Commit | Line | Data |
---|---|---|
1da177e4 | 1 | /* Authors: Karl MacMillan <kmacmillan@tresys.com> |
7c2b240e | 2 | * Frank Mayer <mayerf@tresys.com> |
1da177e4 LT |
3 | * |
4 | * Copyright (C) 2003 - 2004 Tresys Technology, LLC | |
5 | * This program is free software; you can redistribute it and/or modify | |
7c2b240e | 6 | * it under the terms of the GNU General Public License as published by |
1da177e4 LT |
7 | * the Free Software Foundation, version 2. |
8 | */ | |
9 | ||
10 | #include <linux/kernel.h> | |
11 | #include <linux/errno.h> | |
12 | #include <linux/string.h> | |
13 | #include <linux/spinlock.h> | |
1da177e4 LT |
14 | #include <linux/slab.h> |
15 | ||
16 | #include "security.h" | |
17 | #include "conditional.h" | |
18 | ||
19 | /* | |
20 | * cond_evaluate_expr evaluates a conditional expr | |
21 | * in reverse polish notation. It returns true (1), false (0), | |
22 | * or undefined (-1). Undefined occurs when the expression | |
23 | * exceeds the stack depth of COND_EXPR_MAXDEPTH. | |
24 | */ | |
25 | static int cond_evaluate_expr(struct policydb *p, struct cond_expr *expr) | |
26 | { | |
27 | ||
28 | struct cond_expr *cur; | |
29 | int s[COND_EXPR_MAXDEPTH]; | |
30 | int sp = -1; | |
31 | ||
dbc74c65 | 32 | for (cur = expr; cur; cur = cur->next) { |
1da177e4 LT |
33 | switch (cur->expr_type) { |
34 | case COND_BOOL: | |
35 | if (sp == (COND_EXPR_MAXDEPTH - 1)) | |
36 | return -1; | |
37 | sp++; | |
38 | s[sp] = p->bool_val_to_struct[cur->bool - 1]->state; | |
39 | break; | |
40 | case COND_NOT: | |
41 | if (sp < 0) | |
42 | return -1; | |
43 | s[sp] = !s[sp]; | |
44 | break; | |
45 | case COND_OR: | |
46 | if (sp < 1) | |
47 | return -1; | |
48 | sp--; | |
49 | s[sp] |= s[sp + 1]; | |
50 | break; | |
51 | case COND_AND: | |
52 | if (sp < 1) | |
53 | return -1; | |
54 | sp--; | |
55 | s[sp] &= s[sp + 1]; | |
56 | break; | |
57 | case COND_XOR: | |
58 | if (sp < 1) | |
59 | return -1; | |
60 | sp--; | |
61 | s[sp] ^= s[sp + 1]; | |
62 | break; | |
63 | case COND_EQ: | |
64 | if (sp < 1) | |
65 | return -1; | |
66 | sp--; | |
67 | s[sp] = (s[sp] == s[sp + 1]); | |
68 | break; | |
69 | case COND_NEQ: | |
70 | if (sp < 1) | |
71 | return -1; | |
72 | sp--; | |
73 | s[sp] = (s[sp] != s[sp + 1]); | |
74 | break; | |
75 | default: | |
76 | return -1; | |
77 | } | |
78 | } | |
79 | return s[0]; | |
80 | } | |
81 | ||
82 | /* | |
83 | * evaluate_cond_node evaluates the conditional stored in | |
84 | * a struct cond_node and if the result is different than the | |
85 | * current state of the node it sets the rules in the true/false | |
86 | * list appropriately. If the result of the expression is undefined | |
87 | * all of the rules are disabled for safety. | |
88 | */ | |
89 | int evaluate_cond_node(struct policydb *p, struct cond_node *node) | |
90 | { | |
91 | int new_state; | |
7c2b240e | 92 | struct cond_av_list *cur; |
