Eric Lee / smarc-ti-linux-kernel

1

/*

1

/*

2

* Implementation of the security services.

2

* Implementation of the security services.

3

*

3

*

4

* Authors : Stephen Smalley, <sds@epoch.ncsc.mil>

4

* Authors : Stephen Smalley, <sds@epoch.ncsc.mil>

5

* James Morris <jmorris@redhat.com>

5

* James Morris <jmorris@redhat.com>

6

*

6

*

7

* Updated: Trusted Computer Solutions, Inc. <dgoeddel@trustedcs.com>

7

* Updated: Trusted Computer Solutions, Inc. <dgoeddel@trustedcs.com>

8

*

8

*

9

* Support for enhanced MLS infrastructure.

9

* Support for enhanced MLS infrastructure.

10

* Support for context based audit filters.

10

* Support for context based audit filters.

11

*

11

*

12

* Updated: Frank Mayer <mayerf@tresys.com> and Karl MacMillan <kmacmillan@tresys.com>

12

* Updated: Frank Mayer <mayerf@tresys.com> and Karl MacMillan <kmacmillan@tresys.com>

13

*

13

*

14

* Added conditional policy language extensions

14

* Added conditional policy language extensions

15

*

15

*

16

* Updated: Hewlett-Packard <paul@paul-moore.com>

16

* Updated: Hewlett-Packard <paul@paul-moore.com>

17

*

17

*

18

* Added support for NetLabel

18

* Added support for NetLabel

19

* Added support for the policy capability bitmap

19

* Added support for the policy capability bitmap

20

*

20

*

21

* Updated: Chad Sellers <csellers@tresys.com>

21

* Updated: Chad Sellers <csellers@tresys.com>

22

*

22

*

23

* Added validation of kernel classes and permissions

23

* Added validation of kernel classes and permissions

24

*

24

*

25

* Updated: KaiGai Kohei <kaigai@ak.jp.nec.com>

25

* Updated: KaiGai Kohei <kaigai@ak.jp.nec.com>

26

*

26

*

27

* Added support for bounds domain and audit messaged on masked permissions

27

* Added support for bounds domain and audit messaged on masked permissions

28

*

28

*

29

* Updated: Guido Trentalancia <guido@trentalancia.com>

29

* Updated: Guido Trentalancia <guido@trentalancia.com>

30

*

30

*

31

* Added support for runtime switching of the policy type

31

* Added support for runtime switching of the policy type

32

*

32

*

33

34

35

36

37

38

* This program is free software; you can redistribute it and/or modify

38

* This program is free software; you can redistribute it and/or modify

39

* it under the terms of the GNU General Public License as published by

39

* it under the terms of the GNU General Public License as published by

40

* the Free Software Foundation, version 2.

40

* the Free Software Foundation, version 2.

41

*/

41

*/

42

#include <linux/kernel.h>

42

#include <linux/kernel.h>

43

#include <linux/slab.h>

43

#include <linux/slab.h>

44

#include <linux/string.h>

44

#include <linux/string.h>

45

#include <linux/spinlock.h>

45

#include <linux/spinlock.h>

46

#include <linux/rcupdate.h>

46

#include <linux/rcupdate.h>

47

#include <linux/errno.h>

47

#include <linux/errno.h>

48

#include <linux/in.h>

48

#include <linux/in.h>

49

#include <linux/sched.h>

49

#include <linux/sched.h>

50

#include <linux/audit.h>

50

#include <linux/audit.h>

51

#include <linux/mutex.h>

51

#include <linux/mutex.h>

52

#include <linux/selinux.h>

52

#include <linux/selinux.h>

53

#include <linux/flex_array.h>

53

#include <linux/flex_array.h>

54

#include <linux/vmalloc.h>

54

#include <linux/vmalloc.h>

55

#include <net/netlabel.h>

55

#include <net/netlabel.h>

56

57

#include "flask.h"

57

#include "flask.h"

58

#include "avc.h"

58

#include "avc.h"

59

#include "avc_ss.h"

59

#include "avc_ss.h"

60

#include "security.h"

60

#include "security.h"

61

#include "context.h"

61

#include "context.h"

62

#include "policydb.h"

62

#include "policydb.h"

63

#include "sidtab.h"

63

#include "sidtab.h"

64

#include "services.h"

64

#include "services.h"

65

#include "conditional.h"

65

#include "conditional.h"

66

#include "mls.h"

66

#include "mls.h"

67

#include "objsec.h"

67

#include "objsec.h"

68

#include "netlabel.h"

68

#include "netlabel.h"

69

#include "xfrm.h"

69

#include "xfrm.h"

70

#include "ebitmap.h"

70

#include "ebitmap.h"

71

#include "audit.h"

71

#include "audit.h"

72

73

int selinux_policycap_netpeer;

73

int selinux_policycap_netpeer;

74

int selinux_policycap_openperm;

74

int selinux_policycap_openperm;

75

int selinux_policycap_alwaysnetwork;

75

int selinux_policycap_alwaysnetwork;

76

77

static DEFINE_RWLOCK(policy_rwlock);

77

static DEFINE_RWLOCK(policy_rwlock);

78

79

static struct sidtab sidtab;

79

static struct sidtab sidtab;

80

struct policydb policydb;

80

struct policydb policydb;

81

int ss_initialized;

81

int ss_initialized;

82

83

/*

83

/*

84

* The largest sequence number that has been used when

84

* The largest sequence number that has been used when

85

* providing an access decision to the access vector cache.

85

* providing an access decision to the access vector cache.

86

* The sequence number only changes when a policy change

86

* The sequence number only changes when a policy change

87

* occurs.

87

* occurs.

88

*/

88

*/

89

static u32 latest_granting;

89

static u32 latest_granting;

90

91

/* Forward declaration. */

91

/* Forward declaration. */

92

static int context_struct_to_string(struct context *context, char **scontext,

92

static int context_struct_to_string(struct context *context, char **scontext,

93

u32 *scontext_len);

93

u32 *scontext_len);

94

95

static void context_struct_compute_av(struct context *scontext,

95

static void context_struct_compute_av(struct context *scontext,

96

struct context *tcontext,

96

struct context *tcontext,

97

u16 tclass,

97

u16 tclass,

98

struct av_decision *avd);

98

struct av_decision *avd);

99

100

struct selinux_mapping {

100

struct selinux_mapping {

101

u16 value; /* policy value */

101

u16 value; /* policy value */

102

unsigned num_perms;

102

unsigned num_perms;

103

u32 perms[sizeof(u32) * 8];

103

u32 perms[sizeof(u32) * 8];

104

};

104

};

105

106

static struct selinux_mapping *current_mapping;

106

static struct selinux_mapping *current_mapping;

107

static u16 current_mapping_size;

107

static u16 current_mapping_size;

108

109

static int selinux_set_mapping(struct policydb *pol,

109

static int selinux_set_mapping(struct policydb *pol,

110

struct security_class_mapping *map,

110

struct security_class_mapping *map,

111

struct selinux_mapping **out_map_p,

111

struct selinux_mapping **out_map_p,

112

u16 *out_map_size)

112

u16 *out_map_size)

113

{

113

{

114

struct selinux_mapping *out_map = NULL;

114

struct selinux_mapping *out_map = NULL;

115

size_t size = sizeof(struct selinux_mapping);

115

size_t size = sizeof(struct selinux_mapping);

116

u16 i, j;

116

u16 i, j;

117

unsigned k;

117

unsigned k;

118

bool print_unknown_handle = false;

118

bool print_unknown_handle = false;

119

120

/* Find number of classes in the input mapping */

120

/* Find number of classes in the input mapping */

121

if (!map)

121

if (!map)

122

return -EINVAL;

122

return -EINVAL;

123

i = 0;

123

i = 0;

124

while (map[i].name)

124

while (map[i].name)

125

i++;

125

i++;

126

127

/* Allocate space for the class records, plus one for class zero */

127

/* Allocate space for the class records, plus one for class zero */

128

out_map = kcalloc(++i, size, GFP_ATOMIC);

128

out_map = kcalloc(++i, size, GFP_ATOMIC);

129

if (!out_map)

129

if (!out_map)

130

return -ENOMEM;

130

return -ENOMEM;

131

132

/* Store the raw class and permission values */

132

/* Store the raw class and permission values */

133

j = 0;

133

j = 0;

134

while (map[j].name) {

134

while (map[j].name) {

135

struct security_class_mapping *p_in = map + (j++);

135

struct security_class_mapping *p_in = map + (j++);

136

struct selinux_mapping *p_out = out_map + j;

136

struct selinux_mapping *p_out = out_map + j;

137

138

/* An empty class string skips ahead */

138

/* An empty class string skips ahead */

139

if (!strcmp(p_in->name, "")) {

139

if (!strcmp(p_in->name, "")) {

140

p_out->num_perms = 0;

140

p_out->num_perms = 0;

141

continue;

141

continue;

142

}

142

}

143

144

p_out->value = string_to_security_class(pol, p_in->name);

144

p_out->value = string_to_security_class(pol, p_in->name);

145

if (!p_out->value) {

145

if (!p_out->value) {

146

printk(KERN_INFO

146

printk(KERN_INFO

147

"SELinux: Class %s not defined in policy.\n",

147

"SELinux: Class %s not defined in policy.\n",

148

p_in->name);

148

p_in->name);

149

if (pol->reject_unknown)

149

if (pol->reject_unknown)

150

goto err;

150

goto err;

151

p_out->num_perms = 0;

151

p_out->num_perms = 0;

152

print_unknown_handle = true;

152

print_unknown_handle = true;

153

continue;

153

continue;

154

}

154

}

155

156

k = 0;

156

k = 0;

157

while (p_in->perms && p_in->perms[k]) {

157

while (p_in->perms && p_in->perms[k]) {

158

/* An empty permission string skips ahead */

158

/* An empty permission string skips ahead */

159

if (!*p_in->perms[k]) {

159

if (!*p_in->perms[k]) {

160

k++;

160

k++;

161

continue;

161

continue;

162

}

162

}

163

p_out->perms[k] = string_to_av_perm(pol, p_out->value,

163

p_out->perms[k] = string_to_av_perm(pol, p_out->value,

164

p_in->perms[k]);

164

p_in->perms[k]);

165

if (!p_out->perms[k]) {

165

if (!p_out->perms[k]) {

166

printk(KERN_INFO

166

printk(KERN_INFO

167

"SELinux: Permission %s in class %s not defined in policy.\n",

167

"SELinux: Permission %s in class %s not defined in policy.\n",

168

p_in->perms[k], p_in->name);

168

p_in->perms[k], p_in->name);

169

if (pol->reject_unknown)

169

if (pol->reject_unknown)

170

goto err;

170

goto err;

171

print_unknown_handle = true;

171

print_unknown_handle = true;

172

}

172

}

173

174

k++;

174

k++;

175

}

175

}

176

p_out->num_perms = k;

176

p_out->num_perms = k;

177

}

177

}

178

179

if (print_unknown_handle)

179

if (print_unknown_handle)

180

printk(KERN_INFO "SELinux: the above unknown classes and permissions will be %s\n",

180

printk(KERN_INFO "SELinux: the above unknown classes and permissions will be %s\n",

181

pol->allow_unknown ? "allowed" : "denied");

181

pol->allow_unknown ? "allowed" : "denied");

182

183

*out_map_p = out_map;

183

*out_map_p = out_map;

184

*out_map_size = i;

184

*out_map_size = i;

185

return 0;

185

return 0;

186

err:

186

err:

187

kfree(out_map);

187

kfree(out_map);

188

return -EINVAL;

188

return -EINVAL;

189

}

189

}

190

191

/*

191

/*

192

* Get real, policy values from mapped values

192

* Get real, policy values from mapped values

193

*/

193

*/

194

195

static u16 unmap_class(u16 tclass)

195

static u16 unmap_class(u16 tclass)

196

{

196

{

197

if (tclass < current_mapping_size)

197

if (tclass < current_mapping_size)

198

return current_mapping[tclass].value;

198

return current_mapping[tclass].value;

199

200

return tclass;

200

return tclass;

201

}

201

}

202

203

/*

203

/*

204

* Get kernel value for class from its policy value

204

* Get kernel value for class from its policy value

205

*/

205

*/

206

static u16 map_class(u16 pol_value)

206

static u16 map_class(u16 pol_value)

207

{

207

{

208

u16 i;

208

u16 i;

209

210

for (i = 1; i < current_mapping_size; i++) {

210

for (i = 1; i < current_mapping_size; i++) {

211

if (current_mapping[i].value == pol_value)

211

if (current_mapping[i].value == pol_value)

212

return i;

212

return i;

213

}

213

}

214

215

return SECCLASS_NULL;

215

return SECCLASS_NULL;

216

}

216

}

217

218

static void map_decision(u16 tclass, struct av_decision *avd,

218

static void map_decision(u16 tclass, struct av_decision *avd,

219

int allow_unknown)

219

int allow_unknown)

220

{

220

{

221

if (tclass < current_mapping_size) {

221

if (tclass < current_mapping_size) {

222

unsigned i, n = current_mapping[tclass].num_perms;

222

unsigned i, n = current_mapping[tclass].num_perms;

223

u32 result;

223

u32 result;

224

225

for (i = 0, result = 0; i < n; i++) {

225

for (i = 0, result = 0; i < n; i++) {

226

if (avd->allowed & current_mapping[tclass].perms[i])

226

if (avd->allowed & current_mapping[tclass].perms[i])

227

result |= 1<<i;

227

result |= 1<<i;

228

if (allow_unknown && !current_mapping[tclass].perms[i])

228

if (allow_unknown && !current_mapping[tclass].perms[i])

229

result |= 1<<i;

229

result |= 1<<i;

230

}

230

}

231

avd->allowed = result;

231

avd->allowed = result;

232

233

for (i = 0, result = 0; i < n; i++)

233

for (i = 0, result = 0; i < n; i++)

234

if (avd->auditallow & current_mapping[tclass].perms[i])

234

if (avd->auditallow & current_mapping[tclass].perms[i])

235

result |= 1<<i;

235

result |= 1<<i;

236

avd->auditallow = result;

236

avd->auditallow = result;

237

238

for (i = 0, result = 0; i < n; i++) {

238

for (i = 0, result = 0; i < n; i++) {

239

if (avd->auditdeny & current_mapping[tclass].perms[i])

239

if (avd->auditdeny & current_mapping[tclass].perms[i])

240

result |= 1<<i;

240

result |= 1<<i;

241

if (!allow_unknown && !current_mapping[tclass].perms[i])

241

if (!allow_unknown && !current_mapping[tclass].perms[i])

242

result |= 1<<i;

242

result |= 1<<i;

243

}

243

}

244

/*

244

/*

245

* In case the kernel has a bug and requests a permission

245

* In case the kernel has a bug and requests a permission

246

* between num_perms and the maximum permission number, we

246

* between num_perms and the maximum permission number, we

247

* should audit that denial

247

* should audit that denial

248

*/

248

*/

249

for (; i < (sizeof(u32)*8); i++)

249

for (; i < (sizeof(u32)*8); i++)

250

result |= 1<<i;

250

result |= 1<<i;

251

avd->auditdeny = result;

251

avd->auditdeny = result;

252

}

252

}

253

}

253

}

254

255

int security_mls_enabled(void)

255

int security_mls_enabled(void)

256

{

256

{

257

return policydb.mls_enabled;

257

return policydb.mls_enabled;

258

}

258

}

259

260

/*

260

/*

261

* Return the boolean value of a constraint expression

261

* Return the boolean value of a constraint expression

262

* when it is applied to the specified source and target

262

* when it is applied to the specified source and target

263

* security contexts.

263

* security contexts.

264

*

264

*

265

* xcontext is a special beast... It is used by the validatetrans rules

265

* xcontext is a special beast... It is used by the validatetrans rules

266

* only. For these rules, scontext is the context before the transition,

266

* only. For these rules, scontext is the context before the transition,

267

* tcontext is the context after the transition, and xcontext is the context

267

* tcontext is the context after the transition, and xcontext is the context

268

* of the process performing the transition. All other callers of

268

* of the process performing the transition. All other callers of

269

* constraint_expr_eval should pass in NULL for xcontext.

269

* constraint_expr_eval should pass in NULL for xcontext.

270

*/

270

*/

271

static int constraint_expr_eval(struct context *scontext,

271

static int constraint_expr_eval(struct context *scontext,

272

struct context *tcontext,

272

struct context *tcontext,

273

struct context *xcontext,

273

struct context *xcontext,

274

struct constraint_expr *cexpr)

274

struct constraint_expr *cexpr)

275

{

275

{

276

u32 val1, val2;

276

u32 val1, val2;

277

struct context *c;

277

struct context *c;

278

struct role_datum *r1, *r2;

278

struct role_datum *r1, *r2;

279

struct mls_level *l1, *l2;

279

struct mls_level *l1, *l2;

280

struct constraint_expr *e;

280

struct constraint_expr *e;

281

int s[CEXPR_MAXDEPTH];

281

int s[CEXPR_MAXDEPTH];

282

int sp = -1;

282

int sp = -1;

283

284

for (e = cexpr; e; e = e->next) {

284

for (e = cexpr; e; e = e->next) {

285

switch (e->expr_type) {

285

switch (e->expr_type) {

286

case CEXPR_NOT:

286

case CEXPR_NOT:

287

BUG_ON(sp < 0);

287

BUG_ON(sp < 0);

288

s[sp] = !s[sp];

288

s[sp] = !s[sp];

289

break;

289

break;

290

case CEXPR_AND:

290

case CEXPR_AND:

291

BUG_ON(sp < 1);

291

BUG_ON(sp < 1);

292

sp--;

292

sp--;

293

s[sp] &= s[sp + 1];

293

s[sp] &= s[sp + 1];

294

break;

294

break;

295

case CEXPR_OR:

295

case CEXPR_OR:

296

BUG_ON(sp < 1);

296

BUG_ON(sp < 1);

297

sp--;

297

sp--;

298

s[sp] |= s[sp + 1];

298

s[sp] |= s[sp + 1];

299

break;

299

break;

300

case CEXPR_ATTR:

300

case CEXPR_ATTR:

301

if (sp == (CEXPR_MAXDEPTH - 1))

301

if (sp == (CEXPR_MAXDEPTH - 1))

302

return 0;

302

return 0;

303

switch (e->attr) {

303

switch (e->attr) {

304

case CEXPR_USER:

304

case CEXPR_USER:

305

val1 = scontext->user;

305

val1 = scontext->user;

306

val2 = tcontext->user;

306

val2 = tcontext->user;

307

break;

307

break;

308

case CEXPR_TYPE:

308

case CEXPR_TYPE:

309

val1 = scontext->type;

309

val1 = scontext->type;

310

val2 = tcontext->type;

310

val2 = tcontext->type;

311

break;

311

break;

312

case CEXPR_ROLE:

312

case CEXPR_ROLE:

313

val1 = scontext->role;

313

val1 = scontext->role;

314

val2 = tcontext->role;

314

val2 = tcontext->role;

315

r1 = policydb.role_val_to_struct[val1 - 1];

315

r1 = policydb.role_val_to_struct[val1 - 1];

316

r2 = policydb.role_val_to_struct[val2 - 1];

316

r2 = policydb.role_val_to_struct[val2 - 1];

317

switch (e->op) {

317

switch (e->op) {

318

case CEXPR_DOM:

318

case CEXPR_DOM:

319

s[++sp] = ebitmap_get_bit(&r1->dominates,

319

s[++sp] = ebitmap_get_bit(&r1->dominates,

320

val2 - 1);

320

val2 - 1);

321

continue;

321

continue;

322

case CEXPR_DOMBY:

322

case CEXPR_DOMBY:

323

s[++sp] = ebitmap_get_bit(&r2->dominates,

323

s[++sp] = ebitmap_get_bit(&r2->dominates,

324

val1 - 1);

324

val1 - 1);

325

continue;

325

continue;

326

case CEXPR_INCOMP:

326

case CEXPR_INCOMP:

327

s[++sp] = (!ebitmap_get_bit(&r1->dominates,

327

s[++sp] = (!ebitmap_get_bit(&r1->dominates,

328

val2 - 1) &&

328

val2 - 1) &&

329

!ebitmap_get_bit(&r2->dominates,

329

!ebitmap_get_bit(&r2->dominates,

330

val1 - 1));

330

val1 - 1));

331

continue;

331

continue;

332

default:

332

default:

333

break;

333

break;

334

}

334

}

335

break;

335

break;

336

case CEXPR_L1L2:

336

case CEXPR_L1L2:

337

l1 = &(scontext->range.level[0]);

337

l1 = &(scontext->range.level[0]);

338

l2 = &(tcontext->range.level[0]);

338

l2 = &(tcontext->range.level[0]);

339

goto mls_ops;

339

goto mls_ops;

340

case CEXPR_L1H2:

340

case CEXPR_L1H2:

341

l1 = &(scontext->range.level[0]);

341

l1 = &(scontext->range.level[0]);

342

l2 = &(tcontext->range.level[1]);

342

l2 = &(tcontext->range.level[1]);

343

goto mls_ops;

343

goto mls_ops;

344

case CEXPR_H1L2:

344

case CEXPR_H1L2:

345

l1 = &(scontext->range.level[1]);

345

l1 = &(scontext->range.level[1]);

346

l2 = &(tcontext->range.level[0]);

346

l2 = &(tcontext->range.level[0]);

347

goto mls_ops;

347

goto mls_ops;

348

case CEXPR_H1H2:

348

case CEXPR_H1H2:

349

l1 = &(scontext->range.level[1]);

349

l1 = &(scontext->range.level[1]);

350

l2 = &(tcontext->range.level[1]);

350

l2 = &(tcontext->range.level[1]);

351

goto mls_ops;

351

goto mls_ops;

352

case CEXPR_L1H1:

352

case CEXPR_L1H1:

353

l1 = &(scontext->range.level[0]);

353

l1 = &(scontext->range.level[0]);

354

l2 = &(scontext->range.level[1]);

354

l2 = &(scontext->range.level[1]);

355

goto mls_ops;

355

goto mls_ops;

356

case CEXPR_L2H2:

356

case CEXPR_L2H2:

357

l1 = &(tcontext->range.level[0]);

357

l1 = &(tcontext->range.level[0]);

358

l2 = &(tcontext->range.level[1]);

358

l2 = &(tcontext->range.level[1]);

359

goto mls_ops;

359

goto mls_ops;

360

mls_ops:

360

mls_ops:

361

switch (e->op) {

361

switch (e->op) {

362

case CEXPR_EQ:

362

case CEXPR_EQ:

363

s[++sp] = mls_level_eq(l1, l2);

363

s[++sp] = mls_level_eq(l1, l2);

364

continue;

364

continue;

365

case CEXPR_NEQ:

365

case CEXPR_NEQ:

366

s[++sp] = !mls_level_eq(l1, l2);

366

s[++sp] = !mls_level_eq(l1, l2);

367

continue;

367

continue;

368

case CEXPR_DOM:

368

case CEXPR_DOM:

369

s[++sp] = mls_level_dom(l1, l2);

369

s[++sp] = mls_level_dom(l1, l2);

370

continue;

370

continue;

371

case CEXPR_DOMBY:

371

case CEXPR_DOMBY:

372

s[++sp] = mls_level_dom(l2, l1);

372

s[++sp] = mls_level_dom(l2, l1);

373

continue;

373

continue;

374

case CEXPR_INCOMP:

374

case CEXPR_INCOMP:

375

s[++sp] = mls_level_incomp(l2, l1);

375

s[++sp] = mls_level_incomp(l2, l1);

376

continue;

376

continue;

377

default:

377

default:

378

BUG();

378

BUG();

379

return 0;

379

return 0;

380

}

380

}

381

break;

381

break;

382

default:

382

default:

383

BUG();

383

BUG();

384

return 0;

384

return 0;

385

}

385

}

386

387

switch (e->op) {

387

switch (e->op) {

388

case CEXPR_EQ:

388

case CEXPR_EQ:

389

s[++sp] = (val1 == val2);

389

s[++sp] = (val1 == val2);

390

break;

390

break;

391

case CEXPR_NEQ:

391

case CEXPR_NEQ:

392

s[++sp] = (val1 != val2);

392

s[++sp] = (val1 != val2);

393

break;

393

break;

394

default:

394

default:

395

BUG();

395

BUG();

396

return 0;

396

return 0;

397

}

397

}

398

break;

398

break;

399

case CEXPR_NAMES:

399

case CEXPR_NAMES:

400

if (sp == (CEXPR_MAXDEPTH-1))

400

if (sp == (CEXPR_MAXDEPTH-1))

401

return 0;

401

return 0;

402

c = scontext;

402

c = scontext;

403

if (e->attr & CEXPR_TARGET)

403

if (e->attr & CEXPR_TARGET)

404

c = tcontext;

404

c = tcontext;

405

else if (e->attr & CEXPR_XTARGET) {

405

else if (e->attr & CEXPR_XTARGET) {

406

c = xcontext;

406

c = xcontext;

407

if (!c) {

407

if (!c) {

408

BUG();

408

BUG();

409

return 0;

409

return 0;

410

}

410

}

411

}

411

}

412

if (e->attr & CEXPR_USER)

412

if (e->attr & CEXPR_USER)

413

val1 = c->user;

413

val1 = c->user;

414

else if (e->attr & CEXPR_ROLE)

414

else if (e->attr & CEXPR_ROLE)

415

val1 = c->role;

415

val1 = c->role;

416

else if (e->attr & CEXPR_TYPE)

416

else if (e->attr & CEXPR_TYPE)

417

val1 = c->type;

417

val1 = c->type;

418

else {

418

else {

419

BUG();

419

BUG();

420

return 0;

420

return 0;

421

}

421

}

422

423

switch (e->op) {

423

switch (e->op) {

424

case CEXPR_EQ:

424

case CEXPR_EQ:

425

s[++sp] = ebitmap_get_bit(&e->names, val1 - 1);

425

s[++sp] = ebitmap_get_bit(&e->names, val1 - 1);

426

break;

426

break;

427

case CEXPR_NEQ:

427

case CEXPR_NEQ:

428

s[++sp] = !ebitmap_get_bit(&e->names, val1 - 1);

428

s[++sp] = !ebitmap_get_bit(&e->names, val1 - 1);

429

break;

429

break;

430

default:

430

default:

431

BUG();

431

BUG();

432

return 0;

432

return 0;

433

}

433

}

434

break;

434

break;

435

default:

435

default:

436

BUG();

436

BUG();

437

return 0;

437

return 0;

438

}

438

}

439

}

439

}

440

441

BUG_ON(sp != 0);

441

BUG_ON(sp != 0);

442

return s[0];

442

return s[0];

443

}

443

}

444

445

/*

445

/*

446

* security_dump_masked_av - dumps masked permissions during

446

* security_dump_masked_av - dumps masked permissions during

447

* security_compute_av due to RBAC, MLS/Constraint and Type bounds.

447

* security_compute_av due to RBAC, MLS/Constraint and Type bounds.

448

*/

448

*/

449

static int dump_masked_av_helper(void *k, void *d, void *args)

449

static int dump_masked_av_helper(void *k, void *d, void *args)

450

{

450

{

451

struct perm_datum *pdatum = d;

451

struct perm_datum *pdatum = d;

452

char **permission_names = args;

452

char **permission_names = args;

453

454

BUG_ON(pdatum->value < 1 || pdatum->value > 32);

454

BUG_ON(pdatum->value < 1 || pdatum->value > 32);

455

456

permission_names[pdatum->value - 1] = (char *)k;

456

permission_names[pdatum->value - 1] = (char *)k;

457

458

return 0;

458

return 0;

459

}

459

}

460

461

static void security_dump_masked_av(struct context *scontext,

461

static void security_dump_masked_av(struct context *scontext,

462

struct context *tcontext,

462

struct context *tcontext,

463

u16 tclass,

463

u16 tclass,

464

u32 permissions,

464

u32 permissions,

465

const char *reason)

465

const char *reason)

466

{

466

{

467

struct common_datum *common_dat;

467

struct common_datum *common_dat;

468

struct class_datum *tclass_dat;

468

struct class_datum *tclass_dat;

469

struct audit_buffer *ab;

469

struct audit_buffer *ab;

470

char *tclass_name;

470

char *tclass_name;

471

char *scontext_name = NULL;

471

char *scontext_name = NULL;

472

char *tcontext_name = NULL;

472

char *tcontext_name = NULL;

473

char *permission_names[32];

473

char *permission_names[32];

474

int index;

474

int index;

475

u32 length;

475

u32 length;

476

bool need_comma = false;

476

bool need_comma = false;

477

478

if (!permissions)

478

if (!permissions)

479

return;

479

return;

480

481

tclass_name = sym_name(&policydb, SYM_CLASSES, tclass - 1);

481

tclass_name = sym_name(&policydb, SYM_CLASSES, tclass - 1);

482

tclass_dat = policydb.class_val_to_struct[tclass - 1];

482

tclass_dat = policydb.class_val_to_struct[tclass - 1];

483

common_dat = tclass_dat->comdatum;

483

common_dat = tclass_dat->comdatum;

484

485

/* init permission_names */

485

/* init permission_names */

486

if (common_dat &&

486

if (common_dat &&

487

hashtab_map(common_dat->permissions.table,

487

hashtab_map(common_dat->permissions.table,

488

dump_masked_av_helper, permission_names) < 0)

488

dump_masked_av_helper, permission_names) < 0)

489

goto out;

489

goto out;

490

491

if (hashtab_map(tclass_dat->permissions.table,

491

if (hashtab_map(tclass_dat->permissions.table,

492

dump_masked_av_helper, permission_names) < 0)

492

dump_masked_av_helper, permission_names) < 0)

493

goto out;

493

goto out;

494

495

/* get scontext/tcontext in text form */

495

/* get scontext/tcontext in text form */

496

if (context_struct_to_string(scontext,

496

if (context_struct_to_string(scontext,

497

&scontext_name, &length) < 0)

497

&scontext_name, &length) < 0)

498

goto out;

498

goto out;

499

500

if (context_struct_to_string(tcontext,

500

if (context_struct_to_string(tcontext,

501

&tcontext_name, &length) < 0)

501

&tcontext_name, &length) < 0)

502

goto out;

502

goto out;

503

504

/* audit a message */

504

/* audit a message */

505

ab = audit_log_start(current->audit_context,

505

ab = audit_log_start(current->audit_context,

506

GFP_ATOMIC, AUDIT_SELINUX_ERR);

506

GFP_ATOMIC, AUDIT_SELINUX_ERR);

507

if (!ab)

507

if (!ab)

508

goto out;

508

goto out;

509

510

audit_log_format(ab, "op=security_compute_av reason=%s "

510

audit_log_format(ab, "op=security_compute_av reason=%s "

511

"scontext=%s tcontext=%s tclass=%s perms=",

511

"scontext=%s tcontext=%s tclass=%s perms=",

512

reason, scontext_name, tcontext_name, tclass_name);

512

reason, scontext_name, tcontext_name, tclass_name);

513

514

for (index = 0; index < 32; index++) {

514

for (index = 0; index < 32; index++) {

515

u32 mask = (1 << index);

515

u32 mask = (1 << index);

516

517

if ((mask & permissions) == 0)

517

if ((mask & permissions) == 0)

518

continue;

518

continue;

519

520

audit_log_format(ab, "%s%s",

520

audit_log_format(ab, "%s%s",

521

need_comma ? "," : "",

521

need_comma ? "," : "",

522

permission_names[index]

522

permission_names[index]

523

? permission_names[index] : "????");

523

? permission_names[index] : "????");

524

need_comma = true;

524

need_comma = true;

525

}

525

}

526

audit_log_end(ab);

526

audit_log_end(ab);

527

out:

527

out:

528

/* release scontext/tcontext */

528

/* release scontext/tcontext */

529

kfree(tcontext_name);

529

kfree(tcontext_name);

530

kfree(scontext_name);

530

kfree(scontext_name);

531

532

return;

532

return;

533

}

533

}

534

535

/*

535

/*

536

* security_boundary_permission - drops violated permissions

536

* security_boundary_permission - drops violated permissions

537

* on boundary constraint.

537

* on boundary constraint.

538

*/

538

*/

539

static void type_attribute_bounds_av(struct context *scontext,

539

static void type_attribute_bounds_av(struct context *scontext,

540

struct context *tcontext,

540

struct context *tcontext,

541

u16 tclass,

541

u16 tclass,

542

struct av_decision *avd)

542

struct av_decision *avd)

543

{

543

{

544

struct context lo_scontext;

544

struct context lo_scontext;

545

struct context lo_tcontext;

545

struct context lo_tcontext;

546

struct av_decision lo_avd;

546

struct av_decision lo_avd;

547

struct type_datum *source;

547

struct type_datum *source;

548

struct type_datum *target;

548

struct type_datum *target;

549

u32 masked = 0;

549

u32 masked = 0;

550

551

source = flex_array_get_ptr(policydb.type_val_to_struct_array,

551

source = flex_array_get_ptr(policydb.type_val_to_struct_array,

552

scontext->type - 1);

552

scontext->type - 1);

553

BUG_ON(!source);

553

BUG_ON(!source);

554

555

target = flex_array_get_ptr(policydb.type_val_to_struct_array,

555

target = flex_array_get_ptr(policydb.type_val_to_struct_array,

556

tcontext->type - 1);

556

tcontext->type - 1);

557

BUG_ON(!target);

557

BUG_ON(!target);

558

559

if (source->bounds) {

559

if (source->bounds) {

560

memset(&lo_avd, 0, sizeof(lo_avd));

560

memset(&lo_avd, 0, sizeof(lo_avd));

561

562

memcpy(&lo_scontext, scontext, sizeof(lo_scontext));

562

memcpy(&lo_scontext, scontext, sizeof(lo_scontext));

563

lo_scontext.type = source->bounds;

563

lo_scontext.type = source->bounds;

564

565

context_struct_compute_av(&lo_scontext,

565

context_struct_compute_av(&lo_scontext,

566

tcontext,

566

tcontext,

567

tclass,

567

tclass,

568

&lo_avd);

568

&lo_avd);

569

if ((lo_avd.allowed & avd->allowed) == avd->allowed)

569

if ((lo_avd.allowed & avd->allowed) == avd->allowed)

570

return; /* no masked permission */

570

return; /* no masked permission */

571

masked = ~lo_avd.allowed & avd->allowed;

571

masked = ~lo_avd.allowed & avd->allowed;

572

}

572

}

573

574

if (target->bounds) {

574

if (target->bounds) {

575

memset(&lo_avd, 0, sizeof(lo_avd));

575

memset(&lo_avd, 0, sizeof(lo_avd));

576

577

memcpy(&lo_tcontext, tcontext, sizeof(lo_tcontext));

577

memcpy(&lo_tcontext, tcontext, sizeof(lo_tcontext));

578

lo_tcontext.type = target->bounds;

578

lo_tcontext.type = target->bounds;

579

580

context_struct_compute_av(scontext,

580

context_struct_compute_av(scontext,

581

&lo_tcontext,

581

&lo_tcontext,

582

tclass,

582

tclass,

583

&lo_avd);

583

&lo_avd);

584

if ((lo_avd.allowed & avd->allowed) == avd->allowed)

584

if ((lo_avd.allowed & avd->allowed) == avd->allowed)

585

return; /* no masked permission */

585

return; /* no masked permission */

586

masked = ~lo_avd.allowed & avd->allowed;

586

masked = ~lo_avd.allowed & avd->allowed;

587

}

587

}

588

589

if (source->bounds && target->bounds) {

589

if (source->bounds && target->bounds) {

590

memset(&lo_avd, 0, sizeof(lo_avd));

590

memset(&lo_avd, 0, sizeof(lo_avd));

591

/*

591

/*

592

* lo_scontext and lo_tcontext are already

592

* lo_scontext and lo_tcontext are already

593

* set up.

593

* set up.

594

*/

594

*/

595

596

context_struct_compute_av(&lo_scontext,

596

context_struct_compute_av(&lo_scontext,

597

&lo_tcontext,

597

&lo_tcontext,

598

tclass,

598

tclass,

599

&lo_avd);

599

&lo_avd);

600

if ((lo_avd.allowed & avd->allowed) == avd->allowed)

600

if ((lo_avd.allowed & avd->allowed) == avd->allowed)

601

return; /* no masked permission */

601

return; /* no masked permission */

602

masked = ~lo_avd.allowed & avd->allowed;

602

masked = ~lo_avd.allowed & avd->allowed;

603

}

603

}

604

605

if (masked) {

605

if (masked) {

606

/* mask violated permissions */

606

/* mask violated permissions */

607

avd->allowed &= ~masked;

607

avd->allowed &= ~masked;

608

609

/* audit masked permissions */

609

/* audit masked permissions */

610

security_dump_masked_av(scontext, tcontext,

610

security_dump_masked_av(scontext, tcontext,

611

tclass, masked, "bounds");

611

tclass, masked, "bounds");

612

}

612

}

613

}

613

}

614

615

/*

615

/*

616

* Compute access vectors based on a context structure pair for

616

* Compute access vectors based on a context structure pair for

617

* the permissions in a particular class.

617

* the permissions in a particular class.

618

*/

618

*/

619

static void context_struct_compute_av(struct context *scontext,

619

static void context_struct_compute_av(struct context *scontext,

620

struct context *tcontext,

620

struct context *tcontext,

621

u16 tclass,

621

u16 tclass,

622

struct av_decision *avd)

622

struct av_decision *avd)

623

{

623

{

624

struct constraint_node *constraint;

624

struct constraint_node *constraint;

625

struct role_allow *ra;

625

struct role_allow *ra;

626

struct avtab_key avkey;

626

struct avtab_key avkey;

627

struct avtab_node *node;

627

struct avtab_node *node;

628

struct class_datum *tclass_datum;

628

struct class_datum *tclass_datum;

629

struct ebitmap *sattr, *tattr;

629

struct ebitmap *sattr, *tattr;

630

struct ebitmap_node *snode, *tnode;

630

struct ebitmap_node *snode, *tnode;

631

unsigned int i, j;

631

unsigned int i, j;

632

633

avd->allowed = 0;

633

avd->allowed = 0;

634

avd->auditallow = 0;

634

avd->auditallow = 0;

635

avd->auditdeny = 0xffffffff;

635

avd->auditdeny = 0xffffffff;

636

637

if (unlikely(!tclass || tclass > policydb.p_classes.nprim)) {

637

if (unlikely(!tclass || tclass > policydb.p_classes.nprim)) {

638

if (printk_ratelimit())

638

if (printk_ratelimit())

639

printk(KERN_WARNING "SELinux: Invalid class %hu\n", tclass);

639

printk(KERN_WARNING "SELinux: Invalid class %hu\n", tclass);

640

return;

640

return;

641

}

641

}

642

643

tclass_datum = policydb.class_val_to_struct[tclass - 1];

643

tclass_datum = policydb.class_val_to_struct[tclass - 1];

644

645

/*

645

/*

646

* If a specific type enforcement rule was defined for

646

* If a specific type enforcement rule was defined for

647

* this permission check, then use it.

647

* this permission check, then use it.

