1 /* 2 * Implementation of the security services. 3 * 4 * Authors : Stephen Smalley, <sds@epoch.ncsc.mil> 5 * James Morris <jmorris@redhat.com> 6 * 7 * Updated: Trusted Computer Solutions, Inc. <dgoeddel@trustedcs.com> 8 * 9 * Support for enhanced MLS infrastructure. 10 * Support for context based audit filters. 11 * 12 * Updated: Frank Mayer <mayerf@tresys.com> and Karl MacMillan <kmacmillan@tresys.com> 13 * 14 * Added conditional policy language extensions 15 * 16 * Updated: Hewlett-Packard <paul@paul-moore.com> 17 * 18 * Added support for NetLabel 19 * Added support for the policy capability bitmap 20 * 21 * Updated: Chad Sellers <csellers@tresys.com> 22 * 23 * Added validation of kernel classes and permissions 24 * 25 * Updated: KaiGai Kohei <kaigai@ak.jp.nec.com> 26 * 27 * Added support for bounds domain and audit messaged on masked permissions 28 * 29 * Updated: Guido Trentalancia <guido@trentalancia.com> 30 * 31 * Added support for runtime switching of the policy type 32 * 33 * Copyright (C) 2008, 2009 NEC Corporation 34 * Copyright (C) 2006, 2007 Hewlett-Packard Development Company, L.P. 35 * Copyright (C) 2004-2006 Trusted Computer Solutions, Inc. 36 * Copyright (C) 2003 - 2004, 2006 Tresys Technology, LLC 37 * Copyright (C) 2003 Red Hat, Inc., James Morris <jmorris@redhat.com> 38 * This program is free software; you can redistribute it and/or modify 39 * it under the terms of the GNU General Public License as published by 40 * the Free Software Foundation, version 2. 41 */ 42 #include <linux/kernel.h> 43 #include <linux/slab.h> 44 #include <linux/string.h> 45 #include <linux/spinlock.h> 46 #include <linux/rcupdate.h> 47 #include <linux/errno.h> 48 #include <linux/in.h> 49 #include <linux/sched.h> 50 #include <linux/audit.h> 51 #include <linux/mutex.h> 52 #include <linux/selinux.h> 53 #include <linux/flex_array.h> 54 #include <linux/vmalloc.h> 55 #include <net/netlabel.h> 56 57 #include "flask.h" 58 #include "avc.h" 59 #include "avc_ss.h" 60 #include "security.h" 61 #include "context.h" 62 #include "policydb.h" 63 #include "sidtab.h" 64 #include "services.h" 65 #include "conditional.h" 66 #include "mls.h" 67 #include "objsec.h" 68 #include "netlabel.h" 69 #include "xfrm.h" 70 #include "ebitmap.h" 71 #include "audit.h" 72 73 int selinux_policycap_netpeer; 74 int selinux_policycap_openperm; 75 int selinux_policycap_alwaysnetwork; 76 77 static DEFINE_RWLOCK(policy_rwlock); 78 79 static struct sidtab sidtab; 80 struct policydb policydb; 81 int ss_initialized; 82 83 /* 84 * The largest sequence number that has been used when 85 * providing an access decision to the access vector cache. 86 * The sequence number only changes when a policy change 87 * occurs. 88 */ 89 static u32 latest_granting; 90 91 /* Forward declaration. */ 92 static int context_struct_to_string(struct context *context, char **scontext, 93 u32 *scontext_len); 94 95 static void context_struct_compute_av(struct context *scontext, 96 struct context *tcontext, 97 u16 tclass, 98 struct av_decision *avd, 99 struct extended_perms *xperms); 100 101 struct selinux_mapping { 102 u16 value; /* policy value */ 103 unsigned num_perms; 104 u32 perms[sizeof(u32) * 8]; 105 }; 106 107 static struct selinux_mapping *current_mapping; 108 static u16 current_mapping_size; 109 110 static int selinux_set_mapping(struct policydb *pol, 111 struct security_class_mapping *map, 112 struct selinux_mapping **out_map_p, 113 u16 *out_map_size) 114 { 115 struct selinux_mapping *out_map = NULL; 116 size_t size = sizeof(struct selinux_mapping); 117 u16 i, j; 118 unsigned k; 119 bool print_unknown_handle = false; 120 121 /* Find number of classes in the input mapping */ 122 if (!map) 123 return -EINVAL; 124 i = 0; 125 while (map[i].name) 126 i++; 127 128 /* Allocate space for the class records, plus one for class zero */ 129 out_map = kcalloc(++i, size, GFP_ATOMIC); 130 if (!out_map) 131 return -ENOMEM; 132 133 /* Store the raw class and permission values */ 134 j = 0; 135 while (map[j].name) { 136 struct security_class_mapping *p_in = map + (j++); 137 struct selinux_mapping *p_out = out_map + j; 138 139 /* An empty class string skips ahead */ 140 if (!strcmp(p_in->name, "")) { 141 p_out->num_perms = 0; 142 continue; 143 } 144 145 p_out->value = string_to_security_class(pol, p_in->name); 146 if (!p_out->value) { 147 printk(KERN_INFO 148 "SELinux: Class %s not defined in policy.\n", 149 p_in->name); 150 if (pol->reject_unknown) 151 goto err; 152 p_out->num_perms = 0; 153 print_unknown_handle = true; 154 continue; 155 } 156 157 k = 0; 158 while (p_in->perms && p_in->perms[k]) { 159 /* An empty permission string skips ahead */ 160 if (!*p_in->perms[k]) { 161 k++; 162 continue; 163 } 164 p_out->perms[k] = string_to_av_perm(pol, p_out->value, 165 p_in->perms[k]); 166 if (!p_out->perms[k]) { 167 printk(KERN_INFO 168 "SELinux: Permission %s in class %s not defined in policy.\n", 169 p_in->perms[k], p_in->name); 170 if (pol->reject_unknown) 171 goto err; 172 print_unknown_handle = true; 173 } 174 175 k++; 176 } 177 p_out->num_perms = k; 178 } 179 180 if (print_unknown_handle) 181 printk(KERN_INFO "SELinux: the above unknown classes and permissions will be %s\n", 182 pol->allow_unknown ? "allowed" : "denied"); 183 184 *out_map_p = out_map; 185 *out_map_size = i; 186 return 0; 187 err: 188 kfree(out_map); 189 return -EINVAL; 190 } 191 192 /* 193 * Get real, policy values from mapped values 194 */ 195 196 static u16 unmap_class(u16 tclass) 197 { 198 if (tclass < current_mapping_size) 199 return current_mapping[tclass].value; 200 201 return tclass; 202 } 203 204 /* 205 * Get kernel value for class from its policy value 206 */ 207 static u16 map_class(u16 pol_value) 208 { 209 u16 i; 210 211 for (i = 1; i < current_mapping_size; i++) { 212 if (current_mapping[i].value == pol_value) 213 return i; 214 } 215 216 return SECCLASS_NULL; 217 } 218 219 static void map_decision(u16 tclass, struct av_decision *avd, 220 int allow_unknown) 221 { 222 if (tclass < current_mapping_size) { 223 unsigned i, n = current_mapping[tclass].num_perms; 224 u32 result; 225 226 for (i = 0, result = 0; i < n; i++) { 227 if (avd->allowed & current_mapping[tclass].perms[i]) 228 result |= 1<<i; 229 if (allow_unknown && !current_mapping[tclass].perms[i]) 230 result |= 1<<i; 231 } 232 avd->allowed = result; 233 234 for (i = 0, result = 0; i < n; i++) 235 if (avd->auditallow & current_mapping[tclass].perms[i]) 236 result |= 1<<i; 237 avd->auditallow = result; 238 239 for (i = 0, result = 0; i < n; i++) { 240 if (avd->auditdeny & current_mapping[tclass].perms[i]) 241 result |= 1<<i; 242 if (!allow_unknown && !current_mapping[tclass].perms[i]) 243 result |= 1<<i; 244 } 245 /* 246 * In case the kernel has a bug and requests a permission 247 * between num_perms and the maximum permission number, we 248 * should audit that denial 249 */ 250 for (; i < (sizeof(u32)*8); i++) 251 result |= 1<<i; 252 avd->auditdeny = result; 253 } 254 } 255 256 int security_mls_enabled(void) 257 { 258 return policydb.mls_enabled; 259 } 260 261 /* 262 * Return the boolean value of a constraint expression 263 * when it is applied to the specified source and target 264 * security contexts. 265 * 266 * xcontext is a special beast... It is used by the validatetrans rules 267 * only. For these rules, scontext is the context before the transition, 268 * tcontext is the context after the transition, and xcontext is the context 269 * of the process performing the transition. All other callers of 270 * constraint_expr_eval should pass in NULL for xcontext. 271 */ 272 static int constraint_expr_eval(struct context *scontext, 273 struct context *tcontext, 274 struct context *xcontext, 275 struct constraint_expr *cexpr) 276 { 277 u32 val1, val2; 278 struct context *c; 279 struct role_datum *r1, *r2; 280 struct mls_level *l1, *l2; 281 struct constraint_expr *e; 282 int s[CEXPR_MAXDEPTH]; 283 int sp = -1; 284 285 for (e = cexpr; e; e = e->next) { 286 switch (e->expr_type) { 287 case CEXPR_NOT: 288 BUG_ON(sp < 0); 289 s[sp] = !s[sp]; 290 break; 291 case CEXPR_AND: 292 BUG_ON(sp < 1); 293 sp--; 294 s[sp] &= s[sp + 1]; 295 break; 296 case CEXPR_OR: 297 BUG_ON(sp < 1); 298 sp--; 299 s[sp] |= s[sp + 1]; 300 break; 301 case CEXPR_ATTR: 302 if (sp == (CEXPR_MAXDEPTH - 1)) 303 return 0; 304 switch (e->attr) { 305 case CEXPR_USER: 306 val1 = scontext->user; 307 val2 = tcontext->user; 308 break; 309 case CEXPR_TYPE: 310 val1 = scontext->type; 311 val2 = tcontext->type; 312 break; 313 case CEXPR_ROLE: 314 val1 = scontext->role; 315 val2 = tcontext->role; 316 r1 = policydb.role_val_to_struct[val1 - 1]; 317 r2 = policydb.role_val_to_struct[val2 - 1]; 318 switch (e->op) { 319 case CEXPR_DOM: 320 s[++sp] = ebitmap_get_bit(&r1->dominates, 321 val2 - 1); 322 continue; 323 case CEXPR_DOMBY: 324 s[++sp] = ebitmap_get_bit(&r2->dominates, 325 val1 - 1); 326 continue; 327 case CEXPR_INCOMP: 328 s[++sp] = (!ebitmap_get_bit(&r1->dominates, 329 val2 - 1) && 330 !ebitmap_get_bit(&r2->dominates, 331 val1 - 1)); 332 continue; 333 default: 334 break; 335 } 336 break; 337 case CEXPR_L1L2: 338 l1 = &(scontext->range.level[0]); 339 l2 = &(tcontext->range.level[0]); 340 goto mls_ops; 341 case CEXPR_L1H2: 342 l1 = &(scontext->range.level[0]); 343 l2 = &(tcontext->range.level[1]); 344 goto mls_ops; 345 case CEXPR_H1L2: 346 l1 = &(scontext->range.level[1]); 347 l2 = &(tcontext->range.level[0]); 348 goto mls_ops; 349 case CEXPR_H1H2: 350 l1 = &(scontext->range.level[1]); 351 l2 = &(tcontext->range.level[1]); 352 goto mls_ops; 353 case CEXPR_L1H1: 354 l1 = &(scontext->range.level[0]); 355 l2 = &(scontext->range.level[1]); 356 goto mls_ops; 357 case CEXPR_L2H2: 358 l1 = &(tcontext->range.level[0]); 359 l2 = &(tcontext->range.level[1]); 360 goto mls_ops; 361 mls_ops: 362 switch (e->op) { 363 case CEXPR_EQ: 364 s[++sp] = mls_level_eq(l1, l2); 365 continue; 366 case CEXPR_NEQ: 367 s[++sp] = !mls_level_eq(l1, l2); 368 continue; 369 case CEXPR_DOM: 370 s[++sp] = mls_level_dom(l1, l2); 371 continue; 372 case CEXPR_DOMBY: 373 s[++sp] = mls_level_dom(l2, l1); 374 continue; 375 case CEXPR_INCOMP: 376 s[++sp] = mls_level_incomp(l2, l1); 377 continue; 378 default: 379 BUG(); 380 return 0; 381 } 382 break; 383 default: 384 BUG(); 385 return 0; 386 } 387 388 switch (e->op) { 389 case CEXPR_EQ: 390 s[++sp] = (val1 == val2); 391 break; 392 case CEXPR_NEQ: 393 s[++sp] = (val1 != val2); 394 break; 395 default: 396 BUG(); 397 return 0; 398 } 399 break; 400 case CEXPR_NAMES: 401 if (sp == (CEXPR_MAXDEPTH-1)) 402 return 0; 403 c = scontext; 404 if (e->attr & CEXPR_TARGET) 405 c = tcontext; 406 else if (e->attr & CEXPR_XTARGET) { 407 c = xcontext; 408 if (!c) { 409 BUG(); 410 return 0; 411 } 412 } 413 if (e->attr & CEXPR_USER) 414 val1 = c->user; 415 else if (e->attr & CEXPR_ROLE) 416 val1 = c->role; 417 else if (e->attr & CEXPR_TYPE) 418 val1 = c->type; 419 else { 420 BUG(); 421 return 0; 422 } 423 424 switch (e->op) { 425 case CEXPR_EQ: 426 s[++sp] = ebitmap_get_bit(&e->names, val1 - 1); 427 break; 428 case CEXPR_NEQ: 429 s[++sp] = !ebitmap_get_bit(&e->names, val1 - 1); 430 break; 431 default: 432 BUG(); 433 return 0; 434 } 435 break; 436 default: 437 BUG(); 438 return 0; 439 } 440 } 441 442 BUG_ON(sp != 0); 443 return s[0]; 444 } 445 446 /* 447 * security_dump_masked_av - dumps masked permissions during 448 * security_compute_av due to RBAC, MLS/Constraint and Type bounds. 