1 // SPDX-License-Identifier: GPL-2.0-only 2 /* 3 * Implementation of the security services. 4 * 5 * Authors : Stephen Smalley, <sds@tycho.nsa.gov> 6 * James Morris <jmorris@redhat.com> 7 * 8 * Updated: Trusted Computer Solutions, Inc. <dgoeddel@trustedcs.com> 9 * 10 * Support for enhanced MLS infrastructure. 11 * Support for context based audit filters. 12 * 13 * Updated: Frank Mayer <mayerf@tresys.com> and Karl MacMillan <kmacmillan@tresys.com> 14 * 15 * Added conditional policy language extensions 16 * 17 * Updated: Hewlett-Packard <paul@paul-moore.com> 18 * 19 * Added support for NetLabel 20 * Added support for the policy capability bitmap 21 * 22 * Updated: Chad Sellers <csellers@tresys.com> 23 * 24 * Added validation of kernel classes and permissions 25 * 26 * Updated: KaiGai Kohei <kaigai@ak.jp.nec.com> 27 * 28 * Added support for bounds domain and audit messaged on masked permissions 29 * 30 * Updated: Guido Trentalancia <guido@trentalancia.com> 31 * 32 * Added support for runtime switching of the policy type 33 * 34 * Copyright (C) 2008, 2009 NEC Corporation 35 * Copyright (C) 2006, 2007 Hewlett-Packard Development Company, L.P. 36 * Copyright (C) 2004-2006 Trusted Computer Solutions, Inc. 37 * Copyright (C) 2003 - 2004, 2006 Tresys Technology, LLC 38 * Copyright (C) 2003 Red Hat, Inc., James Morris <jmorris@redhat.com> 39 */ 40 #include <linux/kernel.h> 41 #include <linux/slab.h> 42 #include <linux/string.h> 43 #include <linux/spinlock.h> 44 #include <linux/rcupdate.h> 45 #include <linux/errno.h> 46 #include <linux/in.h> 47 #include <linux/sched.h> 48 #include <linux/audit.h> 49 #include <linux/vmalloc.h> 50 #include <linux/lsm_hooks.h> 51 #include <net/netlabel.h> 52 53 #include "flask.h" 54 #include "avc.h" 55 #include "avc_ss.h" 56 #include "security.h" 57 #include "context.h" 58 #include "policydb.h" 59 #include "sidtab.h" 60 #include "services.h" 61 #include "conditional.h" 62 #include "mls.h" 63 #include "objsec.h" 64 #include "netlabel.h" 65 #include "xfrm.h" 66 #include "ebitmap.h" 67 #include "audit.h" 68 #include "policycap_names.h" 69 #include "ima.h" 70 71 struct convert_context_args { 72 struct selinux_state *state; 73 struct policydb *oldp; 74 struct policydb *newp; 75 }; 76 77 struct selinux_policy_convert_data { 78 struct convert_context_args args; 79 struct sidtab_convert_params sidtab_params; 80 }; 81 82 /* Forward declaration. */ 83 static int context_struct_to_string(struct policydb *policydb, 84 struct context *context, 85 char **scontext, 86 u32 *scontext_len); 87 88 static int sidtab_entry_to_string(struct policydb *policydb, 89 struct sidtab *sidtab, 90 struct sidtab_entry *entry, 91 char **scontext, 92 u32 *scontext_len); 93 94 static void context_struct_compute_av(struct policydb *policydb, 95 struct context *scontext, 96 struct context *tcontext, 97 u16 tclass, 98 struct av_decision *avd, 99 struct extended_perms *xperms); 100 101 static int selinux_set_mapping(struct policydb *pol, 102 struct security_class_mapping *map, 103 struct selinux_map *out_map) 104 { 105 u16 i, j; 106 unsigned k; 107 bool print_unknown_handle = false; 108 109 /* Find number of classes in the input mapping */ 110 if (!map) 111 return -EINVAL; 112 i = 0; 113 while (map[i].name) 114 i++; 115 116 /* Allocate space for the class records, plus one for class zero */ 117 out_map->mapping = kcalloc(++i, sizeof(*out_map->mapping), GFP_ATOMIC); 118 if (!out_map->mapping) 119 return -ENOMEM; 120 121 /* Store the raw class and permission values */ 122 j = 0; 123 while (map[j].name) { 124 struct security_class_mapping *p_in = map + (j++); 125 struct selinux_mapping *p_out = out_map->mapping + j; 126 127 /* An empty class string skips ahead */ 128 if (!strcmp(p_in->name, "")) { 129 p_out->num_perms = 0; 130 continue; 131 } 132 133 p_out->value = string_to_security_class(pol, p_in->name); 134 if (!p_out->value) { 135 pr_info("SELinux: Class %s not defined in policy.\n", 136 p_in->name); 137 if (pol->reject_unknown) 138 goto err; 139 p_out->num_perms = 0; 140 print_unknown_handle = true; 141 continue; 142 } 143 144 k = 0; 145 while (p_in->perms[k]) { 146 /* An empty permission string skips ahead */ 147 if (!*p_in->perms[k]) { 148 k++; 149 continue; 150 } 151 p_out->perms[k] = string_to_av_perm(pol, p_out->value, 152 p_in->perms[k]); 153 if (!p_out->perms[k]) { 154 pr_info("SELinux: Permission %s in class %s not defined in policy.\n", 155 p_in->perms[k], p_in->name); 156 if (pol->reject_unknown) 157 goto err; 158 print_unknown_handle = true; 159 } 160 161 k++; 162 } 163 p_out->num_perms = k; 164 } 165 166 if (print_unknown_handle) 167 pr_info("SELinux: the above unknown classes and permissions will be %s\n", 168 pol->allow_unknown ? "allowed" : "denied"); 169 170 out_map->size = i; 171 return 0; 172 err: 173 kfree(out_map->mapping); 174 out_map->mapping = NULL; 175 return -EINVAL; 176 } 177 178 /* 179 * Get real, policy values from mapped values 180 */ 181 182 static u16 unmap_class(struct selinux_map *map, u16 tclass) 183 { 184 if (tclass < map->size) 185 return map->mapping[tclass].value; 186 187 return tclass; 188 } 189 190 /* 191 * Get kernel value for class from its policy value 192 */ 193 static u16 map_class(struct selinux_map *map, u16 pol_value) 194 { 195 u16 i; 196 197 for (i = 1; i < map->size; i++) { 198 if (map->mapping[i].value == pol_value) 199 return i; 200 } 201 202 return SECCLASS_NULL; 203 } 204 205 static void map_decision(struct selinux_map *map, 206 u16 tclass, struct av_decision *avd, 207 int allow_unknown) 208 { 209 if (tclass < map->size) { 210 struct selinux_mapping *mapping = &map->mapping[tclass]; 211 unsigned int i, n = mapping->num_perms; 212 u32 result; 213 214 for (i = 0, result = 0; i < n; i++) { 215 if (avd->allowed & mapping->perms[i]) 216 result |= 1<<i; 217 if (allow_unknown && !mapping->perms[i]) 218 result |= 1<<i; 219 } 220 avd->allowed = result; 221 222 for (i = 0, result = 0; i < n; i++) 223 if (avd->auditallow & mapping->perms[i]) 224 result |= 1<<i; 225 avd->auditallow = result; 226 227 for (i = 0, result = 0; i < n; i++) { 228 if (avd->auditdeny & mapping->perms[i]) 229 result |= 1<<i; 230 if (!allow_unknown && !mapping->perms[i]) 231 result |= 1<<i; 232 } 233 /* 234 * In case the kernel has a bug and requests a permission 235 * between num_perms and the maximum permission number, we 236 * should audit that denial 237 */ 238 for (; i < (sizeof(u32)*8); i++) 239 result |= 1<<i; 240 avd->auditdeny = result; 241 } 242 } 243 244 int security_mls_enabled(struct selinux_state *state) 245 { 246 int mls_enabled; 247 struct selinux_policy *policy; 248 249 if (!selinux_initialized(state)) 250 return 0; 251 252 rcu_read_lock(); 253 policy = rcu_dereference(state->policy); 254 mls_enabled = policy->policydb.mls_enabled; 255 rcu_read_unlock(); 256 return mls_enabled; 257 } 258 259 /* 260 * Return the boolean value of a constraint expression 261 * when it is applied to the specified source and target 262 * security contexts. 263 * 264 * xcontext is a special beast... It is used by the validatetrans rules 265 * only. For these rules, scontext is the context before the transition, 266 * tcontext is the context after the transition, and xcontext is the context 267 * of the process performing the transition. All other callers of 268 * constraint_expr_eval should pass in NULL for xcontext. 269 */ 270 static int constraint_expr_eval(struct policydb *policydb, 271 struct context *scontext, 272 struct context *tcontext, 273 struct context *xcontext, 274 struct constraint_expr *cexpr) 275 { 276 u32 val1, val2; 277 struct context *c; 278 struct role_datum *r1, *r2; 279 struct mls_level *l1, *l2; 280 struct constraint_expr *e; 281 int s[CEXPR_MAXDEPTH]; 282 int sp = -1; 283 284 for (e = cexpr; e; e = e->next) { 285 switch (e->expr_type) { 286 case CEXPR_NOT: 287 BUG_ON(sp < 0); 288 s[sp] = !s[sp]; 289 break; 290 case CEXPR_AND: 291 BUG_ON(sp < 1); 292 sp--; 293 s[sp] &= s[sp + 1]; 294 break; 295 case CEXPR_OR: 296 BUG_ON(sp < 1); 297 sp--; 298 s[sp] |= s[sp + 1]; 299 break; 300 case CEXPR_ATTR: 301 if (sp == (CEXPR_MAXDEPTH - 1)) 302 return 0; 303 switch (e->attr) { 304 case CEXPR_USER: 305 val1 = scontext->user; 306 val2 = tcontext->user; 307 break; 308 case CEXPR_TYPE: 309 val1 = scontext->type; 310 val2 = tcontext->type; 311 break; 312 case CEXPR_ROLE: 313 val1 = scontext->role; 314 val2 = tcontext->role; 315 r1 = policydb->role_val_to_struct[val1 - 1]; 316 r2 = policydb->role_val_to_struct[val2 - 1]; 317 switch (e->op) { 318 case CEXPR_DOM: 319 s[++sp] = ebitmap_get_bit(&r1->dominates, 320 val2 - 1); 321 continue; 322 case CEXPR_DOMBY: 323 s[++sp] = ebitmap_get_bit(&r2->dominates, 324 val1 - 1); 325 continue; 326 case CEXPR_INCOMP: 327 s[++sp] = (!ebitmap_get_bit(&r1->dominates, 328 val2 - 1) && 329 !ebitmap_get_bit(&r2->dominates, 330 val1 - 1)); 331 continue; 332 default: 333 break; 334 } 335 break; 336 case CEXPR_L1L2: 337 l1 = &(scontext->range.level[0]); 338 l2 = &(tcontext->range.level[0]); 339 goto mls_ops; 340 case CEXPR_L1H2: 341 l1 = &(scontext->range.level[0]); 342 l2 = &(tcontext->range.level[1]); 343 goto mls_ops; 344 case CEXPR_H1L2: 345 l1 = &(scontext->range.level[1]); 346 l2 = &(tcontext->range.level[0]); 347 goto mls_ops; 348 case CEXPR_H1H2: 349 l1 = &(scontext->range.level[1]); 350 l2 = &(tcontext->range.level[1]); 351 goto mls_ops; 352 case CEXPR_L1H1: 353 l1 = &(scontext->range.level[0]); 354 l2 = &(scontext->range.level[1]); 355 goto mls_ops; 356 case CEXPR_L2H2: 357 l1 = &(tcontext->range.level[0]); 358 l2 = &(tcontext->range.level[1]); 359 goto mls_ops; 360 mls_ops: 361 switch (e->op) { 362 case CEXPR_EQ: 363 s[++sp] = mls_level_eq(l1, l2); 364 continue; 365 case CEXPR_NEQ: 366 s[++sp] = !mls_level_eq(l1, l2); 367 continue; 368 case CEXPR_DOM: 369 s[++sp] = mls_level_dom(l1, l2); 370 continue; 371 case CEXPR_DOMBY: 372 s[++sp] = mls_level_dom(l2, l1); 373 continue; 374 case CEXPR_INCOMP: 375 s[++sp] = mls_level_incomp(l2, l1); 376 continue; 377 default: 378 BUG(); 379 return 0; 380 } 381 break; 382 default: 383 BUG(); 384 return 0; 385 } 386 387 switch (e->op) { 388 case CEXPR_EQ: 389 s[++sp] = (val1 == val2); 390 break; 391 case CEXPR_NEQ: 392 s[++sp] = (val1 != val2); 393 break; 394 default: 395 BUG(); 396 return 0; 397 } 398 break; 399 case CEXPR_NAMES: 400 if (sp == (CEXPR_MAXDEPTH-1)) 401 return 0; 402 c = scontext; 403 if (e->attr & CEXPR_TARGET) 404 c = tcontext; 405 else if (e->attr & CEXPR_XTARGET) { 406 c = xcontext; 407 if (!c) { 408 BUG(); 409 return 0; 410 } 411 } 412 if (e->attr & CEXPR_USER) 413 val1 = c->user; 414 else if (e->attr & CEXPR_ROLE) 415 val1 = c->role; 416 else if (e->attr & CEXPR_TYPE) 417 val1 = c->type; 418 else { 419 BUG(); 420 return 0; 421 } 422 423 switch (e->op) { 424 case CEXPR_EQ: 425 s[++sp] = ebitmap_get_bit(&e->names, val1 - 1); 426 break; 427 case CEXPR_NEQ: 428 s[++sp] = !ebitmap_get_bit(&e->names, val1 - 1); 429 break; 430 default: 431 BUG(); 432 return 0; 433 } 434 break; 435 default: 436 BUG(); 437 return 0; 438 } 439 } 440 441 BUG_ON(sp != 0); 442 return s[0]; 443 } 444 445 /* 446 * security_dump_masked_av - dumps masked permissions during 447 * security_compute_av due to RBAC, MLS/Constraint and Type bounds. 448 */ 449 static int dump_masked_av_helper(void *k, void *d, void *args) 450 { 451 struct perm_datum *pdatum = d; 452 char **permission_names = args; 453 454 BUG_ON(pdatum->value < 1 || pdatum->value > 32); 455 456 permission_names[pdatum->value - 1] = (char *)k; 457 458 return 0; 459 } 460 461 static void security_dump_masked_av(struct policydb *policydb, 462 struct context *scontext, 463 struct context *tcontext, 464 u16 tclass, 465 u32 permissions, 466 const char *reason) 467 { 468 struct common_datum *common_dat; 469 struct class_datum *tclass_dat; 470 struct audit_buffer *ab; 471 char *tclass_name; 472 char *scontext_name = NULL; 473 char *tcontext_name = NULL; 474 char *permission_names[32]; 475 int index; 476 u32 length; 477 bool need_comma = false; 478 479 if (!permissions) 480 return; 481 482 tclass_name = sym_name(policydb, SYM_CLASSES, tclass - 1); 483 tclass_dat = policydb->class_val_to_struct[tclass - 1]; 484 common_dat = tclass_dat->comdatum; 485 486 /* init permission_names */ 487 if (common_dat && 488 hashtab_map(&common_dat->permissions.table, 489 dump_masked_av_helper, permission_names) < 0) 490 goto out; 491 492 if (hashtab_map(&tclass_dat->permissions.table, 493 dump_masked_av_helper, permission_names) < 0) 494 goto out; 495 496 /* get scontext/tcontext in text form */ 497 if (context_struct_to_string(policydb, scontext, 498 &scontext_name, &length) < 0) 499 goto out; 500 501 if (context_struct_to_string(policydb, tcontext, 502 &tcontext_name, &length) < 0) 503 goto out; 504 505 /* audit a message */ 506 ab = audit_log_start(audit_context(), 507 GFP_ATOMIC, AUDIT_SELINUX_ERR); 508 if (!ab) 509 goto out; 510 511 audit_log_format(ab, "op=security_compute_av reason=%s " 512 "scontext=%s tcontext=%s tclass=%s perms=", 513 reason, scontext_name, tcontext_name, tclass_name); 514 515 for (index = 0; index < 32; index++) { 516 u32 mask = (1 << index); 517 518 if ((mask & permissions) == 0) 519 continue; 520 521 audit_log_format(ab, "%s%s", 522 need_comma ? "," : "", 523 permission_names[index] 524 ? permission_names[index] : "????"); 525 need_comma = true; 526 } 527 audit_log_end(ab); 528 out: 529 /* release scontext/tcontext */ 530 kfree(tcontext_name); 531 kfree(scontext_name); 532 533 return; 534 } 535 536 /* 537 * security_boundary_permission - drops violated permissions 538 * on boundary constraint. 