1da177e4 LT |
93 | |
94 | new_state = cond_evaluate_expr(p, node->expr); | |
95 | if (new_state != node->cur_state) { | |
96 | node->cur_state = new_state; | |
97 | if (new_state == -1) | |
454d972c | 98 | printk(KERN_ERR "SELinux: expression result was undefined - disabling all rules.\n"); |
1da177e4 | 99 | /* turn the rules on or off */ |
dbc74c65 | 100 | for (cur = node->true_list; cur; cur = cur->next) { |
7c2b240e | 101 | if (new_state <= 0) |
782ebb99 | 102 | cur->node->key.specified &= ~AVTAB_ENABLED; |
7c2b240e | 103 | else |
782ebb99 | 104 | cur->node->key.specified |= AVTAB_ENABLED; |
1da177e4 LT |
105 | } |
106 | ||
dbc74c65 | 107 | for (cur = node->false_list; cur; cur = cur->next) { |
1da177e4 | 108 | /* -1 or 1 */ |
7c2b240e | 109 | if (new_state) |
782ebb99 | 110 | cur->node->key.specified &= ~AVTAB_ENABLED; |
7c2b240e | 111 | else |
782ebb99 | 112 | cur->node->key.specified |= AVTAB_ENABLED; |
1da177e4 LT |
113 | } |
114 | } | |
115 | return 0; | |
116 | } | |
117 | ||
118 | int cond_policydb_init(struct policydb *p) | |
119 | { | |
120 | p->bool_val_to_struct = NULL; | |
121 | p->cond_list = NULL; | |
122 | if (avtab_init(&p->te_cond_avtab)) | |
123 | return -1; | |
124 | ||
125 | return 0; | |
126 | } | |
127 | ||
128 | static void cond_av_list_destroy(struct cond_av_list *list) | |
129 | { | |
130 | struct cond_av_list *cur, *next; | |
dbc74c65 | 131 | for (cur = list; cur; cur = next) { |
1da177e4 LT |
132 | next = cur->next; |
133 | /* the avtab_ptr_t node is destroy by the avtab */ | |
134 | kfree(cur); | |
135 | } | |
136 | } | |
137 | ||
138 | static void cond_node_destroy(struct cond_node *node) | |
139 | { | |
140 | struct cond_expr *cur_expr, *next_expr; | |
141 | ||
dbc74c65 | 142 | for (cur_expr = node->expr; cur_expr; cur_expr = next_expr) { |
1da177e4 LT |
143 | next_expr = cur_expr->next; |
144 | kfree(cur_expr); | |
145 | } | |
146 | cond_av_list_destroy(node->true_list); | |
147 | cond_av_list_destroy(node->false_list); | |
148 | kfree(node); | |
149 | } | |
150 | ||
151 | static void cond_list_destroy(struct cond_node *list) | |
152 | { | |
153 | struct cond_node *next, *cur; | |
154 | ||
155 | if (list == NULL) | |
156 | return; | |
157 | ||
dbc74c65 | 158 | for (cur = list; cur; cur = next) { |
1da177e4 LT |
159 | next = cur->next; |
160 | cond_node_destroy(cur); | |
161 | } | |
162 | } | |
163 | ||
164 | void cond_policydb_destroy(struct policydb *p) | |
165 | { | |
9a5f04bf | 166 | kfree(p->bool_val_to_struct); |
1da177e4 LT |
167 | avtab_destroy(&p->te_cond_avtab); |
168 | cond_list_destroy(p->cond_list); | |
169 | } | |
170 | ||
171 | int cond_init_bool_indexes(struct policydb *p) | |
172 | { | |
9a5f04bf | 173 | kfree(p->bool_val_to_struct); |
7c2b240e EP |
174 | p->bool_val_to_struct = (struct cond_bool_datum **) |
175 | kmalloc(p->p_bools.nprim * sizeof(struct cond_bool_datum *), GFP_KERNEL); | |