449 */ 450 static int dump_masked_av_helper(void *k, void *d, void *args) 451 { 452 struct perm_datum *pdatum = d; 453 char **permission_names = args; 454 455 BUG_ON(pdatum->value < 1 || pdatum->value > 32); 456 457 permission_names[pdatum->value - 1] = (char *)k; 458 459 return 0; 460 } 461 462 static void security_dump_masked_av(struct context *scontext, 463 struct context *tcontext, 464 u16 tclass, 465 u32 permissions, 466 const char *reason) 467 { 468 struct common_datum *common_dat; 469 struct class_datum *tclass_dat; 470 struct audit_buffer *ab; 471 char *tclass_name; 472 char *scontext_name = NULL; 473 char *tcontext_name = NULL; 474 char *permission_names[32]; 475 int index; 476 u32 length; 477 bool need_comma = false; 478 479 if (!permissions) 480 return; 481 482 tclass_name = sym_name(&policydb, SYM_CLASSES, tclass - 1); 483 tclass_dat = policydb.class_val_to_struct[tclass - 1]; 484 common_dat = tclass_dat->comdatum; 485 486 /* init permission_names */ 487 if (common_dat && 488 hashtab_map(common_dat->permissions.table, 489 dump_masked_av_helper, permission_names) < 0) 490 goto out; 491 492 if (hashtab_map(tclass_dat->permissions.table, 493 dump_masked_av_helper, permission_names) < 0) 494 goto out; 495 496 /* get scontext/tcontext in text form */ 497 if (context_struct_to_string(scontext, 498 &scontext_name, &length) < 0) 499 goto out; 500 501 if (context_struct_to_string(tcontext, 502 &tcontext_name, &length) < 0) 503 goto out; 504 505 /* audit a message */ 506 ab = audit_log_start(current->audit_context, 507 GFP_ATOMIC, AUDIT_SELINUX_ERR); 508 if (!ab) 509 goto out; 510 511 audit_log_format(ab, "op=security_compute_av reason=%s " 512 "scontext=%s tcontext=%s tclass=%s perms=", 513 reason, scontext_name, tcontext_name, tclass_name); 514 515 for (index = 0; index < 32; index++) { 516 u32 mask = (1 << index); 517 518 if ((mask & permissions) == 0) 519 continue; 520 521 audit_log_format(ab, "%s%s", 522 need_comma ? "," : "", 523 permission_names[index] 524 ? permission_names[index] : "????"); 525 need_comma = true; 526 } 527 audit_log_end(ab); 528 out: 529 /* release scontext/tcontext */ 530 kfree(tcontext_name); 531 kfree(scontext_name); 532 533 return; 534 } 535 536 /* 537 * security_boundary_permission - drops violated permissions 538 * on boundary constraint. 539 */ 540 static void type_attribute_bounds_av(struct context *scontext, 541 struct context *tcontext, 542 u16 tclass, 543 struct av_decision *avd) 544 { 545 struct context lo_scontext; 546 struct context lo_tcontext; 547 struct av_decision lo_avd; 548 struct type_datum *source; 549 struct type_datum *target; 550 u32 masked = 0; 551 552 source = flex_array_get_ptr(policydb.type_val_to_struct_array, 553 scontext->type - 1); 554 BUG_ON(!source); 555 556 target = flex_array_get_ptr(policydb.type_val_to_struct_array, 557 tcontext->type - 1); 558 BUG_ON(!target); 559 560 if (source->bounds) { 561 memset(&lo_avd, 0, sizeof(lo_avd)); 562 563 memcpy(&lo_scontext, scontext, sizeof(lo_scontext)); 564 lo_scontext.type = source->bounds; 565 566 context_struct_compute_av(&lo_scontext, 567 tcontext, 568 tclass, 569 &lo_avd, 570 NULL); 571 if ((lo_avd.allowed & avd->allowed) == avd->allowed) 572 return; /* no masked permission */ 573 masked = ~lo_avd.allowed & avd->allowed; 574 } 575 576 if (target->bounds) { 577 memset(&lo_avd, 0, sizeof(lo_avd)); 578 579 memcpy(&lo_tcontext, tcontext, sizeof(lo_tcontext)); 580 lo_tcontext.type = target->bounds; 581 582 context_struct_compute_av(scontext, 583 &lo_tcontext, 584 tclass, 585 &lo_avd, 586 NULL); 587 if ((lo_avd.allowed & avd->allowed) == avd->allowed) 588 return; /* no masked permission */ 589 masked = ~lo_avd.allowed & avd->allowed; 590 } 591 592 if (source->bounds && target->bounds) { 593 memset(&lo_avd, 0, sizeof(lo_avd)); 594 /* 595 * lo_scontext and lo_tcontext are already 596 * set up. 597 */ 598 599 context_struct_compute_av(&lo_scontext, 600 &lo_tcontext, 601 tclass, 602 &lo_avd, 603 NULL); 604 if ((lo_avd.allowed & avd->allowed) == avd->allowed) 605 return; /* no masked permission */ 606 masked = ~lo_avd.allowed & avd->allowed; 607 } 608 609 if (masked) { 610 /* mask violated permissions */ 611 avd->allowed &= ~masked; 612 613 /* audit masked permissions */ 614 security_dump_masked_av(scontext, tcontext, 615 tclass, masked, "bounds"); 616 } 617 } 618 619 /* 620 * flag which drivers have permissions 621 * only looking for ioctl based extended permssions 622 */ 623 void services_compute_xperms_drivers( 624 struct extended_perms *xperms, 625 struct avtab_node *node) 626 { 627 unsigned int i; 628 629 if (node->datum.u.xperms->specified == AVTAB_XPERMS_IOCTLDRIVER) { 630 /* if one or more driver has all permissions allowed */ 631 for (i = 0; i < ARRAY_SIZE(xperms->drivers.p); i++) 632 xperms->drivers.p[i] |= node->datum.u.xperms->perms.p[i]; 633 } else if (node->datum.u.xperms->specified == AVTAB_XPERMS_IOCTLFUNCTION) { 634 /* if allowing permissions within a driver */ 635 security_xperm_set(xperms->drivers.p, 636 node->datum.u.xperms->driver); 637 } 638 639 /* If no ioctl commands are allowed, ignore auditallow and auditdeny */ 640 if (node->key.specified & AVTAB_XPERMS_ALLOWED) 641 xperms->len = 1; 642 } 643 644 /* 645 * Compute access vectors and extended permissions based on a context 646 * structure pair for the permissions in a particular class. 647 */ 648 static void context_struct_compute_av(struct context *scontext, 649 struct context *tcontext, 650 u16 tclass, 651 struct av_decision *avd, 652 struct extended_perms *xperms) 653 { 654 struct constraint_node *constraint; 655 struct role_allow *ra; 656 struct avtab_key avkey; 657 struct avtab_node *node; 658 struct class_datum *tclass_datum; 659 struct ebitmap *sattr, *tattr; 660 struct ebitmap_node *snode, *tnode; 661 unsigned int i, j; 662 663 avd->allowed = 0; 664 avd->auditallow = 0; 665 avd->auditdeny = 0xffffffff; 666 if (xperms) { 667 memset(&xperms->drivers, 0, sizeof(xperms->drivers)); 668 xperms->len = 0; 669 } 670 671 if (unlikely(!tclass || tclass > policydb.p_classes.nprim)) { 672 if (printk_ratelimit()) 673 printk(KERN_WARNING "SELinux: Invalid class %hu\n", tclass); 674 return; 675 } 676 677 tclass_datum = policydb.class_val_to_struct[tclass - 1]; 678 679 /* 680 * If a specific type enforcement rule was defined for 681 * this permission check, then use it. 682 */ 683 avkey.target_class = tclass; 684 avkey.specified = AVTAB_AV | AVTAB_XPERMS; 685 sattr = flex_array_get(policydb.type_attr_map_array, scontext->type - 1); 686 BUG_ON(!sattr); 687 tattr = flex_array_get(policydb.type_attr_map_array, tcontext->type - 1); 688 BUG_ON(!tattr); 689 ebitmap_for_each_positive_bit(sattr, snode, i) { 690 ebitmap_for_each_positive_bit(tattr, tnode, j) { 691 avkey.source_type = i + 1; 692 avkey.target_type = j + 1; 693 for (node = avtab_search_node(&policydb.te_avtab, &avkey); 694 node; 695 node = avtab_search_node_next(node, avkey.specified)) { 696 if (node->key.specified == AVTAB_ALLOWED) 697 avd->allowed |= node->datum.u.data; 698 else if (node->key.specified == AVTAB_AUDITALLOW) 699 avd->auditallow |= node->datum.u.data; 700 else if (node->key.specified == AVTAB_AUDITDENY) 701 avd->auditdeny &= node->datum.u.data; 702 else if (xperms && (node->key.specified & AVTAB_XPERMS)) 703 services_compute_xperms_drivers(xperms, node); 704 } 705 706 /* Check conditional av table for additional permissions */ 707 cond_compute_av(&policydb.te_cond_avtab, &avkey, 708 avd, xperms); 709 710 } 711 } 712 713 /* 714 * Remove any permissions prohibited by a constraint (this includes 715 * the MLS policy). 716 */ 717 constraint = tclass_datum->constraints; 718 while (constraint) { 719 if ((constraint->permissions & (avd->allowed)) && 720 !constraint_expr_eval(scontext, tcontext, NULL, 721 constraint->expr)) { 722 avd->allowed &= ~(constraint->permissions); 723 } 724 constraint = constraint->next; 725 } 726 727 /* 728 * If checking process transition permission and the 729 * role is changing, then check the (current_role, new_role) 730 * pair. 731 */ 732 if (tclass == policydb.process_class && 733 (avd->allowed & policydb.process_trans_perms) && 734 scontext->role != tcontext->role) { 735 for (ra = policydb.role_allow; ra; ra = ra->next) { 736 if (scontext->role == ra->role && 737 tcontext->role == ra->new_role) 738 break; 739 } 740 if (!ra) 741 avd->allowed &= ~policydb.process_trans_perms; 742 } 743 744 /* 745 * If the given source and target types have boundary 746 * constraint, lazy checks have to mask any violated 747 * permission and notice it to userspace via audit. 748 */ 749 type_attribute_bounds_av(scontext, tcontext, 750 tclass, avd); 751 } 752 753 static int security_validtrans_handle_fail(struct context *ocontext, 754 struct context *ncontext, 755 struct context *tcontext, 756 u16 tclass) 757 { 758 char *o = NULL, *n = NULL, *t = NULL; 759 u32 olen, nlen, tlen; 760 761 if (context_struct_to_string(ocontext, &o, &olen)) 762 goto out; 763 if (context_struct_to_string(ncontext, &n, &nlen)) 764 goto out; 765 if (context_struct_to_string(tcontext, &t, &tlen)) 766 goto out; 767 audit_log(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR, 768 "op=security_validate_transition seresult=denied" 769 " oldcontext=%s newcontext=%s taskcontext=%s tclass=%s", 770 o, n, t, sym_name(&policydb, SYM_CLASSES, tclass-1)); 771 out: 772 kfree(o); 773 kfree(n); 774 kfree(t); 775 776 if (!selinux_enforcing) 777 return 0; 778 return -EPERM; 779 } 780 781 int security_validate_transition(u32 oldsid, u32 newsid, u32 tasksid, 782 u16 orig_tclass) 783 { 784 struct context *ocontext; 785 struct context *ncontext; 786 struct context *tcontext; 787 struct class_datum *tclass_datum; 788 struct constraint_node *constraint; 789 u16 tclass; 790 int rc = 0; 791 792 if (!ss_initialized) 793 return 0; 794 795 read_lock(&policy_rwlock); 796 797 tclass = unmap_class(orig_tclass); 798 799 if (!tclass || tclass > policydb.p_classes.nprim) { 800 printk(KERN_ERR "SELinux: %s: unrecognized class %d\n", 801 __func__, tclass); 802 rc = -EINVAL; 803 goto out; 804 } 805 tclass_datum = policydb.class_val_to_struct[tclass - 1]; 806 807 ocontext = sidtab_search(&sidtab, oldsid); 808 if (!ocontext) { 809 printk(KERN_ERR "SELinux: %s: unrecognized SID %d\n", 810 __func__, oldsid); 811 rc = -EINVAL; 812 goto out; 813 } 814 815 ncontext = sidtab_search(&sidtab, newsid); 816 if (!ncontext) { 817 printk(KERN_ERR "SELinux: %s: unrecognized SID %d\n", 818 __func__, newsid); 819 rc = -EINVAL; 820 goto out; 821 } 822 823 tcontext = sidtab_search(&sidtab, tasksid); 824 if (!tcontext) { 825 printk(KERN_ERR "SELinux: %s: unrecognized SID %d\n", 826 __func__, tasksid); 827 rc = -EINVAL; 828 goto out; 829 } 830 831 constraint = tclass_datum->validatetrans; 832 while (constraint) { 833 if (!constraint_expr_eval(ocontext, ncontext, tcontext, 834 constraint->expr)) { 835 rc = security_validtrans_handle_fail(ocontext, ncontext, 836 tcontext, tclass); 837 goto out; 838 } 839 constraint = constraint->next; 840 } 841 842 out: 843 read_unlock(&policy_rwlock); 844 return rc; 845 } 846 847 /* 848 * security_bounded_transition - check whether the given 849 * transition is directed to bounded, or not. 850 * It returns 0, if @newsid is bounded by @oldsid. 