539 */ 540 static void type_attribute_bounds_av(struct policydb *policydb, 541 struct context *scontext, 542 struct context *tcontext, 543 u16 tclass, 544 struct av_decision *avd) 545 { 546 struct context lo_scontext; 547 struct context lo_tcontext, *tcontextp = tcontext; 548 struct av_decision lo_avd; 549 struct type_datum *source; 550 struct type_datum *target; 551 u32 masked = 0; 552 553 source = policydb->type_val_to_struct[scontext->type - 1]; 554 BUG_ON(!source); 555 556 if (!source->bounds) 557 return; 558 559 target = policydb->type_val_to_struct[tcontext->type - 1]; 560 BUG_ON(!target); 561 562 memset(&lo_avd, 0, sizeof(lo_avd)); 563 564 memcpy(&lo_scontext, scontext, sizeof(lo_scontext)); 565 lo_scontext.type = source->bounds; 566 567 if (target->bounds) { 568 memcpy(&lo_tcontext, tcontext, sizeof(lo_tcontext)); 569 lo_tcontext.type = target->bounds; 570 tcontextp = &lo_tcontext; 571 } 572 573 context_struct_compute_av(policydb, &lo_scontext, 574 tcontextp, 575 tclass, 576 &lo_avd, 577 NULL); 578 579 masked = ~lo_avd.allowed & avd->allowed; 580 581 if (likely(!masked)) 582 return; /* no masked permission */ 583 584 /* mask violated permissions */ 585 avd->allowed &= ~masked; 586 587 /* audit masked permissions */ 588 security_dump_masked_av(policydb, scontext, tcontext, 589 tclass, masked, "bounds"); 590 } 591 592 /* 593 * flag which drivers have permissions 594 * only looking for ioctl based extended permssions 595 */ 596 void services_compute_xperms_drivers( 597 struct extended_perms *xperms, 598 struct avtab_node *node) 599 { 600 unsigned int i; 601 602 if (node->datum.u.xperms->specified == AVTAB_XPERMS_IOCTLDRIVER) { 603 /* if one or more driver has all permissions allowed */ 604 for (i = 0; i < ARRAY_SIZE(xperms->drivers.p); i++) 605 xperms->drivers.p[i] |= node->datum.u.xperms->perms.p[i]; 606 } else if (node->datum.u.xperms->specified == AVTAB_XPERMS_IOCTLFUNCTION) { 607 /* if allowing permissions within a driver */ 608 security_xperm_set(xperms->drivers.p, 609 node->datum.u.xperms->driver); 610 } 611 612 xperms->len = 1; 613 } 614 615 /* 616 * Compute access vectors and extended permissions based on a context 617 * structure pair for the permissions in a particular class. 618 */ 619 static void context_struct_compute_av(struct policydb *policydb, 620 struct context *scontext, 621 struct context *tcontext, 622 u16 tclass, 623 struct av_decision *avd, 624 struct extended_perms *xperms) 625 { 626 struct constraint_node *constraint; 627 struct role_allow *ra; 628 struct avtab_key avkey; 629 struct avtab_node *node; 630 struct class_datum *tclass_datum; 631 struct ebitmap *sattr, *tattr; 632 struct ebitmap_node *snode, *tnode; 633 unsigned int i, j; 634 635 avd->allowed = 0; 636 avd->auditallow = 0; 637 avd->auditdeny = 0xffffffff; 638 if (xperms) { 639 memset(&xperms->drivers, 0, sizeof(xperms->drivers)); 640 xperms->len = 0; 641 } 642 643 if (unlikely(!tclass || tclass > policydb->p_classes.nprim)) { 644 if (printk_ratelimit()) 645 pr_warn("SELinux: Invalid class %hu\n", tclass); 646 return; 647 } 648 649 tclass_datum = policydb->class_val_to_struct[tclass - 1]; 650 651 /* 652 * If a specific type enforcement rule was defined for 653 * this permission check, then use it. 654 */ 655 avkey.target_class = tclass; 656 avkey.specified = AVTAB_AV | AVTAB_XPERMS; 657 sattr = &policydb->type_attr_map_array[scontext->type - 1]; 658 tattr = &policydb->type_attr_map_array[tcontext->type - 1]; 659 ebitmap_for_each_positive_bit(sattr, snode, i) { 660 ebitmap_for_each_positive_bit(tattr, tnode, j) { 661 avkey.source_type = i + 1; 662 avkey.target_type = j + 1; 663 for (node = avtab_search_node(&policydb->te_avtab, 664 &avkey); 665 node; 666 node = avtab_search_node_next(node, avkey.specified)) { 667 if (node->key.specified == AVTAB_ALLOWED) 668 avd->allowed |= node->datum.u.data; 669 else if (node->key.specified == AVTAB_AUDITALLOW) 670 avd->auditallow |= node->datum.u.data; 671 else if (node->key.specified == AVTAB_AUDITDENY) 672 avd->auditdeny &= node->datum.u.data; 673 else if (xperms && (node->key.specified & AVTAB_XPERMS)) 674 services_compute_xperms_drivers(xperms, node); 675 } 676 677 /* Check conditional av table for additional permissions */ 678 cond_compute_av(&policydb->te_cond_avtab, &avkey, 679 avd, xperms); 680 681 } 682 } 683 684 /* 685 * Remove any permissions prohibited by a constraint (this includes 686 * the MLS policy). 687 */ 688 constraint = tclass_datum->constraints; 689 while (constraint) { 690 if ((constraint->permissions & (avd->allowed)) && 691 !constraint_expr_eval(policydb, scontext, tcontext, NULL, 692 constraint->expr)) { 693 avd->allowed &= ~(constraint->permissions); 694 } 695 constraint = constraint->next; 696 } 697 698 /* 699 * If checking process transition permission and the 700 * role is changing, then check the (current_role, new_role) 701 * pair. 702 */ 703 if (tclass == policydb->process_class && 704 (avd->allowed & policydb->process_trans_perms) && 705 scontext->role != tcontext->role) { 706 for (ra = policydb->role_allow; ra; ra = ra->next) { 707 if (scontext->role == ra->role && 708 tcontext->role == ra->new_role) 709 break; 710 } 711 if (!ra) 712 avd->allowed &= ~policydb->process_trans_perms; 713 } 714 715 /* 716 * If the given source and target types have boundary 717 * constraint, lazy checks have to mask any violated 718 * permission and notice it to userspace via audit. 719 */ 720 type_attribute_bounds_av(policydb, scontext, tcontext, 721 tclass, avd); 722 } 723 724 static int security_validtrans_handle_fail(struct selinux_state *state, 725 struct selinux_policy *policy, 726 struct sidtab_entry *oentry, 727 struct sidtab_entry *nentry, 728 struct sidtab_entry *tentry, 729 u16 tclass) 730 { 731 struct policydb *p = &policy->policydb; 732 struct sidtab *sidtab = policy->sidtab; 733 char *o = NULL, *n = NULL, *t = NULL; 734 u32 olen, nlen, tlen; 735 736 if (sidtab_entry_to_string(p, sidtab, oentry, &o, &olen)) 737 goto out; 738 if (sidtab_entry_to_string(p, sidtab, nentry, &n, &nlen)) 739 goto out; 740 if (sidtab_entry_to_string(p, sidtab, tentry, &t, &tlen)) 741 goto out; 742 audit_log(audit_context(), GFP_ATOMIC, AUDIT_SELINUX_ERR, 743 "op=security_validate_transition seresult=denied" 744 " oldcontext=%s newcontext=%s taskcontext=%s tclass=%s", 745 o, n, t, sym_name(p, SYM_CLASSES, tclass-1)); 746 out: 747 kfree(o); 748 kfree(n); 749 kfree(t); 750 751 if (!enforcing_enabled(state)) 752 return 0; 753 return -EPERM; 754 } 755 756 static int security_compute_validatetrans(struct selinux_state *state, 757 u32 oldsid, u32 newsid, u32 tasksid, 758 u16 orig_tclass, bool user) 759 { 760 struct selinux_policy *policy; 761 struct policydb *policydb; 762 struct sidtab *sidtab; 763 struct sidtab_entry *oentry; 764 struct sidtab_entry *nentry; 765 struct sidtab_entry *tentry; 766 struct class_datum *tclass_datum; 767 struct constraint_node *constraint; 768 u16 tclass; 769 int rc = 0; 770 771 772 if (!selinux_initialized(state)) 773 return 0; 774 775 rcu_read_lock(); 776 777 policy = rcu_dereference(state->policy); 778 policydb = &policy->policydb; 779 sidtab = policy->sidtab; 780 781 if (!user) 782 tclass = unmap_class(&policy->map, orig_tclass); 783 else 784 tclass = orig_tclass; 785 786 if (!tclass || tclass > policydb->p_classes.nprim) { 787 rc = -EINVAL; 788 goto out; 789 } 790 tclass_datum = policydb->class_val_to_struct[tclass - 1]; 791 792 oentry = sidtab_search_entry(sidtab, oldsid); 793 if (!oentry) { 794 pr_err("SELinux: %s: unrecognized SID %d\n", 795 __func__, oldsid); 796 rc = -EINVAL; 797 goto out; 798 } 799 800 nentry = sidtab_search_entry(sidtab, newsid); 801 if (!nentry) { 802 pr_err("SELinux: %s: unrecognized SID %d\n", 803 __func__, newsid); 804 rc = -EINVAL; 805 goto out; 806 } 807 808 tentry = sidtab_search_entry(sidtab, tasksid); 809 if (!tentry) { 810 pr_err("SELinux: %s: unrecognized SID %d\n", 811 __func__, tasksid); 812 rc = -EINVAL; 813 goto out; 814 } 815 816 constraint = tclass_datum->validatetrans; 817 while (constraint) { 818 if (!constraint_expr_eval(policydb, &oentry->context, 819 &nentry->context, &tentry->context, 820 constraint->expr)) { 821 if (user) 822 rc = -EPERM; 823 else 824 rc = security_validtrans_handle_fail(state, 825 policy, 826 oentry, 827 nentry, 828 tentry, 829 tclass); 830 goto out; 831 } 832 constraint = constraint->next; 833 } 834 835 out: 836 rcu_read_unlock(); 837 return rc; 838 } 839 840 int security_validate_transition_user(struct selinux_state *state, 841 u32 oldsid, u32 newsid, u32 tasksid, 842 u16 tclass) 843 { 844 return security_compute_validatetrans(state, oldsid, newsid, tasksid, 845 tclass, true); 846 } 847 848 int security_validate_transition(struct selinux_state *state, 849 u32 oldsid, u32 newsid, u32 tasksid, 850 u16 orig_tclass) 851 { 852 return security_compute_validatetrans(state, oldsid, newsid, tasksid, 853 orig_tclass, false); 854 } 855 856 /* 857 * security_bounded_transition - check whether the given 858 * transition is directed to bounded, or not. 859 * It returns 0, if @newsid is bounded by @oldsid. 860 * Otherwise, it returns error code. 861 * 862 * @state: SELinux state 863 * @oldsid : current security identifier 864 * @newsid : destinated security identifier 865 */ 866 int security_bounded_transition(struct selinux_state *state, 867 u32 old_sid, u32 new_sid) 868 { 869 struct selinux_policy *policy; 870 struct policydb *policydb; 871 struct sidtab *sidtab; 872 struct sidtab_entry *old_entry, *new_entry; 873 struct type_datum *type; 874 int index; 875 int rc; 876 877 if (!selinux_initialized(state)) 878 return 0; 879 880 rcu_read_lock(); 881 policy = rcu_dereference(state->policy); 882 policydb = &policy->policydb; 883 sidtab = policy->sidtab; 884 885 rc = -EINVAL; 886 old_entry = sidtab_search_entry(sidtab, old_sid); 887 if (!old_entry) { 888 pr_err("SELinux: %s: unrecognized SID %u\n", 889 __func__, old_sid); 890 goto out; 891 } 892 893 rc = -EINVAL; 894 new_entry = sidtab_search_entry(sidtab, new_sid); 895 if (!new_entry) { 896 pr_err("SELinux: %s: unrecognized SID %u\n", 897 __func__, new_sid); 898 goto out; 899 } 900 901 rc = 0; 902 /* type/domain unchanged */ 903 if (old_entry->context.type == new_entry->context.type) 904 goto out; 905 906 index = new_entry->context.type; 907 while (true) { 908 type = policydb->type_val_to_struct[index - 1]; 909 BUG_ON(!type); 910 911 /* not bounded anymore */ 912 rc = -EPERM; 913 if (!type->bounds) 914 break; 915 916 /* @newsid is bounded by @oldsid */ 917 rc = 0; 918 if (type->bounds == old_entry->context.type) 919 break; 920 921 index = type->bounds; 922 } 923 924 if (rc) { 925 char *old_name = NULL; 926 char *new_name = NULL; 927 u32 length; 928 929 if (!sidtab_entry_to_string(policydb, sidtab, old_entry, 930 &old_name, &length) && 931 !sidtab_entry_to_string(policydb, sidtab, new_entry, 932 &new_name, &length)) { 933 audit_log(audit_context(), 934 GFP_ATOMIC, AUDIT_SELINUX_ERR, 935 "op=security_bounded_transition " 936 "seresult=denied " 937 "oldcontext=%s newcontext=%s", 938 old_name, new_name); 939 } 940 kfree(new_name); 941 kfree(old_name); 942 } 943 out: 944 rcu_read_unlock(); 945 946 return rc; 947 } 948 949 static void avd_init(struct selinux_policy *policy, struct av_decision *avd) 950 { 951 avd->allowed = 0; 952 avd->auditallow = 0; 953 avd->auditdeny = 0xffffffff; 954 if (policy) 955 avd->seqno = policy->latest_granting; 956 else 957 avd->seqno = 0; 958 avd->flags = 0; 959 } 960 961 void services_compute_xperms_decision(struct extended_perms_decision *xpermd, 962 struct avtab_node *node) 963 { 964 unsigned int i; 965 966 if (node->datum.u.xperms->specified == AVTAB_XPERMS_IOCTLFUNCTION) { 967 if (xpermd->driver != node->datum.u.xperms->driver) 968 return; 969 } else if (node->datum.u.xperms->specified == AVTAB_XPERMS_IOCTLDRIVER) { 970 if (!security_xperm_test(node->datum.u.xperms->perms.p, 971 xpermd->driver)) 972 return; 973 } else { 974 BUG(); 975 } 976 977 if (node->key.specified == AVTAB_XPERMS_ALLOWED) { 978 xpermd->used |= XPERMS_ALLOWED; 979 if (node->datum.u.xperms->specified == AVTAB_XPERMS_IOCTLDRIVER) { 980 memset(xpermd->allowed->p, 0xff, 981 sizeof(xpermd->allowed->p)); 982 } 983 if (node->datum.u.xperms->specified == AVTAB_XPERMS_IOCTLFUNCTION) { 984 for (i = 0; i < ARRAY_SIZE(xpermd->allowed->p); i++) 985 xpermd->allowed->p[i] |= 986 node->datum.u.xperms->perms.p[i]; 987 } 988 } else if (node->key.specified == AVTAB_XPERMS_AUDITALLOW) { 989 xpermd->used |= XPERMS_AUDITALLOW; 990 if (node->datum.u.xperms->specified == AVTAB_XPERMS_IOCTLDRIVER) { 991 memset(xpermd->auditallow->p, 0xff, 992 sizeof(xpermd->auditallow->p)); 993 } 994 if (node->datum.u.xperms->specified == AVTAB_XPERMS_IOCTLFUNCTION) { 995 for (i = 0; i < ARRAY_SIZE(xpermd->auditallow->p); i++) 996 xpermd->auditallow->p[i] |= 997 node->datum.u.xperms->perms.p[i]; 998 } 999 } else if (node->key.specified == AVTAB_XPERMS_DONTAUDIT) { 1000 xpermd->used |= XPERMS_DONTAUDIT; 1001 if (node->datum.u.xperms->specified == AVTAB_XPERMS_IOCTLDRIVER) { 1002 memset(xpermd->dontaudit->p, 0xff, 1003 sizeof(xpermd->dontaudit->p)); 1004 } 1005 if (node->datum.u.xperms->specified == AVTAB_XPERMS_IOCTLFUNCTION) { 1006 for (i = 0; i < ARRAY_SIZE(xpermd->dontaudit->p); i++) 1007 xpermd->dontaudit->p[i] |= 1008 node->datum.u.xperms->perms.p[i]; 1009 } 1010 } else { 1011 BUG(); 1012 } 1013 } 1014 1015 void security_compute_xperms_decision(struct selinux_state *state, 1016 u32 ssid, 1017 u32 tsid, 1018 u16 orig_tclass, 1019 u8 driver, 1020 struct extended_perms_decision *xpermd) 1021 { 1022 struct selinux_policy *policy; 1023 struct policydb *policydb; 1024 struct sidtab *sidtab; 1025 u16 tclass; 1026 struct context *scontext, *tcontext; 1027 struct avtab_key avkey; 1028 struct avtab_node *node; 1029 struct ebitmap *sattr, *tattr; 1030 struct ebitmap_node *snode, *tnode; 1031 unsigned int i, j; 1032 1033 xpermd->driver = driver; 1034 xpermd->used = 0; 1035 memset(xpermd->allowed->p, 0, sizeof(xpermd->allowed->p)); 1036 memset(xpermd->auditallow->p, 0, sizeof(xpermd->auditallow->p)); 1037 memset(xpermd->dontaudit->p, 0, sizeof(xpermd->dontaudit->p)); 1038 1039 rcu_read_lock(); 1040 if (!selinux_initialized(state)) 1041 goto allow; 1042 1043 policy = rcu_dereference(state->policy); 1044 policydb = &policy->policydb; 1045 sidtab = policy->sidtab; 1046 1047 scontext = sidtab_search(sidtab, ssid); 1048 if (!scontext) { 1049 pr_err("SELinux: %s: unrecognized SID %d\n", 1050 __func__, ssid); 1051 goto out; 1052 } 1053 1054 tcontext = sidtab_search(sidtab, tsid); 1055 if (!tcontext) { 1056 pr_err("SELinux: %s: unrecognized SID %d\n", 1057 __func__, tsid); 1058 goto out; 1059 } 1060 1061 tclass = unmap_class(&policy->map, orig_tclass); 1062 if (unlikely(orig_tclass && !tclass)) { 1063 if (policydb->allow_unknown) 1064 goto allow; 1065 goto out; 1066 } 1067 1068 1069 if (unlikely(!tclass || tclass > policydb->p_classes.nprim)) { 1070 pr_warn_ratelimited("SELinux: Invalid class %hu\n", tclass); 1071 goto out; 1072 } 1073 1074 avkey.target_class = tclass; 1075 avkey.specified = AVTAB_XPERMS; 1076 sattr = &policydb->type_attr_map_array[scontext->type - 1]; 1077 tattr = &policydb->type_attr_map_array[tcontext->type - 1]; 1078 ebitmap_for_each_positive_bit(sattr, snode, i) { 1079 ebitmap_for_each_positive_bit(tattr, tnode, j) { 1080 avkey.source_type = i + 1; 1081 avkey.target_type = j + 1; 1082 for (node = avtab_search_node(&policydb->te_avtab, 1083 &avkey); 1084 node; 1085 node = avtab_search_node_next(node, avkey.specified)) 1086 services_compute_xperms_decision(xpermd, node); 1087 1088 cond_compute_xperms(&policydb->te_cond_avtab, 1089 &avkey, xpermd); 1090 } 1091 } 1092 out: 1093 rcu_read_unlock(); 1094 return; 1095 allow: 1096 memset(xpermd->allowed->p, 0xff, sizeof(xpermd->allowed->p)); 1097 goto out; 1098 } 1099 1100 /** 1101 * security_compute_av - Compute access vector decisions. 