~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

TOMOYO Linux Cross Reference
Linux/security/selinux/ss/conditional.c

Version: ~ [ linux-5.8-rc5 ] ~ [ linux-5.7.8 ] ~ [ linux-5.6.19 ] ~ [ linux-5.5.19 ] ~ [ linux-5.4.51 ] ~ [ linux-5.3.18 ] ~ [ linux-5.2.21 ] ~ [ linux-5.1.21 ] ~ [ linux-5.0.21 ] ~ [ linux-4.20.17 ] ~ [ linux-4.19.132 ] ~ [ linux-4.18.20 ] ~ [ linux-4.17.19 ] ~ [ linux-4.16.18 ] ~ [ linux-4.15.18 ] ~ [ linux-4.14.188 ] ~ [ linux-4.13.16 ] ~ [ linux-4.12.14 ] ~ [ linux-4.11.12 ] ~ [ linux-4.10.17 ] ~ [ linux-4.9.230 ] ~ [ linux-4.8.17 ] ~ [ linux-4.7.10 ] ~ [ linux-4.6.7 ] ~ [ linux-4.5.7 ] ~ [ linux-4.4.230 ] ~ [ linux-4.3.6 ] ~ [ linux-4.2.8 ] ~ [ linux-4.1.52 ] ~ [ linux-4.0.9 ] ~ [ linux-3.19.8 ] ~ [ linux-3.18.140 ] ~ [ linux-3.17.8 ] ~ [ linux-3.16.85 ] ~ [ linux-3.15.10 ] ~ [ linux-3.14.79 ] ~ [ linux-3.13.11 ] ~ [ linux-3.12.74 ] ~ [ linux-3.11.10 ] ~ [ linux-3.10.108 ] ~ [ linux-2.6.32.71 ] ~ [ linux-2.6.0 ] ~ [ linux-2.4.37.11 ] ~ [ unix-v6-master ] ~ [ ccs-tools-1.8.5 ] ~ [ policy-sample ] ~
Architecture: ~ [ i386 ] ~ [ alpha ] ~ [ m68k ] ~ [ mips ] ~ [ ppc ] ~ [ sparc ] ~ [ sparc64 ] ~

  1 /* Authors: Karl MacMillan <kmacmillan@tresys.com>
  2  *          Frank Mayer <mayerf@tresys.com>
  3  *
  4  * Copyright (C) 2003 - 2004 Tresys Technology, LLC
  5  *      This program is free software; you can redistribute it and/or modify
  6  *      it under the terms of the GNU General Public License as published by
  7  *      the Free Software Foundation, version 2.
  8  */
  9 
 10 #include <linux/kernel.h>
 11 #include <linux/errno.h>
 12 #include <linux/string.h>
 13 #include <linux/spinlock.h>
 14 #include <linux/slab.h>
 15 
 16 #include "security.h"
 17 #include "conditional.h"
 18 #include "services.h"
 19 
 20 /*
 21  * cond_evaluate_expr evaluates a conditional expr
 22  * in reverse polish notation. It returns true (1), false (0),
 23  * or undefined (-1). Undefined occurs when the expression
 24  * exceeds the stack depth of COND_EXPR_MAXDEPTH.