851 * Otherwise, it returns error code. 852 * 853 * @oldsid : current security identifier 854 * @newsid : destinated security identifier 855 */ 856 int security_bounded_transition(u32 old_sid, u32 new_sid) 857 { 858 struct context *old_context, *new_context; 859 struct type_datum *type; 860 int index; 861 int rc; 862 863 read_lock(&policy_rwlock); 864 865 rc = -EINVAL; 866 old_context = sidtab_search(&sidtab, old_sid); 867 if (!old_context) { 868 printk(KERN_ERR "SELinux: %s: unrecognized SID %u\n", 869 __func__, old_sid); 870 goto out; 871 } 872 873 rc = -EINVAL; 874 new_context = sidtab_search(&sidtab, new_sid); 875 if (!new_context) { 876 printk(KERN_ERR "SELinux: %s: unrecognized SID %u\n", 877 __func__, new_sid); 878 goto out; 879 } 880 881 rc = 0; 882 /* type/domain unchanged */ 883 if (old_context->type == new_context->type) 884 goto out; 885 886 index = new_context->type; 887 while (true) { 888 type = flex_array_get_ptr(policydb.type_val_to_struct_array, 889 index - 1); 890 BUG_ON(!type); 891 892 /* not bounded anymore */ 893 rc = -EPERM; 894 if (!type->bounds) 895 break; 896 897 /* @newsid is bounded by @oldsid */ 898 rc = 0; 899 if (type->bounds == old_context->type) 900 break; 901 902 index = type->bounds; 903 } 904 905 if (rc) { 906 char *old_name = NULL; 907 char *new_name = NULL; 908 u32 length; 909 910 if (!context_struct_to_string(old_context, 911 &old_name, &length) && 912 !context_struct_to_string(new_context, 913 &new_name, &length)) { 914 audit_log(current->audit_context, 915 GFP_ATOMIC, AUDIT_SELINUX_ERR, 916 "op=security_bounded_transition " 917 "seresult=denied " 918 "oldcontext=%s newcontext=%s", 919 old_name, new_name); 920 } 921 kfree(new_name); 922 kfree(old_name); 923 } 924 out: 925 read_unlock(&policy_rwlock); 926 927 return rc; 928 } 929 930 static void avd_init(struct av_decision *avd) 931 { 932 avd->allowed = 0; 933 avd->auditallow = 0; 934 avd->auditdeny = 0xffffffff; 935 avd->seqno = latest_granting; 936 avd->flags = 0; 937 } 938 939 void services_compute_xperms_decision(struct extended_perms_decision *xpermd, 940 struct avtab_node *node) 941 { 942 unsigned int i; 943 944 if (node->datum.u.xperms->specified == AVTAB_XPERMS_IOCTLFUNCTION) { 945 if (xpermd->driver != node->datum.u.xperms->driver) 946 return; 947 } else if (node->datum.u.xperms->specified == AVTAB_XPERMS_IOCTLDRIVER) { 948 if (!security_xperm_test(node->datum.u.xperms->perms.p, 949 xpermd->driver)) 950 return; 951 } else { 952 BUG(); 953 } 954 955 if (node->key.specified == AVTAB_XPERMS_ALLOWED) { 956 xpermd->used |= XPERMS_ALLOWED; 957 if (node->datum.u.xperms->specified == AVTAB_XPERMS_IOCTLDRIVER) { 958 memset(xpermd->allowed->p, 0xff, 959 sizeof(xpermd->allowed->p)); 960 } 961 if (node->datum.u.xperms->specified == AVTAB_XPERMS_IOCTLFUNCTION) { 962 for (i = 0; i < ARRAY_SIZE(xpermd->allowed->p); i++) 963 xpermd->allowed->p[i] |= 964 node->datum.u.xperms->perms.p[i]; 965 } 966 } else if (node->key.specified == AVTAB_XPERMS_AUDITALLOW) { 967 xpermd->used |= XPERMS_AUDITALLOW; 968 if (node->datum.u.xperms->specified == AVTAB_XPERMS_IOCTLDRIVER) { 969 memset(xpermd->auditallow->p, 0xff, 970 sizeof(xpermd->auditallow->p)); 971 } 972 if (node->datum.u.xperms->specified == AVTAB_XPERMS_IOCTLFUNCTION) { 973 for (i = 0; i < ARRAY_SIZE(xpermd->auditallow->p); i++) 974 xpermd->auditallow->p[i] |= 975 node->datum.u.xperms->perms.p[i]; 976 } 977 } else if (node->key.specified == AVTAB_XPERMS_DONTAUDIT) { 978 xpermd->used |= XPERMS_DONTAUDIT; 979 if (node->datum.u.xperms->specified == AVTAB_XPERMS_IOCTLDRIVER) { 980 memset(xpermd->dontaudit->p, 0xff, 981 sizeof(xpermd->dontaudit->p)); 982 } 983 if (node->datum.u.xperms->specified == AVTAB_XPERMS_IOCTLFUNCTION) { 984 for (i = 0; i < ARRAY_SIZE(xpermd->dontaudit->p); i++) 985 xpermd->dontaudit->p[i] |= 986 node->datum.u.xperms->perms.p[i]; 987 } 988 } else { 989 BUG(); 990 } 991 } 992 993 void security_compute_xperms_decision(u32 ssid, 994 u32 tsid, 995 u16 orig_tclass, 996 u8 driver, 997 struct extended_perms_decision *xpermd) 998 { 999 u16 tclass; 1000 struct context *scontext, *tcontext; 1001 struct avtab_key avkey; 1002 struct avtab_node *node; 1003 struct ebitmap *sattr, *tattr; 1004 struct ebitmap_node *snode, *tnode; 1005 unsigned int i, j; 1006 1007 xpermd->driver = driver; 1008 xpermd->used = 0; 1009 memset(xpermd->allowed->p, 0, sizeof(xpermd->allowed->p)); 1010 memset(xpermd->auditallow->p, 0, sizeof(xpermd->auditallow->p)); 1011 memset(xpermd->dontaudit->p, 0, sizeof(xpermd->dontaudit->p)); 1012 1013 read_lock(&policy_rwlock); 1014 if (!ss_initialized) 1015 goto allow; 1016 1017 scontext = sidtab_search(&sidtab, ssid); 1018 if (!scontext) { 1019 printk(KERN_ERR "SELinux: %s: unrecognized SID %d\n", 1020 __func__, ssid); 1021 goto out; 1022 } 1023 1024 tcontext = sidtab_search(&sidtab, tsid); 1025 if (!tcontext) { 1026 printk(KERN_ERR "SELinux: %s: unrecognized SID %d\n", 1027 __func__, tsid); 1028 goto out; 1029 } 1030 1031 tclass = unmap_class(orig_tclass); 1032 if (unlikely(orig_tclass && !tclass)) { 1033 if (policydb.allow_unknown) 1034 goto allow; 1035 goto out; 1036 } 1037 1038 1039 if (unlikely(!tclass || tclass > policydb.p_classes.nprim)) { 1040 pr_warn_ratelimited("SELinux: Invalid class %hu\n", tclass); 1041 goto out; 1042 } 1043 1044 avkey.target_class = tclass; 1045 avkey.specified = AVTAB_XPERMS; 1046 sattr = flex_array_get(policydb.type_attr_map_array, 1047 scontext->type - 1); 1048 BUG_ON(!sattr); 1049 tattr = flex_array_get(policydb.type_attr_map_array, 1050 tcontext->type - 1); 1051 BUG_ON(!tattr); 1052 ebitmap_for_each_positive_bit(sattr, snode, i) { 1053 ebitmap_for_each_positive_bit(tattr, tnode, j) { 1054 avkey.source_type = i + 1; 1055 avkey.target_type = j + 1; 1056 for (node = avtab_search_node(&policydb.te_avtab, &avkey); 1057 node; 1058 node = avtab_search_node_next(node, avkey.specified)) 1059 services_compute_xperms_decision(xpermd, node); 1060 1061 cond_compute_xperms(&policydb.te_cond_avtab, 1062 &avkey, xpermd); 1063 } 1064 } 1065 out: 1066 read_unlock(&policy_rwlock); 1067 return; 1068 allow: 1069 memset(xpermd->allowed->p, 0xff, sizeof(xpermd->allowed->p)); 1070 goto out; 1071 } 1072 1073 /** 1074 * security_compute_av - Compute access vector decisions. 1075 * @ssid: source security identifier 1076 * @tsid: target security identifier 1077 * @tclass: target security class 1078 * @avd: access vector decisions 1079 * @xperms: extended permissions 1080 * 1081 * Compute a set of access vector decisions based on the 1082 * SID pair (@ssid, @tsid) for the permissions in @tclass. 1083 */ 1084 void security_compute_av(u32 ssid, 1085 u32 tsid, 1086 u16 orig_tclass, 1087 struct av_decision *avd, 1088 struct extended_perms *xperms) 1089 { 1090 u16 tclass; 1091 struct context *scontext = NULL, *tcontext = NULL; 1092 1093 read_lock(&policy_rwlock); 1094 avd_init(avd); 1095 xperms->len = 0; 1096 if (!ss_initialized) 1097 goto allow; 1098 1099 scontext = sidtab_search(&sidtab, ssid); 1100 if (!scontext) { 1101 printk(KERN_ERR "SELinux: %s: unrecognized SID %d\n", 1102 __func__, ssid); 1103 goto out; 1104 } 1105 1106 /* permissive domain? */ 1107 if (ebitmap_get_bit(&policydb.permissive_map, scontext->type)) 1108 avd->flags |= AVD_FLAGS_PERMISSIVE; 1109 1110 tcontext = sidtab_search(&sidtab, tsid); 1111 if (!tcontext) { 1112 printk(KERN_ERR "SELinux: %s: unrecognized SID %d\n", 1113 __func__, tsid); 1114 goto out; 1115 } 1116 1117 tclass = unmap_class(orig_tclass); 1118 if (unlikely(orig_tclass && !tclass)) { 1119 if (policydb.allow_unknown) 1120 goto allow; 1121 goto out; 1122 } 1123 context_struct_compute_av(scontext, tcontext, tclass, avd, xperms); 1124 map_decision(orig_tclass, avd, policydb.allow_unknown); 1125 out: 1126 read_unlock(&policy_rwlock); 1127 return; 1128 allow: 1129 avd->allowed = 0xffffffff; 1130 goto out; 1131 } 1132 1133 void security_compute_av_user(u32 ssid, 1134 u32 tsid, 1135 u16 tclass, 1136 struct av_decision *avd) 1137 { 1138 struct context *scontext = NULL, *tcontext = NULL; 1139 1140 read_lock(&policy_rwlock); 1141 avd_init(avd); 1142 if (!ss_initialized) 1143 goto allow; 1144 1145 scontext = sidtab_search(&sidtab, ssid); 1146 if (!scontext) { 1147 printk(KERN_ERR "SELinux: %s: unrecognized SID %d\n", 1148 __func__, ssid); 1149 goto out; 1150 } 1151 1152 /* permissive domain? */ 1153 if (ebitmap_get_bit(&policydb.permissive_map, scontext->type)) 1154 avd->flags |= AVD_FLAGS_PERMISSIVE; 1155 1156 tcontext = sidtab_search(&sidtab, tsid); 1157 if (!tcontext) { 1158 printk(KERN_ERR "SELinux: %s: unrecognized SID %d\n", 1159 __func__, tsid); 1160 goto out; 1161 } 1162 1163 if (unlikely(!tclass)) { 1164 if (policydb.allow_unknown) 1165 goto allow; 1166 goto out; 1167 } 1168 1169 context_struct_compute_av(scontext, tcontext, tclass, avd, NULL); 1170 out: 1171 read_unlock(&policy_rwlock); 1172 return; 1173 allow: 1174 avd->allowed = 0xffffffff; 1175 goto out; 1176 } 1177 1178 /* 1179 * Write the security context string representation of 1180 * the context structure `context' into a dynamically 1181 * allocated string of the correct size. Set `*scontext' 1182 * to point to this string and set `*scontext_len' to 1183 * the length of the string. 1184 */ 1185 static int context_struct_to_string(struct context *context, char **scontext, u32 *scontext_len) 1186 { 1187 char *scontextp; 1188 1189 if (scontext) 1190 *scontext = NULL; 1191 *scontext_len = 0; 1192 1193 if (context->len) { 1194 *scontext_len = context->len; 1195 if (scontext) { 1196 *scontext = kstrdup(context->str, GFP_ATOMIC); 1197 if (!(*scontext)) 1198 return -ENOMEM; 1199 } 1200 return 0; 1201 } 1202 1203 /* Compute the size of the context. */ 1204 *scontext_len += strlen(sym_name(&policydb, SYM_USERS, context->user - 1)) + 1; 1205 *scontext_len += strlen(sym_name(&policydb, SYM_ROLES, context->role - 1)) + 1; 1206 *scontext_len += strlen(sym_name(&policydb, SYM_TYPES, context->type - 1)) + 1; 1207 *scontext_len += mls_compute_context_len(context); 1208 1209 if (!scontext) 1210 return 0; 1211 1212 /* Allocate space for the context; caller must free this space. */ 1213 scontextp = kmalloc(*scontext_len, GFP_ATOMIC); 1214 if (!scontextp) 1215 return -ENOMEM; 1216 *scontext = scontextp; 1217 1218 /* 1219 * Copy the user name, role name and type name into the context. 1220 */ 1221 scontextp += sprintf(scontextp, "%s:%s:%s", 1222 sym_name(&policydb, SYM_USERS, context->user - 1), 1223 sym_name(&policydb, SYM_ROLES, context->role - 1), 1224 sym_name(&policydb, SYM_TYPES, context->type - 1)); 1225 1226 mls_sid_to_context(context, &scontextp); 1227 1228 *scontextp = 0; 1229 1230 return 0; 1231 } 1232 1233 #include "initial_sid_to_string.h" 1234 1235 const char *security_get_initial_sid_context(u32 sid) 1236 { 1237 if (unlikely(sid > SECINITSID_NUM)) 1238 return NULL; 1239 return initial_sid_to_string[sid]; 1240 } 1241 1242 static int security_sid_to_context_core(u32 sid, char **scontext, 1243 u32 *scontext_len, int force) 1244 { 1245 struct context *context; 1246 int rc = 0; 1247 1248 if (scontext) 1249 *scontext = NULL; 1250 *scontext_len = 0; 1251 1252 if (!ss_initialized) { 1253 if (sid <= SECINITSID_NUM) { 1254 char *scontextp; 1255 1256 *scontext_len = strlen(initial_sid_to_string[sid]) + 1; 1257 if (!scontext) 1258 goto out; 1259 scontextp = kmemdup(initial_sid_to_string[sid], 1260 *scontext_len, GFP_ATOMIC); 1261 if (!scontextp) { 1262 rc = -ENOMEM; 1263 goto out; 1264 } 1265 *scontext = scontextp; 1266 goto out; 1267 } 1268 printk(KERN_ERR "SELinux: %s: called before initial " 1269 "load_policy on unknown SID %d\n", __func__, sid); 1270 rc = -EINVAL; 1271 goto out; 1272 } 1273 read_lock(&policy_rwlock); 1274 if (force) 1275 context = sidtab_search_force(&sidtab, sid); 1276 else 1277 context = sidtab_search(&sidtab, sid); 1278 if (!context) { 1279 printk(KERN_ERR "SELinux: %s: unrecognized SID %d\n", 1280 __func__, sid); 1281 rc = -EINVAL; 1282 goto out_unlock; 1283 } 1284 rc = context_struct_to_string(context, scontext, scontext_len); 1285 out_unlock: 1286 read_unlock(&policy_rwlock); 1287 out: 1288 return rc; 1289 1290 } 1291 1292 /** 1293 * security_sid_to_context - Obtain a context for a given SID. 1294 * @sid: security identifier, SID 1295 * @scontext: security context 1296 * @scontext_len: length in bytes 1297 * 1298 * Write the string representation of the context associated with @sid 1299 * into a dynamically allocated string of the correct size. Set @scontext 1300 * to point to this string and set @scontext_len to the length of the string. 