1102 * @state: SELinux state 1103 * @ssid: source security identifier 1104 * @tsid: target security identifier 1105 * @tclass: target security class 1106 * @avd: access vector decisions 1107 * @xperms: extended permissions 1108 * 1109 * Compute a set of access vector decisions based on the 1110 * SID pair (@ssid, @tsid) for the permissions in @tclass. 1111 */ 1112 void security_compute_av(struct selinux_state *state, 1113 u32 ssid, 1114 u32 tsid, 1115 u16 orig_tclass, 1116 struct av_decision *avd, 1117 struct extended_perms *xperms) 1118 { 1119 struct selinux_policy *policy; 1120 struct policydb *policydb; 1121 struct sidtab *sidtab; 1122 u16 tclass; 1123 struct context *scontext = NULL, *tcontext = NULL; 1124 1125 rcu_read_lock(); 1126 policy = rcu_dereference(state->policy); 1127 avd_init(policy, avd); 1128 xperms->len = 0; 1129 if (!selinux_initialized(state)) 1130 goto allow; 1131 1132 policydb = &policy->policydb; 1133 sidtab = policy->sidtab; 1134 1135 scontext = sidtab_search(sidtab, ssid); 1136 if (!scontext) { 1137 pr_err("SELinux: %s: unrecognized SID %d\n", 1138 __func__, ssid); 1139 goto out; 1140 } 1141 1142 /* permissive domain? */ 1143 if (ebitmap_get_bit(&policydb->permissive_map, scontext->type)) 1144 avd->flags |= AVD_FLAGS_PERMISSIVE; 1145 1146 tcontext = sidtab_search(sidtab, tsid); 1147 if (!tcontext) { 1148 pr_err("SELinux: %s: unrecognized SID %d\n", 1149 __func__, tsid); 1150 goto out; 1151 } 1152 1153 tclass = unmap_class(&policy->map, orig_tclass); 1154 if (unlikely(orig_tclass && !tclass)) { 1155 if (policydb->allow_unknown) 1156 goto allow; 1157 goto out; 1158 } 1159 context_struct_compute_av(policydb, scontext, tcontext, tclass, avd, 1160 xperms); 1161 map_decision(&policy->map, orig_tclass, avd, 1162 policydb->allow_unknown); 1163 out: 1164 rcu_read_unlock(); 1165 return; 1166 allow: 1167 avd->allowed = 0xffffffff; 1168 goto out; 1169 } 1170 1171 void security_compute_av_user(struct selinux_state *state, 1172 u32 ssid, 1173 u32 tsid, 1174 u16 tclass, 1175 struct av_decision *avd) 1176 { 1177 struct selinux_policy *policy; 1178 struct policydb *policydb; 1179 struct sidtab *sidtab; 1180 struct context *scontext = NULL, *tcontext = NULL; 1181 1182 rcu_read_lock(); 1183 policy = rcu_dereference(state->policy); 1184 avd_init(policy, avd); 1185 if (!selinux_initialized(state)) 1186 goto allow; 1187 1188 policydb = &policy->policydb; 1189 sidtab = policy->sidtab; 1190 1191 scontext = sidtab_search(sidtab, ssid); 1192 if (!scontext) { 1193 pr_err("SELinux: %s: unrecognized SID %d\n", 1194 __func__, ssid); 1195 goto out; 1196 } 1197 1198 /* permissive domain? */ 1199 if (ebitmap_get_bit(&policydb->permissive_map, scontext->type)) 1200 avd->flags |= AVD_FLAGS_PERMISSIVE; 1201 1202 tcontext = sidtab_search(sidtab, tsid); 1203 if (!tcontext) { 1204 pr_err("SELinux: %s: unrecognized SID %d\n", 1205 __func__, tsid); 1206 goto out; 1207 } 1208 1209 if (unlikely(!tclass)) { 1210 if (policydb->allow_unknown) 1211 goto allow; 1212 goto out; 1213 } 1214 1215 context_struct_compute_av(policydb, scontext, tcontext, tclass, avd, 1216 NULL); 1217 out: 1218 rcu_read_unlock(); 1219 return; 1220 allow: 1221 avd->allowed = 0xffffffff; 1222 goto out; 1223 } 1224 1225 /* 1226 * Write the security context string representation of 1227 * the context structure `context' into a dynamically 1228 * allocated string of the correct size. Set `*scontext' 1229 * to point to this string and set `*scontext_len' to 1230 * the length of the string. 1231 */ 1232 static int context_struct_to_string(struct policydb *p, 1233 struct context *context, 1234 char **scontext, u32 *scontext_len) 1235 { 1236 char *scontextp; 1237 1238 if (scontext) 1239 *scontext = NULL; 1240 *scontext_len = 0; 1241 1242 if (context->len) { 1243 *scontext_len = context->len; 1244 if (scontext) { 1245 *scontext = kstrdup(context->str, GFP_ATOMIC); 1246 if (!(*scontext)) 1247 return -ENOMEM; 1248 } 1249 return 0; 1250 } 1251 1252 /* Compute the size of the context. */ 1253 *scontext_len += strlen(sym_name(p, SYM_USERS, context->user - 1)) + 1; 1254 *scontext_len += strlen(sym_name(p, SYM_ROLES, context->role - 1)) + 1; 1255 *scontext_len += strlen(sym_name(p, SYM_TYPES, context->type - 1)) + 1; 1256 *scontext_len += mls_compute_context_len(p, context); 1257 1258 if (!scontext) 1259 return 0; 1260 1261 /* Allocate space for the context; caller must free this space. */ 1262 scontextp = kmalloc(*scontext_len, GFP_ATOMIC); 1263 if (!scontextp) 1264 return -ENOMEM; 1265 *scontext = scontextp; 1266 1267 /* 1268 * Copy the user name, role name and type name into the context. 1269 */ 1270 scontextp += sprintf(scontextp, "%s:%s:%s", 1271 sym_name(p, SYM_USERS, context->user - 1), 1272 sym_name(p, SYM_ROLES, context->role - 1), 1273 sym_name(p, SYM_TYPES, context->type - 1)); 1274 1275 mls_sid_to_context(p, context, &scontextp); 1276 1277 *scontextp = 0; 1278 1279 return 0; 1280 } 1281 1282 static int sidtab_entry_to_string(struct policydb *p, 1283 struct sidtab *sidtab, 1284 struct sidtab_entry *entry, 1285 char **scontext, u32 *scontext_len) 1286 { 1287 int rc = sidtab_sid2str_get(sidtab, entry, scontext, scontext_len); 1288 1289 if (rc != -ENOENT) 1290 return rc; 1291 1292 rc = context_struct_to_string(p, &entry->context, scontext, 1293 scontext_len); 1294 if (!rc && scontext) 1295 sidtab_sid2str_put(sidtab, entry, *scontext, *scontext_len); 1296 return rc; 1297 } 1298 1299 #include "initial_sid_to_string.h" 1300 1301 int security_sidtab_hash_stats(struct selinux_state *state, char *page) 1302 { 1303 struct selinux_policy *policy; 1304 int rc; 1305 1306 if (!selinux_initialized(state)) { 1307 pr_err("SELinux: %s: called before initial load_policy\n", 1308 __func__); 1309 return -EINVAL; 1310 } 1311 1312 rcu_read_lock(); 1313 policy = rcu_dereference(state->policy); 1314 rc = sidtab_hash_stats(policy->sidtab, page); 1315 rcu_read_unlock(); 1316 1317 return rc; 1318 } 1319 1320 const char *security_get_initial_sid_context(u32 sid) 1321 { 1322 if (unlikely(sid > SECINITSID_NUM)) 1323 return NULL; 1324 return initial_sid_to_string[sid]; 1325 } 1326 1327 static int security_sid_to_context_core(struct selinux_state *state, 1328 u32 sid, char **scontext, 1329 u32 *scontext_len, int force, 1330 int only_invalid) 1331 { 1332 struct selinux_policy *policy; 1333 struct policydb *policydb; 1334 struct sidtab *sidtab; 1335 struct sidtab_entry *entry; 1336 int rc = 0; 1337 1338 if (scontext) 1339 *scontext = NULL; 1340 *scontext_len = 0; 1341 1342 if (!selinux_initialized(state)) { 1343 if (sid <= SECINITSID_NUM) { 1344 char *scontextp; 1345 const char *s = initial_sid_to_string[sid]; 1346 1347 if (!s) 1348 return -EINVAL; 1349 *scontext_len = strlen(s) + 1; 1350 if (!scontext) 1351 return 0; 1352 scontextp = kmemdup(s, *scontext_len, GFP_ATOMIC); 1353 if (!scontextp) 1354 return -ENOMEM; 1355 *scontext = scontextp; 1356 return 0; 1357 } 1358 pr_err("SELinux: %s: called before initial " 1359 "load_policy on unknown SID %d\n", __func__, sid); 1360 return -EINVAL; 1361 } 1362 rcu_read_lock(); 1363 policy = rcu_dereference(state->policy); 1364 policydb = &policy->policydb; 1365 sidtab = policy->sidtab; 1366 1367 if (force) 1368 entry = sidtab_search_entry_force(sidtab, sid); 1369 else 1370 entry = sidtab_search_entry(sidtab, sid); 1371 if (!entry) { 1372 pr_err("SELinux: %s: unrecognized SID %d\n", 1373 __func__, sid); 1374 rc = -EINVAL; 1375 goto out_unlock; 1376 } 1377 if (only_invalid && !entry->context.len) 1378 goto out_unlock; 1379 1380 rc = sidtab_entry_to_string(policydb, sidtab, entry, scontext, 1381 scontext_len); 1382 1383 out_unlock: 1384 rcu_read_unlock(); 1385 return rc; 1386 1387 } 1388 1389 /** 1390 * security_sid_to_context - Obtain a context for a given SID. 1391 * @state: SELinux state 1392 * @sid: security identifier, SID 1393 * @scontext: security context 1394 * @scontext_len: length in bytes 1395 * 1396 * Write the string representation of the context associated with @sid 1397 * into a dynamically allocated string of the correct size. Set @scontext 1398 * to point to this string and set @scontext_len to the length of the string. 1399 */ 1400 int security_sid_to_context(struct selinux_state *state, 1401 u32 sid, char **scontext, u32 *scontext_len) 1402 { 1403 return security_sid_to_context_core(state, sid, scontext, 1404 scontext_len, 0, 0); 1405 } 1406 1407 int security_sid_to_context_force(struct selinux_state *state, u32 sid, 1408 char **scontext, u32 *scontext_len) 1409 { 1410 return security_sid_to_context_core(state, sid, scontext, 1411 scontext_len, 1, 0); 1412 } 1413 1414 /** 1415 * security_sid_to_context_inval - Obtain a context for a given SID if it 1416 * is invalid. 1417 * @state: SELinux state 1418 * @sid: security identifier, SID 1419 * @scontext: security context 1420 * @scontext_len: length in bytes 1421 * 1422 * Write the string representation of the context associated with @sid 1423 * into a dynamically allocated string of the correct size, but only if the 1424 * context is invalid in the current policy. Set @scontext to point to 1425 * this string (or NULL if the context is valid) and set @scontext_len to 1426 * the length of the string (or 0 if the context is valid). 1427 */ 1428 int security_sid_to_context_inval(struct selinux_state *state, u32 sid, 1429 char **scontext, u32 *scontext_len) 1430 { 1431 return security_sid_to_context_core(state, sid, scontext, 1432 scontext_len, 1, 1); 1433 } 1434 1435 /* 1436 * Caveat: Mutates scontext. 1437 */ 1438 static int string_to_context_struct(struct policydb *pol, 1439 struct sidtab *sidtabp, 1440 char *scontext, 1441 struct context *ctx, 1442 u32 def_sid) 1443 { 1444 struct role_datum *role; 1445 struct type_datum *typdatum; 1446 struct user_datum *usrdatum; 1447 char *scontextp, *p, oldc; 1448 int rc = 0; 1449 1450 context_init(ctx); 1451 1452 /* Parse the security context. */ 1453 1454 rc = -EINVAL; 1455 scontextp = (char *) scontext; 1456 1457 /* Extract the user. */ 1458 p = scontextp; 1459 while (*p && *p != ':') 1460 p++; 1461 1462 if (*p == 0) 1463 goto out; 1464 1465 *p++ = 0; 1466 1467 usrdatum = symtab_search(&pol->p_users, scontextp); 1468 if (!usrdatum) 1469 goto out; 1470 1471 ctx->user = usrdatum->value; 1472 1473 /* Extract role. */ 1474 scontextp = p; 1475 while (*p && *p != ':') 1476 p++; 1477 1478 if (*p == 0) 1479 goto out; 1480 1481 *p++ = 0; 1482 1483 role = symtab_search(&pol->p_roles, scontextp); 1484 if (!role) 1485 goto out; 1486 ctx->role = role->value; 1487 1488 /* Extract type. */ 1489 scontextp = p; 1490 while (*p && *p != ':') 1491 p++; 1492 oldc = *p; 1493 *p++ = 0; 1494 1495 typdatum = symtab_search(&pol->p_types, scontextp); 1496 if (!typdatum || typdatum->attribute) 1497 goto out; 1498 1499 ctx->type = typdatum->value; 1500 1501 rc = mls_context_to_sid(pol, oldc, p, ctx, sidtabp, def_sid); 1502 if (rc) 1503 goto out; 1504 1505 /* Check the validity of the new context. */ 1506 rc = -EINVAL; 1507 if (!policydb_context_isvalid(pol, ctx)) 1508 goto out; 1509 rc = 0; 1510 out: 1511 if (rc) 1512 context_destroy(ctx); 1513 return rc; 1514 } 1515 1516 static int security_context_to_sid_core(struct selinux_state *state, 1517 const char *scontext, u32 scontext_len, 1518 u32 *sid, u32 def_sid, gfp_t gfp_flags, 1519 int force) 1520 { 1521 struct selinux_policy *policy; 1522 struct policydb *policydb; 1523 struct sidtab *sidtab; 1524 char *scontext2, *str = NULL; 1525 struct context context; 1526 int rc = 0; 1527 1528 /* An empty security context is never valid. */ 1529 if (!scontext_len) 1530 return -EINVAL; 1531 1532 /* Copy the string to allow changes and ensure a NUL terminator */ 1533 scontext2 = kmemdup_nul(scontext, scontext_len, gfp_flags); 1534 if (!scontext2) 1535 return -ENOMEM; 1536 1537 if (!selinux_initialized(state)) { 1538 int i; 1539 1540 for (i = 1; i < SECINITSID_NUM; i++) { 1541 const char *s = initial_sid_to_string[i]; 1542 1543 if (s && !strcmp(s, scontext2)) { 1544 *sid = i; 1545 goto out; 1546 } 1547 } 1548 *sid = SECINITSID_KERNEL; 1549 goto out; 1550 } 1551 *sid = SECSID_NULL; 1552 1553 if (force) { 1554 /* Save another copy for storing in uninterpreted form */ 1555 rc = -ENOMEM; 1556 str = kstrdup(scontext2, gfp_flags); 1557 if (!str) 1558 goto out; 1559 } 1560 retry: 1561 rcu_read_lock(); 1562 policy = rcu_dereference(state->policy); 1563 policydb = &policy->policydb; 1564 sidtab = policy->sidtab; 1565 rc = string_to_context_struct(policydb, sidtab, scontext2, 1566 &context, def_sid); 1567 if (rc == -EINVAL && force) { 1568 context.str = str; 1569 context.len = strlen(str) + 1; 1570 str = NULL; 1571 } else if (rc) 1572 goto out_unlock; 1573 rc = sidtab_context_to_sid(sidtab, &context, sid); 1574 if (rc == -ESTALE) { 1575 rcu_read_unlock(); 1576 if (context.str) { 1577 str = context.str; 1578 context.str = NULL; 1579 } 1580 context_destroy(&context); 1581 goto retry; 1582 } 1583 context_destroy(&context); 1584 out_unlock: 1585 rcu_read_unlock(); 1586 out: 1587 kfree(scontext2); 1588 kfree(str); 1589 return rc; 1590 } 1591 1592 /** 1593 * security_context_to_sid - Obtain a SID for a given security context. 