1da177e4 LT |
176 | if (!p->bool_val_to_struct) |
177 | return -1; | |
178 | return 0; | |
179 | } | |
180 | ||
181 | int cond_destroy_bool(void *key, void *datum, void *p) | |
182 | { | |
9a5f04bf | 183 | kfree(key); |
1da177e4 LT |
184 | kfree(datum); |
185 | return 0; | |
186 | } | |
187 | ||
188 | int cond_index_bool(void *key, void *datum, void *datap) | |
189 | { | |
190 | struct policydb *p; | |
191 | struct cond_bool_datum *booldatum; | |
192 | ||
193 | booldatum = datum; | |
194 | p = datap; | |
195 | ||
196 | if (!booldatum->value || booldatum->value > p->p_bools.nprim) | |
197 | return -EINVAL; | |
198 | ||
199 | p->p_bool_val_to_name[booldatum->value - 1] = key; | |
7c2b240e | 200 | p->bool_val_to_struct[booldatum->value - 1] = booldatum; |
1da177e4 LT |
201 | |
202 | return 0; | |
203 | } | |
204 | ||
205 | static int bool_isvalid(struct cond_bool_datum *b) | |
206 | { | |
207 | if (!(b->state == 0 || b->state == 1)) | |
208 | return 0; | |
209 | return 1; | |
210 | } | |
211 | ||
212 | int cond_read_bool(struct policydb *p, struct hashtab *h, void *fp) | |
213 | { | |
214 | char *key = NULL; | |
215 | struct cond_bool_datum *booldatum; | |
b5bf6c55 AD |
216 | __le32 buf[3]; |
217 | u32 len; | |
1da177e4 LT |
218 | int rc; |
219 | ||
89d155ef | 220 | booldatum = kzalloc(sizeof(struct cond_bool_datum), GFP_KERNEL); |
1da177e4 LT |
221 | if (!booldatum) |
222 | return -1; | |
1da177e4 LT |
223 | |
224 | rc = next_entry(buf, fp, sizeof buf); | |
225 | if (rc < 0) | |
226 | goto err; | |
227 | ||
228 | booldatum->value = le32_to_cpu(buf[0]); | |
229 | booldatum->state = le32_to_cpu(buf[1]); | |
230 | ||
231 | if (!bool_isvalid(booldatum)) | |
232 | goto err; | |
233 | ||
234 | len = le32_to_cpu(buf[2]); | |
235 | ||
236 | key = kmalloc(len + 1, GFP_KERNEL); | |
237 | if (!key) | |
238 | goto err; | |
239 | rc = next_entry(key, fp, len); | |
240 | if (rc < 0) | |
241 | goto err; | |
df4ea865 | 242 | key[len] = '\0'; |
1da177e4 LT |
243 | if (hashtab_insert(h, key, booldatum)) |
244 | goto err; | |
245 | ||
246 | return 0; | |
247 | err: | |
248 | cond_destroy_bool(key, booldatum, NULL); | |
249 | return -1; | |
250 | } | |
251 | ||
7c2b240e | 252 | struct cond_insertf_data { |
782ebb99 SS |
253 | struct policydb *p; |
254 | struct cond_av_list *other; | |
255 | struct cond_av_list *head; | |
256 | struct cond_av_list *tail; | |
257 | }; | |
258 | ||
259 | static int cond_insertf(struct avtab *a, struct avtab_key *k, struct avtab_datum *d, void *ptr) | |
260 | { | |
261 | struct cond_insertf_data *data = ptr; | |
262 | struct policydb *p = data->p; | |
263 | struct cond_av_list *other = data->other, *list, *cur; | |
1da177e4 | 264 | struct avtab_node *node_ptr; |
1da177e4 | 265 | u8 found; |
9d623b17 | 266 | int rc = -EINVAL; |
1da177e4 | 267 | |
782ebb99 SS |
268 | /* |