648

*/

648

*/

649

avkey.target_class = tclass;

649

avkey.target_class = tclass;

650

avkey.specified = AVTAB_AV;

650

avkey.specified = AVTAB_AV;

651

sattr = flex_array_get(policydb.type_attr_map_array, scontext->type - 1);

651

sattr = flex_array_get(policydb.type_attr_map_array, scontext->type - 1);

652

BUG_ON(!sattr);

652

BUG_ON(!sattr);

653

tattr = flex_array_get(policydb.type_attr_map_array, tcontext->type - 1);

653

tattr = flex_array_get(policydb.type_attr_map_array, tcontext->type - 1);

654

BUG_ON(!tattr);

654

BUG_ON(!tattr);

655

ebitmap_for_each_positive_bit(sattr, snode, i) {

655

ebitmap_for_each_positive_bit(sattr, snode, i) {

656

ebitmap_for_each_positive_bit(tattr, tnode, j) {

656

ebitmap_for_each_positive_bit(tattr, tnode, j) {

657

avkey.source_type = i + 1;

657

avkey.source_type = i + 1;

658

avkey.target_type = j + 1;

658

avkey.target_type = j + 1;

659

for (node = avtab_search_node(&policydb.te_avtab, &avkey);

659

for (node = avtab_search_node(&policydb.te_avtab, &avkey);

660

node;

660

node;

661

node = avtab_search_node_next(node, avkey.specified)) {

661

node = avtab_search_node_next(node, avkey.specified)) {

662

if (node->key.specified == AVTAB_ALLOWED)

662

if (node->key.specified == AVTAB_ALLOWED)

663

avd->allowed |= node->datum.data;

663

avd->allowed |= node->datum.data;

664

else if (node->key.specified == AVTAB_AUDITALLOW)

664

else if (node->key.specified == AVTAB_AUDITALLOW)

665

avd->auditallow |= node->datum.data;

665

avd->auditallow |= node->datum.data;

666

else if (node->key.specified == AVTAB_AUDITDENY)

666

else if (node->key.specified == AVTAB_AUDITDENY)

667

avd->auditdeny &= node->datum.data;

667

avd->auditdeny &= node->datum.data;

668

}

668

}

669

670

/* Check conditional av table for additional permissions */

670

/* Check conditional av table for additional permissions */

671

cond_compute_av(&policydb.te_cond_avtab, &avkey, avd);

671

cond_compute_av(&policydb.te_cond_avtab, &avkey, avd);

672

673

}

673

}

674

}

674

}

675

676

/*

676

/*

677

* Remove any permissions prohibited by a constraint (this includes

677

* Remove any permissions prohibited by a constraint (this includes

678

* the MLS policy).

678

* the MLS policy).

679

*/

679

*/

680

constraint = tclass_datum->constraints;

680

constraint = tclass_datum->constraints;

681

while (constraint) {

681

while (constraint) {

682

if ((constraint->permissions & (avd->allowed)) &&

682

if ((constraint->permissions & (avd->allowed)) &&

683

!constraint_expr_eval(scontext, tcontext, NULL,

683

!constraint_expr_eval(scontext, tcontext, NULL,

684

constraint->expr)) {

684

constraint->expr)) {

685

avd->allowed &= ~(constraint->permissions);

685

avd->allowed &= ~(constraint->permissions);

686

}

686

}

687

constraint = constraint->next;

687

constraint = constraint->next;

688

}

688

}

689

690

/*

690

/*

691

* If checking process transition permission and the

691

* If checking process transition permission and the

692

* role is changing, then check the (current_role, new_role)

692

* role is changing, then check the (current_role, new_role)

693

* pair.

693

* pair.

694

*/

694

*/

695

if (tclass == policydb.process_class &&

695

if (tclass == policydb.process_class &&

696

(avd->allowed & policydb.process_trans_perms) &&

696

(avd->allowed & policydb.process_trans_perms) &&

697

scontext->role != tcontext->role) {

697

scontext->role != tcontext->role) {

698

for (ra = policydb.role_allow; ra; ra = ra->next) {

698

for (ra = policydb.role_allow; ra; ra = ra->next) {

699

if (scontext->role == ra->role &&

699

if (scontext->role == ra->role &&

700

tcontext->role == ra->new_role)

700

tcontext->role == ra->new_role)

701

break;

701

break;

702

}

702

}

703

if (!ra)

703

if (!ra)

704

avd->allowed &= ~policydb.process_trans_perms;

704

avd->allowed &= ~policydb.process_trans_perms;

705

}

705

}

706

707

/*

707

/*

708

* If the given source and target types have boundary

708

* If the given source and target types have boundary

709

* constraint, lazy checks have to mask any violated

709

* constraint, lazy checks have to mask any violated

710

* permission and notice it to userspace via audit.

710

* permission and notice it to userspace via audit.

711

*/

711

*/

712

type_attribute_bounds_av(scontext, tcontext,

712

type_attribute_bounds_av(scontext, tcontext,

713

tclass, avd);

713

tclass, avd);

714

}

714

}

715

716

static int security_validtrans_handle_fail(struct context *ocontext,

716

static int security_validtrans_handle_fail(struct context *ocontext,

717

struct context *ncontext,

717

struct context *ncontext,

718

struct context *tcontext,

718

struct context *tcontext,

719

u16 tclass)

719

u16 tclass)

720

{

720

{

721

char *o = NULL, *n = NULL, *t = NULL;

721

char *o = NULL, *n = NULL, *t = NULL;

722

u32 olen, nlen, tlen;

722

u32 olen, nlen, tlen;

723

724

if (context_struct_to_string(ocontext, &o, &olen))

724

if (context_struct_to_string(ocontext, &o, &olen))

725

goto out;

725

goto out;

726

if (context_struct_to_string(ncontext, &n, &nlen))

726

if (context_struct_to_string(ncontext, &n, &nlen))

727

goto out;

727

goto out;

728

if (context_struct_to_string(tcontext, &t, &tlen))

728

if (context_struct_to_string(tcontext, &t, &tlen))

729

goto out;

729

goto out;

730

audit_log(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR,

730

audit_log(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR,

731

"security_validate_transition: denied for"

731

"op=security_validate_transition seresult=denied"

732

" oldcontext=%s newcontext=%s taskcontext=%s tclass=%s",

732

" oldcontext=%s newcontext=%s taskcontext=%s tclass=%s",

733

o, n, t, sym_name(&policydb, SYM_CLASSES, tclass-1));

733

o, n, t, sym_name(&policydb, SYM_CLASSES, tclass-1));

734

out:

734

out:

735

kfree(o);

735

kfree(o);

736

kfree(n);

736

kfree(n);

737

kfree(t);

737

kfree(t);

738

739

if (!selinux_enforcing)

739

if (!selinux_enforcing)

740

return 0;

740

return 0;

741

return -EPERM;

741

return -EPERM;

742

}

742

}

743

744

int security_validate_transition(u32 oldsid, u32 newsid, u32 tasksid,

744

int security_validate_transition(u32 oldsid, u32 newsid, u32 tasksid,

745

u16 orig_tclass)

745

u16 orig_tclass)

746

{

746

{

747

struct context *ocontext;

747

struct context *ocontext;

748

struct context *ncontext;

748

struct context *ncontext;

749

struct context *tcontext;

749

struct context *tcontext;

750

struct class_datum *tclass_datum;

750

struct class_datum *tclass_datum;

751

struct constraint_node *constraint;

751

struct constraint_node *constraint;

752

u16 tclass;

752

u16 tclass;

753

int rc = 0;

753

int rc = 0;

754

755

if (!ss_initialized)

755

if (!ss_initialized)

756

return 0;

756

return 0;

757

758

read_lock(&policy_rwlock);

758

read_lock(&policy_rwlock);

759

760

tclass = unmap_class(orig_tclass);

760

tclass = unmap_class(orig_tclass);

761

762

if (!tclass || tclass > policydb.p_classes.nprim) {

762

if (!tclass || tclass > policydb.p_classes.nprim) {

763

printk(KERN_ERR "SELinux: %s: unrecognized class %d\n",

763

printk(KERN_ERR "SELinux: %s: unrecognized class %d\n",

764

__func__, tclass);

764

__func__, tclass);

765

rc = -EINVAL;

765

rc = -EINVAL;

766

goto out;

766

goto out;

767

}

767

}

768

tclass_datum = policydb.class_val_to_struct[tclass - 1];

768

tclass_datum = policydb.class_val_to_struct[tclass - 1];

769

770

ocontext = sidtab_search(&sidtab, oldsid);

770

ocontext = sidtab_search(&sidtab, oldsid);

771

if (!ocontext) {

771

if (!ocontext) {

772

printk(KERN_ERR "SELinux: %s: unrecognized SID %d\n",

772

printk(KERN_ERR "SELinux: %s: unrecognized SID %d\n",

773

__func__, oldsid);

773

__func__, oldsid);

774

rc = -EINVAL;

774

rc = -EINVAL;

775

goto out;

775

goto out;

776

}

776

}

777

778

ncontext = sidtab_search(&sidtab, newsid);

778

ncontext = sidtab_search(&sidtab, newsid);

779

if (!ncontext) {

779

if (!ncontext) {

780

printk(KERN_ERR "SELinux: %s: unrecognized SID %d\n",

780

printk(KERN_ERR "SELinux: %s: unrecognized SID %d\n",

781

__func__, newsid);

781

__func__, newsid);

782

rc = -EINVAL;

782

rc = -EINVAL;

783

goto out;

783

goto out;

784

}

784

}

785

786

tcontext = sidtab_search(&sidtab, tasksid);

786

tcontext = sidtab_search(&sidtab, tasksid);

787

if (!tcontext) {

787

if (!tcontext) {

788

printk(KERN_ERR "SELinux: %s: unrecognized SID %d\n",

788

printk(KERN_ERR "SELinux: %s: unrecognized SID %d\n",

789

__func__, tasksid);

789

__func__, tasksid);

790

rc = -EINVAL;

790

rc = -EINVAL;

791

goto out;

791

goto out;

792

}

792

}

793

794

constraint = tclass_datum->validatetrans;

794

constraint = tclass_datum->validatetrans;

795

while (constraint) {

795

while (constraint) {

796

if (!constraint_expr_eval(ocontext, ncontext, tcontext,

796

if (!constraint_expr_eval(ocontext, ncontext, tcontext,

797

constraint->expr)) {

797

constraint->expr)) {

798

rc = security_validtrans_handle_fail(ocontext, ncontext,

798

rc = security_validtrans_handle_fail(ocontext, ncontext,

799

tcontext, tclass);

799

tcontext, tclass);

800

goto out;

800

goto out;

801

}

801

}

802

constraint = constraint->next;

802

constraint = constraint->next;

803

}

803

}

804

805

out:

805

out:

806

read_unlock(&policy_rwlock);

806

read_unlock(&policy_rwlock);

807

return rc;

807

return rc;

808

}

808

}

809

810

/*

810

/*

811

* security_bounded_transition - check whether the given

811

* security_bounded_transition - check whether the given

812

* transition is directed to bounded, or not.

812

* transition is directed to bounded, or not.

813

* It returns 0, if @newsid is bounded by @oldsid.

813

* It returns 0, if @newsid is bounded by @oldsid.

814

* Otherwise, it returns error code.

814

* Otherwise, it returns error code.

815

*

815

*

816

* @oldsid : current security identifier

816

* @oldsid : current security identifier

817

* @newsid : destinated security identifier

817

* @newsid : destinated security identifier

818

*/

818

*/

819

int security_bounded_transition(u32 old_sid, u32 new_sid)

819

int security_bounded_transition(u32 old_sid, u32 new_sid)

820

{

820

{

821

struct context *old_context, *new_context;

821

struct context *old_context, *new_context;

822

struct type_datum *type;

822

struct type_datum *type;

823

int index;

823

int index;

824

int rc;

824

int rc;

825

826

read_lock(&policy_rwlock);

826

read_lock(&policy_rwlock);

827

828

rc = -EINVAL;

828

rc = -EINVAL;

829

old_context = sidtab_search(&sidtab, old_sid);

829

old_context = sidtab_search(&sidtab, old_sid);

830

if (!old_context) {

830

if (!old_context) {

831

printk(KERN_ERR "SELinux: %s: unrecognized SID %u\n",

831

printk(KERN_ERR "SELinux: %s: unrecognized SID %u\n",

832

__func__, old_sid);

832

__func__, old_sid);

833

goto out;

833

goto out;

834

}

834

}

835

836

rc = -EINVAL;

836

rc = -EINVAL;

837

new_context = sidtab_search(&sidtab, new_sid);

837

new_context = sidtab_search(&sidtab, new_sid);

838

if (!new_context) {

838

if (!new_context) {

839

printk(KERN_ERR "SELinux: %s: unrecognized SID %u\n",

839

printk(KERN_ERR "SELinux: %s: unrecognized SID %u\n",

840

__func__, new_sid);

840

__func__, new_sid);

841

goto out;

841

goto out;

842

}

842

}

843

844

rc = 0;

844

rc = 0;

845

/* type/domain unchanged */

845

/* type/domain unchanged */

846

if (old_context->type == new_context->type)

846

if (old_context->type == new_context->type)

847

goto out;

847

goto out;

848

849

index = new_context->type;

849

index = new_context->type;

850

while (true) {

850

while (true) {

851

type = flex_array_get_ptr(policydb.type_val_to_struct_array,

851

type = flex_array_get_ptr(policydb.type_val_to_struct_array,

852

index - 1);

852

index - 1);

853

BUG_ON(!type);

853

BUG_ON(!type);

854

855

/* not bounded anymore */

855

/* not bounded anymore */

856

rc = -EPERM;

856

rc = -EPERM;

857

if (!type->bounds)

857

if (!type->bounds)

858

break;

858

break;

859

860

/* @newsid is bounded by @oldsid */

860

/* @newsid is bounded by @oldsid */

861

rc = 0;

861

rc = 0;

862

if (type->bounds == old_context->type)

862

if (type->bounds == old_context->type)

863

break;

863

break;

864

865

index = type->bounds;

865

index = type->bounds;

866

}

866

}

867

868

if (rc) {

868

if (rc) {

869

char *old_name = NULL;

869

char *old_name = NULL;

870

char *new_name = NULL;

870

char *new_name = NULL;

871

u32 length;

871

u32 length;

872

873

if (!context_struct_to_string(old_context,

873

if (!context_struct_to_string(old_context,

874

&old_name, &length) &&

874

&old_name, &length) &&

875

!context_struct_to_string(new_context,

875

!context_struct_to_string(new_context,

876

&new_name, &length)) {

876

&new_name, &length)) {

877

audit_log(current->audit_context,

877

audit_log(current->audit_context,

878

GFP_ATOMIC, AUDIT_SELINUX_ERR,

878

GFP_ATOMIC, AUDIT_SELINUX_ERR,

879

"op=security_bounded_transition "

879

"op=security_bounded_transition "

880

"result=denied "

880

"seresult=denied "

881

"oldcontext=%s newcontext=%s",

881

"oldcontext=%s newcontext=%s",

882

old_name, new_name);

882

old_name, new_name);

883

}

883

}

884

kfree(new_name);

884

kfree(new_name);

885

kfree(old_name);

885

kfree(old_name);

886

}

886

}

887

out:

887

out:

888

read_unlock(&policy_rwlock);

888

read_unlock(&policy_rwlock);

889

890

return rc;

890

return rc;

891

}

891

}

892

893

static void avd_init(struct av_decision *avd)

893

static void avd_init(struct av_decision *avd)

894

{

894

{

895

avd->allowed = 0;

895

avd->allowed = 0;

896

avd->auditallow = 0;

896

avd->auditallow = 0;

897

avd->auditdeny = 0xffffffff;

897

avd->auditdeny = 0xffffffff;

898

avd->seqno = latest_granting;

898

avd->seqno = latest_granting;

899

avd->flags = 0;

899

avd->flags = 0;

900

}

900

}

901

902

903

/**

903

/**

904

* security_compute_av - Compute access vector decisions.

904

* security_compute_av - Compute access vector decisions.

905

* @ssid: source security identifier

905

* @ssid: source security identifier

906

* @tsid: target security identifier

906

* @tsid: target security identifier

907

* @tclass: target security class

907

* @tclass: target security class

908

* @avd: access vector decisions

908

* @avd: access vector decisions

909

*

909

*

910

* Compute a set of access vector decisions based on the

910

* Compute a set of access vector decisions based on the

911

* SID pair (@ssid, @tsid) for the permissions in @tclass.

911

* SID pair (@ssid, @tsid) for the permissions in @tclass.

912

*/

912

*/

913

void security_compute_av(u32 ssid,

913

void security_compute_av(u32 ssid,

914

u32 tsid,

914

u32 tsid,

915

u16 orig_tclass,

915

u16 orig_tclass,

916

struct av_decision *avd)

916

struct av_decision *avd)

917

{

917

{

918

u16 tclass;

918

u16 tclass;

919

struct context *scontext = NULL, *tcontext = NULL;

919

struct context *scontext = NULL, *tcontext = NULL;

920

921

read_lock(&policy_rwlock);

921

read_lock(&policy_rwlock);

922

avd_init(avd);

922

avd_init(avd);

923

if (!ss_initialized)

923

if (!ss_initialized)

924

goto allow;

924

goto allow;

925

926

scontext = sidtab_search(&sidtab, ssid);

926

scontext = sidtab_search(&sidtab, ssid);

927

if (!scontext) {

927

if (!scontext) {

928

printk(KERN_ERR "SELinux: %s: unrecognized SID %d\n",

928

printk(KERN_ERR "SELinux: %s: unrecognized SID %d\n",

929

__func__, ssid);

929

__func__, ssid);

930

goto out;

930

goto out;

931

}

931

}

932

933

/* permissive domain? */

933

/* permissive domain? */

934

if (ebitmap_get_bit(&policydb.permissive_map, scontext->type))

934

if (ebitmap_get_bit(&policydb.permissive_map, scontext->type))

935

avd->flags |= AVD_FLAGS_PERMISSIVE;

935

avd->flags |= AVD_FLAGS_PERMISSIVE;

936

937

tcontext = sidtab_search(&sidtab, tsid);

937

tcontext = sidtab_search(&sidtab, tsid);

938

if (!tcontext) {

938

if (!tcontext) {

939

printk(KERN_ERR "SELinux: %s: unrecognized SID %d\n",

939

printk(KERN_ERR "SELinux: %s: unrecognized SID %d\n",

940

__func__, tsid);

940

__func__, tsid);

941

goto out;

941

goto out;

942

}

942

}

943

944

tclass = unmap_class(orig_tclass);

944

tclass = unmap_class(orig_tclass);

945

if (unlikely(orig_tclass && !tclass)) {

945

if (unlikely(orig_tclass && !tclass)) {

946

if (policydb.allow_unknown)

946

if (policydb.allow_unknown)

947

goto allow;

947

goto allow;

948

goto out;

948

goto out;

949

}

949

}

950

context_struct_compute_av(scontext, tcontext, tclass, avd);

950

context_struct_compute_av(scontext, tcontext, tclass, avd);

951

map_decision(orig_tclass, avd, policydb.allow_unknown);

951

map_decision(orig_tclass, avd, policydb.allow_unknown);

952

out:

952

out:

953

read_unlock(&policy_rwlock);

953

read_unlock(&policy_rwlock);

954

return;

954

return;

955

allow:

955

allow:

956

avd->allowed = 0xffffffff;

956

avd->allowed = 0xffffffff;

957

goto out;

957

goto out;

958

}

958

}

959

960

void security_compute_av_user(u32 ssid,

960

void security_compute_av_user(u32 ssid,

961

u32 tsid,

961

u32 tsid,

962

u16 tclass,

962

u16 tclass,

963

struct av_decision *avd)

963

struct av_decision *avd)

964

{

964

{

965

struct context *scontext = NULL, *tcontext = NULL;

965

struct context *scontext = NULL, *tcontext = NULL;

966

967

read_lock(&policy_rwlock);

967

read_lock(&policy_rwlock);

968

avd_init(avd);

968

avd_init(avd);

969

if (!ss_initialized)

969

if (!ss_initialized)

970

goto allow;

970

goto allow;

971

972

scontext = sidtab_search(&sidtab, ssid);

972

scontext = sidtab_search(&sidtab, ssid);

973

if (!scontext) {

973

if (!scontext) {

974

printk(KERN_ERR "SELinux: %s: unrecognized SID %d\n",

974

printk(KERN_ERR "SELinux: %s: unrecognized SID %d\n",

975

__func__, ssid);

975

__func__, ssid);

976

goto out;

976

goto out;

977

}

977

}

978

979

/* permissive domain? */

979

/* permissive domain? */

980

if (ebitmap_get_bit(&policydb.permissive_map, scontext->type))

980

if (ebitmap_get_bit(&policydb.permissive_map, scontext->type))

981

avd->flags |= AVD_FLAGS_PERMISSIVE;

981

avd->flags |= AVD_FLAGS_PERMISSIVE;

982

983

tcontext = sidtab_search(&sidtab, tsid);

983

tcontext = sidtab_search(&sidtab, tsid);

984

if (!tcontext) {

984

if (!tcontext) {

985

printk(KERN_ERR "SELinux: %s: unrecognized SID %d\n",

985

printk(KERN_ERR "SELinux: %s: unrecognized SID %d\n",

986

__func__, tsid);

986

__func__, tsid);

987

goto out;

987

goto out;

988

}

988

}

989

990

if (unlikely(!tclass)) {

990

if (unlikely(!tclass)) {

991

if (policydb.allow_unknown)

991

if (policydb.allow_unknown)

992

goto allow;

992

goto allow;

993

goto out;

993

goto out;

994

}

994

}

995

996

context_struct_compute_av(scontext, tcontext, tclass, avd);

996

context_struct_compute_av(scontext, tcontext, tclass, avd);

997

out:

997

out:

998

read_unlock(&policy_rwlock);

998

read_unlock(&policy_rwlock);

999

return;

999

return;

1000

allow:

1000

allow:

1001

avd->allowed = 0xffffffff;

1001

avd->allowed = 0xffffffff;

1002

goto out;

1002

goto out;

1003

}

1003

}

1004

1005

/*

1005

/*

1006

* Write the security context string representation of

1006

* Write the security context string representation of

1007

* the context structure `context' into a dynamically

1007

* the context structure `context' into a dynamically

1008

* allocated string of the correct size. Set `*scontext'

1008

* allocated string of the correct size. Set `*scontext'

1009

* to point to this string and set `*scontext_len' to

1009

* to point to this string and set `*scontext_len' to

1010

* the length of the string.

1010

* the length of the string.

1011

*/

1011

*/

1012

static int context_struct_to_string(struct context *context, char **scontext, u32 *scontext_len)

1012

static int context_struct_to_string(struct context *context, char **scontext, u32 *scontext_len)

1013

{

1013

{

1014

char *scontextp;

1014

char *scontextp;

1015

1016

if (scontext)

1016

if (scontext)

1017

*scontext = NULL;

1017

*scontext = NULL;

1018

*scontext_len = 0;

1018

*scontext_len = 0;

1019

1020

if (context->len) {

1020

if (context->len) {

1021

*scontext_len = context->len;

1021

*scontext_len = context->len;

1022

if (scontext) {

1022

if (scontext) {

1023

*scontext = kstrdup(context->str, GFP_ATOMIC);

1023

*scontext = kstrdup(context->str, GFP_ATOMIC);

1024

if (!(*scontext))

1024

if (!(*scontext))

1025

return -ENOMEM;

1025

return -ENOMEM;

1026

}

1026

}

1027

return 0;

1027

return 0;

1028

}

1028

}

1029

1030

/* Compute the size of the context. */

1030

/* Compute the size of the context. */

1031

*scontext_len += strlen(sym_name(&policydb, SYM_USERS, context->user - 1)) + 1;

1031

*scontext_len += strlen(sym_name(&policydb, SYM_USERS, context->user - 1)) + 1;

1032

*scontext_len += strlen(sym_name(&policydb, SYM_ROLES, context->role - 1)) + 1;

1032

*scontext_len += strlen(sym_name(&policydb, SYM_ROLES, context->role - 1)) + 1;

1033

*scontext_len += strlen(sym_name(&policydb, SYM_TYPES, context->type - 1)) + 1;

1033

*scontext_len += strlen(sym_name(&policydb, SYM_TYPES, context->type - 1)) + 1;

1034

*scontext_len += mls_compute_context_len(context);

1034

*scontext_len += mls_compute_context_len(context);

1035

1036

if (!scontext)

1036

if (!scontext)

1037

return 0;

1037

return 0;

1038

1039

/* Allocate space for the context; caller must free this space. */

1039

/* Allocate space for the context; caller must free this space. */

1040

scontextp = kmalloc(*scontext_len, GFP_ATOMIC);

1040

scontextp = kmalloc(*scontext_len, GFP_ATOMIC);

1041

if (!scontextp)

1041

if (!scontextp)

1042

return -ENOMEM;

1042

return -ENOMEM;

1043

*scontext = scontextp;

1043

*scontext = scontextp;

1044

1045

/*

1045

/*

1046

* Copy the user name, role name and type name into the context.

1046

* Copy the user name, role name and type name into the context.

1047

*/

1047

*/

1048

sprintf(scontextp, "%s:%s:%s",

1048

sprintf(scontextp, "%s:%s:%s",

1049

sym_name(&policydb, SYM_USERS, context->user - 1),

1049

sym_name(&policydb, SYM_USERS, context->user - 1),

1050

sym_name(&policydb, SYM_ROLES, context->role - 1),

1050

sym_name(&policydb, SYM_ROLES, context->role - 1),

1051

sym_name(&policydb, SYM_TYPES, context->type - 1));

1051

sym_name(&policydb, SYM_TYPES, context->type - 1));

1052

scontextp += strlen(sym_name(&policydb, SYM_USERS, context->user - 1)) +

1052

scontextp += strlen(sym_name(&policydb, SYM_USERS, context->user - 1)) +

1053

1 + strlen(sym_name(&policydb, SYM_ROLES, context->role - 1)) +

1053

1 + strlen(sym_name(&policydb, SYM_ROLES, context->role - 1)) +

1054

1 + strlen(sym_name(&policydb, SYM_TYPES, context->type - 1));

1054

1 + strlen(sym_name(&policydb, SYM_TYPES, context->type - 1));

1055

1056

mls_sid_to_context(context, &scontextp);

1056

mls_sid_to_context(context, &scontextp);

1057

1058

*scontextp = 0;

1058

*scontextp = 0;

1059

1060

return 0;

1060

return 0;

1061

}

1061

}

1062

1063

#include "initial_sid_to_string.h"

1063

#include "initial_sid_to_string.h"

1064

1065

const char *security_get_initial_sid_context(u32 sid)

1065

const char *security_get_initial_sid_context(u32 sid)

1066

{

1066

{

1067

if (unlikely(sid > SECINITSID_NUM))

1067

if (unlikely(sid > SECINITSID_NUM))

1068

return NULL;

1068

return NULL;

1069

return initial_sid_to_string[sid];

1069

return initial_sid_to_string[sid];

1070

}

1070

}

1071

1072

static int security_sid_to_context_core(u32 sid, char **scontext,

1072

static int security_sid_to_context_core(u32 sid, char **scontext,

1073

u32 *scontext_len, int force)

1073

u32 *scontext_len, int force)

1074

{

1074

{

1075

struct context *context;

1075

struct context *context;

1076

int rc = 0;

1076

int rc = 0;

1077

1078

if (scontext)

1078

if (scontext)

1079

*scontext = NULL;

1079

*scontext = NULL;

1080

*scontext_len = 0;

1080

*scontext_len = 0;

1081

1082

if (!ss_initialized) {

1082

if (!ss_initialized) {

1083

if (sid <= SECINITSID_NUM) {

1083

if (sid <= SECINITSID_NUM) {

1084

char *scontextp;

1084

char *scontextp;

1085

1086

*scontext_len = strlen(initial_sid_to_string[sid]) + 1;

1086

*scontext_len = strlen(initial_sid_to_string[sid]) + 1;

1087

if (!scontext)

1087

if (!scontext)

1088

goto out;

1088

goto out;

1089

scontextp = kmalloc(*scontext_len, GFP_ATOMIC);

1089

scontextp = kmalloc(*scontext_len, GFP_ATOMIC);

1090

if (!scontextp) {

1090

if (!scontextp) {

1091

rc = -ENOMEM;

1091

rc = -ENOMEM;

1092

goto out;

1092

goto out;

1093

}

1093

}

1094

strcpy(scontextp, initial_sid_to_string[sid]);

1094

strcpy(scontextp, initial_sid_to_string[sid]);

1095

*scontext = scontextp;

1095

*scontext = scontextp;

1096

goto out;

1096

goto out;

1097

}

1097

}

1098

printk(KERN_ERR "SELinux: %s: called before initial "

1098

printk(KERN_ERR "SELinux: %s: called before initial "

1099

"load_policy on unknown SID %d\n", __func__, sid);

1099

"load_policy on unknown SID %d\n", __func__, sid);

1100

rc = -EINVAL;

1100

rc = -EINVAL;

1101

goto out;

1101

goto out;

1102

}

1102

}

1103

read_lock(&policy_rwlock);

1103

read_lock(&policy_rwlock);

1104

if (force)

1104

if (force)

1105

context = sidtab_search_force(&sidtab, sid);

1105

context = sidtab_search_force(&sidtab, sid);

1106

else

1106

else

1107

context = sidtab_search(&sidtab, sid);

1107

context = sidtab_search(&sidtab, sid);

1108

if (!context) {

1108

if (!context) {

1109

printk(KERN_ERR "SELinux: %s: unrecognized SID %d\n",

1109

printk(KERN_ERR "SELinux: %s: unrecognized SID %d\n",

1110

__func__, sid);

1110

__func__, sid);

1111

rc = -EINVAL;

1111

rc = -EINVAL;

1112

goto out_unlock;

1112

goto out_unlock;

1113

}

1113

}

1114

rc = context_struct_to_string(context, scontext, scontext_len);

1114

rc = context_struct_to_string(context, scontext, scontext_len);

1115

out_unlock:

1115

out_unlock:

1116

read_unlock(&policy_rwlock);

1116

read_unlock(&policy_rwlock);

1117

out:

1117

out:

1118

return rc;

1118

return rc;

1119

1120

}

1120

}

1121

1122

/**

1122

/**

1123

* security_sid_to_context - Obtain a context for a given SID.

1123

* security_sid_to_context - Obtain a context for a given SID.

1124

* @sid: security identifier, SID

1124

* @sid: security identifier, SID

1125

* @scontext: security context

1125

* @scontext: security context

1126

* @scontext_len: length in bytes

1126

* @scontext_len: length in bytes

1127

*

1127

*

1128

* Write the string representation of the context associated with @sid

1128

* Write the string representation of the context associated with @sid

1129

* into a dynamically allocated string of the correct size. Set @scontext

1129

* into a dynamically allocated string of the correct size. Set @scontext

1130

* to point to this string and set @scontext_len to the length of the string.

1130

* to point to this string and set @scontext_len to the length of the string.

1131

*/

1131

*/

1132

int security_sid_to_context(u32 sid, char **scontext, u32 *scontext_len)

1132

int security_sid_to_context(u32 sid, char **scontext, u32 *scontext_len)

1133

{

1133

{

1134

return security_sid_to_context_core(sid, scontext, scontext_len, 0);

1134

return security_sid_to_context_core(sid, scontext, scontext_len, 0);

1135

}

1135

}

1136

1137

int security_sid_to_context_force(u32 sid, char **scontext, u32 *scontext_len)

1137

int security_sid_to_context_force(u32 sid, char **scontext, u32 *scontext_len)

1138

{

1138

{

1139

return security_sid_to_context_core(sid, scontext, scontext_len, 1);

1139

return security_sid_to_context_core(sid, scontext, scontext_len, 1);

1140

}

1140

}

1141

1142

/*

1142

/*

1143

* Caveat: Mutates scontext.

1143

* Caveat: Mutates scontext.

1144

*/

1144

*/

1145

static int string_to_context_struct(struct policydb *pol,

1145

static int string_to_context_struct(struct policydb *pol,

1146

struct sidtab *sidtabp,

1146

struct sidtab *sidtabp,

1147

char *scontext,

1147

char *scontext,

1148

u32 scontext_len,

1148

u32 scontext_len,

1149

struct context *ctx,

1149

struct context *ctx,

1150

u32 def_sid)

1150

u32 def_sid)

1151

{

1151

{

1152

struct role_datum *role;

1152

struct role_datum *role;

1153

struct type_datum *typdatum;

1153

struct type_datum *typdatum;

1154

struct user_datum *usrdatum;

1154

struct user_datum *usrdatum;

1155

char *scontextp, *p, oldc;

1155

char *scontextp, *p, oldc;

1156

int rc = 0;

1156

int rc = 0;

1157

1158

context_init(ctx);

1158

context_init(ctx);

1159

1160

/* Parse the security context. */

1160

/* Parse the security context. */

1161

1162

rc = -EINVAL;

1162

rc = -EINVAL;

1163

scontextp = (char *) scontext;

1163

scontextp = (char *) scontext;

1164

1165

/* Extract the user. */

1165

/* Extract the user. */

1166

p = scontextp;

1166

p = scontextp;

1167

while (*p && *p != ':')

1167

while (*p && *p != ':')

1168

p++;

1168

p++;

1169

1170

if (*p == 0)

1170

if (*p == 0)

1171

goto out;

1171

goto out;

1172

1173

*p++ = 0;

1173

*p++ = 0;

1174

1175

usrdatum = hashtab_search(pol->p_users.table, scontextp);

1175

usrdatum = hashtab_search(pol->p_users.table, scontextp);

1176

if (!usrdatum)

1176

if (!usrdatum)

1177

goto out;

1177

goto out;

1178

1179

ctx->user = usrdatum->value;

1179

ctx->user = usrdatum->value;

1180

1181

/* Extract role. */

1181

/* Extract role. */

1182

scontextp = p;

1182

scontextp = p;

1183

while (*p && *p != ':')

1183

while (*p && *p != ':')

1184

p++;

1184

p++;

1185

1186

if (*p == 0)

1186

if (*p == 0)

1187

goto out;

1187

goto out;

1188

1189

*p++ = 0;

1189

*p++ = 0;

1190

1191

role = hashtab_search(pol->p_roles.table, scontextp);

1191

role = hashtab_search(pol->p_roles.table, scontextp);

1192

if (!role)

1192

if (!role)

1193

goto out;

1193

goto out;

1194

ctx->role = role->value;

1194

ctx->role = role->value;

1195

1196

/* Extract type. */

1196

/* Extract type. */

1197

scontextp = p;

1197

scontextp = p;

1198

while (*p && *p != ':')

1198

while (*p && *p != ':')

1199

p++;

1199

p++;

1200

oldc = *p;

1200

oldc = *p;

1201

*p++ = 0;

1201

*p++ = 0;

1202

1203

typdatum = hashtab_search(pol->p_types.table, scontextp);

1203

typdatum = hashtab_search(pol->p_types.table, scontextp);

1204

if (!typdatum || typdatum->attribute)

1204

if (!typdatum || typdatum->attribute)

1205

goto out;

1205

goto out;

1206

1207

ctx->type = typdatum->value;

1207

ctx->type = typdatum->value;

1208

1209

rc = mls_context_to_sid(pol, oldc, &p, ctx, sidtabp, def_sid);

1209

rc = mls_context_to_sid(pol, oldc, &p, ctx, sidtabp, def_sid);

1210

if (rc)

1210

if (rc)

1211

goto out;

1211

goto out;

1212

1213

rc = -EINVAL;

1213

rc = -EINVAL;

1214

if ((p - scontext) < scontext_len)

1214

if ((p - scontext) < scontext_len)

1215

goto out;

1215

goto out;

1216

1217

/* Check the validity of the new context. */

1217

/* Check the validity of the new context. */

1218

if (!policydb_context_isvalid(pol, ctx))

1218

if (!policydb_context_isvalid(pol, ctx))

1219

goto out;

1219

goto out;

1220

rc = 0;

1220

rc = 0;

1221

out:

1221

out:

1222

if (rc)

1222

if (rc)

1223

context_destroy(ctx);

1223

context_destroy(ctx);

1224

return rc;

1224

return rc;

1225

}

1225

}

1226

1227

static int security_context_to_sid_core(const char *scontext, u32 scontext_len,

1227

static int security_context_to_sid_core(const char *scontext, u32 scontext_len,

1228

u32 *sid, u32 def_sid, gfp_t gfp_flags,

1228

u32 *sid, u32 def_sid, gfp_t gfp_flags,

1229

int force)

1229

int force)

1230

{

1230

{

1231

char *scontext2, *str = NULL;

1231

char *scontext2, *str = NULL;

1232

struct context context;

1232

struct context context;

1233

int rc = 0;

1233

int rc = 0;

1234

1235

/* An empty security context is never valid. */

1235

/* An empty security context is never valid. */

1236

if (!scontext_len)

1236

if (!scontext_len)

1237

return -EINVAL;

1237

return -EINVAL;

1238

1239

if (!ss_initialized) {

1239

if (!ss_initialized) {

1240

int i;

1240

int i;

1241

1242

for (i = 1; i < SECINITSID_NUM; i++) {

1242

for (i = 1; i < SECINITSID_NUM; i++) {

1243

if (!strcmp(initial_sid_to_string[i], scontext)) {

1243

if (!strcmp(initial_sid_to_string[i], scontext)) {

1244

*sid = i;

1244

*sid = i;

1245

return 0;

1245

return 0;

1246

}

1246

}

1247

}

1247

}

1248

*sid = SECINITSID_KERNEL;

1248

*sid = SECINITSID_KERNEL;

1249

return 0;

1249

return 0;

1250

}

1250

}

1251

*sid = SECSID_NULL;

1251

*sid = SECSID_NULL;

1252

1253

/* Copy the string so that we can modify the copy as we parse it. */

1253

/* Copy the string so that we can modify the copy as we parse it. */

1254

scontext2 = kmalloc(scontext_len + 1, gfp_flags);

1254

scontext2 = kmalloc(scontext_len + 1, gfp_flags);

1255

if (!scontext2)

1255

if (!scontext2)

1256

return -ENOMEM;

1256

return -ENOMEM;

1257

memcpy(scontext2, scontext, scontext_len);

1257

memcpy(scontext2, scontext, scontext_len);

1258

scontext2[scontext_len] = 0;

1258

scontext2[scontext_len] = 0;

1259

1260

if (force) {

1260

if (force) {

1261

/* Save another copy for storing in uninterpreted form */

1261

/* Save another copy for storing in uninterpreted form */

1262

rc = -ENOMEM;

1262

rc = -ENOMEM;

1263

str = kstrdup(scontext2, gfp_flags);

1263

str = kstrdup(scontext2, gfp_flags);

1264

if (!str)

1264

if (!str)

1265

goto out;

1265

goto out;

1266

}

1266

}

1267

1268

read_lock(&policy_rwlock);

1268

read_lock(&policy_rwlock);

1269

rc = string_to_context_struct(&policydb, &sidtab, scontext2,

1269

rc = string_to_context_struct(&policydb, &sidtab, scontext2,

1270

scontext_len, &context, def_sid);

1270

scontext_len, &context, def_sid);

1271

if (rc == -EINVAL && force) {

1271

if (rc == -EINVAL && force) {

1272

context.str = str;

1272

context.str = str;

1273

context.len = scontext_len;

1273

context.len = scontext_len;

1274

str = NULL;

1274

str = NULL;

1275

} else if (rc)

1275

} else if (rc)

1276

goto out_unlock;

1276

goto out_unlock;

1277

rc = sidtab_context_to_sid(&sidtab, &context, sid);

1277

rc = sidtab_context_to_sid(&sidtab, &context, sid);

1278

context_destroy(&context);

1278

context_destroy(&context);

1279

out_unlock:

1279

out_unlock:

1280

read_unlock(&policy_rwlock);

1280

read_unlock(&policy_rwlock);

1281

out:

1281

out:

1282

kfree(scontext2);

1282

kfree(scontext2);

1283

kfree(str);

1283

kfree(str);

1284

return rc;

1284

return rc;

1285

}

1285

}

1286

1287

/**

1287

/**

1288

* security_context_to_sid - Obtain a SID for a given security context.