1594 * @state: SELinux state 1595 * @scontext: security context 1596 * @scontext_len: length in bytes 1597 * @sid: security identifier, SID 1598 * @gfp: context for the allocation 1599 * 1600 * Obtains a SID associated with the security context that 1601 * has the string representation specified by @scontext. 1602 * Returns -%EINVAL if the context is invalid, -%ENOMEM if insufficient 1603 * memory is available, or 0 on success. 1604 */ 1605 int security_context_to_sid(struct selinux_state *state, 1606 const char *scontext, u32 scontext_len, u32 *sid, 1607 gfp_t gfp) 1608 { 1609 return security_context_to_sid_core(state, scontext, scontext_len, 1610 sid, SECSID_NULL, gfp, 0); 1611 } 1612 1613 int security_context_str_to_sid(struct selinux_state *state, 1614 const char *scontext, u32 *sid, gfp_t gfp) 1615 { 1616 return security_context_to_sid(state, scontext, strlen(scontext), 1617 sid, gfp); 1618 } 1619 1620 /** 1621 * security_context_to_sid_default - Obtain a SID for a given security context, 1622 * falling back to specified default if needed. 1623 * 1624 * @state: SELinux state 1625 * @scontext: security context 1626 * @scontext_len: length in bytes 1627 * @sid: security identifier, SID 1628 * @def_sid: default SID to assign on error 1629 * 1630 * Obtains a SID associated with the security context that 1631 * has the string representation specified by @scontext. 1632 * The default SID is passed to the MLS layer to be used to allow 1633 * kernel labeling of the MLS field if the MLS field is not present 1634 * (for upgrading to MLS without full relabel). 1635 * Implicitly forces adding of the context even if it cannot be mapped yet. 1636 * Returns -%EINVAL if the context is invalid, -%ENOMEM if insufficient 1637 * memory is available, or 0 on success. 1638 */ 1639 int security_context_to_sid_default(struct selinux_state *state, 1640 const char *scontext, u32 scontext_len, 1641 u32 *sid, u32 def_sid, gfp_t gfp_flags) 1642 { 1643 return security_context_to_sid_core(state, scontext, scontext_len, 1644 sid, def_sid, gfp_flags, 1); 1645 } 1646 1647 int security_context_to_sid_force(struct selinux_state *state, 1648 const char *scontext, u32 scontext_len, 1649 u32 *sid) 1650 { 1651 return security_context_to_sid_core(state, scontext, scontext_len, 1652 sid, SECSID_NULL, GFP_KERNEL, 1); 1653 } 1654 1655 static int compute_sid_handle_invalid_context( 1656 struct selinux_state *state, 1657 struct selinux_policy *policy, 1658 struct sidtab_entry *sentry, 1659 struct sidtab_entry *tentry, 1660 u16 tclass, 1661 struct context *newcontext) 1662 { 1663 struct policydb *policydb = &policy->policydb; 1664 struct sidtab *sidtab = policy->sidtab; 1665 char *s = NULL, *t = NULL, *n = NULL; 1666 u32 slen, tlen, nlen; 1667 struct audit_buffer *ab; 1668 1669 if (sidtab_entry_to_string(policydb, sidtab, sentry, &s, &slen)) 1670 goto out; 1671 if (sidtab_entry_to_string(policydb, sidtab, tentry, &t, &tlen)) 1672 goto out; 1673 if (context_struct_to_string(policydb, newcontext, &n, &nlen)) 1674 goto out; 1675 ab = audit_log_start(audit_context(), GFP_ATOMIC, AUDIT_SELINUX_ERR); 1676 audit_log_format(ab, 1677 "op=security_compute_sid invalid_context="); 1678 /* no need to record the NUL with untrusted strings */ 1679 audit_log_n_untrustedstring(ab, n, nlen - 1); 1680 audit_log_format(ab, " scontext=%s tcontext=%s tclass=%s", 1681 s, t, sym_name(policydb, SYM_CLASSES, tclass-1)); 1682 audit_log_end(ab); 1683 out: 1684 kfree(s); 1685 kfree(t); 1686 kfree(n); 1687 if (!enforcing_enabled(state)) 1688 return 0; 1689 return -EACCES; 1690 } 1691 1692 static void filename_compute_type(struct policydb *policydb, 1693 struct context *newcontext, 1694 u32 stype, u32 ttype, u16 tclass, 1695 const char *objname) 1696 { 1697 struct filename_trans_key ft; 1698 struct filename_trans_datum *datum; 1699 1700 /* 1701 * Most filename trans rules are going to live in specific directories 1702 * like /dev or /var/run. This bitmap will quickly skip rule searches 1703 * if the ttype does not contain any rules. 1704 */ 1705 if (!ebitmap_get_bit(&policydb->filename_trans_ttypes, ttype)) 1706 return; 1707 1708 ft.ttype = ttype; 1709 ft.tclass = tclass; 1710 ft.name = objname; 1711 1712 datum = policydb_filenametr_search(policydb, &ft); 1713 while (datum) { 1714 if (ebitmap_get_bit(&datum->stypes, stype - 1)) { 1715 newcontext->type = datum->otype; 1716 return; 1717 } 1718 datum = datum->next; 1719 } 1720 } 1721 1722 static int security_compute_sid(struct selinux_state *state, 1723 u32 ssid, 1724 u32 tsid, 1725 u16 orig_tclass, 1726 u32 specified, 1727 const char *objname, 1728 u32 *out_sid, 1729 bool kern) 1730 { 1731 struct selinux_policy *policy; 1732 struct policydb *policydb; 1733 struct sidtab *sidtab; 1734 struct class_datum *cladatum; 1735 struct context *scontext, *tcontext, newcontext; 1736 struct sidtab_entry *sentry, *tentry; 1737 struct avtab_key avkey; 1738 struct avtab_datum *avdatum; 1739 struct avtab_node *node; 1740 u16 tclass; 1741 int rc = 0; 1742 bool sock; 1743 1744 if (!selinux_initialized(state)) { 1745 switch (orig_tclass) { 1746 case SECCLASS_PROCESS: /* kernel value */ 1747 *out_sid = ssid; 1748 break; 1749 default: 1750 *out_sid = tsid; 1751 break; 1752 } 1753 goto out; 1754 } 1755 1756 retry: 1757 cladatum = NULL; 1758 context_init(&newcontext); 1759 1760 rcu_read_lock(); 1761 1762 policy = rcu_dereference(state->policy); 1763 1764 if (kern) { 1765 tclass = unmap_class(&policy->map, orig_tclass); 1766 sock = security_is_socket_class(orig_tclass); 1767 } else { 1768 tclass = orig_tclass; 1769 sock = security_is_socket_class(map_class(&policy->map, 1770 tclass)); 1771 } 1772 1773 policydb = &policy->policydb; 1774 sidtab = policy->sidtab; 1775 1776 sentry = sidtab_search_entry(sidtab, ssid); 1777 if (!sentry) { 1778 pr_err("SELinux: %s: unrecognized SID %d\n", 1779 __func__, ssid); 1780 rc = -EINVAL; 1781 goto out_unlock; 1782 } 1783 tentry = sidtab_search_entry(sidtab, tsid); 1784 if (!tentry) { 1785 pr_err("SELinux: %s: unrecognized SID %d\n", 1786 __func__, tsid); 1787 rc = -EINVAL; 1788 goto out_unlock; 1789 } 1790 1791 scontext = &sentry->context; 1792 tcontext = &tentry->context; 1793 1794 if (tclass && tclass <= policydb->p_classes.nprim) 1795 cladatum = policydb->class_val_to_struct[tclass - 1]; 1796 1797 /* Set the user identity. */ 1798 switch (specified) { 1799 case AVTAB_TRANSITION: 1800 case AVTAB_CHANGE: 1801 if (cladatum && cladatum->default_user == DEFAULT_TARGET) { 1802 newcontext.user = tcontext->user; 1803 } else { 1804 /* notice this gets both DEFAULT_SOURCE and unset */ 1805 /* Use the process user identity. */ 1806 newcontext.user = scontext->user; 1807 } 1808 break; 1809 case AVTAB_MEMBER: 1810 /* Use the related object owner. */ 1811 newcontext.user = tcontext->user; 1812 break; 1813 } 1814 1815 /* Set the role to default values. */ 1816 if (cladatum && cladatum->default_role == DEFAULT_SOURCE) { 1817 newcontext.role = scontext->role; 1818 } else if (cladatum && cladatum->default_role == DEFAULT_TARGET) { 1819 newcontext.role = tcontext->role; 1820 } else { 1821 if ((tclass == policydb->process_class) || sock) 1822 newcontext.role = scontext->role; 1823 else 1824 newcontext.role = OBJECT_R_VAL; 1825 } 1826 1827 /* Set the type to default values. */ 1828 if (cladatum && cladatum->default_type == DEFAULT_SOURCE) { 1829 newcontext.type = scontext->type; 1830 } else if (cladatum && cladatum->default_type == DEFAULT_TARGET) { 1831 newcontext.type = tcontext->type; 1832 } else { 1833 if ((tclass == policydb->process_class) || sock) { 1834 /* Use the type of process. */ 1835 newcontext.type = scontext->type; 1836 } else { 1837 /* Use the type of the related object. */ 1838 newcontext.type = tcontext->type; 1839 } 1840 } 1841 1842 /* Look for a type transition/member/change rule. */ 1843 avkey.source_type = scontext->type; 1844 avkey.target_type = tcontext->type; 1845 avkey.target_class = tclass; 1846 avkey.specified = specified; 1847 avdatum = avtab_search(&policydb->te_avtab, &avkey); 1848 1849 /* If no permanent rule, also check for enabled conditional rules */ 1850 if (!avdatum) { 1851 node = avtab_search_node(&policydb->te_cond_avtab, &avkey); 1852 for (; node; node = avtab_search_node_next(node, specified)) { 1853 if (node->key.specified & AVTAB_ENABLED) { 1854 avdatum = &node->datum; 1855 break; 1856 } 1857 } 1858 } 1859 1860 if (avdatum) { 1861 /* Use the type from the type transition/member/change rule. */ 1862 newcontext.type = avdatum->u.data; 1863 } 1864 1865 /* if we have a objname this is a file trans check so check those rules */ 1866 if (objname) 1867 filename_compute_type(policydb, &newcontext, scontext->type, 1868 tcontext->type, tclass, objname); 1869 1870 /* Check for class-specific changes. */ 1871 if (specified & AVTAB_TRANSITION) { 1872 /* Look for a role transition rule. */ 1873 struct role_trans_datum *rtd; 1874 struct role_trans_key rtk = { 1875 .role = scontext->role, 1876 .type = tcontext->type, 1877 .tclass = tclass, 1878 }; 1879 1880 rtd = policydb_roletr_search(policydb, &rtk); 1881 if (rtd) 1882 newcontext.role = rtd->new_role; 1883 } 1884 1885 /* Set the MLS attributes. 1886 This is done last because it may allocate memory. */ 1887 rc = mls_compute_sid(policydb, scontext, tcontext, tclass, specified, 1888 &newcontext, sock); 1889 if (rc) 1890 goto out_unlock; 1891 1892 /* Check the validity of the context. */ 1893 if (!policydb_context_isvalid(policydb, &newcontext)) { 1894 rc = compute_sid_handle_invalid_context(state, policy, sentry, 1895 tentry, tclass, 1896 &newcontext); 1897 if (rc) 1898 goto out_unlock; 1899 } 1900 /* Obtain the sid for the context. */ 1901 rc = sidtab_context_to_sid(sidtab, &newcontext, out_sid); 1902 if (rc == -ESTALE) { 1903 rcu_read_unlock(); 1904 context_destroy(&newcontext); 1905 goto retry; 1906 } 1907 out_unlock: 1908 rcu_read_unlock(); 1909 context_destroy(&newcontext); 1910 out: 1911 return rc; 1912 } 1913 1914 /** 1915 * security_transition_sid - Compute the SID for a new subject/object. 1916 * @state: SELinux state 1917 * @ssid: source security identifier 1918 * @tsid: target security identifier 1919 * @tclass: target security class 1920 * @out_sid: security identifier for new subject/object 1921 * 1922 * Compute a SID to use for labeling a new subject or object in the 1923 * class @tclass based on a SID pair (@ssid, @tsid). 1924 * Return -%EINVAL if any of the parameters are invalid, -%ENOMEM 1925 * if insufficient memory is available, or %0 if the new SID was 1926 * computed successfully. 1927 */ 1928 int security_transition_sid(struct selinux_state *state, 1929 u32 ssid, u32 tsid, u16 tclass, 1930 const struct qstr *qstr, u32 *out_sid) 1931 { 1932 return security_compute_sid(state, ssid, tsid, tclass, 1933 AVTAB_TRANSITION, 1934 qstr ? qstr->name : NULL, out_sid, true); 1935 } 1936 1937 int security_transition_sid_user(struct selinux_state *state, 1938 u32 ssid, u32 tsid, u16 tclass, 1939 const char *objname, u32 *out_sid) 1940 { 1941 return security_compute_sid(state, ssid, tsid, tclass, 1942 AVTAB_TRANSITION, 1943 objname, out_sid, false); 1944 } 1945 1946 /** 1947 * security_member_sid - Compute the SID for member selection. 1948 * @ssid: source security identifier 1949 * @tsid: target security identifier 1950 * @tclass: target security class 1951 * @out_sid: security identifier for selected member 1952 * 1953 * Compute a SID to use when selecting a member of a polyinstantiated 1954 * object of class @tclass based on a SID pair (@ssid, @tsid). 1955 * Return -%EINVAL if any of the parameters are invalid, -%ENOMEM 1956 * if insufficient memory is available, or %0 if the SID was 1957 * computed successfully. 1958 */ 1959 int security_member_sid(struct selinux_state *state, 1960 u32 ssid, 1961 u32 tsid, 1962 u16 tclass, 1963 u32 *out_sid) 1964 { 1965 return security_compute_sid(state, ssid, tsid, tclass, 1966 AVTAB_MEMBER, NULL, 1967 out_sid, false); 1968 } 1969 1970 /** 1971 * security_change_sid - Compute the SID for object relabeling. 1972 * @state: SELinux state 1973 * @ssid: source security identifier 1974 * @tsid: target security identifier 1975 * @tclass: target security class 1976 * @out_sid: security identifier for selected member 1977 * 1978 * Compute a SID to use for relabeling an object of class @tclass 1979 * based on a SID pair (@ssid, @tsid). 