269 | * For type rules we have to make certain there aren't any | |
270 | * conflicting rules by searching the te_avtab and the | |
271 | * cond_te_avtab. | |
272 | */ | |
273 | if (k->specified & AVTAB_TYPE) { | |
274 | if (avtab_search(&p->te_avtab, k)) { | |
744ba35e | 275 | printk(KERN_ERR "SELinux: type rule already exists outside of a conditional.\n"); |
1da177e4 | 276 | goto err; |
782ebb99 | 277 | } |
1da177e4 | 278 | /* |
782ebb99 SS |
279 | * If we are reading the false list other will be a pointer to |
280 | * the true list. We can have duplicate entries if there is only | |
281 | * 1 other entry and it is in our true list. | |
282 | * | |
283 | * If we are reading the true list (other == NULL) there shouldn't | |
284 | * be any other entries. | |
1da177e4 | 285 | */ |
782ebb99 SS |
286 | if (other) { |
287 | node_ptr = avtab_search_node(&p->te_cond_avtab, k); | |
288 | if (node_ptr) { | |
289 | if (avtab_search_node_next(node_ptr, k->specified)) { | |
744ba35e | 290 | printk(KERN_ERR "SELinux: too many conflicting type rules.\n"); |
782ebb99 SS |
291 | goto err; |
292 | } | |
293 | found = 0; | |
dbc74c65 | 294 | for (cur = other; cur; cur = cur->next) { |
782ebb99 SS |
295 | if (cur->node == node_ptr) { |
296 | found = 1; | |
297 | break; | |
1da177e4 LT |
298 | } |
299 | } | |
782ebb99 | 300 | if (!found) { |
744ba35e | 301 | printk(KERN_ERR "SELinux: conflicting type rules.\n"); |
1da177e4 LT |
302 | goto err; |
303 | } | |
304 | } | |
782ebb99 SS |
305 | } else { |
306 | if (avtab_search(&p->te_cond_avtab, k)) { | |
744ba35e | 307 | printk(KERN_ERR "SELinux: conflicting type rules when adding type rule for true.\n"); |
782ebb99 SS |
308 | goto err; |
309 | } | |
1da177e4 | 310 | } |
782ebb99 | 311 | } |
1da177e4 | 312 | |
782ebb99 SS |
313 | node_ptr = avtab_insert_nonunique(&p->te_cond_avtab, k, d); |
314 | if (!node_ptr) { | |
744ba35e | 315 | printk(KERN_ERR "SELinux: could not insert rule.\n"); |
9d623b17 | 316 | rc = -ENOMEM; |
782ebb99 | 317 | goto err; |
1da177e4 LT |
318 | } |
319 | ||
89d155ef | 320 | list = kzalloc(sizeof(struct cond_av_list), GFP_KERNEL); |
9d623b17 DC |
321 | if (!list) { |
322 | rc = -ENOMEM; | |
782ebb99 | 323 | goto err; |
9d623b17 | 324 | } |
782ebb99 SS |
325 | |
326 | list->node = node_ptr; | |
327 | if (!data->head) | |
328 | data->head = list; | |
329 | else | |
330 | data->tail->next = list; | |
331 | data->tail = list; | |
1da177e4 | 332 | return 0; |
782ebb99 | 333 | |
1da177e4 | 334 | err: |
782ebb99 SS |
335 | cond_av_list_destroy(data->head); |
336 | data->head = NULL; | |
9d623b17 | 337 | return rc; |
1da177e4 LT |
338 | } |
339 | ||
782ebb99 SS |
340 | static int cond_read_av_list(struct policydb *p, void *fp, struct cond_av_list **ret_list, struct cond_av_list *other) |
341 | { | |
342 | int i, rc; | |
b5bf6c55 AD |
343 | __le32 buf[1]; |
344 | u32 len; | |
782ebb99 SS |
345 | struct cond_insertf_data data; |
