; 2485 struct policydb *policydb; 2486 struct sidtab *sidtab; 2487 struct ocontext *c; 2488 int rc; 2489 2490 if (!selinux_initialized(state)) { 2491 *out_sid = SECINITSID_UNLABELED; 2492 return 0; 2493 } 2494 2495 retry: 2496 rc = 0; 2497 rcu_read_lock(); 2498 policy = rcu_dereference(state->policy); 2499 policydb = &policy->policydb; 2500 sidtab = policy->sidtab; 2501 2502 c = policydb->ocontexts[OCON_IBPKEY]; 2503 while (c) { 2504 if (c->u.ibpkey.low_pkey <= pkey_num && 2505 c->u.ibpkey.high_pkey >= pkey_num && 2506 c->u.ibpkey.subnet_prefix == subnet_prefix) 2507 break; 2508 2509 c = c->next; 2510 } 2511 2512 if (c) { 2513 rc = ocontext_to_sid(sidtab, c, 0, out_sid); 2514 if (rc == -ESTALE) { 2515 rcu_read_unlock(); 2516 goto retry; 2517 } 2518 if (rc) 2519 goto out; 2520 } else 2521 *out_sid = SECINITSID_UNLABELED; 2522 2523 out: 2524 rcu_read_unlock(); 2525 return rc; 2526 } 2527 2528 /** 2529 * security_ib_endport_sid - Obtain the SID for a subnet management interface. 2530 * @state: SELinux state 2531 * @dev_name: device name 2532 * @port_num: port number 2533 * @out_sid: security identifier 2534 */ 2535 int security_ib_endport_sid(struct selinux_state *state, 2536 const char *dev_name, u8 port_num, u32 *out_sid) 2537 { 2538 struct selinux_policy *policy; 2539 struct policydb *policydb; 2540 struct sidtab *sidtab; 2541 struct ocontext *c; 2542 int rc; 2543 2544 if (!selinux_initialized(state)) { 2545 *out_sid = SECINITSID_UNLABELED; 2546 return 0; 2547 } 2548 2549 retry: 2550 rc = 0; 2551 rcu_read_lock(); 2552 policy = rcu_dereference(state->policy); 2553 policydb = &policy->policydb; 2554 sidtab = policy->sidtab; 2555 2556 c = policydb->ocontexts[OCON_IBENDPORT]; 2557 while (c) { 2558 if (c->u.ibendport.port == port_num && 2559 !strncmp(c->u.ibendport.dev_name, 2560 dev_name, 2561 IB_DEVICE_NAME_MAX)) 2562 break; 2563 2564 c = c->next; 2565 } 2566 2567 if (c) { 2568 rc = ocontext_to_sid(sidtab, c, 0, out_sid); 2569 if (rc == -ESTALE) { 2570 rcu_read_unlock(); 2571 goto retry; 2572 } 2573 if (rc) 2574 goto out; 2575 } else 2576 *out_sid = SECINITSID_UNLABELED; 2577 2578 out: 2579 rcu_read_unlock(); 2580 return rc; 2581 } 2582 2583 /** 2584 * security_netif_sid - Obtain the SID for a network interface. 2585 * @state: SELinux state 2586 * @name: interface name 2587 * @if_sid: interface SID 2588 */ 2589 int security_netif_sid(struct selinux_state *state, 2590 char *name, u32 *if_sid) 2591 { 2592 struct selinux_policy *policy; 2593 struct policydb *policydb; 2594 struct sidtab *sidtab; 2595 int rc; 2596 struct ocontext *c; 2597 2598 if (!selinux_initialized(state)) { 2599 *if_sid = SECINITSID_NETIF; 2600 return 0; 2601 } 2602 2603 retry: 2604 rc = 0; 2605 rcu_read_lock(); 2606 policy = rcu_dereference(state->policy); 2607 policydb = &policy->policydb; 2608 sidtab = policy->sidtab; 2609 2610 c = policydb->ocontexts[OCON_NETIF]; 2611 while (c) { 2612 if (strcmp(name, c->u.name) == 0) 2613 break; 2614 c = c->next; 2615 } 2616 2617 if (c) { 2618 rc = ocontext_to_sid(sidtab, c, 0, if_sid); 2619 if (rc == -ESTALE) { 2620 rcu_read_unlock(); 2621 goto retry; 2622 } 2623 if (rc) 2624 goto out; 2625 } else 2626 *if_sid = SECINITSID_NETIF; 2627 2628 out: 2629 rcu_read_unlock(); 2630 return rc; 2631 } 2632 2633 static int match_ipv6_addrmask(u32 *input, u32 *addr, u32 *mask) 2634 { 2635 int i, fail = 0; 2636 2637 for (i = 0; i < 4; i++) 2638 if (addr[i] != (input[i] & mask[i])) { 2639 fail = 1; 2640 break; 2641 } 2642 2643 return !fail; 2644 } 2645 2646 /** 2647 * security_node_sid - Obtain the SID for a node (host). 2648 * @state: SELinux state 2649 * @domain: communication domain aka address family 2650 * @addrp: address 2651 * @addrlen: address length in bytes 2652 * @out_sid: security identifier 2653 */ 2654 int security_node_sid(struct selinux_state *state, 2655 u16 domain, 2656 void *addrp, 2657 u32 addrlen, 2658 u32 *out_sid) 2659 { 2660 struct selinux_policy *policy; 2661 struct policydb *policydb; 2662 struct sidtab *sidtab; 2663 int rc; 2664 struct ocontext *c; 2665 2666 if (!selinux_initialized(state)) { 2667 *out_sid = SECINITSID_NODE; 2668 return 0; 2669 } 2670 2671 retry: 2672 rcu_read_lock(); 2673 policy = rcu_dereference(state->policy); 2674 policydb = &policy->policydb; 2675 sidtab = policy->sidtab; 2676 2677 switch (domain) { 2678 case AF_INET: { 2679 u32 addr; 2680 2681 rc = -EINVAL; 2682 if (addrlen != sizeof(u32)) 2683 goto out; 2684 2685 addr = *((u32 *)addrp); 2686 2687 c = policydb->ocontexts[OCON_NODE]; 2688 while (c) { 2689 if (c->u.node.addr == (addr & c->u.node.mask)) 2690 break; 2691 c = c->next; 2692 } 2693 break; 2694 } 2695 2696 case AF_INET6: 2697 rc = -EINVAL; 2698 if (addrlen != sizeof(u64) * 2) 2699 goto out; 2700 c = policydb->ocontexts[OCON_NODE6]; 2701 while (c) { 2702 if (match_ipv6_addrmask(addrp, c->u.node6.addr, 2703 c->u.node6.mask)) 2704 break; 2705 c = c->next; 2706 } 2707 break; 2708 2709 default: 2710 rc = 0; 2711 *out_sid = SECINITSID_NODE; 2712 goto out; 2713 } 2714 2715 if (c) { 2716 rc = ocontext_to_sid(sidtab, c, 0, out_sid); 2717 if (rc == -ESTALE) { 2718 rcu_read_unlock(); 2719 goto retry; 2720 } 2721 if (rc) 2722 goto out; 2723 } else { 2724 *out_sid = SECINITSID_NODE; 2725 } 2726 2727 rc = 0; 2728 out: 2729 rcu_read_unlock(); 2730 return rc; 2731 } 2732 2733 #define SIDS_NEL 25 2734 2735 /** 2736 * security_get_user_sids - Obtain reachable SIDs for a user. 2737 * @state: SELinux state 2738 * @fromsid: starting SID 2739 * @username: username 2740 * @sids: array of reachable SIDs for user 2741 * @nel: number of elements in @sids 2742 * 2743 * Generate the set of SIDs for legal security contexts 2744 * for a given user that can be reached by @fromsid. 