1301 */ 1302 int security_sid_to_context(u32 sid, char **scontext, u32 *scontext_len) 1303 { 1304 return security_sid_to_context_core(sid, scontext, scontext_len, 0); 1305 } 1306 1307 int security_sid_to_context_force(u32 sid, char **scontext, u32 *scontext_len) 1308 { 1309 return security_sid_to_context_core(sid, scontext, scontext_len, 1); 1310 } 1311 1312 /* 1313 * Caveat: Mutates scontext. 1314 */ 1315 static int string_to_context_struct(struct policydb *pol, 1316 struct sidtab *sidtabp, 1317 char *scontext, 1318 u32 scontext_len, 1319 struct context *ctx, 1320 u32 def_sid) 1321 { 1322 struct role_datum *role; 1323 struct type_datum *typdatum; 1324 struct user_datum *usrdatum; 1325 char *scontextp, *p, oldc; 1326 int rc = 0; 1327 1328 context_init(ctx); 1329 1330 /* Parse the security context. */ 1331 1332 rc = -EINVAL; 1333 scontextp = (char *) scontext; 1334 1335 /* Extract the user. */ 1336 p = scontextp; 1337 while (*p && *p != ':') 1338 p++; 1339 1340 if (*p == 0) 1341 goto out; 1342 1343 *p++ = 0; 1344 1345 usrdatum = hashtab_search(pol->p_users.table, scontextp); 1346 if (!usrdatum) 1347 goto out; 1348 1349 ctx->user = usrdatum->value; 1350 1351 /* Extract role. */ 1352 scontextp = p; 1353 while (*p && *p != ':') 1354 p++; 1355 1356 if (*p == 0) 1357 goto out; 1358 1359 *p++ = 0; 1360 1361 role = hashtab_search(pol->p_roles.table, scontextp); 1362 if (!role) 1363 goto out; 1364 ctx->role = role->value; 1365 1366 /* Extract type. */ 1367 scontextp = p; 1368 while (*p && *p != ':') 1369 p++; 1370 oldc = *p; 1371 *p++ = 0; 1372 1373 typdatum = hashtab_search(pol->p_types.table, scontextp); 1374 if (!typdatum || typdatum->attribute) 1375 goto out; 1376 1377 ctx->type = typdatum->value; 1378 1379 rc = mls_context_to_sid(pol, oldc, &p, ctx, sidtabp, def_sid); 1380 if (rc) 1381 goto out; 1382 1383 rc = -EINVAL; 1384 if ((p - scontext) < scontext_len) 1385 goto out; 1386 1387 /* Check the validity of the new context. */ 1388 if (!policydb_context_isvalid(pol, ctx)) 1389 goto out; 1390 rc = 0; 1391 out: 1392 if (rc) 1393 context_destroy(ctx); 1394 return rc; 1395 } 1396 1397 static int security_context_to_sid_core(const char *scontext, u32 scontext_len, 1398 u32 *sid, u32 def_sid, gfp_t gfp_flags, 1399 int force) 1400 { 1401 char *scontext2, *str = NULL; 1402 struct context context; 1403 int rc = 0; 1404 1405 /* An empty security context is never valid. */ 1406 if (!scontext_len) 1407 return -EINVAL; 1408 1409 if (!ss_initialized) { 1410 int i; 1411 1412 for (i = 1; i < SECINITSID_NUM; i++) { 1413 if (!strcmp(initial_sid_to_string[i], scontext)) { 1414 *sid = i; 1415 return 0; 1416 } 1417 } 1418 *sid = SECINITSID_KERNEL; 1419 return 0; 1420 } 1421 *sid = SECSID_NULL; 1422 1423 /* Copy the string so that we can modify the copy as we parse it. */ 1424 scontext2 = kmalloc(scontext_len + 1, gfp_flags); 1425 if (!scontext2) 1426 return -ENOMEM; 1427 memcpy(scontext2, scontext, scontext_len); 1428 scontext2[scontext_len] = 0; 1429 1430 if (force) { 1431 /* Save another copy for storing in uninterpreted form */ 1432 rc = -ENOMEM; 1433 str = kstrdup(scontext2, gfp_flags); 1434 if (!str) 1435 goto out; 1436 } 1437 1438 read_lock(&policy_rwlock); 1439 rc = string_to_context_struct(&policydb, &sidtab, scontext2, 1440 scontext_len, &context, def_sid); 1441 if (rc == -EINVAL && force) { 1442 context.str = str; 1443 context.len = scontext_len; 1444 str = NULL; 1445 } else if (rc) 1446 goto out_unlock; 1447 rc = sidtab_context_to_sid(&sidtab, &context, sid); 1448 context_destroy(&context); 1449 out_unlock: 1450 read_unlock(&policy_rwlock); 1451 out: 1452 kfree(scontext2); 1453 kfree(str); 1454 return rc; 1455 } 1456 1457 /** 1458 * security_context_to_sid - Obtain a SID for a given security context. 1459 * @scontext: security context 1460 * @scontext_len: length in bytes 1461 * @sid: security identifier, SID 1462 * @gfp: context for the allocation 1463 * 1464 * Obtains a SID associated with the security context that 1465 * has the string representation specified by @scontext. 1466 * Returns -%EINVAL if the context is invalid, -%ENOMEM if insufficient 1467 * memory is available, or 0 on success. 1468 */ 1469 int security_context_to_sid(const char *scontext, u32 scontext_len, u32 *sid, 1470 gfp_t gfp) 1471 { 1472 return security_context_to_sid_core(scontext, scontext_len, 1473 sid, SECSID_NULL, gfp, 0); 1474 } 1475 1476 int security_context_str_to_sid(const char *scontext, u32 *sid, gfp_t gfp) 1477 { 1478 return security_context_to_sid(scontext, strlen(scontext), sid, gfp); 1479 } 1480 1481 /** 1482 * security_context_to_sid_default - Obtain a SID for a given security context, 1483 * falling back to specified default if needed. 1484 * 1485 * @scontext: security context 1486 * @scontext_len: length in bytes 1487 * @sid: security identifier, SID 1488 * @def_sid: default SID to assign on error 1489 * 1490 * Obtains a SID associated with the security context that 1491 * has the string representation specified by @scontext. 1492 * The default SID is passed to the MLS layer to be used to allow 1493 * kernel labeling of the MLS field if the MLS field is not present 1494 * (for upgrading to MLS without full relabel). 1495 * Implicitly forces adding of the context even if it cannot be mapped yet. 1496 * Returns -%EINVAL if the context is invalid, -%ENOMEM if insufficient 1497 * memory is available, or 0 on success. 1498 */ 1499 int security_context_to_sid_default(const char *scontext, u32 scontext_len, 1500 u32 *sid, u32 def_sid, gfp_t gfp_flags) 1501 { 1502 return security_context_to_sid_core(scontext, scontext_len, 1503 sid, def_sid, gfp_flags, 1); 1504 } 1505 1506 int security_context_to_sid_force(const char *scontext, u32 scontext_len, 1507 u32 *sid) 1508 { 1509 return security_context_to_sid_core(scontext, scontext_len, 1510 sid, SECSID_NULL, GFP_KERNEL, 1); 1511 } 1512 1513 static int compute_sid_handle_invalid_context( 1514 struct context *scontext, 1515 struct context *tcontext, 1516 u16 tclass, 1517 struct context *newcontext) 1518 { 1519 char *s = NULL, *t = NULL, *n = NULL; 1520 u32 slen, tlen, nlen; 1521 1522 if (context_struct_to_string(scontext, &s, &slen)) 1523 goto out; 1524 if (context_struct_to_string(tcontext, &t, &tlen)) 1525 goto out; 1526 if (context_struct_to_string(newcontext, &n, &nlen)) 1527 goto out; 1528 audit_log(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR, 1529 "op=security_compute_sid invalid_context=%s" 1530 " scontext=%s" 1531 " tcontext=%s" 1532 " tclass=%s", 1533 n, s, t, sym_name(&policydb, SYM_CLASSES, tclass-1)); 1534 out: 1535 kfree(s); 1536 kfree(t); 1537 kfree(n); 1538 if (!selinux_enforcing) 1539 return 0; 1540 return -EACCES; 1541 } 1542 1543 static void filename_compute_type(struct policydb *p, struct context *newcontext, 1544 u32 stype, u32 ttype, u16 tclass, 1545 const char *objname) 1546 { 1547 struct filename_trans ft; 1548 struct filename_trans_datum *otype; 1549 1550 /* 1551 * Most filename trans rules are going to live in specific directories 1552 * like /dev or /var/run. This bitmap will quickly skip rule searches 1553 * if the ttype does not contain any rules. 1554 */ 1555 if (!ebitmap_get_bit(&p->filename_trans_ttypes, ttype)) 1556 return; 1557 1558 ft.stype = stype; 1559 ft.ttype = ttype; 1560 ft.tclass = tclass; 1561 ft.name = objname; 1562 1563 otype = hashtab_search(p->filename_trans, &ft); 1564 if (otype) 1565 newcontext->type = otype->otype; 1566 } 1567 1568 static int security_compute_sid(u32 ssid, 1569 u32 tsid, 1570 u16 orig_tclass, 1571 u32 specified, 1572 const char *objname, 1573 u32 *out_sid, 1574 bool kern) 1575 { 1576 struct class_datum *cladatum = NULL; 1577 struct context *scontext = NULL, *tcontext = NULL, newcontext; 1578 struct role_trans *roletr = NULL; 1579 struct avtab_key avkey; 1580 struct avtab_datum *avdatum; 1581 struct avtab_node *node; 1582 u16 tclass; 1583 int rc = 0; 1584 bool sock; 1585 1586 if (!ss_initialized) { 1587 switch (orig_tclass) { 1588 case SECCLASS_PROCESS: /* kernel value */ 1589 *out_sid = ssid; 1590 break; 1591 default: 1592 *out_sid = tsid; 1593 break; 1594 } 1595 goto out; 1596 } 1597 1598 context_init(&newcontext); 1599 1600 read_lock(&policy_rwlock); 1601 1602 if (kern) { 1603 tclass = unmap_class(orig_tclass); 1604 sock = security_is_socket_class(orig_tclass); 1605 } else { 1606 tclass = orig_tclass; 1607 sock = security_is_socket_class(map_class(tclass)); 1608 } 1609 1610 scontext = sidtab_search(&sidtab, ssid); 1611 if (!scontext) { 1612 printk(KERN_ERR "SELinux: %s: unrecognized SID %d\n", 1613 __func__, ssid); 1614 rc = -EINVAL; 1615 goto out_unlock; 1616 } 1617 tcontext = sidtab_search(&sidtab, tsid); 1618 if (!tcontext) { 1619 printk(KERN_ERR "SELinux: %s: unrecognized SID %d\n", 1620 __func__, tsid); 1621 rc = -EINVAL; 1622 goto out_unlock; 1623 } 1624 1625 if (tclass && tclass <= policydb.p_classes.nprim) 1626 cladatum = policydb.class_val_to_struct[tclass - 1]; 1627 1628 /* Set the user identity. */ 1629 switch (specified) { 1630 case AVTAB_TRANSITION: 1631 case AVTAB_CHANGE: 1632 if (cladatum && cladatum->default_user == DEFAULT_TARGET) { 1633 newcontext.user = tcontext->user; 1634 } else { 1635 /* notice this gets both DEFAULT_SOURCE and unset */ 1636 /* Use the process user identity. */ 1637 newcontext.user = scontext->user; 1638 } 1639 break; 1640 case AVTAB_MEMBER: 1641 /* Use the related object owner. */ 1642 newcontext.user = tcontext->user; 1643 break; 1644 } 1645 1646 /* Set the role to default values. */ 1647 if (cladatum && cladatum->default_role == DEFAULT_SOURCE) { 1648 newcontext.role = scontext->role; 1649 } else if (cladatum && cladatum->default_role == DEFAULT_TARGET) { 1650 newcontext.role = tcontext->role; 1651 } else { 1652 if ((tclass == policydb.process_class) || (sock == true)) 1653 newcontext.role = scontext->role; 1654 else 1655 newcontext.role = OBJECT_R_VAL; 1656 } 1657 1658 /* Set the type to default values. */ 1659 if (cladatum && cladatum->default_type == DEFAULT_SOURCE) { 1660 newcontext.type = scontext->type; 1661 } else if (cladatum && cladatum->default_type == DEFAULT_TARGET) { 1662 newcontext.type = tcontext->type; 1663 } else { 1664 if ((tclass == policydb.process_class) || (sock == true)) { 1665 /* Use the type of process. */ 1666 newcontext.type = scontext->type; 1667 } else { 1668 /* Use the type of the related object. */ 1669 newcontext.type = tcontext->type; 1670 } 1671 } 1672 1673 /* Look for a type transition/member/change rule. */ 1674 avkey.source_type = scontext->type; 1675 avkey.target_type = tcontext->type; 1676 avkey.target_class = tclass; 1677 avkey.specified = specified; 1678 avdatum = avtab_search(&policydb.te_avtab, &avkey); 1679 1680 /* If no permanent rule, also check for enabled conditional rules */ 1681 if (!avdatum) { 1682 node = avtab_search_node(&policydb.te_cond_avtab, &avkey); 1683 for (; node; node = avtab_search_node_next(node, specified)) { 1684 if (node->key.specified & AVTAB_ENABLED) { 1685 avdatum = &node->datum; 1686 break; 1687 } 1688 } 1689 } 1690 1691 if (avdatum) { 1692 /* Use the type from the type transition/member/change rule. */ 1693 newcontext.type = avdatum->u.data; 1694 } 1695 1696 /* if we have a objname this is a file trans check so check those rules */ 1697 if (objname) 1698 filename_compute_type(&policydb, &newcontext, scontext->type, 1699 tcontext->type, tclass, objname); 1700 1701 /* Check for class-specific changes. */ 1702 if (specified & AVTAB_TRANSITION) { 1703 /* Look for a role transition rule. */ 1704 for (roletr = policydb.role_tr; roletr; roletr = roletr->next) { 1705 if ((roletr->role == scontext->role) && 1706 (roletr->type == tcontext->type) && 1707 (roletr->tclass == tclass)) { 1708 /* Use the role transition rule. */ 1709 newcontext.role = roletr->new_role; 1710 break; 1711 } 1712 } 1713 } 1714 1715 /* Set the MLS attributes. 