1 // SPDX-License-Identifier: GPL-2.0-only 2 /* 3 * Implementation of the security services. 4 * 5 * Authors : Stephen Smalley, <sds@tycho.nsa.gov> 6 * James Morris <jmorris@redhat.com> 7 * 8 * Updated: Trusted Computer Solutions, Inc. <dgoeddel@trustedcs.com> 9 * 10 * Support for enhanced MLS infrastructure. 11 * Support for context based audit filters. 12 * 13 * Updated: Frank Mayer <mayerf@tresys.com> and Karl MacMillan <kmacmillan@tresys.com> 14 * 15 * Added conditional policy language extensions 16 * 17 * Updated: Hewlett-Packard <paul@paul-moore.com> 18 * 19 * Added support for NetLabel 20 * Added support for the policy capability bitmap 21 * 22 * Updated: Chad Sellers <csellers@tresys.com> 23 * 24 * Added validation of kernel classes and permissions 25 * 26 * Updated: KaiGai Kohei <kaigai@ak.jp.nec.com> 27 * 28 * Added support for bounds domain and audit messaged on masked permissions 29 * 30 * Updated: Guido Trentalancia <guido@trentalancia.com> 31 * 32 * Added support for runtime switching of the policy type 33 * 34 * Copyright (C) 2008, 2009 NEC Corporation 35 * Copyright (C) 2006, 2007 Hewlett-Packard Development Company, L.P. 36 * Copyright (C) 2004-2006 Trusted Computer Solutions, Inc. 37 * Copyright (C) 2003 - 2004, 2006 Tresys Technology, LLC 38 * Copyright (C) 2003 Red Hat, Inc., James Morris <jmorris@redhat.com> 39 */ 40 #include <linux/kernel.h> 41 #include <linux/slab.h> 42 #include <linux/string.h> 43 #include <linux/spinlock.h> 44 #include <linux/rcupdate.h> 45 #include <linux/errno.h> 46 #include <linux/in.h> 47 #include <linux/sched.h> 48 #include <linux/audit.h> 49 #include <linux/vmalloc.h> 50 #include <net/netlabel.h> 51 52 #include "flask.h" 53 #include "avc.h" 54 #include "avc_ss.h" 55 #include "security.h" 56 #include "context.h" 57 #include "policydb.h" 58 #include "sidtab.h" 59 #include "services.h" 60 #include "conditional.h" 61 #include "mls.h" 62 #include "objsec.h" 63 #include "netlabel.h" 64 #include "xfrm.h" 65 #include "ebitmap.h" 66 #include "audit.h" 67 #include "policycap_names.h" 68 #include "ima.h" 69 70 /* Forward declaration. */ 71 static int context_struct_to_string(struct policydb *policydb, 72 struct context *context, 73 char **scontext, 74 u32 *scontext_len); 75 76 static int sidtab_entry_to_string(struct policydb *policydb, 77 struct sidtab *sidtab, 78 struct sidtab_entry *entry, 79 char **scontext, 80 u32 *scontext_len); 81 82 static void context_struct_compute_av(struct policydb *policydb, 83 struct context *scontext, 84 struct context *tcontext, 85 u16 tclass, 86 struct av_decision *avd, 87 struct extended_perms *xperms); 88 89 static int selinux_set_mapping(struct policydb *pol, 90 struct security_class_mapping *map, 91 struct selinux_map *out_map) 92 { 93 u16 i, j; 94 unsigned k; 95 bool print_unknown_handle = false; 96 97 /* Find number of classes in the input mapping */ 98 if (!map) 99 return -EINVAL; 100 i = 0; 101 while (map[i].name) 102 i++; 103 104 /* Allocate space for the class records, plus one for class zero */ 105 out_map->mapping = kcalloc(++i, sizeof(*out_map->mapping), GFP_ATOMIC); 106 if (!out_map->mapping) 107 return -ENOMEM; 108 109 /* Store the raw class and permission values */ 110 j = 0; 111 while (map[j].name) { 112 struct security_class_mapping *p_in = map + (j++); 113 struct selinux_mapping *p_out = out_map->mapping + j; 114 115 /* An empty class string skips ahead */ 116 if (!strcmp(p_in->name, "")) { 117 p_out->num_perms = 0; 118 continue; 119 } 120 121 p_out->value = string_to_security_class(pol, p_in->name); 122 if (!p_out->value) { 123 pr_info("SELinux: Class %s not defined in policy.\n", 124 p_in->name); 125 if (pol->reject_unknown) 126 goto err; 127 p_out->num_perms = 0; 128 print_unknown_handle = true; 129 continue; 130 } 131 132 k = 0; 133 while (p_in->perms[k]) { 134 /* An empty permission string skips ahead */ 135 if (!*p_in->perms[k]) { 136 k++; 137 continue; 138 } 139 p_out->perms[k] = string_to_av_perm(pol, p_out->value, 140 p_in->perms[k]); 141 if (!p_out->perms[k]) { 142 pr_info("SELinux: Permission %s in class %s not defined in policy.\n", 143 p_in->perms[k], p_in->name); 144 if (pol->reject_unknown) 145 goto err; 146 print_unknown_handle = true; 147 } 148 149 k++; 150 } 151 p_out->num_perms = k; 152 } 153 154 if (print_unknown_handle) 155 pr_info("SELinux: the above unknown classes and permissions will be %s\n", 156 pol->allow_unknown ? "allowed" : "denied"); 157 158 out_map->size = i; 159 return 0; 160 err: 161 kfree(out_map->mapping); 162 out_map->mapping = NULL; 163 return -EINVAL; 164 } 165 166 /* 167 * Get real, policy values from mapped values 168 */ 169 170 static u16 unmap_class(struct selinux_map *map, u16 tclass) 171 { 172 if (tclass < map->size) 173 return map->mapping[tclass].value; 174 175 return tclass; 176 } 177 178 /* 179 * Get kernel value for class from its policy value 180 */ 181 static u16 map_class(struct selinux_map *map, u16 pol_value) 182 { 183 u16 i; 184 185 for (i = 1; i < map->size; i++) { 186 if (map->mapping[i].value == pol_value) 187 return i; 188 } 189 190 return SECCLASS_NULL; 191 } 192 193 static void map_decision(struct selinux_map *map, 194 u16 tclass, struct av_decision *avd, 195 int allow_unknown) 196 { 197 if (tclass < map->size) { 198 struct selinux_mapping *mapping = &map->mapping[tclass]; 199 unsigned int i, n = mapping->num_perms; 200 u32 result; 201 202 for (i = 0, result = 0; i < n; i++) { 203 if (avd->allowed & mapping->perms[i]) 204 result |= 1<<i; 205 if (allow_unknown && !mapping->perms[i]) 206 result |= 1<<i; 207 } 208 avd->allowed = result; 209 210 for (i = 0, result = 0; i < n; i++) 211 if (avd->auditallow & mapping->perms[i]) 212 result |= 1<<i; 213 avd->auditallow = result; 214 215 for (i = 0, result = 0; i < n; i++) { 216 if (avd->auditdeny & mapping->perms[i]) 217 result |= 1<<i; 218 if (!allow_unknown && !mapping->perms[i]) 219 result |= 1<<i; 220 } 221 /* 222 * In case the kernel has a bug and requests a permission 223 * between num_perms and the maximum permission number, we 224 * should audit that denial 225 */ 226 for (; i < (sizeof(u32)*8); i++) 227 result |= 1<<i; 228 avd->auditdeny = result; 229 } 230 } 231 232 int security_mls_enabled(struct selinux_state *state) 233 { 234 int mls_enabled; 235 struct selinux_policy *policy; 236 237 if (!selinux_initialized(state)) 238 return 0; 239 240 rcu_read_lock(); 241 policy = rcu_dereference(state->policy); 242 mls_enabled = policy->policydb.mls_enabled; 243 rcu_read_unlock(); 244 return mls_enabled; 245 } 246 247 /* 248 * Return the boolean value of a constraint expression 249 * when it is applied to the specified source and target 250 * security contexts. 251 * 252 * xcontext is a special beast... It is used by the validatetrans rules 253 * only. For these rules, scontext is the context before the transition, 254 * tcontext is the context after the transition, and xcontext is the context 255 * of the process performing the transition. All other callers of 256 * constraint_expr_eval should pass in NULL for xcontext. 257 */ 258 static int constraint_expr_eval(struct policydb *policydb, 259 struct context *scontext, 260 struct context *tcontext, 261 struct context *xcontext, 262 struct constraint_expr *cexpr) 263 { 264 u32 val1, val2; 265 struct context *c; 266 struct role_datum *r1, *r2; 267 struct mls_level *l1, *l2; 268 struct constraint_expr *e; 269 int s[CEXPR_MAXDEPTH]; 270 int sp = -1; 271 272 for (e = cexpr; e; e = e->next) { 273 switch (e->expr_type) { 274 case CEXPR_NOT: 275 BUG_ON(sp < 0); 276 s[sp] = !s[sp]; 277 break; 278 case CEXPR_AND: 279 BUG_ON(sp < 1); 280 sp--; 281 s[sp] &= s[sp + 1]; 282 break; 283 case CEXPR_OR: 284 BUG_ON(sp < 1); 285 sp--; 286 s[sp] |= s[sp + 1]; 287 break; 288 case CEXPR_ATTR: 289 if (sp == (CEXPR_MAXDEPTH - 1)) 290 return 0; 291 switch (e->attr) { 292 case CEXPR_USER: 293 val1 = scontext->user; 294 val2 = tcontext->user; 295 break; 296 case CEXPR_TYPE: 297 val1 = scontext->type; 298 val2 = tcontext->type; 299 break; 300 case CEXPR_ROLE: 301 val1 = scontext->role; 302 val2 = tcontext->role; 303 r1 = policydb->role_val_to_struct[val1 - 1]; 304 r2 = policydb->role_val_to_struct[val2 - 1]; 305 switch (e->op) { 306 case CEXPR_DOM: 307 s[++sp] = ebitmap_get_bit(&r1->dominates, 308 val2 - 1); 309 continue; 310 case CEXPR_DOMBY: 311 s[++sp] = ebitmap_get_bit(&r2->dominates, 312 val1 - 1); 313 continue; 314 case CEXPR_INCOMP: 315 s[++sp] = (!ebitmap_get_bit(&r1->dominates, 316 val2 - 1) && 317 !ebitmap_get_bit(&r2->dominates, 318 val1 - 1)); 319 continue; 320 default: 321 break; 322 } 323 break; 324 case CEXPR_L1L2: 325 l1 = &(scontext->range.level[0]); 326 l2 = &(tcontext->range.level[0]); 327 goto mls_ops; 328 case CEXPR_L1H2: 329 l1 = &(scontext->range.level[0]); 330 l2 = &(tcontext->range.level[1]); 331 goto mls_ops; 332 case CEXPR_H1L2: 333 l1 = &(scontext->range.level[1]); 334 l2 = &(tcontext->range.level[0]); 335 goto mls_ops; 336 case CEXPR_H1H2: 337 l1 = &(scontext->range.level[1]); 338 l2 = &(tcontext->range.level[1]); 339 goto mls_ops; 340 case CEXPR_L1H1: 341 l1 = &(scontext->range.level[0]); 342 l2 = &(scontext->range.level[1]); 343 goto mls_ops; 344 case CEXPR_L2H2: 345 l1 = &(tcontext->range.level[0]); 346 l2 = &(tcontext->range.level[1]); 347 goto mls_ops; 348 mls_ops: 349 switch (e->op) { 350 case CEXPR_EQ: 351 s[++sp] = mls_level_eq(l1, l2); 352 continue; 353 case CEXPR_NEQ: 354 s[++sp] = !mls_level_eq(l1, l2); 355 continue; 356 case CEXPR_DOM: 357 s[++sp] = mls_level_dom(l1, l2); 358 continue; 359 case CEXPR_DOMBY: 360 s[++sp] = mls_level_dom(l2, l1); 361 continue; 362 case CEXPR_INCOMP: 363 s[++sp] = mls_level_incomp(l2, l1); 364 continue; 365 default: 366 BUG(); 367 return 0; 368 } 369 break; 370 default: 371 BUG(); 372 return 0; 373 } 374 375 switch (e->op) { 376 case CEXPR_EQ: 377 s[++sp] = (val1 == val2); 378 break; 379 case CEXPR_NEQ: 380 s[++sp] = (val1 != val2); 381 break; 382 default: 383 BUG(); 384 return 0; 385 } 386 break; 387 case CEXPR_NAMES: 388 if (sp == (CEXPR_MAXDEPTH-1)) 389 return 0; 390 c = scontext; 391 if (e->attr & CEXPR_TARGET) 392 c = tcontext; 393 else if (e->attr & CEXPR_XTARGET) { 394 c = xcontext; 395 if (!c) { 396 BUG(); 397 return 0; 398 } 399 } 400 if (e->attr & CEXPR_USER) 401 val1 = c->user; 402 else if (e->attr & CEXPR_ROLE) 403 val1 = c->role; 404 else if (e->attr & CEXPR_TYPE) 405 val1 = c->type; 406 else { 407 BUG(); 408 return 0; 409 } 410 411 switch (e->op) { 412 case CEXPR_EQ: 413 s[++sp] = ebitmap_get_bit(&e->names, val1 - 1); 414 break; 415 case CEXPR_NEQ: 416 s[++sp] = !ebitmap_get_bit(&e->names, val1 - 1); 417 break; 418 default: 419 BUG(); 420 return 0; 421 } 422 break; 423 default: 424 BUG(); 425 return 0; 426 } 427 } 428 429 BUG_ON(sp != 0); 430 return s[0]; 431 } 432 433 /* 434 * security_dump_masked_av - dumps masked permissions during 435 * security_compute_av due to RBAC, MLS/Constraint and Type bounds. 436 */ 437 static int dump_masked_av_helper(void *k, void *d, void *args) 438 { 439 struct perm_datum *pdatum = d; 440 char **permission_names = args; 441 442 BUG_ON(pdatum->value < 1 || pdatum->value > 32); 443 444 permission_names[pdatum->value - 1] = (char *)k; 445 446 return 0; 447 } 448 449 static void security_dump_masked_av(struct policydb *policydb, 450 struct context *scontext, 451 struct context *tcontext, 452 u16 tclass, 453 u32 permissions, 454 const char *reason) 455 { 456 struct common_datum *common_dat; 457 struct class_datum *tclass_dat; 458 struct audit_buffer *ab; 459 char *tclass_name; 460 char *scontext_name = NULL; 461 char *tcontext_name = NULL; 462 char *permission_names[32]; 463 int index; 464 u32 length; 465 bool need_comma = false; 466 467 if (!permissions) 468 return; 469 470 tclass_name = sym_name(policydb, SYM_CLASSES, tclass - 1); 471 tclass_dat = policydb->class_val_to_struct[tclass - 1]; 472 common_dat = tclass_dat->comdatum; 473 474 /* init permission_names */ 475 if (common_dat && 476 hashtab_map(&common_dat->permissions.table, 477 dump_masked_av_helper, permission_names) < 0) 478 goto out; 479 480 if (hashtab_map(&tclass_dat->permissions.table, 481 dump_masked_av_helper, permission_names) < 0) 482 goto out; 483 484 /* get scontext/tcontext in text form */ 485 if (context_struct_to_string(policydb, scontext, 486 &scontext_name, &length) < 0) 487 goto out; 488 489 if (context_struct_to_string(policydb, tcontext, 490 &tcontext_name, &length) < 0) 491 goto out; 492 493 /* audit a message */ 494 ab = audit_log_start(audit_context(), 495 GFP_ATOMIC, AUDIT_SELINUX_ERR); 496 if (!ab) 497 goto out; 498 499 audit_log_format(ab, "op=security_compute_av reason=%s " 500 "scontext=%s tcontext=%s tclass=%s perms=", 501 reason, scontext_name, tcontext_name, tclass_name); 502 503 for (index = 0; index < 32; index++) { 504 u32 mask = (1 << index); 505 506 if ((mask & permissions) == 0) 507 continue; 508 509 audit_log_format(ab, "%s%s", 510 need_comma ? "," : "", 511 permission_names[index] 512 ? permission_names[index] : "????"); 513 need_comma = true; 514 } 515 audit_log_end(ab); 516 out: 517 /* release scontext/tcontext */ 518 kfree(tcontext_name); 519 kfree(scontext_name); 520 521 return; 522 } 523 524 /* 525 * security_boundary_permission - drops violated permissions 526 * on boundary constraint. 