2745 * Set *@sids to point to a dynamically allocated 2746 * array containing the set of SIDs. Set *@nel to the 2747 * number of elements in the array. 2748 */ 2749 2750 int security_get_user_sids(struct selinux_state *state, 2751 u32 fromsid, 2752 char *username, 2753 u32 **sids, 2754 u32 *nel) 2755 { 2756 struct selinux_policy *policy; 2757 struct policydb *policydb; 2758 struct sidtab *sidtab; 2759 struct context *fromcon, usercon; 2760 u32 *mysids = NULL, *mysids2, sid; 2761 u32 i, j, mynel, maxnel = SIDS_NEL; 2762 struct user_datum *user; 2763 struct role_datum *role; 2764 struct ebitmap_node *rnode, *tnode; 2765 int rc; 2766 2767 *sids = NULL; 2768 *nel = 0; 2769 2770 if (!selinux_initialized(state)) 2771 return 0; 2772 2773 mysids = kcalloc(maxnel, sizeof(*mysids), GFP_KERNEL); 2774 if (!mysids) 2775 return -ENOMEM; 2776 2777 retry: 2778 mynel = 0; 2779 rcu_read_lock(); 2780 policy = rcu_dereference(state->policy); 2781 policydb = &policy->policydb; 2782 sidtab = policy->sidtab; 2783 2784 context_init(&usercon); 2785 2786 rc = -EINVAL; 2787 fromcon = sidtab_search(sidtab, fromsid); 2788 if (!fromcon) 2789 goto out_unlock; 2790 2791 rc = -EINVAL; 2792 user = symtab_search(&policydb->p_users, username); 2793 if (!user) 2794 goto out_unlock; 2795 2796 usercon.user = user->value; 2797 2798 ebitmap_for_each_positive_bit(&user->roles, rnode, i) { 2799 role = policydb->role_val_to_struct[i]; 2800 usercon.role = i + 1; 2801 ebitmap_for_each_positive_bit(&role->types, tnode, j) { 2802 usercon.type = j + 1; 2803 2804 if (mls_setup_user_range(policydb, fromcon, user, 2805 &usercon)) 2806 continue; 2807 2808 rc = sidtab_context_to_sid(sidtab, &usercon, &sid); 2809 if (rc == -ESTALE) { 2810 rcu_read_unlock(); 2811 goto retry; 2812 } 2813 if (rc) 2814 goto out_unlock; 2815 if (mynel < maxnel) { 2816 mysids[mynel++] = sid; 2817 } else { 2818 rc = -ENOMEM; 2819 maxnel += SIDS_NEL; 2820 mysids2 = kcalloc(maxnel, sizeof(*mysids2), GFP_ATOMIC); 2821 if (!mysids2) 2822 goto out_unlock; 2823 memcpy(mysids2, mysids, mynel * sizeof(*mysids2)); 2824 kfree(mysids); 2825 mysids = mysids2; 2826 mysids[mynel++] = sid; 2827 } 2828 } 2829 } 2830 rc = 0; 2831 out_unlock: 2832 rcu_read_unlock(); 2833 if (rc || !mynel) { 2834 kfree(mysids); 2835 return rc; 2836 } 2837 2838 rc = -ENOMEM; 2839 mysids2 = kcalloc(mynel, sizeof(*mysids2), GFP_KERNEL); 2840 if (!mysids2) { 2841 kfree(mysids); 2842 return rc; 2843 } 2844 for (i = 0, j = 0; i < mynel; i++) { 2845 struct av_decision dummy_avd; 2846 rc = avc_has_perm_noaudit(state, 2847 fromsid, mysids[i], 2848 SECCLASS_PROCESS, /* kernel value */ 2849 PROCESS__TRANSITION, AVC_STRICT, 2850 &dummy_avd); 2851 if (!rc) 2852 mysids2[j++] = mysids[i]; 2853 cond_resched(); 2854 } 2855 kfree(mysids); 2856 *sids = mysids2; 2857 *nel = j; 2858 return 0; 2859 } 2860 2861 /** 2862 * __security_genfs_sid - Helper to obtain a SID for a file in a filesystem 2863 * @policy: policy 2864 * @fstype: filesystem type 2865 * @path: path from root of mount 2866 * @orig_sclass: file security class 2867 * @sid: SID for path 2868 * 2869 * Obtain a SID to use for a file in a filesystem that 2870 * cannot support xattr or use a fixed labeling behavior like 2871 * transition SIDs or task SIDs. 2872 * 2873 * WARNING: This function may return -ESTALE, indicating that the caller 2874 * must retry the operation after re-acquiring the policy pointer! 2875 */ 2876 static inline int __security_genfs_sid(struct selinux_policy *policy, 2877 const char *fstype, 2878 char *path, 2879 u16 orig_sclass, 2880 u32 *sid) 2881 { 2882 struct policydb *policydb = &policy->policydb; 2883 struct sidtab *sidtab = policy->sidtab; 2884 int len; 2885 u16 sclass; 2886 struct genfs *genfs; 2887 struct ocontext *c; 2888 int cmp = 0; 2889 2890 while (path[0] == '/' && path[1] == '/') 2891 path++; 2892 2893 sclass = unmap_class(&policy->map, orig_sclass); 2894 *sid = SECINITSID_UNLABELED; 2895 2896 for (genfs = policydb->genfs; genfs; genfs = genfs->next) { 2897 cmp = strcmp(fstype, genfs->fstype); 2898 if (cmp <= 0) 2899 break; 2900 } 2901 2902 if (!genfs || cmp) 2903 return -ENOENT; 2904 2905 for (c = genfs->head; c; c = c->next) { 2906 len = strlen(c->u.name); 2907 if ((!c->v.sclass || sclass == c->v.sclass) && 2908 (strncmp(c->u.name, path, len) == 0)) 2909 break; 2910 } 2911 2912 if (!c) 2913 return -ENOENT; 2914 2915 return ocontext_to_sid(sidtab, c, 0, sid); 2916 } 2917 2918 /** 2919 * security_genfs_sid - Obtain a SID for a file in a filesystem 2920 * @state: SELinux state 2921 * @fstype: filesystem type 2922 * @path: path from root of mount 2923 * @orig_sclass: file security class 2924 * @sid: SID for path 2925 * 2926 * Acquire policy_rwlock before calling __security_genfs_sid() and release 2927 * it afterward. 