1288

* security_context_to_sid - Obtain a SID for a given security context.

1289

* @scontext: security context

1289

* @scontext: security context

1290

* @scontext_len: length in bytes

1290

* @scontext_len: length in bytes

1291

* @sid: security identifier, SID

1291

* @sid: security identifier, SID

1292

* @gfp: context for the allocation

1292

* @gfp: context for the allocation

1293

*

1293

*

1294

* Obtains a SID associated with the security context that

1294

* Obtains a SID associated with the security context that

1295

* has the string representation specified by @scontext.

1295

* has the string representation specified by @scontext.

1296

* Returns -%EINVAL if the context is invalid, -%ENOMEM if insufficient

1296

* Returns -%EINVAL if the context is invalid, -%ENOMEM if insufficient

1297

* memory is available, or 0 on success.

1297

* memory is available, or 0 on success.

1298

*/

1298

*/

1299

int security_context_to_sid(const char *scontext, u32 scontext_len, u32 *sid,

1299

int security_context_to_sid(const char *scontext, u32 scontext_len, u32 *sid,

1300

gfp_t gfp)

1300

gfp_t gfp)

1301

{

1301

{

1302

return security_context_to_sid_core(scontext, scontext_len,

1302

return security_context_to_sid_core(scontext, scontext_len,

1303

sid, SECSID_NULL, gfp, 0);

1303

sid, SECSID_NULL, gfp, 0);

1304

}

1304

}

1305

1306

/**

1306

/**

1307

* security_context_to_sid_default - Obtain a SID for a given security context,

1307

* security_context_to_sid_default - Obtain a SID for a given security context,

1308

* falling back to specified default if needed.

1308

* falling back to specified default if needed.

1309

*

1309

*

1310

* @scontext: security context

1310

* @scontext: security context

1311

* @scontext_len: length in bytes

1311

* @scontext_len: length in bytes

1312

* @sid: security identifier, SID

1312

* @sid: security identifier, SID

1313

* @def_sid: default SID to assign on error

1313

* @def_sid: default SID to assign on error

1314

*

1314

*

1315

* Obtains a SID associated with the security context that

1315

* Obtains a SID associated with the security context that

1316

* has the string representation specified by @scontext.

1316

* has the string representation specified by @scontext.

1317

* The default SID is passed to the MLS layer to be used to allow

1317

* The default SID is passed to the MLS layer to be used to allow

1318

* kernel labeling of the MLS field if the MLS field is not present

1318

* kernel labeling of the MLS field if the MLS field is not present

1319

* (for upgrading to MLS without full relabel).

1319

* (for upgrading to MLS without full relabel).

1320

* Implicitly forces adding of the context even if it cannot be mapped yet.

1320

* Implicitly forces adding of the context even if it cannot be mapped yet.

1321

* Returns -%EINVAL if the context is invalid, -%ENOMEM if insufficient

1321

* Returns -%EINVAL if the context is invalid, -%ENOMEM if insufficient

1322

* memory is available, or 0 on success.

1322

* memory is available, or 0 on success.

1323

*/

1323

*/

1324

int security_context_to_sid_default(const char *scontext, u32 scontext_len,

1324

int security_context_to_sid_default(const char *scontext, u32 scontext_len,

1325

u32 *sid, u32 def_sid, gfp_t gfp_flags)

1325

u32 *sid, u32 def_sid, gfp_t gfp_flags)

1326

{

1326

{

1327

return security_context_to_sid_core(scontext, scontext_len,

1327

return security_context_to_sid_core(scontext, scontext_len,

1328

sid, def_sid, gfp_flags, 1);

1328

sid, def_sid, gfp_flags, 1);

1329

}

1329

}

1330

1331

int security_context_to_sid_force(const char *scontext, u32 scontext_len,

1331

int security_context_to_sid_force(const char *scontext, u32 scontext_len,

1332

u32 *sid)

1332

u32 *sid)

1333

{

1333

{

1334

return security_context_to_sid_core(scontext, scontext_len,

1334

return security_context_to_sid_core(scontext, scontext_len,

1335

sid, SECSID_NULL, GFP_KERNEL, 1);

1335

sid, SECSID_NULL, GFP_KERNEL, 1);

1336

}

1336

}

1337

1338

static int compute_sid_handle_invalid_context(

1338

static int compute_sid_handle_invalid_context(

1339

struct context *scontext,

1339

struct context *scontext,

1340

struct context *tcontext,

1340

struct context *tcontext,

1341

u16 tclass,

1341

u16 tclass,

1342

struct context *newcontext)

1342

struct context *newcontext)

1343

{

1343

{

1344

char *s = NULL, *t = NULL, *n = NULL;

1344

char *s = NULL, *t = NULL, *n = NULL;

1345

u32 slen, tlen, nlen;

1345

u32 slen, tlen, nlen;

1346

1347

if (context_struct_to_string(scontext, &s, &slen))

1347

if (context_struct_to_string(scontext, &s, &slen))

1348

goto out;

1348

goto out;

1349

if (context_struct_to_string(tcontext, &t, &tlen))

1349

if (context_struct_to_string(tcontext, &t, &tlen))

1350

goto out;

1350

goto out;

1351

if (context_struct_to_string(newcontext, &n, &nlen))

1351

if (context_struct_to_string(newcontext, &n, &nlen))

1352

goto out;

1352

goto out;

1353

audit_log(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR,

1353

audit_log(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR,

1354

"security_compute_sid: invalid context %s"

1354

"op=security_compute_sid invalid_context=%s"

1355

" for scontext=%s"

1355

" scontext=%s"

1356

" tcontext=%s"

1356

" tcontext=%s"

1357

" tclass=%s",

1357

" tclass=%s",

1358

n, s, t, sym_name(&policydb, SYM_CLASSES, tclass-1));

1358

n, s, t, sym_name(&policydb, SYM_CLASSES, tclass-1));

1359

out:

1359

out:

1360

kfree(s);

1360

kfree(s);

1361

kfree(t);

1361

kfree(t);

1362

kfree(n);

1362

kfree(n);

1363

if (!selinux_enforcing)

1363

if (!selinux_enforcing)

1364

return 0;

1364

return 0;

1365

return -EACCES;

1365

return -EACCES;

1366

}

1366

}

1367

1368

static void filename_compute_type(struct policydb *p, struct context *newcontext,

1368

static void filename_compute_type(struct policydb *p, struct context *newcontext,

1369

u32 stype, u32 ttype, u16 tclass,

1369

u32 stype, u32 ttype, u16 tclass,

1370

const char *objname)

1370

const char *objname)

1371

{

1371

{

1372

struct filename_trans ft;

1372

struct filename_trans ft;

1373

struct filename_trans_datum *otype;

1373

struct filename_trans_datum *otype;

1374

1375

/*

1375

/*

1376

* Most filename trans rules are going to live in specific directories

1376

* Most filename trans rules are going to live in specific directories

1377

* like /dev or /var/run. This bitmap will quickly skip rule searches

1377

* like /dev or /var/run. This bitmap will quickly skip rule searches

1378

* if the ttype does not contain any rules.

1378

* if the ttype does not contain any rules.

1379

*/

1379

*/

1380

if (!ebitmap_get_bit(&p->filename_trans_ttypes, ttype))

1380

if (!ebitmap_get_bit(&p->filename_trans_ttypes, ttype))

1381

return;

1381

return;

1382

1383

ft.stype = stype;

1383

ft.stype = stype;

1384

ft.ttype = ttype;

1384

ft.ttype = ttype;

1385

ft.tclass = tclass;

1385

ft.tclass = tclass;

1386

ft.name = objname;

1386

ft.name = objname;

1387

1388

otype = hashtab_search(p->filename_trans, &ft);

1388

otype = hashtab_search(p->filename_trans, &ft);

1389

if (otype)

1389

if (otype)

1390

newcontext->type = otype->otype;

1390

newcontext->type = otype->otype;

1391

}

1391

}

1392

1393

static int security_compute_sid(u32 ssid,

1393

static int security_compute_sid(u32 ssid,

1394

u32 tsid,

1394

u32 tsid,

1395

u16 orig_tclass,

1395

u16 orig_tclass,

1396

u32 specified,

1396

u32 specified,

1397

const char *objname,

1397

const char *objname,

1398

u32 *out_sid,

1398

u32 *out_sid,

1399

bool kern)

1399

bool kern)

1400

{

1400

{

1401

struct class_datum *cladatum = NULL;

1401

struct class_datum *cladatum = NULL;

1402

struct context *scontext = NULL, *tcontext = NULL, newcontext;

1402

struct context *scontext = NULL, *tcontext = NULL, newcontext;

1403

struct role_trans *roletr = NULL;

1403

struct role_trans *roletr = NULL;

1404

struct avtab_key avkey;

1404

struct avtab_key avkey;

1405

struct avtab_datum *avdatum;

1405

struct avtab_datum *avdatum;

1406

struct avtab_node *node;

1406

struct avtab_node *node;

1407

u16 tclass;

1407

u16 tclass;

1408

int rc = 0;

1408

int rc = 0;

1409

bool sock;

1409

bool sock;

1410

1411

if (!ss_initialized) {

1411

if (!ss_initialized) {

1412

switch (orig_tclass) {

1412

switch (orig_tclass) {

1413

case SECCLASS_PROCESS: /* kernel value */

1413

case SECCLASS_PROCESS: /* kernel value */

1414

*out_sid = ssid;

1414

*out_sid = ssid;

1415

break;

1415

break;

1416

default:

1416

default:

1417

*out_sid = tsid;

1417

*out_sid = tsid;

1418

break;

1418

break;

1419

}

1419

}

1420

goto out;

1420

goto out;

1421

}

1421

}

1422

1423

context_init(&newcontext);

1423

context_init(&newcontext);

1424

1425

read_lock(&policy_rwlock);

1425

read_lock(&policy_rwlock);

1426

1427

if (kern) {

1427

if (kern) {

1428

tclass = unmap_class(orig_tclass);

1428

tclass = unmap_class(orig_tclass);

1429

sock = security_is_socket_class(orig_tclass);

1429

sock = security_is_socket_class(orig_tclass);

1430

} else {

1430

} else {

1431

tclass = orig_tclass;

1431

tclass = orig_tclass;

1432

sock = security_is_socket_class(map_class(tclass));

1432

sock = security_is_socket_class(map_class(tclass));

1433

}

1433

}

1434

1435

scontext = sidtab_search(&sidtab, ssid);

1435

scontext = sidtab_search(&sidtab, ssid);

1436

if (!scontext) {

1436

if (!scontext) {

1437

printk(KERN_ERR "SELinux: %s: unrecognized SID %d\n",

1437

printk(KERN_ERR "SELinux: %s: unrecognized SID %d\n",

1438

__func__, ssid);

1438

__func__, ssid);

1439

rc = -EINVAL;

1439

rc = -EINVAL;

1440

goto out_unlock;

1440

goto out_unlock;

1441

}

1441

}

1442

tcontext = sidtab_search(&sidtab, tsid);

1442

tcontext = sidtab_search(&sidtab, tsid);

1443

if (!tcontext) {

1443

if (!tcontext) {

1444

printk(KERN_ERR "SELinux: %s: unrecognized SID %d\n",

1444

printk(KERN_ERR "SELinux: %s: unrecognized SID %d\n",

1445

__func__, tsid);

1445

__func__, tsid);

1446

rc = -EINVAL;

1446

rc = -EINVAL;

1447

goto out_unlock;

1447

goto out_unlock;

1448

}

1448

}

1449

1450

if (tclass && tclass <= policydb.p_classes.nprim)

1450

if (tclass && tclass <= policydb.p_classes.nprim)

1451

cladatum = policydb.class_val_to_struct[tclass - 1];

1451

cladatum = policydb.class_val_to_struct[tclass - 1];

1452

1453

/* Set the user identity. */

1453

/* Set the user identity. */

1454

switch (specified) {

1454

switch (specified) {

1455

case AVTAB_TRANSITION:

1455

case AVTAB_TRANSITION:

1456

case AVTAB_CHANGE:

1456

case AVTAB_CHANGE:

1457

if (cladatum && cladatum->default_user == DEFAULT_TARGET) {

1457

if (cladatum && cladatum->default_user == DEFAULT_TARGET) {

1458

newcontext.user = tcontext->user;

1458

newcontext.user = tcontext->user;

1459

} else {

1459

} else {

1460

/* notice this gets both DEFAULT_SOURCE and unset */

1460

/* notice this gets both DEFAULT_SOURCE and unset */

1461

/* Use the process user identity. */

1461

/* Use the process user identity. */

1462

newcontext.user = scontext->user;

1462

newcontext.user = scontext->user;

1463

}

1463

}

1464

break;

1464

break;

1465

case AVTAB_MEMBER:

1465

case AVTAB_MEMBER:

1466

/* Use the related object owner. */

1466

/* Use the related object owner. */

1467

newcontext.user = tcontext->user;

1467

newcontext.user = tcontext->user;

1468

break;

1468

break;

1469

}

1469

}

1470

1471

/* Set the role to default values. */

1471

/* Set the role to default values. */

1472

if (cladatum && cladatum->default_role == DEFAULT_SOURCE) {

1472

if (cladatum && cladatum->default_role == DEFAULT_SOURCE) {

1473

newcontext.role = scontext->role;

1473

newcontext.role = scontext->role;

1474

} else if (cladatum && cladatum->default_role == DEFAULT_TARGET) {

1474

} else if (cladatum && cladatum->default_role == DEFAULT_TARGET) {

1475

newcontext.role = tcontext->role;

1475

newcontext.role = tcontext->role;

1476

} else {

1476

} else {

1477

if ((tclass == policydb.process_class) || (sock == true))

1477

if ((tclass == policydb.process_class) || (sock == true))

1478

newcontext.role = scontext->role;

1478

newcontext.role = scontext->role;

1479

else

1479

else

1480

newcontext.role = OBJECT_R_VAL;

1480

newcontext.role = OBJECT_R_VAL;

1481

}

1481

}

1482

1483

/* Set the type to default values. */

1483

/* Set the type to default values. */

1484

if (cladatum && cladatum->default_type == DEFAULT_SOURCE) {

1484

if (cladatum && cladatum->default_type == DEFAULT_SOURCE) {

1485

newcontext.type = scontext->type;

1485

newcontext.type = scontext->type;

1486

} else if (cladatum && cladatum->default_type == DEFAULT_TARGET) {

1486

} else if (cladatum && cladatum->default_type == DEFAULT_TARGET) {

1487

newcontext.type = tcontext->type;

1487

newcontext.type = tcontext->type;

1488

} else {

1488

} else {

1489

if ((tclass == policydb.process_class) || (sock == true)) {

1489

if ((tclass == policydb.process_class) || (sock == true)) {

1490

/* Use the type of process. */

1490

/* Use the type of process. */

1491

newcontext.type = scontext->type;

1491

newcontext.type = scontext->type;

1492

} else {

1492

} else {

1493

/* Use the type of the related object. */

1493

/* Use the type of the related object. */

1494

newcontext.type = tcontext->type;

1494

newcontext.type = tcontext->type;

1495

}

1495

}

1496

}

1496

}

1497

1498

/* Look for a type transition/member/change rule. */

1498

/* Look for a type transition/member/change rule. */

1499

avkey.source_type = scontext->type;

1499

avkey.source_type = scontext->type;

1500

avkey.target_type = tcontext->type;

1500

avkey.target_type = tcontext->type;

1501

avkey.target_class = tclass;

1501

avkey.target_class = tclass;

1502

avkey.specified = specified;

1502

avkey.specified = specified;

1503

avdatum = avtab_search(&policydb.te_avtab, &avkey);

1503

avdatum = avtab_search(&policydb.te_avtab, &avkey);

1504

1505

/* If no permanent rule, also check for enabled conditional rules */

1505

/* If no permanent rule, also check for enabled conditional rules */

1506

if (!avdatum) {

1506

if (!avdatum) {

1507

node = avtab_search_node(&policydb.te_cond_avtab, &avkey);

1507

node = avtab_search_node(&policydb.te_cond_avtab, &avkey);

1508

for (; node; node = avtab_search_node_next(node, specified)) {

1508

for (; node; node = avtab_search_node_next(node, specified)) {

1509

if (node->key.specified & AVTAB_ENABLED) {

1509

if (node->key.specified & AVTAB_ENABLED) {

1510

avdatum = &node->datum;

1510

avdatum = &node->datum;

1511

break;

1511

break;

1512

}

1512

}

1513

}

1513

}

1514

}

1514

}

1515

1516

if (avdatum) {

1516

if (avdatum) {

1517

/* Use the type from the type transition/member/change rule. */

1517

/* Use the type from the type transition/member/change rule. */

1518

newcontext.type = avdatum->data;

1518

newcontext.type = avdatum->data;

1519

}

1519

}

1520

1521

/* if we have a objname this is a file trans check so check those rules */

1521

/* if we have a objname this is a file trans check so check those rules */

1522

if (objname)

1522

if (objname)

1523

filename_compute_type(&policydb, &newcontext, scontext->type,

1523

filename_compute_type(&policydb, &newcontext, scontext->type,

1524

tcontext->type, tclass, objname);

1524

tcontext->type, tclass, objname);

1525

1526

/* Check for class-specific changes. */

1526

/* Check for class-specific changes. */

1527

if (specified & AVTAB_TRANSITION) {

1527

if (specified & AVTAB_TRANSITION) {

1528

/* Look for a role transition rule. */

1528

/* Look for a role transition rule. */

1529

for (roletr = policydb.role_tr; roletr; roletr = roletr->next) {

1529

for (roletr = policydb.role_tr; roletr; roletr = roletr->next) {

1530

if ((roletr->role == scontext->role) &&

1530

if ((roletr->role == scontext->role) &&

1531

(roletr->type == tcontext->type) &&

1531

(roletr->type == tcontext->type) &&

1532

(roletr->tclass == tclass)) {

1532

(roletr->tclass == tclass)) {

1533

/* Use the role transition rule. */

1533

/* Use the role transition rule. */

1534

newcontext.role = roletr->new_role;

1534

newcontext.role = roletr->new_role;

1535

break;

1535

break;

1536

}

1536

}

1537

}

1537

}

1538

}

1538

}

1539

1540

/* Set the MLS attributes.

1540

/* Set the MLS attributes.

1541

This is done last because it may allocate memory. */

1541

This is done last because it may allocate memory. */

1542

rc = mls_compute_sid(scontext, tcontext, tclass, specified,

1542

rc = mls_compute_sid(scontext, tcontext, tclass, specified,

1543

&newcontext, sock);

1543

&newcontext, sock);

1544

if (rc)

1544

if (rc)

1545

goto out_unlock;

1545

goto out_unlock;

1546

1547

/* Check the validity of the context. */

1547

/* Check the validity of the context. */

1548

if (!policydb_context_isvalid(&policydb, &newcontext)) {

1548

if (!policydb_context_isvalid(&policydb, &newcontext)) {

1549

rc = compute_sid_handle_invalid_context(scontext,

1549

rc = compute_sid_handle_invalid_context(scontext,

1550

tcontext,

1550

tcontext,

1551

tclass,

1551

tclass,

1552

&newcontext);

1552

&newcontext);

1553

if (rc)

1553

if (rc)

1554

goto out_unlock;

1554

goto out_unlock;

1555

}

1555

}

1556

/* Obtain the sid for the context. */

1556

/* Obtain the sid for the context. */

1557

rc = sidtab_context_to_sid(&sidtab, &newcontext, out_sid);

1557

rc = sidtab_context_to_sid(&sidtab, &newcontext, out_sid);

1558

out_unlock:

1558

out_unlock:

1559

read_unlock(&policy_rwlock);

1559

read_unlock(&policy_rwlock);

1560

context_destroy(&newcontext);

1560

context_destroy(&newcontext);

1561

out:

1561

out:

1562

return rc;

1562

return rc;

1563

}

1563

}

1564

1565

/**

1565

/**

1566

* security_transition_sid - Compute the SID for a new subject/object.

1566

* security_transition_sid - Compute the SID for a new subject/object.

1567

* @ssid: source security identifier

1567

* @ssid: source security identifier

1568

* @tsid: target security identifier

1568

* @tsid: target security identifier

1569

* @tclass: target security class

1569

* @tclass: target security class

1570

* @out_sid: security identifier for new subject/object

1570

* @out_sid: security identifier for new subject/object

1571

*

1571

*

1572

* Compute a SID to use for labeling a new subject or object in the

1572

* Compute a SID to use for labeling a new subject or object in the

1573

* class @tclass based on a SID pair (@ssid, @tsid).

1573

* class @tclass based on a SID pair (@ssid, @tsid).

1574

* Return -%EINVAL if any of the parameters are invalid, -%ENOMEM

1574

* Return -%EINVAL if any of the parameters are invalid, -%ENOMEM

1575

* if insufficient memory is available, or %0 if the new SID was

1575

* if insufficient memory is available, or %0 if the new SID was

1576

* computed successfully.

1576

* computed successfully.

1577

*/

1577

*/

1578

int security_transition_sid(u32 ssid, u32 tsid, u16 tclass,

1578

int security_transition_sid(u32 ssid, u32 tsid, u16 tclass,

1579

const struct qstr *qstr, u32 *out_sid)

1579

const struct qstr *qstr, u32 *out_sid)

1580

{

1580

{

1581

return security_compute_sid(ssid, tsid, tclass, AVTAB_TRANSITION,

1581

return security_compute_sid(ssid, tsid, tclass, AVTAB_TRANSITION,

1582

qstr ? qstr->name : NULL, out_sid, true);

1582

qstr ? qstr->name : NULL, out_sid, true);

1583

}

1583

}

1584

1585

int security_transition_sid_user(u32 ssid, u32 tsid, u16 tclass,

1585

int security_transition_sid_user(u32 ssid, u32 tsid, u16 tclass,

1586

const char *objname, u32 *out_sid)

1586

const char *objname, u32 *out_sid)

1587

{

1587

{

1588

return security_compute_sid(ssid, tsid, tclass, AVTAB_TRANSITION,

1588

return security_compute_sid(ssid, tsid, tclass, AVTAB_TRANSITION,

1589

objname, out_sid, false);

1589

objname, out_sid, false);

1590

}

1590

}

1591

1592

/**

1592

/**

1593

* security_member_sid - Compute the SID for member selection.

1593

* security_member_sid - Compute the SID for member selection.

1594

* @ssid: source security identifier

1594

* @ssid: source security identifier

1595

* @tsid: target security identifier

1595

* @tsid: target security identifier

1596

* @tclass: target security class

1596

* @tclass: target security class

1597

* @out_sid: security identifier for selected member

1597

* @out_sid: security identifier for selected member

1598

*

1598

*

1599

* Compute a SID to use when selecting a member of a polyinstantiated

1599

* Compute a SID to use when selecting a member of a polyinstantiated

1600

* object of class @tclass based on a SID pair (@ssid, @tsid).

1600

* object of class @tclass based on a SID pair (@ssid, @tsid).

1601

* Return -%EINVAL if any of the parameters are invalid, -%ENOMEM

1601

* Return -%EINVAL if any of the parameters are invalid, -%ENOMEM

1602

* if insufficient memory is available, or %0 if the SID was

1602

* if insufficient memory is available, or %0 if the SID was

1603

* computed successfully.

1603

* computed successfully.

1604

*/

1604

*/

1605

int security_member_sid(u32 ssid,

1605

int security_member_sid(u32 ssid,

1606

u32 tsid,

1606

u32 tsid,

1607

u16 tclass,

1607

u16 tclass,

1608

u32 *out_sid)

1608

u32 *out_sid)

1609

{

1609

{

1610

return security_compute_sid(ssid, tsid, tclass, AVTAB_MEMBER, NULL,

1610

return security_compute_sid(ssid, tsid, tclass, AVTAB_MEMBER, NULL,

1611

out_sid, false);

1611

out_sid, false);

1612

}

1612

}

1613

1614

/**

1614

/**

1615

* security_change_sid - Compute the SID for object relabeling.

1615

* security_change_sid - Compute the SID for object relabeling.

1616

* @ssid: source security identifier

1616

* @ssid: source security identifier

1617

* @tsid: target security identifier

1617

* @tsid: target security identifier

1618

* @tclass: target security class

1618

* @tclass: target security class

1619

* @out_sid: security identifier for selected member

1619

* @out_sid: security identifier for selected member

1620

*

1620

*

1621

* Compute a SID to use for relabeling an object of class @tclass

1621

* Compute a SID to use for relabeling an object of class @tclass

1622

* based on a SID pair (@ssid, @tsid).

1622

* based on a SID pair (@ssid, @tsid).

1623

* Return -%EINVAL if any of the parameters are invalid, -%ENOMEM

1623

* Return -%EINVAL if any of the parameters are invalid, -%ENOMEM

1624

* if insufficient memory is available, or %0 if the SID was

1624

* if insufficient memory is available, or %0 if the SID was

1625

* computed successfully.

1625

* computed successfully.

1626

*/

1626

*/

1627

int security_change_sid(u32 ssid,

1627

int security_change_sid(u32 ssid,

1628

u32 tsid,

1628

u32 tsid,

1629

u16 tclass,

1629

u16 tclass,

1630

u32 *out_sid)

1630

u32 *out_sid)

1631

{

1631

{

1632

return security_compute_sid(ssid, tsid, tclass, AVTAB_CHANGE, NULL,

1632

return security_compute_sid(ssid, tsid, tclass, AVTAB_CHANGE, NULL,

1633

out_sid, false);

1633

out_sid, false);

1634

}

1634

}

1635

1636

/* Clone the SID into the new SID table. */

1636

/* Clone the SID into the new SID table. */

1637

static int clone_sid(u32 sid,

1637

static int clone_sid(u32 sid,

1638

struct context *context,

1638

struct context *context,

1639

void *arg)

1639

void *arg)

1640

{

1640

{

1641

struct sidtab *s = arg;

1641

struct sidtab *s = arg;

1642

1643

if (sid > SECINITSID_NUM)

1643

if (sid > SECINITSID_NUM)

1644

return sidtab_insert(s, sid, context);

1644

return sidtab_insert(s, sid, context);

1645

else

1645

else

1646

return 0;

1646

return 0;

1647

}

1647

}

1648

1649

static inline int convert_context_handle_invalid_context(struct context *context)

1649

static inline int convert_context_handle_invalid_context(struct context *context)

1650

{

1650

{

1651

char *s;

1651

char *s;

1652

u32 len;

1652

u32 len;

1653

1654

if (selinux_enforcing)

1654

if (selinux_enforcing)

1655

return -EINVAL;

1655

return -EINVAL;

1656

1657

if (!context_struct_to_string(context, &s, &len)) {

1657

if (!context_struct_to_string(context, &s, &len)) {

1658

printk(KERN_WARNING "SELinux: Context %s would be invalid if enforcing\n", s);

1658

printk(KERN_WARNING "SELinux: Context %s would be invalid if enforcing\n", s);

1659

kfree(s);

1659

kfree(s);

1660

}

1660

}

1661

return 0;

1661

return 0;

1662

}

1662

}

1663

1664

struct convert_context_args {

1664

struct convert_context_args {

1665

struct policydb *oldp;

1665

struct policydb *oldp;

1666

struct policydb *newp;

1666

struct policydb *newp;

1667

};

1667

};

1668

1669

/*

1669

/*

1670

* Convert the values in the security context

1670

* Convert the values in the security context

1671

* structure `c' from the values specified

1671

* structure `c' from the values specified

1672

* in the policy `p->oldp' to the values specified

1672

* in the policy `p->oldp' to the values specified

1673

* in the policy `p->newp'. Verify that the

1673

* in the policy `p->newp'. Verify that the

1674

* context is valid under the new policy.

1674

* context is valid under the new policy.

1675

*/

1675

*/

1676

static int convert_context(u32 key,

1676

static int convert_context(u32 key,

1677

struct context *c,

1677

struct context *c,

1678

void *p)

1678

void *p)

1679

{

1679

{

1680

struct convert_context_args *args;

1680

struct convert_context_args *args;

1681

struct context oldc;

1681

struct context oldc;

1682

struct ocontext *oc;

1682

struct ocontext *oc;

1683

struct mls_range *range;

1683

struct mls_range *range;

1684

struct role_datum *role;

1684

struct role_datum *role;

1685

struct type_datum *typdatum;

1685

struct type_datum *typdatum;

1686

struct user_datum *usrdatum;

1686

struct user_datum *usrdatum;

1687

char *s;

1687

char *s;

1688

u32 len;

1688

u32 len;

1689

int rc = 0;

1689

int rc = 0;

1690

1691

if (key <= SECINITSID_NUM)

1691

if (key <= SECINITSID_NUM)

1692

goto out;

1692

goto out;

1693

1694

args = p;

1694

args = p;

1695

1696

if (c->str) {

1696

if (c->str) {

1697

struct context ctx;

1697

struct context ctx;

1698

1699

rc = -ENOMEM;

1699

rc = -ENOMEM;

1700

s = kstrdup(c->str, GFP_KERNEL);

1700

s = kstrdup(c->str, GFP_KERNEL);

1701

if (!s)

1701

if (!s)

1702

goto out;

1702

goto out;

1703

1704

rc = string_to_context_struct(args->newp, NULL, s,

1704

rc = string_to_context_struct(args->newp, NULL, s,

1705

c->len, &ctx, SECSID_NULL);

1705

c->len, &ctx, SECSID_NULL);

1706

kfree(s);

1706

kfree(s);

1707

if (!rc) {

1707

if (!rc) {

1708

printk(KERN_INFO "SELinux: Context %s became valid (mapped).\n",

1708

printk(KERN_INFO "SELinux: Context %s became valid (mapped).\n",

1709

c->str);

1709

c->str);

1710

/* Replace string with mapped representation. */

1710

/* Replace string with mapped representation. */

1711

kfree(c->str);

1711

kfree(c->str);

1712

memcpy(c, &ctx, sizeof(*c));

1712

memcpy(c, &ctx, sizeof(*c));

1713

goto out;

1713

goto out;

1714

} else if (rc == -EINVAL) {

1714

} else if (rc == -EINVAL) {

1715

/* Retain string representation for later mapping. */

1715

/* Retain string representation for later mapping. */

1716

rc = 0;

1716

rc = 0;

1717

goto out;

1717

goto out;

1718

} else {

1718

} else {

1719

/* Other error condition, e.g. ENOMEM. */

1719

/* Other error condition, e.g. ENOMEM. */

1720

printk(KERN_ERR "SELinux: Unable to map context %s, rc = %d.\n",

1720

printk(KERN_ERR "SELinux: Unable to map context %s, rc = %d.\n",

1721

c->str, -rc);

1721

c->str, -rc);

1722

goto out;

1722

goto out;

1723

}

1723

}

1724

}

1724

}

1725

1726

rc = context_cpy(&oldc, c);

1726

rc = context_cpy(&oldc, c);

1727

if (rc)

1727

if (rc)

1728

goto out;

1728

goto out;

1729

1730

/* Convert the user. */

1730

/* Convert the user. */

1731

rc = -EINVAL;

1731

rc = -EINVAL;

1732

usrdatum = hashtab_search(args->newp->p_users.table,

1732

usrdatum = hashtab_search(args->newp->p_users.table,

1733

sym_name(args->oldp, SYM_USERS, c->user - 1));

1733

sym_name(args->oldp, SYM_USERS, c->user - 1));

1734

if (!usrdatum)

1734

if (!usrdatum)

1735

goto bad;

1735

goto bad;

1736

c->user = usrdatum->value;

1736

c->user = usrdatum->value;

1737

1738

/* Convert the role. */

1738

/* Convert the role. */

1739

rc = -EINVAL;

1739

rc = -EINVAL;

1740

role = hashtab_search(args->newp->p_roles.table,

1740

role = hashtab_search(args->newp->p_roles.table,

1741

sym_name(args->oldp, SYM_ROLES, c->role - 1));

1741

sym_name(args->oldp, SYM_ROLES, c->role - 1));

1742

if (!role)

1742

if (!role)

1743

goto bad;

1743

goto bad;

1744

c->role = role->value;

1744

c->role = role->value;

1745

1746

/* Convert the type. */

1746

/* Convert the type. */

1747

rc = -EINVAL;

1747

rc = -EINVAL;

1748

typdatum = hashtab_search(args->newp->p_types.table,

1748

typdatum = hashtab_search(args->newp->p_types.table,

1749

sym_name(args->oldp, SYM_TYPES, c->type - 1));

1749

sym_name(args->oldp, SYM_TYPES, c->type - 1));

1750

if (!typdatum)

1750

if (!typdatum)

1751

goto bad;

1751

goto bad;

1752

c->type = typdatum->value;

1752

c->type = typdatum->value;

1753

1754

/* Convert the MLS fields if dealing with MLS policies */

1754

/* Convert the MLS fields if dealing with MLS policies */

1755

if (args->oldp->mls_enabled && args->newp->mls_enabled) {

1755

if (args->oldp->mls_enabled && args->newp->mls_enabled) {

1756

rc = mls_convert_context(args->oldp, args->newp, c);

1756

rc = mls_convert_context(args->oldp, args->newp, c);

1757

if (rc)

1757

if (rc)

1758

goto bad;

1758

goto bad;

1759

} else if (args->oldp->mls_enabled && !args->newp->mls_enabled) {

1759

} else if (args->oldp->mls_enabled && !args->newp->mls_enabled) {

1760

/*

1760

/*

1761

* Switching between MLS and non-MLS policy:

1761

* Switching between MLS and non-MLS policy:

1762

* free any storage used by the MLS fields in the

1762

* free any storage used by the MLS fields in the

1763

* context for all existing entries in the sidtab.

1763

* context for all existing entries in the sidtab.

1764

*/

1764

*/

1765

mls_context_destroy(c);

1765

mls_context_destroy(c);

1766

} else if (!args->oldp->mls_enabled && args->newp->mls_enabled) {

1766

} else if (!args->oldp->mls_enabled && args->newp->mls_enabled) {

1767

/*

1767

/*

1768

* Switching between non-MLS and MLS policy:

1768

* Switching between non-MLS and MLS policy:

1769

* ensure that the MLS fields of the context for all

1769

* ensure that the MLS fields of the context for all

1770

* existing entries in the sidtab are filled in with a

1770

* existing entries in the sidtab are filled in with a

1771

* suitable default value, likely taken from one of the

1771

* suitable default value, likely taken from one of the

1772

* initial SIDs.

1772

* initial SIDs.

1773

*/

1773

*/

1774

oc = args->newp->ocontexts[OCON_ISID];

1774

oc = args->newp->ocontexts[OCON_ISID];

1775

while (oc && oc->sid[0] != SECINITSID_UNLABELED)

1775

while (oc && oc->sid[0] != SECINITSID_UNLABELED)

1776

oc = oc->next;

1776

oc = oc->next;

1777

rc = -EINVAL;

1777

rc = -EINVAL;

1778

if (!oc) {

1778

if (!oc) {

1779

printk(KERN_ERR "SELinux: unable to look up"

1779

printk(KERN_ERR "SELinux: unable to look up"

1780

" the initial SIDs list\n");

1780

" the initial SIDs list\n");

1781

goto bad;

1781

goto bad;

1782

}

1782

}

1783

range = &oc->context[0].range;

1783

range = &oc->context[0].range;

1784

rc = mls_range_set(c, range);

1784

rc = mls_range_set(c, range);

1785

if (rc)

1785

if (rc)

1786

goto bad;

1786

goto bad;

1787

}

1787

}

1788

1789

/* Check the validity of the new context. */

1789

/* Check the validity of the new context. */

1790

if (!policydb_context_isvalid(args->newp, c)) {

1790

if (!policydb_context_isvalid(args->newp, c)) {

1791

rc = convert_context_handle_invalid_context(&oldc);

1791

rc = convert_context_handle_invalid_context(&oldc);

1792

if (rc)

1792

if (rc)

1793

goto bad;

1793

goto bad;

1794

}

1794

}

1795

1796

context_destroy(&oldc);

1796

context_destroy(&oldc);

1797

1798

rc = 0;

1798

rc = 0;

1799

out:

1799

out:

1800

return rc;

1800

return rc;

1801

bad:

1801

bad:

1802

/* Map old representation to string and save it. */

1802

/* Map old representation to string and save it. */

1803

rc = context_struct_to_string(&oldc, &s, &len);

1803

rc = context_struct_to_string(&oldc, &s, &len);

1804

if (rc)

1804

if (rc)

1805

return rc;

1805

return rc;

1806

context_destroy(&oldc);

1806

context_destroy(&oldc);

1807

context_destroy(c);

1807

context_destroy(c);

1808

c->str = s;

1808

c->str = s;

1809

c->len = len;

1809

c->len = len;

1810

printk(KERN_INFO "SELinux: Context %s became invalid (unmapped).\n",

1810

printk(KERN_INFO "SELinux: Context %s became invalid (unmapped).\n",

1811

c->str);

1811

c->str);

1812

rc = 0;

1812

rc = 0;

1813

goto out;

1813

goto out;

1814

}

1814

}

1815

1816

static void security_load_policycaps(void)

1816

static void security_load_policycaps(void)

1817

{

1817

{

1818

selinux_policycap_netpeer = ebitmap_get_bit(&policydb.policycaps,

1818

selinux_policycap_netpeer = ebitmap_get_bit(&policydb.policycaps,

1819

POLICYDB_CAPABILITY_NETPEER);

1819

POLICYDB_CAPABILITY_NETPEER);

1820

selinux_policycap_openperm = ebitmap_get_bit(&policydb.policycaps,

1820

selinux_policycap_openperm = ebitmap_get_bit(&policydb.policycaps,

1821

POLICYDB_CAPABILITY_OPENPERM);

1821

POLICYDB_CAPABILITY_OPENPERM);

1822

selinux_policycap_alwaysnetwork = ebitmap_get_bit(&policydb.policycaps,

1822

selinux_policycap_alwaysnetwork = ebitmap_get_bit(&policydb.policycaps,

1823

POLICYDB_CAPABILITY_ALWAYSNETWORK);

1823

POLICYDB_CAPABILITY_ALWAYSNETWORK);

1824

}

1824

}

1825

1826

static int security_preserve_bools(struct policydb *p);

1826

static int security_preserve_bools(struct policydb *p);

1827

1828

/**

1828

/**

1829

* security_load_policy - Load a security policy configuration.

1829

* security_load_policy - Load a security policy configuration.