527 */ 528 static void type_attribute_bounds_av(struct policydb *policydb, 529 struct context *scontext, 530 struct context *tcontext, 531 u16 tclass, 532 struct av_decision *avd) 533 { 534 struct context lo_scontext; 535 struct context lo_tcontext, *tcontextp = tcontext; 536 struct av_decision lo_avd; 537 struct type_datum *source; 538 struct type_datum *target; 539 u32 masked = 0; 540 541 source = policydb->type_val_to_struct[scontext->type - 1]; 542 BUG_ON(!source); 543 544 if (!source->bounds) 545 return; 546 547 target = policydb->type_val_to_struct[tcontext->type - 1]; 548 BUG_ON(!target); 549 550 memset(&lo_avd, 0, sizeof(lo_avd)); 551 552 memcpy(&lo_scontext, scontext, sizeof(lo_scontext)); 553 lo_scontext.type = source->bounds; 554 555 if (target->bounds) { 556 memcpy(&lo_tcontext, tcontext, sizeof(lo_tcontext)); 557 lo_tcontext.type = target->bounds; 558 tcontextp = &lo_tcontext; 559 } 560 561 context_struct_compute_av(policydb, &lo_scontext, 562 tcontextp, 563 tclass, 564 &lo_avd, 565 NULL); 566 567 masked = ~lo_avd.allowed & avd->allowed; 568 569 if (likely(!masked)) 570 return; /* no masked permission */ 571 572 /* mask violated permissions */ 573 avd->allowed &= ~masked; 574 575 /* audit masked permissions */ 576 security_dump_masked_av(policydb, scontext, tcontext, 577 tclass, masked, "bounds"); 578 } 579 580 /* 581 * flag which drivers have permissions 582 * only looking for ioctl based extended permssions 583 */ 584 void services_compute_xperms_drivers( 585 struct extended_perms *xperms, 586 struct avtab_node *node) 587 { 588 unsigned int i; 589 590 if (node->datum.u.xperms->specified == AVTAB_XPERMS_IOCTLDRIVER) { 591 /* if one or more driver has all permissions allowed */ 592 for (i = 0; i < ARRAY_SIZE(xperms->drivers.p); i++) 593 xperms->drivers.p[i] |= node->datum.u.xperms->perms.p[i]; 594 } else if (node->datum.u.xperms->specified == AVTAB_XPERMS_IOCTLFUNCTION) { 595 /* if allowing permissions within a driver */ 596 security_xperm_set(xperms->drivers.p, 597 node->datum.u.xperms->driver); 598 } 599 600 xperms->len = 1; 601 } 602 603 /* 604 * Compute access vectors and extended permissions based on a context 605 * structure pair for the permissions in a particular class. 606 */ 607 static void context_struct_compute_av(struct policydb *policydb, 608 struct context *scontext, 609 struct context *tcontext, 610 u16 tclass, 611 struct av_decision *avd, 612 struct extended_perms *xperms) 613 { 614 struct constraint_node *constraint; 615 struct role_allow *ra; 616 struct avtab_key avkey; 617 struct avtab_node *node; 618 struct class_datum *tclass_datum; 619 struct ebitmap *sattr, *tattr; 620 struct ebitmap_node *snode, *tnode; 621 unsigned int i, j; 622 623 avd->allowed = 0; 624 avd->auditallow = 0; 625 avd->auditdeny = 0xffffffff; 626 if (xperms) { 627 memset(&xperms->drivers, 0, sizeof(xperms->drivers)); 628 xperms->len = 0; 629 } 630 631 if (unlikely(!tclass || tclass > policydb->p_classes.nprim)) { 632 if (printk_ratelimit()) 633 pr_warn("SELinux: Invalid class %hu\n", tclass); 634 return; 635 } 636 637 tclass_datum = policydb->class_val_to_struct[tclass - 1]; 638 639 /* 640 * If a specific type enforcement rule was defined for 641 * this permission check, then use it. 642 */ 643 avkey.target_class = tclass; 644 avkey.specified = AVTAB_AV | AVTAB_XPERMS; 645 sattr = &policydb->type_attr_map_array[scontext->type - 1]; 646 tattr = &policydb->type_attr_map_array[tcontext->type - 1]; 647 ebitmap_for_each_positive_bit(sattr, snode, i) { 648 ebitmap_for_each_positive_bit(tattr, tnode, j) { 649 avkey.source_type = i + 1; 650 avkey.target_type = j + 1; 651 for (node = avtab_search_node(&policydb->te_avtab, 652 &avkey); 653 node; 654 node = avtab_search_node_next(node, avkey.specified)) { 655 if (node->key.specified == AVTAB_ALLOWED) 656 avd->allowed |= node->datum.u.data; 657 else if (node->key.specified == AVTAB_AUDITALLOW) 658 avd->auditallow |= node->datum.u.data; 659 else if (node->key.specified == AVTAB_AUDITDENY) 660 avd->auditdeny &= node->datum.u.data; 661 else if (xperms && (node->key.specified & AVTAB_XPERMS)) 662 services_compute_xperms_drivers(xperms, node); 663 } 664 665 /* Check conditional av table for additional permissions */ 666 cond_compute_av(&policydb->te_cond_avtab, &avkey, 667 avd, xperms); 668 669 } 670 } 671 672 /* 673 * Remove any permissions prohibited by a constraint (this includes 674 * the MLS policy). 675 */ 676 constraint = tclass_datum->constraints; 677 while (constraint) { 678 if ((constraint->permissions & (avd->allowed)) && 679 !constraint_expr_eval(policydb, scontext, tcontext, NULL, 680 constraint->expr)) { 681 avd->allowed &= ~(constraint->permissions); 682 } 683 constraint = constraint->next; 684 } 685 686 /* 687 * If checking process transition permission and the 688 * role is changing, then check the (current_role, new_role) 689 * pair. 690 */ 691 if (tclass == policydb->process_class && 692 (avd->allowed & policydb->process_trans_perms) && 693 scontext->role != tcontext->role) { 694 for (ra = policydb->role_allow; ra; ra = ra->next) { 695 if (scontext->role == ra->role && 696 tcontext->role == ra->new_role) 697 break; 698 } 699 if (!ra) 700 avd->allowed &= ~policydb->process_trans_perms; 701 } 702 703 /* 704 * If the given source and target types have boundary 705 * constraint, lazy checks have to mask any violated 706 * permission and notice it to userspace via audit. 707 */ 708 type_attribute_bounds_av(policydb, scontext, tcontext, 709 tclass, avd); 710 } 711 712 static int security_validtrans_handle_fail(struct selinux_state *state, 713 struct selinux_policy *policy, 714 struct sidtab_entry *oentry, 715 struct sidtab_entry *nentry, 716 struct sidtab_entry *tentry, 717 u16 tclass) 718 { 719 struct policydb *p = &policy->policydb; 720 struct sidtab *sidtab = policy->sidtab; 721 char *o = NULL, *n = NULL, *t = NULL; 722 u32 olen, nlen, tlen; 723 724 if (sidtab_entry_to_string(p, sidtab, oentry, &o, &olen)) 725 goto out; 726 if (sidtab_entry_to_string(p, sidtab, nentry, &n, &nlen)) 727 goto out; 728 if (sidtab_entry_to_string(p, sidtab, tentry, &t, &tlen)) 729 goto out; 730 audit_log(audit_context(), GFP_ATOMIC, AUDIT_SELINUX_ERR, 731 "op=security_validate_transition seresult=denied" 732 " oldcontext=%s newcontext=%s taskcontext=%s tclass=%s", 733 o, n, t, sym_name(p, SYM_CLASSES, tclass-1)); 734 out: 735 kfree(o); 736 kfree(n); 737 kfree(t); 738 739 if (!enforcing_enabled(state)) 740 return 0; 741 return -EPERM; 742 } 743 744 static int security_compute_validatetrans(struct selinux_state *state, 745 u32 oldsid, u32 newsid, u32 tasksid, 746 u16 orig_tclass, bool user) 747 { 748 struct selinux_policy *policy; 749 struct policydb *policydb; 750 struct sidtab *sidtab; 751 struct sidtab_entry *oentry; 752 struct sidtab_entry *nentry; 753 struct sidtab_entry *tentry; 754 struct class_datum *tclass_datum; 755 struct constraint_node *constraint; 756 u16 tclass; 757 int rc = 0; 758 759 760 if (!selinux_initialized(state)) 761 return 0; 762 763 rcu_read_lock(); 764 765 policy = rcu_dereference(state->policy); 766 policydb = &policy->policydb; 767 sidtab = policy->sidtab; 768 769 if (!user) 770 tclass = unmap_class(&policy->map, orig_tclass); 771 else 772 tclass = orig_tclass; 773 774 if (!tclass || tclass > policydb->p_classes.nprim) { 775 rc = -EINVAL; 776 goto out; 777 } 778 tclass_datum = policydb->class_val_to_struct[tclass - 1]; 779 780 oentry = sidtab_search_entry(sidtab, oldsid); 781 if (!oentry) { 782 pr_err("SELinux: %s: unrecognized SID %d\n", 783 __func__, oldsid); 784 rc = -EINVAL; 785 goto out; 786 } 787 788 nentry = sidtab_search_entry(sidtab, newsid); 789 if (!nentry) { 790 pr_err("SELinux: %s: unrecognized SID %d\n", 791 __func__, newsid); 792 rc = -EINVAL; 793 goto out; 794 } 795 796 tentry = sidtab_search_entry(sidtab, tasksid); 797 if (!tentry) { 798 pr_err("SELinux: %s: unrecognized SID %d\n", 799 __func__, tasksid); 800 rc = -EINVAL; 801 goto out; 802 } 803 804 constraint = tclass_datum->validatetrans; 805 while (constraint) { 806 if (!constraint_expr_eval(policydb, &oentry->context, 807 &nentry->context, &tentry->context, 808 constraint->expr)) { 809 if (user) 810 rc = -EPERM; 811 else 812 rc = security_validtrans_handle_fail(state, 813 policy, 814 oentry, 815 nentry, 816 tentry, 817 tclass); 818 goto out; 819 } 820 constraint = constraint->next; 821 } 822 823 out: 824 rcu_read_unlock(); 825 return rc; 826 } 827 828 int security_validate_transition_user(struct selinux_state *state, 829 u32 oldsid, u32 newsid, u32 tasksid, 830 u16 tclass) 831 { 832 return security_compute_validatetrans(state, oldsid, newsid, tasksid, 833 tclass, true); 834 } 835 836 int security_validate_transition(struct selinux_state *state, 837 u32 oldsid, u32 newsid, u32 tasksid, 838 u16 orig_tclass) 839 { 840 return security_compute_validatetrans(state, oldsid, newsid, tasksid, 841 orig_tclass, false); 842 } 843 844 /* 845 * security_bounded_transition - check whether the given 846 * transition is directed to bounded, or not. 847 * It returns 0, if @newsid is bounded by @oldsid. 848 * Otherwise, it returns error code. 849 * 850 * @oldsid : current security identifier 851 * @newsid : destinated security identifier 852 */ 853 int security_bounded_transition(struct selinux_state *state, 854 u32 old_sid, u32 new_sid) 855 { 856 struct selinux_policy *policy; 857 struct policydb *policydb; 858 struct sidtab *sidtab; 859 struct sidtab_entry *old_entry, *new_entry; 860 struct type_datum *type; 861 int index; 862 int rc; 863 864 if (!selinux_initialized(state)) 865 return 0; 866 867 rcu_read_lock(); 868 policy = rcu_dereference(state->policy); 869 policydb = &policy->policydb; 870 sidtab = policy->sidtab; 871 872 rc = -EINVAL; 873 old_entry = sidtab_search_entry(sidtab, old_sid); 874 if (!old_entry) { 875 pr_err("SELinux: %s: unrecognized SID %u\n", 876 __func__, old_sid); 877 goto out; 878 } 879 880 rc = -EINVAL; 881 new_entry = sidtab_search_entry(sidtab, new_sid); 882 if (!new_entry) { 883 pr_err("SELinux: %s: unrecognized SID %u\n", 884 __func__, new_sid); 885 goto out; 886 } 887 888 rc = 0; 889 /* type/domain unchanged */ 890 if (old_entry->context.type == new_entry->context.type) 891 goto out; 892 893 index = new_entry->context.type; 894 while (true) { 895 type = policydb->type_val_to_struct[index - 1]; 896 BUG_ON(!type); 897 898 /* not bounded anymore */ 899 rc = -EPERM; 900 if (!type->bounds) 901 break; 902 903 /* @newsid is bounded by @oldsid */ 904 rc = 0; 905 if (type->bounds == old_entry->context.type) 906 break; 907 908 index = type->bounds; 909 } 910 911 if (rc) { 912 char *old_name = NULL; 913 char *new_name = NULL; 914 u32 length; 915 916 if (!sidtab_entry_to_string(policydb, sidtab, old_entry, 917 &old_name, &length) && 918 !sidtab_entry_to_string(policydb, sidtab, new_entry, 919 &new_name, &length)) { 920 audit_log(audit_context(), 921 GFP_ATOMIC, AUDIT_SELINUX_ERR, 922 "op=security_bounded_transition " 923 "seresult=denied " 924 "oldcontext=%s newcontext=%s", 925 old_name, new_name); 926 } 927 kfree(new_name); 928 kfree(old_name); 929 } 930 out: 931 rcu_read_unlock(); 932 933 return rc; 934 } 935 936 static void avd_init(struct selinux_policy *policy, struct av_decision *avd) 937 { 938 avd->allowed = 0; 939 avd->auditallow = 0; 940 avd->auditdeny = 0xffffffff; 941 if (policy) 942 avd->seqno = policy->latest_granting; 943 else 944 avd->seqno = 0; 945 avd->flags = 0; 946 } 947 948 void services_compute_xperms_decision(struct extended_perms_decision *xpermd, 949 struct avtab_node *node) 950 { 951 unsigned int i; 952 953 if (node->datum.u.xperms->specified == AVTAB_XPERMS_IOCTLFUNCTION) { 954 if (xpermd->driver != node->datum.u.xperms->driver) 955 return; 956 } else if (node->datum.u.xperms->specified == AVTAB_XPERMS_IOCTLDRIVER) { 957 if (!security_xperm_test(node->datum.u.xperms->perms.p, 958 xpermd->driver)) 959 return; 960 } else { 961 BUG(); 962 } 963 964 if (node->key.specified == AVTAB_XPERMS_ALLOWED) { 965 xpermd->used |= XPERMS_ALLOWED; 966 if (node->datum.u.xperms->specified == AVTAB_XPERMS_IOCTLDRIVER) { 967 memset(xpermd->allowed->p, 0xff, 968 sizeof(xpermd->allowed->p)); 969 } 970 if (node->datum.u.xperms->specified == AVTAB_XPERMS_IOCTLFUNCTION) { 971 for (i = 0; i < ARRAY_SIZE(xpermd->allowed->p); i++) 972 xpermd->allowed->p[i] |= 973 node->datum.u.xperms->perms.p[i]; 974 } 975 } else if (node->key.specified == AVTAB_XPERMS_AUDITALLOW) { 976 xpermd->used |= XPERMS_AUDITALLOW; 977 if (node->datum.u.xperms->specified == AVTAB_XPERMS_IOCTLDRIVER) { 978 memset(xpermd->auditallow->p, 0xff, 979 sizeof(xpermd->auditallow->p)); 980 } 981 if (node->datum.u.xperms->specified == AVTAB_XPERMS_IOCTLFUNCTION) { 982 for (i = 0; i < ARRAY_SIZE(xpermd->auditallow->p); i++) 983 xpermd->auditallow->p[i] |= 984 node->datum.u.xperms->perms.p[i]; 985 } 986 } else if (node->key.specified == AVTAB_XPERMS_DONTAUDIT) { 987 xpermd->used |= XPERMS_DONTAUDIT; 988 if (node->datum.u.xperms->specified == AVTAB_XPERMS_IOCTLDRIVER) { 989 memset(xpermd->dontaudit->p, 0xff, 990 sizeof(xpermd->dontaudit->p)); 991 } 992 if (node->datum.u.xperms->specified == AVTAB_XPERMS_IOCTLFUNCTION) { 993 for (i = 0; i < ARRAY_SIZE(xpermd->dontaudit->p); i++) 994 xpermd->dontaudit->p[i] |= 995 node->datum.u.xperms->perms.p[i]; 996 } 997 } else { 998 BUG(); 999 } 1000 } 1001 1002 void security_compute_xperms_decision(struct selinux_state *state, 1003 u32 ssid, 1004 u32 