2928 */ 2929 int security_genfs_sid(struct selinux_state *state, 2930 const char *fstype, 2931 char *path, 2932 u16 orig_sclass, 2933 u32 *sid) 2934 { 2935 struct selinux_policy *policy; 2936 int retval; 2937 2938 if (!selinux_initialized(state)) { 2939 *sid = SECINITSID_UNLABELED; 2940 return 0; 2941 } 2942 2943 do { 2944 rcu_read_lock(); 2945 policy = rcu_dereference(state->policy); 2946 retval = __security_genfs_sid(policy, fstype, path, 2947 orig_sclass, sid); 2948 rcu_read_unlock(); 2949 } while (retval == -ESTALE); 2950 return retval; 2951 } 2952 2953 int selinux_policy_genfs_sid(struct selinux_policy *policy, 2954 const char *fstype, 2955 char *path, 2956 u16 orig_sclass, 2957 u32 *sid) 2958 { 2959 /* no lock required, policy is not yet accessible by other threads */ 2960 return __security_genfs_sid(policy, fstype, path, orig_sclass, sid); 2961 } 2962 2963 /** 2964 * security_fs_use - Determine how to handle labeling for a filesystem. 2965 * @state: SELinux state 2966 * @sb: superblock in question 2967 */ 2968 int security_fs_use(struct selinux_state *state, struct super_block *sb) 2969 { 2970 struct selinux_policy *policy; 2971 struct policydb *policydb; 2972 struct sidtab *sidtab; 2973 int rc; 2974 struct ocontext *c; 2975 struct superblock_security_struct *sbsec = selinux_superblock(sb); 2976 const char *fstype = sb->s_type->name; 2977 2978 if (!selinux_initialized(state)) { 2979 sbsec->behavior = SECURITY_FS_USE_NONE; 2980 sbsec->sid = SECINITSID_UNLABELED; 2981 return 0; 2982 } 2983 2984 retry: 2985 rc = 0; 2986 rcu_read_lock(); 2987 policy = rcu_dereference(state->policy); 2988 policydb = &policy->policydb; 2989 sidtab = policy->sidtab; 2990 2991 c = policydb->ocontexts[OCON_FSUSE]; 2992 while (c) { 2993 if (strcmp(fstype, c->u.name) == 0) 2994 break; 2995 c = c->next; 2996 } 2997 2998 if (c) { 2999 sbsec->behavior = c->v.behavior; 3000 rc = ocontext_to_sid(sidtab, c, 0, &sbsec->sid); 3001 if (rc == -ESTALE) { 3002 rcu_read_unlock(); 3003 goto retry; 3004 } 3005 if (rc) 3006 goto out; 3007 } else { 3008 rc = __security_genfs_sid(policy, fstype, "/", 3009 SECCLASS_DIR, &sbsec->sid); 3010 if (rc == -ESTALE) { 3011 rcu_read_unlock(); 3012 goto retry; 3013 } 3014 if (rc) { 3015 sbsec->behavior = SECURITY_FS_USE_NONE; 3016 rc = 0; 3017 } else { 3018 sbsec->behavior = SECURITY_FS_USE_GENFS; 3019 } 3020 } 3021 3022 out: 3023 rcu_read_unlock(); 3024 return rc; 3025 } 3026 3027 int security_get_bools(struct selinux_policy *policy, 3028 u32 *len, char ***names, int **values) 3029 { 3030 struct policydb *policydb; 3031 u32 i; 3032 int rc; 3033 3034 policydb = &policy->policydb; 3035 3036 *names = NULL; 3037 *values = NULL; 3038 3039 rc = 0; 3040 *len = policydb->p_bools.nprim; 3041 if (!*len) 3042 goto out; 3043 3044 rc = -ENOMEM; 3045 *names = kcalloc(*len, sizeof(char *), GFP_ATOMIC); 3046 if (!*names) 3047 goto err; 3048 3049 rc = -ENOMEM; 3050 *values = kcalloc(*len, sizeof(int), GFP_ATOMIC); 3051 if (!*values) 3052 goto err; 3053 3054 for (i = 0; i < *len; i++) { 3055 (*values)[i] = policydb->bool_val_to_struct[i]->state; 3056 3057 rc = -ENOMEM; 3058 (*names)[i] = kstrdup(sym_name(policydb, SYM_BOOLS, i), 3059 GFP_ATOMIC); 3060 if (!(*names)[i]) 3061 goto err; 3062 } 3063 rc = 0; 3064 out: 3065 return rc; 3066 err: 3067 if (*names) { 3068 for (i = 0; i < *len; i++) 3069 kfree((*names)[i]); 3070 kfree(*names); 3071 } 3072 kfree(*values); 3073 *len = 0; 3074 *names = NULL; 3075 *values = NULL; 3076 goto out; 3077 } 3078 3079 3080 int security_set_bools(struct selinux_state *state, u32 len, int *values) 3081 { 3082 struct selinux_policy *newpolicy, *oldpolicy; 3083 int rc; 3084 u32 i, seqno = 0; 3085 3086 if (!selinux_initialized(state)) 3087 return -EINVAL; 3088 3089 oldpolicy = rcu_dereference_protected(state->policy, 3090 lockdep_is_held(&state->policy_mutex)); 3091 3092 /* Consistency check on number of booleans, should never fail */ 3093 if (WARN_ON(len != oldpolicy->policydb.p_bools.nprim)) 3094 return -EINVAL; 3095 3096 newpolicy = kmemdup(oldpolicy, sizeof(*newpolicy), GFP_KERNEL); 3097 if (!newpolicy) 3098 return -ENOMEM; 3099 3100 /* 3101 * Deep copy only the parts of the policydb that might be 3102 * modified as a result of changing booleans. 