 25  */
 26 static int cond_evaluate_expr(struct policydb *p, struct cond_expr *expr)
 27 {
 28 
 29         struct cond_expr *cur;
 30         int s[COND_EXPR_MAXDEPTH];
 31         int sp = -1;
 32 
 33         for (cur = expr; cur; cur = cur->next) {
 34                 switch (cur->expr_type) {
 35                 case COND_BOOL:
 36                         if (sp == (COND_EXPR_MAXDEPTH - 1))
 37                                 return -1;
 38                         sp++;
 39                         s[sp] = p->bool_val_to_struct[cur->bool - 1]->state;
 40                         break;
 41                 case COND_NOT:
 42                         if (sp < 0)
 43                                 return -1;
 44                         s[sp] = !s[sp];
 45                         break;
 46                 case COND_OR:
 47                         if (sp < 1)
 48                                 return -1;
 49                         sp--;
 50                         s[sp] |= s[sp + 1];
 51                         break;
 52                 case COND_AND:
 53                         if (sp < 1)
 54                                 return -1;
 55                         sp--;
 56                         s[sp] &= s[sp + 1];
 57                         break;
 58                 case COND_XOR:
 59                         if (sp < 1)
 60                                 return -1;
 61                         sp--;
 62                         s[sp] ^= s[sp + 1];
 63                         break;
 64                 case COND_EQ:
 65                         if (sp < 1)
 66                                 return -1;
 67                         sp--;
 68                         s[sp] = (s[sp] == s[sp + 1]);
 69                         break;
 70                 case COND_NEQ:
 71                         if (sp < 1)
 72                                 return -1;
 73                         sp--;
 74                         s[sp] = (s[sp] != s[sp + 1]);
 75                         break;
 76                 default:
 77                         return -1;
 78                 }
 79         }
 80         return s[0];
 81 }
 82 
 83 /*
 84  * evaluate_cond_node evaluates the conditional stored in
 85  * a struct cond_node and if the result is different than the
 86  * current state of the node it sets the rules in the true/false
 87  * list appropriately. If the result of the expression is undefined
 88  * all of the rules are disabled for safety.
 89  */
 90 int evaluate_cond_node(struct policydb *p, struct cond_node *node)
 91 {
 92         int new_state;
 93         struct cond_av_list *cur;
 94 
 95         new_state = cond_evaluate_expr(p, node->expr);
 96         if (new_state != node->cur_state) {
 97                 node->cur_state = new_state;
 98                 if (new_state == -1)
 99                         printk(KERN_ERR "SELinux: expression result was undefined - disabling all rules.\n");
100                 /* turn the rules on or off */
101                 for (cur = node->true_list; cur; cur = cur->next) {
102                         if (new_state <= 0)
103                                 cur->node->key.specified &= ~AVTAB_ENABLED;
104                         else
105                                 cur->node->key.specified |= AVTAB_ENABLED;
106                 }
107 
108                 for (cur = node->false_list; cur; cur = cur->next) {
109                         /* -1 or 1 */
110                         if (new_state)
111                                 cur->node->key.specified &= ~AVTAB_ENABLED;
112                         else
113                                 cur->node->key.specified |= AVTAB_ENABLED;
114                 }
115         }
116         return 0;
117 }
118 
119 int cond_policydb_init(struct policydb *p)
120 {
121         int rc;
122 
123         p->bool_val_to_struct = NULL;
124         p->cond_list = NULL;
125 
126         rc = avtab_init(&p->te_cond_avtab);
127         if (rc)
128                 return rc;
129 
130         return 0;
131 }
132 
133 static void cond_av_list_destroy(struct cond_av_list *list)
134 {
135         struct cond_av_list *cur, *next;
136         for (cur = list; cur; cur = next) {
137                 next = cur->next;
138                 /* the avtab_ptr_t node is destroy by the avtab */
139                 kfree(cur);
140         }
141 }
142 
143 static void cond_node_destroy(struct cond_node *node)
144 {
145         struct cond_expr *cur_expr, *next_expr;
146 
147         for (cur_expr = node->expr; cur_expr; cur_expr = next_expr) {
148                 next_expr = cur_expr->next;
149                 kfree(cur_expr);
150         }
151         cond_av_list_destroy(node->true_list);