1830

* @data: binary policy data

1830

* @data: binary policy data

1831

* @len: length of data in bytes

1831

* @len: length of data in bytes

1832

*

1832

*

1833

* Load a new set of security policy configuration data,

1833

* Load a new set of security policy configuration data,

1834

* validate it and convert the SID table as necessary.

1834

* validate it and convert the SID table as necessary.

1835

* This function will flush the access vector cache after

1835

* This function will flush the access vector cache after

1836

* loading the new policy.

1836

* loading the new policy.

1837

*/

1837

*/

1838

int security_load_policy(void *data, size_t len)

1838

int security_load_policy(void *data, size_t len)

1839

{

1839

{

1840

struct policydb *oldpolicydb, *newpolicydb;

1840

struct policydb *oldpolicydb, *newpolicydb;

1841

struct sidtab oldsidtab, newsidtab;

1841

struct sidtab oldsidtab, newsidtab;

1842

struct selinux_mapping *oldmap, *map = NULL;

1842

struct selinux_mapping *oldmap, *map = NULL;

1843

struct convert_context_args args;

1843

struct convert_context_args args;

1844

u32 seqno;

1844

u32 seqno;

1845

u16 map_size;

1845

u16 map_size;

1846

int rc = 0;

1846

int rc = 0;

1847

struct policy_file file = { data, len }, *fp = &file;

1847

struct policy_file file = { data, len }, *fp = &file;

1848

1849

oldpolicydb = kzalloc(2 * sizeof(*oldpolicydb), GFP_KERNEL);

1849

oldpolicydb = kzalloc(2 * sizeof(*oldpolicydb), GFP_KERNEL);

1850

if (!oldpolicydb) {

1850

if (!oldpolicydb) {

1851

rc = -ENOMEM;

1851

rc = -ENOMEM;

1852

goto out;

1852

goto out;

1853

}

1853

}

1854

newpolicydb = oldpolicydb + 1;

1854

newpolicydb = oldpolicydb + 1;

1855

1856

if (!ss_initialized) {

1856

if (!ss_initialized) {

1857

avtab_cache_init();

1857

avtab_cache_init();

1858

rc = policydb_read(&policydb, fp);

1858

rc = policydb_read(&policydb, fp);

1859

if (rc) {

1859

if (rc) {

1860

avtab_cache_destroy();

1860

avtab_cache_destroy();

1861

goto out;

1861

goto out;

1862

}

1862

}

1863

1864

policydb.len = len;

1864

policydb.len = len;

1865

rc = selinux_set_mapping(&policydb, secclass_map,

1865

rc = selinux_set_mapping(&policydb, secclass_map,

1866

&current_mapping,

1866

&current_mapping,

1867

&current_mapping_size);

1867

&current_mapping_size);

1868

if (rc) {

1868

if (rc) {

1869

policydb_destroy(&policydb);

1869

policydb_destroy(&policydb);

1870

avtab_cache_destroy();

1870

avtab_cache_destroy();

1871

goto out;

1871

goto out;

1872

}

1872

}

1873

1874

rc = policydb_load_isids(&policydb, &sidtab);

1874

rc = policydb_load_isids(&policydb, &sidtab);

1875

if (rc) {

1875

if (rc) {

1876

policydb_destroy(&policydb);

1876

policydb_destroy(&policydb);

1877

avtab_cache_destroy();

1877

avtab_cache_destroy();

1878

goto out;

1878

goto out;

1879

}

1879

}

1880

1881

security_load_policycaps();

1881

security_load_policycaps();

1882

ss_initialized = 1;

1882

ss_initialized = 1;

1883

seqno = ++latest_granting;

1883

seqno = ++latest_granting;

1884

selinux_complete_init();

1884

selinux_complete_init();

1885

avc_ss_reset(seqno);

1885

avc_ss_reset(seqno);

1886

selnl_notify_policyload(seqno);

1886

selnl_notify_policyload(seqno);

1887

selinux_status_update_policyload(seqno);

1887

selinux_status_update_policyload(seqno);

1888

selinux_netlbl_cache_invalidate();

1888

selinux_netlbl_cache_invalidate();

1889

selinux_xfrm_notify_policyload();

1889

selinux_xfrm_notify_policyload();

1890

goto out;

1890

goto out;

1891

}

1891

}

1892

1893

#if 0

1893

#if 0

1894

sidtab_hash_eval(&sidtab, "sids");

1894

sidtab_hash_eval(&sidtab, "sids");

1895

#endif

1895

#endif

1896

1897

rc = policydb_read(newpolicydb, fp);

1897

rc = policydb_read(newpolicydb, fp);

1898

if (rc)

1898

if (rc)

1899

goto out;

1899

goto out;

1900

1901

newpolicydb->len = len;

1901

newpolicydb->len = len;

1902

/* If switching between different policy types, log MLS status */

1902

/* If switching between different policy types, log MLS status */

1903

if (policydb.mls_enabled && !newpolicydb->mls_enabled)

1903

if (policydb.mls_enabled && !newpolicydb->mls_enabled)

1904

printk(KERN_INFO "SELinux: Disabling MLS support...\n");

1904

printk(KERN_INFO "SELinux: Disabling MLS support...\n");

1905

else if (!policydb.mls_enabled && newpolicydb->mls_enabled)

1905

else if (!policydb.mls_enabled && newpolicydb->mls_enabled)

1906

printk(KERN_INFO "SELinux: Enabling MLS support...\n");

1906

printk(KERN_INFO "SELinux: Enabling MLS support...\n");

1907

1908

rc = policydb_load_isids(newpolicydb, &newsidtab);

1908

rc = policydb_load_isids(newpolicydb, &newsidtab);

1909

if (rc) {

1909

if (rc) {

1910

printk(KERN_ERR "SELinux: unable to load the initial SIDs\n");

1910

printk(KERN_ERR "SELinux: unable to load the initial SIDs\n");

1911

policydb_destroy(newpolicydb);

1911

policydb_destroy(newpolicydb);

1912

goto out;

1912

goto out;

1913

}

1913

}

1914

1915

rc = selinux_set_mapping(newpolicydb, secclass_map, &map, &map_size);

1915

rc = selinux_set_mapping(newpolicydb, secclass_map, &map, &map_size);

1916

if (rc)

1916

if (rc)

1917

goto err;

1917

goto err;

1918

1919

rc = security_preserve_bools(newpolicydb);

1919

rc = security_preserve_bools(newpolicydb);

1920

if (rc) {

1920

if (rc) {

1921

printk(KERN_ERR "SELinux: unable to preserve booleans\n");

1921

printk(KERN_ERR "SELinux: unable to preserve booleans\n");

1922

goto err;

1922

goto err;

1923

}

1923

}

1924

1925

/* Clone the SID table. */

1925

/* Clone the SID table. */

1926

sidtab_shutdown(&sidtab);

1926

sidtab_shutdown(&sidtab);

1927

1928

rc = sidtab_map(&sidtab, clone_sid, &newsidtab);

1928

rc = sidtab_map(&sidtab, clone_sid, &newsidtab);

1929

if (rc)

1929

if (rc)

1930

goto err;

1930

goto err;

1931

1932

/*

1932

/*

1933

* Convert the internal representations of contexts

1933

* Convert the internal representations of contexts

1934

* in the new SID table.

1934

* in the new SID table.

1935

*/

1935

*/

1936

args.oldp = &policydb;

1936

args.oldp = &policydb;

1937

args.newp = newpolicydb;

1937

args.newp = newpolicydb;

1938

rc = sidtab_map(&newsidtab, convert_context, &args);

1938

rc = sidtab_map(&newsidtab, convert_context, &args);

1939

if (rc) {

1939

if (rc) {

1940

printk(KERN_ERR "SELinux: unable to convert the internal"

1940

printk(KERN_ERR "SELinux: unable to convert the internal"

1941

" representation of contexts in the new SID"

1941

" representation of contexts in the new SID"

1942

" table\n");

1942

" table\n");

1943

goto err;

1943

goto err;

1944

}

1944

}

1945

1946

/* Save the old policydb and SID table to free later. */

1946

/* Save the old policydb and SID table to free later. */

1947

memcpy(oldpolicydb, &policydb, sizeof(policydb));

1947

memcpy(oldpolicydb, &policydb, sizeof(policydb));

1948

sidtab_set(&oldsidtab, &sidtab);

1948

sidtab_set(&oldsidtab, &sidtab);

1949

1950

/* Install the new policydb and SID table. */

1950

/* Install the new policydb and SID table. */

1951

write_lock_irq(&policy_rwlock);

1951

write_lock_irq(&policy_rwlock);

1952

memcpy(&policydb, newpolicydb, sizeof(policydb));

1952

memcpy(&policydb, newpolicydb, sizeof(policydb));

1953

sidtab_set(&sidtab, &newsidtab);

1953

sidtab_set(&sidtab, &newsidtab);

1954

security_load_policycaps();

1954

security_load_policycaps();

1955

oldmap = current_mapping;

1955

oldmap = current_mapping;

1956

current_mapping = map;

1956

current_mapping = map;

1957

current_mapping_size = map_size;

1957

current_mapping_size = map_size;

1958

seqno = ++latest_granting;

1958

seqno = ++latest_granting;

1959

write_unlock_irq(&policy_rwlock);

1959

write_unlock_irq(&policy_rwlock);

1960

1961

/* Free the old policydb and SID table. */

1961

/* Free the old policydb and SID table. */

1962

policydb_destroy(oldpolicydb);

1962

policydb_destroy(oldpolicydb);

1963

sidtab_destroy(&oldsidtab);

1963

sidtab_destroy(&oldsidtab);

1964

kfree(oldmap);

1964

kfree(oldmap);

1965

1966

avc_ss_reset(seqno);

1966

avc_ss_reset(seqno);

1967

selnl_notify_policyload(seqno);

1967

selnl_notify_policyload(seqno);

1968

selinux_status_update_policyload(seqno);

1968

selinux_status_update_policyload(seqno);

1969

selinux_netlbl_cache_invalidate();

1969

selinux_netlbl_cache_invalidate();

1970

selinux_xfrm_notify_policyload();

1970

selinux_xfrm_notify_policyload();

1971

1972

rc = 0;

1972

rc = 0;

1973

goto out;

1973

goto out;

1974

1975

err:

1975

err:

1976

kfree(map);

1976

kfree(map);

1977

sidtab_destroy(&newsidtab);

1977

sidtab_destroy(&newsidtab);

1978

policydb_destroy(newpolicydb);

1978

policydb_destroy(newpolicydb);

1979

1980

out:

1980

out:

1981

kfree(oldpolicydb);

1981

kfree(oldpolicydb);

1982

return rc;

1982

return rc;

1983

}

1983

}

1984

1985

size_t security_policydb_len(void)

1985

size_t security_policydb_len(void)

1986

{

1986

{

1987

size_t len;

1987

size_t len;

1988

1989

read_lock(&policy_rwlock);

1989

read_lock(&policy_rwlock);

1990

len = policydb.len;

1990

len = policydb.len;

1991

read_unlock(&policy_rwlock);

1991

read_unlock(&policy_rwlock);

1992

1993

return len;

1993

return len;

1994

}

1994

}

1995

1996

/**

1996

/**

1997

* security_port_sid - Obtain the SID for a port.

1997

* security_port_sid - Obtain the SID for a port.

1998

* @protocol: protocol number

1998

* @protocol: protocol number

1999

* @port: port number

1999

* @port: port number

2000

* @out_sid: security identifier

2000

* @out_sid: security identifier

2001

*/

2001

*/

2002

int security_port_sid(u8 protocol, u16 port, u32 *out_sid)

2002

int security_port_sid(u8 protocol, u16 port, u32 *out_sid)

2003

{

2003

{

2004

struct ocontext *c;

2004

struct ocontext *c;

2005

int rc = 0;

2005

int rc = 0;

2006

2007

read_lock(&policy_rwlock);

2007

read_lock(&policy_rwlock);

2008

2009

c = policydb.ocontexts[OCON_PORT];

2009

c = policydb.ocontexts[OCON_PORT];

2010

while (c) {

2010

while (c) {

2011

if (c->u.port.protocol == protocol &&

2011

if (c->u.port.protocol == protocol &&

2012

c->u.port.low_port <= port &&

2012

c->u.port.low_port <= port &&

2013

c->u.port.high_port >= port)

2013

c->u.port.high_port >= port)

2014

break;

2014

break;

2015

c = c->next;

2015

c = c->next;

2016

}

2016

}

2017

2018

if (c) {

2018

if (c) {

2019

if (!c->sid[0]) {

2019

if (!c->sid[0]) {

2020

rc = sidtab_context_to_sid(&sidtab,

2020

rc = sidtab_context_to_sid(&sidtab,

2021

&c->context[0],

2021

&c->context[0],

2022

&c->sid[0]);

2022

&c->sid[0]);

2023

if (rc)

2023

if (rc)

2024

goto out;

2024

goto out;

2025

}

2025

}

2026

*out_sid = c->sid[0];

2026

*out_sid = c->sid[0];

2027

} else {

2027

} else {

2028

*out_sid = SECINITSID_PORT;

2028

*out_sid = SECINITSID_PORT;

2029

}

2029

}

2030

2031

out:

2031

out:

2032

read_unlock(&policy_rwlock);

2032

read_unlock(&policy_rwlock);

2033

return rc;

2033

return rc;

2034

}

2034

}

2035

2036

/**

2036

/**

2037

* security_netif_sid - Obtain the SID for a network interface.

2037

* security_netif_sid - Obtain the SID for a network interface.

2038

* @name: interface name

2038

* @name: interface name

2039

* @if_sid: interface SID

2039

* @if_sid: interface SID

2040

*/

2040

*/

2041

int security_netif_sid(char *name, u32 *if_sid)

2041

int security_netif_sid(char *name, u32 *if_sid)

2042

{

2042

{

2043

int rc = 0;

2043

int rc = 0;

2044

struct ocontext *c;

2044

struct ocontext *c;

2045

2046

read_lock(&policy_rwlock);

2046

read_lock(&policy_rwlock);

2047

2048

c = policydb.ocontexts[OCON_NETIF];

2048

c = policydb.ocontexts[OCON_NETIF];

2049

while (c) {

2049

while (c) {

2050

if (strcmp(name, c->u.name) == 0)

2050

if (strcmp(name, c->u.name) == 0)

2051

break;

2051

break;

2052

c = c->next;

2052

c = c->next;

2053

}

2053

}

2054

2055

if (c) {

2055

if (c) {

2056

if (!c->sid[0] || !c->sid[1]) {

2056

if (!c->sid[0] || !c->sid[1]) {

2057

rc = sidtab_context_to_sid(&sidtab,

2057

rc = sidtab_context_to_sid(&sidtab,

2058

&c->context[0],

2058

&c->context[0],

2059

&c->sid[0]);

2059

&c->sid[0]);

2060

if (rc)

2060

if (rc)

2061

goto out;

2061

goto out;

2062

rc = sidtab_context_to_sid(&sidtab,

2062

rc = sidtab_context_to_sid(&sidtab,

2063

&c->context[1],

2063

&c->context[1],

2064

&c->sid[1]);

2064

&c->sid[1]);

2065

if (rc)

2065

if (rc)

2066

goto out;

2066

goto out;

2067

}

2067

}

2068

*if_sid = c->sid[0];

2068

*if_sid = c->sid[0];

2069

} else

2069

} else

2070

*if_sid = SECINITSID_NETIF;

2070

*if_sid = SECINITSID_NETIF;

2071

2072

out:

2072

out:

2073

read_unlock(&policy_rwlock);

2073

read_unlock(&policy_rwlock);

2074

return rc;

2074

return rc;

2075

}

2075

}

2076

2077

static int match_ipv6_addrmask(u32 *input, u32 *addr, u32 *mask)

2077

static int match_ipv6_addrmask(u32 *input, u32 *addr, u32 *mask)

2078

{

2078

{

2079

int i, fail = 0;

2079

int i, fail = 0;

2080

2081

for (i = 0; i < 4; i++)

2081

for (i = 0; i < 4; i++)

2082

if (addr[i] != (input[i] & mask[i])) {

2082

if (addr[i] != (input[i] & mask[i])) {

2083

fail = 1;

2083

fail = 1;

2084

break;

2084

break;

2085

}

2085

}

2086

2087

return !fail;

2087

return !fail;

2088

}

2088

}

2089

2090

/**

2090

/**

2091

* security_node_sid - Obtain the SID for a node (host).

2091

* security_node_sid - Obtain the SID for a node (host).

2092

* @domain: communication domain aka address family

2092

* @domain: communication domain aka address family

2093

* @addrp: address

2093

* @addrp: address

2094

* @addrlen: address length in bytes

2094

* @addrlen: address length in bytes

2095

* @out_sid: security identifier

2095

* @out_sid: security identifier

2096

*/

2096

*/

2097

int security_node_sid(u16 domain,

2097

int security_node_sid(u16 domain,

2098

void *addrp,

2098

void *addrp,

2099

u32 addrlen,

2099

u32 addrlen,

2100

u32 *out_sid)

2100

u32 *out_sid)

2101

{

2101

{

2102

int rc;

2102

int rc;

2103

struct ocontext *c;

2103

struct ocontext *c;

2104

2105

read_lock(&policy_rwlock);

2105

read_lock(&policy_rwlock);

2106

2107

switch (domain) {

2107

switch (domain) {

2108

case AF_INET: {

2108

case AF_INET: {

2109

u32 addr;

2109

u32 addr;

2110

2111

rc = -EINVAL;

2111

rc = -EINVAL;

2112

if (addrlen != sizeof(u32))

2112

if (addrlen != sizeof(u32))

2113

goto out;

2113

goto out;

2114

2115

addr = *((u32 *)addrp);

2115

addr = *((u32 *)addrp);

2116

2117

c = policydb.ocontexts[OCON_NODE];

2117

c = policydb.ocontexts[OCON_NODE];

2118

while (c) {

2118

while (c) {

2119

if (c->u.node.addr == (addr & c->u.node.mask))

2119

if (c->u.node.addr == (addr & c->u.node.mask))

2120

break;

2120

break;

2121

c = c->next;

2121

c = c->next;

2122

}

2122

}

2123

break;

2123

break;

2124

}

2124

}

2125

2126

case AF_INET6:

2126

case AF_INET6:

2127

rc = -EINVAL;

2127

rc = -EINVAL;

2128

if (addrlen != sizeof(u64) * 2)

2128

if (addrlen != sizeof(u64) * 2)

2129

goto out;

2129

goto out;

2130

c = policydb.ocontexts[OCON_NODE6];

2130

c = policydb.ocontexts[OCON_NODE6];

2131

while (c) {

2131

while (c) {

2132

if (match_ipv6_addrmask(addrp, c->u.node6.addr,

2132

if (match_ipv6_addrmask(addrp, c->u.node6.addr,

2133

c->u.node6.mask))

2133

c->u.node6.mask))

2134

break;

2134

break;

2135

c = c->next;

2135

c = c->next;

2136

}

2136

}

2137

break;

2137

break;

2138

2139

default:

2139

default:

2140

rc = 0;

2140

rc = 0;

2141

*out_sid = SECINITSID_NODE;

2141

*out_sid = SECINITSID_NODE;

2142

goto out;

2142

goto out;

2143

}

2143

}

2144

2145

if (c) {

2145

if (c) {

2146

if (!c->sid[0]) {

2146

if (!c->sid[0]) {

2147

rc = sidtab_context_to_sid(&sidtab,

2147

rc = sidtab_context_to_sid(&sidtab,

2148

&c->context[0],

2148

&c->context[0],

2149

&c->sid[0]);

2149

&c->sid[0]);

2150

if (rc)

2150

if (rc)

2151

goto out;

2151

goto out;

2152

}

2152

}

2153

*out_sid = c->sid[0];

2153

*out_sid = c->sid[0];

2154

} else {

2154

} else {

2155

*out_sid = SECINITSID_NODE;

2155

*out_sid = SECINITSID_NODE;

2156

}

2156

}

2157

2158

rc = 0;

2158

rc = 0;

2159

out:

2159

out:

2160

read_unlock(&policy_rwlock);

2160

read_unlock(&policy_rwlock);

2161

return rc;

2161

return rc;

2162

}

2162

}

2163

2164

#define SIDS_NEL 25

2164

#define SIDS_NEL 25

2165

2166

/**

2166

/**

2167

* security_get_user_sids - Obtain reachable SIDs for a user.

2167

* security_get_user_sids - Obtain reachable SIDs for a user.

2168

* @fromsid: starting SID

2168

* @fromsid: starting SID

2169

* @username: username

2169

* @username: username

2170

* @sids: array of reachable SIDs for user

2170

* @sids: array of reachable SIDs for user

2171

* @nel: number of elements in @sids

2171

* @nel: number of elements in @sids

2172

*

2172

*

2173

* Generate the set of SIDs for legal security contexts

2173

* Generate the set of SIDs for legal security contexts

2174

* for a given user that can be reached by @fromsid.

2174

* for a given user that can be reached by @fromsid.

2175

* Set *@sids to point to a dynamically allocated

2175

* Set *@sids to point to a dynamically allocated

2176

* array containing the set of SIDs. Set *@nel to the

2176

* array containing the set of SIDs. Set *@nel to the

2177

* number of elements in the array.

2177

* number of elements in the array.

2178

*/

2178

*/

2179

2180

int security_get_user_sids(u32 fromsid,

2180

int security_get_user_sids(u32 fromsid,

2181

char *username,

2181

char *username,

2182

u32 **sids,

2182

u32 **sids,

2183

u32 *nel)

2183

u32 *nel)

2184

{

2184

{

2185

struct context *fromcon, usercon;

2185

struct context *fromcon, usercon;

2186

u32 *mysids = NULL, *mysids2, sid;

2186

u32 *mysids = NULL, *mysids2, sid;

2187

u32 mynel = 0, maxnel = SIDS_NEL;

2187

u32 mynel = 0, maxnel = SIDS_NEL;

2188

struct user_datum *user;

2188

struct user_datum *user;

2189

struct role_datum *role;

2189

struct role_datum *role;

2190

struct ebitmap_node *rnode, *tnode;

2190

struct ebitmap_node *rnode, *tnode;

2191

int rc = 0, i, j;

2191

int rc = 0, i, j;

2192

2193

*sids = NULL;

2193

*sids = NULL;

2194

*nel = 0;

2194

*nel = 0;

2195

2196

if (!ss_initialized)

2196

if (!ss_initialized)

2197

goto out;

2197

goto out;

2198

2199

read_lock(&policy_rwlock);

2199

read_lock(&policy_rwlock);

2200

2201

context_init(&usercon);

2201

context_init(&usercon);

2202

2203

rc = -EINVAL;

2203

rc = -EINVAL;

2204

fromcon = sidtab_search(&sidtab, fromsid);

2204

fromcon = sidtab_search(&sidtab, fromsid);

2205

if (!fromcon)

2205

if (!fromcon)

2206

goto out_unlock;

2206

goto out_unlock;

2207

2208

rc = -EINVAL;

2208

rc = -EINVAL;

2209

user = hashtab_search(policydb.p_users.table, username);

2209

user = hashtab_search(policydb.p_users.table, username);

2210

if (!user)

2210

if (!user)

2211

goto out_unlock;

2211

goto out_unlock;

2212

2213

usercon.user = user->value;

2213

usercon.user = user->value;

2214

2215

rc = -ENOMEM;

2215

rc = -ENOMEM;

2216

mysids = kcalloc(maxnel, sizeof(*mysids), GFP_ATOMIC);

2216

mysids = kcalloc(maxnel, sizeof(*mysids), GFP_ATOMIC);

2217

if (!mysids)

2217

if (!mysids)

2218

goto out_unlock;

2218

goto out_unlock;

2219

2220

ebitmap_for_each_positive_bit(&user->roles, rnode, i) {

2220

ebitmap_for_each_positive_bit(&user->roles, rnode, i) {

2221

role = policydb.role_val_to_struct[i];

2221

role = policydb.role_val_to_struct[i];

2222

usercon.role = i + 1;

2222

usercon.role = i + 1;

2223

ebitmap_for_each_positive_bit(&role->types, tnode, j) {

2223

ebitmap_for_each_positive_bit(&role->types, tnode, j) {

2224

usercon.type = j + 1;

2224

usercon.type = j + 1;

2225

2226

if (mls_setup_user_range(fromcon, user, &usercon))

2226

if (mls_setup_user_range(fromcon, user, &usercon))

2227

continue;

2227

continue;

2228

2229

rc = sidtab_context_to_sid(&sidtab, &usercon, &sid);

2229

rc = sidtab_context_to_sid(&sidtab, &usercon, &sid);

2230

if (rc)

2230

if (rc)

2231

goto out_unlock;

2231

goto out_unlock;

2232

if (mynel < maxnel) {

2232

if (mynel < maxnel) {

2233

mysids[mynel++] = sid;

2233

mysids[mynel++] = sid;

2234

} else {

2234

} else {

2235

rc = -ENOMEM;

2235

rc = -ENOMEM;

2236

maxnel += SIDS_NEL;

2236

maxnel += SIDS_NEL;

2237

mysids2 = kcalloc(maxnel, sizeof(*mysids2), GFP_ATOMIC);

2237

mysids2 = kcalloc(maxnel, sizeof(*mysids2), GFP_ATOMIC);

2238

if (!mysids2)

2238

if (!mysids2)

2239

goto out_unlock;

2239

goto out_unlock;

2240

memcpy(mysids2, mysids, mynel * sizeof(*mysids2));

2240

memcpy(mysids2, mysids, mynel * sizeof(*mysids2));

2241

kfree(mysids);

2241

kfree(mysids);

2242

mysids = mysids2;

2242

mysids = mysids2;

2243

mysids[mynel++] = sid;

2243

mysids[mynel++] = sid;

2244

}

2244

}

2245

}

2245

}

2246

}

2246

}

2247

rc = 0;

2247

rc = 0;

2248

out_unlock:

2248

out_unlock:

2249

read_unlock(&policy_rwlock);

2249

read_unlock(&policy_rwlock);

2250

if (rc || !mynel) {

2250

if (rc || !mynel) {

2251

kfree(mysids);

2251

kfree(mysids);

2252

goto out;

2252

goto out;

2253

}

2253

}

2254

2255

rc = -ENOMEM;

2255

rc = -ENOMEM;

2256

mysids2 = kcalloc(mynel, sizeof(*mysids2), GFP_KERNEL);

2256

mysids2 = kcalloc(mynel, sizeof(*mysids2), GFP_KERNEL);

2257

if (!mysids2) {

2257

if (!mysids2) {

2258

kfree(mysids);

2258

kfree(mysids);

2259

goto out;

2259

goto out;

2260

}

2260

}

2261

for (i = 0, j = 0; i < mynel; i++) {

2261

for (i = 0, j = 0; i < mynel; i++) {

2262

struct av_decision dummy_avd;

2262

struct av_decision dummy_avd;

2263

rc = avc_has_perm_noaudit(fromsid, mysids[i],

2263

rc = avc_has_perm_noaudit(fromsid, mysids[i],

2264

SECCLASS_PROCESS, /* kernel value */

2264

SECCLASS_PROCESS, /* kernel value */

2265

PROCESS__TRANSITION, AVC_STRICT,

2265

PROCESS__TRANSITION, AVC_STRICT,

2266

&dummy_avd);

2266

&dummy_avd);

2267

if (!rc)

2267

if (!rc)

2268

mysids2[j++] = mysids[i];

2268

mysids2[j++] = mysids[i];

2269

cond_resched();

2269

cond_resched();

2270

}

2270

}

2271

rc = 0;

2271

rc = 0;

2272

kfree(mysids);

2272

kfree(mysids);

2273

*sids = mysids2;

2273

*sids = mysids2;

2274

*nel = j;

2274

*nel = j;

2275

out:

2275

out:

2276

return rc;

2276

return rc;

2277

}

2277

}

2278

2279

/**

2279

/**

2280

* __security_genfs_sid - Helper to obtain a SID for a file in a filesystem

2280

* __security_genfs_sid - Helper to obtain a SID for a file in a filesystem

2281

* @fstype: filesystem type

2281

* @fstype: filesystem type

2282

* @path: path from root of mount

2282

* @path: path from root of mount

2283

* @sclass: file security class

2283

* @sclass: file security class

2284

* @sid: SID for path

2284

* @sid: SID for path

2285

*

2285

*

2286

* Obtain a SID to use for a file in a filesystem that

2286

* Obtain a SID to use for a file in a filesystem that

2287

* cannot support xattr or use a fixed labeling behavior like

2287

* cannot support xattr or use a fixed labeling behavior like

2288

* transition SIDs or task SIDs.

2288

* transition SIDs or task SIDs.

2289

*

2289

*

2290

* The caller must acquire the policy_rwlock before calling this function.

2290

* The caller must acquire the policy_rwlock before calling this function.

2291

*/

2291

*/

2292

static inline int __security_genfs_sid(const char *fstype,

2292

static inline int __security_genfs_sid(const char *fstype,

2293

char *path,

2293

char *path,

2294

u16 orig_sclass,

2294

u16 orig_sclass,

2295

u32 *sid)

2295

u32 *sid)

2296

{

2296

{

2297

int len;

2297

int len;

2298

u16 sclass;

2298

u16 sclass;

2299

struct genfs *genfs;

2299

struct genfs *genfs;

2300

struct ocontext *c;

2300

struct ocontext *c;

2301

int rc, cmp = 0;

2301

int rc, cmp = 0;

2302

2303

while (path[0] == '/' && path[1] == '/')

2303

while (path[0] == '/' && path[1] == '/')

2304

path++;

2304

path++;

2305

2306

sclass = unmap_class(orig_sclass);

2306

sclass = unmap_class(orig_sclass);

2307

*sid = SECINITSID_UNLABELED;

2307

*sid = SECINITSID_UNLABELED;

2308

2309

for (genfs = policydb.genfs; genfs; genfs = genfs->next) {

2309

for (genfs = policydb.genfs; genfs; genfs = genfs->next) {

2310

cmp = strcmp(fstype, genfs->fstype);

2310

cmp = strcmp(fstype, genfs->fstype);

2311

if (cmp <= 0)

2311

if (cmp <= 0)

2312

break;

2312

break;

2313

}

2313

}

2314

2315

rc = -ENOENT;

2315

rc = -ENOENT;

2316

if (!genfs || cmp)

2316

if (!genfs || cmp)

2317

goto out;

2317

goto out;

2318

2319

for (c = genfs->head; c; c = c->next) {

2319

for (c = genfs->head; c; c = c->next) {

2320

len = strlen(c->u.name);

2320

len = strlen(c->u.name);

2321

if ((!c->v.sclass || sclass == c->v.sclass) &&

2321

if ((!c->v.sclass || sclass == c->v.sclass) &&

2322

(strncmp(c->u.name, path, len) == 0))

2322

(strncmp(c->u.name, path, len) == 0))

2323

break;

2323

break;

2324

}

2324

}

2325

2326

rc = -ENOENT;

2326

rc = -ENOENT;

2327

if (!c)

2327

if (!c)

2328

goto out;

2328

goto out;

2329

2330

if (!c->sid[0]) {

2330

if (!c->sid[0]) {

2331

rc = sidtab_context_to_sid(&sidtab, &c->context[0], &c->sid[0]);

2331

rc = sidtab_context_to_sid(&sidtab, &c->context[0], &c->sid[0]);

2332

if (rc)

2332

if (rc)

2333

goto out;

2333

goto out;

2334

}

2334

}

2335

2336

*sid = c->sid[0];

2336

*sid = c->sid[0];

2337

rc = 0;

2337

rc = 0;

2338

out:

2338

out:

2339

return rc;

2339

return rc;

2340

}

2340

}

2341

2342

/**

2342

/**

2343

* security_genfs_sid - Obtain a SID for a file in a filesystem

2343

* security_genfs_sid - Obtain a SID for a file in a filesystem

2344

* @fstype: filesystem type

2344

* @fstype: filesystem type

2345

* @path: path from root of mount

2345

* @path: path from root of mount

2346

* @sclass: file security class

2346

* @sclass: file security class

2347

* @sid: SID for path

2347

* @sid: SID for path

2348

*

2348

*

2349

* Acquire policy_rwlock before calling __security_genfs_sid() and release

2349

* Acquire policy_rwlock before calling __security_genfs_sid() and release

2350

* it afterward.

2350

* it afterward.

2351

*/

2351

*/

2352

int security_genfs_sid(const char *fstype,

2352

int security_genfs_sid(const char *fstype,

2353

char *path,

2353

char *path,

2354

u16 orig_sclass,

2354

u16 orig_sclass,

2355

u32 *sid)

2355

u32 *sid)

2356

{

2356

{

2357

int retval;

2357

int retval;

2358

2359

read_lock(&policy_rwlock);

2359

read_lock(&policy_rwlock);

2360

retval = __security_genfs_sid(fstype, path, orig_sclass, sid);

2360

retval = __security_genfs_sid(fstype, path, orig_sclass, sid);

2361

read_unlock(&policy_rwlock);

2361

read_unlock(&policy_rwlock);

2362

return retval;

2362

return retval;

2363

}

2363

}

2364

2365

/**

2365

/**

2366

* security_fs_use - Determine how to handle labeling for a filesystem.

2366

* security_fs_use - Determine how to handle labeling for a filesystem.

2367

* @sb: superblock in question

2367

* @sb: superblock in question

2368

*/

2368

*/

2369

int security_fs_use(struct super_block *sb)

2369

int security_fs_use(struct super_block *sb)

2370

{

2370

{

2371

int rc = 0;

2371

int rc = 0;

2372

struct ocontext *c;

2372

struct ocontext *c;

2373

struct superblock_security_struct *sbsec = sb->s_security;

2373

struct superblock_security_struct *sbsec = sb->s_security;

2374

const char *fstype = sb->s_type->name;

2374

const char *fstype = sb->s_type->name;

2375

2376

read_lock(&policy_rwlock);

2376

read_lock(&policy_rwlock);

2377

2378

c = policydb.ocontexts[OCON_FSUSE];

2378

c = policydb.ocontexts[OCON_FSUSE];

2379

while (c) {

2379

while (c) {

2380

if (strcmp(fstype, c->u.name) == 0)

2380

if (strcmp(fstype, c->u.name) == 0)

2381

break;

2381

break;

2382

c = c->next;

2382

c = c->next;

2383

}

2383

}

2384

2385

if (c) {

2385

if (c) {

2386

sbsec->behavior = c->v.behavior;

2386

sbsec->behavior = c->v.behavior;

2387

if (!c->sid[0]) {

2387

if (!c->sid[0]) {

2388

rc = sidtab_context_to_sid(&sidtab, &c->context[0],

2388

rc = sidtab_context_to_sid(&sidtab, &c->context[0],

2389

&c->sid[0]);

2389

&c->sid[0]);

2390

if (rc)

2390

if (rc)

2391

goto out;

2391

goto out;

2392

}

2392

}

2393

sbsec->sid = c->sid[0];

2393

sbsec->sid = c->sid[0];

2394

} else {

2394

} else {

2395

rc = __security_genfs_sid(fstype, "/", SECCLASS_DIR,

2395

rc = __security_genfs_sid(fstype, "/", SECCLASS_DIR,

2396

&sbsec->sid);

2396

&sbsec->sid);

2397

if (rc) {

2397

if (rc) {

2398

sbsec->behavior = SECURITY_FS_USE_NONE;

2398

sbsec->behavior = SECURITY_FS_USE_NONE;

2399

rc = 0;

2399

rc = 0;

2400

} else {

2400

} else {

2401

sbsec->behavior = SECURITY_FS_USE_GENFS;

2401

sbsec->behavior = SECURITY_FS_USE_GENFS;

2402

}

2402

}

2403

}

2403

}

2404

2405

out:

2405

out:

2406

read_unlock(&policy_rwlock);

2406

read_unlock(&policy_rwlock);

2407

return rc;

2407

return rc;

2408

}

2408

}

2409

2410

int security_get_bools(int *len, char ***names, int **values)

2410

int security_get_bools(int *len, char ***names, int **values)

2411

{

2411

{

2412

int i, rc;

2412

int i, rc;

2413

2414

read_lock(&policy_rwlock);

2414

read_lock(&policy_rwlock);

2415

*names = NULL;

2415

*names = NULL;

2416

*values = NULL;

2416

*values = NULL;

2417

2418

rc = 0;

2418

rc = 0;

2419

*len = policydb.p_bools.nprim;

2419

*len = policydb.p_bools.nprim;

2420

if (!*len)

2420

if (!*len)

2421

goto out;

2421

goto out;

2422

2423

rc = -ENOMEM;

2423

rc = -ENOMEM;

2424

*names = kcalloc(*len, sizeof(char *), GFP_ATOMIC);

2424

*names = kcalloc(*len, sizeof(char *), GFP_ATOMIC);

2425

if (!*names)

2425

if (!*names)

2426

goto err;

2426

goto err;

2427

2428

rc = -ENOMEM;

2428

rc = -ENOMEM;

2429

*values = kcalloc(*len, sizeof(int), GFP_ATOMIC);

2429

*values = kcalloc(*len, sizeof(int), GFP_ATOMIC);

2430

if (!*values)

2430

if (!*values)

2431

goto err;

2431

goto err;

2432

2433

for (i = 0; i < *len; i++) {

2433

for (i = 0; i < *len; i++) {

2434

size_t name_len;

2434

size_t name_len;

2435

2436

(*values)[i] = policydb.bool_val_to_struct[i]->state;

2436

(*values)[i] = policydb.bool_val_to_struct[i]->state;

2437

name_len = strlen(sym_name(&policydb, SYM_BOOLS, i)) + 1;

2437

name_len = strlen(sym_name(&policydb, SYM_BOOLS, i)) + 1;

2438

2439

rc = -ENOMEM;

2439

rc = -ENOMEM;

2440

(*names)[i] = kmalloc(sizeof(char) * name_len, GFP_ATOMIC);

2440

(*names)[i] = kmalloc(sizeof(char) * name_len, GFP_ATOMIC);

2441

if (!(*names)[i])

2441

if (!(*names)[i])

2442

goto err;

2442

goto err;

2443

2444

strncpy((*names)[i], sym_name(&policydb, SYM_BOOLS, i), name_len);

2444

strncpy((*names)[i], sym_name(&policydb, SYM_BOOLS, i), name_len);

2445

(*names)[i][name_len - 1] = 0;

2445

(*names)[i][name_len - 1] = 0;

2446

}

2446

}

2447

rc = 0;

2447

rc = 0;

2448

out:

2448

out:

2449

read_unlock(&policy_rwlock);

2449

read_unlock(&policy_rwlock);

2450

return rc;

2450

return rc;

2451

err:

2451

err:

2452

if (*names) {

2452

if (*names) {

2453

for (i = 0; i < *len; i++)

2453

for (i = 0; i < *len; i++)

2454

kfree((*names)[i]);

2454

kfree((*names)[i]);

2455

}

2455

}

2456

kfree(*values);

2456

kfree(*values);

2457

goto out;

2457

goto out;

2458

}

2458

}

2459

2460

2461

int security_set_bools(int len, int *values)

2461

int security_set_bools(int len, int *values)

2462

{

2462

{

2463

int i, rc;