tsid, 1005 u16 orig_tclass, 1006 u8 driver, 1007 struct extended_perms_decision *xpermd) 1008 { 1009 struct selinux_policy *policy; 1010 struct policydb *policydb; 1011 struct sidtab *sidtab; 1012 u16 tclass; 1013 struct context *scontext, *tcontext; 1014 struct avtab_key avkey; 1015 struct avtab_node *node; 1016 struct ebitmap *sattr, *tattr; 1017 struct ebitmap_node *snode, *tnode; 1018 unsigned int i, j; 1019 1020 xpermd->driver = driver; 1021 xpermd->used = 0; 1022 memset(xpermd->allowed->p, 0, sizeof(xpermd->allowed->p)); 1023 memset(xpermd->auditallow->p, 0, sizeof(xpermd->auditallow->p)); 1024 memset(xpermd->dontaudit->p, 0, sizeof(xpermd->dontaudit->p)); 1025 1026 rcu_read_lock(); 1027 if (!selinux_initialized(state)) 1028 goto allow; 1029 1030 policy = rcu_dereference(state->policy); 1031 policydb = &policy->policydb; 1032 sidtab = policy->sidtab; 1033 1034 scontext = sidtab_search(sidtab, ssid); 1035 if (!scontext) { 1036 pr_err("SELinux: %s: unrecognized SID %d\n", 1037 __func__, ssid); 1038 goto out; 1039 } 1040 1041 tcontext = sidtab_search(sidtab, tsid); 1042 if (!tcontext) { 1043 pr_err("SELinux: %s: unrecognized SID %d\n", 1044 __func__, tsid); 1045 goto out; 1046 } 1047 1048 tclass = unmap_class(&policy->map, orig_tclass); 1049 if (unlikely(orig_tclass && !tclass)) { 1050 if (policydb->allow_unknown) 1051 goto allow; 1052 goto out; 1053 } 1054 1055 1056 if (unlikely(!tclass || tclass > policydb->p_classes.nprim)) { 1057 pr_warn_ratelimited("SELinux: Invalid class %hu\n", tclass); 1058 goto out; 1059 } 1060 1061 avkey.target_class = tclass; 1062 avkey.specified = AVTAB_XPERMS; 1063 sattr = &policydb->type_attr_map_array[scontext->type - 1]; 1064 tattr = &policydb->type_attr_map_array[tcontext->type - 1]; 1065 ebitmap_for_each_positive_bit(sattr, snode, i) { 1066 ebitmap_for_each_positive_bit(tattr, tnode, j) { 1067 avkey.source_type = i + 1; 1068 avkey.target_type = j + 1; 1069 for (node = avtab_search_node(&policydb->te_avtab, 1070 &avkey); 1071 node; 1072 node = avtab_search_node_next(node, avkey.specified)) 1073 services_compute_xperms_decision(xpermd, node); 1074 1075 cond_compute_xperms(&policydb->te_cond_avtab, 1076 &avkey, xpermd); 1077 } 1078 } 1079 out: 1080 rcu_read_unlock(); 1081 return; 1082 allow: 1083 memset(xpermd->allowed->p, 0xff, sizeof(xpermd->allowed->p)); 1084 goto out; 1085 } 1086 1087 /** 1088 * security_compute_av - Compute access vector decisions. 1089 * @ssid: source security identifier 1090 * @tsid: target security identifier 1091 * @tclass: target security class 1092 * @avd: access vector decisions 1093 * @xperms: extended permissions 1094 * 1095 * Compute a set of access vector decisions based on the 1096 * SID pair (@ssid, @tsid) for the permissions in @tclass. 1097 */ 1098 void security_compute_av(struct selinux_state *state, 1099 u32 ssid, 1100 u32 tsid, 1101 u16 orig_tclass, 1102 struct av_decision *avd, 1103 struct extended_perms *xperms) 1104 { 1105 struct selinux_policy *policy; 1106 struct policydb *policydb; 1107 struct sidtab *sidtab; 1108 u16 tclass; 1109 struct context *scontext = NULL, *tcontext = NULL; 1110 1111 rcu_read_lock(); 1112 policy = rcu_dereference(state->policy); 1113 avd_init(policy, avd); 1114 xperms->len = 0; 1115 if (!selinux_initialized(state)) 1116 goto allow; 1117 1118 policydb = &policy->policydb; 1119 sidtab = policy->sidtab; 1120 1121 scontext = sidtab_search(sidtab, ssid); 1122 if (!scontext) { 1123 pr_err("SELinux: %s: unrecognized SID %d\n", 1124 __func__, ssid); 1125 goto out; 1126 } 1127 1128 /* permissive domain? */ 1129 if (ebitmap_get_bit(&policydb->permissive_map, scontext->type)) 1130 avd->flags |= AVD_FLAGS_PERMISSIVE; 1131 1132 tcontext = sidtab_search(sidtab, tsid); 1133 if (!tcontext) { 1134 pr_err("SELinux: %s: unrecognized SID %d\n", 1135 __func__, tsid); 1136 goto out; 1137 } 1138 1139 tclass = unmap_class(&policy->map, orig_tclass); 1140 if (unlikely(orig_tclass && !tclass)) { 1141 if (policydb->allow_unknown) 1142 goto allow; 1143 goto out; 1144 } 1145 context_struct_compute_av(policydb, scontext, tcontext, tclass, avd, 1146 xperms); 1147 map_decision(&policy->map, orig_tclass, avd, 1148 policydb->allow_unknown); 1149 out: 1150 rcu_read_unlock(); 1151 return; 1152 allow: 1153 avd->allowed = 0xffffffff; 1154 goto out; 1155 } 1156 1157 void security_compute_av_user(struct selinux_state *state, 1158 u32 ssid, 1159 u32 tsid, 1160 u16 tclass, 1161 struct av_decision *avd) 1162 { 1163 struct selinux_policy *policy; 1164 struct policydb *policydb; 1165 struct sidtab *sidtab; 1166 struct context *scontext = NULL, *tcontext = NULL; 1167 1168 rcu_read_lock(); 1169 policy = rcu_dereference(state->policy); 1170 avd_init(policy, avd); 1171 if (!selinux_initialized(state)) 1172 goto allow; 1173 1174 policydb = &policy->policydb; 1175 sidtab = policy->sidtab; 1176 1177 scontext = sidtab_search(sidtab, ssid); 1178 if (!scontext) { 1179 pr_err("SELinux: %s: unrecognized SID %d\n", 1180 __func__, ssid); 1181 goto out; 1182 } 1183 1184 /* permissive domain? */ 1185 if (ebitmap_get_bit(&policydb->permissive_map, scontext->type)) 1186 avd->flags |= AVD_FLAGS_PERMISSIVE; 1187 1188 tcontext = sidtab_search(sidtab, tsid); 1189 if (!tcontext) { 1190 pr_err("SELinux: %s: unrecognized SID %d\n", 1191 __func__, tsid); 1192 goto out; 1193 } 1194 1195 if (unlikely(!tclass)) { 1196 if (policydb->allow_unknown) 1197 goto allow; 1198 goto out; 1199 } 1200 1201 context_struct_compute_av(policydb, scontext, tcontext, tclass, avd, 1202 NULL); 1203 out: 1204 rcu_read_unlock(); 1205 return; 1206 allow: 1207 avd->allowed = 0xffffffff; 1208 goto out; 1209 } 1210 1211 /* 1212 * Write the security context string representation of 1213 * the context structure `context' into a dynamically 1214 * allocated string of the correct size. Set `*scontext' 1215 * to point to this string and set `*scontext_len' to 1216 * the length of the string. 1217 */ 1218 static int context_struct_to_string(struct policydb *p, 1219 struct context *context, 1220 char **scontext, u32 *scontext_len) 1221 { 1222 char *scontextp; 1223 1224 if (scontext) 1225 *scontext = NULL; 1226 *scontext_len = 0; 1227 1228 if (context->len) { 1229 *scontext_len = context->len; 1230 if (scontext) { 1231 *scontext = kstrdup(context->str, GFP_ATOMIC); 1232 if (!(*scontext)) 1233 return -ENOMEM; 1234 } 1235 return 0; 1236 } 1237 1238 /* Compute the size of the context. */ 1239 *scontext_len += strlen(sym_name(p, SYM_USERS, context->user - 1)) + 1; 1240 *scontext_len += strlen(sym_name(p, SYM_ROLES, context->role - 1)) + 1; 1241 *scontext_len += strlen(sym_name(p, SYM_TYPES, context->type - 1)) + 1; 1242 *scontext_len += mls_compute_context_len(p, context); 1243 1244 if (!scontext) 1245 return 0; 1246 1247 /* Allocate space for the context; caller must free this space. */ 1248 scontextp = kmalloc(*scontext_len, GFP_ATOMIC); 1249 if (!scontextp) 1250 return -ENOMEM; 1251 *scontext = scontextp; 1252 1253 /* 1254 * Copy the user name, role name and type name into the context. 1255 */ 1256 scontextp += sprintf(scontextp, "%s:%s:%s", 1257 sym_name(p, SYM_USERS, context->user - 1), 1258 sym_name(p, SYM_ROLES, context->role - 1), 1259 sym_name(p, SYM_TYPES, context->type - 1)); 1260 1261 mls_sid_to_context(p, context, &scontextp); 1262 1263 *scontextp = 0; 1264 1265 return 0; 1266 } 1267 1268 static int sidtab_entry_to_string(struct policydb *p, 1269 struct sidtab *sidtab, 1270 struct sidtab_entry *entry, 1271 char **scontext, u32 *scontext_len) 1272 { 1273 int rc = sidtab_sid2str_get(sidtab, entry, scontext, scontext_len); 1274 1275 if (rc != -ENOENT) 1276 return rc; 1277 1278 rc = context_struct_to_string(p, &entry->context, scontext, 1279 scontext_len); 1280 if (!rc && scontext) 1281 sidtab_sid2str_put(sidtab, entry, *scontext, *scontext_len); 1282 return rc; 1283 } 1284 1285 #include "initial_sid_to_string.h" 1286 1287 int security_sidtab_hash_stats(struct selinux_state *state, char *page) 1288 { 1289 struct selinux_policy *policy; 1290 int rc; 1291 1292 if (!selinux_initialized(state)) { 1293 pr_err("SELinux: %s: called before initial load_policy\n", 1294 __func__); 1295 return -EINVAL; 1296 } 1297 1298 rcu_read_lock(); 1299 policy = rcu_dereference(state->policy); 1300 rc = sidtab_hash_stats(policy->sidtab, page); 1301 rcu_read_unlock(); 1302 1303 return rc; 1304 } 1305 1306 const char *security_get_initial_sid_context(u32 sid) 1307 { 1308 if (unlikely(sid > SECINITSID_NUM)) 1309 return NULL; 1310 return initial_sid_to_string[sid]; 1311 } 1312 1313 static int security_sid_to_context_core(struct selinux_state *state, 1314 u32 sid, char **scontext, 1315 u32 *scontext_len, int force, 1316 int only_invalid) 1317 { 1318 struct selinux_policy *policy; 1319 struct policydb *policydb; 1320 struct sidtab *sidtab; 1321 struct sidtab_entry *entry; 1322 int rc = 0; 1323 1324 if (scontext) 1325 *scontext = NULL; 1326 *scontext_len = 0; 1327 1328 if (!selinux_initialized(state)) { 1329 if (sid <= SECINITSID_NUM) { 1330 char *scontextp; 1331 const char *s = initial_sid_to_string[sid]; 1332 1333 if (!s) 1334 return -EINVAL; 1335 *scontext_len = strlen(s) + 1; 1336 if (!scontext) 1337 return 0; 1338 scontextp = kmemdup(s, *scontext_len, GFP_ATOMIC); 1339 if (!scontextp) 1340 return -ENOMEM; 1341 *scontext = scontextp; 1342 return 0; 1343 } 1344 pr_err("SELinux: %s: called before initial " 1345 "load_policy on unknown SID %d\n", __func__, sid); 1346 return -EINVAL; 1347 } 1348 rcu_read_lock(); 1349 policy = rcu_dereference(state->policy); 1350 policydb = &policy->policydb; 1351 sidtab = policy->sidtab; 1352 1353 if (force) 1354 entry = sidtab_search_entry_force(sidtab, sid); 1355 else 1356 entry = sidtab_search_entry(sidtab, sid); 1357 if (!entry) { 1358 pr_err("SELinux: %s: unrecognized SID %d\n", 1359 __func__, sid); 1360 rc = -EINVAL; 1361 goto out_unlock; 1362 } 1363 if (only_invalid && !entry->context.len) 1364 goto out_unlock; 1365 1366 rc = sidtab_entry_to_string(policydb, sidtab, entry, scontext, 1367 scontext_len); 1368 1369 out_unlock: 1370 rcu_read_unlock(); 1371 return rc; 1372 1373 } 1374 1375 /** 1376 * security_sid_to_context - Obtain a context for a given SID. 1377 * @sid: security identifier, SID 1378 * @scontext: security context 1379 * @scontext_len: length in bytes 1380 * 1381 * Write the string representation of the context associated with @sid 1382 * into a dynamically allocated string of the correct size. Set @scontext 1383 * to point to this string and set @scontext_len to the length of the string. 1384 */ 1385 int security_sid_to_context(struct selinux_state *state, 1386 u32 sid, char **scontext, u32 *scontext_len) 1387 { 1388 return security_sid_to_context_core(state, sid, scontext, 1389 scontext_len, 0, 0); 1390 } 1391 1392 int security_sid_to_context_force(struct selinux_state *state, u32 sid, 1393 char **scontext, u32 *scontext_len) 1394 { 1395 return security_sid_to_context_core(state, sid, scontext, 1396 scontext_len, 1, 0); 1397 } 1398 1399 /** 1400 * security_sid_to_context_inval - Obtain a context for a given SID if it 1401 * is invalid. 1402 * @sid: security identifier, SID 1403 * @scontext: security context 1404 * @scontext_len: length in bytes 1405 * 1406 * Write the string representation of the context associated with @sid 1407 * into a dynamically allocated string of the correct size, but only if the 1408 * context is invalid in the current policy. Set @scontext to point to 1409 * this string (or NULL if the context is valid) and set @scontext_len to 1410 * the length of the string (or 0 if the context is valid). 1411 */ 1412 int security_sid_to_context_inval(struct selinux_state *state, u32 sid, 1413 char **scontext, u32 *scontext_len) 1414 { 1415 return security_sid_to_context_core(state, sid, scontext, 1416 scontext_len, 1, 1); 1417 } 1418 1419 /* 1420 * Caveat: Mutates scontext. 