152         cond_av_list_destroy(node->false_list);
153         kfree(node);
154 }
155 
156 static void cond_list_destroy(struct cond_node *list)
157 {
158         struct cond_node *next, *cur;
159 
160         if (list == NULL)
161                 return;
162 
163         for (cur = list; cur; cur = next) {
164                 next = cur->next;
165                 cond_node_destroy(cur);
166         }
167 }
168 
169 void cond_policydb_destroy(struct policydb *p)
170 {
171         kfree(p->bool_val_to_struct);
172         avtab_destroy(&p->te_cond_avtab);
173         cond_list_destroy(p->cond_list);
174 }
175 
176 int cond_init_bool_indexes(struct policydb *p)
177 {
178         kfree(p->bool_val_to_struct);
179         p->bool_val_to_struct = kmalloc_array(p->p_bools.nprim,
180                                               sizeof(*p->bool_val_to_struct),
181                                               GFP_KERNEL);
182         if (!p->bool_val_to_struct)
183                 return -ENOMEM;
184         return 0;
185 }
186 
187 int cond_destroy_bool(void *key, void *datum, void *p)
188 {
189         kfree(key);
190         kfree(datum);
191         return 0;
192 }
193 
194 int cond_index_bool(void *key, void *datum, void *datap)
195 {
196         struct policydb *p;
197         struct cond_bool_datum *booldatum;
198         struct flex_array *fa;
199 
200         booldatum = datum;
201         p = datap;
202 
203         if (!booldatum->value || booldatum->value > p->p_bools.nprim)
204                 return -EINVAL;
205 
206         fa = p->sym_val_to_name[SYM_BOOLS];
207         if (flex_array_put_ptr(fa, booldatum->value - 1, key,
208                                GFP_KERNEL | __GFP_ZERO))
209                 BUG();
210         p->bool_val_to_struct[booldatum->value - 1] = booldatum;
211 
212         return 0;
213 }
214 
215 static int bool_isvalid(struct cond_bool_datum *b)
216 {
217         if (!(b->state == 0 || b->state == 1))
218                 return 0;
219         return 1;
220 }
221 
222 int cond_read_bool(struct policydb *p, struct hashtab *h, void *fp)
223 {
224         char *key = NULL;
225         struct cond_bool_datum *booldatum;
226         __le32 buf[3];
227         u32 len;
228         int rc;
229 
230         booldatum = kzalloc(sizeof(*booldatum), GFP_KERNEL);
231         if (!booldatum)
232                 return -ENOMEM;
233 
234         rc = next_entry(buf, fp, sizeof buf);
235         if (rc)
236                 goto err;
237 
238         booldatum->value = le32_to_cpu(buf[0]);
239         booldatum->state = le32_to_cpu(buf[1]);
240 
241         rc = -EINVAL;
242         if (!bool_isvalid(booldatum))
243                 goto err;
244 
245         len = le32_to_cpu(buf[2]);
246         if (((len == 0) || (len == (u32)-1)))
247                 goto err;
248 
249         rc = -ENOMEM;
250         key = kmalloc(len + 1, GFP_KERNEL);
251         if (!key)
252                 goto err;
253         rc = next_entry(key, fp, len);
254         if (rc)
255                 goto err;
256         key[len] = '\0';
257         rc = hashtab_insert(h, key, booldatum);
258         if (rc)
259                 goto err;
260 
261         return 0;
262 err:
263         cond_destroy_bool(key, booldatum, NULL);
264         return rc;
265 }
266 
267 struct cond_insertf_data {
268         struct policydb *p;
269         struct cond_av_list *other;
270         struct cond_av_list *head;
271         struct cond_av_list *tail;
272 };
273 
274 static int cond_insertf(struct avtab *a, struct avtab_key *k, struct avtab_datum *d, void *ptr)
275 {
276         struct cond_insertf_data *data = ptr;
277         struct policydb *p = data->p;
278         struct cond_av_list *other = data->other, *list, *cur;
279         struct avtab_node *node_ptr;
280         u8 found;
281         int rc = -EINVAL;
282 
283         /*
284          * For type rules we have to make certain there aren't any
285          * conflicting rules by searching the te_avtab and the
286          * cond_te_avtab.
287          */
288         if (k->specified & AVTAB_TYPE) {
289                 if (avtab_search(&p->te_avtab, k)) {
290                         printk(KERN_ERR "SELinux: type rule already exists outside of a conditional.\n");
291                         goto err;
292                 }
293                 /*
294                  * If we are reading the false list other will be a pointer to
295                  * the true list. We can have duplicate entries if there is only
296                  * 1 other entry and it is in our true list.
297                  *
298                  * If we are reading the true list (other == NULL) there shouldn't
299                  * be any other entries.