1716 This is done last because it may allocate memory. */ 1717 rc = mls_compute_sid(scontext, tcontext, tclass, specified, 1718 &newcontext, sock); 1719 if (rc) 1720 goto out_unlock; 1721 1722 /* Check the validity of the context. */ 1723 if (!policydb_context_isvalid(&policydb, &newcontext)) { 1724 rc = compute_sid_handle_invalid_context(scontext, 1725 tcontext, 1726 tclass, 1727 &newcontext); 1728 if (rc) 1729 goto out_unlock; 1730 } 1731 /* Obtain the sid for the context. */ 1732 rc = sidtab_context_to_sid(&sidtab, &newcontext, out_sid); 1733 out_unlock: 1734 read_unlock(&policy_rwlock); 1735 context_destroy(&newcontext); 1736 out: 1737 return rc; 1738 } 1739 1740 /** 1741 * security_transition_sid - Compute the SID for a new subject/object. 1742 * @ssid: source security identifier 1743 * @tsid: target security identifier 1744 * @tclass: target security class 1745 * @out_sid: security identifier for new subject/object 1746 * 1747 * Compute a SID to use for labeling a new subject or object in the 1748 * class @tclass based on a SID pair (@ssid, @tsid). 1749 * Return -%EINVAL if any of the parameters are invalid, -%ENOMEM 1750 * if insufficient memory is available, or %0 if the new SID was 1751 * computed successfully. 1752 */ 1753 int security_transition_sid(u32 ssid, u32 tsid, u16 tclass, 1754 const struct qstr *qstr, u32 *out_sid) 1755 { 1756 return security_compute_sid(ssid, tsid, tclass, AVTAB_TRANSITION, 1757 qstr ? qstr->name : NULL, out_sid, true); 1758 } 1759 1760 int security_transition_sid_user(u32 ssid, u32 tsid, u16 tclass, 1761 const char *objname, u32 *out_sid) 1762 { 1763 return security_compute_sid(ssid, tsid, tclass, AVTAB_TRANSITION, 1764 objname, out_sid, false); 1765 } 1766 1767 /** 1768 * security_member_sid - Compute the SID for member selection. 1769 * @ssid: source security identifier 1770 * @tsid: target security identifier 1771 * @tclass: target security class 1772 * @out_sid: security identifier for selected member 1773 * 1774 * Compute a SID to use when selecting a member of a polyinstantiated 1775 * object of class @tclass based on a SID pair (@ssid, @tsid). 1776 * Return -%EINVAL if any of the parameters are invalid, -%ENOMEM 1777 * if insufficient memory is available, or %0 if the SID was 1778 * computed successfully. 1779 */ 1780 int security_member_sid(u32 ssid, 1781 u32 tsid, 1782 u16 tclass, 1783 u32 *out_sid) 1784 { 1785 return security_compute_sid(ssid, tsid, tclass, AVTAB_MEMBER, NULL, 1786 out_sid, false); 1787 } 1788 1789 /** 1790 * security_change_sid - Compute the SID for object relabeling. 1791 * @ssid: source security identifier 1792 * @tsid: target security identifier 1793 * @tclass: target security class 1794 * @out_sid: security identifier for selected member 1795 * 1796 * Compute a SID to use for relabeling an object of class @tclass 1797 * based on a SID pair (@ssid, @tsid). 1798 * Return -%EINVAL if any of the parameters are invalid, -%ENOMEM 1799 * if insufficient memory is available, or %0 if the SID was 1800 * computed successfully. 1801 */ 1802 int security_change_sid(u32 ssid, 1803 u32 tsid, 1804 u16 tclass, 1805 u32 *out_sid) 1806 { 1807 return security_compute_sid(ssid, tsid, tclass, AVTAB_CHANGE, NULL, 1808 out_sid, false); 1809 } 1810 1811 /* Clone the SID into the new SID table. */ 1812 static int clone_sid(u32 sid, 1813 struct context *context, 1814 void *arg) 1815 { 1816 struct sidtab *s = arg; 1817 1818 if (sid > SECINITSID_NUM) 1819 return sidtab_insert(s, sid, context); 1820 else 1821 return 0; 1822 } 1823 1824 static inline int convert_context_handle_invalid_context(struct context *context) 1825 { 1826 char *s; 1827 u32 len; 1828 1829 if (selinux_enforcing) 1830 return -EINVAL; 1831 1832 if (!context_struct_to_string(context, &s, &len)) { 1833 printk(KERN_WARNING "SELinux: Context %s would be invalid if enforcing\n", s); 1834 kfree(s); 1835 } 1836 return 0; 1837 } 1838 1839 struct convert_context_args { 1840 struct policydb *oldp; 1841 struct policydb *newp; 1842 }; 1843 1844 /* 1845 * Convert the values in the security context 1846 * structure `c' from the values specified 1847 * in the policy `p->oldp' to the values specified 1848 * in the policy `p->newp'. Verify that the 1849 * context is valid under the new policy. 1850 */ 1851 static int convert_context(u32 key, 1852 struct context *c, 1853 void *p) 1854 { 1855 struct convert_context_args *args; 1856 struct context oldc; 1857 struct ocontext *oc; 1858 struct mls_range *range; 1859 struct role_datum *role; 1860 struct type_datum *typdatum; 1861 struct user_datum *usrdatum; 1862 char *s; 1863 u32 len; 1864 int rc = 0; 1865 1866 if (key <= SECINITSID_NUM) 1867 goto out; 1868 1869 args = p; 1870 1871 if (c->str) { 1872 struct context ctx; 1873 1874 rc = -ENOMEM; 1875 s = kstrdup(c->str, GFP_KERNEL); 1876 if (!s) 1877 goto out; 1878 1879 rc = string_to_context_struct(args->newp, NULL, s, 1880 c->len, &ctx, SECSID_NULL); 1881 kfree(s); 1882 if (!rc) { 1883 printk(KERN_INFO "SELinux: Context %s became valid (mapped).\n", 1884 c->str); 1885 /* Replace string with mapped representation. */ 1886 kfree(c->str); 1887 memcpy(c, &ctx, sizeof(*c)); 1888 goto out; 1889 } else if (rc == -EINVAL) { 1890 /* Retain string representation for later mapping. */ 1891 rc = 0; 1892 goto out; 1893 } else { 1894 /* Other error condition, e.g. ENOMEM. */ 1895 printk(KERN_ERR "SELinux: Unable to map context %s, rc = %d.\n", 1896 c->str, -rc); 1897 goto out; 1898 } 1899 } 1900 1901 rc = context_cpy(&oldc, c); 1902 if (rc) 1903 goto out; 1904 1905 /* Convert the user. */ 1906 rc = -EINVAL; 1907 usrdatum = hashtab_search(args->newp->p_users.table, 1908 sym_name(args->oldp, SYM_USERS, c->user - 1)); 1909 if (!usrdatum) 1910 goto bad; 1911 c->user = usrdatum->value; 1912 1913 /* Convert the role. */ 1914 rc = -EINVAL; 1915 role = hashtab_search(args->newp->p_roles.table, 1916 sym_name(args->oldp, SYM_ROLES, c->role - 1)); 1917 if (!role) 1918 goto bad; 1919 c->role = role->value; 1920 1921 /* Convert the type. */ 1922 rc = -EINVAL; 1923 typdatum = hashtab_search(args->newp->p_types.table, 1924 sym_name(args->oldp, SYM_TYPES, c->type - 1)); 1925 if (!typdatum) 1926 goto bad; 1927 c->type = typdatum->value; 1928 1929 /* Convert the MLS fields if dealing with MLS policies */ 1930 if (args->oldp->mls_enabled && args->newp->mls_enabled) { 1931 rc = mls_convert_context(args->oldp, args->newp, c); 1932 if (rc) 1933 goto bad; 1934 } else if (args->oldp->mls_enabled && !args->newp->mls_enabled) { 1935 /* 1936 * Switching between MLS and non-MLS policy: 1937 * free any storage used by the MLS fields in the 1938 * context for all existing entries in the sidtab. 1939 */ 1940 mls_context_destroy(c); 1941 } else if (!args->oldp->mls_enabled && args->newp->mls_enabled) { 1942 /* 1943 * Switching between non-MLS and MLS policy: 1944 * ensure that the MLS fields of the context for all 1945 * existing entries in the sidtab are filled in with a 1946 * suitable default value, likely taken from one of the 1947 * initial SIDs. 1948 */ 1949 oc = args->newp->ocontexts[OCON_ISID]; 1950 while (oc && oc->sid[0] != SECINITSID_UNLABELED) 1951 oc = oc->next; 1952 rc = -EINVAL; 1953 if (!oc) { 1954 printk(KERN_ERR "SELinux: unable to look up" 1955 " the initial SIDs list\n"); 1956 goto bad; 1957 } 1958 range = &oc->context[0].range; 1959 rc = mls_range_set(c, range); 1960 if (rc) 1961 goto bad; 1962 } 1963 1964 /* Check the validity of the new context. */ 1965 if (!policydb_context_isvalid(args->newp, c)) { 1966 rc = convert_context_handle_invalid_context(&oldc); 1967 if (rc) 1968 goto bad; 1969 } 1970 1971 context_destroy(&oldc); 1972 1973 rc = 0; 1974 out: 1975 return rc; 1976 bad: 1977 /* Map old representation to string and save it. */ 1978 rc = context_struct_to_string(&oldc, &s, &len); 1979 if (rc) 1980 return rc; 1981 context_destroy(&oldc); 1982 context_destroy(c); 1983 c->str = s; 1984 c->len = len; 1985 printk(KERN_INFO "SELinux: Context %s became invalid (unmapped).\n", 1986 c->str); 1987 rc = 0; 1988 goto out; 1989 } 1990 1991 static void security_load_policycaps(void) 1992 { 1993 selinux_policycap_netpeer = ebitmap_get_bit(&policydb.policycaps, 1994 POLICYDB_CAPABILITY_NETPEER); 1995 selinux_policycap_openperm = ebitmap_get_bit(&policydb.policycaps, 1996 POLICYDB_CAPABILITY_OPENPERM); 1997 selinux_policycap_alwaysnetwork = ebitmap_get_bit(&policydb.policycaps, 1998 POLICYDB_CAPABILITY_ALWAYSNETWORK); 1999 } 2000 2001 static int security_preserve_bools(struct policydb *p); 2002 2003 /** 2004 * security_load_policy - Load a security policy configuration. 2005 * @data: binary policy data 2006 * @len: length of data in bytes 2007 * 2008 * Load a new set of security policy configuration data, 2009 * validate it and convert the SID table as necessary. 2010 * This function will flush the access vector cache after 2011 * loading the new policy. 2012 */ 2013 int security_load_policy(void *data, size_t len) 2014 { 2015 struct policydb *oldpolicydb, *newpolicydb; 2016 struct sidtab oldsidtab, newsidtab; 2017 struct selinux_mapping *oldmap, *map = NULL; 2018 struct convert_context_args args; 2019 u32 seqno; 2020 u16 map_size; 2021 int rc = 0; 2022 struct policy_file file = { data, len }, *fp = &file; 2023 2024 oldpolicydb = kzalloc(2 * sizeof(*oldpolicydb), GFP_KERNEL); 2025 if (!oldpolicydb) { 2026 rc = -ENOMEM; 2027 goto out; 2028 } 2029 newpolicydb = oldpolicydb + 1; 2030 2031 if (!ss_initialized) { 2032 avtab_cache_init(); 2033 rc = policydb_read(&policydb, fp); 2034 if (rc) { 2035 avtab_cache_destroy(); 2036 goto out; 2037 } 2038 2039 policydb.len = len; 2040 rc = selinux_set_mapping(&policydb, secclass_map, 2041 ¤t_mapping, 2042 ¤t_mapping_size); 2043 if (rc) { 2044 policydb_destroy(&policydb); 2045 avtab_cache_destroy(); 2046 goto out; 2047 } 2048 2049 rc = policydb_load_isids(&policydb, &sidtab); 2050 if (rc) { 2051 policydb_destroy(&policydb); 2052 avtab_cache_destroy(); 2053 goto out; 2054 } 2055 2056 security_load_policycaps(); 2057 ss_initialized = 1; 2058 seqno = ++latest_granting; 2059 selinux_complete_init(); 2060 avc_ss_reset(seqno); 2061 selnl_notify_policyload(seqno); 2062 selinux_status_update_policyload(seqno); 2063 selinux_netlbl_cache_invalidate(); 2064 selinux_xfrm_notify_policyload(); 2065 goto out; 2066 } 2067 2068 #if 0 2069 sidtab_hash_eval(&sidtab, "sids"); 2070 #endif 2071 2072 rc = policydb_read(newpolicydb, fp); 2073 if (rc) 2074 goto out; 2075 2076 newpolicydb->len = len; 2077 /* If switching between different policy types, log MLS status */ 2078 if (policydb.mls_enabled && !newpolicydb->mls_enabled) 2079 printk(KERN_INFO "SELinux: Disabling MLS support...