1421 */ 1422 static int string_to_context_struct(struct policydb *pol, 1423 struct sidtab *sidtabp, 1424 char *scontext, 1425 struct context *ctx, 1426 u32 def_sid) 1427 { 1428 struct role_datum *role; 1429 struct type_datum *typdatum; 1430 struct user_datum *usrdatum; 1431 char *scontextp, *p, oldc; 1432 int rc = 0; 1433 1434 context_init(ctx); 1435 1436 /* Parse the security context. */ 1437 1438 rc = -EINVAL; 1439 scontextp = (char *) scontext; 1440 1441 /* Extract the user. */ 1442 p = scontextp; 1443 while (*p && *p != ':') 1444 p++; 1445 1446 if (*p == 0) 1447 goto out; 1448 1449 *p++ = 0; 1450 1451 usrdatum = symtab_search(&pol->p_users, scontextp); 1452 if (!usrdatum) 1453 goto out; 1454 1455 ctx->user = usrdatum->value; 1456 1457 /* Extract role. */ 1458 scontextp = p; 1459 while (*p && *p != ':') 1460 p++; 1461 1462 if (*p == 0) 1463 goto out; 1464 1465 *p++ = 0; 1466 1467 role = symtab_search(&pol->p_roles, scontextp); 1468 if (!role) 1469 goto out; 1470 ctx->role = role->value; 1471 1472 /* Extract type. */ 1473 scontextp = p; 1474 while (*p && *p != ':') 1475 p++; 1476 oldc = *p; 1477 *p++ = 0; 1478 1479 typdatum = symtab_search(&pol->p_types, scontextp); 1480 if (!typdatum || typdatum->attribute) 1481 goto out; 1482 1483 ctx->type = typdatum->value; 1484 1485 rc = mls_context_to_sid(pol, oldc, p, ctx, sidtabp, def_sid); 1486 if (rc) 1487 goto out; 1488 1489 /* Check the validity of the new context. */ 1490 rc = -EINVAL; 1491 if (!policydb_context_isvalid(pol, ctx)) 1492 goto out; 1493 rc = 0; 1494 out: 1495 if (rc) 1496 context_destroy(ctx); 1497 return rc; 1498 } 1499 1500 static int security_context_to_sid_core(struct selinux_state *state, 1501 const char *scontext, u32 scontext_len, 1502 u32 *sid, u32 def_sid, gfp_t gfp_flags, 1503 int force) 1504 { 1505 struct selinux_policy *policy; 1506 struct policydb *policydb; 1507 struct sidtab *sidtab; 1508 char *scontext2, *str = NULL; 1509 struct context context; 1510 int rc = 0; 1511 1512 /* An empty security context is never valid. */ 1513 if (!scontext_len) 1514 return -EINVAL; 1515 1516 /* Copy the string to allow changes and ensure a NUL terminator */ 1517 scontext2 = kmemdup_nul(scontext, scontext_len, gfp_flags); 1518 if (!scontext2) 1519 return -ENOMEM; 1520 1521 if (!selinux_initialized(state)) { 1522 int i; 1523 1524 for (i = 1; i < SECINITSID_NUM; i++) { 1525 const char *s = initial_sid_to_string[i]; 1526 1527 if (s && !strcmp(s, scontext2)) { 1528 *sid = i; 1529 goto out; 1530 } 1531 } 1532 *sid = SECINITSID_KERNEL; 1533 goto out; 1534 } 1535 *sid = SECSID_NULL; 1536 1537 if (force) { 1538 /* Save another copy for storing in uninterpreted form */ 1539 rc = -ENOMEM; 1540 str = kstrdup(scontext2, gfp_flags); 1541 if (!str) 1542 goto out; 1543 } 1544 rcu_read_lock(); 1545 policy = rcu_dereference(state->policy); 1546 policydb = &policy->policydb; 1547 sidtab = policy->sidtab; 1548 rc = string_to_context_struct(policydb, sidtab, scontext2, 1549 &context, def_sid); 1550 if (rc == -EINVAL && force) { 1551 context.str = str; 1552 context.len = strlen(str) + 1; 1553 str = NULL; 1554 } else if (rc) 1555 goto out_unlock; 1556 rc = sidtab_context_to_sid(sidtab, &context, sid); 1557 context_destroy(&context); 1558 out_unlock: 1559 rcu_read_unlock(); 1560 out: 1561 kfree(scontext2); 1562 kfree(str); 1563 return rc; 1564 } 1565 1566 /** 1567 * security_context_to_sid - Obtain a SID for a given security context. 1568 * @scontext: security context 1569 * @scontext_len: length in bytes 1570 * @sid: security identifier, SID 1571 * @gfp: context for the allocation 1572 * 1573 * Obtains a SID associated with the security context that 1574 * has the string representation specified by @scontext. 1575 * Returns -%EINVAL if the context is invalid, -%ENOMEM if insufficient 1576 * memory is available, or 0 on success. 1577 */ 1578 int security_context_to_sid(struct selinux_state *state, 1579 const char *scontext, u32 scontext_len, u32 *sid, 1580 gfp_t gfp) 1581 { 1582 return security_context_to_sid_core(state, scontext, scontext_len, 1583 sid, SECSID_NULL, gfp, 0); 1584 } 1585 1586 int security_context_str_to_sid(struct selinux_state *state, 1587 const char *scontext, u32 *sid, gfp_t gfp) 1588 { 1589 return security_context_to_sid(state, scontext, strlen(scontext), 1590 sid, gfp); 1591 } 1592 1593 /** 1594 * security_context_to_sid_default - Obtain a SID for a given security context, 1595 * falling back to specified default if needed. 1596 * 1597 * @scontext: security context 1598 * @scontext_len: length in bytes 1599 * @sid: security identifier, SID 1600 * @def_sid: default SID to assign on error 1601 * 1602 * Obtains a SID associated with the security context that 1603 * has the string representation specified by @scontext. 1604 * The default SID is passed to the MLS layer to be used to allow 1605 * kernel labeling of the MLS field if the MLS field is not present 1606 * (for upgrading to MLS without full relabel). 1607 * Implicitly forces adding of the context even if it cannot be mapped yet. 1608 * Returns -%EINVAL if the context is invalid, -%ENOMEM if insufficient 1609 * memory is available, or 0 on success. 1610 */ 1611 int security_context_to_sid_default(struct selinux_state *state, 1612 const char *scontext, u32 scontext_len, 1613 u32 *sid, u32 def_sid, gfp_t gfp_flags) 1614 { 1615 return security_context_to_sid_core(state, scontext, scontext_len, 1616 sid, def_sid, gfp_flags, 1); 1617 } 1618 1619 int security_context_to_sid_force(struct selinux_state *state, 1620 const char *scontext, u32 scontext_len, 1621 u32 *sid) 1622 { 1623 return security_context_to_sid_core(state, scontext, scontext_len, 1624 sid, SECSID_NULL, GFP_KERNEL, 1); 1625 } 1626 1627 static int compute_sid_handle_invalid_context( 1628 struct selinux_state *state, 1629 struct selinux_policy *policy, 1630 struct sidtab_entry *sentry, 1631 struct sidtab_entry *tentry, 1632 u16 tclass, 1633 struct context *newcontext) 1634 { 1635 struct policydb *policydb = &policy->policydb; 1636 struct sidtab *sidtab = policy->sidtab; 1637 char *s = NULL, *t = NULL, *n = NULL; 1638 u32 slen, tlen, nlen; 1639 struct audit_buffer *ab; 1640 1641 if (sidtab_entry_to_string(policydb, sidtab, sentry, &s, &slen)) 1642 goto out; 1643 if (sidtab_entry_to_string(policydb, sidtab, tentry, &t, &tlen)) 1644 goto out; 1645 if (context_struct_to_string(policydb, newcontext, &n, &nlen)) 1646 goto out; 1647 ab = audit_log_start(audit_context(), GFP_ATOMIC, AUDIT_SELINUX_ERR); 1648 audit_log_format(ab, 1649 "op=security_compute_sid invalid_context="); 1650 /* no need to record the NUL with untrusted strings */ 1651 audit_log_n_untrustedstring(ab, n, nlen - 1); 1652 audit_log_format(ab, " scontext=%s tcontext=%s tclass=%s", 1653 s, t, sym_name(policydb, SYM_CLASSES, tclass-1)); 1654 audit_log_end(ab); 1655 out: 1656 kfree(s); 1657 kfree(t); 1658 kfree(n); 1659 if (!enforcing_enabled(state)) 1660 return 0; 1661 return -EACCES; 1662 } 1663 1664 static void filename_compute_type(struct policydb *policydb, 1665 struct context *newcontext, 1666 u32 stype, u32 ttype, u16 tclass, 1667 const char *objname) 1668 { 1669 struct filename_trans_key ft; 1670 struct filename_trans_datum *datum; 1671 1672 /* 1673 * Most filename trans rules are going to live in specific directories 1674 * like /dev or /var/run. This bitmap will quickly skip rule searches 1675 * if the ttype does not contain any rules. 1676 */ 1677 if (!ebitmap_get_bit(&policydb->filename_trans_ttypes, ttype)) 1678 return; 1679 1680 ft.ttype = ttype; 1681 ft.tclass = tclass; 1682 ft.name = objname; 1683 1684 datum = policydb_filenametr_search(policydb, &ft); 1685 while (datum) { 1686 if (ebitmap_get_bit(&datum->stypes, stype - 1)) { 1687 newcontext->type = datum->otype; 1688 return; 1689 } 1690 datum = datum->next; 1691 } 1692 } 1693 1694 static int security_compute_sid(struct selinux_state *state, 1695 u32 ssid, 1696 u32 tsid, 1697 u16 orig_tclass, 1698 u32 specified, 1699 const char *objname, 1700 u32 *out_sid, 1701 bool kern) 1702 { 1703 struct selinux_policy *policy; 1704 struct policydb *policydb; 1705 struct sidtab *sidtab; 1706 struct class_datum *cladatum = NULL; 1707 struct context *scontext, *tcontext, newcontext; 1708 struct sidtab_entry *sentry, *tentry; 1709 struct avtab_key avkey; 1710 struct avtab_datum *avdatum; 1711 struct avtab_node *node; 1712 u16 tclass; 1713 int rc = 0; 1714 bool sock; 1715 1716 if (!selinux_initialized(state)) { 1717 switch (orig_tclass) { 1718 case SECCLASS_PROCESS: /* kernel value */ 1719 *out_sid = ssid; 1720 break; 1721 default: 1722 *out_sid = tsid; 1723 break; 1724 } 1725 goto out; 1726 } 1727 1728 context_init(&newcontext); 1729 1730 rcu_read_lock(); 1731 1732 policy = rcu_dereference(state->policy); 1733 1734 if (kern) { 1735 tclass = unmap_class(&policy->map, orig_tclass); 1736 sock = security_is_socket_class(orig_tclass); 1737 } else { 1738 tclass = orig_tclass; 1739 sock = security_is_socket_class(map_class(&policy->map, 1740 tclass)); 1741 } 1742 1743 policydb = &policy->policydb; 1744 sidtab = policy->sidtab; 1745 1746 sentry = sidtab_search_entry(sidtab, ssid); 1747 if (!sentry) { 1748 pr_err("SELinux: %s: unrecognized SID %d\n", 1749 __func__, ssid); 1750 rc = -EINVAL; 1751 goto out_unlock; 1752 } 1753 tentry = sidtab_search_entry(sidtab, tsid); 1754 if (!tentry) { 1755 pr_err("SELinux: %s: unrecognized SID %d\n", 1756 __func__, tsid); 1757 rc = -EINVAL; 1758 goto out_unlock; 1759 } 1760 1761 scontext = &sentry->context; 1762 tcontext = &tentry->context; 1763 1764 if (tclass && tclass <= policydb->p_classes.nprim) 1765 cladatum = policydb->class_val_to_struct[tclass - 1]; 1766 1767 /* Set the user identity. */ 1768 switch (specified) { 1769 case AVTAB_TRANSITION: 1770 case AVTAB_CHANGE: 1771 if (cladatum && cladatum->default_user == DEFAULT_TARGET) { 1772 newcontext.user = tcontext->user; 1773 } else { 1774 /* notice this gets both DEFAULT_SOURCE and unset */ 1775 /* Use the process user identity. */ 1776 newcontext.user = scontext->user; 1777 } 1778 break; 1779 case AVTAB_MEMBER: 1780 /* Use the related object owner. */ 1781 newcontext.user = tcontext->user; 1782 break; 1783 } 1784 1785 /* Set the role to default values. */ 1786 if (cladatum && cladatum->default_role == DEFAULT_SOURCE) { 1787 newcontext.role = scontext->role; 1788 } else if (cladatum && cladatum->default_role == DEFAULT_TARGET) { 1789 newcontext.role = tcontext->role; 1790 } else { 1791 if ((tclass == policydb->process_class) || sock) 1792 newcontext.role = scontext->role; 1793 else 1794 newcontext.role = OBJECT_R_VAL; 1795 } 1796 1797 /* Set the type to default values. */ 1798 if (cladatum && cladatum->default_type == DEFAULT_SOURCE) { 1799 newcontext.type = scontext->type; 1800 } else if (cladatum && cladatum->default_type == DEFAULT_TARGET) { 1801 newcontext.type = tcontext->type; 1802 } else { 1803 if ((tclass == policydb->process_class) || sock) { 1804 /* Use the type of process. */ 1805 newcontext.type = scontext->type; 1806 } else { 1807 /* Use the type of the related object. */ 1808 newcontext.type = tcontext->type; 1809 } 1810 } 1811 1812 /* Look for a type transition/member/change rule. */ 1813 avkey.source_type = scontext->type; 1814 avkey.target_type = tcontext->type; 1815 avkey.target_class = tclass; 1816 avkey.specified = specified; 1817 avdatum = avtab_search(&policydb->te_avtab, &avkey); 1818 1819 /* If no permanent rule, also check for enabled conditional rules */ 1820 if (!avdatum) { 1821 node = avtab_search_node(&policydb->te_cond_avtab, &avkey); 1822 for (; node; node = avtab_search_node_next(node, specified)) { 1823 if (node->key.specified & AVTAB_ENABLED) { 1824 avdatum = &node->datum; 1825 break; 1826 } 1827 } 1828 } 1829 1830 if (avdatum) { 1831 /* Use the type from the type transition/member/change rule. */ 1832 newcontext.type = avdatum->u.data; 1833 } 1834 1835 /* if we have a objname this is a file trans check so check those rules */ 1836 if (objname) 1837 filename_compute_type(policydb, &newcontext, scontext->type, 1838 tcontext->type, tclass, objname); 1839 1840 /* Check for class-specific changes. */ 1841 if (specified & AVTAB_TRANSITION) { 1842 /* Look for a role transition rule. */ 1843 struct role_trans_datum *rtd; 1844 struct role_trans_key rtk = { 1845 .role = scontext->role, 1846 .type = tcontext->type, 1847 .tclass = tclass, 1848 }; 1849 1850 rtd = policydb_roletr_search(policydb, &rtk); 1851 if (rtd) 1852 newcontext.role = rtd->new_role; 1853 } 1854 1855 /* Set the MLS attributes. 1856 This is done last because it may allocate memory. */ 1857 rc = mls_compute_sid(policydb, scontext, tcontext, tclass, specified, 1858 &newcontext, sock); 1859 if (rc) 1860 goto out_unlock; 1861 1862 /* Check the validity of the context. */ 1863 if (!policydb_context_isvalid(policydb, &newcontext)) { 1864 rc = compute_sid_handle_invalid_context(state, policy, sentry, 1865 tentry, tclass, 1866 &newcontext); 1867 if (rc) 1868 goto out_unlock; 1869 } 1870 /* Obtain the sid for the context. */ 1871 rc = sidtab_context_to_sid(sidtab, &newcontext, out_sid); 1872 out_unlock: 1873 rcu_read_unlock(); 1874 context_destroy(&newcontext); 1875 out: 1876 return rc; 1877 } 1878 1879 /** 1880 * security_transition_sid - Compute the SID for a new subject/object. 1881 * @ssid: source security identifier 1882 * @tsid: target security identifier 1883 * @tclass: target security class 1884 * @out_sid: security identifier for new subject/object 1885 * 1886 * Compute a SID to use for labeling a new subject or object in the 1887 * class @tclass based on a SID pair (@ssid, @tsid). 1888 * Return -%EINVAL if any of the parameters are invalid, -%ENOMEM 1889 * if insufficient memory is available, or %0 if the new SID was 1890 * computed successfully. 1891 */ 1892 int security_transition_sid(struct selinux_state *state, 1893 u32 ssid, u32 tsid, u16 tclass, 1894 const struct qstr *qstr, u32 *out_sid) 1895 { 1896 return security_compute_sid(state, ssid, tsid, tclass, 1897 AVTAB_TRANSITION, 1898 qstr ? qstr->name : NULL, out_sid, true); 1899 } 1900 1901 int security_transition_sid_user(struct selinux_state *state, 1902 u32 ssid, u32 tsid, u16 tclass, 1903 const char *objname, u32 *out_sid) 1904 { 1905 return security_compute_sid(state, ssid, tsid, tclass, 1906 AVTAB_TRANSITION, 1907 objname, out_sid, false); 1908 } 1909 1910 /** 1911 * security_member_sid - Compute the SID for member selection. 1912 * @ssid: source security identifier 1913 * @tsid: target security identifier 1914 * @tclass: target security class 1915 * @out_sid: security identifier for selected member 1916 * 1917 * Compute a SID to use when selecting a member of a polyinstantiated 1918 * object of class @tclass based on a SID pair (@ssid, @tsid). 1919 * Return -%EINVAL if any of the parameters are invalid, -%ENOMEM 1920 * if insufficient memory is available, or %0 if the SID was 1921 * computed successfully. 