300                  */
301                 if (other) {
302                         node_ptr = avtab_search_node(&p->te_cond_avtab, k);
303                         if (node_ptr) {
304                                 if (avtab_search_node_next(node_ptr, k->specified)) {
305                                         printk(KERN_ERR "SELinux: too many conflicting type rules.\n");
306                                         goto err;
307                                 }
308                                 found = 0;
309                                 for (cur = other; cur; cur = cur->next) {
310                                         if (cur->node == node_ptr) {
311                                                 found = 1;
312                                                 break;
313                                         }
314                                 }
315                                 if (!found) {
316                                         printk(KERN_ERR "SELinux: conflicting type rules.\n");
317                                         goto err;
318                                 }
319                         }
320                 } else {
321                         if (avtab_search(&p->te_cond_avtab, k)) {
322                                 printk(KERN_ERR "SELinux: conflicting type rules when adding type rule for true.\n");
323                                 goto err;
324                         }
325                 }
326         }
327 
328         node_ptr = avtab_insert_nonunique(&p->te_cond_avtab, k, d);
329         if (!node_ptr) {
330                 printk(KERN_ERR "SELinux: could not insert rule.\n");
331                 rc = -ENOMEM;
332                 goto err;
333         }
334 
335         list = kzalloc(sizeof(*list), GFP_KERNEL);
336         if (!list) {
337                 rc = -ENOMEM;
338                 goto err;
339         }
340 
341         list->node = node_ptr;
342         if (!data->head)
343                 data->head = list;
344         else
345                 data->tail->next = list;
346         data->tail = list;
347         return 0;
348 
349 err:
350         cond_av_list_destroy(data->head);
351         data->head = NULL;
352         return rc;
353 }
354 
355 static int cond_read_av_list(struct policydb *p, void *fp, struct cond_av_list **ret_list, struct cond_av_list *other)
356 {
357         int i, rc;
358         __le32 buf[1];
359         u32 len;
360         struct cond_insertf_data data;
361 
362         *ret_list = NULL;
363 
364         rc = next_entry(buf, fp, sizeof(u32));
365         if (rc)
366                 return rc;
367 
368         len = le32_to_cpu(buf[0]);
369         if (len == 0)
370                 return 0;
371 
372         data.p = p;
373         data.other = other;
374         data.head = NULL;
375         data.tail = NULL;
376         for (i = 0; i < len; i++) {
377                 rc = avtab_read_item(&p->te_cond_avtab, fp, p, cond_insertf,
378                                      &data);
379                 if (rc)
380                         return rc;
381         }
382 
383         *ret_list = data.head;
384         return 0;
385 }
386 
387 static int expr_isvalid(struct policydb *p, struct cond_expr *expr)
388 {
389         if (expr->expr_type <= 0 || expr->expr_type > COND_LAST) {
390                 printk(KERN_ERR "SELinux: conditional expressions uses unknown operator.\n");
391                 return 0;
392         }
393 
394         if (expr->bool > p->p_bools.nprim) {
395                 printk(KERN_ERR "SELinux: conditional expressions uses unknown bool.\n");
396                 return 0;
397         }
398         return 1;
399 }
400 
401 static int cond_read_node(struct policydb *p, struct cond_node *node, void *fp)
402 {
403         __le32 buf[2];
404         u32 len, i;
405         int rc;
406         struct cond_expr *expr = NULL, *last = NULL;
407 
408         rc = next_entry(buf, fp, sizeof(u32) * 2);
409         if (rc)
410                 goto err;
411 
412         node->cur_state = le32_to_cpu(buf[0]);
413 
414         /* expr */
415         len = le32_to_cpu(buf[1]);
416 
417         for (i = 0; i < len; i++) {
418                 rc = next_entry(buf, fp, sizeof(u32) * 2);
419                 if (rc)
420                         goto err;
421 
422                 rc = -ENOMEM;
423                 expr = kzalloc(sizeof(*expr), GFP_KERNEL);