\n"); 2080 else if (!policydb.mls_enabled && newpolicydb->mls_enabled) 2081 printk(KERN_INFO "SELinux: Enabling MLS support...\n"); 2082 2083 rc = policydb_load_isids(newpolicydb, &newsidtab); 2084 if (rc) { 2085 printk(KERN_ERR "SELinux: unable to load the initial SIDs\n"); 2086 policydb_destroy(newpolicydb); 2087 goto out; 2088 } 2089 2090 rc = selinux_set_mapping(newpolicydb, secclass_map, &map, &map_size); 2091 if (rc) 2092 goto err; 2093 2094 rc = security_preserve_bools(newpolicydb); 2095 if (rc) { 2096 printk(KERN_ERR "SELinux: unable to preserve booleans\n"); 2097 goto err; 2098 } 2099 2100 /* Clone the SID table. */ 2101 sidtab_shutdown(&sidtab); 2102 2103 rc = sidtab_map(&sidtab, clone_sid, &newsidtab); 2104 if (rc) 2105 goto err; 2106 2107 /* 2108 * Convert the internal representations of contexts 2109 * in the new SID table. 2110 */ 2111 args.oldp = &policydb; 2112 args.newp = newpolicydb; 2113 rc = sidtab_map(&newsidtab, convert_context, &args); 2114 if (rc) { 2115 printk(KERN_ERR "SELinux: unable to convert the internal" 2116 " representation of contexts in the new SID" 2117 " table\n"); 2118 goto err; 2119 } 2120 2121 /* Save the old policydb and SID table to free later. */ 2122 memcpy(oldpolicydb, &policydb, sizeof(policydb)); 2123 sidtab_set(&oldsidtab, &sidtab); 2124 2125 /* Install the new policydb and SID table. */ 2126 write_lock_irq(&policy_rwlock); 2127 memcpy(&policydb, newpolicydb, sizeof(policydb)); 2128 sidtab_set(&sidtab, &newsidtab); 2129 security_load_policycaps(); 2130 oldmap = current_mapping; 2131 current_mapping = map; 2132 current_mapping_size = map_size; 2133 seqno = ++latest_granting; 2134 write_unlock_irq(&policy_rwlock); 2135 2136 /* Free the old policydb and SID table. */ 2137 policydb_destroy(oldpolicydb); 2138 sidtab_destroy(&oldsidtab); 2139 kfree(oldmap); 2140 2141 avc_ss_reset(seqno); 2142 selnl_notify_policyload(seqno); 2143 selinux_status_update_policyload(seqno); 2144 selinux_netlbl_cache_invalidate(); 2145 selinux_xfrm_notify_policyload(); 2146 2147 rc = 0; 2148 goto out; 2149 2150 err: 2151 kfree(map); 2152 sidtab_destroy(&newsidtab); 2153 policydb_destroy(newpolicydb); 2154 2155 out: 2156 kfree(oldpolicydb); 2157 return rc; 2158 } 2159 2160 size_t security_policydb_len(void) 2161 { 2162 size_t len; 2163 2164 read_lock(&policy_rwlock); 2165 len = policydb.len; 2166 read_unlock(&policy_rwlock); 2167 2168 return len; 2169 } 2170 2171 /** 2172 * security_port_sid - Obtain the SID for a port. 2173 * @protocol: protocol number 2174 * @port: port number 2175 * @out_sid: security identifier 2176 */ 2177 int security_port_sid(u8 protocol, u16 port, u32 *out_sid) 2178 { 2179 struct ocontext *c; 2180 int rc = 0; 2181 2182 read_lock(&policy_rwlock); 2183 2184 c = policydb.ocontexts[OCON_PORT]; 2185 while (c) { 2186 if (c->u.port.protocol == protocol && 2187 c->u.port.low_port <= port && 2188 c->u.port.high_port >= port) 2189 break; 2190 c = c->next; 2191 } 2192 2193 if (c) { 2194 if (!c->sid[0]) { 2195 rc = sidtab_context_to_sid(&sidtab, 2196 &c->context[0], 2197 &c->sid[0]); 2198 if (rc) 2199 goto out; 2200 } 2201 *out_sid = c->sid[0]; 2202 } else { 2203 *out_sid = SECINITSID_PORT; 2204 } 2205 2206 out: 2207 read_unlock(&policy_rwlock); 2208 return rc; 2209 } 2210 2211 /** 2212 * security_netif_sid - Obtain the SID for a network interface. 2213 * @name: interface name 2214 * @if_sid: interface SID 2215 */ 2216 int security_netif_sid(char *name, u32 *if_sid) 2217 { 2218 int rc = 0; 2219 struct ocontext *c; 2220 2221 read_lock(&policy_rwlock); 2222 2223 c = policydb.ocontexts[OCON_NETIF]; 2224 while (c) { 2225 if (strcmp(name, c->u.name) == 0) 2226 break; 2227 c = c->next; 2228 } 2229 2230 if (c) { 2231 if (!c->sid[0] || !c->sid[1]) { 2232 rc = sidtab_context_to_sid(&sidtab, 2233 &c->context[0], 2234 &c->sid[0]); 2235 if (rc) 2236 goto out; 2237 rc = sidtab_context_to_sid(&sidtab, 2238 &c->context[1], 2239 &c->sid[1]); 2240 if (rc) 2241 goto out; 2242 } 2243 *if_sid = c->sid[0]; 2244 } else 2245 *if_sid = SECINITSID_NETIF; 2246 2247 out: 2248 read_unlock(&policy_rwlock); 2249 return rc; 2250 } 2251 2252 static int match_ipv6_addrmask(u32 *input, u32 *addr, u32 *mask) 2253 { 2254 int i, fail = 0; 2255 2256 for (i = 0; i < 4; i++) 2257 if (addr[i] != (input[i] & mask[i])) { 2258 fail = 1; 2259 break; 2260 } 2261 2262 return !fail; 2263 } 2264 2265 /** 2266 * security_node_sid - Obtain the SID for a node (host). 2267 * @domain: communication domain aka address family 2268 * @addrp: address 2269 * @addrlen: address length in bytes 2270 * @out_sid: security identifier 2271 */ 2272 int security_node_sid(u16 domain, 2273 void *addrp, 2274 u32 addrlen, 2275 u32 *out_sid) 2276 { 2277 int rc; 2278 struct ocontext *c; 2279 2280 read_lock(&policy_rwlock); 2281 2282 switch (domain) { 2283 case AF_INET: { 2284 u32 addr; 2285 2286 rc = -EINVAL; 2287 if (addrlen != sizeof(u32)) 2288 goto out; 2289 2290 addr = *((u32 *)addrp); 2291 2292 c = policydb.ocontexts[OCON_NODE]; 2293 while (c) { 2294 if (c->u.node.addr == (addr & c->u.node.mask)) 2295 break; 2296 c = c->next; 2297 } 2298 break; 2299 } 2300 2301 case AF_INET6: 2302 rc = -EINVAL; 2303 if (addrlen != sizeof(u64) * 2) 2304 goto out; 2305 c = policydb.ocontexts[OCON_NODE6]; 2306 while (c) { 2307 if (match_ipv6_addrmask(addrp, c->u.node6.addr, 2308 c->u.node6.mask)) 2309 break; 2310 c = c->next; 2311 } 2312 break; 2313 2314 default: 2315 rc = 0; 2316 *out_sid = SECINITSID_NODE; 2317 goto out; 2318 } 2319 2320 if (c) { 2321 if (!c->sid[0]) { 2322 rc = sidtab_context_to_sid(&sidtab, 2323 &c->context[0], 2324 &c->sid[0]); 2325 if (rc) 2326 goto out; 2327 } 2328 *out_sid = c->sid[0]; 2329 } else { 2330 *out_sid = SECINITSID_NODE; 2331 } 2332 2333 rc = 0; 2334 out: 2335 read_unlock(&policy_rwlock); 2336 return rc; 2337 } 2338 2339 #define SIDS_NEL 25 2340 2341 /** 2342 * security_get_user_sids - Obtain reachable SIDs for a user. 2343 * @fromsid: starting SID 2344 * @username: username 2345 * @sids: array of reachable SIDs for user 2346 * @nel: number of elements in @sids 2347 * 2348 * Generate the set of SIDs for legal security contexts 2349 * for a given user that can be reached by @fromsid. 2350 * Set *@sids to point to a dynamically allocated 2351 * array containing the set of SIDs. Set *@nel to the 2352 * number of elements in the array. 2353 */ 2354 2355 int security_get_user_sids(u32 fromsid, 2356 char *username, 2357 u32 **sids, 2358 u32 *nel) 2359 { 2360 struct context *fromcon, usercon; 2361 u32 *mysids = NULL, *mysids2, sid; 2362 u32 mynel = 0, maxnel = SIDS_NEL; 2363 struct user_datum *user; 2364 struct role_datum *role; 2365 struct ebitmap_node *rnode, *tnode; 2366 int rc = 0, i, j; 2367 2368 *sids = NULL; 2369 *nel = 0; 2370 2371 if (!ss_initialized) 2372 goto out; 2373 2374 read_lock(&policy_rwlock); 2375 2376 context_init(&usercon); 2377 2378 rc = -EINVAL; 2379 fromcon = sidtab_search(&sidtab, fromsid); 2380 if (!fromcon) 2381 goto out_unlock; 2382 2383 rc = -EINVAL; 2384 user = hashtab_search(policydb.p_users.table, username); 2385 if (!user) 2386 goto out_unlock; 2387 2388 usercon.user = user->value; 2389 2390 rc = -ENOMEM; 2391 mysids = kcalloc(maxnel, sizeof(*mysids), GFP_ATOMIC); 2392 if (!mysids) 2393 goto out_unlock; 2394 2395 ebitmap_for_each_positive_bit(&user->roles, rnode, i) { 2396 role = policydb.role_val_to_struct[i]; 2397 usercon.role = i + 1; 2398 ebitmap_for_each_positive_bit(&role->types, tnode, j) { 2399 usercon.type = j + 1; 2400 2401 if (mls_setup_user_range(fromcon, user, &usercon)) 2402 continue; 2403 2404 rc = sidtab_context_to_sid(&sidtab, &usercon, &sid); 2405 if (rc) 2406 goto out_unlock; 2407 if (mynel < maxnel) { 2408 mysids[mynel++] = sid; 2409 } else { 2410 rc = -ENOMEM; 2411 maxnel += SIDS_NEL; 2412 mysids2 = kcalloc(maxnel, sizeof(*mysids2), GFP_ATOMIC); 2413 if (!mysids2) 2414 goto out_unlock; 2415 memcpy(mysids2, mysids, mynel * sizeof(*mysids2)); 2416 kfree(mysids); 2417 mysids = mysids2; 2418 mysids[mynel++] = sid; 2419 } 2420 } 2421 } 2422 rc = 0; 2423 out_unlock: 2424 read_unlock(&policy_rwlock); 2425 if (rc || !mynel) { 2426 kfree(mysids); 2427 goto out; 2428 } 2429 2430 rc = -ENOMEM; 2431 mysids2 = kcalloc(mynel, sizeof(*mysids2), GFP_KERNEL); 2432 if (!mysids2) { 2433 kfree(mysids); 2434 goto out; 2435 } 2436 for (i = 0, j = 0; i < mynel; i++) { 2437 struct av_decision dummy_avd; 2438 rc = avc_has_perm_noaudit(fromsid, mysids[i], 2439 SECCLASS_PROCESS, /* kernel value */ 2440 PROCESS__TRANSITION, AVC_STRICT, 2441 &dummy_avd); 2442 if (!rc) 2443 mysids2[j++] = mysids[i]; 2444 cond_resched(); 2445 } 2446 rc = 0; 2447 kfree(mysids); 2448 *sids = mysids2; 2449 *nel = j; 2450 out: 2451 return rc; 2452 } 2453 2454 /** 2455 * __security_genfs_sid - Helper to obtain a SID for a file in a filesystem 2456 * @fstype: filesystem type 2457 * @path: path from root of mount 2458 * @sclass: file security class 2459 * @sid: SID for path 2460 * 2461 * Obtain a SID to use for a file in a filesystem that 2462 * cannot support xattr or use a fixed labeling behavior like 2463 * transition SIDs or task SIDs. 2464 * 2465 * The caller must acquire the policy_rwlock before calling this function. 2466 */ 2467 static inline int __security_genfs_sid(const char *fstype, 2468 char *path, 2469 u16 orig_sclass, 2470 u32 *sid) 2471 { 2472 int len; 2473 u16 sclass; 2474 struct genfs *genfs; 2475 struct ocontext *c; 2476 int rc, cmp = 0; 2477 2478 while (path[0] == '/' && path[1] == '/') 2479 path++; 2480 2481 sclass = unmap_class(orig_sclass); 2482 *sid = SECINITSID_UNLABELED; 2483 2484 for (genfs = policydb.genfs; genfs; genfs = genfs->next) { 2485 cmp = strcmp(fstype, genfs->fstype); 2486 if (cmp <= 0) 2487 break; 2488 } 2489 2490 rc = -ENOENT; 2491 if (!genfs || cmp) 2492 goto out; 2493 2494 for (c = genfs->head; c; c = c->next) { 2495 len = strlen(c->u.name); 2496 if ((!c->v.sclass || sclass == c->v.sclass) && 2497 (strncmp(c->u.name, path, len) == 0)) 2498 break; 2499 } 2500 2501 rc = -ENOENT; 2502 if (!c) 2503 goto out; 2504 2505 if (!c->sid[0]) { 2506 rc = sidtab_context_to_sid(&sidtab, &c->context[0], &c->sid[0]); 2507 if (rc) 2508 goto out; 2509 } 2510 2511 *sid = c->sid[0]; 2512 rc = 0; 2513 out: 2514 return rc; 2515 } 2516 2517 /** 2518 * security_genfs_sid - Obtain a SID for a file in a filesystem 2519 * @fstype: filesystem type 2520 * @path: path from root of mount 2521 * @sclass: file security class 2522 * @sid: SID for path 2523 * 2524 * Acquire policy_rwlock before calling __security_genfs_sid() and release 2525 * it afterward. 2526 */ 2527 int security_genfs_sid(const char *fstype, 2528 char *path, 2529 u16 orig_sclass, 2530 u32 *sid) 2531 { 2532 int retval; 2533 2534 read_lock(&policy_rwlock); 2535 retval = __security_genfs_sid(fstype, path, orig_sclass, sid); 2536 read_unlock(&policy_rwlock); 2537 return retval; 2538 } 2539 2540 /** 2541 * security_fs_use - Determine how to handle labeling for a filesystem. 