1922 */ 1923 int security_member_sid(struct selinux_state *state, 1924 u32 ssid, 1925 u32 tsid, 1926 u16 tclass, 1927 u32 *out_sid) 1928 { 1929 return security_compute_sid(state, ssid, tsid, tclass, 1930 AVTAB_MEMBER, NULL, 1931 out_sid, false); 1932 } 1933 1934 /** 1935 * security_change_sid - Compute the SID for object relabeling. 1936 * @ssid: source security identifier 1937 * @tsid: target security identifier 1938 * @tclass: target security class 1939 * @out_sid: security identifier for selected member 1940 * 1941 * Compute a SID to use for relabeling an object of class @tclass 1942 * based on a SID pair (@ssid, @tsid). 1943 * Return -%EINVAL if any of the parameters are invalid, -%ENOMEM 1944 * if insufficient memory is available, or %0 if the SID was 1945 * computed successfully. 1946 */ 1947 int security_change_sid(struct selinux_state *state, 1948 u32 ssid, 1949 u32 tsid, 1950 u16 tclass, 1951 u32 *out_sid) 1952 { 1953 return security_compute_sid(state, 1954 ssid, tsid, tclass, AVTAB_CHANGE, NULL, 1955 out_sid, false); 1956 } 1957 1958 static inline int convert_context_handle_invalid_context( 1959 struct selinux_state *state, 1960 struct policydb *policydb, 1961 struct context *context) 1962 { 1963 char *s; 1964 u32 len; 1965 1966 if (enforcing_enabled(state)) 1967 return -EINVAL; 1968 1969 if (!context_struct_to_string(policydb, context, &s, &len)) { 1970 pr_warn("SELinux: Context %s would be invalid if enforcing\n", 1971 s); 1972 kfree(s); 1973 } 1974 return 0; 1975 } 1976 1977 struct convert_context_args { 1978 struct selinux_state *state; 1979 struct policydb *oldp; 1980 struct policydb *newp; 1981 }; 1982 1983 /* 1984 * Convert the values in the security context 1985 * structure `oldc' from the values specified 1986 * in the policy `p->oldp' to the values specified 1987 * in the policy `p->newp', storing the new context 1988 * in `newc'. Verify that the context is valid 1989 * under the new policy. 1990 */ 1991 static int convert_context(struct context *oldc, struct context *newc, void *p) 1992 { 1993 struct convert_context_args *args; 1994 struct ocontext *oc; 1995 struct role_datum *role; 1996 struct type_datum *typdatum; 1997 struct user_datum *usrdatum; 1998 char *s; 1999 u32 len; 2000 int rc; 2001 2002 args = p; 2003 2004 if (oldc->str) { 2005 s = kstrdup(oldc->str, GFP_KERNEL); 2006 if (!s) 2007 return -ENOMEM; 2008 2009 rc = string_to_context_struct(args->newp, NULL, s, 2010 newc, SECSID_NULL); 2011 if (rc == -EINVAL) { 2012 /* 2013 * Retain string representation for later mapping. 2014 * 2015 * IMPORTANT: We need to copy the contents of oldc->str 2016 * back into s again because string_to_context_struct() 2017 * may have garbled it. 2018 */ 2019 memcpy(s, oldc->str, oldc->len); 2020 context_init(newc); 2021 newc->str = s; 2022 newc->len = oldc->len; 2023 return 0; 2024 } 2025 kfree(s); 2026 if (rc) { 2027 /* Other error condition, e.g. ENOMEM. */ 2028 pr_err("SELinux: Unable to map context %s, rc = %d.\n", 2029 oldc->str, -rc); 2030 return rc; 2031 } 2032 pr_info("SELinux: Context %s became valid (mapped).\n", 2033 oldc->str); 2034 return 0; 2035 } 2036 2037 context_init(newc); 2038 2039 /* Convert the user. */ 2040 rc = -EINVAL; 2041 usrdatum = symtab_search(&args->newp->p_users, 2042 sym_name(args->oldp, 2043 SYM_USERS, oldc->user - 1)); 2044 if (!usrdatum) 2045 goto bad; 2046 newc->user = usrdatum->value; 2047 2048 /* Convert the role. */ 2049 rc = -EINVAL; 2050 role = symtab_search(&args->newp->p_roles, 2051 sym_name(args->oldp, SYM_ROLES, oldc->role - 1)); 2052 if (!role) 2053 goto bad; 2054 newc->role = role->value; 2055 2056 /* Convert the type. */ 2057 rc = -EINVAL; 2058 typdatum = symtab_search(&args->newp->p_types, 2059 sym_name(args->oldp, 2060 SYM_TYPES, oldc->type - 1)); 2061 if (!typdatum) 2062 goto bad; 2063 newc->type = typdatum->value; 2064 2065 /* Convert the MLS fields if dealing with MLS policies */ 2066 if (args->oldp->mls_enabled && args->newp->mls_enabled) { 2067 rc = mls_convert_context(args->oldp, args->newp, oldc, newc); 2068 if (rc) 2069 goto bad; 2070 } else if (!args->oldp->mls_enabled && args->newp->mls_enabled) { 2071 /* 2072 * Switching between non-MLS and MLS policy: 2073 * ensure that the MLS fields of the context for all 2074 * existing entries in the sidtab are filled in with a 2075 * suitable default value, likely taken from one of the 2076 * initial SIDs. 2077 */ 2078 oc = args->newp->ocontexts[OCON_ISID]; 2079 while (oc && oc->sid[0] != SECINITSID_UNLABELED) 2080 oc = oc->next; 2081 rc = -EINVAL; 2082 if (!oc) { 2083 pr_err("SELinux: unable to look up" 2084 " the initial SIDs list\n"); 2085 goto bad; 2086 } 2087 rc = mls_range_set(newc, &oc->context[0].range); 2088 if (rc) 2089 goto bad; 2090 } 2091 2092 /* Check the validity of the new context. */ 2093 if (!policydb_context_isvalid(args->newp, newc)) { 2094 rc = convert_context_handle_invalid_context(args->state, 2095 args->oldp, 2096 oldc); 2097 if (rc) 2098 goto bad; 2099 } 2100 2101 return 0; 2102 bad: 2103 /* Map old representation to string and save it. */ 2104 rc = context_struct_to_string(args->oldp, oldc, &s, &len); 2105 if (rc) 2106 return rc; 2107 context_destroy(newc); 2108 newc->str = s; 2109 newc->len = len; 2110 pr_info("SELinux: Context %s became invalid (unmapped).\n", 2111 newc->str); 2112 return 0; 2113 } 2114 2115 static void security_load_policycaps(struct selinux_state *state, 2116 struct selinux_policy *policy) 2117 { 2118 struct policydb *p; 2119 unsigned int i; 2120 struct ebitmap_node *node; 2121 2122 p = &policy->policydb; 2123 2124 for (i = 0; i < ARRAY_SIZE(state->policycap); i++) 2125 WRITE_ONCE(state->policycap[i], 2126 ebitmap_get_bit(&p->policycaps, i)); 2127 2128 for (i = 0; i < ARRAY_SIZE(selinux_policycap_names); i++) 2129 pr_info("SELinux: policy capability %s=%d\n", 2130 selinux_policycap_names[i], 2131 ebitmap_get_bit(&p->policycaps, i)); 2132 2133 ebitmap_for_each_positive_bit(&p->policycaps, node, i) { 2134 if (i >= ARRAY_SIZE(selinux_policycap_names)) 2135 pr_info("SELinux: unknown policy capability %u\n", 2136 i); 2137 } 2138 } 2139 2140 static int security_preserve_bools(struct selinux_policy *oldpolicy, 2141 struct selinux_policy *newpolicy); 2142 2143 static void selinux_policy_free(struct selinux_policy *policy) 2144 { 2145 if (!policy) 2146 return; 2147 2148 sidtab_destroy(policy->sidtab); 2149 kfree(policy->map.mapping); 2150 policydb_destroy(&policy->policydb); 2151 kfree(policy->sidtab); 2152 kfree(policy); 2153 } 2154 2155 static void selinux_policy_cond_free(struct selinux_policy *policy) 2156 { 2157 cond_policydb_destroy_dup(&policy->policydb); 2158 kfree(policy); 2159 } 2160 2161 void selinux_policy_cancel(struct selinux_state *state, 2162 struct selinux_policy *policy) 2163 { 2164 struct selinux_policy *oldpolicy; 2165 2166 oldpolicy = rcu_dereference_protected(state->policy, 2167 lockdep_is_held(&state->policy_mutex)); 2168 2169 sidtab_cancel_convert(oldpolicy->sidtab); 2170 selinux_policy_free(policy); 2171 } 2172 2173 static void selinux_notify_policy_change(struct selinux_state *state, 2174 u32 seqno) 2175 { 2176 /* Flush external caches and notify userspace of policy load */ 2177 avc_ss_reset(state->avc, seqno); 2178 selnl_notify_policyload(seqno); 2179 selinux_status_update_policyload(state, seqno); 2180 selinux_netlbl_cache_invalidate(); 2181 selinux_xfrm_notify_policyload(); 2182 selinux_ima_measure_state(state); 2183 } 2184 2185 void selinux_policy_commit(struct selinux_state *state, 2186 struct selinux_policy *newpolicy) 2187 { 2188 struct selinux_policy *oldpolicy; 2189 u32 seqno; 2190 2191 oldpolicy = rcu_dereference_protected(state->policy, 2192 lockdep_is_held(&state->policy_mutex)); 2193 2194 /* If switching between different policy types, log MLS status */ 2195 if (oldpolicy) { 2196 if (oldpolicy->policydb.mls_enabled && !newpolicy->policydb.mls_enabled) 2197 pr_info("SELinux: Disabling MLS support...\n"); 2198 else if (!oldpolicy->policydb.mls_enabled && newpolicy->policydb.mls_enabled) 2199 pr_info("SELinux: Enabling MLS support...\n"); 2200 } 2201 2202 /* Set latest granting seqno for new policy. */ 2203 if (oldpolicy) 2204 newpolicy->latest_granting = oldpolicy->latest_granting + 1; 2205 else 2206 newpolicy->latest_granting = 1; 2207 seqno = newpolicy->latest_granting; 2208 2209 /* Install the new policy. */ 2210 rcu_assign_pointer(state->policy, newpolicy); 2211 2212 /* Load the policycaps from the new policy */ 2213 security_load_policycaps(state, newpolicy); 2214 2215 if (!selinux_initialized(state)) { 2216 /* 2217 * After first policy load, the security server is 2218 * marked as initialized and ready to handle requests and 2219 * any objects created prior to policy load are then labeled. 2220 */ 2221 selinux_mark_initialized(state); 2222 selinux_complete_init(); 2223 } 2224 2225 /* Free the old policy */ 2226 synchronize_rcu(); 2227 selinux_policy_free(oldpolicy); 2228 2229 /* Notify others of the policy change */ 2230 selinux_notify_policy_change(state, seqno); 2231 } 2232 2233 /** 2234 * security_load_policy - Load a security policy configuration. 2235 * @data: binary policy data 2236 * @len: length of data in bytes 2237 * 2238 * Load a new set of security policy configuration data, 2239 * validate it and convert the SID table as necessary. 2240 * This function will flush the access vector cache after 2241 * loading the new policy. 2242 */ 2243 int security_load_policy(struct selinux_state *state, void *data, size_t len, 2244 struct selinux_policy **newpolicyp) 2245 { 2246 struct selinux_policy *newpolicy, *oldpolicy; 2247 struct sidtab_convert_params convert_params; 2248 struct convert_context_args args; 2249 int rc = 0; 2250 struct policy_file file = { data, len }, *fp = &file; 2251 2252 newpolicy = kzalloc(sizeof(*newpolicy), GFP_KERNEL); 2253 if (!newpolicy) 2254 return -ENOMEM; 2255 2256 newpolicy->sidtab = kzalloc(sizeof(*newpolicy->sidtab), GFP_KERNEL); 2257 if (!newpolicy->sidtab) { 2258 rc = -ENOMEM; 2259 goto err_policy; 2260 } 2261 2262 rc = policydb_read(&newpolicy->policydb, fp); 2263 if (rc) 2264 goto err_sidtab; 2265 2266 newpolicy->policydb.len = len; 2267 rc = selinux_set_mapping(&newpolicy->policydb, secclass_map, 2268 &newpolicy->map); 2269 if (rc) 2270 goto err_policydb; 2271 2272 rc = policydb_load_isids(&newpolicy->policydb, newpolicy->sidtab); 2273 if (rc) { 2274 pr_err("SELinux: unable to load the initial SIDs\n"); 2275 goto err_mapping; 2276 } 2277 2278 2279 if (!selinux_initialized(state)) { 2280 /* First policy load, so no need to preserve state from old policy */ 2281 *newpolicyp = newpolicy; 2282 return 0; 2283 } 2284 2285 oldpolicy = rcu_dereference_protected(state->policy, 2286 lockdep_is_held(&state->policy_mutex)); 2287 2288 /* Preserve active boolean values from the old policy */ 2289 rc = security_preserve_bools(oldpolicy, newpolicy); 2290 if (rc) { 2291 pr_err("SELinux: unable to preserve booleans\n"); 2292 goto err_free_isids; 2293 } 2294 2295 /* 2296 * Convert the internal representations of contexts 2297 * in the new SID table. 2298 */ 2299 args.state = state; 2300 args.oldp = &oldpolicy->policydb; 2301 args.newp = &newpolicy->policydb; 2302 2303 convert_params.func = convert_context; 2304 convert_params.args = &args; 2305 convert_params.target = newpolicy->sidtab; 2306 2307 rc = sidtab_convert(oldpolicy->sidtab, &convert_params); 2308 if (rc) { 2309 pr_err("SELinux: unable to convert the internal" 2310 " representation of contexts in the new SID" 2311 " table\n"); 2312 goto err_free_isids; 2313 } 2314 2315 *newpolicyp = newpolicy; 2316 return 0; 2317 2318 err_free_isids: 2319 sidtab_destroy(newpolicy->sidtab); 2320 err_mapping: 2321 kfree(newpolicy->map.mapping); 2322 err_policydb: 2323 policydb_destroy(&newpolicy->policydb); 2324 err_sidtab: 2325 kfree(newpolicy->sidtab); 2326 err_policy: 2327 kfree(newpolicy); 2328 2329 return rc; 2330 } 2331 2332 /** 2333 * security_port_sid - Obtain the SID for a port. 2334 * @protocol: protocol number 2335 * @port: port number 2336 * @out_sid: security identifier 2337 */ 2338 int security_port_sid(struct selinux_state *state, 2339 u8 protocol, u16 port, u32 *out_sid) 2340 { 2341 struct selinux_policy *policy; 2342 struct policydb *policydb; 2343 struct sidtab *sidtab; 2344 struct ocontext *c; 2345 int rc = 0; 2346 2347 if (!selinux_initialized(state)) { 2348 *out_sid = SECINITSID_PORT; 2349 return 0; 2350 } 2351 2352 rcu_read_lock(); 2353 policy = rcu_dereference(state->policy); 2354 policydb = &policy->policydb; 2355 sidtab = policy->sidtab; 2356 2357 c = policydb->ocontexts[OCON_PORT]; 2358 while (c) { 2359 if (c->u.port.protocol == protocol && 2360 c->u.port.low_port <= port && 2361 c->u.port.high_port >= port) 2362 break; 2363 c = c->next; 2364 } 2365 2366 if (c) { 2367 if (!c->sid[0]) { 2368 rc = sidtab_context_to_sid(sidtab, &c->context[0], 2369 &c->sid[0]); 2370 if (rc) 2371 goto out; 2372 } 2373 *out_sid = c->sid[0]; 2374 } else { 2375 *out_sid = SECINITSID_PORT; 2376 } 2377 2378 out: 2379 rcu_read_unlock(); 2380 return rc; 2381 } 2382 2383 /** 2384 * security_pkey_sid - Obtain the SID for a pkey. 2385 * @subnet_prefix: Subnet Prefix 2386 * @pkey_num: pkey number 2387 * @out_sid: security identifier 2388 */ 2389 int security_ib_pkey_sid(struct selinux_state *state, 2390 u64 subnet_prefix, u16 pkey_num, u32 *out_sid) 2391 { 2392 struct selinux_policy *policy; 2393 struct policydb *policydb; 2394 struct sidtab *sidtab; 2395 struct ocontext *c; 2396 int rc = 0; 2397 2398 if (!selinux_initialized(state)) { 2399 *out_sid = SECINITSID_UNLABELED; 2400 return 0; 2401 } 2402 2403 rcu_read_lock(); 2404 policy = rcu_dereference(state->policy); 2405 policydb = &policy->policydb; 2406 sidtab = policy->sidtab; 2407 2408 c = policydb->ocontexts[OCON_IBPKEY]; 2409 while (c) { 2410 if (c->u.ibpkey.low_pkey <= pkey_num && 2411 c->u.ibpkey.high_pkey >= pkey_num && 2412 c->u.ibpkey.subnet_prefix == subnet_prefix) 2413 break; 2414 2415 c = c->next; 2416 } 2417 2418 if (c) { 2419 if (!c->sid[0]) { 2420 rc = sidtab_context_to_sid(sidtab, 2421 &c->context[0], 2422 &c->sid[0]); 2423 if (rc) 2424 goto out; 2425 } 2426 *out_sid = c->sid[0]; 2427 } else 2428 *out_sid = SECINITSID_UNLABELED; 2429 2430 out: 2431 rcu_read_unlock(); 2432 return rc; 2433 } 2434 2435 /** 2436 * security_ib_endport_sid - Obtain the SID for a subnet management interface. 