3103 */ 3104 rc = cond_policydb_dup(&newpolicy->policydb, &oldpolicy->policydb); 3105 if (rc) { 3106 kfree(newpolicy); 3107 return -ENOMEM; 3108 } 3109 3110 /* Update the boolean states in the copy */ 3111 for (i = 0; i < len; i++) { 3112 int new_state = !!values[i]; 3113 int old_state = newpolicy->policydb.bool_val_to_struct[i]->state; 3114 3115 if (new_state != old_state) { 3116 audit_log(audit_context(), GFP_ATOMIC, 3117 AUDIT_MAC_CONFIG_CHANGE, 3118 "bool=%s val=%d old_val=%d auid=%u ses=%u", 3119 sym_name(&newpolicy->policydb, SYM_BOOLS, i), 3120 new_state, 3121 old_state, 3122 from_kuid(&init_user_ns, audit_get_loginuid(current)), 3123 audit_get_sessionid(current)); 3124 newpolicy->policydb.bool_val_to_struct[i]->state = new_state; 3125 } 3126 } 3127 3128 /* Re-evaluate the conditional rules in the copy */ 3129 evaluate_cond_nodes(&newpolicy->policydb); 3130 3131 /* Set latest granting seqno for new policy */ 3132 newpolicy->latest_granting = oldpolicy->latest_granting + 1; 3133 seqno = newpolicy->latest_granting; 3134 3135 /* Install the new policy */ 3136 rcu_assign_pointer(state->policy, newpolicy); 3137 3138 /* 3139 * Free the conditional portions of the old policydb 3140 * that were copied for the new policy, and the oldpolicy 3141 * structure itself but not what it references. 3142 */ 3143 synchronize_rcu(); 3144 selinux_policy_cond_free(oldpolicy); 3145 3146 /* Notify others of the policy change */ 3147 selinux_notify_policy_change(state, seqno); 3148 return 0; 3149 } 3150 3151 int security_get_bool_value(struct selinux_state *state, 3152 u32 index) 3153 { 3154 struct selinux_policy *policy; 3155 struct policydb *policydb; 3156 int rc; 3157 u32 len; 3158 3159 if (!selinux_initialized(state)) 3160 return 0; 3161 3162 rcu_read_lock(); 3163 policy = rcu_dereference(state->policy); 3164 policydb = &policy->policydb; 3165 3166 rc = -EFAULT; 3167 len = policydb->p_bools.nprim; 3168 if (index >= len) 3169 goto out; 3170 3171 rc = policydb->bool_val_to_struct[index]->state; 3172 out: 3173 rcu_read_unlock(); 3174 return rc; 3175 } 3176 3177 static int security_preserve_bools(struct selinux_policy *oldpolicy, 3178 struct selinux_policy *newpolicy) 3179 { 3180 int rc, *bvalues = NULL; 3181 char **bnames = NULL; 3182 struct cond_bool_datum *booldatum; 3183 u32 i, nbools = 0; 3184 3185 rc = security_get_bools(oldpolicy, &nbools, &bnames, &bvalues); 3186 if (rc) 3187 goto out; 3188 for (i = 0; i < nbools; i++) { 3189 booldatum = symtab_search(&newpolicy->policydb.p_bools, 3190 bnames[i]); 3191 if (booldatum) 3192 booldatum->state = bvalues[i]; 3193 } 3194 evaluate_cond_nodes(&newpolicy->policydb); 3195 3196 out: 3197 if (bnames) { 3198 for (i = 0; i < nbools; i++) 3199 kfree(bnames[i]); 3200 } 3201 kfree(bnames); 3202 kfree(bvalues); 3203 return rc; 3204 } 3205 3206 /* 3207 * security_sid_mls_copy() - computes a new sid based on the given 3208 * sid and the mls portion of mls_sid. 3209 */ 3210 int security_sid_mls_copy(struct selinux_state *state, 3211 u32 sid, u32 mls_sid, u32 *new_sid) 3212 { 3213 struct selinux_policy *policy; 3214 struct policydb *policydb; 3215 struct sidtab *sidtab; 3216 struct context *context1; 3217 struct context *context2; 3218 struct context newcon; 3219 char *s; 3220 u32 len; 3221 int rc; 3222 3223 if (!selinux_initialized(state)) { 3224 *new_sid = sid; 3225 return 0; 3226 } 3227 3228 retry: 3229 rc = 0; 3230 context_init(&newcon); 3231 3232 rcu_read_lock(); 3233 policy = rcu_dereference(state->policy); 3234 policydb = &policy->policydb; 3235 sidtab = policy->sidtab; 3236 3237 if (!policydb->mls_enabled) { 3238 *new_sid = sid; 3239 goto out_unlock; 3240 } 3241 3242 rc = -EINVAL; 3243 context1 = sidtab_search(sidtab, sid); 3244 if (!context1) { 3245 pr_err("SELinux: %s: unrecognized SID %d\n", 3246 __func__, sid); 3247 goto out_unlock; 3248 } 3249 3250 rc = -EINVAL; 3251 context2 = sidtab_search(sidtab, mls_sid); 3252 if (!context2) { 3253 pr_err("SELinux: %s: unrecognized SID %d\n", 3254 __func__, mls_sid); 3255 goto out_unlock; 3256 } 3257 3258 newcon.user = context1->user; 3259 newcon.role = context1->role; 3260 newcon.type = context1->type; 3261 rc = mls_context_cpy(&newcon, context2); 3262 if (rc) 3263 goto out_unlock; 3264 3265 /* Check the validity of the new context. */ 3266 if (!policydb_context_isvalid(policydb, &newcon)) { 3267 rc = convert_context_handle_invalid_context(state, policydb, 3268 &newcon); 3269 if (rc) { 3270 if (!context_struct_to_string(policydb, &newcon, &s, 3271 &len)) { 3272 struct audit_buffer *ab; 3273 3274 ab = audit_log_start(audit_context(), 3275 GFP_ATOMIC, 3276 AUDIT_SELINUX_ERR); 3277 audit_log_format(ab, 3278 "op=security_sid_mls_copy invalid_context="); 3279 /* don't record NUL with untrusted strings */ 3280 audit_log_n_untrustedstring(ab, s, len - 1); 3281 audit_log_end(ab); 3282 kfree(s); 3283 } 3284 goto out_unlock; 3285 } 3286 } 3287 rc = sidtab_context_to_sid(sidtab, &newcon, new_sid); 3288 if (rc == -ESTALE) { 3289 rcu_read_unlock(); 3290 context_destroy(&newcon); 3291 goto retry; 3292 } 3293 out_unlock: 3294 rcu_read_unlock(); 3295 context_destroy(&newcon); 3296 return rc; 3297 } 3298 3299 /** 3300 * security_net_peersid_resolve - Compare and resolve two network peer SIDs 3301 * @state: SELinux state 3302 * @nlbl_sid: NetLabel SID 3303 * @nlbl_type: NetLabel labeling protocol type 3304 * @xfrm_sid: XFRM SID 3305 * @peer_sid: network peer sid 3306 * 3307 * Description: 3308 * Compare the @nlbl_sid and @xfrm_sid values and if the two SIDs can be 3309 * resolved into a single SID it is returned via @peer_sid