2542 * @sb: superblock in question 2543 */ 2544 int security_fs_use(struct super_block *sb) 2545 { 2546 int rc = 0; 2547 struct ocontext *c; 2548 struct superblock_security_struct *sbsec = sb->s_security; 2549 const char *fstype = sb->s_type->name; 2550 2551 read_lock(&policy_rwlock); 2552 2553 c = policydb.ocontexts[OCON_FSUSE]; 2554 while (c) { 2555 if (strcmp(fstype, c->u.name) == 0) 2556 break; 2557 c = c->next; 2558 } 2559 2560 if (c) { 2561 sbsec->behavior = c->v.behavior; 2562 if (!c->sid[0]) { 2563 rc = sidtab_context_to_sid(&sidtab, &c->context[0], 2564 &c->sid[0]); 2565 if (rc) 2566 goto out; 2567 } 2568 sbsec->sid = c->sid[0]; 2569 } else { 2570 rc = __security_genfs_sid(fstype, "/", SECCLASS_DIR, 2571 &sbsec->sid); 2572 if (rc) { 2573 sbsec->behavior = SECURITY_FS_USE_NONE; 2574 rc = 0; 2575 } else { 2576 sbsec->behavior = SECURITY_FS_USE_GENFS; 2577 } 2578 } 2579 2580 out: 2581 read_unlock(&policy_rwlock); 2582 return rc; 2583 } 2584 2585 int security_get_bools(int *len, char ***names, int **values) 2586 { 2587 int i, rc; 2588 2589 read_lock(&policy_rwlock); 2590 *names = NULL; 2591 *values = NULL; 2592 2593 rc = 0; 2594 *len = policydb.p_bools.nprim; 2595 if (!*len) 2596 goto out; 2597 2598 rc = -ENOMEM; 2599 *names = kcalloc(*len, sizeof(char *), GFP_ATOMIC); 2600 if (!*names) 2601 goto err; 2602 2603 rc = -ENOMEM; 2604 *values = kcalloc(*len, sizeof(int), GFP_ATOMIC); 2605 if (!*values) 2606 goto err; 2607 2608 for (i = 0; i < *len; i++) { 2609 (*values)[i] = policydb.bool_val_to_struct[i]->state; 2610 2611 rc = -ENOMEM; 2612 (*names)[i] = kstrdup(sym_name(&policydb, SYM_BOOLS, i), GFP_ATOMIC); 2613 if (!(*names)[i]) 2614 goto err; 2615 } 2616 rc = 0; 2617 out: 2618 read_unlock(&policy_rwlock); 2619 return rc; 2620 err: 2621 if (*names) { 2622 for (i = 0; i < *len; i++) 2623 kfree((*names)[i]); 2624 } 2625 kfree(*values); 2626 goto out; 2627 } 2628 2629 2630 int security_set_bools(int len, int *values) 2631 { 2632 int i, rc; 2633 int lenp, seqno = 0; 2634 struct cond_node *cur; 2635 2636 write_lock_irq(&policy_rwlock); 2637 2638 rc = -EFAULT; 2639 lenp = policydb.p_bools.nprim; 2640 if (len != lenp) 2641 goto out; 2642 2643 for (i = 0; i < len; i++) { 2644 if (!!values[i] != policydb.bool_val_to_struct[i]->state) { 2645 audit_log(current->audit_context, GFP_ATOMIC, 2646 AUDIT_MAC_CONFIG_CHANGE, 2647 "bool=%s val=%d old_val=%d auid=%u ses=%u", 2648 sym_name(&policydb, SYM_BOOLS, i), 2649 !!values[i], 2650 policydb.bool_val_to_struct[i]->state, 2651 from_kuid(&init_user_ns, audit_get_loginuid(current)), 2652 audit_get_sessionid(current)); 2653 } 2654 if (values[i]) 2655 policydb.bool_val_to_struct[i]->state = 1; 2656 else 2657 policydb.bool_val_to_struct[i]->state = 0; 2658 } 2659 2660 for (cur = policydb.cond_list; cur; cur = cur->next) { 2661 rc = evaluate_cond_node(&policydb, cur); 2662 if (rc) 2663 goto out; 2664 } 2665 2666 seqno = ++latest_granting; 2667 rc = 0; 2668 out: 2669 write_unlock_irq(&policy_rwlock); 2670 if (!rc) { 2671 avc_ss_reset(seqno); 2672 selnl_notify_policyload(seqno); 2673 selinux_status_update_policyload(seqno); 2674 selinux_xfrm_notify_policyload(); 2675 } 2676 return rc; 2677 } 2678 2679 int security_get_bool_value(int bool) 2680 { 2681 int rc; 2682 int len; 2683 2684 read_lock(&policy_rwlock); 2685 2686 rc = -EFAULT; 2687 len = policydb.p_bools.nprim; 2688 if (bool >= len) 2689 goto out; 2690 2691 rc = policydb.bool_val_to_struct[bool]->state; 2692 out: 2693 read_unlock(&policy_rwlock); 2694 return rc; 2695 } 2696 2697 static int security_preserve_bools(struct policydb *p) 2698 { 2699 int rc, nbools = 0, *bvalues = NULL, i; 2700 char **bnames = NULL; 2701 struct cond_bool_datum *booldatum; 2702 struct cond_node *cur; 2703 2704 rc = security_get_bools(&nbools, &bnames, &bvalues); 2705 if (rc) 2706 goto out; 2707 for (i = 0; i < nbools; i++) { 2708 booldatum = hashtab_search(p->p_bools.table, bnames[i]); 2709 if (booldatum) 2710 booldatum->state = bvalues[i]; 2711 } 2712 for (cur = p->cond_list; cur; cur = cur->next) { 2713 rc = evaluate_cond_node(p, cur); 2714 if (rc) 2715 goto out; 2716 } 2717 2718 out: 2719 if (bnames) { 2720 for (i = 0; i < nbools; i++) 2721 kfree(bnames[i]); 2722 } 2723 kfree(bnames); 2724 kfree(bvalues); 2725 return rc; 2726 } 2727 2728 /* 2729 * security_sid_mls_copy() - computes a new sid based on the given 2730 * sid and the mls portion of mls_sid. 2731 */ 2732 int security_sid_mls_copy(u32 sid, u32 mls_sid, u32 *new_sid) 2733 { 2734 struct context *context1; 2735 struct context *context2; 2736 struct context newcon; 2737 char *s; 2738 u32 len; 2739 int rc; 2740 2741 rc = 0; 2742 if (!ss_initialized || !policydb.mls_enabled) { 2743 *new_sid = sid; 2744 goto out; 2745 } 2746 2747 context_init(&newcon); 2748 2749 read_lock(&policy_rwlock); 2750 2751 rc = -EINVAL; 2752 context1 = sidtab_search(&sidtab, sid); 2753 if (!context1) { 2754 printk(KERN_ERR "SELinux: %s: unrecognized SID %d\n", 2755 __func__, sid); 2756 goto out_unlock; 2757 } 2758 2759 rc = -EINVAL; 2760 context2 = sidtab_search(&sidtab, mls_sid); 2761 if (!context2) { 2762 printk(KERN_ERR "SELinux: %s: unrecognized SID %d\n", 2763 __func__, mls_sid); 2764 goto out_unlock; 2765 } 2766 2767 newcon.user = context1->user; 2768 newcon.role = context1->role; 2769 newcon.type = context1->type; 2770 rc = mls_context_cpy(&newcon, context2); 2771 if (rc) 2772 goto out_unlock; 2773 2774 /* Check the validity of the new context. */ 2775 if (!policydb_context_isvalid(&policydb, &newcon)) { 2776 rc = convert_context_handle_invalid_context(&newcon); 2777 if (rc) { 2778 if (!context_struct_to_string(&newcon, &s, &len)) { 2779 audit_log(current->audit_context, 2780 GFP_ATOMIC, AUDIT_SELINUX_ERR, 2781 "op=security_sid_mls_copy " 2782 "invalid_context=%s", s); 2783 kfree(s); 2784 } 2785 goto out_unlock; 2786 } 2787 } 2788 2789 rc = sidtab_context_to_sid(&sidtab, &newcon, new_sid); 2790 out_unlock: 2791 read_unlock(&policy_rwlock); 2792 context_destroy(&newcon); 2793 out: 2794 return rc; 2795 } 2796 2797 /** 2798 * security_net_peersid_resolve - Compare and resolve two network peer SIDs 2799 * @nlbl_sid: NetLabel SID 2800 * @nlbl_type: NetLabel labeling protocol type 2801 * @xfrm_sid: XFRM SID 2802 * 2803 * Description: 2804 * Compare the @nlbl_sid and @xfrm_sid values and if the two SIDs can be 2805 * resolved into a single SID it is returned via @peer_sid and the function 2806 * returns zero. Otherwise @peer_sid is set to SECSID_NULL and the function 2807 * returns a negative value. A table summarizing the behavior is below: 2808 * 2809 * | function return | @sid 2810 * ------------------------------+-----------------+----------------- 2811 * no peer labels | 0 | SECSID_NULL 2812 * single peer label | 0 | <peer_label> 2813 * multiple, consistent labels | 0 | <peer_label> 2814 * multiple, inconsistent labels | -<errno> | SECSID_NULL 2815 * 2816 */ 2817 int security_net_peersid_resolve(u32 nlbl_sid, u32 nlbl_type, 2818 u32 xfrm_sid, 2819 u32 *peer_sid) 2820 { 2821 int rc; 2822 struct context *nlbl_ctx; 2823 struct context *xfrm_ctx; 2824 2825 *peer_sid = SECSID_NULL; 2826 2827 /* handle the common (which also happens to be the set of easy) cases 2828 * right away, these two if statements catch everything involving a 2829 * single or absent peer SID/label */ 2830 if (xfrm_sid == SECSID_NULL) { 2831 *peer_sid = nlbl_sid; 2832 return 0; 2833 } 2834 /* NOTE: an nlbl_type == NETLBL_NLTYPE_UNLABELED is a "fallback" label 2835 * and is treated as if nlbl_sid == SECSID_NULL when a XFRM SID/label 2836 * is present */ 2837 if (nlbl_sid == SECSID_NULL || nlbl_type == NETLBL_NLTYPE_UNLABELED) { 2838 *peer_sid = xfrm_sid; 2839 return 0; 2840 } 2841 2842 /* we don't need to check ss_initialized here since the only way both 2843 * nlbl_sid and xfrm_sid are not equal to SECSID_NULL would be if the 2844 * security server was initialized and ss_initialized was true */ 2845 if (!policydb.mls_enabled) 2846 return 0; 2847 2848 read_lock(&policy_rwlock); 2849 2850 rc = -EINVAL; 2851 nlbl_ctx = sidtab_search(&sidtab, nlbl_sid); 2852 if (!nlbl_ctx) { 2853 printk(KERN_ERR "SELinux: %s: unrecognized SID %d\n", 2854 __func__, nlbl_sid); 2855 goto out; 2856 } 2857 rc = -EINVAL; 2858 xfrm_ctx = sidtab_search(&sidtab, xfrm_sid); 2859 if (!xfrm_ctx) { 2860 printk(KERN_ERR "SELinux: %s: unrecognized SID %d\n", 2861 __func__, xfrm_sid); 2862 goto out; 2863 } 2864 rc = (mls_context_cmp(nlbl_ctx, xfrm_ctx) ? 0 : -EACCES); 2865 if (rc) 2866 goto out; 2867 2868 /* at present NetLabel SIDs/labels really only carry MLS 2869 * information so if the MLS portion of the NetLabel SID 2870 * matches the MLS portion of the labeled XFRM SID/label 2871 * then pass along the XFRM SID as it is the most 2872 * expressive */ 2873 *peer_sid = xfrm_sid; 2874 out: 2875 read_unlock(&policy_rwlock); 2876 return rc; 2877 } 2878 2879 static int get_classes_callback(void *k, void *d, void *args) 2880 { 2881 struct class_datum *datum = d; 2882 char *name = k, **classes = args; 2883 int value = datum->value - 1; 2884 2885 classes[value] = kstrdup(name, GFP_ATOMIC); 2886 if (!classes[value]) 2887 return -ENOMEM; 2888 2889 return 0; 2890 } 2891 2892 int security_get_classes(char ***classes, int *nclasses) 2893 { 2894 int rc; 2895 2896 read_lock(&policy_rwlock); 2897 2898 rc = -ENOMEM; 2899 *nclasses = policydb.p_classes.nprim; 2900 *classes = kcalloc(*nclasses, sizeof(**classes), GFP_ATOMIC); 2901 if (!*classes) 2902 goto out; 2903 2904 rc = hashtab_map(policydb.p_classes.table, get_classes_callback, 2905 *classes); 2906 if (rc) { 2907 int i; 2908 for (i = 0; i < *nclasses; i++) 2909 kfree((*classes)[i]); 2910 kfree(*classes); 2911 } 2912 2913 out: 2914 read_unlock(&policy_rwlock); 2915 return rc; 2916 } 2917 2918 static int get_permissions_callback(void *k, void *d, void *args) 2919 { 2920 struct perm_datum *datum = d; 2921 char *name = k, **perms = args; 2922 int value = datum->value - 1; 2923 2924 perms[value] = kstrdup(name, GFP_ATOMIC); 2925 if (!perms[value]) 2926 return -ENOMEM; 2927 2928 return 0; 2929 } 2930 2931 int security_get_permissions(char *class, char ***perms, int *nperms) 2932 { 2933 int rc, i; 2934 struct class_datum *match; 2935 2936 read_lock(&policy_rwlock); 2937 2938 rc = -EINVAL; 2939 match = hashtab_search(policydb.p_classes.table, class); 2940 if (!match) { 2941 printk(KERN_ERR "SELinux: %s: unrecognized class %s\n", 2942 __func__, class); 2943 goto out; 2944 } 2945 2946 rc = -ENOMEM; 2947 *nperms = match->permissions.nprim; 2948 *perms = kcalloc(*nperms, sizeof(**perms), GFP_ATOMIC); 2949 if (!*perms) 2950 goto out; 2951 2952 if (match->comdatum) { 2953 rc = hashtab_map(match->comdatum->permissions.table, 2954 get_permissions_callback, *perms); 2955 if (rc) 2956 goto err; 2957 } 2958 2959 rc = hashtab_map(match->permissions.table, get_permissions_callback, 2960 *perms); 2961 if (rc) 2962 goto err; 2963 2964 out: 2965 read_unlock(&policy_rwlock); 2966 return rc; 2967 2968 err: 2969 read_unlock(&policy_rwlock); 2970 for (i = 0; i < *nperms; i++) 2971 kfree((*perms)[i]); 2972 kfree(*perms); 2973 return rc; 2974 } 2975 2976 int security_get_reject_unknown(void) 2977 { 2978 return policydb.reject_unknown; 2979 } 2980 2981 int security_get_allow_unknown(void) 2982 { 2983 return policydb.allow_unknown; 2984 } 2985 2986 /** 2987 * security_policycap_supported - Check for a specific policy capability 2988 * @req_cap: capability 2989 * 2990 * Description: 2991 * This function queries the currently loaded policy to see if it supports the 2992 * capability specified by @req_cap. Returns true (1) if the capability is 2993 * supported, false (0) if it isn't supported. 