424                 if (!expr)
425                         goto err;
426 
427                 expr->expr_type = le32_to_cpu(buf[0]);
428                 expr->bool = le32_to_cpu(buf[1]);
429 
430                 if (!expr_isvalid(p, expr)) {
431                         rc = -EINVAL;
432                         kfree(expr);
433                         goto err;
434                 }
435 
436                 if (i == 0)
437                         node->expr = expr;
438                 else
439                         last->next = expr;
440                 last = expr;
441         }
442 
443         rc = cond_read_av_list(p, fp, &node->true_list, NULL);
444         if (rc)
445                 goto err;
446         rc = cond_read_av_list(p, fp, &node->false_list, node->true_list);
447         if (rc)
448                 goto err;
449         return 0;
450 err:
451         cond_node_destroy(node);
452         return rc;
453 }
454 
455 int cond_read_list(struct policydb *p, void *fp)
456 {
457         struct cond_node *node, *last = NULL;
458         __le32 buf[1];
459         u32 i, len;
460         int rc;
461 
462         rc = next_entry(buf, fp, sizeof buf);
463         if (rc)
464                 return rc;
465 
466         len = le32_to_cpu(buf[0]);
467 
468         rc = avtab_alloc(&(p->te_cond_avtab), p->te_avtab.nel);
469         if (rc)
470                 goto err;
471 
472         for (i = 0; i < len; i++) {
473                 rc = -ENOMEM;
474                 node = kzalloc(sizeof(*node), GFP_KERNEL);
475                 if (!node)
476                         goto err;
477 
478                 rc = cond_read_node(p, node, fp);
479                 if (rc)
480                         goto err;
481 
482                 if (i == 0)
483                         p->cond_list = node;
484                 else
485                         last->next = node;
486                 last = node;
487         }
488         return 0;
489 err:
490         cond_list_destroy(p->cond_list);
491         p->cond_list = NULL;
492         return rc;
493 }
494 
495 int cond_write_bool(void *vkey, void *datum, void *ptr)
496 {
497         char *key = vkey;
498         struct cond_bool_datum *booldatum = datum;
499         struct policy_data *pd = ptr;
500         void *fp = pd->fp;
501         __le32 buf[3];
502         u32 len;
503         int rc;
504 
505         len = strlen(key);
506         buf[0] = cpu_to_le32(booldatum->value);
507         buf[1] = cpu_to_le32(booldatum->state);
508         buf[2] = cpu_to_le32(len);
509         rc = put_entry(buf, sizeof(u32), 3, fp);
510         if (rc)
511                 return rc;
512         rc = put_entry(key, 1, len, fp);
513         if (rc)
514                 return rc;
515         return 0;
516 }
517 
518 /*
519  * cond_write_cond_av_list doesn't write out the av_list nodes.
520  * Instead it writes out the key/value pairs from the avtab. This
521  * is necessary because there is no way to uniquely identifying rules
522  * in the avtab so it is not possible to associate individual rules
523  * in the avtab with a conditional without saving them as part of
524  * the conditional. This means that the avtab with the conditional
525  * rules will not be saved but will be rebuilt on policy load.
526  */
527 static int cond_write_av_list(struct policydb *p,
528                               struct cond_av_list *list, struct policy_file *fp)
529 {
530         __le32 buf[1];
531         struct cond_av_list *cur_list;
532         u32 len;
533         int rc;
534 
535         len = 0;
536         for (cur_list = list; cur_list != NULL; cur_list = cur_list->next)
537                 len++;
538 
539         buf[0] = cpu_to_le32(len);
540         rc = put_entry(buf, sizeof(u32), 1, fp);
541         if (rc)
542                 return rc;
543 
544         if (len == 0)
545                 return 0;
546 
547         for (cur_list = list; cur_list != NULL; cur_list = cur_list->next) {
548                 rc = avtab_write_item(p, cur_list->node, fp);
549                 if (rc)
550                         return rc;
551         }
552 
553         return 0;
554 }
555 
556 static int cond_write_node(struct policydb *p, struct cond_node *node,
557                     struct policy_file *fp)
558 {
559         struct cond_expr *cur_expr;
560         __le32 buf[2];
561         int rc;
562         u32 len = 0;
563 