2463

int i, rc;

2464

int lenp, seqno = 0;

2464

int lenp, seqno = 0;

2465

struct cond_node *cur;

2465

struct cond_node *cur;

2466

2467

write_lock_irq(&policy_rwlock);

2467

write_lock_irq(&policy_rwlock);

2468

2469

rc = -EFAULT;

2469

rc = -EFAULT;

2470

lenp = policydb.p_bools.nprim;

2470

lenp = policydb.p_bools.nprim;

2471

if (len != lenp)

2471

if (len != lenp)

2472

goto out;

2472

goto out;

2473

2474

for (i = 0; i < len; i++) {

2474

for (i = 0; i < len; i++) {

2475

if (!!values[i] != policydb.bool_val_to_struct[i]->state) {

2475

if (!!values[i] != policydb.bool_val_to_struct[i]->state) {

2476

audit_log(current->audit_context, GFP_ATOMIC,

2476

audit_log(current->audit_context, GFP_ATOMIC,

2477

AUDIT_MAC_CONFIG_CHANGE,

2477

AUDIT_MAC_CONFIG_CHANGE,

2478

"bool=%s val=%d old_val=%d auid=%u ses=%u",

2478

"bool=%s val=%d old_val=%d auid=%u ses=%u",

2479

sym_name(&policydb, SYM_BOOLS, i),

2479

sym_name(&policydb, SYM_BOOLS, i),

2480

!!values[i],

2480

!!values[i],

2481

policydb.bool_val_to_struct[i]->state,

2481

policydb.bool_val_to_struct[i]->state,

2482

from_kuid(&init_user_ns, audit_get_loginuid(current)),

2482

from_kuid(&init_user_ns, audit_get_loginuid(current)),

2483

audit_get_sessionid(current));

2483

audit_get_sessionid(current));

2484

}

2484

}

2485

if (values[i])

2485

if (values[i])

2486

policydb.bool_val_to_struct[i]->state = 1;

2486

policydb.bool_val_to_struct[i]->state = 1;

2487

else

2487

else

2488

policydb.bool_val_to_struct[i]->state = 0;

2488

policydb.bool_val_to_struct[i]->state = 0;

2489

}

2489

}

2490

2491

for (cur = policydb.cond_list; cur; cur = cur->next) {

2491

for (cur = policydb.cond_list; cur; cur = cur->next) {

2492

rc = evaluate_cond_node(&policydb, cur);

2492

rc = evaluate_cond_node(&policydb, cur);

2493

if (rc)

2493

if (rc)

2494

goto out;

2494

goto out;

2495

}

2495

}

2496

2497

seqno = ++latest_granting;

2497

seqno = ++latest_granting;

2498

rc = 0;

2498

rc = 0;

2499

out:

2499

out:

2500

write_unlock_irq(&policy_rwlock);

2500

write_unlock_irq(&policy_rwlock);

2501

if (!rc) {

2501

if (!rc) {

2502

avc_ss_reset(seqno);

2502

avc_ss_reset(seqno);

2503

selnl_notify_policyload(seqno);

2503

selnl_notify_policyload(seqno);

2504

selinux_status_update_policyload(seqno);

2504

selinux_status_update_policyload(seqno);

2505

selinux_xfrm_notify_policyload();

2505

selinux_xfrm_notify_policyload();

2506

}

2506

}

2507

return rc;

2507

return rc;

2508

}

2508

}

2509

2510

int security_get_bool_value(int bool)

2510

int security_get_bool_value(int bool)

2511

{

2511

{

2512

int rc;

2512

int rc;

2513

int len;

2513

int len;

2514

2515

read_lock(&policy_rwlock);

2515

read_lock(&policy_rwlock);

2516

2517

rc = -EFAULT;

2517

rc = -EFAULT;

2518

len = policydb.p_bools.nprim;

2518

len = policydb.p_bools.nprim;

2519

if (bool >= len)

2519

if (bool >= len)

2520

goto out;

2520

goto out;

2521

2522

rc = policydb.bool_val_to_struct[bool]->state;

2522

rc = policydb.bool_val_to_struct[bool]->state;

2523

out:

2523

out:

2524

read_unlock(&policy_rwlock);

2524

read_unlock(&policy_rwlock);

2525

return rc;

2525

return rc;

2526

}

2526

}

2527

2528

static int security_preserve_bools(struct policydb *p)

2528

static int security_preserve_bools(struct policydb *p)

2529

{

2529

{

2530

int rc, nbools = 0, *bvalues = NULL, i;

2530

int rc, nbools = 0, *bvalues = NULL, i;

2531

char **bnames = NULL;

2531

char **bnames = NULL;

2532

struct cond_bool_datum *booldatum;

2532

struct cond_bool_datum *booldatum;

2533

struct cond_node *cur;

2533

struct cond_node *cur;

2534

2535

rc = security_get_bools(&nbools, &bnames, &bvalues);

2535

rc = security_get_bools(&nbools, &bnames, &bvalues);

2536

if (rc)

2536

if (rc)

2537

goto out;

2537

goto out;

2538

for (i = 0; i < nbools; i++) {

2538

for (i = 0; i < nbools; i++) {

2539

booldatum = hashtab_search(p->p_bools.table, bnames[i]);

2539

booldatum = hashtab_search(p->p_bools.table, bnames[i]);

2540

if (booldatum)

2540

if (booldatum)

2541

booldatum->state = bvalues[i];

2541

booldatum->state = bvalues[i];

2542

}

2542

}

2543

for (cur = p->cond_list; cur; cur = cur->next) {

2543

for (cur = p->cond_list; cur; cur = cur->next) {

2544

rc = evaluate_cond_node(p, cur);

2544

rc = evaluate_cond_node(p, cur);

2545

if (rc)

2545

if (rc)

2546

goto out;

2546

goto out;

2547

}

2547

}

2548

2549

out:

2549

out:

2550

if (bnames) {

2550

if (bnames) {

2551

for (i = 0; i < nbools; i++)

2551

for (i = 0; i < nbools; i++)

2552

kfree(bnames[i]);

2552

kfree(bnames[i]);

2553

}

2553

}

2554

kfree(bnames);

2554

kfree(bnames);

2555

kfree(bvalues);

2555

kfree(bvalues);

2556

return rc;

2556

return rc;

2557

}

2557

}

2558

2559

/*

2559

/*

2560

* security_sid_mls_copy() - computes a new sid based on the given

2560

* security_sid_mls_copy() - computes a new sid based on the given

2561

* sid and the mls portion of mls_sid.

2561

* sid and the mls portion of mls_sid.

2562

*/

2562

*/

2563

int security_sid_mls_copy(u32 sid, u32 mls_sid, u32 *new_sid)

2563

int security_sid_mls_copy(u32 sid, u32 mls_sid, u32 *new_sid)

2564

{

2564

{

2565

struct context *context1;

2565

struct context *context1;

2566

struct context *context2;

2566

struct context *context2;

2567

struct context newcon;

2567

struct context newcon;

2568

char *s;

2568

char *s;

2569

u32 len;

2569

u32 len;

2570

int rc;

2570

int rc;

2571

2572

rc = 0;

2572

rc = 0;

2573

if (!ss_initialized || !policydb.mls_enabled) {

2573

if (!ss_initialized || !policydb.mls_enabled) {

2574

*new_sid = sid;

2574

*new_sid = sid;

2575

goto out;

2575

goto out;

2576

}

2576

}

2577

2578

context_init(&newcon);

2578

context_init(&newcon);

2579

2580

read_lock(&policy_rwlock);

2580

read_lock(&policy_rwlock);

2581

2582

rc = -EINVAL;

2582

rc = -EINVAL;

2583

context1 = sidtab_search(&sidtab, sid);

2583

context1 = sidtab_search(&sidtab, sid);

2584

if (!context1) {

2584

if (!context1) {

2585

printk(KERN_ERR "SELinux: %s: unrecognized SID %d\n",

2585

printk(KERN_ERR "SELinux: %s: unrecognized SID %d\n",

2586

__func__, sid);

2586

__func__, sid);

2587

goto out_unlock;

2587

goto out_unlock;

2588

}

2588

}

2589

2590

rc = -EINVAL;

2590

rc = -EINVAL;

2591

context2 = sidtab_search(&sidtab, mls_sid);

2591

context2 = sidtab_search(&sidtab, mls_sid);

2592

if (!context2) {

2592

if (!context2) {

2593

printk(KERN_ERR "SELinux: %s: unrecognized SID %d\n",

2593

printk(KERN_ERR "SELinux: %s: unrecognized SID %d\n",

2594

__func__, mls_sid);

2594

__func__, mls_sid);

2595

goto out_unlock;

2595

goto out_unlock;

2596

}

2596

}

2597

2598

newcon.user = context1->user;

2598

newcon.user = context1->user;

2599

newcon.role = context1->role;

2599

newcon.role = context1->role;

2600

newcon.type = context1->type;

2600

newcon.type = context1->type;

2601

rc = mls_context_cpy(&newcon, context2);

2601

rc = mls_context_cpy(&newcon, context2);

2602

if (rc)

2602

if (rc)

2603

goto out_unlock;

2603

goto out_unlock;

2604

2605

/* Check the validity of the new context. */

2605

/* Check the validity of the new context. */

2606

if (!policydb_context_isvalid(&policydb, &newcon)) {

2606

if (!policydb_context_isvalid(&policydb, &newcon)) {

2607

rc = convert_context_handle_invalid_context(&newcon);

2607

rc = convert_context_handle_invalid_context(&newcon);

2608

if (rc) {

2608

if (rc) {

2609

if (!context_struct_to_string(&newcon, &s, &len)) {

2609

if (!context_struct_to_string(&newcon, &s, &len)) {

2610

audit_log(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR,

2610

audit_log(current->audit_context,

2611

"security_sid_mls_copy: invalid context %s", s);

2611

GFP_ATOMIC, AUDIT_SELINUX_ERR,

2612

"op=security_sid_mls_copy "

2613

"invalid_context=%s", s);

2612

kfree(s);

2614

kfree(s);

2613

}

2615

}

2614

goto out_unlock;

2616

goto out_unlock;

2615

}

2617

}

2616

}

2618

}

2617

2619

2618

rc = sidtab_context_to_sid(&sidtab, &newcon, new_sid);

2620

rc = sidtab_context_to_sid(&sidtab, &newcon, new_sid);

2619

out_unlock:

2621

out_unlock:

2620

read_unlock(&policy_rwlock);

2622

read_unlock(&policy_rwlock);

2621

context_destroy(&newcon);

2623

context_destroy(&newcon);

2622

out:

2624

out:

2623

return rc;

2625

return rc;

2624

}

2626

}

2625

2627

2626

/**

2628

/**

2627

* security_net_peersid_resolve - Compare and resolve two network peer SIDs

2629

* security_net_peersid_resolve - Compare and resolve two network peer SIDs

2628

* @nlbl_sid: NetLabel SID

2630

* @nlbl_sid: NetLabel SID

2629

* @nlbl_type: NetLabel labeling protocol type

2631

* @nlbl_type: NetLabel labeling protocol type

2630

* @xfrm_sid: XFRM SID

2632

* @xfrm_sid: XFRM SID

2631

*

2633

*

2632

* Description:

2634

* Description:

2633

* Compare the @nlbl_sid and @xfrm_sid values and if the two SIDs can be

2635

* Compare the @nlbl_sid and @xfrm_sid values and if the two SIDs can be

2634

* resolved into a single SID it is returned via @peer_sid and the function

2636

* resolved into a single SID it is returned via @peer_sid and the function

2635

* returns zero. Otherwise @peer_sid is set to SECSID_NULL and the function

2637

* returns zero. Otherwise @peer_sid is set to SECSID_NULL and the function

2636

* returns a negative value. A table summarizing the behavior is below:

2638

* returns a negative value. A table summarizing the behavior is below:

2637

*

2639

*

2638

* | function return | @sid

2640

* | function return | @sid

2639

* ------------------------------+-----------------+-----------------

2641

* ------------------------------+-----------------+-----------------

2640

* no peer labels | 0 | SECSID_NULL

2642

* no peer labels | 0 | SECSID_NULL

2641

* single peer label | 0 | <peer_label>

2643

* single peer label | 0 | <peer_label>

2642

* multiple, consistent labels | 0 | <peer_label>

2644

* multiple, consistent labels | 0 | <peer_label>

2643

* multiple, inconsistent labels | -<errno> | SECSID_NULL

2645

* multiple, inconsistent labels | -<errno> | SECSID_NULL

2644

*

2646

*

2645

*/

2647

*/

2646

int security_net_peersid_resolve(u32 nlbl_sid, u32 nlbl_type,

2648

int security_net_peersid_resolve(u32 nlbl_sid, u32 nlbl_type,

2647

u32 xfrm_sid,

2649

u32 xfrm_sid,

2648

u32 *peer_sid)

2650

u32 *peer_sid)

2649

{

2651

{

2650

int rc;

2652

int rc;

2651

struct context *nlbl_ctx;

2653

struct context *nlbl_ctx;

2652

struct context *xfrm_ctx;

2654

struct context *xfrm_ctx;

2653

2655

2654

*peer_sid = SECSID_NULL;

2656

*peer_sid = SECSID_NULL;

2655

2657

2656

/* handle the common (which also happens to be the set of easy) cases

2658

/* handle the common (which also happens to be the set of easy) cases

2657

* right away, these two if statements catch everything involving a

2659

* right away, these two if statements catch everything involving a

2658

* single or absent peer SID/label */

2660

* single or absent peer SID/label */

2659

if (xfrm_sid == SECSID_NULL) {

2661

if (xfrm_sid == SECSID_NULL) {

2660

*peer_sid = nlbl_sid;

2662

*peer_sid = nlbl_sid;

2661

return 0;

2663

return 0;

2662

}

2664

}

2663

/* NOTE: an nlbl_type == NETLBL_NLTYPE_UNLABELED is a "fallback" label

2665

/* NOTE: an nlbl_type == NETLBL_NLTYPE_UNLABELED is a "fallback" label

2664

* and is treated as if nlbl_sid == SECSID_NULL when a XFRM SID/label

2666

* and is treated as if nlbl_sid == SECSID_NULL when a XFRM SID/label

2665

* is present */

2667

* is present */

2666

if (nlbl_sid == SECSID_NULL || nlbl_type == NETLBL_NLTYPE_UNLABELED) {

2668

if (nlbl_sid == SECSID_NULL || nlbl_type == NETLBL_NLTYPE_UNLABELED) {

2667

*peer_sid = xfrm_sid;

2669

*peer_sid = xfrm_sid;

2668

return 0;

2670

return 0;

2669

}

2671

}

2670

2672

2671

/* we don't need to check ss_initialized here since the only way both

2673

/* we don't need to check ss_initialized here since the only way both

2672

* nlbl_sid and xfrm_sid are not equal to SECSID_NULL would be if the

2674

* nlbl_sid and xfrm_sid are not equal to SECSID_NULL would be if the

2673

* security server was initialized and ss_initialized was true */

2675

* security server was initialized and ss_initialized was true */

2674

if (!policydb.mls_enabled)

2676

if (!policydb.mls_enabled)

2675

return 0;

2677

return 0;

2676

2678

2677

read_lock(&policy_rwlock);

2679

read_lock(&policy_rwlock);

2678

2680

2679

rc = -EINVAL;

2681

rc = -EINVAL;

2680

nlbl_ctx = sidtab_search(&sidtab, nlbl_sid);

2682

nlbl_ctx = sidtab_search(&sidtab, nlbl_sid);

2681

if (!nlbl_ctx) {

2683

if (!nlbl_ctx) {

2682

printk(KERN_ERR "SELinux: %s: unrecognized SID %d\n",

2684

printk(KERN_ERR "SELinux: %s: unrecognized SID %d\n",

2683

__func__, nlbl_sid);

2685

__func__, nlbl_sid);

2684

goto out;

2686

goto out;

2685

}

2687

}

2686

rc = -EINVAL;

2688

rc = -EINVAL;

2687

xfrm_ctx = sidtab_search(&sidtab, xfrm_sid);

2689

xfrm_ctx = sidtab_search(&sidtab, xfrm_sid);

2688

if (!xfrm_ctx) {

2690

if (!xfrm_ctx) {

2689

printk(KERN_ERR "SELinux: %s: unrecognized SID %d\n",

2691

printk(KERN_ERR "SELinux: %s: unrecognized SID %d\n",

2690

__func__, xfrm_sid);

2692

__func__, xfrm_sid);

2691

goto out;

2693

goto out;

2692

}

2694

}

2693

rc = (mls_context_cmp(nlbl_ctx, xfrm_ctx) ? 0 : -EACCES);

2695

rc = (mls_context_cmp(nlbl_ctx, xfrm_ctx) ? 0 : -EACCES);

2694

if (rc)

2696

if (rc)

2695

goto out;

2697

goto out;

2696

2698

2697

/* at present NetLabel SIDs/labels really only carry MLS

2699

/* at present NetLabel SIDs/labels really only carry MLS

2698

* information so if the MLS portion of the NetLabel SID

2700

* information so if the MLS portion of the NetLabel SID

2699

* matches the MLS portion of the labeled XFRM SID/label

2701

* matches the MLS portion of the labeled XFRM SID/label

2700

* then pass along the XFRM SID as it is the most

2702

* then pass along the XFRM SID as it is the most

2701

* expressive */

2703

* expressive */

2702

*peer_sid = xfrm_sid;

2704

*peer_sid = xfrm_sid;

2703

out:

2705

out:

2704

read_unlock(&policy_rwlock);

2706

read_unlock(&policy_rwlock);

2705

return rc;

2707

return rc;

2706

}

2708

}

2707

2709

2708

static int get_classes_callback(void *k, void *d, void *args)

2710

static int get_classes_callback(void *k, void *d, void *args)

2709

{

2711

{

2710

struct class_datum *datum = d;

2712

struct class_datum *datum = d;

2711

char *name = k, **classes = args;

2713

char *name = k, **classes = args;

2712

int value = datum->value - 1;

2714

int value = datum->value - 1;

2713

2715

2714

classes[value] = kstrdup(name, GFP_ATOMIC);

2716

classes[value] = kstrdup(name, GFP_ATOMIC);

2715

if (!classes[value])

2717

if (!classes[value])

2716

return -ENOMEM;

2718

return -ENOMEM;

2717

2719

2718

return 0;

2720

return 0;

2719

}

2721

}

2720

2722

2721

int security_get_classes(char ***classes, int *nclasses)

2723

int security_get_classes(char ***classes, int *nclasses)

2722

{

2724

{

2723

int rc;

2725

int rc;

2724

2726

2725

read_lock(&policy_rwlock);

2727

read_lock(&policy_rwlock);

2726

2728

2727

rc = -ENOMEM;

2729

rc = -ENOMEM;

2728

*nclasses = policydb.p_classes.nprim;

2730

*nclasses = policydb.p_classes.nprim;

2729

*classes = kcalloc(*nclasses, sizeof(**classes), GFP_ATOMIC);

2731

*classes = kcalloc(*nclasses, sizeof(**classes), GFP_ATOMIC);

2730

if (!*classes)

2732

if (!*classes)

2731

goto out;

2733

goto out;

2732

2734

2733

rc = hashtab_map(policydb.p_classes.table, get_classes_callback,

2735

rc = hashtab_map(policydb.p_classes.table, get_classes_callback,

2734

*classes);

2736

*classes);

2735

if (rc) {

2737

if (rc) {

2736

int i;

2738

int i;

2737

for (i = 0; i < *nclasses; i++)

2739

for (i = 0; i < *nclasses; i++)

2738

kfree((*classes)[i]);

2740

kfree((*classes)[i]);

2739

kfree(*classes);

2741

kfree(*classes);

2740

}

2742

}

2741

2743

2742

out:

2744

out:

2743

read_unlock(&policy_rwlock);

2745

read_unlock(&policy_rwlock);

2744

return rc;

2746

return rc;

2745

}

2747

}

2746

2748

2747

static int get_permissions_callback(void *k, void *d, void *args)

2749

static int get_permissions_callback(void *k, void *d, void *args)

2748

{

2750

{

2749

struct perm_datum *datum = d;

2751

struct perm_datum *datum = d;

2750

char *name = k, **perms = args;

2752

char *name = k, **perms = args;

2751

int value = datum->value - 1;

2753

int value = datum->value - 1;

2752

2754

2753

perms[value] = kstrdup(name, GFP_ATOMIC);

2755

perms[value] = kstrdup(name, GFP_ATOMIC);

2754

if (!perms[value])

2756

if (!perms[value])

2755

return -ENOMEM;

2757

return -ENOMEM;

2756

2758

2757

return 0;

2759

return 0;

2758

}

2760

}

2759

2761

2760

int security_get_permissions(char *class, char ***perms, int *nperms)

2762

int security_get_permissions(char *class, char ***perms, int *nperms)

2761

{

2763

{

2762

int rc, i;

2764

int rc, i;

2763

struct class_datum *match;

2765

struct class_datum *match;

2764

2766

2765

read_lock(&policy_rwlock);

2767

read_lock(&policy_rwlock);

2766

2768

2767

rc = -EINVAL;

2769

rc = -EINVAL;

2768

match = hashtab_search(policydb.p_classes.table, class);

2770

match = hashtab_search(policydb.p_classes.table, class);

2769

if (!match) {

2771

if (!match) {

2770

printk(KERN_ERR "SELinux: %s: unrecognized class %s\n",

2772

printk(KERN_ERR "SELinux: %s: unrecognized class %s\n",

2771

__func__, class);

2773

__func__, class);

2772

goto out;

2774

goto out;

2773

}

2775

}

2774

2776

2775

rc = -ENOMEM;

2777

rc = -ENOMEM;

2776

*nperms = match->permissions.nprim;

2778

*nperms = match->permissions.nprim;

2777

*perms = kcalloc(*nperms, sizeof(**perms), GFP_ATOMIC);

2779

*perms = kcalloc(*nperms, sizeof(**perms), GFP_ATOMIC);

2778

if (!*perms)

2780

if (!*perms)

2779

goto out;

2781

goto out;

2780

2782

2781

if (match->comdatum) {

2783

if (match->comdatum) {

2782

rc = hashtab_map(match->comdatum->permissions.table,

2784

rc = hashtab_map(match->comdatum->permissions.table,

2783

get_permissions_callback, *perms);

2785

get_permissions_callback, *perms);

2784

if (rc)

2786

if (rc)

2785

goto err;

2787

goto err;

2786

}

2788

}

2787

2789

2788

rc = hashtab_map(match->permissions.table, get_permissions_callback,

2790

rc = hashtab_map(match->permissions.table, get_permissions_callback,

2789

*perms);

2791

*perms);

2790

if (rc)

2792

if (rc)

2791

goto err;

2793

goto err;

2792

2794

2793

out:

2795

out:

2794

read_unlock(&policy_rwlock);

2796

read_unlock(&policy_rwlock);

2795

return rc;

2797

return rc;

2796

2798

2797

err:

2799

err:

2798

read_unlock(&policy_rwlock);

2800

read_unlock(&policy_rwlock);

2799

for (i = 0; i < *nperms; i++)

2801

for (i = 0; i < *nperms; i++)

2800

kfree((*perms)[i]);

2802

kfree((*perms)[i]);

2801

kfree(*perms);

2803

kfree(*perms);

2802

return rc;

2804

return rc;

2803

}

2805

}

2804

2806

2805

int security_get_reject_unknown(void)

2807

int security_get_reject_unknown(void)

2806

{

2808

{

2807

return policydb.reject_unknown;

2809

return policydb.reject_unknown;

2808

}

2810

}

2809

2811

2810

int security_get_allow_unknown(void)

2812

int security_get_allow_unknown(void)

2811

{

2813

{

2812

return policydb.allow_unknown;

2814

return policydb.allow_unknown;

2813

}

2815

}

2814

2816

2815

/**

2817

/**

2816

* security_policycap_supported - Check for a specific policy capability

2818

* security_policycap_supported - Check for a specific policy capability

2817

* @req_cap: capability

2819

* @req_cap: capability

2818

*

2820

*

2819

* Description:

2821

* Description:

2820

* This function queries the currently loaded policy to see if it supports the

2822

* This function queries the currently loaded policy to see if it supports the

2821

* capability specified by @req_cap. Returns true (1) if the capability is

2823

* capability specified by @req_cap. Returns true (1) if the capability is

2822

* supported, false (0) if it isn't supported.

2824

* supported, false (0) if it isn't supported.

2823

*

2825

*

2824

*/

2826

*/

2825

int security_policycap_supported(unsigned int req_cap)

2827

int security_policycap_supported(unsigned int req_cap)

2826

{

2828

{

2827

int rc;

2829

int rc;

2828

2830

2829

read_lock(&policy_rwlock);

2831

read_lock(&policy_rwlock);

2830

rc = ebitmap_get_bit(&policydb.policycaps, req_cap);

2832

rc = ebitmap_get_bit(&policydb.policycaps, req_cap);

2831

read_unlock(&policy_rwlock);

2833

read_unlock(&policy_rwlock);

2832

2834

2833

return rc;

2835

return rc;

2834

}

2836

}

2835

2837

2836

struct selinux_audit_rule {

2838

struct selinux_audit_rule {

2837

u32 au_seqno;

2839

u32 au_seqno;

2838

struct context au_ctxt;

2840

struct context au_ctxt;

2839

};

2841

};

2840

2842

2841

void selinux_audit_rule_free(void *vrule)

2843

void selinux_audit_rule_free(void *vrule)

2842

{

2844

{

2843

struct selinux_audit_rule *rule = vrule;

2845

struct selinux_audit_rule *rule = vrule;

2844

2846

2845

if (rule) {

2847

if (rule) {

2846

context_destroy(&rule->au_ctxt);

2848

context_destroy(&rule->au_ctxt);

2847

kfree(rule);

2849

kfree(rule);

2848

}

2850

}

2849

}

2851

}

2850

2852

2851

int selinux_audit_rule_init(u32 field, u32 op, char *rulestr, void **vrule)

2853

int selinux_audit_rule_init(u32 field, u32 op, char *rulestr, void **vrule)

2852

{

2854

{

2853

struct selinux_audit_rule *tmprule;

2855

struct selinux_audit_rule *tmprule;

2854

struct role_datum *roledatum;

2856

struct role_datum *roledatum;

2855

struct type_datum *typedatum;

2857

struct type_datum *typedatum;

2856

struct user_datum *userdatum;

2858

struct user_datum *userdatum;

2857

struct selinux_audit_rule **rule = (struct selinux_audit_rule **)vrule;

2859

struct selinux_audit_rule **rule = (struct selinux_audit_rule **)vrule;

2858

int rc = 0;

2860

int rc = 0;

2859

2861

2860

*rule = NULL;

2862

*rule = NULL;

2861

2863

2862

if (!ss_initialized)

2864

if (!ss_initialized)

2863

return -EOPNOTSUPP;

2865

return -EOPNOTSUPP;

2864

2866

2865

switch (field) {

2867

switch (field) {

2866

case AUDIT_SUBJ_USER:

2868

case AUDIT_SUBJ_USER:

2867

case AUDIT_SUBJ_ROLE:

2869

case AUDIT_SUBJ_ROLE:

2868

case AUDIT_SUBJ_TYPE:

2870

case AUDIT_SUBJ_TYPE:

2869

case AUDIT_OBJ_USER:

2871

case AUDIT_OBJ_USER:

2870

case AUDIT_OBJ_ROLE:

2872

case AUDIT_OBJ_ROLE:

2871

case AUDIT_OBJ_TYPE:

2873

case AUDIT_OBJ_TYPE:

2872

/* only 'equals' and 'not equals' fit user, role, and type */

2874

/* only 'equals' and 'not equals' fit user, role, and type */

2873

if (op != Audit_equal && op != Audit_not_equal)

2875

if (op != Audit_equal && op != Audit_not_equal)

2874

return -EINVAL;

2876

return -EINVAL;

2875

break;

2877

break;

2876

case AUDIT_SUBJ_SEN:

2878

case AUDIT_SUBJ_SEN:

2877

case AUDIT_SUBJ_CLR:

2879

case AUDIT_SUBJ_CLR:

2878

case AUDIT_OBJ_LEV_LOW:

2880

case AUDIT_OBJ_LEV_LOW:

2879

case AUDIT_OBJ_LEV_HIGH:

2881

case AUDIT_OBJ_LEV_HIGH:

2880

/* we do not allow a range, indicated by the presence of '-' */

2882

/* we do not allow a range, indicated by the presence of '-' */

2881

if (strchr(rulestr, '-'))

2883

if (strchr(rulestr, '-'))

2882

return -EINVAL;

2884

return -EINVAL;

2883

break;

2885

break;

2884

default:

2886

default:

2885

/* only the above fields are valid */

2887

/* only the above fields are valid */

2886

return -EINVAL;

2888

return -EINVAL;

2887

}

2889

}

2888

2890

2889

tmprule = kzalloc(sizeof(struct selinux_audit_rule), GFP_KERNEL);

2891

tmprule = kzalloc(sizeof(struct selinux_audit_rule), GFP_KERNEL);

2890

if (!tmprule)

2892

if (!tmprule)

2891

return -ENOMEM;

2893

return -ENOMEM;

2892

2894

2893

context_init(&tmprule->au_ctxt);

2895

context_init(&tmprule->au_ctxt);

2894

2896

2895

read_lock(&policy_rwlock);

2897

read_lock(&policy_rwlock);

2896

2898

2897

tmprule->au_seqno = latest_granting;

2899

tmprule->au_seqno = latest_granting;

2898

2900

2899

switch (field) {

2901

switch (field) {

2900

case AUDIT_SUBJ_USER:

2902

case AUDIT_SUBJ_USER:

2901

case AUDIT_OBJ_USER:

2903

case AUDIT_OBJ_USER:

2902

rc = -EINVAL;

2904

rc = -EINVAL;

2903

userdatum = hashtab_search(policydb.p_users.table, rulestr);

2905

userdatum = hashtab_search(policydb.p_users.table, rulestr);

2904

if (!userdatum)

2906

if (!userdatum)

2905

goto out;

2907

goto out;

2906

tmprule->au_ctxt.user = userdatum->value;

2908

tmprule->au_ctxt.user = userdatum->value;

2907

break;

2909

break;

2908

case AUDIT_SUBJ_ROLE:

2910

case AUDIT_SUBJ_ROLE:

2909

case AUDIT_OBJ_ROLE:

2911

case AUDIT_OBJ_ROLE:

2910

rc = -EINVAL;

2912

rc = -EINVAL;

2911

roledatum = hashtab_search(policydb.p_roles.table, rulestr);

2913

roledatum = hashtab_search(policydb.p_roles.table, rulestr);

2912

if (!roledatum)

2914

if (!roledatum)

2913

goto out;

2915

goto out;

2914

tmprule->au_ctxt.role = roledatum->value;

2916

tmprule->au_ctxt.role = roledatum->value;

2915

break;

2917

break;

2916

case AUDIT_SUBJ_TYPE:

2918

case AUDIT_SUBJ_TYPE:

2917

case AUDIT_OBJ_TYPE:

2919

case AUDIT_OBJ_TYPE:

2918

rc = -EINVAL;

2920

rc = -EINVAL;

2919

typedatum = hashtab_search(policydb.p_types.table, rulestr);

2921

typedatum = hashtab_search(policydb.p_types.table, rulestr);

2920

if (!typedatum)

2922

if (!typedatum)

2921

goto out;

2923

goto out;

2922

tmprule->au_ctxt.type = typedatum->value;

2924

tmprule->au_ctxt.type = typedatum->value;

2923

break;

2925

break;

2924

case AUDIT_SUBJ_SEN:

2926

case AUDIT_SUBJ_SEN:

2925

case AUDIT_SUBJ_CLR:

2927

case AUDIT_SUBJ_CLR:

2926

case AUDIT_OBJ_LEV_LOW:

2928

case AUDIT_OBJ_LEV_LOW:

2927

case AUDIT_OBJ_LEV_HIGH:

2929

case AUDIT_OBJ_LEV_HIGH:

2928

rc = mls_from_string(rulestr, &tmprule->au_ctxt, GFP_ATOMIC);

2930

rc = mls_from_string(rulestr, &tmprule->au_ctxt, GFP_ATOMIC);

2929

if (rc)

2931

if (rc)

2930

goto out;

2932

goto out;

2931

break;

2933

break;

2932

}

2934

}

2933

rc = 0;

2935

rc = 0;

2934

out:

2936

out:

2935

read_unlock(&policy_rwlock);

2937

read_unlock(&policy_rwlock);

2936

2938

2937

if (rc) {

2939

if (rc) {

2938

selinux_audit_rule_free(tmprule);

2940

selinux_audit_rule_free(tmprule);

2939

tmprule = NULL;

2941

tmprule = NULL;

2940

}

2942

}

2941

2943

2942

*rule = tmprule;

2944

*rule = tmprule;

2943

2945

2944

return rc;

2946

return rc;

2945

}

2947

}

2946

2948

2947

/* Check to see if the rule contains any selinux fields */

2949

/* Check to see if the rule contains any selinux fields */

2948

int selinux_audit_rule_known(struct audit_krule *rule)

2950

int selinux_audit_rule_known(struct audit_krule *rule)

2949

{

2951

{

2950

int i;

2952

int i;

2951

2953

2952

for (i = 0; i < rule->field_count; i++) {

2954

for (i = 0; i < rule->field_count; i++) {

2953

struct audit_field *f = &rule->fields[i];

2955

struct audit_field *f = &rule->fields[i];

2954

switch (f->type) {

2956

switch (f->type) {

2955

case AUDIT_SUBJ_USER:

2957

case AUDIT_SUBJ_USER:

2956

case AUDIT_SUBJ_ROLE:

2958

case AUDIT_SUBJ_ROLE:

2957

case AUDIT_SUBJ_TYPE:

2959

case AUDIT_SUBJ_TYPE:

2958

case AUDIT_SUBJ_SEN:

2960

case AUDIT_SUBJ_SEN:

2959

case AUDIT_SUBJ_CLR:

2961

case AUDIT_SUBJ_CLR:

2960

case AUDIT_OBJ_USER:

2962

case AUDIT_OBJ_USER:

2961

case AUDIT_OBJ_ROLE:

2963

case AUDIT_OBJ_ROLE:

2962

case AUDIT_OBJ_TYPE:

2964

case AUDIT_OBJ_TYPE:

2963

case AUDIT_OBJ_LEV_LOW:

2965

case AUDIT_OBJ_LEV_LOW:

2964

case AUDIT_OBJ_LEV_HIGH:

2966

case AUDIT_OBJ_LEV_HIGH:

2965

return 1;

2967

return 1;

2966

}

2968

}

2967

}

2969

}

2968

2970

2969

return 0;

2971

return 0;

2970

}

2972

}

2971

2973

2972

int selinux_audit_rule_match(u32 sid, u32 field, u32 op, void *vrule,

2974

int selinux_audit_rule_match(u32 sid, u32 field, u32 op, void *vrule,

2973

struct audit_context *actx)

2975

struct audit_context *actx)

2974

{

2976

{

2975

struct context *ctxt;

2977

struct context *ctxt;

2976

struct mls_level *level;

2978

struct mls_level *level;

2977

struct selinux_audit_rule *rule = vrule;

2979

struct selinux_audit_rule *rule = vrule;

2978

int match = 0;

2980

int match = 0;

2979

2981

2980

if (unlikely(!rule)) {

2982

if (unlikely(!rule)) {

2981

WARN_ONCE(1, "selinux_audit_rule_match: missing rule\n");

2983

WARN_ONCE(1, "selinux_audit_rule_match: missing rule\n");

2982

return -ENOENT;

2984

return -ENOENT;

2983

}

2985

}

2984

2986

2985

read_lock(&policy_rwlock);

2987

read_lock(&policy_rwlock);

2986

2988

2987

if (rule->au_seqno < latest_granting) {

2989

if (rule->au_seqno < latest_granting) {

2988

match = -ESTALE;

2990

match = -ESTALE;

2989

goto out;

2991

goto out;

2990

}

2992

}

2991

2993

2992

ctxt = sidtab_search(&sidtab, sid);

2994

ctxt = sidtab_search(&sidtab, sid);

2993

if (unlikely(!ctxt)) {

2995

if (unlikely(!ctxt)) {

2994

WARN_ONCE(1, "selinux_audit_rule_match: unrecognized SID %d\n",

2996

WARN_ONCE(1, "selinux_audit_rule_match: unrecognized SID %d\n",

2995

sid);

2997

sid);

2996

match = -ENOENT;

2998

match = -ENOENT;

2997

goto out;

2999

goto out;

2998

}

3000

}

2999

3001

3000

/* a field/op pair that is not caught here will simply fall through

3002

/* a field/op pair that is not caught here will simply fall through

3001

without a match */

3003

without a match */

3002

switch (field) {

3004

switch (field) {

3003

case AUDIT_SUBJ_USER:

3005

case AUDIT_SUBJ_USER:

3004

case AUDIT_OBJ_USER:

3006

case AUDIT_OBJ_USER:

3005

switch (op) {

3007

switch (op) {

3006

case Audit_equal:

3008

case Audit_equal:

3007

match = (ctxt->user == rule->au_ctxt.user);

3009

match = (ctxt->user == rule->au_ctxt.user);

3008

break;

3010

break;

3009

case Audit_not_equal:

3011

case Audit_not_equal:

3010

match = (ctxt->user != rule->au_ctxt.user);

3012

match = (ctxt->user != rule->au_ctxt.user);

3011

break;

3013

break;

3012

}

3014

}

3013

break;

3015

break;

3014

case AUDIT_SUBJ_ROLE:

3016

case AUDIT_SUBJ_ROLE:

3015

case AUDIT_OBJ_ROLE:

3017

case AUDIT_OBJ_ROLE:

3016

switch (op) {

3018

switch (op) {

3017

case Audit_equal:

3019

case Audit_equal:

3018

match = (ctxt->role == rule->au_ctxt.role);

3020

match = (ctxt->role == rule->au_ctxt.role);

3019

break;

3021

break;

3020

case Audit_not_equal:

3022

case Audit_not_equal:

3021

match = (ctxt->role != rule->au_ctxt.role);

3023

match = (ctxt->role != rule->au_ctxt.role);

3022

break;

3024

break;

3023

}

3025

}

3024

break;

3026

break;

3025

case AUDIT_SUBJ_TYPE:

3027

case AUDIT_SUBJ_TYPE:

3026

case AUDIT_OBJ_TYPE:

3028

case AUDIT_OBJ_TYPE:

3027

switch (op) {

3029

switch (op) {

3028

case Audit_equal:

3030

case Audit_equal:

3029

match = (ctxt->type == rule->au_ctxt.type);

3031

match = (ctxt->type == rule->au_ctxt.type);

3030

break;

3032

break;

3031

case Audit_not_equal:

3033

case Audit_not_equal:

3032

match = (ctxt->type != rule->au_ctxt.type);

3034

match = (ctxt->type != rule->au_ctxt.type);

3033

break;

3035

break;

3034

}

3036

}

3035

break;

3037

break;

3036

case AUDIT_SUBJ_SEN:

3038

case AUDIT_SUBJ_SEN:

3037

case AUDIT_SUBJ_CLR:

3039

case AUDIT_SUBJ_CLR:

3038

case AUDIT_OBJ_LEV_LOW:

3040

case AUDIT_OBJ_LEV_LOW:

3039

case AUDIT_OBJ_LEV_HIGH:

3041

case AUDIT_OBJ_LEV_HIGH:

3040

level = ((field == AUDIT_SUBJ_SEN ||

3042

level = ((field == AUDIT_SUBJ_SEN ||

3041

field == AUDIT_OBJ_LEV_LOW) ?