and the function 3310 * returns zero. Otherwise @peer_sid is set to SECSID_NULL and the function 3311 * returns a negative value. A table summarizing the behavior is below: 3312 * 3313 * | function return | @sid 3314 * ------------------------------+-----------------+----------------- 3315 * no peer labels | 0 | SECSID_NULL 3316 * single peer label | 0 | <peer_label> 3317 * multiple, consistent labels | 0 | <peer_label> 3318 * multiple, inconsistent labels | -<errno> | SECSID_NULL 3319 * 3320 */ 3321 int security_net_peersid_resolve(struct selinux_state *state, 3322 u32 nlbl_sid, u32 nlbl_type, 3323 u32 xfrm_sid, 3324 u32 *peer_sid) 3325 { 3326 struct selinux_policy *policy; 3327 struct policydb *policydb; 3328 struct sidtab *sidtab; 3329 int rc; 3330 struct context *nlbl_ctx; 3331 struct context *xfrm_ctx; 3332 3333 *peer_sid = SECSID_NULL; 3334 3335 /* handle the common (which also happens to be the set of easy) cases 3336 * right away, these two if statements catch everything involving a 3337 * single or absent peer SID/label */ 3338 if (xfrm_sid == SECSID_NULL) { 3339 *peer_sid = nlbl_sid; 3340 return 0; 3341 } 3342 /* NOTE: an nlbl_type == NETLBL_NLTYPE_UNLABELED is a "fallback" label 3343 * and is treated as if nlbl_sid == SECSID_NULL when a XFRM SID/label 3344 * is present */ 3345 if (nlbl_sid == SECSID_NULL || nlbl_type == NETLBL_NLTYPE_UNLABELED) { 3346 *peer_sid = xfrm_sid; 3347 return 0; 3348 } 3349 3350 if (!selinux_initialized(state)) 3351 return 0; 3352 3353 rcu_read_lock(); 3354 policy = rcu_dereference(state->policy); 3355 policydb = &policy->policydb; 3356 sidtab = policy->sidtab; 3357 3358 /* 3359 * We don't need to check initialized here since the only way both 3360 * nlbl_sid and xfrm_sid are not equal to SECSID_NULL would be if the 3361 * security server was initialized and state->initialized was true. 3362 */ 3363 if (!policydb->mls_enabled) { 3364 rc = 0; 3365 goto out; 3366 } 3367 3368 rc = -EINVAL; 3369 nlbl_ctx = sidtab_search(sidtab, nlbl_sid); 3370 if (!nlbl_ctx) { 3371 pr_err("SELinux: %s: unrecognized SID %d\n", 3372 __func__, nlbl_sid); 3373 goto out; 3374 } 3375 rc = -EINVAL; 3376 xfrm_ctx = sidtab_search(sidtab, xfrm_sid); 3377 if (!xfrm_ctx) { 3378 pr_err("SELinux: %s: unrecognized SID %d\n", 3379 __func__, xfrm_sid); 3380 goto out; 3381 } 3382 rc = (mls_context_cmp(nlbl_ctx, xfrm_ctx) ? 0 : -EACCES); 3383 if (rc) 3384 goto out; 3385 3386 /* at present NetLabel SIDs/labels really only carry MLS 3387 * information so if the MLS portion of the NetLabel SID 3388 * matches the MLS portion of the labeled XFRM SID/label 3389 * then pass along the XFRM SID as it is the most 3390 * expressive */ 3391 *peer_sid = xfrm_sid; 3392 out: 3393 rcu_read_unlock(); 3394 return rc; 3395 } 3396 3397 static int get_classes_callback(void *k, void *d, void *args) 3398 { 3399 struct class_datum *datum = d; 3400 char *name = k, **classes = args; 3401 int value = datum->value - 1; 3402 3403 classes[value] = kstrdup(name, GFP_ATOMIC); 3404 if (!classes[value]) 3405 return -ENOMEM; 3406 3407 return 0; 3408 } 3409 3410 int security_get_classes(struct selinux_policy *policy, 3411 char ***classes, int *nclasses) 3412 { 3413 struct policydb *policydb; 3414 int rc; 3415 3416 policydb = &policy->policydb; 3417 3418 rc = -ENOMEM; 3419 *nclasses = policydb->p_classes.nprim; 3420 *classes = kcalloc(*nclasses, sizeof(**classes), GFP_ATOMIC); 3421 if (!*classes) 3422 goto out; 3423 3424 rc = hashtab_map(&policydb->p_classes.table, get_classes_callback, 3425 *classes); 3426 if (rc) { 3427 int i; 3428 for (i = 0; i < *nclasses; i++) 3429 kfree((*classes)[i]); 3430 kfree(*classes); 3431 } 3432 3433 out: 3434 return rc; 3435 } 3436 3437 static int get_permissions_callback(void *k, void *d, void *args) 3438 { 3439 struct perm_datum *datum = d; 3440 char *name = k, **perms = args; 3441 int value = datum->value - 1; 3442 3443 perms[value] = kstrdup(name, GFP_ATOMIC); 3444 if (!perms[value]) 3445 return -ENOMEM; 3446 3447 return 0; 3448 } 3449 3450 int security_get_permissions(struct selinux_policy *policy, 3451 char *class, char ***perms, int *nperms) 3452 { 3453 struct policydb *policydb; 3454 int rc, i; 3455 struct class_datum *match; 3456 3457 policydb = &policy->policydb; 3458 3459 rc = -EINVAL; 3460 match = symtab_search(&policydb->p_classes, class); 3461 if (!match) { 3462 pr_err("SELinux: %s: unrecognized class %s\n", 3463 __func__, class); 3464 goto out; 3465 } 3466 3467 rc = -ENOMEM; 3468 *nperms = match->permissions.nprim; 3469 *perms = kcalloc(*nperms, sizeof(**perms), GFP_ATOMIC); 3470 if (!