564         buf[0] = cpu_to_le32(node->cur_state);
565         rc = put_entry(buf, sizeof(u32), 1, fp);
566         if (rc)
567                 return rc;
568 
569         for (cur_expr = node->expr; cur_expr != NULL; cur_expr = cur_expr->next)
570                 len++;
571 
572         buf[0] = cpu_to_le32(len);
573         rc = put_entry(buf, sizeof(u32), 1, fp);
574         if (rc)
575                 return rc;
576 
577         for (cur_expr = node->expr; cur_expr != NULL; cur_expr = cur_expr->next) {
578                 buf[0] = cpu_to_le32(cur_expr->expr_type);
579                 buf[1] = cpu_to_le32(cur_expr->bool);
580                 rc = put_entry(buf, sizeof(u32), 2, fp);
581                 if (rc)
582                         return rc;
583         }
584 
585         rc = cond_write_av_list(p, node->true_list, fp);
586         if (rc)
587                 return rc;
588         rc = cond_write_av_list(p, node->false_list, fp);
589         if (rc)
590                 return rc;
591 
592         return 0;
593 }
594 
595 int cond_write_list(struct policydb *p, struct cond_node *list, void *fp)
596 {
597         struct cond_node *cur;
598         u32 len;
599         __le32 buf[1];
600         int rc;
601 
602         len = 0;
603         for (cur = list; cur != NULL; cur = cur->next)
604                 len++;
605         buf[0] = cpu_to_le32(len);
606         rc = put_entry(buf, sizeof(u32), 1, fp);
607         if (rc)
608                 return rc;
609 
610         for (cur = list; cur != NULL; cur = cur->next) {
611                 rc = cond_write_node(p, cur, fp);
612                 if (rc)
613                         return rc;
614         }
615 
616         return 0;
617 }
618 
619 void cond_compute_xperms(struct avtab *ctab, struct avtab_key *key,
620                 struct extended_perms_decision *xpermd)
621 {
622         struct avtab_node *node;
623 
624         if (!ctab || !key || !xpermd)
625                 return;
626 
627         for (node = avtab_search_node(ctab, key); node;
628                         node = avtab_search_node_next(node, key->specified)) {
629                 if (node->key.specified & AVTAB_ENABLED)
630                         services_compute_xperms_decision(xpermd, node);
631         }
632         return;
633 
634 }
635 /* Determine whether additional permissions are granted by the conditional
636  * av table, and if so, add them to the result
637  */
638 void cond_compute_av(struct avtab *ctab, struct avtab_key *key,
639                 struct av_decision *avd, struct extended_perms *xperms)
640 {
641         struct avtab_node *node;
642 
643         if (!ctab || !key || !avd)
644                 return;
645 
646         for (node = avtab_search_node(ctab, key); node;
647                                 node = avtab_search_node_next(node, key->specified)) {
648                 if ((u16)(AVTAB_ALLOWED|AVTAB_ENABLED) ==
649                     (node->key.specified & (AVTAB_ALLOWED|AVTAB_ENABLED)))
650                         avd->allowed |= node->datum.u.data;
651                 if ((u16)(AVTAB_AUDITDENY|AVTAB_ENABLED) ==
652                     (node->key.specified & (AVTAB_AUDITDENY|AVTAB_ENABLED)))
653                         /* Since a '' in an auditdeny mask represents a
654                          * permission we do NOT want to audit (dontaudit), we use
655                          * the '&' operand to ensure that all ''s in the mask
656                          * are retained (much unlike the allow and auditallow cases).
657                          */
658                         avd->auditdeny &= node->datum.u.data;
659                 if ((u16)(AVTAB_AUDITALLOW|AVTAB_ENABLED) ==
660                     (node->key.specified & (AVTAB_AUDITALLOW|AVTAB_ENABLED)))
661                         avd->auditallow |= node->datum.u.data;
662                 if (xperms && (node->key.specified & AVTAB_ENABLED) &&
663                                 (node->key.specified & AVTAB_XPERMS))
664                         services_compute_xperms_drivers(xperms, node);
665         }
666 }
667 

~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

kernel.org | git.kernel.org | LWN.net | Project Home | Wiki (Japanese) | Wiki (English) | SVN repository | Mail admin

Linux® is a registered trademark of Linus Torvalds in the United States and other countries.
TOMOYO® is a registered trademark of NTT DATA CORPORATION.

osdn.jp