3043

field == AUDIT_OBJ_LEV_LOW) ?

3042

&ctxt->range.level[0] : &ctxt->range.level[1]);

3044

&ctxt->range.level[0] : &ctxt->range.level[1]);

3043

switch (op) {

3045

switch (op) {

3044

case Audit_equal:

3046

case Audit_equal:

3045

match = mls_level_eq(&rule->au_ctxt.range.level[0],

3047

match = mls_level_eq(&rule->au_ctxt.range.level[0],

3046

level);

3048

level);

3047

break;

3049

break;

3048

case Audit_not_equal:

3050

case Audit_not_equal:

3049

match = !mls_level_eq(&rule->au_ctxt.range.level[0],

3051

match = !mls_level_eq(&rule->au_ctxt.range.level[0],

3050

level);

3052

level);

3051

break;

3053

break;

3052

case Audit_lt:

3054

case Audit_lt:

3053

match = (mls_level_dom(&rule->au_ctxt.range.level[0],

3055

match = (mls_level_dom(&rule->au_ctxt.range.level[0],

3054

level) &&

3056

level) &&

3055

!mls_level_eq(&rule->au_ctxt.range.level[0],

3057

!mls_level_eq(&rule->au_ctxt.range.level[0],

3056

level));

3058

level));

3057

break;

3059

break;

3058

case Audit_le:

3060

case Audit_le:

3059

match = mls_level_dom(&rule->au_ctxt.range.level[0],

3061

match = mls_level_dom(&rule->au_ctxt.range.level[0],

3060

level);

3062

level);

3061

break;

3063

break;

3062

case Audit_gt:

3064

case Audit_gt:

3063

match = (mls_level_dom(level,

3065

match = (mls_level_dom(level,

3064

&rule->au_ctxt.range.level[0]) &&

3066

&rule->au_ctxt.range.level[0]) &&

3065

!mls_level_eq(level,

3067

!mls_level_eq(level,

3066

&rule->au_ctxt.range.level[0]));

3068

&rule->au_ctxt.range.level[0]));

3067

break;

3069

break;

3068

case Audit_ge:

3070

case Audit_ge:

3069

match = mls_level_dom(level,

3071

match = mls_level_dom(level,

3070

&rule->au_ctxt.range.level[0]);

3072

&rule->au_ctxt.range.level[0]);

3071

break;

3073

break;

3072

}

3074

}

3073

}

3075

}

3074

3076

3075

out:

3077

out:

3076

read_unlock(&policy_rwlock);

3078

read_unlock(&policy_rwlock);

3077

return match;

3079

return match;

3078

}

3080

}

3079

3081

3080

static int (*aurule_callback)(void) = audit_update_lsm_rules;

3082

static int (*aurule_callback)(void) = audit_update_lsm_rules;

3081

3083

3082

static int aurule_avc_callback(u32 event)

3084

static int aurule_avc_callback(u32 event)

3083

{

3085

{

3084

int err = 0;

3086

int err = 0;

3085

3087

3086

if (event == AVC_CALLBACK_RESET && aurule_callback)

3088

if (event == AVC_CALLBACK_RESET && aurule_callback)

3087

err = aurule_callback();

3089

err = aurule_callback();

3088

return err;

3090

return err;

3089

}

3091

}

3090

3092

3091

static int __init aurule_init(void)

3093

static int __init aurule_init(void)

3092

{

3094

{

3093

int err;

3095

int err;

3094

3096

3095

err = avc_add_callback(aurule_avc_callback, AVC_CALLBACK_RESET);

3097

err = avc_add_callback(aurule_avc_callback, AVC_CALLBACK_RESET);

3096

if (err)

3098

if (err)

3097

panic("avc_add_callback() failed, error %d\n", err);

3099

panic("avc_add_callback() failed, error %d\n", err);

3098

3100

3099

return err;

3101

return err;

3100

}

3102

}

3101

__initcall(aurule_init);

3103

__initcall(aurule_init);

3102

3104

3103

#ifdef CONFIG_NETLABEL

3105

#ifdef CONFIG_NETLABEL

3104

/**

3106

/**

3105

* security_netlbl_cache_add - Add an entry to the NetLabel cache

3107

* security_netlbl_cache_add - Add an entry to the NetLabel cache

3106

* @secattr: the NetLabel packet security attributes

3108

* @secattr: the NetLabel packet security attributes

3107

* @sid: the SELinux SID

3109

* @sid: the SELinux SID

3108

*

3110

*

3109

* Description:

3111

* Description:

3110

* Attempt to cache the context in @ctx, which was derived from the packet in

3112

* Attempt to cache the context in @ctx, which was derived from the packet in

3111

* @skb, in the NetLabel subsystem cache. This function assumes @secattr has

3113

* @skb, in the NetLabel subsystem cache. This function assumes @secattr has

3112

* already been initialized.

3114

* already been initialized.

3113

*

3115

*

3114

*/

3116

*/

3115

static void security_netlbl_cache_add(struct netlbl_lsm_secattr *secattr,

3117

static void security_netlbl_cache_add(struct netlbl_lsm_secattr *secattr,

3116

u32 sid)

3118

u32 sid)

3117

{

3119

{

3118

u32 *sid_cache;

3120

u32 *sid_cache;

3119

3121

3120

sid_cache = kmalloc(sizeof(*sid_cache), GFP_ATOMIC);

3122

sid_cache = kmalloc(sizeof(*sid_cache), GFP_ATOMIC);

3121

if (sid_cache == NULL)

3123

if (sid_cache == NULL)

3122

return;

3124

return;

3123

secattr->cache = netlbl_secattr_cache_alloc(GFP_ATOMIC);

3125

secattr->cache = netlbl_secattr_cache_alloc(GFP_ATOMIC);

3124

if (secattr->cache == NULL) {

3126

if (secattr->cache == NULL) {

3125

kfree(sid_cache);

3127

kfree(sid_cache);

3126

return;

3128

return;

3127

}

3129

}

3128

3130

3129

*sid_cache = sid;

3131

*sid_cache = sid;

3130

secattr->cache->free = kfree;

3132

secattr->cache->free = kfree;

3131

secattr->cache->data = sid_cache;

3133

secattr->cache->data = sid_cache;

3132

secattr->flags |= NETLBL_SECATTR_CACHE;

3134

secattr->flags |= NETLBL_SECATTR_CACHE;

3133

}

3135

}

3134

3136

3135

/**

3137

/**

3136

* security_netlbl_secattr_to_sid - Convert a NetLabel secattr to a SELinux SID

3138

* security_netlbl_secattr_to_sid - Convert a NetLabel secattr to a SELinux SID

3137

* @secattr: the NetLabel packet security attributes

3139

* @secattr: the NetLabel packet security attributes

3138

* @sid: the SELinux SID

3140

* @sid: the SELinux SID

3139

*

3141

*

3140

* Description:

3142

* Description:

3141

* Convert the given NetLabel security attributes in @secattr into a

3143

* Convert the given NetLabel security attributes in @secattr into a

3142

* SELinux SID. If the @secattr field does not contain a full SELinux

3144

* SELinux SID. If the @secattr field does not contain a full SELinux

3143

* SID/context then use SECINITSID_NETMSG as the foundation. If possible the

3145

* SID/context then use SECINITSID_NETMSG as the foundation. If possible the

3144

* 'cache' field of @secattr is set and the CACHE flag is set; this is to

3146

* 'cache' field of @secattr is set and the CACHE flag is set; this is to

3145

* allow the @secattr to be used by NetLabel to cache the secattr to SID

3147

* allow the @secattr to be used by NetLabel to cache the secattr to SID

3146

* conversion for future lookups. Returns zero on success, negative values on

3148

* conversion for future lookups. Returns zero on success, negative values on

3147

* failure.

3149

* failure.

3148

*

3150

*

3149

*/

3151

*/

3150

int security_netlbl_secattr_to_sid(struct netlbl_lsm_secattr *secattr,

3152

int security_netlbl_secattr_to_sid(struct netlbl_lsm_secattr *secattr,

3151

u32 *sid)

3153

u32 *sid)

3152

{

3154

{

3153

int rc;

3155

int rc;

3154

struct context *ctx;

3156

struct context *ctx;

3155

struct context ctx_new;

3157

struct context ctx_new;

3156

3158

3157

if (!ss_initialized) {

3159

if (!ss_initialized) {

3158

*sid = SECSID_NULL;

3160

*sid = SECSID_NULL;

3159

return 0;

3161

return 0;

3160

}

3162

}

3161

3163

3162

read_lock(&policy_rwlock);

3164

read_lock(&policy_rwlock);

3163

3165

3164

if (secattr->flags & NETLBL_SECATTR_CACHE)

3166

if (secattr->flags & NETLBL_SECATTR_CACHE)

3165

*sid = *(u32 *)secattr->cache->data;

3167

*sid = *(u32 *)secattr->cache->data;

3166

else if (secattr->flags & NETLBL_SECATTR_SECID)

3168

else if (secattr->flags & NETLBL_SECATTR_SECID)

3167

*sid = secattr->attr.secid;

3169

*sid = secattr->attr.secid;

3168

else if (secattr->flags & NETLBL_SECATTR_MLS_LVL) {

3170

else if (secattr->flags & NETLBL_SECATTR_MLS_LVL) {

3169

rc = -EIDRM;

3171

rc = -EIDRM;

3170

ctx = sidtab_search(&sidtab, SECINITSID_NETMSG);

3172

ctx = sidtab_search(&sidtab, SECINITSID_NETMSG);

3171

if (ctx == NULL)

3173

if (ctx == NULL)

3172

goto out;

3174

goto out;

3173

3175

3174

context_init(&ctx_new);

3176

context_init(&ctx_new);

3175

ctx_new.user = ctx->user;

3177

ctx_new.user = ctx->user;

3176

ctx_new.role = ctx->role;

3178

ctx_new.role = ctx->role;

3177

ctx_new.type = ctx->type;

3179

ctx_new.type = ctx->type;

3178

mls_import_netlbl_lvl(&ctx_new, secattr);

3180

mls_import_netlbl_lvl(&ctx_new, secattr);

3179

if (secattr->flags & NETLBL_SECATTR_MLS_CAT) {

3181

if (secattr->flags & NETLBL_SECATTR_MLS_CAT) {

3180

rc = ebitmap_netlbl_import(&ctx_new.range.level[0].cat,

3182

rc = ebitmap_netlbl_import(&ctx_new.range.level[0].cat,

3181

secattr->attr.mls.cat);

3183

secattr->attr.mls.cat);

3182

if (rc)

3184

if (rc)

3183

goto out;

3185

goto out;

3184

memcpy(&ctx_new.range.level[1].cat,

3186

memcpy(&ctx_new.range.level[1].cat,

3185

&ctx_new.range.level[0].cat,

3187

&ctx_new.range.level[0].cat,

3186

sizeof(ctx_new.range.level[0].cat));

3188

sizeof(ctx_new.range.level[0].cat));

3187

}

3189

}

3188

rc = -EIDRM;

3190

rc = -EIDRM;

3189

if (!mls_context_isvalid(&policydb, &ctx_new))

3191

if (!mls_context_isvalid(&policydb, &ctx_new))

3190

goto out_free;

3192

goto out_free;

3191

3193

3192

rc = sidtab_context_to_sid(&sidtab, &ctx_new, sid);

3194

rc = sidtab_context_to_sid(&sidtab, &ctx_new, sid);

3193

if (rc)

3195

if (rc)

3194

goto out_free;

3196

goto out_free;

3195

3197

3196

security_netlbl_cache_add(secattr, *sid);

3198

security_netlbl_cache_add(secattr, *sid);

3197

3199

3198

ebitmap_destroy(&ctx_new.range.level[0].cat);

3200

ebitmap_destroy(&ctx_new.range.level[0].cat);

3199

} else

3201

} else

3200

*sid = SECSID_NULL;

3202

*sid = SECSID_NULL;

3201

3203

3202

read_unlock(&policy_rwlock);

3204

read_unlock(&policy_rwlock);

3203

return 0;

3205

return 0;

3204

out_free:

3206

out_free:

3205

ebitmap_destroy(&ctx_new.range.level[0].cat);

3207

ebitmap_destroy(&ctx_new.range.level[0].cat);

3206

out:

3208

out:

3207

read_unlock(&policy_rwlock);

3209

read_unlock(&policy_rwlock);

3208

return rc;

3210

return rc;

3209

}

3211

}

3210

3212

3211

/**

3213

/**

3212

* security_netlbl_sid_to_secattr - Convert a SELinux SID to a NetLabel secattr

3214

* security_netlbl_sid_to_secattr - Convert a SELinux SID to a NetLabel secattr

3213

* @sid: the SELinux SID

3215

* @sid: the SELinux SID

3214

* @secattr: the NetLabel packet security attributes

3216

* @secattr: the NetLabel packet security attributes

3215

*

3217

*

3216

* Description:

3218

* Description:

3217

* Convert the given SELinux SID in @sid into a NetLabel security attribute.

3219

* Convert the given SELinux SID in @sid into a NetLabel security attribute.

3218

* Returns zero on success, negative values on failure.

3220

* Returns zero on success, negative values on failure.

3219

*

3221

*

3220

*/

3222

*/

3221

int security_netlbl_sid_to_secattr(u32 sid, struct netlbl_lsm_secattr *secattr)

3223

int security_netlbl_sid_to_secattr(u32 sid, struct netlbl_lsm_secattr *secattr)

3222

{

3224

{

3223

int rc;

3225

int rc;

3224

struct context *ctx;

3226

struct context *ctx;

3225

3227

3226

if (!ss_initialized)

3228

if (!ss_initialized)

3227

return 0;

3229

return 0;

3228

3230

3229

read_lock(&policy_rwlock);

3231

read_lock(&policy_rwlock);

3230

3232

3231

rc = -ENOENT;

3233

rc = -ENOENT;

3232

ctx = sidtab_search(&sidtab, sid);

3234

ctx = sidtab_search(&sidtab, sid);

3233

if (ctx == NULL)

3235

if (ctx == NULL)

3234

goto out;

3236

goto out;

3235

3237

3236

rc = -ENOMEM;

3238

rc = -ENOMEM;

3237

secattr->domain = kstrdup(sym_name(&policydb, SYM_TYPES, ctx->type - 1),

3239

secattr->domain = kstrdup(sym_name(&policydb, SYM_TYPES, ctx->type - 1),

3238

GFP_ATOMIC);

3240

GFP_ATOMIC);

3239

if (secattr->domain == NULL)

3241

if (secattr->domain == NULL)

3240

goto out;

3242

goto out;

3241

3243

3242

secattr->attr.secid = sid;

3244

secattr->attr.secid = sid;

3243

secattr->flags |= NETLBL_SECATTR_DOMAIN_CPY | NETLBL_SECATTR_SECID;

3245

secattr->flags |= NETLBL_SECATTR_DOMAIN_CPY | NETLBL_SECATTR_SECID;

3244

mls_export_netlbl_lvl(ctx, secattr);

3246

mls_export_netlbl_lvl(ctx, secattr);

3245

rc = mls_export_netlbl_cat(ctx, secattr);

3247

rc = mls_export_netlbl_cat(ctx, secattr);

3246

out:

3248

out:

3247

read_unlock(&policy_rwlock);

3249

read_unlock(&policy_rwlock);

3248

return rc;

3250

return rc;

3249

}

3251

}

3250

#endif /* CONFIG_NETLABEL */

3252

#endif /* CONFIG_NETLABEL */

3251

3253

3252

/**

3254

/**

3253

* security_read_policy - read the policy.

3255

* security_read_policy - read the policy.

3254

* @data: binary policy data

3256

* @data: binary policy data

3255

* @len: length of data in bytes

3257

* @len: length of data in bytes

3256

*

3258

*

3257

*/

3259

*/

3258

int security_read_policy(void **data, size_t *len)

3260

int security_read_policy(void **data, size_t *len)

3259

{

3261

{

3260

int rc;

3262

int rc;

3261

struct policy_file fp;

3263

struct policy_file fp;

3262

3264

3263

if (!ss_initialized)

3265

if (!ss_initialized)

3264

return -EINVAL;

3266

return -EINVAL;

3265

3267

3266

*len = security_policydb_len();

3268

*len = security_policydb_len();

3267

3269

3268

*data = vmalloc_user(*len);

3270

*data = vmalloc_user(*len);

3269

if (!*data)

3271

if (!*data)

3270

return -ENOMEM;

3272

return -ENOMEM;

3271

3273

3272

fp.data = *data;

3274

fp.data = *data;

3273

fp.len = *len;

3275

fp.len = *len;

3274

3276

3275

read_lock(&policy_rwlock);

3277

read_lock(&policy_rwlock);

3276

rc = policydb_write(&policydb, &fp);

3278

rc = policydb_write(&policydb, &fp);

3277

read_unlock(&policy_rwlock);

3279

read_unlock(&policy_rwlock);

3278

3280

3279

if (rc)

3281

if (rc)

3280

return rc;

3282

return rc;

3281

3283

3282

*len = (unsigned long)fp.data - (unsigned long)*data;

3284

*len = (unsigned long)fp.data - (unsigned long)*data;

3283

return 0;

3285

return 0;