1980 * Return -%EINVAL if any of the parameters are invalid, -%ENOMEM 1981 * if insufficient memory is available, or %0 if the SID was 1982 * computed successfully. 1983 */ 1984 int security_change_sid(struct selinux_state *state, 1985 u32 ssid, 1986 u32 tsid, 1987 u16 tclass, 1988 u32 *out_sid) 1989 { 1990 return security_compute_sid(state, 1991 ssid, tsid, tclass, AVTAB_CHANGE, NULL, 1992 out_sid, false); 1993 } 1994 1995 static inline int convert_context_handle_invalid_context( 1996 struct selinux_state *state, 1997 struct policydb *policydb, 1998 struct context *context) 1999 { 2000 char *s; 2001 u32 len; 2002 2003 if (enforcing_enabled(state)) 2004 return -EINVAL; 2005 2006 if (!context_struct_to_string(policydb, context, &s, &len)) { 2007 pr_warn("SELinux: Context %s would be invalid if enforcing\n", 2008 s); 2009 kfree(s); 2010 } 2011 return 0; 2012 } 2013 2014 /* 2015 * Convert the values in the security context 2016 * structure `oldc' from the values specified 2017 * in the policy `p->oldp' to the values specified 2018 * in the policy `p->newp', storing the new context 2019 * in `newc'. Verify that the context is valid 2020 * under the new policy. 2021 */ 2022 static int convert_context(struct context *oldc, struct context *newc, void *p) 2023 { 2024 struct convert_context_args *args; 2025 struct ocontext *oc; 2026 struct role_datum *role; 2027 struct type_datum *typdatum; 2028 struct user_datum *usrdatum; 2029 char *s; 2030 u32 len; 2031 int rc; 2032 2033 args = p; 2034 2035 if (oldc->str) { 2036 s = kstrdup(oldc->str, GFP_KERNEL); 2037 if (!s) 2038 return -ENOMEM; 2039 2040 rc = string_to_context_struct(args->newp, NULL, s, 2041 newc, SECSID_NULL); 2042 if (rc == -EINVAL) { 2043 /* 2044 * Retain string representation for later mapping. 2045 * 2046 * IMPORTANT: We need to copy the contents of oldc->str 2047 * back into s again because string_to_context_struct() 2048 * may have garbled it. 2049 */ 2050 memcpy(s, oldc->str, oldc->len); 2051 context_init(newc); 2052 newc->str = s; 2053 newc->len = oldc->len; 2054 return 0; 2055 } 2056 kfree(s); 2057 if (rc) { 2058 /* Other error condition, e.g. ENOMEM. */ 2059 pr_err("SELinux: Unable to map context %s, rc = %d.\n", 2060 oldc->str, -rc); 2061 return rc; 2062 } 2063 pr_info("SELinux: Context %s became valid (mapped).\n", 2064 oldc->str); 2065 return 0; 2066 } 2067 2068 context_init(newc); 2069 2070 /* Convert the user. */ 2071 usrdatum = symtab_search(&args->newp->p_users, 2072 sym_name(args->oldp, 2073 SYM_USERS, oldc->user - 1)); 2074 if (!usrdatum) 2075 goto bad; 2076 newc->user = usrdatum->value; 2077 2078 /* Convert the role. */ 2079 role = symtab_search(&args->newp->p_roles, 2080 sym_name(args->oldp, SYM_ROLES, oldc->role - 1)); 2081 if (!role) 2082 goto bad; 2083 newc->role = role->value; 2084 2085 /* Convert the type. */ 2086 typdatum = symtab_search(&args->newp->p_types, 2087 sym_name(args->oldp, 2088 SYM_TYPES, oldc->type - 1)); 2089 if (!typdatum) 2090 goto bad; 2091 newc->type = typdatum->value; 2092 2093 /* Convert the MLS fields if dealing with MLS policies */ 2094 if (args->oldp->mls_enabled && args->newp->mls_enabled) { 2095 rc = mls_convert_context(args->oldp, args->newp, oldc, newc); 2096 if (rc) 2097 goto bad; 2098 } else if (!args->oldp->mls_enabled && args->newp->mls_enabled) { 2099 /* 2100 * Switching between non-MLS and MLS policy: 2101 * ensure that the MLS fields of the context for all 2102 * existing entries in the sidtab are filled in with a 2103 * suitable default value, likely taken from one of the 2104 * initial SIDs. 2105 */ 2106 oc = args->newp->ocontexts[OCON_ISID]; 2107 while (oc && oc->sid[0] != SECINITSID_UNLABELED) 2108 oc = oc->next; 2109 if (!oc) { 2110 pr_err("SELinux: unable to look up" 2111 " the initial SIDs list\n"); 2112 goto bad; 2113 } 2114 rc = mls_range_set(newc, &oc->context[0].range); 2115 if (rc) 2116 goto bad; 2117 } 2118 2119 /* Check the validity of the new context. */ 2120 if (!policydb_context_isvalid(args->newp, newc)) { 2121 rc = convert_context_handle_invalid_context(args->state, 2122 args->oldp, 2123 oldc); 2124 if (rc) 2125 goto bad; 2126 } 2127 2128 return 0; 2129 bad: 2130 /* Map old representation to string and save it. */ 2131 rc = context_struct_to_string(args->oldp, oldc, &s, &len); 2132 if (rc) 2133 return rc; 2134 context_destroy(newc); 2135 newc->str = s; 2136 newc->len = len; 2137 pr_info("SELinux: Context %s became invalid (unmapped).\n", 2138 newc->str); 2139 return 0; 2140 } 2141 2142 static void security_load_policycaps(struct selinux_state *state, 2143 struct selinux_policy *policy) 2144 { 2145 struct policydb *p; 2146 unsigned int i; 2147 struct ebitmap_node *node; 2148 2149 p = &policy->policydb; 2150 2151 for (i = 0; i < ARRAY_SIZE(state->policycap); i++) 2152 WRITE_ONCE(state->policycap[i], 2153 ebitmap_get_bit(&p->policycaps, i)); 2154 2155 for (i = 0; i < ARRAY_SIZE(selinux_policycap_names); i++) 2156 pr_info("SELinux: policy capability %s=%d\n", 2157 selinux_policycap_names[i], 2158 ebitmap_get_bit(&p->policycaps, i)); 2159 2160 ebitmap_for_each_positive_bit(&p->policycaps, node, i) { 2161 if (i >= ARRAY_SIZE(selinux_policycap_names)) 2162 pr_info("SELinux: unknown policy capability %u\n", 2163 i); 2164 } 2165 } 2166 2167 static int security_preserve_bools(struct selinux_policy *oldpolicy, 2168 struct selinux_policy *newpolicy); 2169 2170 static void selinux_policy_free(struct selinux_policy *policy) 2171 { 2172 if (!policy) 2173 return; 2174 2175 sidtab_destroy(policy->sidtab); 2176 kfree(policy->map.mapping); 2177 policydb_destroy(&policy->policydb); 2178 kfree(policy->sidtab); 2179 kfree(policy); 2180 } 2181 2182 static void selinux_policy_cond_free(struct selinux_policy *policy) 2183 { 2184 cond_policydb_destroy_dup(&policy->policydb); 2185 kfree(policy); 2186 } 2187 2188 void selinux_policy_cancel(struct selinux_state *state, 2189 struct selinux_load_state *load_state) 2190 { 2191 struct selinux_policy *oldpolicy; 2192 2193 oldpolicy = rcu_dereference_protected(state->policy, 2194 lockdep_is_held(&state->policy_mutex)); 2195 2196 sidtab_cancel_convert(oldpolicy->sidtab); 2197 selinux_policy_free(load_state->policy); 2198 kfree(load_state->convert_data); 2199 } 2200 2201 static void selinux_notify_policy_change(struct selinux_state *state, 2202 u32 seqno) 2203 { 2204 /* Flush external caches and notify userspace of policy load */ 2205 avc_ss_reset(state->avc, seqno); 2206 selnl_notify_policyload(seqno); 2207 selinux_status_update_policyload(state, seqno); 2208 selinux_netlbl_cache_invalidate(); 2209 selinux_xfrm_notify_policyload(); 2210 selinux_ima_measure_state_locked(state); 2211 } 2212 2213 void selinux_policy_commit(struct selinux_state *state, 2214 struct selinux_load_state *load_state) 2215 { 2216 struct selinux_policy *oldpolicy, *newpolicy = load_state->policy; 2217 unsigned long flags; 2218 u32 seqno; 2219 2220 oldpolicy = rcu_dereference_protected(state->policy, 2221 lockdep_is_held(&state->policy_mutex)); 2222 2223 /* If switching between different policy types, log MLS status */ 2224 if (oldpolicy) { 2225 if (oldpolicy->policydb.mls_enabled && !newpolicy->policydb.mls_enabled) 2226 pr_info("SELinux: Disabling MLS support...\n"); 2227 else if (!oldpolicy->policydb.mls_enabled && newpolicy->policydb.mls_enabled) 2228 pr_info("SELinux: Enabling MLS support...\n"); 2229 } 2230 2231 /* Set latest granting seqno for new policy. */ 2232 if (oldpolicy) 2233 newpolicy->latest_granting = oldpolicy->latest_granting + 1; 2234 else 2235 newpolicy->latest_granting = 1; 2236 seqno = newpolicy->latest_granting; 2237 2238 /* Install the new policy. */ 2239 if (oldpolicy) { 2240 sidtab_freeze_begin(oldpolicy->sidtab, &flags); 2241 rcu_assign_pointer(state->policy, newpolicy); 2242 sidtab_freeze_end(oldpolicy->sidtab, &flags); 2243 } else { 2244 rcu_assign_pointer(state->policy, newpolicy); 2245 } 2246 2247 /* Load the policycaps from the new policy */ 2248 security_load_policycaps(state, newpolicy); 2249 2250 if (!selinux_initialized(state)) { 2251 /* 2252 * After first policy load, the security server is 2253 * marked as initialized and ready to handle requests and 2254 * any objects created prior to policy load are then labeled. 2255 */ 2256 selinux_mark_initialized(state); 2257 selinux_complete_init(); 2258 } 2259 2260 /* Free the old policy */ 2261 synchronize_rcu(); 2262 selinux_policy_free(oldpolicy); 2263 kfree(load_state->convert_data); 2264 2265 /* Notify others of the policy change */ 2266 selinux_notify_policy_change(state, seqno); 2267 } 2268 2269 /** 2270 * security_load_policy - Load a security policy configuration. 2271 * @state: SELinux state 2272 * @data: binary policy data 2273 * @len: length of data in bytes 2274 * 2275 * Load a new set of security policy configuration data, 2276 * validate it and convert the SID table as necessary. 2277 * This function will flush the access vector cache after 2278 * loading the new policy. 2279 */ 2280 int security_load_policy(struct selinux_state *state, void *data, size_t len, 2281 struct selinux_load_state *load_state) 2282 { 2283 struct selinux_policy *newpolicy, *oldpolicy; 2284 struct selinux_policy_convert_data *convert_data; 2285 int rc = 0; 2286 struct policy_file file = { data, len }, *fp = &file; 2287 2288 newpolicy = kzalloc(sizeof(*newpolicy), GFP_KERNEL); 2289 if (!newpolicy) 2290 return -ENOMEM; 2291 2292 newpolicy->sidtab = kzalloc(sizeof(*newpolicy->sidtab), GFP_KERNEL); 2293 if (!newpolicy->sidtab) { 2294 rc = -ENOMEM; 2295 goto err_policy; 2296 } 2297 2298 rc = policydb_read(&newpolicy->policydb, fp); 2299 if (rc) 2300 goto err_sidtab; 2301 2302 newpolicy->policydb.len = len; 2303 rc = selinux_set_mapping(&newpolicy->policydb, secclass_map, 2304 &newpolicy->map); 2305 if (rc) 2306 goto err_policydb; 2307 2308 rc = policydb_load_isids(&newpolicy->policydb, newpolicy->sidtab); 2309 if (rc) { 2310 pr_err("SELinux: unable to load the initial SIDs\n"); 2311 goto err_mapping; 2312 } 2313 2314 if (!selinux_initialized(state)) { 2315 /* First policy load, so no need to preserve state from old policy */ 2316 load_state->policy = newpolicy; 2317 load_state->convert_data = NULL; 2318 return 0; 2319 } 2320 2321 oldpolicy = rcu_dereference_protected(state->policy, 2322 lockdep_is_held(&state->policy_mutex)); 2323 2324 /* Preserve active boolean values from the old policy */ 2325 rc = security_preserve_bools(oldpolicy, newpolicy); 2326 if (rc) { 2327 pr_err("SELinux: unable to preserve booleans\n"); 2328 goto err_free_isids; 2329 } 2330 2331 convert_data = kmalloc(sizeof(*convert_data), GFP_KERNEL); 2332 if (!convert_data) { 2333 rc = -ENOMEM; 2334 goto err_free_isids; 2335 } 2336 2337 /* 2338 * Convert the internal representations of contexts 2339 * in the new SID table. 2340 */ 2341 convert_data->args.state = state; 2342 convert_data->args.oldp = &oldpolicy->policydb; 2343 convert_data->args.newp = &newpolicy->policydb; 2344 2345 convert_data->sidtab_params.func = convert_context; 2346 convert_data->sidtab_params.args = &convert_data->args; 2347 convert_data->sidtab_params.target = newpolicy->sidtab; 2348 2349 rc = sidtab_convert(oldpolicy->sidtab, &convert_data->sidtab_params); 2350 if (rc) { 2351 pr_err("SELinux: unable to convert the internal" 2352 " representation of contexts in the new SID" 2353 " table\n"); 2354 goto err_free_convert_data; 2355 } 2356 2357 load_state->policy = newpolicy; 2358 load_state->convert_data = convert_data; 2359 return 0; 2360 2361 err_free_convert_data: 2362 kfree(convert_data); 2363 err_free_isids: 2364 sidtab_destroy(newpolicy->sidtab); 2365 err_mapping: 2366 kfree(newpolicy->map.mapping); 2367 err_policydb: 2368 policydb_destroy(&newpolicy->policydb); 2369 err_sidtab: 2370 kfree(newpolicy->sidtab); 2371 err_policy: 2372 kfree(newpolicy); 2373 2374 return rc; 2375 } 2376 2377 /** 2378 * security_port_sid - Obtain the SID for a port. 2379 * @state: SELinux state 2380 * @protocol: protocol number 2381 * @port: port number 2382 * @out_sid: security identifier 2383 */ 2384 int security_port_sid(struct selinux_state *state, 2385 u8 protocol, u16 port, u32 *out_sid) 2386 { 2387 struct selinux_policy *policy; 2388 struct policydb *policydb; 2389 struct sidtab *sidtab; 2390 struct ocontext *c; 2391 int rc; 2392 2393 if (!selinux_initialized(state)) { 2394 *out_sid = SECINITSID_PORT; 2395 return 0; 2396 } 2397 2398 retry: 2399 rc = 0; 2400 rcu_read_lock(); 2401 policy = rcu_dereference(state->policy); 2402 policydb = &policy->policydb; 2403 sidtab = policy->sidtab; 2404 2405 c = policydb->ocontexts[OCON_PORT]; 2406 while (c) { 2407 if (c->u.port.protocol == protocol && 2408 c->u.port.low_port <= port && 2409 c->u.port.high_port >= port) 2410 break; 2411 c = c->next; 2412 } 2413 2414 if (c) { 2415 if (!c->sid[0]) { 2416 rc = sidtab_context_to_sid(sidtab, &c->context[0], 2417 &c->sid[0]); 2418 if (rc == -ESTALE) { 2419 rcu_read_unlock(); 2420 goto retry; 2421 } 2422 if (rc) 2423 goto out; 2424 } 2425 *out_sid = c->sid[0]; 2426 } else { 2427 *out_sid = SECINITSID_PORT; 2428 } 2429 2430 out: 2431 rcu_read_unlock(); 2432 return rc; 2433 } 2434 2435 /** 2436 * security_ib_pkey_sid - Obtain the SID for a pkey. 2437 * @state: SELinux state 2438 * @subnet_prefix: Subnet Prefix 2439 * @pkey_num: pkey number 2440 * @out_sid: security identifier 2441 */ 2442 int security_ib_pkey_sid(struct selinux_state *state, 2443 u64 subnet_prefix, u16 pkey_num, u32 *out_sid) 2444 { 2445 struct selinux_policy *policy; 2446 struct policydb *policydb; 2447 struct sidtab *sidtab; 2448 struct ocontext *c; 2449 int rc; 2450 2451 if (!selinux_initialized(state)) { 2452 *out_sid = SECINITSID_UNLABELED; 2453 return 0; 2454 } 2455 2456 retry: 2457 rc = 0; 2458 rcu_read_lock(); 2459 policy = rcu_dereference(state->policy); 2460 policydb = &policy->policydb; 2461 sidtab = policy->sidtab; 2462 2463 c = policydb->ocontexts[OCON_IBPKEY]; 2464 while (c) { 2465 if (c->u.ibpkey.low_pkey <= pkey_num && 2466 c->u.ibpkey.high_pkey >= pkey_num && 2467 c->u.ibpkey.subnet_prefix == subnet_prefix) 2468 break; 2469 2470 c = c->next; 2471 } 2472 2473 if (c) { 2474 if (!c->sid[0]) { 2475 rc = sidtab_context_to_sid(sidtab, 2476 &c->context[0], 2477 &c->sid[0]); 2478 if (rc == -ESTALE) { 2479 rcu_read_unlock(); 2480 goto retry; 2481 } 2482 if (rc) 2483 goto out; 2484 } 2485 *out_sid = c->sid[0]; 2486 } else 2487 *out_sid = SECINITSID_UNLABELED; 2488 2489 out: 2490 rcu_read_unlock(); 2491 return rc; 2492 } 2493 2494 /** 2495 * security_ib_endport_sid - Obtain the SID for a subnet management interface. 