346 | ||
347 | *ret_list = NULL; | |
348 | ||
349 | len = 0; | |
350 | rc = next_entry(buf, fp, sizeof(u32)); | |
9d623b17 DC |
351 | if (rc) |
352 | return rc; | |
782ebb99 SS |
353 | |
354 | len = le32_to_cpu(buf[0]); | |
7c2b240e | 355 | if (len == 0) |
782ebb99 | 356 | return 0; |
782ebb99 SS |
357 | |
358 | data.p = p; | |
359 | data.other = other; | |
360 | data.head = NULL; | |
361 | data.tail = NULL; | |
362 | for (i = 0; i < len; i++) { | |
45e5421e SS |
363 | rc = avtab_read_item(&p->te_cond_avtab, fp, p, cond_insertf, |
364 | &data); | |
782ebb99 SS |
365 | if (rc) |
366 | return rc; | |
782ebb99 SS |
367 | } |
368 | ||
369 | *ret_list = data.head; | |
370 | return 0; | |
371 | } | |
372 | ||
1da177e4 LT |
373 | static int expr_isvalid(struct policydb *p, struct cond_expr *expr) |
374 | { | |
375 | if (expr->expr_type <= 0 || expr->expr_type > COND_LAST) { | |
744ba35e | 376 | printk(KERN_ERR "SELinux: conditional expressions uses unknown operator.\n"); |
1da177e4 LT |
377 | return 0; |
378 | } | |
379 | ||
380 | if (expr->bool > p->p_bools.nprim) { | |
744ba35e | 381 | printk(KERN_ERR "SELinux: conditional expressions uses unknown bool.\n"); |
1da177e4 LT |
382 | return 0; |
383 | } | |
384 | return 1; | |
385 | } | |
386 | ||
387 | static int cond_read_node(struct policydb *p, struct cond_node *node, void *fp) | |
388 | { | |
b5bf6c55 AD |
389 | __le32 buf[2]; |
390 | u32 len, i; | |
1da177e4 LT |
391 | int rc; |
392 | struct cond_expr *expr = NULL, *last = NULL; | |
393 | ||
394 | rc = next_entry(buf, fp, sizeof(u32)); | |
fc5c126e DC |
395 | if (rc) |
396 | return rc; | |
1da177e4 LT |
397 | |
398 | node->cur_state = le32_to_cpu(buf[0]); | |
399 | ||
400 | len = 0; | |
401 | rc = next_entry(buf, fp, sizeof(u32)); | |
fc5c126e DC |
402 | if (rc) |
403 | return rc; | |
1da177e4 LT |
404 | |
405 | /* expr */ | |
406 | len = le32_to_cpu(buf[0]); | |
407 | ||
7c2b240e | 408 | for (i = 0; i < len; i++) { |
1da177e4 | 409 | rc = next_entry(buf, fp, sizeof(u32) * 2); |
fc5c126e | 410 | if (rc) |
1da177e4 LT |
411 | goto err; |
412 | ||
fc5c126e | 413 | rc = -ENOMEM; |
89d155ef | 414 | expr = kzalloc(sizeof(struct cond_expr), GFP_KERNEL); |
7c2b240e | 415 | if (!expr) |
1da177e4 | 416 | goto err; |
1da177e4 LT |
417 | |
418 | expr->expr_type = le32_to_cpu(buf[0]); | |
419 | expr->bool = le32_to_cpu(buf[1]); | |
420 | ||
421 | if (!expr_isvalid(p, expr)) { | |
fc5c126e | 422 | rc = -EINVAL; |
1da177e4 LT |
423 | kfree(expr); |
424 | goto err; | |
425 | } | |
426 | ||
7c2b240e | 427 | if (i == 0) |
1da177e4 | 428 | node->expr = expr; |
7c2b240e | 429 | else |
1da177e4 | 430 | last->next = expr; |
1da177e4 LT |
431 | last = expr; |
432 | } | |
433 | ||
fc5c126e DC |
434 | rc = cond_read_av_list(p, fp, &node->true_list, NULL); |
435 | if (rc) | |
1da177e4 | 436 | goto err; |
fc5c126e DC |