2437 * @dev_name: device name 2438 * @port: port number 2439 * @out_sid: security identifier 2440 */ 2441 int security_ib_endport_sid(struct selinux_state *state, 2442 const char *dev_name, u8 port_num, u32 *out_sid) 2443 { 2444 struct selinux_policy *policy; 2445 struct policydb *policydb; 2446 struct sidtab *sidtab; 2447 struct ocontext *c; 2448 int rc = 0; 2449 2450 if (!selinux_initialized(state)) { 2451 *out_sid = SECINITSID_UNLABELED; 2452 return 0; 2453 } 2454 2455 rcu_read_lock(); 2456 policy = rcu_dereference(state->policy); 2457 policydb = &policy->policydb; 2458 sidtab = policy->sidtab; 2459 2460 c = policydb->ocontexts[OCON_IBENDPORT]; 2461 while (c) { 2462 if (c->u.ibendport.port == port_num && 2463 !strncmp(c->u.ibendport.dev_name, 2464 dev_name, 2465 IB_DEVICE_NAME_MAX)) 2466 break; 2467 2468 c = c->next; 2469 } 2470 2471 if (c) { 2472 if (!c->sid[0]) { 2473 rc = sidtab_context_to_sid(sidtab, &c->context[0], 2474 &c->sid[0]); 2475 if (rc) 2476 goto out; 2477 } 2478 *out_sid = c->sid[0]; 2479 } else 2480 *out_sid = SECINITSID_UNLABELED; 2481 2482 out: 2483 rcu_read_unlock(); 2484 return rc; 2485 } 2486 2487 /** 2488 * security_netif_sid - Obtain the SID for a network interface. 2489 * @name: interface name 2490 * @if_sid: interface SID 2491 */ 2492 int security_netif_sid(struct selinux_state *state, 2493 char *name, u32 *if_sid) 2494 { 2495 struct selinux_policy *policy; 2496 struct policydb *policydb; 2497 struct sidtab *sidtab; 2498 int rc = 0; 2499 struct ocontext *c; 2500 2501 if (!selinux_initialized(state)) { 2502 *if_sid = SECINITSID_NETIF; 2503 return 0; 2504 } 2505 2506 rcu_read_lock(); 2507 policy = rcu_dereference(state->policy); 2508 policydb = &policy->policydb; 2509 sidtab = policy->sidtab; 2510 2511 c = policydb->ocontexts[OCON_NETIF]; 2512 while (c) { 2513 if (strcmp(name, c->u.name) == 0) 2514 break; 2515 c = c->next; 2516 } 2517 2518 if (c) { 2519 if (!c->sid[0] || !c->sid[1]) { 2520 rc = sidtab_context_to_sid(sidtab, &c->context[0], 2521 &c->sid[0]); 2522 if (rc) 2523 goto out; 2524 rc = sidtab_context_to_sid(sidtab, &c->context[1], 2525 &c->sid[1]); 2526 if (rc) 2527 goto out; 2528 } 2529 *if_sid = c->sid[0]; 2530 } else 2531 *if_sid = SECINITSID_NETIF; 2532 2533 out: 2534 rcu_read_unlock(); 2535 return rc; 2536 } 2537 2538 static int match_ipv6_addrmask(u32 *input, u32 *addr, u32 *mask) 2539 { 2540 int i, fail = 0; 2541 2542 for (i = 0; i < 4; i++) 2543 if (addr[i] != (input[i] & mask[i])) { 2544 fail = 1; 2545 break; 2546 } 2547 2548 return !fail; 2549 } 2550 2551 /** 2552 * security_node_sid - Obtain the SID for a node (host). 2553 * @domain: communication domain aka address family 2554 * @addrp: address 2555 * @addrlen: address length in bytes 2556 * @out_sid: security identifier 2557 */ 2558 int security_node_sid(struct selinux_state *state, 2559 u16 domain, 2560 void *addrp, 2561 u32 addrlen, 2562 u32 *out_sid) 2563 { 2564 struct selinux_policy *policy; 2565 struct policydb *policydb; 2566 struct sidtab *sidtab; 2567 int rc; 2568 struct ocontext *c; 2569 2570 if (!selinux_initialized(state)) { 2571 *out_sid = SECINITSID_NODE; 2572 return 0; 2573 } 2574 2575 rcu_read_lock(); 2576 policy = rcu_dereference(state->policy); 2577 policydb = &policy->policydb; 2578 sidtab = policy->sidtab; 2579 2580 switch (domain) { 2581 case AF_INET: { 2582 u32 addr; 2583 2584 rc = -EINVAL; 2585 if (addrlen != sizeof(u32)) 2586 goto out; 2587 2588 addr = *((u32 *)addrp); 2589 2590 c = policydb->ocontexts[OCON_NODE]; 2591 while (c) { 2592 if (c->u.node.addr == (addr & c->u.node.mask)) 2593 break; 2594 c = c->next; 2595 } 2596 break; 2597 } 2598 2599 case AF_INET6: 2600 rc = -EINVAL; 2601 if (addrlen != sizeof(u64) * 2) 2602 goto out; 2603 c = policydb->ocontexts[OCON_NODE6]; 2604 while (c) { 2605 if (match_ipv6_addrmask(addrp, c->u.node6.addr, 2606 c->u.node6.mask)) 2607 break; 2608 c = c->next; 2609 } 2610 break; 2611 2612 default: 2613 rc = 0; 2614 *out_sid = SECINITSID_NODE; 2615 goto out; 2616 } 2617 2618 if (c) { 2619 if (!c->sid[0]) { 2620 rc = sidtab_context_to_sid(sidtab, 2621 &c->context[0], 2622 &c->sid[0]); 2623 if (rc) 2624 goto out; 2625 } 2626 *out_sid = c->sid[0]; 2627 } else { 2628 *out_sid = SECINITSID_NODE; 2629 } 2630 2631 rc = 0; 2632 out: 2633 rcu_read_unlock(); 2634 return rc; 2635 } 2636 2637 #define SIDS_NEL 25 2638 2639 /** 2640 * security_get_user_sids - Obtain reachable SIDs for a user. 2641 * @fromsid: starting SID 2642 * @username: username 2643 * @sids: array of reachable SIDs for user 2644 * @nel: number of elements in @sids 2645 * 2646 * Generate the set of SIDs for legal security contexts 2647 * for a given user that can be reached by @fromsid. 2648 * Set *@sids to point to a dynamically allocated 2649 * array containing the set of SIDs. Set *@nel to the 2650 * number of elements in the array. 2651 */ 2652 2653 int security_get_user_sids(struct selinux_state *state, 2654 u32 fromsid, 2655 char *username, 2656 u32 **sids, 2657 u32 *nel) 2658 { 2659 struct selinux_policy *policy; 2660 struct policydb *policydb; 2661 struct sidtab *sidtab; 2662 struct context *fromcon, usercon; 2663 u32 *mysids = NULL, *mysids2, sid; 2664 u32 mynel = 0, maxnel = SIDS_NEL; 2665 struct user_datum *user; 2666 struct role_datum *role; 2667 struct ebitmap_node *rnode, *tnode; 2668 int rc = 0, i, j; 2669 2670 *sids = NULL; 2671 *nel = 0; 2672 2673 if (!selinux_initialized(state)) 2674 goto out; 2675 2676 rcu_read_lock(); 2677 policy = rcu_dereference(state->policy); 2678 policydb = &policy->policydb; 2679 sidtab = policy->sidtab; 2680 2681 context_init(&usercon); 2682 2683 rc = -EINVAL; 2684 fromcon = sidtab_search(sidtab, fromsid); 2685 if (!fromcon) 2686 goto out_unlock; 2687 2688 rc = -EINVAL; 2689 user = symtab_search(&policydb->p_users, username); 2690 if (!user) 2691 goto out_unlock; 2692 2693 usercon.user = user->value; 2694 2695 rc = -ENOMEM; 2696 mysids = kcalloc(maxnel, sizeof(*mysids), GFP_ATOMIC); 2697 if (!mysids) 2698 goto out_unlock; 2699 2700 ebitmap_for_each_positive_bit(&user->roles, rnode, i) { 2701 role = policydb->role_val_to_struct[i]; 2702 usercon.role = i + 1; 2703 ebitmap_for_each_positive_bit(&role->types, tnode, j) { 2704 usercon.type = j + 1; 2705 2706 if (mls_setup_user_range(policydb, fromcon, user, 2707 &usercon)) 2708 continue; 2709 2710 rc = sidtab_context_to_sid(sidtab, &usercon, &sid); 2711 if (rc) 2712 goto out_unlock; 2713 if (mynel < maxnel) { 2714 mysids[mynel++] = sid; 2715 } else { 2716 rc = -ENOMEM; 2717 maxnel += SIDS_NEL; 2718 mysids2 = kcalloc(maxnel, sizeof(*mysids2), GFP_ATOMIC); 2719 if (!mysids2) 2720 goto out_unlock; 2721 memcpy(mysids2, mysids, mynel * sizeof(*mysids2)); 2722 kfree(mysids); 2723 mysids = mysids2; 2724 mysids[mynel++] = sid; 2725 } 2726 } 2727 } 2728 rc = 0; 2729 out_unlock: 2730 rcu_read_unlock(); 2731 if (rc || !mynel) { 2732 kfree(mysids); 2733 goto out; 2734 } 2735 2736 rc = -ENOMEM; 2737 mysids2 = kcalloc(mynel, sizeof(*mysids2), GFP_KERNEL); 2738 if (!mysids2) { 2739 kfree(mysids); 2740 goto out; 2741 } 2742 for (i = 0, j = 0; i < mynel; i++) { 2743 struct av_decision dummy_avd; 2744 rc = avc_has_perm_noaudit(state, 2745 fromsid, mysids[i], 2746 SECCLASS_PROCESS, /* kernel value */ 2747 PROCESS__TRANSITION, AVC_STRICT, 2748 &dummy_avd); 2749 if (!rc) 2750 mysids2[j++] = mysids[i]; 2751 cond_resched(); 2752 } 2753 rc = 0; 2754 kfree(mysids); 2755 *sids = mysids2; 2756 *nel = j; 2757 out: 2758 return rc; 2759 } 2760 2761 /** 2762 * __security_genfs_sid - Helper to obtain a SID for a file in a filesystem 2763 * @fstype: filesystem type 2764 * @path: path from root of mount 2765 * @sclass: file security class 2766 * @sid: SID for path 2767 * 2768 * Obtain a SID to use for a file in a filesystem that 2769 * cannot support xattr or use a fixed labeling behavior like 2770 * transition SIDs or task SIDs. 2771 */ 2772 static inline int __security_genfs_sid(struct selinux_policy *policy, 2773 const char *fstype, 2774 char *path, 2775 u16 orig_sclass, 2776 u32 *sid) 2777 { 2778 struct policydb *policydb = &policy->policydb; 2779 struct sidtab *sidtab = policy->sidtab; 2780 int len; 2781 u16 sclass; 2782 struct genfs *genfs; 2783 struct ocontext *c; 2784 int rc, cmp = 0; 2785 2786 while (path[0] == '/' && path[1] == '/') 2787 path++; 2788 2789 sclass = unmap_class(&policy->map, orig_sclass); 2790 *sid = SECINITSID_UNLABELED; 2791 2792 for (genfs = policydb->genfs; genfs; genfs = genfs->next) { 2793 cmp = strcmp(fstype, genfs->fstype); 2794 if (cmp <= 0) 2795 break; 2796 } 2797 2798 rc = -ENOENT; 2799 if (!genfs || cmp) 2800 goto out; 2801 2802 for (c = genfs->head; c; c = c->next) { 2803 len = strlen(c->u.name); 2804 if ((!c->v.sclass || sclass == c->v.sclass) && 2805 (strncmp(c->u.name, path, len) == 0)) 2806 break; 2807 } 2808 2809 rc = -ENOENT; 2810 if (!c) 2811 goto out; 2812 2813 if (!c->sid[0]) { 2814 rc = sidtab_context_to_sid(sidtab, &c->context[0], &c->sid[0]); 2815 if (rc) 2816 goto out; 2817 } 2818 2819 *sid = c->sid[0]; 2820 rc = 0; 2821 out: 2822 return rc; 2823 } 2824 2825 /** 2826 * security_genfs_sid - Obtain a SID for a file in a filesystem 2827 * @fstype: filesystem type 2828 * @path: path from root of mount 2829 * @sclass: file security class 2830 * @sid: SID for path 2831 * 2832 * Acquire policy_rwlock before calling __security_genfs_sid() and release 2833 * it afterward. 2834 */ 2835 int security_genfs_sid(struct selinux_state *state, 2836 const char *fstype, 2837 char *path, 2838 u16 orig_sclass, 2839 u32 *sid) 2840 { 2841 struct selinux_policy *policy; 2842 int retval; 2843 2844 if (!selinux_initialized(state)) { 2845 *sid = SECINITSID_UNLABELED; 2846 return 0; 2847 } 2848 2849 rcu_read_lock(); 2850 policy = rcu_dereference(state->policy); 2851 retval = __security_genfs_sid(policy, 2852 fstype, path, orig_sclass, sid); 2853 rcu_read_unlock(); 2854 return retval; 2855 } 2856 2857 int selinux_policy_genfs_sid(struct selinux_policy *policy, 2858 const char *fstype, 2859 char *path, 2860 u16 orig_sclass, 2861 u32 *sid) 2862 { 2863 /* no lock required, policy is not yet accessible by other threads */ 2864 return __security_genfs_sid(policy, fstype, path, orig_sclass, sid); 2865 } 2866 2867 /** 2868 * security_fs_use - Determine how to handle labeling for a filesystem. 2869 * @sb: superblock in question 2870 */ 2871 int security_fs_use(struct selinux_state *state, struct super_block *sb) 2872 { 2873 struct selinux_policy *policy; 2874 struct policydb *policydb; 2875 struct sidtab *sidtab; 2876 int rc = 0; 2877 struct ocontext *c; 2878 struct superblock_security_struct *sbsec = sb->s_security; 2879 const char *fstype = sb->s_type->name; 2880 2881 if (!selinux_initialized(state)) { 2882 sbsec->behavior = SECURITY_FS_USE_NONE; 2883 sbsec->sid = SECINITSID_UNLABELED; 2884 return 0; 2885 } 2886 2887 rcu_read_lock(); 2888 policy = rcu_dereference(state->policy); 2889 policydb = &policy->policydb; 2890 sidtab = policy->sidtab; 2891 2892 c = policydb->ocontexts[OCON_FSUSE]; 2893 while (c) { 2894 if (strcmp(fstype, c->u.name) == 0) 2895 break; 2896 c = c->next; 2897 } 2898 2899 if (c) { 2900 sbsec->behavior = c->v.behavior; 2901 if (!c->sid[0]) { 2902 rc = sidtab_context_to_sid(sidtab, &c->context[0], 2903 &c->sid[0]); 2904 if (rc) 2905 goto out; 2906 } 2907 sbsec->sid = c->sid[0]; 2908 } else { 2909 rc = __security_genfs_sid(policy, fstype, "/", 2910 SECCLASS_DIR, &sbsec->sid); 2911 if (rc) { 2912 sbsec->behavior = SECURITY_FS_USE_NONE; 2913 rc = 0; 2914 } else { 2915 sbsec->behavior = SECURITY_FS_USE_GENFS; 2916 } 2917 } 2918 2919 out: 2920 rcu_read_unlock(); 2921 return rc; 2922 } 2923 2924 int security_get_bools(struct selinux_policy *policy, 2925 u32 *len, char ***names, int **values) 2926 { 2927 struct policydb *policydb; 2928 u32 i; 2929 int rc; 2930 2931 policydb = &policy->policydb; 2932 2933 *names = NULL; 2934 *values = NULL; 2935 2936 rc = 0; 2937 *len = policydb->p_bools.nprim; 2938 if (!*len) 2939 goto out; 2940 2941 rc = -ENOMEM; 2942 *names = kcalloc(*len, sizeof(char *), GFP_ATOMIC); 2943 if (!*names) 2944 goto err; 2945 2946 rc = -ENOMEM; 2947 *values = kcalloc(*len, sizeof(int), GFP_ATOMIC); 2948 if (!*values) 2949 goto err; 2950 2951 for (i = 0; i < *len; i++) { 2952 (*values)[i] = policydb->bool_val_to_struct[i]->state; 2953 2954 rc = -ENOMEM; 2955 (*names)[i] = kstrdup(sym_name(policydb, SYM_BOOLS, i), 2956 GFP_ATOMIC); 2957 if (!