*perms) 3471 goto out; 3472 3473 if (match->comdatum) { 3474 rc = hashtab_map(&match->comdatum->permissions.table, 3475 get_permissions_callback, *perms); 3476 if (rc) 3477 goto err; 3478 } 3479 3480 rc = hashtab_map(&match->permissions.table, get_permissions_callback, 3481 *perms); 3482 if (rc) 3483 goto err; 3484 3485 out: 3486 return rc; 3487 3488 err: 3489 for (i = 0; i < *nperms; i++) 3490 kfree((*perms)[i]); 3491 kfree(*perms); 3492 return rc; 3493 } 3494 3495 int security_get_reject_unknown(struct selinux_state *state) 3496 { 3497 struct selinux_policy *policy; 3498 int value; 3499 3500 if (!selinux_initialized(state)) 3501 return 0; 3502 3503 rcu_read_lock(); 3504 policy = rcu_dereference(state->policy); 3505 value = policy->policydb.reject_unknown; 3506 rcu_read_unlock(); 3507 return value; 3508 } 3509 3510 int security_get_allow_unknown(struct selinux_state *state) 3511 { 3512 struct selinux_policy *policy; 3513 int value; 3514 3515 if (!selinux_initialized(state)) 3516 return 0; 3517 3518 rcu_read_lock(); 3519 policy = rcu_dereference(state->policy); 3520 value = policy->policydb.allow_unknown; 3521 rcu_read_unlock(); 3522 return value; 3523 } 3524 3525 /** 3526 * security_policycap_supported - Check for a specific policy capability 3527 * @state: SELinux state 3528 * @req_cap: capability 3529 * 3530 * Description: 3531 * This function queries the currently loaded policy to see if it supports the 3532 * capability specified by @req_cap. Returns true (1) if the capability is 3533 * supported, false (0) if it isn't supported. 3534 * 3535 */ 3536 int security_policycap_supported(struct selinux_state *state, 3537 unsigned int req_cap) 3538 { 3539 struct selinux_policy *policy; 3540 int rc; 3541 3542 if (!selinux_initialized(state)) 3543 return 0; 3544 3545 rcu_read_lock(); 3546 policy = rcu_dereference(state->policy); 3547 rc = ebitmap_get_bit(&policy->policydb.policycaps, req_cap); 3548 rcu_read_unlock(); 3549 3550 return rc; 3551 } 3552 3553 struct selinux_audit_rule { 3554 u32 au_seqno; 3555 struct context au_ctxt; 3556 }; 3557 3558 void selinux_audit_rule_free(void *vrule) 3559 { 3560 struct selinux_audit_rule *rule = vrule; 3561 3562 if (rule) { 3563 context_destroy(&rule->au_ctxt); 3564 kfree(rule); 3565 } 3566 } 3567 3568 int selinux_audit_rule_init(u32 field, u32 op, char *rulestr, void **vrule) 3569 { 3570 struct selinux_state *state = &selinux_state; 3571 struct selinux_policy *policy; 3572 struct policydb *policydb; 3573 struct selinux_audit_rule *tmprule; 3574 struct role_datum *roledatum; 3575 struct type_datum *typedatum; 3576 struct user_datum *userdatum; 3577 struct selinux_audit_rule **rule = (struct selinux_audit_rule **)vrule; 3578 int rc = 0; 3579 3580 *rule = NULL; 3581 3582 if (!selinux_initialized(state)) 3583 return -EOPNOTSUPP; 3584 3585 switch (field) { 3586 case AUDIT_SUBJ_USER: 3587 case AUDIT_SUBJ_ROLE: 3588 case AUDIT_SUBJ_TYPE: 3589 case AUDIT_OBJ_USER: 3590 case AUDIT_OBJ_ROLE: 3591 case AUDIT_OBJ_TYPE: 3592 /* only 'equals' and 'not equals' fit user, role, and type */ 3593 if (op != Audit_equal && op != Audit_not_equal) 3594 return -EINVAL; 3595 break; 3596 case AUDIT_SUBJ_SEN: 3597 case AUDIT_SUBJ_CLR: 3598 case AUDIT_OBJ_LEV_LOW: 3599 case AUDIT_OBJ_LEV_HIGH: 3600 /* we do not allow a range, indicated by the presence of '-' */ 3601 if (strchr(rulestr, '-')) 3602 return -EINVAL; 3603 break; 3604 default: 3605 /* only the above fields are valid */ 3606 return -EINVAL; 3607 } 3608 3609 tmprule = kzalloc(sizeof(struct selinux_audit_rule), GFP_KERNEL); 3610 if (!tmprule) 3611 return -ENOMEM; 3612 3613 context_init(&tmprule->au_ctxt); 3614 3615 rcu_read_lock(); 3616 policy = rcu_dereference(state->policy); 3617 policydb = &policy->policydb; 3618 3619 tmprule->au_seqno = policy->latest_granting; 3620 3621 switch (field) { 3622 case AUDIT_SUBJ_USER: 3623 case AUDIT_OBJ_USER: 3624 rc = -EINVAL; 3625 userdatum = symtab_search(&policydb->p_users, rulestr); 3626 if (!userdatum) 3627 goto out; 3628 tmprule->au_ctxt.user = userdatum->value; 3629 break; 3630 case AUDIT_SUBJ_ROLE: 3631 case AUDIT_OBJ_ROLE: 3632 rc = -EINVAL; 3633 roledatum = symtab_search(&policydb->p_roles, rulestr); 3634 if (!roledatum) 3635 goto out; 3636 tmprule->au_ctxt.role = roledatum->value; 3637 break; 3638 case AUDIT_SUBJ_TYPE: 3639 case AUDIT_OBJ_TYPE: 3640 rc = -EINVAL; 3641 typedatum = symtab_search(&policydb->p_types, rulestr); 3642 if (!typedatum) 3643 goto out; 3644 tmprule->au_ctxt.type = typedatum->value; 3645 break; 3646 case AUDIT_SUBJ_SEN: 3647 case AUDIT_SUBJ_CLR: 3648 case AUDIT_OBJ_LEV_LOW: 3649 case AUDIT_OBJ_LEV_HIGH: 3650 rc = mls_from_string(policydb, rulestr, &tmprule->au_ctxt, 3651 GFP_ATOMIC); 3652 if (rc) 3653 goto out; 3654 break; 3655 } 3656 rc = 0; 3657 out: 3658 rcu_read_unlock(); 3659 3660 if (rc) { 3661 selinux_audit_rule_free(tmprule); 3662 tmprule = NULL; 3663 } 3664 3665 *rule = tmprule; 3666 3667 return rc; 3668 } 3669 3670 /* Check to see if the rule contains any selinux fields */ 3671 int selinux_audit_rule_known(struct audit_krule *rule) 3672 { 3673 int i; 3674 3675 for (i = 0; i < rule->field_count; i++) { 3676 struct audit_field *f = &rule->fields[i]; 3677 switch (f->type) { 3678 case AUDIT_SUBJ_USER: 3679 case AUDIT_SUBJ_ROLE: 3680 case AUDIT_SUBJ_TYPE: 3681 case AUDIT_SUBJ_SEN: 3682 case AUDIT_SUBJ_CLR: 3683 case AUDIT_OBJ_USER: 3684 case AUDIT_OBJ_ROLE: 3685 case AUDIT_OBJ_TYPE: 3686 case AUDIT_OBJ_LEV_LOW: 3687 case AUDIT_OBJ_LEV_HIGH: 3688 return 1; 3689 } 3690 } 3691 3692 return 0; 3693 } 3694 3695 int