2496 * @state: SELinux state 2497 * @dev_name: device name 2498 * @port: port number 2499 * @out_sid: security identifier 2500 */ 2501 int security_ib_endport_sid(struct selinux_state *state, 2502 const char *dev_name, u8 port_num, u32 *out_sid) 2503 { 2504 struct selinux_policy *policy; 2505 struct policydb *policydb; 2506 struct sidtab *sidtab; 2507 struct ocontext *c; 2508 int rc; 2509 2510 if (!selinux_initialized(state)) { 2511 *out_sid = SECINITSID_UNLABELED; 2512 return 0; 2513 } 2514 2515 retry: 2516 rc = 0; 2517 rcu_read_lock(); 2518 policy = rcu_dereference(state->policy); 2519 policydb = &policy->policydb; 2520 sidtab = policy->sidtab; 2521 2522 c = policydb->ocontexts[OCON_IBENDPORT]; 2523 while (c) { 2524 if (c->u.ibendport.port == port_num && 2525 !strncmp(c->u.ibendport.dev_name, 2526 dev_name, 2527 IB_DEVICE_NAME_MAX)) 2528 break; 2529 2530 c = c->next; 2531 } 2532 2533 if (c) { 2534 if (!c->sid[0]) { 2535 rc = sidtab_context_to_sid(sidtab, &c->context[0], 2536 &c->sid[0]); 2537 if (rc == -ESTALE) { 2538 rcu_read_unlock(); 2539 goto retry; 2540 } 2541 if (rc) 2542 goto out; 2543 } 2544 *out_sid = c->sid[0]; 2545 } else 2546 *out_sid = SECINITSID_UNLABELED; 2547 2548 out: 2549 rcu_read_unlock(); 2550 return rc; 2551 } 2552 2553 /** 2554 * security_netif_sid - Obtain the SID for a network interface. 2555 * @state: SELinux state 2556 * @name: interface name 2557 * @if_sid: interface SID 2558 */ 2559 int security_netif_sid(struct selinux_state *state, 2560 char *name, u32 *if_sid) 2561 { 2562 struct selinux_policy *policy; 2563 struct policydb *policydb; 2564 struct sidtab *sidtab; 2565 int rc; 2566 struct ocontext *c; 2567 2568 if (!selinux_initialized(state)) { 2569 *if_sid = SECINITSID_NETIF; 2570 return 0; 2571 } 2572 2573 retry: 2574 rc = 0; 2575 rcu_read_lock(); 2576 policy = rcu_dereference(state->policy); 2577 policydb = &policy->policydb; 2578 sidtab = policy->sidtab; 2579 2580 c = policydb->ocontexts[OCON_NETIF]; 2581 while (c) { 2582 if (strcmp(name, c->u.name) == 0) 2583 break; 2584 c = c->next; 2585 } 2586 2587 if (c) { 2588 if (!c->sid[0] || !c->sid[1]) { 2589 rc = sidtab_context_to_sid(sidtab, &c->context[0], 2590 &c->sid[0]); 2591 if (rc == -ESTALE) { 2592 rcu_read_unlock(); 2593 goto retry; 2594 } 2595 if (rc) 2596 goto out; 2597 rc = sidtab_context_to_sid(sidtab, &c->context[1], 2598 &c->sid[1]); 2599 if (rc == -ESTALE) { 2600 rcu_read_unlock(); 2601 goto retry; 2602 } 2603 if (rc) 2604 goto out; 2605 } 2606 *if_sid = c->sid[0]; 2607 } else 2608 *if_sid = SECINITSID_NETIF; 2609 2610 out: 2611 rcu_read_unlock(); 2612 return rc; 2613 } 2614 2615 static int match_ipv6_addrmask(u32 *input, u32 *addr, u32 *mask) 2616 { 2617 int i, fail = 0; 2618 2619 for (i = 0; i < 4; i++) 2620 if (addr[i] != (input[i] & mask[i])) { 2621 fail = 1; 2622 break; 2623 } 2624 2625 return !fail; 2626 } 2627 2628 /** 2629 * security_node_sid - Obtain the SID for a node (host). 2630 * @state: SELinux state 2631 * @domain: communication domain aka address family 2632 * @addrp: address 2633 * @addrlen: address length in bytes 2634 * @out_sid: security identifier 2635 */ 2636 int security_node_sid(struct selinux_state *state, 2637 u16 domain, 2638 void *addrp, 2639 u32 addrlen, 2640 u32 *out_sid) 2641 { 2642 struct selinux_policy *policy; 2643 struct policydb *policydb; 2644 struct sidtab *sidtab; 2645 int rc; 2646 struct ocontext *c; 2647 2648 if (!selinux_initialized(state)) { 2649 *out_sid = SECINITSID_NODE; 2650 return 0; 2651 } 2652 2653 retry: 2654 rcu_read_lock(); 2655 policy = rcu_dereference(state->policy); 2656 policydb = &policy->policydb; 2657 sidtab = policy->sidtab; 2658 2659 switch (domain) { 2660 case AF_INET: { 2661 u32 addr; 2662 2663 rc = -EINVAL; 2664 if (addrlen != sizeof(u32)) 2665 goto out; 2666 2667 addr = *((u32 *)addrp); 2668 2669 c = policydb->ocontexts[OCON_NODE]; 2670 while (c) { 2671 if (c->u.node.addr == (addr & c->u.node.mask)) 2672 break; 2673 c = c->next; 2674 } 2675 break; 2676 } 2677 2678 case AF_INET6: 2679 rc = -EINVAL; 2680 if (addrlen != sizeof(u64) * 2) 2681 goto out; 2682 c = policydb->ocontexts[OCON_NODE6]; 2683 while (c) { 2684 if (match_ipv6_addrmask(addrp, c->u.node6.addr, 2685 c->u.node6.mask)) 2686 break; 2687 c = c->next; 2688 } 2689 break; 2690 2691 default: 2692 rc = 0; 2693 *out_sid = SECINITSID_NODE; 2694 goto out; 2695 } 2696 2697 if (c) { 2698 if (!c->sid[0]) { 2699 rc = sidtab_context_to_sid(sidtab, 2700 &c->context[0], 2701 &c->sid[0]); 2702 if (rc == -ESTALE) { 2703 rcu_read_unlock(); 2704 goto retry; 2705 } 2706 if (rc) 2707 goto out; 2708 } 2709 *out_sid = c->sid[0]; 2710 } else { 2711 *out_sid = SECINITSID_NODE; 2712 } 2713 2714 rc = 0; 2715 out: 2716 rcu_read_unlock(); 2717 return rc; 2718 } 2719 2720 #define SIDS_NEL 25 2721 2722 /** 2723 * security_get_user_sids - Obtain reachable SIDs for a user. 2724 * @state: SELinux state 2725 * @fromsid: starting SID 2726 * @username: username 2727 * @sids: array of reachable SIDs for user 2728 * @nel: number of elements in @sids 2729 * 2730 * Generate the set of SIDs for legal security contexts 2731 * for a given user that can be reached by @fromsid. 2732 * Set *@sids to point to a dynamically allocated 2733 * array containing the set of SIDs. Set *@nel to the 2734 * number of elements in the array. 2735 */ 2736 2737 int security_get_user_sids(struct selinux_state *state, 2738 u32 fromsid, 2739 char *username, 2740 u32 **sids, 2741 u32 *nel) 2742 { 2743 struct selinux_policy *policy; 2744 struct policydb *policydb; 2745 struct sidtab *sidtab; 2746 struct context *fromcon, usercon; 2747 u32 *mysids = NULL, *mysids2, sid; 2748 u32 i, j, mynel, maxnel = SIDS_NEL; 2749 struct user_datum *user; 2750 struct role_datum *role; 2751 struct ebitmap_node *rnode, *tnode; 2752 int rc; 2753 2754 *sids = NULL; 2755 *nel = 0; 2756 2757 if (!selinux_initialized(state)) 2758 return 0; 2759 2760 mysids = kcalloc(maxnel, sizeof(*mysids), GFP_KERNEL); 2761 if (!mysids) 2762 return -ENOMEM; 2763 2764 retry: 2765 mynel = 0; 2766 rcu_read_lock(); 2767 policy = rcu_dereference(state->policy); 2768 policydb = &policy->policydb; 2769 sidtab = policy->sidtab; 2770 2771 context_init(&usercon); 2772 2773 rc = -EINVAL; 2774 fromcon = sidtab_search(sidtab, fromsid); 2775 if (!fromcon) 2776 goto out_unlock; 2777 2778 rc = -EINVAL; 2779 user = symtab_search(&policydb->p_users, username); 2780 if (!user) 2781 goto out_unlock; 2782 2783 usercon.user = user->value; 2784 2785 ebitmap_for_each_positive_bit(&user->roles, rnode, i) { 2786 role = policydb->role_val_to_struct[i]; 2787 usercon.role = i + 1; 2788 ebitmap_for_each_positive_bit(&role->types, tnode, j) { 2789 usercon.type = j + 1; 2790 2791 if (mls_setup_user_range(policydb, fromcon, user, 2792 &usercon)) 2793 continue; 2794 2795 rc = sidtab_context_to_sid(sidtab, &usercon, &sid); 2796 if (rc == -ESTALE) { 2797 rcu_read_unlock(); 2798 goto retry; 2799 } 2800 if (rc) 2801 goto out_unlock; 2802 if (mynel < maxnel) { 2803 mysids[mynel++] = sid; 2804 } else { 2805 rc = -ENOMEM; 2806 maxnel += SIDS_NEL; 2807 mysids2 = kcalloc(maxnel, sizeof(*mysids2), GFP_ATOMIC); 2808 if (!mysids2) 2809 goto out_unlock; 2810 memcpy(mysids2, mysids, mynel * sizeof(*mysids2)); 2811 kfree(mysids); 2812 mysids = mysids2; 2813 mysids[mynel++] = sid; 2814 } 2815 } 2816 } 2817 rc = 0; 2818 out_unlock: 2819 rcu_read_unlock(); 2820 if (rc || !mynel) { 2821 kfree(mysids); 2822 return rc; 2823 } 2824 2825 rc = -ENOMEM; 2826 mysids2 = kcalloc(mynel, sizeof(*mysids2), GFP_KERNEL); 2827 if (!mysids2) { 2828 kfree(mysids); 2829 return rc; 2830 } 2831 for (i = 0, j = 0; i < mynel; i++) { 2832 struct av_decision dummy_avd; 2833 rc = avc_has_perm_noaudit(state, 2834 fromsid, mysids[i], 2835 SECCLASS_PROCESS, /* kernel value */ 2836 PROCESS__TRANSITION, AVC_STRICT, 2837 &dummy_avd); 2838 if (!rc) 2839 mysids2[j++] = mysids[i]; 2840 cond_resched(); 2841 } 2842 kfree(mysids); 2843 *sids = mysids2; 2844 *nel = j; 2845 return 0; 2846 } 2847 2848 /** 2849 * __security_genfs_sid - Helper to obtain a SID for a file in a filesystem 2850 * @fstype: filesystem type 2851 * @path: path from root of mount 2852 * @sclass: file security class 2853 * @sid: SID for path 2854 * 2855 * Obtain a SID to use for a file in a filesystem that 2856 * cannot support xattr or use a fixed labeling behavior like 2857 * transition SIDs or task SIDs. 2858 * 2859 * WARNING: This function may return -ESTALE, indicating that the caller 2860 * must retry the operation after re-acquiring the policy pointer! 2861 */ 2862 static inline int __security_genfs_sid(struct selinux_policy *policy, 2863 const char *fstype, 2864 char *path, 2865 u16 orig_sclass, 2866 u32 *sid) 2867 { 2868 struct policydb *policydb = &policy->policydb; 2869 struct sidtab *sidtab = policy->sidtab; 2870 int len; 2871 u16 sclass; 2872 struct genfs *genfs; 2873 struct ocontext *c; 2874 int rc, cmp = 0; 2875 2876 while (path[0] == '/' && path[1] == '/') 2877 path++; 2878 2879 sclass = unmap_class(&policy->map, orig_sclass); 2880 *sid = SECINITSID_UNLABELED; 2881 2882 for (genfs = policydb->genfs; genfs; genfs = genfs->next) { 2883 cmp = strcmp(fstype, genfs->fstype); 2884 if (cmp <= 0) 2885 break; 2886 } 2887 2888 rc = -ENOENT; 2889 if (!genfs || cmp) 2890 goto out; 2891 2892 for (c = genfs->head; c; c = c->next) { 2893 len = strlen(c->u.name); 2894 if ((!c->v.sclass || sclass == c->v.sclass) && 2895 (strncmp(c->u.name, path, len) == 0)) 2896 break; 2897 } 2898 2899 rc = -ENOENT; 2900 if (!c) 2901 goto out; 2902 2903 if (!c->sid[0]) { 2904 rc = sidtab_context_to_sid(sidtab, &c->context[0], &c->sid[0]); 2905 if (rc) 2906 goto out; 2907 } 2908 2909 *sid = c->sid[0]; 2910 rc = 0; 2911 out: 2912 return rc; 2913 } 2914 2915 /** 2916 * security_genfs_sid - Obtain a SID for a file in a filesystem 2917 * @state: SELinux state 2918 * @fstype: filesystem type 2919 * @path: path from root of mount 2920 * @sclass: file security class 2921 * @sid: SID for path 2922 * 2923 * Acquire policy_rwlock before calling __security_genfs_sid() and release 2924 * it afterward. 2925 */ 2926 int security_genfs_sid(struct selinux_state *state, 2927 const char *fstype, 2928 char *path, 2929 u16 orig_sclass, 2930 u32 *sid) 2931 { 2932 struct selinux_policy *policy; 2933 int retval; 2934 2935 if (!selinux_initialized(state)) { 2936 *sid = SECINITSID_UNLABELED; 2937 return 0; 2938 } 2939 2940 do { 2941 rcu_read_lock(); 2942 policy = rcu_dereference(state->policy); 2943 retval = __security_genfs_sid(policy, fstype, path, 2944 orig_sclass, sid); 2945 rcu_read_unlock(); 2946 } while (retval == -ESTALE); 2947 return retval; 2948 } 2949 2950 int selinux_policy_genfs_sid(struct selinux_policy *policy, 2951 const char *fstype, 2952 char *path, 2953 u16 orig_sclass, 2954 u32 *sid) 2955 { 2956 /* no lock required, policy is not yet accessible by other threads */ 2957 return __security_genfs_sid(policy, fstype, path, orig_sclass, sid); 2958 } 2959 2960 /** 2961 * security_fs_use - Determine how to handle labeling for a filesystem. 2962 * @state: SELinux state 2963 * @sb: superblock in question 2964 */ 2965 int security_fs_use(struct selinux_state *state, struct super_block *sb) 2966 { 2967 struct selinux_policy *policy; 2968 struct policydb *policydb; 2969 struct sidtab *sidtab; 2970 int rc; 2971 struct ocontext *c; 2972 struct superblock_security_struct *sbsec = selinux_superblock(sb); 2973 const char *fstype = sb->s_type->name; 2974 2975 if (!selinux_initialized(state)) { 2976 sbsec->behavior = SECURITY_FS_USE_NONE; 2977 sbsec->sid = SECINITSID_UNLABELED; 2978 return 0; 2979 } 2980 2981 retry: 2982 rc = 0; 2983 rcu_read_lock(); 2984 policy = rcu_dereference(state->policy); 2985 policydb = &policy->policydb; 2986 sidtab = policy->sidtab; 2987 2988 c = policydb->ocontexts[OCON_FSUSE]; 2989 while (c) { 2990 if (strcmp(fstype, c->u.name) == 0) 2991 break; 2992 c = c->next; 2993 } 2994 2995 if (c) { 2996 sbsec->behavior = c->v.behavior; 2997 if (!c->sid[0]) { 2998 rc = sidtab_context_to_sid(sidtab, &c->context[0], 2999 &c->sid[0]); 3000 if (rc == -ESTALE) { 3001 rcu_read_unlock(); 3002 goto retry; 3003 } 3004 if (rc) 3005 goto out; 3006 } 3007 sbsec->sid = c->sid[0]; 3008 } else { 3009 rc = __security_genfs_sid(policy, fstype, "/", 3010 SECCLASS_DIR, &sbsec->sid); 3011 if (rc == -ESTALE) { 3012 rcu_read_unlock(); 3013 goto retry; 3014 } 3015 if (rc) { 3016 sbsec->behavior = SECURITY_FS_USE_NONE; 3017 rc = 0; 3018 } else { 3019 sbsec->behavior = SECURITY_FS_USE_GENFS; 3020 } 3021 } 3022 3023 out: 3024 rcu_read_unlock(); 3025 return rc; 3026 } 3027 3028 int security_get_bools(struct selinux_policy *policy, 3029 u32 *len, char ***names, int **values) 3030 { 3031 struct policydb *policydb; 3032 u32 i; 3033 int rc; 3034 3035 policydb = &policy->policydb; 3036 3037 *names = NULL; 3038 *values = NULL; 3039 3040 rc = 0; 3041 *len = policydb->p_bools.nprim; 3042 if (!