(*names)[i]) 2958 goto err; 2959 } 2960 rc = 0; 2961 out: 2962 return rc; 2963 err: 2964 if (*names) { 2965 for (i = 0; i < *len; i++) 2966 kfree((*names)[i]); 2967 kfree(*names); 2968 } 2969 kfree(*values); 2970 *len = 0; 2971 *names = NULL; 2972 *values = NULL; 2973 goto out; 2974 } 2975 2976 2977 int security_set_bools(struct selinux_state *state, u32 len, int *values) 2978 { 2979 struct selinux_policy *newpolicy, *oldpolicy; 2980 int rc; 2981 u32 i, seqno = 0; 2982 2983 if (!selinux_initialized(state)) 2984 return -EINVAL; 2985 2986 oldpolicy = rcu_dereference_protected(state->policy, 2987 lockdep_is_held(&state->policy_mutex)); 2988 2989 /* Consistency check on number of booleans, should never fail */ 2990 if (WARN_ON(len != oldpolicy->policydb.p_bools.nprim)) 2991 return -EINVAL; 2992 2993 newpolicy = kmemdup(oldpolicy, sizeof(*newpolicy), GFP_KERNEL); 2994 if (!newpolicy) 2995 return -ENOMEM; 2996 2997 /* 2998 * Deep copy only the parts of the policydb that might be 2999 * modified as a result of changing booleans. 3000 */ 3001 rc = cond_policydb_dup(&newpolicy->policydb, &oldpolicy->policydb); 3002 if (rc) { 3003 kfree(newpolicy); 3004 return -ENOMEM; 3005 } 3006 3007 /* Update the boolean states in the copy */ 3008 for (i = 0; i < len; i++) { 3009 int new_state = !!values[i]; 3010 int old_state = newpolicy->policydb.bool_val_to_struct[i]->state; 3011 3012 if (new_state != old_state) { 3013 audit_log(audit_context(), GFP_ATOMIC, 3014 AUDIT_MAC_CONFIG_CHANGE, 3015 "bool=%s val=%d old_val=%d auid=%u ses=%u", 3016 sym_name(&newpolicy->policydb, SYM_BOOLS, i), 3017 new_state, 3018 old_state, 3019 from_kuid(&init_user_ns, audit_get_loginuid(current)), 3020 audit_get_sessionid(current)); 3021 newpolicy->policydb.bool_val_to_struct[i]->state = new_state; 3022 } 3023 } 3024 3025 /* Re-evaluate the conditional rules in the copy */ 3026 evaluate_cond_nodes(&newpolicy->policydb); 3027 3028 /* Set latest granting seqno for new policy */ 3029 newpolicy->latest_granting = oldpolicy->latest_granting + 1; 3030 seqno = newpolicy->latest_granting; 3031 3032 /* Install the new policy */ 3033 rcu_assign_pointer(state->policy, newpolicy); 3034 3035 /* 3036 * Free the conditional portions of the old policydb 3037 * that were copied for the new policy, and the oldpolicy 3038 * structure itself but not what it references. 3039 */ 3040 synchronize_rcu(); 3041 selinux_policy_cond_free(oldpolicy); 3042 3043 /* Notify others of the policy change */ 3044 selinux_notify_policy_change(state, seqno); 3045 return 0; 3046 } 3047 3048 int security_get_bool_value(struct selinux_state *state, 3049 u32 index) 3050 { 3051 struct selinux_policy *policy; 3052 struct policydb *policydb; 3053 int rc; 3054 u32 len; 3055 3056 if (!selinux_initialized(state)) 3057 return 0; 3058 3059 rcu_read_lock(); 3060 policy = rcu_dereference(state->policy); 3061 policydb = &policy->policydb; 3062 3063 rc = -EFAULT; 3064 len = policydb->p_bools.nprim; 3065 if (index >= len) 3066 goto out; 3067 3068 rc = policydb->bool_val_to_struct[index]->state; 3069 out: 3070 rcu_read_unlock(); 3071 return rc; 3072 } 3073 3074 static int security_preserve_bools(struct selinux_policy *oldpolicy, 3075 struct selinux_policy *newpolicy) 3076 { 3077 int rc, *bvalues = NULL; 3078 char **bnames = NULL; 3079 struct cond_bool_datum *booldatum; 3080 u32 i, nbools = 0; 3081 3082 rc = security_get_bools(oldpolicy, &nbools, &bnames, &bvalues); 3083 if (rc) 3084 goto out; 3085 for (i = 0; i < nbools; i++) { 3086 booldatum = symtab_search(&newpolicy->policydb.p_bools, 3087 bnames[i]); 3088 if (booldatum) 3089 booldatum->state = bvalues[i]; 3090 } 3091 evaluate_cond_nodes(&newpolicy->policydb); 3092 3093 out: 3094 if (bnames) { 3095 for (i = 0; i < nbools; i++) 3096 kfree(bnames[i]); 3097 } 3098 kfree(bnames); 3099 kfree(bvalues); 3100 return rc; 3101 } 3102 3103 /* 3104 * security_sid_mls_copy() - computes a new sid based on the given 3105 * sid and the mls portion of mls_sid. 3106 */ 3107 int security_sid_mls_copy(struct selinux_state *state, 3108 u32 sid, u32 mls_sid, u32 *new_sid) 3109 { 3110 struct selinux_policy *policy; 3111 struct policydb *policydb; 3112 struct sidtab *sidtab; 3113 struct context *context1; 3114 struct context *context2; 3115 struct context newcon; 3116 char *s; 3117 u32 len; 3118 int rc; 3119 3120 rc = 0; 3121 if (!selinux_initialized(state)) { 3122 *new_sid = sid; 3123 goto out; 3124 } 3125 3126 context_init(&newcon); 3127 3128 rcu_read_lock(); 3129 policy = rcu_dereference(state->policy); 3130 policydb = &policy->policydb; 3131 sidtab = policy->sidtab; 3132 3133 if (!policydb->mls_enabled) { 3134 *new_sid = sid; 3135 goto out_unlock; 3136 } 3137 3138 rc = -EINVAL; 3139 context1 = sidtab_search(sidtab, sid); 3140 if (!context1) { 3141 pr_err("SELinux: %s: unrecognized SID %d\n", 3142 __func__, sid); 3143 goto out_unlock; 3144 } 3145 3146 rc = -EINVAL; 3147 context2 = sidtab_search(sidtab, mls_sid); 3148 if (!context2) { 3149 pr_err("SELinux: %s: unrecognized SID %d\n", 3150 __func__, mls_sid); 3151 goto out_unlock; 3152 } 3153 3154 newcon.user = context1->user; 3155 newcon.role = context1->role; 3156 newcon.type = context1->type; 3157 rc = mls_context_cpy(&newcon, context2); 3158 if (rc) 3159 goto out_unlock; 3160 3161 /* Check the validity of the new context. */ 3162 if (!policydb_context_isvalid(policydb, &newcon)) { 3163 rc = convert_context_handle_invalid_context(state, policydb, 3164 &newcon); 3165 if (rc) { 3166 if (!context_struct_to_string(policydb, &newcon, &s, 3167 &len)) { 3168 struct audit_buffer *ab; 3169 3170 ab = audit_log_start(audit_context(), 3171 GFP_ATOMIC, 3172 AUDIT_SELINUX_ERR); 3173 audit_log_format(ab, 3174 "op=security_sid_mls_copy invalid_context="); 3175 /* don't record NUL with untrusted strings */ 3176 audit_log_n_untrustedstring(ab, s, len - 1); 3177 audit_log_end(ab); 3178 kfree(s); 3179 } 3180 goto out_unlock; 3181 } 3182 } 3183 rc = sidtab_context_to_sid(sidtab, &newcon, new_sid); 3184 out_unlock: 3185 rcu_read_unlock(); 3186 context_destroy(&newcon); 3187 out: 3188 return rc; 3189 } 3190 3191 /** 3192 * security_net_peersid_resolve - Compare and resolve two network peer SIDs 3193 * @nlbl_sid: NetLabel SID 3194 * @nlbl_type: NetLabel labeling protocol type 3195 * @xfrm_sid: XFRM SID 3196 * 3197 * Description: 3198 * Compare the @nlbl_sid and @xfrm_sid values and if the two SIDs can be 3199 * resolved into a single SID it is returned via @peer_sid and the function 3200 * returns zero. Otherwise @peer_sid is set to SECSID_NULL and the function 3201 * returns a negative value. A table summarizing the behavior is below: 3202 * 3203 * | function return | @sid 3204 * ------------------------------+-----------------+----------------- 3205 * no peer labels | 0 | SECSID_NULL 3206 * single peer label | 0 | <peer_label> 3207 * multiple, consistent labels | 0 | <peer_label> 3208 * multiple, inconsistent labels | -<errno> | SECSID_NULL 3209 * 3210 */ 3211 int security_net_peersid_resolve(struct selinux_state *state, 3212 u32 nlbl_sid, u32 nlbl_type, 3213 u32 xfrm_sid, 3214 u32 *peer_sid) 3215 { 3216 struct selinux_policy *policy; 3217 struct policydb *policydb; 3218 struct sidtab *sidtab; 3219 int rc; 3220 struct context *nlbl_ctx; 3221 struct context *xfrm_ctx; 3222 3223 *peer_sid = SECSID_NULL; 3224 3225 /* handle the common (which also happens to be the set of easy) cases 3226 * right away, these two if statements catch everything involving a 3227 * single or absent peer SID/label */ 3228 if (xfrm_sid == SECSID_NULL) { 3229 *peer_sid = nlbl_sid; 3230 return 0; 3231 } 3232 /* NOTE: an nlbl_type == NETLBL_NLTYPE_UNLABELED is a "fallback" label 3233 * and is treated as if nlbl_sid == SECSID_NULL when a XFRM SID/label 3234 * is present */ 3235 if (nlbl_sid == SECSID_NULL || nlbl_type == NETLBL_NLTYPE_UNLABELED) { 3236 *peer_sid = xfrm_sid; 3237 return 0; 3238 } 3239 3240 if (!selinux_initialized(state)) 3241 return 0; 3242 3243 rcu_read_lock(); 3244 policy = rcu_dereference(state->policy); 3245 policydb = &policy->policydb; 3246 sidtab = policy->sidtab; 3247 3248 /* 3249 * We don't need to check initialized here since the only way both 3250 * nlbl_sid and xfrm_sid are not equal to SECSID_NULL would be if the 3251 * security server was initialized and state->initialized was true. 3252 */ 3253 if (!policydb->mls_enabled) { 3254 rc = 0; 3255 goto out; 3256 } 3257 3258 rc = -EINVAL; 3259 nlbl_ctx = sidtab_search(sidtab, nlbl_sid); 3260 if (!nlbl_ctx) { 3261 pr_err("SELinux: %s: unrecognized SID %d\n", 3262 __func__, nlbl_sid); 3263 goto out; 3264 } 3265 rc = -EINVAL; 3266 xfrm_ctx = sidtab_search(sidtab, xfrm_sid); 3267 if (!xfrm_ctx) { 3268 pr_err("SELinux: %s: unrecognized SID %d\n", 3269 __func__, xfrm_sid); 3270 goto out; 3271 } 3272 rc = (mls_context_cmp(nlbl_ctx, xfrm_ctx) ? 0 : -EACCES); 3273 if (rc) 3274 goto out; 3275 3276 /* at present NetLabel SIDs/labels really only carry MLS 3277 * information so if the MLS portion of the NetLabel SID 3278 * matches the MLS portion of the labeled XFRM SID/label 3279 * then pass along the XFRM SID as it is the most 3280 * expressive */ 3281 *peer_sid = xfrm_sid; 3282 out: 3283 rcu_read_unlock(); 3284 return rc; 3285 } 3286 3287 static int get_classes_callback(void *k, void *d, void *args) 3288 { 3289 struct class_datum *datum = d; 3290 char *name = k, **classes = args; 3291 int value = datum->value - 1; 3292 3293 classes[value] = kstrdup(name, GFP_ATOMIC); 3294 if (!classes[value]) 3295 return -ENOMEM; 3296 3297 return 0; 3298 } 3299 3300 int security_get_classes(struct selinux_policy *policy, 3301 char ***classes, int *nclasses) 3302 { 3303 struct policydb *policydb; 3304 int rc; 3305 3306 policydb = &policy->policydb; 3307 3308 rc = -ENOMEM; 3309 *nclasses = policydb->p_classes.nprim; 3310 *classes = kcalloc(*nclasses, sizeof(**classes), GFP_ATOMIC); 3311 if (!*classes) 3312 goto out; 3313 3314 rc = hashtab_map(&policydb->p_classes.table, get_classes_callback, 3315 *classes); 3316 if (rc) { 3317 int i; 3318 for (i = 0; i < *nclasses; i++) 3319 kfree((*classes)[i]); 3320 kfree(*classes); 3321 } 3322 3323 out: 3324 return rc; 3325 } 3326 3327 static int get_permissions_callback(void *k, void *d, void *args) 3328 { 3329 struct perm_datum *datum = d; 3330 char *name = k, **perms = args; 3331 int value = datum->value - 1; 3332 3333 perms[value] = kstrdup(name, GFP_ATOMIC); 3334 if (!perms[value]) 3335 return -ENOMEM; 3336 3337 return 0; 3338 } 3339 3340 int security_get_permissions(struct selinux_policy *policy, 3341 char *class, char ***perms, int *nperms) 3342 { 3343 struct policydb *policydb; 3344 int rc, i; 3345 struct class_datum *match; 3346 3347 policydb = &policy->policydb; 3348 3349 rc = -EINVAL; 3350 match = symtab_search(&policydb->p_classes, class); 3351 if (!match) { 3352 pr_err("SELinux: %s: unrecognized class %s\n", 3353 __func__, class); 3354 goto out; 3355 } 3356 3357 rc = -ENOMEM; 3358 *nperms = match->permissions.nprim; 3359 *perms = kcalloc(*nperms, sizeof(**perms), GFP_ATOMIC); 3360 if (!*perms) 3361 goto out; 3362 3363 if (match->comdatum) { 3364 rc = hashtab_map(&match->comdatum->permissions.table, 3365 get_permissions_callback, *perms); 3366 if (rc) 3367 goto err; 3368 } 3369 3370 rc = hashtab_map(&match->permissions.table, get_permissions_callback, 3371 *perms); 3372 if (rc) 3373 goto err; 3374 3375 out: 3376 return rc; 3377 3378 err: 3379 for (i = 0; i < *nperms; i++) 3380 kfree((*perms)[i]); 3381 kfree(*perms); 3382 return rc; 3383 } 3384 3385 int security_get_reject_unknown(struct selinux_state *state) 3386 { 3387 struct selinux_policy *policy; 3388 int value; 3389 3390 if (!selinux_initialized(state)) 3391 return 0; 3392 3393 rcu_read_lock(); 3394 policy = rcu_dereference(state->policy); 3395 value = policy->policydb.reject_unknown; 3396 rcu_read_unlock(); 3397 return value; 3398 } 3399 3400 int security_get_allow_unknown(struct selinux_state *state) 3401 { 3402 struct selinux_policy *policy; 3403 int value; 3404 3405 if (!selinux_initialized(state)) 3406 return 0; 3407 3408 rcu_read_lock(); 3409 policy = rcu_dereference(state->policy); 3410 value = policy->policydb.allow_unknown; 3411 rcu_read_unlock(); 3412 return value; 3413 } 3414 3415 /** 3416 * security_policycap_supported - Check for a specific policy capability 3417 * @req_cap: capability 3418 * 3419 * Description: 3420 * This function queries the currently loaded policy to see if it supports the 3421 * capability specified by @req_cap. Returns true (1) if the capability is 3422 * supported, false (0) if it isn't supported. 