3284

3286

3285

}

3287

}

3286

3288

GITLAB

selinux: normalize audit log formatting

 /*
  * Implementation of the security services.
  *
  * Authors : Stephen Smalley, <sds@epoch.ncsc.mil>
  *	     James Morris <jmorris@redhat.com>
  *
  * Updated: Trusted Computer Solutions, Inc. <dgoeddel@trustedcs.com>
  *
  *	Support for enhanced MLS infrastructure.
  *	Support for context based audit filters.
  *
  * Updated: Frank Mayer <mayerf@tresys.com> and Karl MacMillan <kmacmillan@tresys.com>
  *
  *	Added conditional policy language extensions
  *
  * Updated: Hewlett-Packard <paul@paul-moore.com>
  *
  *      Added support for NetLabel
  *      Added support for the policy capability bitmap
  *
  * Updated: Chad Sellers <csellers@tresys.com>
  *
  *  Added validation of kernel classes and permissions
  *
  * Updated: KaiGai Kohei <kaigai@ak.jp.nec.com>
  *
  *  Added support for bounds domain and audit messaged on masked permissions
  *
  * Updated: Guido Trentalancia <guido@trentalancia.com>
  *
  *  Added support for runtime switching of the policy type
  *
  * Copyright (C) 2008, 2009 NEC Corporation
  * Copyright (C) 2006, 2007 Hewlett-Packard Development Company, L.P.
  * Copyright (C) 2004-2006 Trusted Computer Solutions, Inc.
  * Copyright (C) 2003 - 2004, 2006 Tresys Technology, LLC
  * Copyright (C) 2003 Red Hat, Inc., James Morris <jmorris@redhat.com>
  *	This program is free software; you can redistribute it and/or modify
  *	it under the terms of the GNU General Public License as published by
  *	the Free Software Foundation, version 2.
  */
 #include <linux/kernel.h>
 #include <linux/slab.h>
 #include <linux/string.h>
 #include <linux/spinlock.h>
 #include <linux/rcupdate.h>
 #include <linux/errno.h>
 #include <linux/in.h>
 #include <linux/sched.h>
 #include <linux/audit.h>
 #include <linux/mutex.h>
 #include <linux/selinux.h>
 #include <linux/flex_array.h>
 #include <linux/vmalloc.h>
 #include <net/netlabel.h>
 #include "flask.h"
 #include "avc.h"
 #include "avc_ss.h"
 #include "security.h"
 #include "context.h"
 #include "policydb.h"
 #include "sidtab.h"
 #include "services.h"
 #include "conditional.h"
 #include "mls.h"
 #include "objsec.h"
 #include "netlabel.h"
 #include "xfrm.h"
 #include "ebitmap.h"
 #include "audit.h"
 int selinux_policycap_netpeer;
 int selinux_policycap_openperm;
 int selinux_policycap_alwaysnetwork;
 static DEFINE_RWLOCK(policy_rwlock);
 static struct sidtab sidtab;
 struct policydb policydb;
 int ss_initialized;
 /*
  * The largest sequence number that has been used when
  * providing an access decision to the access vector cache.
  * The sequence number only changes when a policy change
  * occurs.
  */
 static u32 latest_granting;
 /* Forward declaration. */
 static int context_struct_to_string(struct context *context, char **scontext,
 				    u32 *scontext_len);
 static void context_struct_compute_av(struct context *scontext,
 				      struct context *tcontext,
 				      u16 tclass,
 				      struct av_decision *avd);
 struct selinux_mapping {
 	u16 value; /* policy value */
 	unsigned num_perms;
 	u32 perms[sizeof(u32) * 8];
 };
 static struct selinux_mapping *current_mapping;
 static u16 current_mapping_size;
 static int selinux_set_mapping(struct policydb *pol,
 			       struct security_class_mapping *map,
 			       struct selinux_mapping **out_map_p,
 			       u16 *out_map_size)
 {
 	struct selinux_mapping *out_map = NULL;
 	size_t size = sizeof(struct selinux_mapping);
 	u16 i, j;
 	unsigned k;
 	bool print_unknown_handle = false;
 	/* Find number of classes in the input mapping */
 	if (!map)
 		return -EINVAL;
 	i = 0;
 	while (map[i].name)
 		i++;
 	/* Allocate space for the class records, plus one for class zero */
 	out_map = kcalloc(++i, size, GFP_ATOMIC);
 	if (!out_map)
 		return -ENOMEM;
 	/* Store the raw class and permission values */
 	j = 0;
 	while (map[j].name) {
 		struct security_class_mapping *p_in = map + (j++);
 		struct selinux_mapping *p_out = out_map + j;
 		/* An empty class string skips ahead */
 		if (!strcmp(p_in->name, "")) {
 			p_out->num_perms = 0;
 			continue;
 		}
 		p_out->value = string_to_security_class(pol, p_in->name);
 		if (!p_out->value) {
 			printk(KERN_INFO
 			       "SELinux:  Class %s not defined in policy.\n",
 			       p_in->name);
 			if (pol->reject_unknown)
 				goto err;
 			p_out->num_perms = 0;
 			print_unknown_handle = true;
 			continue;
 		}
 		k = 0;
 		while (p_in->perms && p_in->perms[k]) {
 			/* An empty permission string skips ahead */
 			if (!*p_in->perms[k]) {
 				k++;
 				continue;
 			}
 			p_out->perms[k] = string_to_av_perm(pol, p_out->value,
 							    p_in->perms[k]);
 			if (!p_out->perms[k]) {
 				printk(KERN_INFO
 				       "SELinux:  Permission %s in class %s not defined in policy.\n",
 				       p_in->perms[k], p_in->name);
 				if (pol->reject_unknown)
 					goto err;
 				print_unknown_handle = true;
 			}
 			k++;
 		}
 		p_out->num_perms = k;
 	}
 	if (print_unknown_handle)
 		printk(KERN_INFO "SELinux: the above unknown classes and permissions will be %s\n",
 		       pol->allow_unknown ? "allowed" : "denied");
 	*out_map_p = out_map;
 	*out_map_size = i;
 	return 0;
 err:
 	kfree(out_map);
 	return -EINVAL;
 }
 /*
  * Get real, policy values from mapped values
  */
 static u16 unmap_class(u16 tclass)
 {
 	if (tclass < current_mapping_size)
 		return current_mapping[tclass].value;
 	return tclass;
 }
 /*
  * Get kernel value for class from its policy value
  */
 static u16 map_class(u16 pol_value)
 {
 	u16 i;
 	for (i = 1; i < current_mapping_size; i++) {
 		if (current_mapping[i].value == pol_value)
 			return i;
 	}
 	return SECCLASS_NULL;
 }
 static void map_decision(u16 tclass, struct av_decision *avd,
 			 int allow_unknown)
 {
 	if (tclass < current_mapping_size) {
 		unsigned i, n = current_mapping[tclass].num_perms;
 		u32 result;
 		for (i = 0, result = 0; i < n; i++) {
 			if (avd->allowed & current_mapping[tclass].perms[i])
 				result |= 1<<i;
 			if (allow_unknown && !current_mapping[tclass].perms[i])
 				result |= 1<<i;
 		}
 		avd->allowed = result;
 		for (i = 0, result = 0; i < n; i++)
 			if (avd->auditallow & current_mapping[tclass].perms[i])
 				result |= 1<<i;
 		avd->auditallow = result;
 		for (i = 0, result = 0; i < n; i++) {
 			if (avd->auditdeny & current_mapping[tclass].perms[i])
 				result |= 1<<i;
 			if (!allow_unknown && !current_mapping[tclass].perms[i])
 				result |= 1<<i;
 		}
 		/*
 		 * In case the kernel has a bug and requests a permission
 		 * between num_perms and the maximum permission number, we
 		 * should audit that denial
 		 */
 		for (; i < (sizeof(u32)*8); i++)
 			result |= 1<<i;
 		avd->auditdeny = result;
 	}
 }
 int security_mls_enabled(void)
 {
 	return policydb.mls_enabled;
 }
 /*
  * Return the boolean value of a constraint expression
  * when it is applied to the specified source and target
  * security contexts.
  *
  * xcontext is a special beast...  It is used by the validatetrans rules
  * only.  For these rules, scontext is the context before the transition,
  * tcontext is the context after the transition, and xcontext is the context
  * of the process performing the transition.  All other callers of
  * constraint_expr_eval should pass in NULL for xcontext.
  */
 static int constraint_expr_eval(struct context *scontext,
 				struct context *tcontext,
 				struct context *xcontext,
 				struct constraint_expr *cexpr)
 {
 	u32 val1, val2;
 	struct context *c;
 	struct role_datum *r1, *r2;
 	struct mls_level *l1, *l2;
 	struct constraint_expr *e;
 	int s[CEXPR_MAXDEPTH];
 	int sp = -1;
 	for (e = cexpr; e; e = e->next) {
 		switch (e->expr_type) {
 		case CEXPR_NOT:
 			BUG_ON(sp < 0);
 			s[sp] = !s[sp];
 			break;
 		case CEXPR_AND:
 			BUG_ON(sp < 1);
 			sp--;
 			s[sp] &= s[sp + 1];
 			break;
 		case CEXPR_OR:
 			BUG_ON(sp < 1);
 			sp--;
 			s[sp] |= s[sp + 1];
 			break;
 		case CEXPR_ATTR:
 			if (sp == (CEXPR_MAXDEPTH - 1))
 				return 0;
 			switch (e->attr) {
 			case CEXPR_USER:
 				val1 = scontext->user;
 				val2 = tcontext->user;
 				break;
 			case CEXPR_TYPE:
 				val1 = scontext->type;
 				val2 = tcontext->type;
 				break;
 			case CEXPR_ROLE:
 				val1 = scontext->role;
 				val2 = tcontext->role;
 				r1 = policydb.role_val_to_struct[val1 - 1];
 				r2 = policydb.role_val_to_struct[val2 - 1];
 				switch (e->op) {
 				case CEXPR_DOM:
 					s[++sp] = ebitmap_get_bit(&r1->dominates,
 								  val2 - 1);
 					continue;
 				case CEXPR_DOMBY:
 					s[++sp] = ebitmap_get_bit(&r2->dominates,
 								  val1 - 1);
 					continue;
 				case CEXPR_INCOMP:
 					s[++sp] = (!ebitmap_get_bit(&r1->dominates,
 								    val2 - 1) &&
 						   !ebitmap_get_bit(&r2->dominates,
 								    val1 - 1));
 					continue;
 				default:
 					break;
 				}
 				break;
 			case CEXPR_L1L2:
 				l1 = &(scontext->range.level[0]);
 				l2 = &(tcontext->range.level[0]);
 				goto mls_ops;
 			case CEXPR_L1H2:
 				l1 = &(scontext->range.level[0]);
 				l2 = &(tcontext->range.level[1]);
 				goto mls_ops;
 			case CEXPR_H1L2:
 				l1 = &(scontext->range.level[1]);
 				l2 = &(tcontext->range.level[0]);
 				goto mls_ops;
 			case CEXPR_H1H2:
 				l1 = &(scontext->range.level[1]);
 				l2 = &(tcontext->range.level[1]);
 				goto mls_ops;
 			case CEXPR_L1H1:
 				l1 = &(scontext->range.level[0]);
 				l2 = &(scontext->range.level[1]);
 				goto mls_ops;
 			case CEXPR_L2H2:
 				l1 = &(tcontext->range.level[0]);
 				l2 = &(tcontext->range.level[1]);
 				goto mls_ops;
 mls_ops:
 			switch (e->op) {
 			case CEXPR_EQ:
 				s[++sp] = mls_level_eq(l1, l2);
 				continue;
 			case CEXPR_NEQ:
 				s[++sp] = !mls_level_eq(l1, l2);
 				continue;
 			case CEXPR_DOM:
 				s[++sp] = mls_level_dom(l1, l2);
 				continue;
 			case CEXPR_DOMBY:
 				s[++sp] = mls_level_dom(l2, l1);
 				continue;
 			case CEXPR_INCOMP:
 				s[++sp] = mls_level_incomp(l2, l1);
 				continue;
 			default:
 				BUG();
 				return 0;
 			}
 			break;
 			default:
 				BUG();
 				return 0;
 			}
 			switch (e->op) {
 			case CEXPR_EQ:
 				s[++sp] = (val1 == val2);
 				break;
 			case CEXPR_NEQ:
 				s[++sp] = (val1 != val2);
 				break;
 			default:
 				BUG();
 				return 0;
 			}
 			break;
 		case CEXPR_NAMES:
 			if (sp == (CEXPR_MAXDEPTH-1))
 				return 0;
 			c = scontext;
 			if (e->attr & CEXPR_TARGET)
 				c = tcontext;
 			else if (e->attr & CEXPR_XTARGET) {
 				c = xcontext;
 				if (!c) {
 					BUG();
 					return 0;
 				}
 			}
 			if (e->attr & CEXPR_USER)
 				val1 = c->user;
 			else if (e->attr & CEXPR_ROLE)
 				val1 = c->role;
 			else if (e->attr & CEXPR_TYPE)
 				val1 = c->type;
 			else {
 				BUG();
 				return 0;
 			}
 			switch (e->op) {
 			case CEXPR_EQ:
 				s[++sp] = ebitmap_get_bit(&e->names, val1 - 1);
 				break;
 			case CEXPR_NEQ:
 				s[++sp] = !ebitmap_get_bit(&e->names, val1 - 1);
 				break;
 			default:
 				BUG();
 				return 0;
 			}
 			break;
 		default:
 			BUG();
 			return 0;
 		}
 	}
 	BUG_ON(sp != 0);
 	return s[0];
 }
 /*
  * security_dump_masked_av - dumps masked permissions during
  * security_compute_av due to RBAC, MLS/Constraint and Type bounds.
  */
 static int dump_masked_av_helper(void *k, void *d, void *args)
 {
 	struct perm_datum *pdatum = d;
 	char **permission_names = args;
 	BUG_ON(pdatum->value < 1 || pdatum->value > 32);
 	permission_names[pdatum->value - 1] = (char *)k;
 	return 0;
 }
 static void security_dump_masked_av(struct context *scontext,
 				    struct context *tcontext,
 				    u16 tclass,
 				    u32 permissions,
 				    const char *reason)
 {
 	struct common_datum *common_dat;
 	struct class_datum *tclass_dat;
 	struct audit_buffer *ab;
 	char *tclass_name;
 	char *scontext_name = NULL;
 	char *tcontext_name = NULL;
 	char *permission_names[32];
 	int index;
 	u32 length;
 	bool need_comma = false;
 	if (!permissions)
 		return;
 	tclass_name = sym_name(&policydb, SYM_CLASSES, tclass - 1);
 	tclass_dat = policydb.class_val_to_struct[tclass - 1];
 	common_dat = tclass_dat->comdatum;
 	/* init permission_names */
 	if (common_dat &&
 	    hashtab_map(common_dat->permissions.table,
 			dump_masked_av_helper, permission_names) < 0)
 		goto out;
 	if (hashtab_map(tclass_dat->permissions.table,
 			dump_masked_av_helper, permission_names) < 0)
 		goto out;
 	/* get scontext/tcontext in text form */
 	if (context_struct_to_string(scontext,
 				     &scontext_name, &length) < 0)
 		goto out;
 	if (context_struct_to_string(tcontext,
 				     &tcontext_name, &length) < 0)
 		goto out;
 	/* audit a message */
 	ab = audit_log_start(current->audit_context,
 			     GFP_ATOMIC, AUDIT_SELINUX_ERR);
 	if (!ab)
 		goto out;
 	audit_log_format(ab, "op=security_compute_av reason=%s "
 			 "scontext=%s tcontext=%s tclass=%s perms=",
 			 reason, scontext_name, tcontext_name, tclass_name);
 	for (index = 0; index < 32; index++) {
 		u32 mask = (1 << index);
 		if ((mask & permissions) == 0)
 			continue;
 		audit_log_format(ab, "%s%s",
 				 need_comma ? "," : "",
 				 permission_names[index]
 				 ? permission_names[index] : "????");
 		need_comma = true;
 	}
 	audit_log_end(ab);
 out:
 	/* release scontext/tcontext */
 	kfree(tcontext_name);
 	kfree(scontext_name);
 	return;
 }
 /*
  * security_boundary_permission - drops violated permissions
  * on boundary constraint.
  */
 static void type_attribute_bounds_av(struct context *scontext,
 				     struct context *tcontext,
 				     u16 tclass,
 				     struct av_decision *avd)
 {
 	struct context lo_scontext;
 	struct context lo_tcontext;
 	struct av_decision lo_avd;
 	struct type_datum *source;
 	struct type_datum *target;
 	u32 masked = 0;
 	source = flex_array_get_ptr(policydb.type_val_to_struct_array,
 				    scontext->type - 1);
 	BUG_ON(!source);
 	target = flex_array_get_ptr(policydb.type_val_to_struct_array,
 				    tcontext->type - 1);
 	BUG_ON(!target);
 	if (source->bounds) {
 		memset(&lo_avd, 0, sizeof(lo_avd));
 		memcpy(&lo_scontext, scontext, sizeof(lo_scontext));
 		lo_scontext.type = source->bounds;
 		context_struct_compute_av(&lo_scontext,
 					  tcontext,
 					  tclass,
 					  &lo_avd);
 		if ((lo_avd.allowed & avd->allowed) == avd->allowed)
 			return;		/* no masked permission */
 		masked = ~lo_avd.allowed & avd->allowed;
 	}
 	if (target->bounds) {
 		memset(&lo_avd, 0, sizeof(lo_avd));
 		memcpy(&lo_tcontext, tcontext, sizeof(lo_tcontext));
 		lo_tcontext.type = target->bounds;
 		context_struct_compute_av(scontext,
 					  &lo_tcontext,
 					  tclass,
 					  &lo_avd);
 		if ((lo_avd.allowed & avd->allowed) == avd->allowed)
 			return;		/* no masked permission */
 		masked = ~lo_avd.allowed & avd->allowed;
 	}
 	if (source->bounds && target->bounds) {
 		memset(&lo_avd, 0, sizeof(lo_avd));
 		/*
 		 * lo_scontext and lo_tcontext are already
 		 * set up.
 		 */
 		context_struct_compute_av(&lo_scontext,
 					  &lo_tcontext,
 					  tclass,
 					  &lo_avd);
 		if ((lo_avd.allowed & avd->allowed) == avd->allowed)
 			return;		/* no masked permission */
 		masked = ~lo_avd.allowed & avd->allowed;
 	}
 	if (masked) {
 		/* mask violated permissions */
 		avd->allowed &= ~masked;
 		/* audit masked permissions */
 		security_dump_masked_av(scontext, tcontext,
 					tclass, masked, "bounds");
 	}
 }
 /*
  * Compute access vectors based on a context structure pair for
  * the permissions in a particular class.
  */
 static void context_struct_compute_av(struct context *scontext,
 				      struct context *tcontext,
 				      u16 tclass,
 				      struct av_decision *avd)
 {
 	struct constraint_node *constraint;
 	struct role_allow *ra;
 	struct avtab_key avkey;
 	struct avtab_node *node;
 	struct class_datum *tclass_datum;
 	struct ebitmap *sattr, *tattr;
 	struct ebitmap_node *snode, *tnode;
 	unsigned int i, j;
 	avd->allowed = 0;
 	avd->auditallow = 0;
 	avd->auditdeny = 0xffffffff;
 	if (unlikely(!tclass || tclass > policydb.p_classes.nprim)) {
 		if (printk_ratelimit())
 			printk(KERN_WARNING "SELinux:  Invalid class %hu\n", tclass);
 		return;
 	}
 	tclass_datum = policydb.class_val_to_struct[tclass - 1];
 	/*
 	 * If a specific type enforcement rule was defined for
 	 * this permission check, then use it.
 	 */
 	avkey.target_class = tclass;
 	avkey.specified = AVTAB_AV;
 	sattr = flex_array_get(policydb.type_attr_map_array, scontext->type - 1);
 	BUG_ON(!sattr);
 	tattr = flex_array_get(policydb.type_attr_map_array, tcontext->type - 1);
 	BUG_ON(!tattr);
 	ebitmap_for_each_positive_bit(sattr, snode, i) {
 		ebitmap_for_each_positive_bit(tattr, tnode, j) {
 			avkey.source_type = i + 1;
 			avkey.target_type = j + 1;
 			for (node = avtab_search_node(&policydb.te_avtab, &avkey);
 			     node;
 			     node = avtab_search_node_next(node, avkey.specified)) {
 				if (node->key.specified == AVTAB_ALLOWED)
 					avd->allowed |= node->datum.data;
 				else if (node->key.specified == AVTAB_AUDITALLOW)
 					avd->auditallow |= node->datum.data;
 				else if (node->key.specified == AVTAB_AUDITDENY)
 					avd->auditdeny &= node->datum.data;
 			}
 			/* Check conditional av table for additional permissions */
 			cond_compute_av(&policydb.te_cond_avtab, &avkey, avd);
 		}
 	}
 	/*
 	 * Remove any permissions prohibited by a constraint (this includes
 	 * the MLS policy).
 	 */
 	constraint = tclass_datum->constraints;
 	while (constraint) {
 		if ((constraint->permissions & (avd->allowed)) &&
 		    !constraint_expr_eval(scontext, tcontext, NULL,
 					  constraint->expr)) {
 			avd->allowed &= ~(constraint->permissions);
 		}
 		constraint = constraint->next;
 	}
 	/*
 	 * If checking process transition permission and the
 	 * role is changing, then check the (current_role, new_role)
 	 * pair.
 	 */
 	if (tclass == policydb.process_class &&
 	    (avd->allowed & policydb.process_trans_perms) &&
 	    scontext->role != tcontext->role) {
 		for (ra = policydb.role_allow; ra; ra = ra->next) {
 			if (scontext->role == ra->role &&
 			    tcontext->role == ra->new_role)
 				break;
 		}
 		if (!ra)
 			avd->allowed &= ~policydb.process_trans_perms;
 	}
 	/*
 	 * If the given source and target types have boundary
 	 * constraint, lazy checks have to mask any violated
 	 * permission and notice it to userspace via audit.
 	 */
 	type_attribute_bounds_av(scontext, tcontext,
 				 tclass, avd);
 }
 static int security_validtrans_handle_fail(struct context *ocontext,
 					   struct context *ncontext,
 					   struct context *tcontext,
 					   u16 tclass)
 {
 	char *o = NULL, *n = NULL, *t = NULL;
 	u32 olen, nlen, tlen;
 	if (context_struct_to_string(ocontext, &o, &olen))
 		goto out;
 	if (context_struct_to_string(ncontext, &n, &nlen))
 		goto out;
 	if (context_struct_to_string(tcontext, &t, &tlen))
 		goto out;
 	audit_log(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR,
-		  "security_validate_transition:  denied for"
+		  "op=security_validate_transition seresult=denied"
 		  " oldcontext=%s newcontext=%s taskcontext=%s tclass=%s",
 		  o, n, t, sym_name(&policydb, SYM_CLASSES, tclass-1));
 out:
 	kfree(o);
 	kfree(n);
 	kfree(t);
 	if (!selinux_enforcing)
 		return 0;
 	return -EPERM;
 }
 int security_validate_transition(u32 oldsid, u32 newsid, u32 tasksid,
 				 u16 orig_tclass)
 {
 	struct context *ocontext;
 	struct context *ncontext;
 	struct context *tcontext;
 	struct class_datum *tclass_datum;
 	struct constraint_node *constraint;
 	u16 tclass;
 	int rc = 0;
 	if (!ss_initialized)
 		return 0;
 	read_lock(&policy_rwlock);
 	tclass = unmap_class(orig_tclass);
 	if (!tclass || tclass > policydb.p_classes.nprim) {
 		printk(KERN_ERR "SELinux: %s:  unrecognized class %d\n",
 			__func__, tclass);
 		rc = -EINVAL;
 		goto out;
 	}
 	tclass_datum = policydb.class_val_to_struct[tclass - 1];
 	ocontext = sidtab_search(&sidtab, oldsid);
 	if (!ocontext) {
 		printk(KERN_ERR "SELinux: %s:  unrecognized SID %d\n",
 			__func__, oldsid);
 		rc = -EINVAL;
 		goto out;
 	}
 	ncontext = sidtab_search(&sidtab, newsid);
 	if (!ncontext) {
 		printk(KERN_ERR "SELinux: %s:  unrecognized SID %d\n",
 			__func__, newsid);
 		rc = -EINVAL;
 		goto out;
 	}
 	tcontext = sidtab_search(&sidtab, tasksid);
 	if (!tcontext) {
 		printk(KERN_ERR "SELinux: %s:  unrecognized SID %d\n",
 			__func__, tasksid);
 		rc = -EINVAL;
 		goto out;
 	}
 	constraint = tclass_datum->validatetrans;
 	while (constraint) {
 		if (!constraint_expr_eval(ocontext, ncontext, tcontext,
 					  constraint->expr)) {
 			rc = security_validtrans_handle_fail(ocontext, ncontext,
 							     tcontext, tclass);
 			goto out;
 		}
 		constraint = constraint->next;
 	}
 out:
 	read_unlock(&policy_rwlock);
 	return rc;
 }
 /*
  * security_bounded_transition - check whether the given
  * transition is directed to bounded, or not.
  * It returns 0, if @newsid is bounded by @oldsid.
  * Otherwise, it returns error code.
  *
  * @oldsid : current security identifier
  * @newsid : destinated security identifier
  */
 int security_bounded_transition(u32 old_sid, u32 new_sid)
 {
 	struct context *old_context, *new_context;
 	struct type_datum *type;
 	int index;
 	int rc;
 	read_lock(&policy_rwlock);
 	rc = -EINVAL;
 	old_context = sidtab_search(&sidtab, old_sid);
 	if (!old_context) {
 		printk(KERN_ERR "SELinux: %s: unrecognized SID %u\n",
 		       __func__, old_sid);
 		goto out;
 	}
 	rc = -EINVAL;
 	new_context = sidtab_search(&sidtab, new_sid);
 	if (!new_context) {
 		printk(KERN_ERR "SELinux: %s: unrecognized SID %u\n",
 		       __func__, new_sid);
 		goto out;
 	}
 	rc = 0;
 	/* type/domain unchanged */
 	if (old_context->type == new_context->type)
 		goto out;
 	index = new_context->type;
 	while (true) {
 		type = flex_array_get_ptr(policydb.type_val_to_struct_array,
 					  index - 1);
 		BUG_ON(!type);
 		/* not bounded anymore */
 		rc = -EPERM;
 		if (!type->bounds)
 			break;
 		/* @newsid is bounded by @oldsid */
 		rc = 0;
 		if (type->bounds == old_context->type)
 			break;
 		index = type->bounds;
 	}
 	if (rc) {
 		char *old_name = NULL;
 		char *new_name = NULL;
 		u32 length;
 		if (!context_struct_to_string(old_context,
 					      &old_name, &length) &&
 		    !context_struct_to_string(new_context,
 					      &new_name, &length)) {
 			audit_log(current->audit_context,
 				  GFP_ATOMIC, AUDIT_SELINUX_ERR,
 				  "op=security_bounded_transition "
-				  "result=denied "
+				  "seresult=denied "
 				  "oldcontext=%s newcontext=%s",
 				  old_name, new_name);
 		}
 		kfree(new_name);
 		kfree(old_name);
 	}
 out:
 	read_unlock(&policy_rwlock);
 	return rc;
 }
 static void avd_init(struct av_decision *avd)
 {
 	avd->allowed = 0;
 	avd->auditallow = 0;
 	avd->auditdeny = 0xffffffff;
 	avd->seqno = latest_granting;
 	avd->flags = 0;
 }
 /**
  * security_compute_av - Compute access vector decisions.
  * @ssid: source security identifier
  * @tsid: target security identifier
  * @tclass: target security class
  * @avd: access vector decisions
  *
  * Compute a set of access vector decisions based on the
  * SID pair (@ssid, @tsid) for the permissions in @tclass.
  */
 void security_compute_av(u32 ssid,
 			 u32 tsid,
 			 u16 orig_tclass,
 			 struct av_decision *avd)
 {
 	u16 tclass;
 	struct context *scontext = NULL, *tcontext = NULL;
 	read_lock(&policy_rwlock);
 	avd_init(avd);
 	if (!ss_initialized)
 		goto allow;
 	scontext = sidtab_search(&sidtab, ssid);
 	if (!scontext) {
 		printk(KERN_ERR "SELinux: %s:  unrecognized SID %d\n",
 		       __func__, ssid);
 		goto out;
 	}
 	/* permissive domain? */
 	if (ebitmap_get_bit(&policydb.permissive_map, scontext->type))
 		avd->flags |= AVD_FLAGS_PERMISSIVE;
 	tcontext = sidtab_search(&sidtab, tsid);
 	if (!tcontext) {
 		printk(KERN_ERR "SELinux: %s:  unrecognized SID %d\n",
 		       __func__, tsid);
 		goto out;
 	}
 	tclass = unmap_class(orig_tclass);
 	if (unlikely(orig_tclass && !tclass)) {
 		if (policydb.allow_unknown)
 			goto allow;
 		goto out;
 	}
 	context_struct_compute_av(scontext, tcontext, tclass, avd);
 	map_decision(orig_tclass, avd, policydb.allow_unknown);
 out:
 	read_unlock(&policy_rwlock);
 	return;
 allow:
 	avd->allowed = 0xffffffff;
 	goto out;
 }
 void security_compute_av_user(u32 ssid,
 			      u32 tsid,
 			      u16 tclass,
 			      struct av_decision *avd)
 {
 	struct context *scontext = NULL, *tcontext = NULL;
 	read_lock(&policy_rwlock);
 	avd_init(avd);
 	if (!ss_initialized)
 		goto allow;
 	scontext = sidtab_search(&sidtab, ssid);
 	if (!scontext) {
 		printk(KERN_ERR "SELinux: %s:  unrecognized SID %d\n",
 		       __func__, ssid);
 		goto out;
 	}
 	/* permissive domain? */
 	if (ebitmap_get_bit(&policydb.permissive_map, scontext->type))
 		avd->flags |= AVD_FLAGS_PERMISSIVE;
 	tcontext = sidtab_search(&sidtab, tsid);
 	if (!tcontext) {
 		printk(KERN_ERR "SELinux: %s:  unrecognized SID %d\n",
 		       __func__, tsid);
 		goto out;
 	}
 	if (unlikely(!tclass)) {
 		if (policydb.allow_unknown)
 			goto allow;
 		goto out;
 	}
 	context_struct_compute_av(scontext, tcontext, tclass, avd);
  out:
 	read_unlock(&policy_rwlock);
 	return;
 allow:
 	avd->allowed = 0xffffffff;
 	goto out;
 }
 /*
  * Write the security context string representation of
  * the context structure `context' into a dynamically
  * allocated string of the correct size.  Set `*scontext'
  * to point to this string and set `*scontext_len' to
  * the length of the string.
  */
 static int context_struct_to_string(struct context *context, char **scontext, u32 *scontext_len)
 {
 	char *scontextp;
 	if (scontext)
 		*scontext = NULL;
 	*scontext_len = 0;
 	if (context->len) {
 		*scontext_len = context->len;
 		if (scontext) {
 			*scontext = kstrdup(context->str, GFP_ATOMIC);
 			if (!(*scontext))
 				return -ENOMEM;
 		}
 		return 0;
 	}
 	/* Compute the size of the context. */
 	*scontext_len += strlen(sym_name(&policydb, SYM_USERS, context->user - 1)) + 1;
 	*scontext_len += strlen(sym_name(&policydb, SYM_ROLES, context->role - 1)) + 1;
 	*scontext_len += strlen(sym_name(&policydb, SYM_TYPES, context->type - 1)) + 1;
 	*scontext_len += mls_compute_context_len(context);
 	if (!scontext)
 		return 0;
 	/* Allocate space for the context; caller must free this space. */
 	scontextp = kmalloc(*scontext_len, GFP_ATOMIC);
 	if (!scontextp)
 		return -ENOMEM;
 	*scontext = scontextp;
 	/*
 	 * Copy the user name, role name and type name into the context.
 	 */
 	sprintf(scontextp, "%s:%s:%s",
 		sym_name(&policydb, SYM_USERS, context->user - 1),
 		sym_name(&policydb, SYM_ROLES, context->role - 1),
 		sym_name(&policydb, SYM_TYPES, context->type - 1));
 	scontextp += strlen(sym_name(&policydb, SYM_USERS, context->user - 1)) +
 		     1 + strlen(sym_name(&policydb, SYM_ROLES, context->role - 1)) +
 		     1 + strlen(sym_name(&policydb, SYM_TYPES, context->type - 1));
 	mls_sid_to_context(context, &scontextp);
 	*scontextp = 0;
 	return 0;
 }
 #include "initial_sid_to_string.h"
 const char *security_get_initial_sid_context(u32 sid)
 {
 	if (unlikely(sid > SECINITSID_NUM))
 		return NULL;
 	return initial_sid_to_string[sid];
 }
 static int security_sid_to_context_core(u32 sid, char **scontext,
 					u32 *scontext_len, int force)
 {
 	struct context *context;
 	int rc = 0;
 	if (scontext)
 		*scontext = NULL;
 	*scontext_len  = 0;
 	if (!ss_initialized) {
 		if (sid <= SECINITSID_NUM) {
 			char *scontextp;
 			*scontext_len = strlen(initial_sid_to_string[sid]) + 1;
 			if (!scontext)
 				goto out;
 			scontextp = kmalloc(*scontext_len, GFP_ATOMIC);
 			if (!scontextp) {
 				rc = -ENOMEM;
 				goto out;
 			}
 			strcpy(scontextp, initial_sid_to_string[sid]);
 			*scontext = scontextp;
 			goto out;
 		}
 		printk(KERN_ERR "SELinux: %s:  called before initial "
 		       "load_policy on unknown SID %d\n", __func__, sid);
 		rc = -EINVAL;
 		goto out;
 	}
 	read_lock(&policy_rwlock);
 	if (force)
 		context = sidtab_search_force(&sidtab, sid);
 	else
 		context = sidtab_search(&sidtab, sid);
 	if (!context) {
 		printk(KERN_ERR "SELinux: %s:  unrecognized SID %d\n",
 			__func__, sid);
 		rc = -EINVAL;
 		goto out_unlock;
 	}
 	rc = context_struct_to_string(context, scontext, scontext_len);
 out_unlock:
 	read_unlock(&policy_rwlock);
 out:
 	return rc;
 }
 /**
  * security_sid_to_context - Obtain a context for a given SID.
  * @sid: security identifier, SID
  * @scontext: security context
  * @scontext_len: length in bytes
  *
  * Write the string representation of the context associated with @sid
  * into a dynamically allocated string of the correct size.  Set @scontext
  * to point to this string and set @scontext_len to the length of the string.
  */
 int security_sid_to_context(u32 sid, char **scontext, u32 *scontext_len)
 {
 	return security_sid_to_context_core(sid, scontext, scontext_len, 0);
 }
 int security_sid_to_context_force(u32 sid, char **scontext, u32 *scontext_len)
 {
 	return security_sid_to_context_core(sid, scontext, scontext_len, 1);
 }
 /*
  * Caveat:  Mutates scontext.
  */
 static int string_to_context_struct(struct policydb *pol,
 				    struct sidtab *sidtabp,
 				    char *scontext,
 				    u32 scontext_len,
 				    struct context *ctx,
 				    u32 def_sid)
 {
 	struct role_datum *role;
 	struct type_datum *typdatum;
 	struct user_datum *usrdatum;
 	char *scontextp, *p, oldc;
 	int rc = 0;
 	context_init(ctx);
 	/* Parse the security context. */
 	rc = -EINVAL;
 	scontextp = (char *) scontext;
 	/* Extract the user. */
 	p = scontextp;
 	while (*p && *p != ':')
 		p++;
 	if (*p == 0)
 		goto out;
 	*p++ = 0;
 	usrdatum = hashtab_search(pol->p_users.table, scontextp);
 	if (!usrdatum)
 		goto out;
 	ctx->user = usrdatum->value;
 	/* Extract role. */
 	scontextp = p;
 	while (*p && *p != ':')
 		p++;
 	if (*p == 0)
 		goto out;
 	*p++ = 0;
 	role = hashtab_search(pol->p_roles.table, scontextp);
 	if (!role)
 		goto out;
 	ctx->role = role->value;
 	/* Extract type. */
 	scontextp = p;
 	while (*p && *p != ':')
 		p++;
 	oldc = *p;
 	*p++ = 0;
 	typdatum = hashtab_search(pol->p_types.table, scontextp);
 	if (!typdatum || typdatum->attribute)
 		goto out;
 	ctx->type = typdatum->value;
 	rc = mls_context_to_sid(pol, oldc, &p, ctx, sidtabp, def_sid);
 	if (rc)
 		goto out;
 	rc = -EINVAL;
 	if ((p - scontext) < scontext_len)
 		goto out;
 	/* Check the validity of the new context. */
 	if (!policydb_context_isvalid(pol, ctx))
 		goto out;
 	rc = 0;
 out:
 	if (rc)
 		context_destroy(ctx);
 	return rc;
 }
 static int security_context_to_sid_core(const char *scontext, u32 scontext_len,
 					u32 *sid, u32 def_sid, gfp_t gfp_flags,
 					int force)
 {
 	char *scontext2, *str = NULL;
 	struct context context;
 	int rc = 0;
 	/* An empty security context is never valid. */
 	if (!scontext_len)
 		return -EINVAL;
 	if (!ss_initialized) {
 		int i;
 		for (i = 1; i < SECINITSID_NUM; i++) {
 			if (!strcmp(initial_sid_to_string[i], scontext)) {
 				*sid = i;
 				return 0;
 			}
 		}
 		*sid = SECINITSID_KERNEL;
 		return 0;
 	}
 	*sid = SECSID_NULL;
 	/* Copy the string so that we can modify the copy as we parse it. */
 	scontext2 = kmalloc(scontext_len + 1, gfp_flags);
 	if (!scontext2)
 		return -ENOMEM;
 	memcpy(scontext2, scontext, scontext_len);
 	scontext2[scontext_len] = 0;
 	if (force) {
 		/* Save another copy for storing in uninterpreted form */
 		rc = -ENOMEM;
 		str = kstrdup(scontext2, gfp_flags);
 		if (!str)
 			goto out;
 	}
 	read_lock(&policy_rwlock);
 	rc = string_to_context_struct(&policydb, &sidtab, scontext2,
 				      scontext_len, &context, def_sid);
 	if (rc == -EINVAL && force) {
 		context.str = str;
 		context.len = scontext_len;
 		str = NULL;
 	} else if (rc)
 		goto out_unlock;
 	rc = sidtab_context_to_sid(&sidtab, &context, sid);
 	context_destroy(&context);
 out_unlock:
 	read_unlock(&policy_rwlock);
 out:
 	kfree(scontext2);
 	kfree(str);
 	return rc;
 }
 /**
  * security_context_to_sid - Obtain a SID for a given security context.
  * @scontext: security context
  * @scontext_len: length in bytes
  * @sid: security identifier, SID
  * @gfp: context for the allocation
  *
  * Obtains a SID associated with the security context that
  * has the string representation specified by @scontext.
  * Returns -%EINVAL if the context is invalid, -%ENOMEM if insufficient
  * memory is available, or 0 on success.
  */
 int security_context_to_sid(const char *scontext, u32 scontext_len, u32 *sid,
 			    gfp_t gfp)
 {
 	return security_context_to_sid_core(scontext, scontext_len,
 					    sid, SECSID_NULL, gfp, 0);
 }
 /**
  * security_context_to_sid_default - Obtain a SID for a given security context,
  * falling back to specified default if needed.
  *
  * @scontext: security context
  * @scontext_len: length in bytes
  * @sid: security identifier, SID
  * @def_sid: default SID to assign on error
  *
  * Obtains a SID associated with the security context that
  * has the string representation specified by @scontext.
  * The default SID is passed to the MLS layer to be used to allow
  * kernel labeling of the MLS field if the MLS field is not present
  * (for upgrading to MLS without full relabel).
  * Implicitly forces adding of the context even if it cannot be mapped yet.
  * Returns -%EINVAL if the context is invalid, -%ENOMEM if insufficient
  * memory is available, or 0 on success.
  */
 int security_context_to_sid_default(const char *scontext, u32 scontext_len,
 				    u32 *sid, u32 def_sid, gfp_t gfp_flags)
 {
 	return security_context_to_sid_core(scontext, scontext_len,
 					    sid, def_sid, gfp_flags, 1);
 }
 int security_context_to_sid_force(const char *scontext, u32 scontext_len,
 				  u32 *sid)
 {
 	return security_context_to_sid_core(scontext, scontext_len,
 					    sid, SECSID_NULL, GFP_KERNEL, 1);
 }
 static int compute_sid_handle_invalid_context(
 	struct context *scontext,
 	struct context *tcontext,
 	u16 tclass,
 	struct context *newcontext)
 {
 	char *s = NULL, *t = NULL, *n = NULL;
 	u32 slen, tlen, nlen;
 	if (context_struct_to_string(scontext, &s, &slen))
 		goto out;
 	if (context_struct_to_string(tcontext, &t, &tlen))
 		goto out;
 	if (context_struct_to_string(newcontext, &n, &nlen))
 		goto out;
 	audit_log(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR,
-		  "security_compute_sid:  invalid context %s"
+		  "op=security_compute_sid invalid_context=%s"
-		  " for scontext=%s"
+		  " scontext=%s"
 		  " tcontext=%s"
 		  " tclass=%s",
 		  n, s, t, sym_name(&policydb, SYM_CLASSES, tclass-1));
 out:
 	kfree(s);
 	kfree(t);
 	kfree(n);
 	if (!selinux_enforcing)
 		return 0;
 	return -EACCES;
 }
 static void filename_compute_type(struct policydb *p, struct context *newcontext,
 				  u32 stype, u32 ttype, u16 tclass,
 				  const char *objname)
 {
 	struct filename_trans ft;
 	struct filename_trans_datum *otype;
 	/*
 	 * Most filename trans rules are going to live in specific directories
 	 * like /dev or /var/run.  This bitmap will quickly skip rule searches
 	 * if the ttype does not contain any rules.
 	 */
 	if (!ebitmap_get_bit(&p->filename_trans_ttypes, ttype))
 		return;
 	ft.stype = stype;
 	ft.ttype = ttype;
 	ft.tclass = tclass;
 	ft.name = objname;
 	otype = hashtab_search(p->filename_trans, &ft);
 	if (otype)
 		newcontext->type = otype->otype;
 }
 static int security_compute_sid(u32 ssid,
 				u32 tsid,
 				u16 orig_tclass,
 				u32 specified,
 				const char *objname,
 				u32 *out_sid,
 				bool kern)
 {
 	struct class_datum *cladatum = NULL;
 	struct context *scontext = NULL, *tcontext = NULL, newcontext;
 	struct role_trans *roletr = NULL;
 	struct avtab_key avkey;
 	struct avtab_datum *avdatum;
 	struct avtab_node *node;
 	u16 tclass;
 	int rc = 0;
 	bool sock;
 	if (!ss_initialized) {
 		switch (orig_tclass) {
 		case SECCLASS_PROCESS: /* kernel value */
 			*out_sid = ssid;
 			break;
 		default:
 			*out_sid = tsid;
 			break;
 		}
 		goto out;
 	}
 	context_init(&newcontext);
 	read_lock(&policy_rwlock);
 	if (kern) {
 		tclass = unmap_class(orig_tclass);
 		sock = security_is_socket_class(orig_tclass);
 	} else {
 		tclass = orig_tclass;
 		sock = security_is_socket_class(map_class(tclass));
 	}
 	scontext = sidtab_search(&sidtab, ssid);
 	if (!scontext) {
 		printk(KERN_ERR "SELinux: %s:  unrecognized SID %d\n",
 		       __func__, ssid);
 		rc = -EINVAL;
 		goto out_unlock;
 	}
 	tcontext = sidtab_search(&sidtab, tsid);
 	if (!tcontext) {
 		printk(KERN_ERR "SELinux: %s:  unrecognized SID %d\n",
 		       __func__, tsid);
 		rc = -EINVAL;
 		goto out_unlock;
 	}
 	if (tclass && tclass <= policydb.p_classes.nprim)
 		cladatum = policydb.class_val_to_struct[tclass - 1];
 	/* Set the user identity. */
 	switch (specified) {
 	case AVTAB_TRANSITION:
 	case AVTAB_CHANGE:
 		if (cladatum && cladatum->default_user == DEFAULT_TARGET) {
 			newcontext.user = tcontext->user;
 		} else {
 			/* notice this gets both DEFAULT_SOURCE and unset */
 			/* Use the process user identity. */
 			newcontext.user = scontext->user;
 		}
 		break;
 	case AVTAB_MEMBER:
 		/* Use the related object owner. */
 		newcontext.user = tcontext->user;
 		break;
 	}
 	/* Set the role to default values. */
 	if (cladatum && cladatum->default_role == DEFAULT_SOURCE) {
 		newcontext.role = scontext->role;
 	} else if (cladatum && cladatum->default_role == DEFAULT_TARGET) {
 		newcontext.role = tcontext->role;
 	} else {
 		if ((tclass == policydb.process_class) || (sock == true))
 			newcontext.role = scontext->role;
 		else
 			newcontext.role = OBJECT_R_VAL;
 	}
 	/* Set the type to default values. */
 	if (cladatum && cladatum->default_type == DEFAULT_SOURCE) {
 		newcontext.type = scontext->type;
 	} else if (cladatum && cladatum->default_type == DEFAULT_TARGET) {
 		newcontext.type = tcontext->type;
 	} else {
 		if ((tclass == policydb.process_class) || (sock == true)) {
 			/* Use the type of process. */
 			newcontext.type = scontext->type;
 		} else {
 			/* Use the type of the related object. */
 			newcontext.type = tcontext->type;
 		}
 	}
 	/* Look for a type transition/member/change rule. */
 	avkey.source_type = scontext->type;
 	avkey.target_type = tcontext->type;
 	avkey.target_class = tclass;
 	avkey.specified = specified;
 	avdatum = avtab_search(&policydb.te_avtab, &avkey);
 	/* If no permanent rule, also check for enabled conditional rules */
 	if (!avdatum) {
 		node = avtab_search_node(&policydb.te_cond_avtab, &avkey);
 		for (; node; node = avtab_search_node_next(node, specified)) {
 			if (node->key.specified & AVTAB_ENABLED) {
 				avdatum = &node->datum;
 				break;
 			}
 		}
 	}
 	if (avdatum) {
 		/* Use the type from the type transition/member/change rule. */
 		newcontext.type = avdatum->data;
 	}
 	/* if we have a objname this is a file trans check so check those rules */
 	if (objname)
 		filename_compute_type(&policydb, &newcontext, scontext->type,
 				      tcontext->type, tclass, objname);
 	/* Check for class-specific changes. */
 	if (specified & AVTAB_TRANSITION) {
 		/* Look for a role transition rule. */
 		for (roletr = policydb.role_tr; roletr; roletr = roletr->next) {
 			if ((roletr->role == scontext->role) &&
 			    (roletr->type == tcontext->type) &&
 			    (roletr->tclass == tclass)) {
 				/* Use the role transition rule. */
 				newcontext.role = roletr->new_role;
 				break;
 			}
 		}
 	}
 	/* Set the MLS attributes.
 	   This is done last because it may allocate memory. */
 	rc = mls_compute_sid(scontext, tcontext, tclass, specified,
 			     &newcontext, sock);
 	if (rc)
 		goto out_unlock;
 	/* Check the validity of the context. */
 	if (!policydb_context_isvalid(&policydb, &newcontext)) {
 		rc = compute_sid_handle_invalid_context(scontext,
 							tcontext,
 							tclass,
 							&newcontext);
 		if (rc)
 			goto out_unlock;
 	}
 	/* Obtain the sid for the context. */
 	rc = sidtab_context_to_sid(&sidtab, &newcontext, out_sid);
 out_unlock:
 	read_unlock(&policy_rwlock);
 	context_destroy(&newcontext);
 out:
 	return rc;
 }
 /**
  * security_transition_sid - Compute the SID for a new subject/object.
  * @ssid: source security identifier
  * @tsid: target security identifier
  * @tclass: target security class
  * @out_sid: security identifier for new subject/object
  *