*len) 3043 goto out; 3044 3045 rc = -ENOMEM; 3046 *names = kcalloc(*len, sizeof(char *), GFP_ATOMIC); 3047 if (!*names) 3048 goto err; 3049 3050 rc = -ENOMEM; 3051 *values = kcalloc(*len, sizeof(int), GFP_ATOMIC); 3052 if (!*values) 3053 goto err; 3054 3055 for (i = 0; i < *len; i++) { 3056 (*values)[i] = policydb->bool_val_to_struct[i]->state; 3057 3058 rc = -ENOMEM; 3059 (*names)[i] = kstrdup(sym_name(policydb, SYM_BOOLS, i), 3060 GFP_ATOMIC); 3061 if (!(*names)[i]) 3062 goto err; 3063 } 3064 rc = 0; 3065 out: 3066 return rc; 3067 err: 3068 if (*names) { 3069 for (i = 0; i < *len; i++) 3070 kfree((*names)[i]); 3071 kfree(*names); 3072 } 3073 kfree(*values); 3074 *len = 0; 3075 *names = NULL; 3076 *values = NULL; 3077 goto out; 3078 } 3079 3080 3081 int security_set_bools(struct selinux_state *state, u32 len, int *values) 3082 { 3083 struct selinux_policy *newpolicy, *oldpolicy; 3084 int rc; 3085 u32 i, seqno = 0; 3086 3087 if (!selinux_initialized(state)) 3088 return -EINVAL; 3089 3090 oldpolicy = rcu_dereference_protected(state->policy, 3091 lockdep_is_held(&state->policy_mutex)); 3092 3093 /* Consistency check on number of booleans, should never fail */ 3094 if (WARN_ON(len != oldpolicy->policydb.p_bools.nprim)) 3095 return -EINVAL; 3096 3097 newpolicy = kmemdup(oldpolicy, sizeof(*newpolicy), GFP_KERNEL); 3098 if (!newpolicy) 3099 return -ENOMEM; 3100 3101 /* 3102 * Deep copy only the parts of the policydb that might be 3103 * modified as a result of changing booleans. 3104 */ 3105 rc = cond_policydb_dup(&newpolicy->policydb, &oldpolicy->policydb); 3106 if (rc) { 3107 kfree(newpolicy); 3108 return -ENOMEM; 3109 } 3110 3111 /* Update the boolean states in the copy */ 3112 for (i = 0; i < len; i++) { 3113 int new_state = !!values[i]; 3114 int old_state = newpolicy->policydb.bool_val_to_struct[i]->state; 3115 3116 if (new_state != old_state) { 3117 audit_log(audit_context(), GFP_ATOMIC, 3118 AUDIT_MAC_CONFIG_CHANGE, 3119 "bool=%s val=%d old_val=%d auid=%u ses=%u", 3120 sym_name(&newpolicy->policydb, SYM_BOOLS, i), 3121 new_state, 3122 old_state, 3123 from_kuid(&init_user_ns, audit_get_loginuid(current)), 3124 audit_get_sessionid(current)); 3125 newpolicy->policydb.bool_val_to_struct[i]->state = new_state; 3126 } 3127 } 3128 3129 /* Re-evaluate the conditional rules in the copy */ 3130 evaluate_cond_nodes(&newpolicy->policydb); 3131 3132 /* Set latest granting seqno for new policy */ 3133 newpolicy->latest_granting = oldpolicy->latest_granting + 1; 3134 seqno = newpolicy->latest_granting; 3135 3136 /* Install the new policy */ 3137 rcu_assign_pointer(state->policy, newpolicy); 3138 3139 /* 3140 * Free the conditional portions of the old policydb 3141 * that were copied for the new policy, and the oldpolicy 3142 * structure itself but not what it references. 3143 */ 3144 synchronize_rcu(); 3145 selinux_policy_cond_free(oldpolicy); 3146 3147 /* Notify others of the policy change */ 3148 selinux_notify_policy_change(state, seqno); 3149 return 0; 3150 } 3151 3152 int security_get_bool_value(struct selinux_state *state, 3153 u32 index) 3154 { 3155 struct selinux_policy *policy; 3156 struct policydb *policydb; 3157 int rc; 3158 u32 len; 3159 3160 if (!selinux_initialized(state)) 3161 return 0; 3162 3163 rcu_read_lock(); 3164 policy = rcu_dereference(state->policy); 3165 policydb = &policy->policydb; 3166 3167 rc = -EFAULT; 3168 len = policydb->p_bools.nprim; 3169 if (index >= len) 3170 goto out; 3171 3172 rc = policydb->bool_val_to_struct[index]->state; 3173 out: 3174 rcu_read_unlock(); 3175 return rc; 3176 } 3177 3178 static int security_preserve_bools(struct selinux_policy *oldpolicy, 3179 struct selinux_policy *newpolicy) 3180 { 3181 int rc, *bvalues = NULL; 3182 char **bnames = NULL; 3183 struct cond_bool_datum *booldatum; 3184 u32 i, nbools = 0; 3185 3186 rc = security_get_bools(oldpolicy, &nbools, &bnames, &bvalues); 3187 if (rc) 3188 goto out; 3189 for (i = 0; i < nbools; i++) { 3190 booldatum = symtab_search(&newpolicy->policydb.p_bools, 3191 bnames[i]); 3192 if (booldatum) 3193 booldatum->state = bvalues[i]; 3194 } 3195 evaluate_cond_nodes(&newpolicy->policydb); 3196 3197 out: 3198 if (bnames) { 3199 for (i = 0; i < nbools; i++) 3200 kfree(bnames[i]); 3201 } 3202 kfree(bnames); 3203 kfree(bvalues); 3204 return rc; 3205 } 3206 3207 /* 3208 * security_sid_mls_copy() - computes a new sid based on the given 3209 * sid and the mls portion of mls_sid. 3210 */ 3211 int security_sid_mls_copy(struct selinux_state *state, 3212 u32 sid, u32 mls_sid, u32 *new_sid) 3213 { 3214 struct selinux_policy *policy; 3215 struct policydb *policydb; 3216 struct sidtab *sidtab; 3217 struct context *context1; 3218 struct context *context2; 3219 struct context newcon; 3220 char *s; 3221 u32 len; 3222 int rc; 3223 3224 if (!selinux_initialized(state)) { 3225 *new_sid = sid; 3226 return 0; 3227 } 3228 3229 retry: 3230 rc = 0; 3231 context_init(&newcon); 3232 3233 rcu_read_lock(); 3234 policy = rcu_dereference(state->policy); 3235 policydb = &policy->policydb; 3236 sidtab = policy->sidtab; 3237 3238 if (!policydb->mls_enabled) { 3239 *new_sid = sid; 3240 goto out_unlock; 3241 } 3242 3243 rc = -EINVAL; 3244 context1 = sidtab_search(sidtab, sid); 3245 if (!context1) { 3246 pr_err("SELinux: %s: unrecognized SID %d\n", 3247 __func__, sid); 3248 goto out_unlock; 3249 } 3250 3251 rc = -EINVAL; 3252 context2 = sidtab_search(sidtab, mls_sid); 3253 if (!context2) { 3254 pr_err("SELinux: %s: unrecognized SID %d\n", 3255 __func__, mls_sid); 3256 goto out_unlock; 3257 } 3258 3259 newcon.user = context1->user; 3260 newcon.role = context1->role; 3261 newcon.type = context1->type; 3262 rc = mls_context_cpy(&newcon, context2); 3263 if (rc) 3264 goto out_unlock; 3265 3266 /* Check the validity of the new context. */ 3267 if (!policydb_context_isvalid(policydb, &newcon)) { 3268 rc = convert_context_handle_invalid_context(state, policydb, 3269 &newcon); 3270 if (rc) { 3271 if (!context_struct_to_string(policydb, &newcon, &s, 3272 &len)) { 3273 struct audit_buffer *ab; 3274 3275 ab = audit_log_start(audit_context(), 3276 GFP_ATOMIC, 3277 AUDIT_SELINUX_ERR); 3278 audit_log_format(ab, 3279 "op=security_sid_mls_copy invalid_context="); 3280 /* don't record NUL with untrusted strings */ 3281 audit_log_n_untrustedstring(ab, s, len - 1); 3282 audit_log_end(ab); 3283 kfree(s); 3284 } 3285 goto out_unlock; 3286 } 3287 } 3288 rc = sidtab_context_to_sid(sidtab, &newcon, new_sid); 3289 if (rc == -ESTALE) { 3290 rcu_read_unlock(); 3291 context_destroy(&newcon); 3292 goto retry; 3293 } 3294 out_unlock: 3295 rcu_read_unlock(); 3296 context_destroy(&newcon); 3297 return rc; 3298 } 3299 3300 /** 3301 * security_net_peersid_resolve - Compare and resolve two network peer SIDs 3302 * @state: SELinux state 3303 * @nlbl_sid: NetLabel SID 3304 * @nlbl_type: NetLabel labeling protocol type 3305 * @xfrm_sid: XFRM SID 3306 * 3307 * Description: 3308 * Compare the @nlbl_sid and @xfrm_sid values and if the two SIDs can be 3309 * resolved into a single SID it is returned via @peer_sid and the function 3310 * returns zero. Otherwise @peer_sid is set to SECSID_NULL and the function 3311 * returns a negative value. A table summarizing the behavior is below: 3312 * 3313 * | function return | @sid 3314 * ------------------------------+-----------------+----------------- 3315 * no peer labels | 0 | SECSID_NULL 3316 * single peer label | 0 | <peer_label> 3317 * multiple, consistent labels | 0 | <peer_label> 3318 * multiple, inconsistent labels | -<errno> | SECSID_NULL 3319 * 3320 */ 3321 int security_net_peersid_resolve(struct selinux_state *state, 3322 u32 nlbl_sid, u32 nlbl_type, 3323 u32 xfrm_sid, 3324 u32 *peer_sid) 3325 { 3326 struct selinux_policy *policy; 3327 struct policydb *policydb; 3328 struct sidtab *sidtab; 3329 int rc; 3330 struct context *nlbl_ctx; 3331 struct context *xfrm_ctx; 3332 3333 *peer_sid = SECSID_NULL; 3334 3335 /* handle the common (which also happens to be the set of easy) cases 3336 * right away, these two if statements catch everything involving a 3337 * single or absent peer SID/label */ 3338 if (xfrm_sid == SECSID_NULL) { 3339 *peer_sid = nlbl_sid; 3340 return 0; 3341 } 3342 /* NOTE: an nlbl_type == NETLBL_NLTYPE_UNLABELED is a "fallback" label 3343 * and is treated as if nlbl_sid == SECSID_NULL when a XFRM SID/label 3344 * is present */ 3345 if (nlbl_sid == SECSID_NULL || nlbl_type == NETLBL_NLTYPE_UNLABELED) { 3346 *peer_sid = xfrm_sid; 3347 return 0; 3348 } 3349 3350 if (!selinux_initialized(state)) 3351 return 0; 3352 3353 rcu_read_lock(); 3354 policy = rcu_dereference(state->policy); 3355 policydb = &policy->policydb; 3356 sidtab = policy->sidtab; 3357 3358 /* 3359 * We don't need to check initialized here since the only way both 3360 * nlbl_sid and xfrm_sid are not equal to SECSID_NULL would be if the 3361 * security server was initialized and state->initialized was true. 3362 */ 3363 if (!policydb->mls_enabled) { 3364 rc = 0; 3365 goto out; 3366 } 3367 3368 rc = -EINVAL; 3369 nlbl_ctx = sidtab_search(sidtab, nlbl_sid); 3370 if (!nlbl_ctx) { 3371 pr_err("SELinux: %s: unrecognized SID %d\n", 3372 __func__, nlbl_sid); 3373 goto out; 3374 } 3375 rc = -EINVAL; 3376 xfrm_ctx = sidtab_search(sidtab, xfrm_sid); 3377 if (!xfrm_ctx) { 3378 pr_err("SELinux: %s: unrecognized SID %d\n", 3379 __func__, xfrm_sid); 3380 goto out; 3381 } 3382 rc = (mls_context_cmp(nlbl_ctx, xfrm_ctx) ? 0 : -EACCES); 3383 if (rc) 3384 goto out; 3385 3386 /* at present NetLabel SIDs/labels really only carry MLS 3387 * information so if the MLS portion of the NetLabel SID 3388 * matches the MLS portion of the labeled XFRM SID/label 3389 * then pass along the XFRM SID as it is the most 3390 * expressive */ 3391 *peer_sid = xfrm_sid; 3392 out: 3393 rcu_read_unlock(); 3394 return rc; 3395 } 3396 3397 static int get_classes_callback(void *k, void *d, void *args) 3398 { 3399 struct class_datum *datum = d; 3400 char *name = k, **classes = args; 3401 int value = datum->value - 1; 3402 3403 classes[value] = kstrdup(name, GFP_ATOMIC); 3404 if (!classes[value]) 3405 return -ENOMEM; 3406 3407 return 0; 3408 } 3409 3410 int security_get_classes(struct selinux_policy *policy, 3411 char ***classes, int *nclasses) 3412 { 3413 struct policydb *policydb; 3414 int rc; 3415 3416 policydb = &policy->policydb; 3417 3418 rc = -ENOMEM; 3419 *nclasses = policydb->p_classes.nprim; 3420 *classes = kcalloc(*nclasses, sizeof(**classes), GFP_ATOMIC); 3421 if (!*classes) 3422 goto out; 3423 3424 rc = hashtab_map(&policydb->p_classes.table, get_classes_callback, 3425 *classes); 3426 if (rc) { 3427 int i; 3428 for (i = 0; i < *nclasses; i++) 3429 kfree((*classes)[i]); 3430 kfree(*classes); 3431 } 3432 3433 out: 3434 return rc; 3435 } 3436 3437 static int get_permissions_callback(void *k, void *d, void *args) 3438 { 3439 struct perm_datum *datum = d; 3440 char *name = k, **perms = args; 3441 int value = datum->value - 1; 3442 3443 perms[value] = kstrdup(name, GFP_ATOMIC); 3444 if (!perms[value]) 3445 return -ENOMEM; 3446 3447 return 0; 3448 } 3449 3450 int security_get_permissions(struct selinux_policy *policy, 3451 char *class, char ***perms, int *nperms) 3452 { 3453 struct policydb *policydb; 3454 int rc, i; 3455 struct class_datum *match; 3456 3457 policydb = &policy->policydb; 3458 3459 rc = -EINVAL; 3460 match = symtab_search(&policydb->p_classes, class); 3461 if (!match) { 3462 pr_err("SELinux: %s: unrecognized class %s\n", 3463 __func__, class); 3464 goto out; 3465 } 3466 3467 rc = -ENOMEM; 3468 *nperms = match->permissions.nprim; 3469 *perms = kcalloc(*nperms, sizeof(**perms), GFP_ATOMIC); 3470 if (!*perms) 3471 goto out; 3472 3473 if (match->comdatum) { 3474 rc = hashtab_map(&match->comdatum->permissions.table, 3475 get_permissions_callback, *perms); 3476 if (rc) 3477 goto err; 3478 } 3479 3480 rc = hashtab_map(&match->permissions.table, get_permissions_callback, 3481 *perms); 3482 if (rc) 3483 goto err; 3484 3485 out: 3486 return rc; 3487 3488 err: 3489 for (i = 0; i < *nperms; i++) 3490 kfree((*perms)[i]); 3491 kfree(*perms); 3492 return rc; 3493 } 3494 3495 int security_get_reject_unknown(struct selinux_state *state) 3496 { 3497 struct selinux_policy *policy; 3498 int value; 3499 3500 if (!selinux_initialized(state)) 3501 return 0; 3502 3503 rcu_read_lock(); 3504 policy = rcu_dereference(state->policy); 3505 value = policy->policydb.reject_unknown; 3506 rcu_read_unlock(); 3507 return value; 3508 } 3509 3510 int security_get_allow_unknown(struct selinux_state *state) 3511 { 3512 struct selinux_policy *policy; 3513 int value; 3514 3515 if (!selinux_initialized(state)) 3516 return 0; 3517 3518 rcu_read_lock(); 3519 policy = rcu_dereference(state->policy); 3520 value = policy->policydb.allow_unknown; 3521 rcu_read_unlock(); 3522 return value; 3523 } 3524 3525 /** 3526 * security_policycap_supported - Check for a specific policy capability 3527 * @state: SELinux state 3528 * @req_cap: capability 3529 * 3530 * Description: 3531 * This function queries the currently loaded policy to see if it supports the 3532 * capability specified by @req_cap. Returns true (1) if the capability is 3533 * supported, false (0) if it isn't supported. 