3423 * 3424 */ 3425 int security_policycap_supported(struct selinux_state *state, 3426 unsigned int req_cap) 3427 { 3428 struct selinux_policy *policy; 3429 int rc; 3430 3431 if (!selinux_initialized(state)) 3432 return 0; 3433 3434 rcu_read_lock(); 3435 policy = rcu_dereference(state->policy); 3436 rc = ebitmap_get_bit(&policy->policydb.policycaps, req_cap); 3437 rcu_read_unlock(); 3438 3439 return rc; 3440 } 3441 3442 struct selinux_audit_rule { 3443 u32 au_seqno; 3444 struct context au_ctxt; 3445 }; 3446 3447 void selinux_audit_rule_free(void *vrule) 3448 { 3449 struct selinux_audit_rule *rule = vrule; 3450 3451 if (rule) { 3452 context_destroy(&rule->au_ctxt); 3453 kfree(rule); 3454 } 3455 } 3456 3457 int selinux_audit_rule_init(u32 field, u32 op, char *rulestr, void **vrule) 3458 { 3459 struct selinux_state *state = &selinux_state; 3460 struct selinux_policy *policy; 3461 struct policydb *policydb; 3462 struct selinux_audit_rule *tmprule; 3463 struct role_datum *roledatum; 3464 struct type_datum *typedatum; 3465 struct user_datum *userdatum; 3466 struct selinux_audit_rule **rule = (struct selinux_audit_rule **)vrule; 3467 int rc = 0; 3468 3469 *rule = NULL; 3470 3471 if (!selinux_initialized(state)) 3472 return -EOPNOTSUPP; 3473 3474 switch (field) { 3475 case AUDIT_SUBJ_USER: 3476 case AUDIT_SUBJ_ROLE: 3477 case AUDIT_SUBJ_TYPE: 3478 case AUDIT_OBJ_USER: 3479 case AUDIT_OBJ_ROLE: 3480 case AUDIT_OBJ_TYPE: 3481 /* only 'equals' and 'not equals' fit user, role, and type */ 3482 if (op != Audit_equal && op != Audit_not_equal) 3483 return -EINVAL; 3484 break; 3485 case AUDIT_SUBJ_SEN: 3486 case AUDIT_SUBJ_CLR: 3487 case AUDIT_OBJ_LEV_LOW: 3488 case AUDIT_OBJ_LEV_HIGH: 3489 /* we do not allow a range, indicated by the presence of '-' */ 3490 if (strchr(rulestr, '-')) 3491 return -EINVAL; 3492 break; 3493 default: 3494 /* only the above fields are valid */ 3495 return -EINVAL; 3496 } 3497 3498 tmprule = kzalloc(sizeof(struct selinux_audit_rule), GFP_KERNEL); 3499 if (!tmprule) 3500 return -ENOMEM; 3501 3502 context_init(&tmprule->au_ctxt); 3503 3504 rcu_read_lock(); 3505 policy = rcu_dereference(state->policy); 3506 policydb = &policy->policydb; 3507 3508 tmprule->au_seqno = policy->latest_granting; 3509 3510 switch (field) { 3511 case AUDIT_SUBJ_USER: 3512 case AUDIT_OBJ_USER: 3513 rc = -EINVAL; 3514 userdatum = symtab_search(&policydb->p_users, rulestr); 3515 if (!userdatum) 3516 goto out; 3517 tmprule->au_ctxt.user = userdatum->value; 3518 break; 3519 case AUDIT_SUBJ_ROLE: 3520 case AUDIT_OBJ_ROLE: 3521 rc = -EINVAL; 3522 roledatum = symtab_search(&policydb->p_roles, rulestr); 3523 if (!roledatum) 3524 goto out; 3525 tmprule->au_ctxt.role = roledatum->value; 3526 break; 3527 case AUDIT_SUBJ_TYPE: 3528 case AUDIT_OBJ_TYPE: 3529 rc = -EINVAL; 3530 typedatum = symtab_search(&policydb->p_types, rulestr); 3531 if (!typedatum) 3532 goto out; 3533 tmprule->au_ctxt.type = typedatum->value; 3534 break; 3535 case AUDIT_SUBJ_SEN: 3536 case AUDIT_SUBJ_CLR: 3537 case AUDIT_OBJ_LEV_LOW: 3538 case AUDIT_OBJ_LEV_HIGH: 3539 rc = mls_from_string(policydb, rulestr, &tmprule->au_ctxt, 3540 GFP_ATOMIC); 3541 if (rc) 3542 goto out; 3543 break; 3544 } 3545 rc = 0; 3546 out: 3547 rcu_read_unlock(); 3548 3549 if (rc) { 3550 selinux_audit_rule_free(tmprule); 3551 tmprule = NULL; 3552 } 3553 3554 *rule = tmprule; 3555 3556 return rc; 3557 } 3558 3559 /* Check to see if the rule contains any selinux fields */ 3560 int selinux_audit_rule_known(struct audit_krule *rule) 3561 { 3562 int i; 3563 3564 for (i = 0; i < rule->field_count; i++) { 3565 struct audit_field *f = &rule->fields[i]; 3566 switch (f->type) { 3567 case AUDIT_SUBJ_USER: 3568 case AUDIT_SUBJ_ROLE: 3569 case AUDIT_SUBJ_TYPE: 3570 case AUDIT_SUBJ_SEN: 3571 case AUDIT_SUBJ_CLR: 3572 case AUDIT_OBJ_USER: 3573 case AUDIT_OBJ_ROLE: 3574 case AUDIT_OBJ_TYPE: 3575 case AUDIT_OBJ_LEV_LOW: 3576 case AUDIT_OBJ_LEV_HIGH: 3577 return 1; 3578 } 3579 } 3580 3581 return 0; 3582 } 3583 3584 int selinux_audit_rule_match(u32 sid, u32 field, u32 op, void *vrule) 3585 { 3586 struct selinux_state *state = &selinux_state; 3587 struct selinux_policy *policy; 3588 struct context *ctxt; 3589 struct mls_level *level; 3590 struct selinux_audit_rule *rule = vrule; 3591 int match = 0; 3592 3593 if (unlikely(!rule)) { 3594 WARN_ONCE(1, "selinux_audit_rule_match: missing rule\n"); 3595 return -ENOENT; 3596 } 3597 3598 if (!selinux_initialized(state)) 3599 return 0; 3600 3601 rcu_read_lock(); 3602 3603 policy = rcu_dereference(state->policy); 3604 3605 if (rule->au_seqno < policy->latest_granting) { 3606 match = -ESTALE; 3607 goto out; 3608 } 3609 3610 ctxt = sidtab_search(policy->sidtab, sid); 3611 if (unlikely(!ctxt)) { 3612 WARN_ONCE(1, "selinux_audit_rule_match: unrecognized SID %d\n", 3613 sid); 3614 match = -ENOENT; 3615 goto out; 3616 } 3617 3618 /* a field/op pair that is not caught here will simply fall through 3619 without a match */ 3620 switch (field) { 3621 case AUDIT_SUBJ_USER: 3622 case AUDIT_OBJ_USER: 3623 switch (op) { 3624 case Audit_equal: 3625 match = (ctxt->user == rule->au_ctxt.user); 3626 break; 3627 case Audit_not_equal: 3628 match = (ctxt->user != rule->au_ctxt.user); 3629 break; 3630 } 3631 break; 3632 case AUDIT_SUBJ_ROLE: 3633 case AUDIT_OBJ_ROLE: 3634 switch (op) { 3635 case Audit_equal: 3636 match = (ctxt->role == rule->au_ctxt.role); 3637 break; 3638 case Audit_not_equal: 3639 match = (ctxt->role != rule->au_ctxt.role); 3640 break; 3641 } 3642 break; 3643 case AUDIT_SUBJ_TYPE: 3644 case AUDIT_OBJ_TYPE: 3645 switch (op) { 3646 case Audit_equal: 3647 match = (ctxt->type == rule->au_ctxt.type); 3648 break; 3649 case Audit_not_equal: 3650 match = (ctxt->type != rule->au_ctxt.type); 3651 break; 3652 } 3653 break; 3654 case AUDIT_SUBJ_SEN: 3655 case AUDIT_SUBJ_CLR: 3656 case AUDIT_OBJ_LEV_LOW: 3657 case AUDIT_OBJ_LEV_HIGH: 3658 level = ((field == AUDIT_SUBJ_SEN || 3659 field == AUDIT_OBJ_LEV_LOW) ? 3660 &ctxt->range.level[0] : &ctxt->range.level[1]); 3661 switch (op) { 3662 case Audit_equal: 3663 match = mls_level_eq(&rule->au_ctxt.range.level[0], 3664 level); 3665 break; 3666 case Audit_not_equal: 3667 match = !mls_level_eq(&rule->au_ctxt.range.level[0], 3668 level); 3669 break; 3670 case Audit_lt: 3671 match = (mls_level_dom(&rule->au_ctxt.range.level[0], 3672 level) && 3673 !mls_level_eq(&rule->au_ctxt.range.level[0], 3674 level)); 3675 break; 3676 case Audit_le: 3677 match = mls_level_dom(&rule->au_ctxt.range.level[0], 3678 level); 3679 break; 3680 case Audit_gt: 3681 match = (mls_level_dom(level, 3682 &rule->au_ctxt.range.level[0]) && 3683 !mls_level_eq(level, 3684 &rule->au_ctxt.range.level[0])); 3685 break; 3686 case Audit_ge: 3687 match = mls_level_dom(level, 3688 &rule->au_ctxt.range.level[0]); 3689 break; 3690 } 3691 } 3692 3693 out: 3694 rcu_read_unlock(); 3695 return match; 3696 } 3697 3698 static int aurule_avc_callback(u32 event) 3699 { 3700 if (event == AVC_CALLBACK_RESET) 3701 return audit_update_lsm_rules(); 3702 return 0; 3703 } 3704 3705 static int __init aurule_init(void) 3706 { 3707 int err; 3708 3709 err = avc_add_callback(aurule_avc_callback, AVC_CALLBACK_RESET); 3710 if (err) 3711 panic("avc_add_callback() failed, error %d\n", err); 3712 3713 return err; 3714 } 3715 __initcall(aurule_init); 3716 3717 #ifdef CONFIG_NETLABEL 3718 /** 3719 * security_netlbl_cache_add - Add an entry to the NetLabel cache 3720 * @secattr: the NetLabel packet security attributes 3721 * @sid: the SELinux SID 3722 * 3723 * Description: 3724 * Attempt to cache the context in @ctx, which was derived from the packet in 3725 * @skb, in the NetLabel subsystem cache. This function assumes @secattr has 3726 * already been initialized. 3727 * 3728 */ 3729 static void security_netlbl_cache_add(struct netlbl_lsm_secattr *secattr, 3730 u32 sid) 3731 { 3732 u32 *sid_cache; 3733 3734 sid_cache = kmalloc(sizeof(*sid_cache), GFP_ATOMIC); 3735 if (sid_cache == NULL) 3736 return; 3737 secattr->cache = netlbl_secattr_cache_alloc(GFP_ATOMIC); 3738 if (secattr->cache == NULL) { 3739 kfree(sid_cache); 3740 return; 3741 } 3742 3743 *sid_cache = sid; 3744 secattr->cache->free = kfree; 3745 secattr->cache->data = sid_cache; 3746 secattr->flags |= NETLBL_SECATTR_CACHE; 3747 } 3748 3749 /** 3750 * security_netlbl_secattr_to_sid - Convert a NetLabel secattr to a SELinux SID 3751 * @secattr: the NetLabel packet security attributes 3752 * @sid: the SELinux SID 3753 * 3754 * Description: 3755 * Convert the given NetLabel security attributes in @secattr into a 3756 * SELinux SID. If the @secattr field does not contain a full SELinux 3757 * SID/context then use SECINITSID_NETMSG as the foundation. If possible the 3758 * 'cache' field of @secattr is set and the CACHE flag is set; this is to 3759 * allow the @secattr to be used by NetLabel to cache the secattr to SID 3760 * conversion for future lookups. Returns zero on success, negative values on 3761 * failure. 3762 * 3763 */ 3764 int security_netlbl_secattr_to_sid(struct selinux_state *state, 3765 struct netlbl_lsm_secattr *secattr, 3766 u32 *sid) 3767 { 3768 struct selinux_policy *policy; 3769 struct policydb *policydb; 3770 struct sidtab *sidtab; 3771 int rc; 3772 struct context *ctx; 3773 struct context ctx_new; 3774 3775 if (!selinux_initialized(state)) { 3776 *sid = SECSID_NULL; 3777 return 0; 3778 } 3779 3780 rcu_read_lock(); 3781 policy = rcu_dereference(state->policy); 3782 policydb = &policy->policydb; 3783 sidtab = policy->sidtab; 3784 3785 if (secattr->flags & NETLBL_SECATTR_CACHE) 3786 *sid = *(u32 *)secattr->cache->data; 3787 else if (secattr->flags & NETLBL_SECATTR_SECID) 3788 *sid = secattr->attr.secid; 3789 else if (secattr->flags & NETLBL_SECATTR_MLS_LVL) { 3790 rc = -EIDRM; 3791 ctx = sidtab_search(sidtab, SECINITSID_NETMSG); 3792 if (ctx == NULL) 3793 goto out; 3794 3795 context_init(&ctx_new); 3796 ctx_new.user = ctx->user; 3797 ctx_new.role = ctx->role; 3798 ctx_new.type = ctx->type; 3799 mls_import_netlbl_lvl(policydb, &ctx_new, secattr); 3800 if (secattr->flags & NETLBL_SECATTR_MLS_CAT) { 3801 rc = mls_import_netlbl_cat(policydb, &ctx_new, secattr); 3802 if (rc) 3803 goto out; 3804 } 3805 rc = -EIDRM; 3806 if (!mls_context_isvalid(policydb, &ctx_new)) 3807 goto out_free; 3808 3809 rc = sidtab_context_to_sid(sidtab, &ctx_new, sid); 3810 if (rc) 3811 goto out_free; 3812 3813 security_netlbl_cache_add(secattr, *sid); 3814 3815 ebitmap_destroy(&ctx_new.range.level[0].cat); 3816 } else 3817 *sid = SECSID_NULL; 3818 3819 rcu_read_unlock(); 3820 return 0; 3821 out_free: 3822 ebitmap_destroy(&ctx_new.range.level[0].cat); 3823 out: 3824 rcu_read_unlock(); 3825 return rc; 3826 } 3827 3828 /** 3829 * security_netlbl_sid_to_secattr - Convert a SELinux SID to a NetLabel secattr 3830 * @sid: the SELinux SID 3831 * @secattr: the NetLabel packet security attributes 3832 * 3833 * Description: 3834 * Convert the given SELinux SID in @sid into a NetLabel security attribute. 3835 * Returns zero on success, negative values on failure. 3836 * 3837 */ 3838 int security_netlbl_sid_to_secattr(struct selinux_state *state, 3839 u32 sid, struct netlbl_lsm_secattr *secattr) 3840 { 3841 struct selinux_policy *policy; 3842 struct policydb *policydb; 3843 int rc; 3844 struct context *ctx; 3845 3846 if (!selinux_initialized(state)) 3847 return 0; 3848 3849 rcu_read_lock(); 3850 policy = rcu_dereference(state->policy); 3851 policydb = &policy->policydb; 3852 3853 rc = -ENOENT; 3854 ctx = sidtab_search(policy->sidtab, sid); 3855 if (ctx == NULL) 3856 goto out; 3857 3858 rc = -ENOMEM; 3859 secattr->domain = kstrdup(sym_name(policydb, SYM_TYPES, ctx->type - 1), 3860 GFP_ATOMIC); 3861 if (secattr->domain == NULL) 3862 goto out; 3863 3864 secattr->attr.secid = sid; 3865 secattr->flags |= NETLBL_SECATTR_DOMAIN_CPY | NETLBL_SECATTR_SECID; 3866 mls_export_netlbl_lvl(policydb, ctx, secattr); 3867 rc = mls_export_netlbl_cat(policydb, ctx, secattr); 3868 out: 3869 rcu_read_unlock(); 3870 return rc; 3871 } 3872 #endif /* CONFIG_NETLABEL */ 3873 3874 /** 3875 * __security_read_policy - read the policy. 3876 * @policy: SELinux policy 3877 * @data: binary policy data 3878 * @len: length of data in bytes 3879 * 3880 */ 3881 static int __security_read_policy(struct selinux_policy *policy, 3882 void *data, size_t *len) 3883 { 3884 int rc; 3885 struct policy_file fp; 3886 3887 fp.data = data; 3888 fp.len = *len; 3889 3890 rc = policydb_write(&policy->policydb, &fp); 3891 if (rc) 3892 return rc; 3893 3894 *len = (unsigned long)fp.data - (unsigned long)data; 3895 return 0; 3896 } 3897 3898 /** 3899 * security_read_policy - read the policy. 3900 * @state: selinux_state 3901 * @data: binary policy data 3902 * @len: length of data in bytes 3903 * 3904 */ 3905 int security_read_policy(struct selinux_state *state, 3906 void **data, size_t *len) 3907 { 3908 struct selinux_policy *policy; 3909 3910 policy = rcu_dereference_protected( 3911 state->policy, lockdep_is_held(&state->policy_mutex)); 3912 if (!policy) 3913 return -EINVAL; 3914 3915 *len = policy->policydb.len; 3916 *data = vmalloc_user(*len); 3917 if (!*data) 3918 return -ENOMEM; 3919 3920 return __security_read_policy(policy, *data, len); 3921 } 3922 3923 /** 3924 * security_read_state_kernel - read the policy. 3925 * @state: selinux_state 3926 * @data: binary policy data 3927 * @len: length of data in bytes 3928 * 3929 * Allocates kernel memory for reading SELinux policy. 3930 * This function is for internal use only and should not 3931 * be used for returning data to user space. 3932 * 3933 * This function must be called with policy_mutex held. 3934 */ 3935 int security_read_state_kernel(struct selinux_state *state, 3936 void **data, size_t *len) 3937 { 3938 struct selinux_policy *policy; 3939 3940 policy = rcu_dereference_protected( 3941 state->policy, lockdep_is_held(&state->policy_mutex)); 3942 if (!policy) 3943 return -EINVAL; 3944 3945 *len = policy->policydb.len; 3946 *data = vmalloc(*len); 3947 if (!*data) 3948 return -ENOMEM; 3949 3950 return __security_read_policy(policy, *data, len); 3951 } 3952