2994 * 2995 */ 2996 int security_policycap_supported(unsigned int req_cap) 2997 { 2998 int rc; 2999 3000 read_lock(&policy_rwlock); 3001 rc = ebitmap_get_bit(&policydb.policycaps, req_cap); 3002 read_unlock(&policy_rwlock); 3003 3004 return rc; 3005 } 3006 3007 struct selinux_audit_rule { 3008 u32 au_seqno; 3009 struct context au_ctxt; 3010 }; 3011 3012 void selinux_audit_rule_free(void *vrule) 3013 { 3014 struct selinux_audit_rule *rule = vrule; 3015 3016 if (rule) { 3017 context_destroy(&rule->au_ctxt); 3018 kfree(rule); 3019 } 3020 } 3021 3022 int selinux_audit_rule_init(u32 field, u32 op, char *rulestr, void **vrule) 3023 { 3024 struct selinux_audit_rule *tmprule; 3025 struct role_datum *roledatum; 3026 struct type_datum *typedatum; 3027 struct user_datum *userdatum; 3028 struct selinux_audit_rule **rule = (struct selinux_audit_rule **)vrule; 3029 int rc = 0; 3030 3031 *rule = NULL; 3032 3033 if (!ss_initialized) 3034 return -EOPNOTSUPP; 3035 3036 switch (field) { 3037 case AUDIT_SUBJ_USER: 3038 case AUDIT_SUBJ_ROLE: 3039 case AUDIT_SUBJ_TYPE: 3040 case AUDIT_OBJ_USER: 3041 case AUDIT_OBJ_ROLE: 3042 case AUDIT_OBJ_TYPE: 3043 /* only 'equals' and 'not equals' fit user, role, and type */ 3044 if (op != Audit_equal && op != Audit_not_equal) 3045 return -EINVAL; 3046 break; 3047 case AUDIT_SUBJ_SEN: 3048 case AUDIT_SUBJ_CLR: 3049 case AUDIT_OBJ_LEV_LOW: 3050 case AUDIT_OBJ_LEV_HIGH: 3051 /* we do not allow a range, indicated by the presence of '-' */ 3052 if (strchr(rulestr, '-')) 3053 return -EINVAL; 3054 break; 3055 default: 3056 /* only the above fields are valid */ 3057 return -EINVAL; 3058 } 3059 3060 tmprule = kzalloc(sizeof(struct selinux_audit_rule), GFP_KERNEL); 3061 if (!tmprule) 3062 return -ENOMEM; 3063 3064 context_init(&tmprule->au_ctxt); 3065 3066 read_lock(&policy_rwlock); 3067 3068 tmprule->au_seqno = latest_granting; 3069 3070 switch (field) { 3071 case AUDIT_SUBJ_USER: 3072 case AUDIT_OBJ_USER: 3073 rc = -EINVAL; 3074 userdatum = hashtab_search(policydb.p_users.table, rulestr); 3075 if (!userdatum) 3076 goto out; 3077 tmprule->au_ctxt.user = userdatum->value; 3078 break; 3079 case AUDIT_SUBJ_ROLE: 3080 case AUDIT_OBJ_ROLE: 3081 rc = -EINVAL; 3082 roledatum = hashtab_search(policydb.p_roles.table, rulestr); 3083 if (!roledatum) 3084 goto out; 3085 tmprule->au_ctxt.role = roledatum->value; 3086 break; 3087 case AUDIT_SUBJ_TYPE: 3088 case AUDIT_OBJ_TYPE: 3089 rc = -EINVAL; 3090 typedatum = hashtab_search(policydb.p_types.table, rulestr); 3091 if (!typedatum) 3092 goto out; 3093 tmprule->au_ctxt.type = typedatum->value; 3094 break; 3095 case AUDIT_SUBJ_SEN: 3096 case AUDIT_SUBJ_CLR: 3097 case AUDIT_OBJ_LEV_LOW: 3098 case AUDIT_OBJ_LEV_HIGH: 3099 rc = mls_from_string(rulestr, &tmprule->au_ctxt, GFP_ATOMIC); 3100 if (rc) 3101 goto out; 3102 break; 3103 } 3104 rc = 0; 3105 out: 3106 read_unlock(&policy_rwlock); 3107 3108 if (rc) { 3109 selinux_audit_rule_free(tmprule); 3110 tmprule = NULL; 3111 } 3112 3113 *rule = tmprule; 3114 3115 return rc; 3116 } 3117 3118 /* Check to see if the rule contains any selinux fields */ 3119 int selinux_audit_rule_known(struct audit_krule *rule) 3120 { 3121 int i; 3122 3123 for (i = 0; i < rule->field_count; i++) { 3124 struct audit_field *f = &rule->fields[i]; 3125 switch (f->type) { 3126 case AUDIT_SUBJ_USER: 3127 case AUDIT_SUBJ_ROLE: 3128 case AUDIT_SUBJ_TYPE: 3129 case AUDIT_SUBJ_SEN: 3130 case AUDIT_SUBJ_CLR: 3131 case AUDIT_OBJ_USER: 3132 case AUDIT_OBJ_ROLE: 3133 case AUDIT_OBJ_TYPE: 3134 case AUDIT_OBJ_LEV_LOW: 3135 case AUDIT_OBJ_LEV_HIGH: 3136 return 1; 3137 } 3138 } 3139 3140 return 0; 3141 } 3142 3143 int selinux_audit_rule_match(u32 sid, u32 field, u32 op, void *vrule, 3144 struct audit_context *actx) 3145 { 3146 struct context *ctxt; 3147 struct mls_level *level; 3148 struct selinux_audit_rule *rule = vrule; 3149 int match = 0; 3150 3151 if (unlikely(!rule)) { 3152 WARN_ONCE(1, "selinux_audit_rule_match: missing rule\n"); 3153 return -ENOENT; 3154 } 3155 3156 read_lock(&policy_rwlock); 3157 3158 if (rule->au_seqno < latest_granting) { 3159 match = -ESTALE; 3160 goto out; 3161 } 3162 3163 ctxt = sidtab_search(&sidtab, sid); 3164 if (unlikely(!ctxt)) { 3165 WARN_ONCE(1, "selinux_audit_rule_match: unrecognized SID %d\n", 3166 sid); 3167 match = -ENOENT; 3168 goto out; 3169 } 3170 3171 /* a field/op pair that is not caught here will simply fall through 3172 without a match */ 3173 switch (field) { 3174 case AUDIT_SUBJ_USER: 3175 case AUDIT_OBJ_USER: 3176 switch (op) { 3177 case Audit_equal: 3178 match = (ctxt->user == rule->au_ctxt.user); 3179 break; 3180 case Audit_not_equal: 3181 match = (ctxt->user != rule->au_ctxt.user); 3182 break; 3183 } 3184 break; 3185 case AUDIT_SUBJ_ROLE: 3186 case AUDIT_OBJ_ROLE: 3187 switch (op) { 3188 case Audit_equal: 3189 match = (ctxt->role == rule->au_ctxt.role); 3190 break; 3191 case Audit_not_equal: 3192 match = (ctxt->role != rule->au_ctxt.role); 3193 break; 3194 } 3195 break; 3196 case AUDIT_SUBJ_TYPE: 3197 case AUDIT_OBJ_TYPE: 3198 switch (op) { 3199 case Audit_equal: 3200 match = (ctxt->type == rule->au_ctxt.type); 3201 break; 3202 case Audit_not_equal: 3203 match = (ctxt->type != rule->au_ctxt.type); 3204 break; 3205 } 3206 break; 3207 case AUDIT_SUBJ_SEN: 3208 case AUDIT_SUBJ_CLR: 3209 case AUDIT_OBJ_LEV_LOW: 3210 case AUDIT_OBJ_LEV_HIGH: 3211 level = ((field == AUDIT_SUBJ_SEN || 3212 field == AUDIT_OBJ_LEV_LOW) ? 3213 &ctxt->range.level[0] : &ctxt->range.level[1]); 3214 switch (op) { 3215 case Audit_equal: 3216 match = mls_level_eq(&rule->au_ctxt.range.level[0], 3217 level); 3218 break; 3219 case Audit_not_equal: 3220 match = !mls_level_eq(&rule->au_ctxt.range.level[0], 3221 level); 3222 break; 3223 case Audit_lt: 3224 match = (mls_level_dom(&rule->au_ctxt.range.level[0], 3225 level) && 3226 !mls_level_eq(&rule->au_ctxt.range.level[0], 3227 level)); 3228 break; 3229 case Audit_le: 3230 match = mls_level_dom(&rule->au_ctxt.range.level[0], 3231 level); 3232 break; 3233 case Audit_gt: 3234 match = (mls_level_dom(level, 3235 &rule->au_ctxt.range.level[0]) && 3236 !mls_level_eq(level, 3237 &rule->au_ctxt.range.level[0])); 3238 break; 3239 case Audit_ge: 3240 match = mls_level_dom(level, 3241 &rule->au_ctxt.range.level[0]); 3242 break; 3243 } 3244 } 3245 3246 out: 3247 read_unlock(&policy_rwlock); 3248 return match; 3249 } 3250 3251 static int (*aurule_callback)(void) = audit_update_lsm_rules; 3252 3253 static int aurule_avc_callback(u32 event) 3254 { 3255 int err = 0; 3256 3257 if (event == AVC_CALLBACK_RESET && aurule_callback) 3258 err = aurule_callback(); 3259 return err; 3260 } 3261 3262 static int __init aurule_init(void) 3263 { 3264 int err; 3265 3266 err = avc_add_callback(aurule_avc_callback, AVC_CALLBACK_RESET); 3267 if (err) 3268 panic("avc_add_callback() failed, error %d\n", err); 3269 3270 return err; 3271 } 3272 __initcall(aurule_init); 3273 3274 #ifdef CONFIG_NETLABEL 3275 /** 3276 * security_netlbl_cache_add - Add an entry to the NetLabel cache 3277 * @secattr: the NetLabel packet security attributes 3278 * @sid: the SELinux SID 3279 * 3280 * Description: 3281 * Attempt to cache the context in @ctx, which was derived from the packet in 3282 * @skb, in the NetLabel subsystem cache. This function assumes @secattr has 3283 * already been initialized. 3284 * 3285 */ 3286 static void security_netlbl_cache_add(struct netlbl_lsm_secattr *secattr, 3287 u32 sid) 3288 { 3289 u32 *sid_cache; 3290 3291 sid_cache = kmalloc(sizeof(*sid_cache), GFP_ATOMIC); 3292 if (sid_cache == NULL) 3293 return; 3294 secattr->cache = netlbl_secattr_cache_alloc(GFP_ATOMIC); 3295 if (secattr->cache == NULL) { 3296 kfree(sid_cache); 3297 return; 3298 } 3299 3300 *sid_cache = sid; 3301 secattr->cache->free = kfree; 3302 secattr->cache->data = sid_cache; 3303 secattr->flags |= NETLBL_SECATTR_CACHE; 3304 } 3305 3306 /** 3307 * security_netlbl_secattr_to_sid - Convert a NetLabel secattr to a SELinux SID 3308 * @secattr: the NetLabel packet security attributes 3309 * @sid: the SELinux SID 3310 * 3311 * Description: 3312 * Convert the given NetLabel security attributes in @secattr into a 3313 * SELinux SID. If the @secattr field does not contain a full SELinux 3314 * SID/context then use SECINITSID_NETMSG as the foundation. If possible the 3315 * 'cache' field of @secattr is set and the CACHE flag is set; this is to 3316 * allow the @secattr to be used by NetLabel to cache the secattr to SID 3317 * conversion for future lookups. Returns zero on success, negative values on 3318 * failure. 3319 * 3320 */ 3321 int security_netlbl_secattr_to_sid(struct netlbl_lsm_secattr *secattr, 3322 u32 *sid) 3323 { 3324 int rc; 3325 struct context *ctx; 3326 struct context ctx_new; 3327 3328 if (!ss_initialized) { 3329 *sid = SECSID_NULL; 3330 return 0; 3331 } 3332 3333 read_lock(&policy_rwlock); 3334 3335 if (secattr->flags & NETLBL_SECATTR_CACHE) 3336 *sid = *(u32 *)secattr->cache->data; 3337 else if (secattr->flags & NETLBL_SECATTR_SECID) 3338 *sid = secattr->attr.secid; 3339 else if (secattr->flags & NETLBL_SECATTR_MLS_LVL) { 3340 rc = -EIDRM; 3341 ctx = sidtab_search(&sidtab, SECINITSID_NETMSG); 3342 if (ctx == NULL) 3343 goto out; 3344 3345 context_init(&ctx_new); 3346 ctx_new.user = ctx->user; 3347 ctx_new.role = ctx->role; 3348 ctx_new.type = ctx->type; 3349 mls_import_netlbl_lvl(&ctx_new, secattr); 3350 if (secattr->flags & NETLBL_SECATTR_MLS_CAT) { 3351 rc = mls_import_netlbl_cat(&ctx_new, secattr); 3352 if (rc) 3353 goto out; 3354 } 3355 rc = -EIDRM; 3356 if (!mls_context_isvalid(&policydb, &ctx_new)) 3357 goto out_free; 3358 3359 rc = sidtab_context_to_sid(&sidtab, &ctx_new, sid); 3360 if (rc) 3361 goto out_free; 3362 3363 security_netlbl_cache_add(secattr, *sid); 3364 3365 ebitmap_destroy(&ctx_new.range.level[0].cat); 3366 } else 3367 *sid = SECSID_NULL; 3368 3369 read_unlock(&policy_rwlock); 3370 return 0; 3371 out_free: 3372 ebitmap_destroy(&ctx_new.range.level[0].cat); 3373 out: 3374 read_unlock(&policy_rwlock); 3375 return rc; 3376 } 3377 3378 /** 3379 * security_netlbl_sid_to_secattr - Convert a SELinux SID to a NetLabel secattr 3380 * @sid: the SELinux SID 3381 * @secattr: the NetLabel packet security attributes 3382 * 3383 * Description: 3384 * Convert the given SELinux SID in @sid into a NetLabel security attribute. 3385 * Returns zero on success, negative values on failure. 3386 * 3387 */ 3388 int security_netlbl_sid_to_secattr(u32 sid, struct netlbl_lsm_secattr *secattr) 3389 { 3390 int rc; 3391 struct context *ctx; 3392 3393 if (!ss_initialized) 3394 return 0; 3395 3396 read_lock(&policy_rwlock); 3397 3398 rc = -ENOENT; 3399 ctx = sidtab_search(&sidtab, sid); 3400 if (ctx == NULL) 3401 goto out; 3402 3403 rc = -ENOMEM; 3404 secattr->domain = kstrdup(sym_name(&policydb, SYM_TYPES, ctx->type - 1), 3405 GFP_ATOMIC); 3406 if (secattr->domain == NULL) 3407 goto out; 3408 3409 secattr->attr.secid = sid; 3410 secattr->flags |= NETLBL_SECATTR_DOMAIN_CPY | NETLBL_SECATTR_SECID; 3411 mls_export_netlbl_lvl(ctx, secattr); 3412 rc = mls_export_netlbl_cat(ctx, secattr); 3413 out: 3414 read_unlock(&policy_rwlock); 3415 return rc; 3416 } 3417 #endif /* CONFIG_NETLABEL */ 3418 3419 /** 3420 * security_read_policy - read the policy. 3421 * @data: binary policy data 3422 * @len: length of data in bytes 3423 * 3424 */ 3425 int security_read_policy(void **data, size_t *len) 3426 { 3427 int rc; 3428 struct policy_file fp; 3429 3430 if (!ss_initialized) 3431 return -EINVAL; 3432 3433 *len = security_policydb_len(); 3434 3435 *data = vmalloc_user(*len); 3436 if (!*data) 3437 return -ENOMEM; 3438 3439 fp.data = *data; 3440 fp.len = *len; 3441 3442 read_lock(&policy_rwlock); 3443 rc = policydb_write(&policydb, &fp); 3444 read_unlock(&policy_rwlock); 3445 3446 if (rc) 3447 return rc; 3448 3449 *len = (unsigned long)fp.data - (unsigned long)*data; 3450 return 0; 3451 3452 } 3453