3534 * 3535 */ 3536 int security_policycap_supported(struct selinux_state *state, 3537 unsigned int req_cap) 3538 { 3539 struct selinux_policy *policy; 3540 int rc; 3541 3542 if (!selinux_initialized(state)) 3543 return 0; 3544 3545 rcu_read_lock(); 3546 policy = rcu_dereference(state->policy); 3547 rc = ebitmap_get_bit(&policy->policydb.policycaps, req_cap); 3548 rcu_read_unlock(); 3549 3550 return rc; 3551 } 3552 3553 struct selinux_audit_rule { 3554 u32 au_seqno; 3555 struct context au_ctxt; 3556 }; 3557 3558 void selinux_audit_rule_free(void *vrule) 3559 { 3560 struct selinux_audit_rule *rule = vrule; 3561 3562 if (rule) { 3563 context_destroy(&rule->au_ctxt); 3564 kfree(rule); 3565 } 3566 } 3567 3568 int selinux_audit_rule_init(u32 field, u32 op, char *rulestr, void **vrule) 3569 { 3570 struct selinux_state *state = &selinux_state; 3571 struct selinux_policy *policy; 3572 struct policydb *policydb; 3573 struct selinux_audit_rule *tmprule; 3574 struct role_datum *roledatum; 3575 struct type_datum *typedatum; 3576 struct user_datum *userdatum; 3577 struct selinux_audit_rule **rule = (struct selinux_audit_rule **)vrule; 3578 int rc = 0; 3579 3580 *rule = NULL; 3581 3582 if (!selinux_initialized(state)) 3583 return -EOPNOTSUPP; 3584 3585 switch (field) { 3586 case AUDIT_SUBJ_USER: 3587 case AUDIT_SUBJ_ROLE: 3588 case AUDIT_SUBJ_TYPE: 3589 case AUDIT_OBJ_USER: 3590 case AUDIT_OBJ_ROLE: 3591 case AUDIT_OBJ_TYPE: 3592 /* only 'equals' and 'not equals' fit user, role, and type */ 3593 if (op != Audit_equal && op != Audit_not_equal) 3594 return -EINVAL; 3595 break; 3596 case AUDIT_SUBJ_SEN: 3597 case AUDIT_SUBJ_CLR: 3598 case AUDIT_OBJ_LEV_LOW: 3599 case AUDIT_OBJ_LEV_HIGH: 3600 /* we do not allow a range, indicated by the presence of '-' */ 3601 if (strchr(rulestr, '-')) 3602 return -EINVAL; 3603 break; 3604 default: 3605 /* only the above fields are valid */ 3606 return -EINVAL; 3607 } 3608 3609 tmprule = kzalloc(sizeof(struct selinux_audit_rule), GFP_KERNEL); 3610 if (!tmprule) 3611 return -ENOMEM; 3612 3613 context_init(&tmprule->au_ctxt); 3614 3615 rcu_read_lock(); 3616 policy = rcu_dereference(state->policy); 3617 policydb = &policy->policydb; 3618 3619 tmprule->au_seqno = policy->latest_granting; 3620 3621 switch (field) { 3622 case AUDIT_SUBJ_USER: 3623 case AUDIT_OBJ_USER: 3624 rc = -EINVAL; 3625 userdatum = symtab_search(&policydb->p_users, rulestr); 3626 if (!userdatum) 3627 goto out; 3628 tmprule->au_ctxt.user = userdatum->value; 3629 break; 3630 case AUDIT_SUBJ_ROLE: 3631 case AUDIT_OBJ_ROLE: 3632 rc = -EINVAL; 3633 roledatum = symtab_search(&policydb->p_roles, rulestr); 3634 if (!roledatum) 3635 goto out; 3636 tmprule->au_ctxt.role = roledatum->value; 3637 break; 3638 case AUDIT_SUBJ_TYPE: 3639 case AUDIT_OBJ_TYPE: 3640 rc = -EINVAL; 3641 typedatum = symtab_search(&policydb->p_types, rulestr); 3642 if (!typedatum) 3643 goto out; 3644 tmprule->au_ctxt.type = typedatum->value; 3645 break; 3646 case AUDIT_SUBJ_SEN: 3647 case AUDIT_SUBJ_CLR: 3648 case AUDIT_OBJ_LEV_LOW: 3649 case AUDIT_OBJ_LEV_HIGH: 3650 rc = mls_from_string(policydb, rulestr, &tmprule->au_ctxt, 3651 GFP_ATOMIC); 3652 if (rc) 3653 goto out; 3654 break; 3655 } 3656 rc = 0; 3657 out: 3658 rcu_read_unlock(); 3659 3660 if (rc) { 3661 selinux_audit_rule_free(tmprule); 3662 tmprule = NULL; 3663 } 3664 3665 *rule = tmprule; 3666 3667 return rc; 3668 } 3669 3670 /* Check to see if the rule contains any selinux fields */ 3671 int selinux_audit_rule_known(struct audit_krule *rule) 3672 { 3673 int i; 3674 3675 for (i = 0; i < rule->field_count; i++) { 3676 struct audit_field *f = &rule->fields[i]; 3677 switch (f->type) { 3678 case AUDIT_SUBJ_USER: 3679 case AUDIT_SUBJ_ROLE: 3680 case AUDIT_SUBJ_TYPE: 3681 case AUDIT_SUBJ_SEN: 3682 case AUDIT_SUBJ_CLR: 3683 case AUDIT_OBJ_USER: 3684 case AUDIT_OBJ_ROLE: 3685 case AUDIT_OBJ_TYPE: 3686 case AUDIT_OBJ_LEV_LOW: 3687 case AUDIT_OBJ_LEV_HIGH: 3688 return 1; 3689 } 3690 } 3691 3692 return 0; 3693 } 3694 3695 int selinux_audit_rule_match(u32 sid, u32 field, u32 op, void *vrule) 3696 { 3697 struct selinux_state *state = &selinux_state; 3698 struct selinux_policy *policy; 3699 struct context *ctxt; 3700 struct mls_level *level; 3701 struct selinux_audit_rule *rule = vrule; 3702 int match = 0; 3703 3704 if (unlikely(!rule)) { 3705 WARN_ONCE(1, "selinux_audit_rule_match: missing rule\n"); 3706 return -ENOENT; 3707 } 3708 3709 if (!selinux_initialized(state)) 3710 return 0; 3711 3712 rcu_read_lock(); 3713 3714 policy = rcu_dereference(state->policy); 3715 3716 if (rule->au_seqno < policy->latest_granting) { 3717 match = -ESTALE; 3718 goto out; 3719 } 3720 3721 ctxt = sidtab_search(policy->sidtab, sid); 3722 if (unlikely(!ctxt)) { 3723 WARN_ONCE(1, "selinux_audit_rule_match: unrecognized SID %d\n", 3724 sid); 3725 match = -ENOENT; 3726 goto out; 3727 } 3728 3729 /* a field/op pair that is not caught here will simply fall through 3730 without a match */ 3731 switch (field) { 3732 case AUDIT_SUBJ_USER: 3733 case AUDIT_OBJ_USER: 3734 switch (op) { 3735 case Audit_equal: 3736 match = (ctxt->user == rule->au_ctxt.user); 3737 break; 3738 case Audit_not_equal: 3739 match = (ctxt->user != rule->au_ctxt.user); 3740 break; 3741 } 3742 break; 3743 case AUDIT_SUBJ_ROLE: 3744 case AUDIT_OBJ_ROLE: 3745 switch (op) { 3746 case Audit_equal: 3747 match = (ctxt->role == rule->au_ctxt.role); 3748 break; 3749 case Audit_not_equal: 3750 match = (ctxt->role != rule->au_ctxt.role); 3751 break; 3752 } 3753 break; 3754 case AUDIT_SUBJ_TYPE: 3755 case AUDIT_OBJ_TYPE: 3756 switch (op) { 3757 case Audit_equal: 3758 match = (ctxt->type == rule->au_ctxt.type); 3759 break; 3760 case Audit_not_equal: 3761 match = (ctxt->type != rule->au_ctxt.type); 3762 break; 3763 } 3764 break; 3765 case AUDIT_SUBJ_SEN: 3766 case AUDIT_SUBJ_CLR: 3767 case AUDIT_OBJ_LEV_LOW: 3768 case AUDIT_OBJ_LEV_HIGH: 3769 level = ((field == AUDIT_SUBJ_SEN || 3770 field == AUDIT_OBJ_LEV_LOW) ? 3771 &ctxt->range.level[0] : &ctxt->range.level[1]); 3772 switch (op) { 3773 case Audit_equal: 3774 match = mls_level_eq(&rule->au_ctxt.range.level[0], 3775 level); 3776 break; 3777 case Audit_not_equal: 3778 match = !mls_level_eq(&rule->au_ctxt.range.level[0], 3779 level); 3780 break; 3781 case Audit_lt: 3782 match = (mls_level_dom(&rule->au_ctxt.range.level[0], 3783 level) && 3784 !mls_level_eq(&rule->au_ctxt.range.level[0], 3785 level)); 3786 break; 3787 case Audit_le: 3788 match = mls_level_dom(&rule->au_ctxt.range.level[0], 3789 level); 3790 break; 3791 case Audit_gt: 3792 match = (mls_level_dom(level, 3793 &rule->au_ctxt.range.level[0]) && 3794 !mls_level_eq(level, 3795 &rule->au_ctxt.range.level[0])); 3796 break; 3797 case Audit_ge: 3798 match = mls_level_dom(level, 3799 &rule->au_ctxt.range.level[0]); 3800 break; 3801 } 3802 } 3803 3804 out: 3805 rcu_read_unlock(); 3806 return match; 3807 } 3808 3809 static int aurule_avc_callback(u32 event) 3810 { 3811 if (event == AVC_CALLBACK_RESET) 3812 return audit_update_lsm_rules(); 3813 return 0; 3814 } 3815 3816 static int __init aurule_init(void) 3817 { 3818 int err; 3819 3820 err = avc_add_callback(aurule_avc_callback, AVC_CALLBACK_RESET); 3821 if (err) 3822 panic("avc_add_callback() failed, error %d\n", err); 3823 3824 return err; 3825 } 3826 __initcall(aurule_init); 3827 3828 #ifdef CONFIG_NETLABEL 3829 /** 3830 * security_netlbl_cache_add - Add an entry to the NetLabel cache 3831 * @secattr: the NetLabel packet security attributes 3832 * @sid: the SELinux SID 3833 * 3834 * Description: 3835 * Attempt to cache the context in @ctx, which was derived from the packet in 3836 * @skb, in the NetLabel subsystem cache. This function assumes @secattr has 3837 * already been initialized. 3838 * 3839 */ 3840 static void security_netlbl_cache_add(struct netlbl_lsm_secattr *secattr, 3841 u32 sid) 3842 { 3843 u32 *sid_cache; 3844 3845 sid_cache = kmalloc(sizeof(*sid_cache), GFP_ATOMIC); 3846 if (sid_cache == NULL) 3847 return; 3848 secattr->cache = netlbl_secattr_cache_alloc(GFP_ATOMIC); 3849 if (secattr->cache == NULL) { 3850 kfree(sid_cache); 3851 return; 3852 } 3853 3854 *sid_cache = sid; 3855 secattr->cache->free = kfree; 3856 secattr->cache->data = sid_cache; 3857 secattr->flags |= NETLBL_SECATTR_CACHE; 3858 } 3859 3860 /** 3861 * security_netlbl_secattr_to_sid - Convert a NetLabel secattr to a SELinux SID 3862 * @state: SELinux state 3863 * @secattr: the NetLabel packet security attributes 3864 * @sid: the SELinux SID 3865 * 3866 * Description: 3867 * Convert the given NetLabel security attributes in @secattr into a 3868 * SELinux SID. If the @secattr field does not contain a full SELinux 3869 * SID/context then use SECINITSID_NETMSG as the foundation. If possible the 3870 * 'cache' field of @secattr is set and the CACHE flag is set; this is to 3871 * allow the @secattr to be used by NetLabel to cache the secattr to SID 3872 * conversion for future lookups. Returns zero on success, negative values on 3873 * failure. 3874 * 3875 */ 3876 int security_netlbl_secattr_to_sid(struct selinux_state *state, 3877 struct netlbl_lsm_secattr *secattr, 3878 u32 *sid) 3879 { 3880 struct selinux_policy *policy; 3881 struct policydb *policydb; 3882 struct sidtab *sidtab; 3883 int rc; 3884 struct context *ctx; 3885 struct context ctx_new; 3886 3887 if (!selinux_initialized(state)) { 3888 *sid = SECSID_NULL; 3889 return 0; 3890 } 3891 3892 retry: 3893 rc = 0; 3894 rcu_read_lock(); 3895 policy = rcu_dereference(state->policy); 3896 policydb = &policy->policydb; 3897 sidtab = policy->sidtab; 3898 3899 if (secattr->flags & NETLBL_SECATTR_CACHE) 3900 *sid = *(u32 *)secattr->cache->data; 3901 else if (secattr->flags & NETLBL_SECATTR_SECID) 3902 *sid = secattr->attr.secid; 3903 else if (secattr->flags & NETLBL_SECATTR_MLS_LVL) { 3904 rc = -EIDRM; 3905 ctx = sidtab_search(sidtab, SECINITSID_NETMSG); 3906 if (ctx == NULL) 3907 goto out; 3908 3909 context_init(&ctx_new); 3910 ctx_new.user = ctx->user; 3911 ctx_new.role = ctx->role; 3912 ctx_new.type = ctx->type; 3913 mls_import_netlbl_lvl(policydb, &ctx_new, secattr); 3914 if (secattr->flags & NETLBL_SECATTR_MLS_CAT) { 3915 rc = mls_import_netlbl_cat(policydb, &ctx_new, secattr); 3916 if (rc) 3917 goto out; 3918 } 3919 rc = -EIDRM; 3920 if (!mls_context_isvalid(policydb, &ctx_new)) { 3921 ebitmap_destroy(&ctx_new.range.level[0].cat); 3922 goto out; 3923 } 3924 3925 rc = sidtab_context_to_sid(sidtab, &ctx_new, sid); 3926 ebitmap_destroy(&ctx_new.range.level[0].cat); 3927 if (rc == -ESTALE) { 3928 rcu_read_unlock(); 3929 goto retry; 3930 } 3931 if (rc) 3932 goto out; 3933 3934 security_netlbl_cache_add(secattr, *sid); 3935 } else 3936 *sid = SECSID_NULL; 3937 3938 out: 3939 rcu_read_unlock(); 3940 return rc; 3941 } 3942 3943 /** 3944 * security_netlbl_sid_to_secattr - Convert a SELinux SID to a NetLabel secattr 3945 * @state: SELinux state 3946 * @sid: the SELinux SID 3947 * @secattr: the NetLabel packet security attributes 3948 * 3949 * Description: 3950 * Convert the given SELinux SID in @sid into a NetLabel security attribute. 3951 * Returns zero on success, negative values on failure. 3952 * 3953 */ 3954 int security_netlbl_sid_to_secattr(struct selinux_state *state, 3955 u32 sid, struct netlbl_lsm_secattr *secattr) 3956 { 3957 struct selinux_policy *policy; 3958 struct policydb *policydb; 3959 int rc; 3960 struct context *ctx; 3961 3962 if (!selinux_initialized(state)) 3963 return 0; 3964 3965 rcu_read_lock(); 3966 policy = rcu_dereference(state->policy); 3967 policydb = &policy->policydb; 3968 3969 rc = -ENOENT; 3970 ctx = sidtab_search(policy->sidtab, sid); 3971 if (ctx == NULL) 3972 goto out; 3973 3974 rc = -ENOMEM; 3975 secattr->domain = kstrdup(sym_name(policydb, SYM_TYPES, ctx->type - 1), 3976 GFP_ATOMIC); 3977 if (secattr->domain == NULL) 3978 goto out; 3979 3980 secattr->attr.secid = sid; 3981 secattr->flags |= NETLBL_SECATTR_DOMAIN_CPY | NETLBL_SECATTR_SECID; 3982 mls_export_netlbl_lvl(policydb, ctx, secattr); 3983 rc = mls_export_netlbl_cat(policydb, ctx, secattr); 3984 out: 3985 rcu_read_unlock(); 3986 return rc; 3987 } 3988 #endif /* CONFIG_NETLABEL */ 3989 3990 /** 3991 * __security_read_policy - read the policy. 3992 * @policy: SELinux policy 3993 * @data: binary policy data 3994 * @len: length of data in bytes 3995 * 3996 */ 3997 static int __security_read_policy(struct selinux_policy *policy, 3998 void *data, size_t *len) 3999 { 4000 int rc; 4001 struct policy_file fp; 4002 4003 fp.data = data; 4004 fp.len = *len; 4005 4006 rc = policydb_write(&policy->policydb, &fp); 4007 if (rc) 4008 return rc; 4009 4010 *len = (unsigned long)fp.data - (unsigned long)data; 4011 return 0; 4012 } 4013 4014 /** 4015 * security_read_policy - read the policy. 4016 * @state: selinux_state 4017 * @data: binary policy data 4018 * @len: length of data in bytes 4019 * 4020 */ 4021 int security_read_policy(struct selinux_state *state, 4022 void **data, size_t *len) 4023 { 4024 struct selinux_policy *policy; 4025 4026 policy = rcu_dereference_protected( 4027 state->policy, lockdep_is_held(&state->policy_mutex)); 4028 if (!policy) 4029 return -EINVAL; 4030 4031 *len = policy->policydb.len; 4032 *data = vmalloc_user(*len); 4033 if (!*data) 4034 return -ENOMEM; 4035 4036 return __security_read_policy(policy, *data, len); 4037 } 4038 4039 /** 4040 * security_read_state_kernel - read the policy. 4041 * @state: selinux_state 4042 * @data: binary policy data 4043 * @len: length of data in bytes 4044 * 4045 * Allocates kernel memory for reading SELinux policy. 4046 * This function is for internal use only and should not 4047 * be used for returning data to user space. 4048 * 4049 * This function must be called with policy_mutex held. 4050 */ 4051 int security_read_state_kernel(struct selinux_state *state, 4052 void **data, size_t *len) 4053 { 4054 struct selinux_policy *policy; 4055 4056 policy = rcu_dereference_protected( 4057 state->policy, lockdep_is_held(&state->policy_mutex)); 4058 if (!policy) 4059 return -EINVAL; 4060 4061 *len = policy->policydb.len; 4062 *data = vmalloc(*len); 4063 if (!*data) 4064 return -ENOMEM; 4065 4066 return __security_read_policy(policy, *data, len); 4067 } 4068