selinux_audit_rule_match(u32 sid, u32 field, u32 op, void *vrule) 3696 { 3697 struct selinux_state *state = &selinux_state; 3698 struct selinux_policy *policy; 3699 struct context *ctxt; 3700 struct mls_level *level; 3701 struct selinux_audit_rule *rule = vrule; 3702 int match = 0; 3703 3704 if (unlikely(!rule)) { 3705 WARN_ONCE(1, "selinux_audit_rule_match: missing rule\n"); 3706 return -ENOENT; 3707 } 3708 3709 if (!selinux_initialized(state)) 3710 return 0; 3711 3712 rcu_read_lock(); 3713 3714 policy = rcu_dereference(state->policy); 3715 3716 if (rule->au_seqno < policy->latest_granting) { 3717 match = -ESTALE; 3718 goto out; 3719 } 3720 3721 ctxt = sidtab_search(policy->sidtab, sid); 3722 if (unlikely(!ctxt)) { 3723 WARN_ONCE(1, "selinux_audit_rule_match: unrecognized SID %d\n", 3724 sid); 3725 match = -ENOENT; 3726 goto out; 3727 } 3728 3729 /* a field/op pair that is not caught here will simply fall through 3730 without a match */ 3731 switch (field) { 3732 case AUDIT_SUBJ_USER: 3733 case AUDIT_OBJ_USER: 3734 switch (op) { 3735 case Audit_equal: 3736 match = (ctxt->user == rule->au_ctxt.user); 3737 break; 3738 case Audit_not_equal: 3739 match = (ctxt->user != rule->au_ctxt.user); 3740 break; 3741 } 3742 break; 3743 case AUDIT_SUBJ_ROLE: 3744 case AUDIT_OBJ_ROLE: 3745 switch (op) { 3746 case Audit_equal: 3747 match = (ctxt->role == rule->au_ctxt.role); 3748 break; 3749 case Audit_not_equal: 3750 match = (ctxt->role != rule->au_ctxt.role); 3751 break; 3752 } 3753 break; 3754 case AUDIT_SUBJ_TYPE: 3755 case AUDIT_OBJ_TYPE: 3756 switch (op) { 3757 case Audit_equal: 3758 match = (ctxt->type == rule->au_ctxt.type); 3759 break; 3760 case Audit_not_equal: 3761 match = (ctxt->type != rule->au_ctxt.type); 3762 break; 3763 } 3764 break; 3765 case AUDIT_SUBJ_SEN: 3766 case AUDIT_SUBJ_CLR: 3767 case AUDIT_OBJ_LEV_LOW: 3768 case AUDIT_OBJ_LEV_HIGH: 3769 level = ((field == AUDIT_SUBJ_SEN || 3770 field == AUDIT_OBJ_LEV_LOW) ? 3771 &ctxt->range.level[0] : &ctxt->range.level[1]); 3772 switch (op) { 3773 case Audit_equal: 3774 match = mls_level_eq(&rule->au_ctxt.range.level[0], 3775 level); 3776 break; 3777 case Audit_not_equal: 3778 match = !mls_level_eq(&rule->au_ctxt.range.level[0], 3779 level); 3780 break; 3781 case Audit_lt: 3782 match = (mls_level_dom(&rule->au_ctxt.range.level[0], 3783 level) && 3784 !mls_level_eq(&rule->au_ctxt.range.level[0], 3785 level)); 3786 break; 3787 case Audit_le: 3788 match = mls_level_dom(&rule->au_ctxt.range.level[0], 3789 level); 3790 break; 3791 case Audit_gt: 3792 match = (mls_level_dom(level, 3793 &rule->au_ctxt.range.level[0]) && 3794 !mls_level_eq(level, 3795 &rule->au_ctxt.range.level[0])); 3796 break; 3797 case Audit_ge: 3798 match = mls_level_dom(level, 3799 &rule->au_ctxt.range.level[0]); 3800 break; 3801 } 3802 } 3803 3804 out: 3805 rcu_read_unlock(); 3806 return match; 3807 } 3808 3809 static int aurule_avc_callback(u32 event) 3810 { 3811 if (event == AVC_CALLBACK_RESET) 3812 return audit_update_lsm_rules(); 3813 return 0; 3814 } 3815 3816 static int __init aurule_init(void) 3817 { 3818 int err; 3819 3820 err = avc_add_callback(aurule_avc_callback, AVC_CALLBACK_RESET); 3821 if (err) 3822 panic("avc_add_callback() failed, error %d\n", err); 3823 3824 return err; 3825 } 3826 __initcall(aurule_init); 3827 3828 #ifdef CONFIG_NETLABEL 3829 /** 3830 * security_netlbl_cache_add - Add an entry to the NetLabel cache 3831 * @secattr: the NetLabel packet security attributes 3832 * @sid: the SELinux SID 3833 * 3834 * Description: 3835 * Attempt to cache the context in @ctx, which was derived from the packet in 3836 * @skb, in the NetLabel subsystem cache. This function assumes @secattr has 3837 * already been initialized. 3838 * 3839 */ 3840 static void security_netlbl_cache_add(struct netlbl_lsm_secattr *secattr, 3841 u32 sid) 3842 { 3843 u32 *sid_cache; 3844 3845 sid_cache = kmalloc(sizeof(*sid_cache), GFP_ATOMIC); 3846 if (sid_cache == NULL) 3847 return; 3848 secattr->cache = netlbl_secattr_cache_alloc(GFP_ATOMIC); 3849 if (secattr->cache == NULL) { 3850 kfree(sid_cache); 3851 return; 3852 } 3853 3854 *sid_cache = sid; 3855 secattr->cache->free = kfree; 3856 secattr->cache->data = sid_cache; 3857 secattr->flags |= NETLBL_SECATTR_CACHE; 3858 } 3859 3860 /** 3861 * security_netlbl_secattr_to_sid - Convert a NetLabel secattr to a SELinux SID 3862 * @state: SELinux state 3863 * @secattr: the NetLabel packet security attributes 3864 * @sid: the SELinux SID 3865 * 3866 * Description: 3867 * Convert the given NetLabel security attributes in @secattr into a 3868 * SELinux SID. If the @secattr field does not contain a full SELinux 3869 * SID/context then use SECINITSID_NETMSG as the foundation. If possible the 3870 * 'cache' field of @secattr is set and the CACHE flag is set; this is to 3871 * allow the @secattr to be used by NetLabel to cache the secattr to SID 3872 * conversion for future lookups. Returns zero on success, negative values on 3873 * failure. 