  * Compute a SID to use for labeling a new subject or object in the
  * class @tclass based on a SID pair (@ssid, @tsid).
  * Return -%EINVAL if any of the parameters are invalid, -%ENOMEM
  * if insufficient memory is available, or %0 if the new SID was
  * computed successfully.
  */
 int security_transition_sid(u32 ssid, u32 tsid, u16 tclass,
 			    const struct qstr *qstr, u32 *out_sid)
 {
 	return security_compute_sid(ssid, tsid, tclass, AVTAB_TRANSITION,
 				    qstr ? qstr->name : NULL, out_sid, true);
 }
 int security_transition_sid_user(u32 ssid, u32 tsid, u16 tclass,
 				 const char *objname, u32 *out_sid)
 {
 	return security_compute_sid(ssid, tsid, tclass, AVTAB_TRANSITION,
 				    objname, out_sid, false);
 }
 /**
  * security_member_sid - Compute the SID for member selection.
  * @ssid: source security identifier
  * @tsid: target security identifier
  * @tclass: target security class
  * @out_sid: security identifier for selected member
  *
  * Compute a SID to use when selecting a member of a polyinstantiated
  * object of class @tclass based on a SID pair (@ssid, @tsid).
  * Return -%EINVAL if any of the parameters are invalid, -%ENOMEM
  * if insufficient memory is available, or %0 if the SID was
  * computed successfully.
  */
 int security_member_sid(u32 ssid,
 			u32 tsid,
 			u16 tclass,
 			u32 *out_sid)
 {
 	return security_compute_sid(ssid, tsid, tclass, AVTAB_MEMBER, NULL,
 				    out_sid, false);
 }
 /**
  * security_change_sid - Compute the SID for object relabeling.
  * @ssid: source security identifier
  * @tsid: target security identifier
  * @tclass: target security class
  * @out_sid: security identifier for selected member
  *
  * Compute a SID to use for relabeling an object of class @tclass
  * based on a SID pair (@ssid, @tsid).
  * Return -%EINVAL if any of the parameters are invalid, -%ENOMEM
  * if insufficient memory is available, or %0 if the SID was
  * computed successfully.
  */
 int security_change_sid(u32 ssid,
 			u32 tsid,
 			u16 tclass,
 			u32 *out_sid)
 {
 	return security_compute_sid(ssid, tsid, tclass, AVTAB_CHANGE, NULL,
 				    out_sid, false);
 }
 /* Clone the SID into the new SID table. */
 static int clone_sid(u32 sid,
 		     struct context *context,
 		     void *arg)
 {
 	struct sidtab *s = arg;
 	if (sid > SECINITSID_NUM)
 		return sidtab_insert(s, sid, context);
 	else
 		return 0;
 }
 static inline int convert_context_handle_invalid_context(struct context *context)
 {
 	char *s;
 	u32 len;
 	if (selinux_enforcing)
 		return -EINVAL;
 	if (!context_struct_to_string(context, &s, &len)) {
 		printk(KERN_WARNING "SELinux:  Context %s would be invalid if enforcing\n", s);
 		kfree(s);
 	}
 	return 0;
 }
 struct convert_context_args {
 	struct policydb *oldp;
 	struct policydb *newp;
 };
 /*
  * Convert the values in the security context
  * structure `c' from the values specified
  * in the policy `p->oldp' to the values specified
  * in the policy `p->newp'.  Verify that the
  * context is valid under the new policy.
  */
 static int convert_context(u32 key,
 			   struct context *c,
 			   void *p)
 {
 	struct convert_context_args *args;
 	struct context oldc;
 	struct ocontext *oc;
 	struct mls_range *range;
 	struct role_datum *role;
 	struct type_datum *typdatum;
 	struct user_datum *usrdatum;
 	char *s;
 	u32 len;
 	int rc = 0;
 	if (key <= SECINITSID_NUM)
 		goto out;
 	args = p;
 	if (c->str) {
 		struct context ctx;
 		rc = -ENOMEM;
 		s = kstrdup(c->str, GFP_KERNEL);
 		if (!s)
 			goto out;
 		rc = string_to_context_struct(args->newp, NULL, s,
 					      c->len, &ctx, SECSID_NULL);
 		kfree(s);
 		if (!rc) {
 			printk(KERN_INFO "SELinux:  Context %s became valid (mapped).\n",
 			       c->str);
 			/* Replace string with mapped representation. */
 			kfree(c->str);
 			memcpy(c, &ctx, sizeof(*c));
 			goto out;
 		} else if (rc == -EINVAL) {
 			/* Retain string representation for later mapping. */
 			rc = 0;
 			goto out;
 		} else {
 			/* Other error condition, e.g. ENOMEM. */
 			printk(KERN_ERR "SELinux:   Unable to map context %s, rc = %d.\n",
 			       c->str, -rc);
 			goto out;
 		}
 	}
 	rc = context_cpy(&oldc, c);
 	if (rc)
 		goto out;
 	/* Convert the user. */
 	rc = -EINVAL;
 	usrdatum = hashtab_search(args->newp->p_users.table,
 				  sym_name(args->oldp, SYM_USERS, c->user - 1));
 	if (!usrdatum)
 		goto bad;
 	c->user = usrdatum->value;
 	/* Convert the role. */
 	rc = -EINVAL;
 	role = hashtab_search(args->newp->p_roles.table,
 			      sym_name(args->oldp, SYM_ROLES, c->role - 1));
 	if (!role)
 		goto bad;
 	c->role = role->value;
 	/* Convert the type. */
 	rc = -EINVAL;
 	typdatum = hashtab_search(args->newp->p_types.table,
 				  sym_name(args->oldp, SYM_TYPES, c->type - 1));
 	if (!typdatum)
 		goto bad;
 	c->type = typdatum->value;
 	/* Convert the MLS fields if dealing with MLS policies */
 	if (args->oldp->mls_enabled && args->newp->mls_enabled) {
 		rc = mls_convert_context(args->oldp, args->newp, c);
 		if (rc)
 			goto bad;
 	} else if (args->oldp->mls_enabled && !args->newp->mls_enabled) {
 		/*
 		 * Switching between MLS and non-MLS policy:
 		 * free any storage used by the MLS fields in the
 		 * context for all existing entries in the sidtab.
 		 */
 		mls_context_destroy(c);
 	} else if (!args->oldp->mls_enabled && args->newp->mls_enabled) {
 		/*
 		 * Switching between non-MLS and MLS policy:
 		 * ensure that the MLS fields of the context for all
 		 * existing entries in the sidtab are filled in with a
 		 * suitable default value, likely taken from one of the
 		 * initial SIDs.
 		 */
 		oc = args->newp->ocontexts[OCON_ISID];
 		while (oc && oc->sid[0] != SECINITSID_UNLABELED)
 			oc = oc->next;
 		rc = -EINVAL;
 		if (!oc) {
 			printk(KERN_ERR "SELinux:  unable to look up"
 				" the initial SIDs list\n");
 			goto bad;
 		}
 		range = &oc->context[0].range;
 		rc = mls_range_set(c, range);
 		if (rc)
 			goto bad;
 	}
 	/* Check the validity of the new context. */
 	if (!policydb_context_isvalid(args->newp, c)) {
 		rc = convert_context_handle_invalid_context(&oldc);
 		if (rc)
 			goto bad;
 	}
 	context_destroy(&oldc);
 	rc = 0;
 out:
 	return rc;
 bad:
 	/* Map old representation to string and save it. */
 	rc = context_struct_to_string(&oldc, &s, &len);
 	if (rc)
 		return rc;
 	context_destroy(&oldc);
 	context_destroy(c);
 	c->str = s;
 	c->len = len;
 	printk(KERN_INFO "SELinux:  Context %s became invalid (unmapped).\n",
 	       c->str);
 	rc = 0;
 	goto out;
 }
 static void security_load_policycaps(void)
 {
 	selinux_policycap_netpeer = ebitmap_get_bit(&policydb.policycaps,
 						  POLICYDB_CAPABILITY_NETPEER);
 	selinux_policycap_openperm = ebitmap_get_bit(&policydb.policycaps,
 						  POLICYDB_CAPABILITY_OPENPERM);
 	selinux_policycap_alwaysnetwork = ebitmap_get_bit(&policydb.policycaps,
 						  POLICYDB_CAPABILITY_ALWAYSNETWORK);
 }
 static int security_preserve_bools(struct policydb *p);
 /**
  * security_load_policy - Load a security policy configuration.
  * @data: binary policy data
  * @len: length of data in bytes
  *
  * Load a new set of security policy configuration data,
  * validate it and convert the SID table as necessary.
  * This function will flush the access vector cache after
  * loading the new policy.
  */
 int security_load_policy(void *data, size_t len)
 {
 	struct policydb *oldpolicydb, *newpolicydb;
 	struct sidtab oldsidtab, newsidtab;
 	struct selinux_mapping *oldmap, *map = NULL;
 	struct convert_context_args args;
 	u32 seqno;
 	u16 map_size;
 	int rc = 0;
 	struct policy_file file = { data, len }, *fp = &file;
 	oldpolicydb = kzalloc(2 * sizeof(*oldpolicydb), GFP_KERNEL);
 	if (!oldpolicydb) {
 		rc = -ENOMEM;
 		goto out;
 	}
 	newpolicydb = oldpolicydb + 1;
 	if (!ss_initialized) {
 		avtab_cache_init();
 		rc = policydb_read(&policydb, fp);
 		if (rc) {
 			avtab_cache_destroy();
 			goto out;
 		}
 		policydb.len = len;
 		rc = selinux_set_mapping(&policydb, secclass_map,
 					 &current_mapping,
 					 &current_mapping_size);
 		if (rc) {
 			policydb_destroy(&policydb);
 			avtab_cache_destroy();
 			goto out;
 		}
 		rc = policydb_load_isids(&policydb, &sidtab);
 		if (rc) {
 			policydb_destroy(&policydb);
 			avtab_cache_destroy();
 			goto out;
 		}
 		security_load_policycaps();
 		ss_initialized = 1;
 		seqno = ++latest_granting;
 		selinux_complete_init();
 		avc_ss_reset(seqno);
 		selnl_notify_policyload(seqno);
 		selinux_status_update_policyload(seqno);
 		selinux_netlbl_cache_invalidate();
 		selinux_xfrm_notify_policyload();
 		goto out;
 	}
 #if 0
 	sidtab_hash_eval(&sidtab, "sids");
 #endif
 	rc = policydb_read(newpolicydb, fp);
 	if (rc)
 		goto out;
 	newpolicydb->len = len;
 	/* If switching between different policy types, log MLS status */
 	if (policydb.mls_enabled && !newpolicydb->mls_enabled)
 		printk(KERN_INFO "SELinux: Disabling MLS support...\n");
 	else if (!policydb.mls_enabled && newpolicydb->mls_enabled)
 		printk(KERN_INFO "SELinux: Enabling MLS support...\n");
 	rc = policydb_load_isids(newpolicydb, &newsidtab);
 	if (rc) {
 		printk(KERN_ERR "SELinux:  unable to load the initial SIDs\n");
 		policydb_destroy(newpolicydb);
 		goto out;
 	}
 	rc = selinux_set_mapping(newpolicydb, secclass_map, &map, &map_size);
 	if (rc)
 		goto err;
 	rc = security_preserve_bools(newpolicydb);
 	if (rc) {
 		printk(KERN_ERR "SELinux:  unable to preserve booleans\n");
 		goto err;
 	}
 	/* Clone the SID table. */
 	sidtab_shutdown(&sidtab);
 	rc = sidtab_map(&sidtab, clone_sid, &newsidtab);
 	if (rc)
 		goto err;
 	/*
 	 * Convert the internal representations of contexts
 	 * in the new SID table.
 	 */
 	args.oldp = &policydb;
 	args.newp = newpolicydb;
 	rc = sidtab_map(&newsidtab, convert_context, &args);
 	if (rc) {
 		printk(KERN_ERR "SELinux:  unable to convert the internal"
 			" representation of contexts in the new SID"
 			" table\n");
 		goto err;
 	}
 	/* Save the old policydb and SID table to free later. */
 	memcpy(oldpolicydb, &policydb, sizeof(policydb));
 	sidtab_set(&oldsidtab, &sidtab);
 	/* Install the new policydb and SID table. */
 	write_lock_irq(&policy_rwlock);
 	memcpy(&policydb, newpolicydb, sizeof(policydb));
 	sidtab_set(&sidtab, &newsidtab);
 	security_load_policycaps();
 	oldmap = current_mapping;
 	current_mapping = map;
 	current_mapping_size = map_size;
 	seqno = ++latest_granting;
 	write_unlock_irq(&policy_rwlock);
 	/* Free the old policydb and SID table. */
 	policydb_destroy(oldpolicydb);
 	sidtab_destroy(&oldsidtab);
 	kfree(oldmap);
 	avc_ss_reset(seqno);
 	selnl_notify_policyload(seqno);
 	selinux_status_update_policyload(seqno);
 	selinux_netlbl_cache_invalidate();
 	selinux_xfrm_notify_policyload();
 	rc = 0;
 	goto out;
 err:
 	kfree(map);
 	sidtab_destroy(&newsidtab);
 	policydb_destroy(newpolicydb);
 out:
 	kfree(oldpolicydb);
 	return rc;
 }
 size_t security_policydb_len(void)
 {
 	size_t len;
 	read_lock(&policy_rwlock);
 	len = policydb.len;
 	read_unlock(&policy_rwlock);
 	return len;
 }
 /**
  * security_port_sid - Obtain the SID for a port.
  * @protocol: protocol number
  * @port: port number
  * @out_sid: security identifier
  */
 int security_port_sid(u8 protocol, u16 port, u32 *out_sid)
 {
 	struct ocontext *c;
 	int rc = 0;
 	read_lock(&policy_rwlock);
 	c = policydb.ocontexts[OCON_PORT];
 	while (c) {
 		if (c->u.port.protocol == protocol &&
 		    c->u.port.low_port <= port &&
 		    c->u.port.high_port >= port)
 			break;
 		c = c->next;
 	}
 	if (c) {
 		if (!c->sid[0]) {
 			rc = sidtab_context_to_sid(&sidtab,
 						   &c->context[0],
 						   &c->sid[0]);
 			if (rc)
 				goto out;
 		}
 		*out_sid = c->sid[0];
 	} else {
 		*out_sid = SECINITSID_PORT;
 	}
 out:
 	read_unlock(&policy_rwlock);
 	return rc;
 }
 /**
  * security_netif_sid - Obtain the SID for a network interface.
  * @name: interface name
  * @if_sid: interface SID
  */
 int security_netif_sid(char *name, u32 *if_sid)
 {
 	int rc = 0;
 	struct ocontext *c;
 	read_lock(&policy_rwlock);
 	c = policydb.ocontexts[OCON_NETIF];
 	while (c) {
 		if (strcmp(name, c->u.name) == 0)
 			break;
 		c = c->next;
 	}
 	if (c) {
 		if (!c->sid[0] || !c->sid[1]) {
 			rc = sidtab_context_to_sid(&sidtab,
 						  &c->context[0],
 						  &c->sid[0]);
 			if (rc)
 				goto out;
 			rc = sidtab_context_to_sid(&sidtab,
 						   &c->context[1],
 						   &c->sid[1]);
 			if (rc)
 				goto out;
 		}
 		*if_sid = c->sid[0];
 	} else
 		*if_sid = SECINITSID_NETIF;
 out:
 	read_unlock(&policy_rwlock);
 	return rc;
 }
 static int match_ipv6_addrmask(u32 *input, u32 *addr, u32 *mask)
 {
 	int i, fail = 0;
 	for (i = 0; i < 4; i++)
 		if (addr[i] != (input[i] & mask[i])) {
 			fail = 1;
 			break;
 		}
 	return !fail;
 }
 /**
  * security_node_sid - Obtain the SID for a node (host).
  * @domain: communication domain aka address family
  * @addrp: address
  * @addrlen: address length in bytes
  * @out_sid: security identifier
  */
 int security_node_sid(u16 domain,
 		      void *addrp,
 		      u32 addrlen,
 		      u32 *out_sid)
 {
 	int rc;
 	struct ocontext *c;
 	read_lock(&policy_rwlock);
 	switch (domain) {
 	case AF_INET: {
 		u32 addr;
 		rc = -EINVAL;
 		if (addrlen != sizeof(u32))
 			goto out;
 		addr = *((u32 *)addrp);
 		c = policydb.ocontexts[OCON_NODE];
 		while (c) {
 			if (c->u.node.addr == (addr & c->u.node.mask))
 				break;
 			c = c->next;
 		}
 		break;
 	}
 	case AF_INET6:
 		rc = -EINVAL;
 		if (addrlen != sizeof(u64) * 2)
 			goto out;
 		c = policydb.ocontexts[OCON_NODE6];
 		while (c) {
 			if (match_ipv6_addrmask(addrp, c->u.node6.addr,
 						c->u.node6.mask))
 				break;
 			c = c->next;
 		}
 		break;
 	default:
 		rc = 0;
 		*out_sid = SECINITSID_NODE;
 		goto out;
 	}
 	if (c) {
 		if (!c->sid[0]) {
 			rc = sidtab_context_to_sid(&sidtab,
 						   &c->context[0],
 						   &c->sid[0]);
 			if (rc)
 				goto out;
 		}
 		*out_sid = c->sid[0];
 	} else {
 		*out_sid = SECINITSID_NODE;
 	}
 	rc = 0;
 out:
 	read_unlock(&policy_rwlock);
 	return rc;
 }
 #define SIDS_NEL 25
 /**
  * security_get_user_sids - Obtain reachable SIDs for a user.
  * @fromsid: starting SID
  * @username: username
  * @sids: array of reachable SIDs for user
  * @nel: number of elements in @sids
  *
  * Generate the set of SIDs for legal security contexts
  * for a given user that can be reached by @fromsid.
  * Set *@sids to point to a dynamically allocated
  * array containing the set of SIDs.  Set *@nel to the
  * number of elements in the array.
  */
 int security_get_user_sids(u32 fromsid,
 			   char *username,
 			   u32 **sids,
 			   u32 *nel)
 {
 	struct context *fromcon, usercon;
 	u32 *mysids = NULL, *mysids2, sid;
 	u32 mynel = 0, maxnel = SIDS_NEL;
 	struct user_datum *user;
 	struct role_datum *role;
 	struct ebitmap_node *rnode, *tnode;
 	int rc = 0, i, j;
 	*sids = NULL;
 	*nel = 0;
 	if (!ss_initialized)
 		goto out;
 	read_lock(&policy_rwlock);
 	context_init(&usercon);
 	rc = -EINVAL;
 	fromcon = sidtab_search(&sidtab, fromsid);
 	if (!fromcon)
 		goto out_unlock;
 	rc = -EINVAL;
 	user = hashtab_search(policydb.p_users.table, username);
 	if (!user)
 		goto out_unlock;
 	usercon.user = user->value;
 	rc = -ENOMEM;
 	mysids = kcalloc(maxnel, sizeof(*mysids), GFP_ATOMIC);
 	if (!mysids)
 		goto out_unlock;
 	ebitmap_for_each_positive_bit(&user->roles, rnode, i) {
 		role = policydb.role_val_to_struct[i];
 		usercon.role = i + 1;
 		ebitmap_for_each_positive_bit(&role->types, tnode, j) {
 			usercon.type = j + 1;
 			if (mls_setup_user_range(fromcon, user, &usercon))
 				continue;
 			rc = sidtab_context_to_sid(&sidtab, &usercon, &sid);
 			if (rc)
 				goto out_unlock;
 			if (mynel < maxnel) {
 				mysids[mynel++] = sid;
 			} else {
 				rc = -ENOMEM;
 				maxnel += SIDS_NEL;
 				mysids2 = kcalloc(maxnel, sizeof(*mysids2), GFP_ATOMIC);
 				if (!mysids2)
 					goto out_unlock;
 				memcpy(mysids2, mysids, mynel * sizeof(*mysids2));
 				kfree(mysids);
 				mysids = mysids2;
 				mysids[mynel++] = sid;
 			}
 		}
 	}
 	rc = 0;
 out_unlock:
 	read_unlock(&policy_rwlock);
 	if (rc || !mynel) {
 		kfree(mysids);
 		goto out;
 	}
 	rc = -ENOMEM;
 	mysids2 = kcalloc(mynel, sizeof(*mysids2), GFP_KERNEL);
 	if (!mysids2) {
 		kfree(mysids);
 		goto out;
 	}
 	for (i = 0, j = 0; i < mynel; i++) {
 		struct av_decision dummy_avd;
 		rc = avc_has_perm_noaudit(fromsid, mysids[i],
 					  SECCLASS_PROCESS, /* kernel value */
 					  PROCESS__TRANSITION, AVC_STRICT,
 					  &dummy_avd);
 		if (!rc)
 			mysids2[j++] = mysids[i];
 		cond_resched();
 	}
 	rc = 0;
 	kfree(mysids);
 	*sids = mysids2;
 	*nel = j;
 out:
 	return rc;
 }
 /**
  * __security_genfs_sid - Helper to obtain a SID for a file in a filesystem
  * @fstype: filesystem type
  * @path: path from root of mount
  * @sclass: file security class
  * @sid: SID for path
  *
  * Obtain a SID to use for a file in a filesystem that
  * cannot support xattr or use a fixed labeling behavior like
  * transition SIDs or task SIDs.
  *
  * The caller must acquire the policy_rwlock before calling this function.
  */
 static inline int __security_genfs_sid(const char *fstype,
 				       char *path,
 				       u16 orig_sclass,
 				       u32 *sid)
 {
 	int len;
 	u16 sclass;
 	struct genfs *genfs;
 	struct ocontext *c;
 	int rc, cmp = 0;
 	while (path[0] == '/' && path[1] == '/')
 		path++;
 	sclass = unmap_class(orig_sclass);
 	*sid = SECINITSID_UNLABELED;
 	for (genfs = policydb.genfs; genfs; genfs = genfs->next) {
 		cmp = strcmp(fstype, genfs->fstype);
 		if (cmp <= 0)
 			break;
 	}
 	rc = -ENOENT;
 	if (!genfs || cmp)
 		goto out;
 	for (c = genfs->head; c; c = c->next) {
 		len = strlen(c->u.name);
 		if ((!c->v.sclass || sclass == c->v.sclass) &&
 		    (strncmp(c->u.name, path, len) == 0))
 			break;
 	}
 	rc = -ENOENT;
 	if (!c)
 		goto out;
 	if (!c->sid[0]) {
 		rc = sidtab_context_to_sid(&sidtab, &c->context[0], &c->sid[0]);
 		if (rc)
 			goto out;
 	}
 	*sid = c->sid[0];
 	rc = 0;
 out:
 	return rc;
 }
 /**
  * security_genfs_sid - Obtain a SID for a file in a filesystem
  * @fstype: filesystem type
  * @path: path from root of mount
  * @sclass: file security class
  * @sid: SID for path
  *
  * Acquire policy_rwlock before calling __security_genfs_sid() and release
  * it afterward.
  */
 int security_genfs_sid(const char *fstype,
 		       char *path,
 		       u16 orig_sclass,
 		       u32 *sid)
 {
 	int retval;
 	read_lock(&policy_rwlock);
 	retval = __security_genfs_sid(fstype, path, orig_sclass, sid);
 	read_unlock(&policy_rwlock);
 	return retval;
 }
 /**
  * security_fs_use - Determine how to handle labeling for a filesystem.
  * @sb: superblock in question
  */
 int security_fs_use(struct super_block *sb)
 {
 	int rc = 0;
 	struct ocontext *c;
 	struct superblock_security_struct *sbsec = sb->s_security;
 	const char *fstype = sb->s_type->name;
 	read_lock(&policy_rwlock);
 	c = policydb.ocontexts[OCON_FSUSE];
 	while (c) {
 		if (strcmp(fstype, c->u.name) == 0)
 			break;
 		c = c->next;
 	}
 	if (c) {
 		sbsec->behavior = c->v.behavior;
 		if (!c->sid[0]) {
 			rc = sidtab_context_to_sid(&sidtab, &c->context[0],
 						   &c->sid[0]);
 			if (rc)
 				goto out;
 		}
 		sbsec->sid = c->sid[0];
 	} else {
 		rc = __security_genfs_sid(fstype, "/", SECCLASS_DIR,
 					  &sbsec->sid);
 		if (rc) {
 			sbsec->behavior = SECURITY_FS_USE_NONE;
 			rc = 0;
 		} else {
 			sbsec->behavior = SECURITY_FS_USE_GENFS;
 		}
 	}
 out:
 	read_unlock(&policy_rwlock);
 	return rc;
 }
 int security_get_bools(int *len, char ***names, int **values)
 {
 	int i, rc;
 	read_lock(&policy_rwlock);
 	*names = NULL;
 	*values = NULL;
 	rc = 0;
 	*len = policydb.p_bools.nprim;
 	if (!*len)
 		goto out;
 	rc = -ENOMEM;
 	*names = kcalloc(*len, sizeof(char *), GFP_ATOMIC);
 	if (!*names)
 		goto err;
 	rc = -ENOMEM;
 	*values = kcalloc(*len, sizeof(int), GFP_ATOMIC);
 	if (!*values)
 		goto err;
 	for (i = 0; i < *len; i++) {
 		size_t name_len;
 		(*values)[i] = policydb.bool_val_to_struct[i]->state;
 		name_len = strlen(sym_name(&policydb, SYM_BOOLS, i)) + 1;
 		rc = -ENOMEM;
 		(*names)[i] = kmalloc(sizeof(char) * name_len, GFP_ATOMIC);
 		if (!(*names)[i])
 			goto err;
 		strncpy((*names)[i], sym_name(&policydb, SYM_BOOLS, i), name_len);
 		(*names)[i][name_len - 1] = 0;
 	}
 	rc = 0;
 out:
 	read_unlock(&policy_rwlock);
 	return rc;
 err:
 	if (*names) {
 		for (i = 0; i < *len; i++)
 			kfree((*names)[i]);
 	}
 	kfree(*values);
 	goto out;
 }
 int security_set_bools(int len, int *values)
 {
 	int i, rc;
 	int lenp, seqno = 0;
 	struct cond_node *cur;
 	write_lock_irq(&policy_rwlock);
 	rc = -EFAULT;
 	lenp = policydb.p_bools.nprim;
 	if (len != lenp)
 		goto out;
 	for (i = 0; i < len; i++) {
 		if (!!values[i] != policydb.bool_val_to_struct[i]->state) {
 			audit_log(current->audit_context, GFP_ATOMIC,
 				AUDIT_MAC_CONFIG_CHANGE,
 				"bool=%s val=%d old_val=%d auid=%u ses=%u",
 				sym_name(&policydb, SYM_BOOLS, i),
 				!!values[i],
 				policydb.bool_val_to_struct[i]->state,
 				from_kuid(&init_user_ns, audit_get_loginuid(current)),
 				audit_get_sessionid(current));
 		}
 		if (values[i])
 			policydb.bool_val_to_struct[i]->state = 1;
 		else
 			policydb.bool_val_to_struct[i]->state = 0;
 	}
 	for (cur = policydb.cond_list; cur; cur = cur->next) {
 		rc = evaluate_cond_node(&policydb, cur);
 		if (rc)
 			goto out;
 	}
 	seqno = ++latest_granting;
 	rc = 0;
 out:
 	write_unlock_irq(&policy_rwlock);
 	if (!rc) {
 		avc_ss_reset(seqno);
 		selnl_notify_policyload(seqno);
 		selinux_status_update_policyload(seqno);
 		selinux_xfrm_notify_policyload();
 	}
 	return rc;
 }
 int security_get_bool_value(int bool)
 {
 	int rc;
 	int len;
 	read_lock(&policy_rwlock);
 	rc = -EFAULT;
 	len = policydb.p_bools.nprim;
 	if (bool >= len)
 		goto out;
 	rc = policydb.bool_val_to_struct[bool]->state;
 out:
 	read_unlock(&policy_rwlock);
 	return rc;
 }
 static int security_preserve_bools(struct policydb *p)
 {
 	int rc, nbools = 0, *bvalues = NULL, i;
 	char **bnames = NULL;
 	struct cond_bool_datum *booldatum;
 	struct cond_node *cur;
 	rc = security_get_bools(&nbools, &bnames, &bvalues);
 	if (rc)
 		goto out;
 	for (i = 0; i < nbools; i++) {
 		booldatum = hashtab_search(p->p_bools.table, bnames[i]);
 		if (booldatum)
 			booldatum->state = bvalues[i];
 	}
 	for (cur = p->cond_list; cur; cur = cur->next) {
 		rc = evaluate_cond_node(p, cur);
 		if (rc)
 			goto out;
 	}
 out:
 	if (bnames) {
 		for (i = 0; i < nbools; i++)
 			kfree(bnames[i]);
 	}
 	kfree(bnames);
 	kfree(bvalues);
 	return rc;
 }
 /*
  * security_sid_mls_copy() - computes a new sid based on the given
  * sid and the mls portion of mls_sid.
  */
 int security_sid_mls_copy(u32 sid, u32 mls_sid, u32 *new_sid)
 {
 	struct context *context1;
 	struct context *context2;
 	struct context newcon;
 	char *s;
 	u32 len;
 	int rc;
 	rc = 0;
 	if (!ss_initialized || !policydb.mls_enabled) {
 		*new_sid = sid;
 		goto out;
 	}
 	context_init(&newcon);
 	read_lock(&policy_rwlock);
 	rc = -EINVAL;
 	context1 = sidtab_search(&sidtab, sid);
 	if (!context1) {
 		printk(KERN_ERR "SELinux: %s:  unrecognized SID %d\n",
 			__func__, sid);
 		goto out_unlock;
 	}
 	rc = -EINVAL;
 	context2 = sidtab_search(&sidtab, mls_sid);
 	if (!context2) {
 		printk(KERN_ERR "SELinux: %s:  unrecognized SID %d\n",
 			__func__, mls_sid);
 		goto out_unlock;
 	}
 	newcon.user = context1->user;
 	newcon.role = context1->role;
 	newcon.type = context1->type;
 	rc = mls_context_cpy(&newcon, context2);
 	if (rc)
 		goto out_unlock;
 	/* Check the validity of the new context. */
 	if (!policydb_context_isvalid(&policydb, &newcon)) {
 		rc = convert_context_handle_invalid_context(&newcon);
 		if (rc) {
 			if (!context_struct_to_string(&newcon, &s, &len)) {
-				audit_log(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR,
+				audit_log(current->audit_context,
-					  "security_sid_mls_copy: invalid context %s", s);
+					  GFP_ATOMIC, AUDIT_SELINUX_ERR,
+					  "op=security_sid_mls_copy "
+					  "invalid_context=%s", s);
 				kfree(s);
 			}
 			goto out_unlock;
 		}
 	}
 	rc = sidtab_context_to_sid(&sidtab, &newcon, new_sid);
 out_unlock:
 	read_unlock(&policy_rwlock);
 	context_destroy(&newcon);
 out:
 	return rc;
 }
 /**
  * security_net_peersid_resolve - Compare and resolve two network peer SIDs
  * @nlbl_sid: NetLabel SID
  * @nlbl_type: NetLabel labeling protocol type
  * @xfrm_sid: XFRM SID
  *
  * Description:
  * Compare the @nlbl_sid and @xfrm_sid values and if the two SIDs can be
  * resolved into a single SID it is returned via @peer_sid and the function
  * returns zero.  Otherwise @peer_sid is set to SECSID_NULL and the function
  * returns a negative value.  A table summarizing the behavior is below:
  *
  *                                 | function return |      @sid
  *   ------------------------------+-----------------+-----------------
  *   no peer labels                |        0        |    SECSID_NULL
  *   single peer label             |        0        |    <peer_label>
  *   multiple, consistent labels   |        0        |    <peer_label>
  *   multiple, inconsistent labels |    -<errno>     |    SECSID_NULL
  *
  */
 int security_net_peersid_resolve(u32 nlbl_sid, u32 nlbl_type,
 				 u32 xfrm_sid,
 				 u32 *peer_sid)
 {
 	int rc;
 	struct context *nlbl_ctx;
 	struct context *xfrm_ctx;
 	*peer_sid = SECSID_NULL;
 	/* handle the common (which also happens to be the set of easy) cases
 	 * right away, these two if statements catch everything involving a
 	 * single or absent peer SID/label */
 	if (xfrm_sid == SECSID_NULL) {
 		*peer_sid = nlbl_sid;
 		return 0;
 	}
 	/* NOTE: an nlbl_type == NETLBL_NLTYPE_UNLABELED is a "fallback" label
 	 * and is treated as if nlbl_sid == SECSID_NULL when a XFRM SID/label
 	 * is present */
 	if (nlbl_sid == SECSID_NULL || nlbl_type == NETLBL_NLTYPE_UNLABELED) {
 		*peer_sid = xfrm_sid;
 		return 0;
 	}
 	/* we don't need to check ss_initialized here since the only way both
 	 * nlbl_sid and xfrm_sid are not equal to SECSID_NULL would be if the
 	 * security server was initialized and ss_initialized was true */
 	if (!policydb.mls_enabled)
 		return 0;
 	read_lock(&policy_rwlock);
 	rc = -EINVAL;
 	nlbl_ctx = sidtab_search(&sidtab, nlbl_sid);
 	if (!nlbl_ctx) {
 		printk(KERN_ERR "SELinux: %s:  unrecognized SID %d\n",
 		       __func__, nlbl_sid);
 		goto out;
 	}
 	rc = -EINVAL;
 	xfrm_ctx = sidtab_search(&sidtab, xfrm_sid);
 	if (!xfrm_ctx) {
 		printk(KERN_ERR "SELinux: %s:  unrecognized SID %d\n",
 		       __func__, xfrm_sid);
 		goto out;
 	}
 	rc = (mls_context_cmp(nlbl_ctx, xfrm_ctx) ? 0 : -EACCES);
 	if (rc)
 		goto out;
 	/* at present NetLabel SIDs/labels really only carry MLS
 	 * information so if the MLS portion of the NetLabel SID
 	 * matches the MLS portion of the labeled XFRM SID/label
 	 * then pass along the XFRM SID as it is the most
 	 * expressive */
 	*peer_sid = xfrm_sid;
 out:
 	read_unlock(&policy_rwlock);
 	return rc;
 }
 static int get_classes_callback(void *k, void *d, void *args)
 {
 	struct class_datum *datum = d;
 	char *name = k, **classes = args;
 	int value = datum->value - 1;
 	classes[value] = kstrdup(name, GFP_ATOMIC);
 	if (!classes[value])
 		return -ENOMEM;
 	return 0;
 }
 int security_get_classes(char ***classes, int *nclasses)
 {
 	int rc;
 	read_lock(&policy_rwlock);
 	rc = -ENOMEM;
 	*nclasses = policydb.p_classes.nprim;
 	*classes = kcalloc(*nclasses, sizeof(**classes), GFP_ATOMIC);
 	if (!*classes)
 		goto out;
 	rc = hashtab_map(policydb.p_classes.table, get_classes_callback,
 			*classes);
 	if (rc) {
 		int i;
 		for (i = 0; i < *nclasses; i++)
 			kfree((*classes)[i]);
 		kfree(*classes);
 	}
 out:
 	read_unlock(&policy_rwlock);
 	return rc;
 }
 static int get_permissions_callback(void *k, void *d, void *args)
 {
 	struct perm_datum *datum = d;
 	char *name = k, **perms = args;
 	int value = datum->value - 1;
 	perms[value] = kstrdup(name, GFP_ATOMIC);
 	if (!perms[value])
 		return -ENOMEM;
 	return 0;
 }
 int security_get_permissions(char *class, char ***perms, int *nperms)
 {
 	int rc, i;
 	struct class_datum *match;
 	read_lock(&policy_rwlock);
 	rc = -EINVAL;
 	match = hashtab_search(policydb.p_classes.table, class);
 	if (!match) {
 		printk(KERN_ERR "SELinux: %s:  unrecognized class %s\n",
 			__func__, class);
 		goto out;
 	}
 	rc = -ENOMEM;
 	*nperms = match->permissions.nprim;
 	*perms = kcalloc(*nperms, sizeof(**perms), GFP_ATOMIC);
 	if (!*perms)
 		goto out;
 	if (match->comdatum) {
 		rc = hashtab_map(match->comdatum->permissions.table,
 				get_permissions_callback, *perms);
 		if (rc)
 			goto err;
 	}
 	rc = hashtab_map(match->permissions.table, get_permissions_callback,
 			*perms);
 	if (rc)
 		goto err;
 out:
 	read_unlock(&policy_rwlock);
 	return rc;
 err:
 	read_unlock(&policy_rwlock);
 	for (i = 0; i < *nperms; i++)
 		kfree((*perms)[i]);
 	kfree(*perms);
 	return rc;
 }
 int security_get_reject_unknown(void)
 {
 	return policydb.reject_unknown;
 }
 int security_get_allow_unknown(void)
 {
 	return policydb.allow_unknown;
 }
 /**
  * security_policycap_supported - Check for a specific policy capability
  * @req_cap: capability
  *
  * Description:
  * This function queries the currently loaded policy to see if it supports the
  * capability specified by @req_cap.  Returns true (1) if the capability is
  * supported, false (0) if it isn't supported.
  *
  */
 int security_policycap_supported(unsigned int req_cap)
 {
 	int rc;
 	read_lock(&policy_rwlock);
 	rc = ebitmap_get_bit(&policydb.policycaps, req_cap);
 	read_unlock(&policy_rwlock);
 	return rc;
 }
 struct selinux_audit_rule {
 	u32 au_seqno;
 	struct context au_ctxt;
 };
 void selinux_audit_rule_free(void *vrule)
 {
 	struct selinux_audit_rule *rule = vrule;
 	if (rule) {
 		context_destroy(&rule->au_ctxt);
 		kfree(rule);
 	}
 }
 int selinux_audit_rule_init(u32 field, u32 op, char *rulestr, void **vrule)
 {
 	struct selinux_audit_rule *tmprule;
 	struct role_datum *roledatum;
 	struct type_datum *typedatum;
 	struct user_datum *userdatum;
 	struct selinux_audit_rule **rule = (struct selinux_audit_rule **)vrule;
 	int rc = 0;
 	*rule = NULL;
 	if (!ss_initialized)
 		return -EOPNOTSUPP;
 	switch (field) {
 	case AUDIT_SUBJ_USER:
 	case AUDIT_SUBJ_ROLE:
 	case AUDIT_SUBJ_TYPE:
 	case AUDIT_OBJ_USER:
 	case AUDIT_OBJ_ROLE:
 	case AUDIT_OBJ_TYPE:
 		/* only 'equals' and 'not equals' fit user, role, and type */
 		if (op != Audit_equal && op != Audit_not_equal)
 			return -EINVAL;
 		break;
 	case AUDIT_SUBJ_SEN:
 	case AUDIT_SUBJ_CLR:
 	case AUDIT_OBJ_LEV_LOW:
 	case AUDIT_OBJ_LEV_HIGH:
 		/* we do not allow a range, indicated by the presence of '-' */
 		if (strchr(rulestr, '-'))
 			return -EINVAL;
 		break;
 	default:
 		/* only the above fields are valid */
 		return -EINVAL;
 	}
 	tmprule = kzalloc(sizeof(struct selinux_audit_rule), GFP_KERNEL);
 	if (!tmprule)
 		return -ENOMEM;
 	context_init(&tmprule->au_ctxt);
 	read_lock(&policy_rwlock);
 	tmprule->au_seqno = latest_granting;
 	switch (field) {
 	case AUDIT_SUBJ_USER:
 	case AUDIT_OBJ_USER:
 		rc = -EINVAL;
 		userdatum = hashtab_search(policydb.p_users.table, rulestr);
 		if (!userdatum)
 			goto out;
 		tmprule->au_ctxt.user = userdatum->value;
 		break;
 	case AUDIT_SUBJ_ROLE:
 	case AUDIT_OBJ_ROLE:
 		rc = -EINVAL;
 		roledatum = hashtab_search(policydb.p_roles.table, rulestr);
 		if (!roledatum)
 			goto out;
 		tmprule->au_ctxt.role = roledatum->value;
 		break;
 	case AUDIT_SUBJ_TYPE:
 	case AUDIT_OBJ_TYPE:
 		rc = -EINVAL;
 		typedatum = hashtab_search(policydb.p_types.table, rulestr);
 		if (!typedatum)
 			goto out;
 		tmprule->au_ctxt.type = typedatum->value;
 		break;
 	case AUDIT_SUBJ_SEN:
 	case AUDIT_SUBJ_CLR:
 	case AUDIT_OBJ_LEV_LOW:
 	case AUDIT_OBJ_LEV_HIGH:
 		rc = mls_from_string(rulestr, &tmprule->au_ctxt, GFP_ATOMIC);
 		if (rc)
 			goto out;
 		break;
 	}
 	rc = 0;
 out:
 	read_unlock(&policy_rwlock);
 	if (rc) {
 		selinux_audit_rule_free(tmprule);
 		tmprule = NULL;
 	}
 	*rule = tmprule;
 	return rc;
 }
 /* Check to see if the rule contains any selinux fields */
 int selinux_audit_rule_known(struct audit_krule *rule)
 {
 	int i;
 	for (i = 0; i < rule->field_count; i++) {
 		struct audit_field *f = &rule->fields[i];
 		switch (f->type) {
 		case AUDIT_SUBJ_USER:
 		case AUDIT_SUBJ_ROLE:
 		case AUDIT_SUBJ_TYPE:
 		case AUDIT_SUBJ_SEN:
 		case AUDIT_SUBJ_CLR:
 		case AUDIT_OBJ_USER:
 		case AUDIT_OBJ_ROLE:
 		case AUDIT_OBJ_TYPE:
 		case AUDIT_OBJ_LEV_LOW:
 		case AUDIT_OBJ_LEV_HIGH:
 			return 1;
 		}
 	}
 	return 0;
 }
 int selinux_audit_rule_match(u32 sid, u32 field, u32 op, void *vrule,
 			     struct audit_context *actx)
 {
 	struct context *ctxt;
 	struct mls_level *level;
 	struct selinux_audit_rule *rule = vrule;
 	int match = 0;
 	if (unlikely(!rule)) {
 		WARN_ONCE(1, "selinux_audit_rule_match: missing rule\n");
 		return -ENOENT;
 	}
 	read_lock(&policy_rwlock);
 	if (rule->au_seqno < latest_granting) {
 		match = -ESTALE;
 		goto out;
 	}
 	ctxt = sidtab_search(&sidtab, sid);
 	if (unlikely(!ctxt)) {
 		WARN_ONCE(1, "selinux_audit_rule_match: unrecognized SID %d\n",
 			  sid);
 		match = -ENOENT;
 		goto out;
 	}
 	/* a field/op pair that is not caught here will simply fall through
 	   without a match */
 	switch (field) {
 	case AUDIT_SUBJ_USER:
 	case AUDIT_OBJ_USER:
 		switch (op) {
 		case Audit_equal:
 			match = (ctxt->user == rule->au_ctxt.user);
 			break;
 		case Audit_not_equal:
 			match = (ctxt->user != rule->au_ctxt.user);
 			break;
 		}
 		break;
 	case AUDIT_SUBJ_ROLE:
 	case AUDIT_OBJ_ROLE:
 		switch (op) {
 		case Audit_equal:
 			match = (ctxt->role == rule->au_ctxt.role);
 			break;
 		case Audit_not_equal:
 			match = (ctxt->role != rule->au_ctxt.role);
 			break;
 		}
 		break;
 	case AUDIT_SUBJ_TYPE:
 	case AUDIT_OBJ_TYPE:
 		switch (op) {
 		case Audit_equal:
 			match = (ctxt->type == rule->au_ctxt.type);
 			break;
 		case Audit_not_equal:
 			match = (ctxt->type != rule->au_ctxt.type);
 			break;
 		}
 		break;
 	case AUDIT_SUBJ_SEN:
 	case AUDIT_SUBJ_CLR:
 	case AUDIT_OBJ_LEV_LOW:
 	case AUDIT_OBJ_LEV_HIGH:
 		level = ((field == AUDIT_SUBJ_SEN ||
 			  field == AUDIT_OBJ_LEV_LOW) ?
 			 &ctxt->range.level[0] : &ctxt->range.level[1]);
 		switch (op) {
 		case Audit_equal:
 			match = mls_level_eq(&rule->au_ctxt.range.level[0],
 					     level);
 			break;
 		case Audit_not_equal:
 			match = !mls_level_eq(&rule->au_ctxt.range.level[0],
 					      level);
 			break;
 		case Audit_lt:
 			match = (mls_level_dom(&rule->au_ctxt.range.level[0],
 					       level) &&
 				 !mls_level_eq(&rule->au_ctxt.range.level[0],
 					       level));
 			break;
 		case Audit_le:
 			match = mls_level_dom(&rule->au_ctxt.range.level[0],
 					      level);
 			break;
 		case Audit_gt:
 			match = (mls_level_dom(level,
 					      &rule->au_ctxt.range.level[0]) &&
 				 !mls_level_eq(level,
 					       &rule->au_ctxt.range.level[0]));
 			break;
 		case Audit_ge:
 			match = mls_level_dom(level,
 					      &rule->au_ctxt.range.level[0]);
 			break;
 		}
 	}
 out:
 	read_unlock(&policy_rwlock);
 	return match;
 }
 static int (*aurule_callback)(void) = audit_update_lsm_rules;
 static int aurule_avc_callback(u32 event)
 {
 	int err = 0;
 	if (event == AVC_CALLBACK_RESET && aurule_callback)
 		err = aurule_callback();
 	return err;
 }
 static int __init aurule_init(void)
 {
 	int err;
 	err = avc_add_callback(aurule_avc_callback, AVC_CALLBACK_RESET);
 	if (err)
 		panic("avc_add_callback() failed, error %d\n", err);
 	return err;
 }
 __initcall(aurule_init);
 #ifdef CONFIG_NETLABEL
 /**
  * security_netlbl_cache_add - Add an entry to the NetLabel cache
  * @secattr: the NetLabel packet security attributes
  * @sid: the SELinux SID
  *
  * Description:
  * Attempt to cache the context in @ctx, which was derived from the packet in
  * @skb, in the NetLabel subsystem cache.  This function assumes @secattr has
  * already been initialized.
  *
  */
 static void security_netlbl_cache_add(struct netlbl_lsm_secattr *secattr,
 				      u32 sid)
 {
 	u32 *sid_cache;
 	sid_cache = kmalloc(sizeof(*sid_cache), GFP_ATOMIC);
 	if (sid_cache == NULL)
 		return;
 	secattr->cache = netlbl_secattr_cache_alloc(GFP_ATOMIC);
 	if (secattr->cache == NULL) {
 		kfree(sid_cache);
 		return;
 	}
 	*sid_cache = sid;
 	secattr->cache->free = kfree;
 	secattr->cache->data = sid_cache;
 	secattr->flags |= NETLBL_SECATTR_CACHE;
 }
 /**
  * security_netlbl_secattr_to_sid - Convert a NetLabel secattr to a SELinux SID
  * @secattr: the NetLabel packet security attributes
  * @sid: the SELinux SID
  *
  * Description:
  * Convert the given NetLabel security attributes in @secattr into a
  * SELinux SID.  If the @secattr field does not contain a full SELinux
  * SID/context then use SECINITSID_NETMSG as the foundation.  If possible the
  * 'cache' field of @secattr is set and the CACHE flag is set; this is to
  * allow the @secattr to be used by NetLabel to cache the secattr to SID
  * conversion for future lookups.  Returns zero on success, negative values on
  * failure.
  *
  */
 int security_netlbl_secattr_to_sid(struct netlbl_lsm_secattr *secattr,
 				   u32 *sid)
 {
 	int rc;
 	struct context *ctx;
 	struct context ctx_new;
 	if (!ss_initialized) {
 		*sid = SECSID_NULL;
 		return 0;
 	}
 	read_lock(&policy_rwlock);
 	if (secattr->flags & NETLBL_SECATTR_CACHE)
 		*sid = *(u32 *)secattr->cache->data;
 	else if (secattr->flags & NETLBL_SECATTR_SECID)
 		*sid = secattr->attr.secid;
 	else if (secattr->flags & NETLBL_SECATTR_MLS_LVL) {
 		rc = -EIDRM;
 		ctx = sidtab_search(&sidtab, SECINITSID_NETMSG);
 		if (ctx == NULL)
 			goto out;
 		context_init(&ctx_new);
 		ctx_new.user = ctx->user;
 		ctx_new.role = ctx->role;
 		ctx_new.type = ctx->type;
 		mls_import_netlbl_lvl(&ctx_new, secattr);
 		if (secattr->flags & NETLBL_SECATTR_MLS_CAT) {
 			rc = ebitmap_netlbl_import(&ctx_new.range.level[0].cat,
 						   secattr->attr.mls.cat);
 			if (rc)
 				goto out;
 			memcpy(&ctx_new.range.level[1].cat,
 			       &ctx_new.range.level[0].cat,
 			       sizeof(ctx_new.range.level[0].cat));
 		}
 		rc = -EIDRM;
 		if (!mls_context_isvalid(&policydb, &ctx_new))
 			goto out_free;
 		rc = sidtab_context_to_sid(&sidtab, &ctx_new, sid);
 		if (rc)
 			goto out_free;
 		security_netlbl_cache_add(secattr, *sid);
 		ebitmap_destroy(&ctx_new.range.level[0].cat);
 	} else
 		*sid = SECSID_NULL;
 	read_unlock(&policy_rwlock);
 	return 0;
 out_free:
 	ebitmap_destroy(&ctx_new.range.level[0].cat);
 out:
 	read_unlock(&policy_rwlock);
 	return rc;
 }
 /**
  * security_netlbl_sid_to_secattr - Convert a SELinux SID to a NetLabel secattr
  * @sid: the SELinux SID
  * @secattr: the NetLabel packet security attributes
  *
  * Description:
  * Convert the given SELinux SID in @sid into a NetLabel security attribute.
  * Returns zero on success, negative values on failure.
  *
  */
 int security_netlbl_sid_to_secattr(u32 sid, struct netlbl_lsm_secattr *secattr)
 {
 	int rc;
 	struct context *ctx;
 	if (!ss_initialized)
 		return 0;
 	read_lock(&policy_rwlock);
 	rc = -ENOENT;
 	ctx = sidtab_search(&sidtab, sid);
 	if (ctx == NULL)
 		goto out;
 	rc = -ENOMEM;
 	secattr->domain = kstrdup(sym_name(&policydb, SYM_TYPES, ctx->type - 1),
 				  GFP_ATOMIC);
 	if (secattr->domain == NULL)
 		goto out;
 	secattr->attr.secid = sid;
 	secattr->flags |= NETLBL_SECATTR_DOMAIN_CPY | NETLBL_SECATTR_SECID;
 	mls_export_netlbl_lvl(ctx, secattr);
 	rc = mls_export_netlbl_cat(ctx, secattr);
 out:
 	read_unlock(&policy_rwlock);
 	return rc;
 }
 #endif /* CONFIG_NETLABEL */
 /**
  * security_read_policy - read the policy.
  * @data: binary policy data
  * @len: length of data in bytes
  *
  */
 int security_read_policy(void **data, size_t *len)
 {
 	int rc;
 	struct policy_file fp;
 	if (!ss_initialized)
 		return -EINVAL;
 	*len = security_policydb_len();
 	*data = vmalloc_user(*len);
 	if (!*data)
 		return -ENOMEM;
 	fp.data = *data;
 	fp.len = *len;
 	read_lock(&policy_rwlock);
 	rc = policydb_write(&policydb, &fp);
 	read_unlock(&policy_rwlock);
 	if (rc)
 		return rc;
 	*len = (unsigned long)fp.data - (unsigned long)*data;
 	return 0;
 }