437 | rc = cond_read_av_list(p, fp, &node->false_list, node->true_list); |
438 | if (rc) | |
1da177e4 LT |
439 | goto err; |
440 | return 0; | |
441 | err: | |
442 | cond_node_destroy(node); | |
fc5c126e | 443 | return rc; |
1da177e4 LT |
444 | } |
445 | ||
446 | int cond_read_list(struct policydb *p, void *fp) | |
447 | { | |
448 | struct cond_node *node, *last = NULL; | |
b5bf6c55 AD |
449 | __le32 buf[1]; |
450 | u32 i, len; | |
1da177e4 LT |
451 | int rc; |
452 | ||
453 | rc = next_entry(buf, fp, sizeof buf); | |
5241c107 DC |
454 | if (rc) |
455 | return rc; | |
1da177e4 LT |
456 | |
457 | len = le32_to_cpu(buf[0]); | |
458 | ||
3232c110 YN |
459 | rc = avtab_alloc(&(p->te_cond_avtab), p->te_avtab.nel); |
460 | if (rc) | |
461 | goto err; | |
462 | ||
1da177e4 | 463 | for (i = 0; i < len; i++) { |
5241c107 | 464 | rc = -ENOMEM; |
89d155ef | 465 | node = kzalloc(sizeof(struct cond_node), GFP_KERNEL); |
1da177e4 LT |
466 | if (!node) |
467 | goto err; | |
1da177e4 | 468 | |
5241c107 DC |
469 | rc = cond_read_node(p, node, fp); |
470 | if (rc) | |
1da177e4 LT |
471 | goto err; |
472 | ||
7c2b240e | 473 | if (i == 0) |
1da177e4 | 474 | p->cond_list = node; |
7c2b240e | 475 | else |
1da177e4 | 476 | last->next = node; |
1da177e4 LT |
477 | last = node; |
478 | } | |
479 | return 0; | |
480 | err: | |
481 | cond_list_destroy(p->cond_list); | |
782ebb99 | 482 | p->cond_list = NULL; |
5241c107 | 483 | return rc; |
1da177e4 LT |
484 | } |
485 | ||
486 | /* Determine whether additional permissions are granted by the conditional | |
487 | * av table, and if so, add them to the result | |
488 | */ | |
489 | void cond_compute_av(struct avtab *ctab, struct avtab_key *key, struct av_decision *avd) | |
490 | { | |
491 | struct avtab_node *node; | |
492 | ||
7c2b240e | 493 | if (!ctab || !key || !avd) |
1da177e4 LT |
494 | return; |
495 | ||
dbc74c65 | 496 | for (node = avtab_search_node(ctab, key); node; |
782ebb99 | 497 | node = avtab_search_node_next(node, key->specified)) { |
7c2b240e EP |
498 | if ((u16)(AVTAB_ALLOWED|AVTAB_ENABLED) == |
499 | (node->key.specified & (AVTAB_ALLOWED|AVTAB_ENABLED))) | |
782ebb99 | 500 | avd->allowed |= node->datum.data; |
7c2b240e EP |
501 | if ((u16)(AVTAB_AUDITDENY|AVTAB_ENABLED) == |
502 | (node->key.specified & (AVTAB_AUDITDENY|AVTAB_ENABLED))) | |
1da177e4 LT |
503 | /* Since a '0' in an auditdeny mask represents a |
504 | * permission we do NOT want to audit (dontaudit), we use | |
505 | * the '&' operand to ensure that all '0's in the mask | |
506 | * are retained (much unlike the allow and auditallow cases). | |
507 | */ | |
782ebb99 | 508 | avd->auditdeny &= node->datum.data; |
7c2b240e EP |
509 | if ((u16)(AVTAB_AUDITALLOW|AVTAB_ENABLED) == |
510 | (node->key.specified & (AVTAB_AUDITALLOW|AVTAB_ENABLED))) | |
782ebb99 | 511 | avd->auditallow |= node->datum.data; |
1da177e4 LT |
512 | } |
513 | return; | |
514 | } |