3874 * 3875 */ 3876 int security_netlbl_secattr_to_sid(struct selinux_state *state, 3877 struct netlbl_lsm_secattr *secattr, 3878 u32 *sid) 3879 { 3880 struct selinux_policy *policy; 3881 struct policydb *policydb; 3882 struct sidtab *sidtab; 3883 int rc; 3884 struct context *ctx; 3885 struct context ctx_new; 3886 3887 if (!selinux_initialized(state)) { 3888 *sid = SECSID_NULL; 3889 return 0; 3890 } 3891 3892 retry: 3893 rc = 0; 3894 rcu_read_lock(); 3895 policy = rcu_dereference(state->policy); 3896 policydb = &policy->policydb; 3897 sidtab = policy->sidtab; 3898 3899 if (secattr->flags & NETLBL_SECATTR_CACHE) 3900 *sid = *(u32 *)secattr->cache->data; 3901 else if (secattr->flags & NETLBL_SECATTR_SECID) 3902 *sid = secattr->attr.secid; 3903 else if (secattr->flags & NETLBL_SECATTR_MLS_LVL) { 3904 rc = -EIDRM; 3905 ctx = sidtab_search(sidtab, SECINITSID_NETMSG); 3906 if (ctx == NULL) 3907 goto out; 3908 3909 context_init(&ctx_new); 3910 ctx_new.user = ctx->user; 3911 ctx_new.role = ctx->role; 3912 ctx_new.type = ctx->type; 3913 mls_import_netlbl_lvl(policydb, &ctx_new, secattr); 3914 if (secattr->flags & NETLBL_SECATTR_MLS_CAT) { 3915 rc = mls_import_netlbl_cat(policydb, &ctx_new, secattr); 3916 if (rc) 3917 goto out; 3918 } 3919 rc = -EIDRM; 3920 if (!mls_context_isvalid(policydb, &ctx_new)) { 3921 ebitmap_destroy(&ctx_new.range.level[0].cat); 3922 goto out; 3923 } 3924 3925 rc = sidtab_context_to_sid(sidtab, &ctx_new, sid); 3926 ebitmap_destroy(&ctx_new.range.level[0].cat); 3927 if (rc == -ESTALE) { 3928 rcu_read_unlock(); 3929 goto retry; 3930 } 3931 if (rc) 3932 goto out; 3933 3934 security_netlbl_cache_add(secattr, *sid); 3935 } else 3936 *sid = SECSID_NULL; 3937 3938 out: 3939 rcu_read_unlock(); 3940 return rc; 3941 } 3942 3943 /** 3944 * security_netlbl_sid_to_secattr - Convert a SELinux SID to a NetLabel secattr 3945 * @state: SELinux state 3946 * @sid: the SELinux SID 3947 * @secattr: the NetLabel packet security attributes 3948 * 3949 * Description: 3950 * Convert the given SELinux SID in @sid into a NetLabel security attribute. 3951 * Returns zero on success, negative values on failure. 3952 * 3953 */ 3954 int security_netlbl_sid_to_secattr(struct selinux_state *state, 3955 u32 sid, struct netlbl_lsm_secattr *secattr) 3956 { 3957 struct selinux_policy *policy; 3958 struct policydb *policydb; 3959 int rc; 3960 struct context *ctx; 3961 3962 if (!selinux_initialized(state)) 3963 return 0; 3964 3965 rcu_read_lock(); 3966 policy = rcu_dereference(state->policy); 3967 policydb = &policy->policydb; 3968 3969 rc = -ENOENT; 3970 ctx = sidtab_search(policy->sidtab, sid); 3971 if (ctx == NULL) 3972 goto out; 3973 3974 rc = -ENOMEM; 3975 secattr->domain = kstrdup(sym_name(policydb, SYM_TYPES, ctx->type - 1), 3976 GFP_ATOMIC); 3977 if (secattr->domain == NULL) 3978 goto out; 3979 3980 secattr->attr.secid = sid; 3981 secattr->flags |= NETLBL_SECATTR_DOMAIN_CPY | NETLBL_SECATTR_SECID; 3982 mls_export_netlbl_lvl(policydb, ctx, secattr); 3983 rc = mls_export_netlbl_cat(policydb, ctx, secattr); 3984 out: 3985 rcu_read_unlock(); 3986 return rc; 3987 } 3988 #endif /* CONFIG_NETLABEL */ 3989 3990 /** 3991 * __security_read_policy - read the policy. 3992 * @policy: SELinux policy 3993 * @data: binary policy data 3994 * @len: length of data in bytes 3995 * 3996 */ 3997 static int __security_read_policy(struct selinux_policy *policy, 3998 void *data, size_t *len) 3999 { 4000 int rc; 4001 struct policy_file fp; 4002 4003 fp.data = data; 4004 fp.len = *len; 4005 4006 rc = policydb_write(&policy->policydb, &fp); 4007 if (rc) 4008 return rc; 4009 4010 *len = (unsigned long)fp.data - (unsigned long)data; 4011 return 0; 4012 } 4013 4014 /** 4015 * security_read_policy - read the policy. 4016 * @state: selinux_state 4017 * @data: binary policy data 4018 * @len: length of data in bytes 4019 * 4020 */ 4021 int security_read_policy(struct selinux_state *state, 4022 void **data, size_t *len) 4023 { 4024 struct selinux_policy *policy; 4025 4026 policy = rcu_dereference_protected( 4027 state->policy, lockdep_is_held(&state->policy_mutex)); 4028 if (!policy) 4029 return -EINVAL; 4030 4031 *len = policy->policydb.len; 4032 *data = vmalloc_user(*len); 4033 if (!*data) 4034 return -ENOMEM; 4035 4036 return __security_read_policy(policy, *data, len); 4037 } 4038 4039 /** 4040 * security_read_state_kernel - read the policy. 4041 * @state: selinux_state 4042 * @data: binary policy data 4043 * @len: length of data in bytes 4044 * 4045 * Allocates kernel memory for reading SELinux policy. 4046 * This function is for internal use only and should not 4047 * be used for returning data to user space. 4048 * 4049 * This function must be called with policy_mutex held. 4050 */ 4051 int security_read_state_kernel(struct selinux_state *state, 4052 void **data, size_t *len) 4053 { 4054 struct selinux_policy *policy; 4055 4056 policy = rcu_dereference_protected( 4057 state->policy, lockdep_is_held(&state->policy_mutex)); 4058 if (!policy) 4059 return -EINVAL; 4060 4061 *len = policy->policydb.len; 4062 *data = vmalloc(*len); 4063 if (!*data) 4064 return -ENOMEM; 4065 4066 return __security_read_policy(policy, *data, len); 4067 } 4068