1/* Authors: Karl MacMillan <kmacmillan@tresys.com> 2 * Frank Mayer <mayerf@tresys.com> 3 * 4 * Copyright (C) 2003 - 2004 Tresys Technology, LLC 5 * This program is free software; you can redistribute it and/or modify 6 * it under the terms of the GNU General Public License as published by 7 * the Free Software Foundation, version 2. 8 */ 9 10#include <linux/kernel.h> 11#include <linux/errno.h> 12#include <linux/string.h> 13#include <linux/spinlock.h> 14#include <linux/slab.h> 15 16#include "security.h" 17#include "conditional.h" 18 19/* 20 * cond_evaluate_expr evaluates a conditional expr 21 * in reverse polish notation. It returns true (1), false (0), 22 * or undefined (-1). Undefined occurs when the expression 23 * exceeds the stack depth of COND_EXPR_MAXDEPTH. 24 */ 25static int cond_evaluate_expr(struct policydb *p, struct cond_expr *expr) 26{ 27 28 struct cond_expr *cur; 29 int s[COND_EXPR_MAXDEPTH]; 30 int sp = -1; 31 32 for (cur = expr; cur; cur = cur->next) { 33 switch (cur->expr_type) { 34 case COND_BOOL: 35 if (sp == (COND_EXPR_MAXDEPTH - 1)) 36 return -1; 37 sp++; 38 s[sp] = p->bool_val_to_struct[cur->bool - 1]->state; 39 break; 40 case COND_NOT: 41 if (sp < 0) 42 return -1; 43 s[sp] = !s[sp]; 44 break; 45 case COND_OR: 46 if (sp < 1) 47 return -1; 48 sp--; 49 s[sp] |= s[sp + 1]; 50 break; 51 case COND_AND: 52 if (sp < 1) 53 return -1; 54 sp--; 55 s[sp] &= s[sp + 1]; 56 break; 57 case COND_XOR: 58 if (sp < 1) 59 return -1; 60 sp--; 61 s[sp] ^= s[sp + 1]; 62 break; 63 case COND_EQ: 64 if (sp < 1) 65 return -1; 66 sp--; 67 s[sp] = (s[sp] == s[sp + 1]); 68 break; 69 case COND_NEQ: 70 if (sp < 1) 71 return -1; 72 sp--; 73 s[sp] = (s[sp] != s[sp + 1]); 74 break; 75 default: 76 return -1; 77 } 78 } 79 return s[0]; 80} 81 82/* 83 * evaluate_cond_node evaluates the conditional stored in 84 * a struct cond_node and if the result is different than the 85 * current state of the node it sets the rules in the true/false 86 * list appropriately. If the result of the expression is undefined 87 * all of the rules are disabled for safety. 88 */ 89int evaluate_cond_node(struct policydb *p, struct cond_node *node) 90{ 91 int new_state; 92 struct cond_av_list *cur; 93 94 new_state = cond_evaluate_expr(p, node->expr); 95 if (new_state != node->cur_state) { 96 node->cur_state = new_state; 97 if (new_state == -1) 98 printk(KERN_ERR "SELinux: expression result was undefined - disabling all rules.\n"); 99 /* turn the rules on or off */ 100 for (cur = node->true_list; cur; cur = cur->next) { 101 if (new_state <= 0) 102 cur->node->key.specified &= ~AVTAB_ENABLED; 103 else 104 cur->node->key.specified |= AVTAB_ENABLED; 105 } 106 107 for (cur = node->false_list; cur; cur = cur->next) { 108 /* -1 or 1 */ 109 if (new_state) 110 cur->node->key.specified &= ~AVTAB_ENABLED; 111 else 112 cur->node->key.specified |= AVTAB_ENABLED; 113 } 114 } 115 return 0; 116} 117 118int cond_policydb_init(struct policydb *p) 119{ 120 int rc; 121 122 p->bool_val_to_struct = NULL; 123 p->cond_list = NULL; 124 125 rc = avtab_init(&p->te_cond_avtab); 126 if (rc) 127 return rc; 128 129 return 0; 130} 131 132static void cond_av_list_destroy(struct cond_av_list *list) 133{ 134 struct cond_av_list *cur, *next; 135 for (cur = list; cur; cur = next) { 136 next = cur->next; 137 /* the avtab_ptr_t node is destroy by the avtab */ 138 kfree(cur); 139 } 140} 141 142static void cond_node_destroy(struct cond_node *node) 143{ 144 struct cond_expr *cur_expr, *next_expr; 145 146 for (cur_expr = node->expr; cur_expr; cur_expr = next_expr) { 147 next_expr = cur_expr->next; 148 kfree(cur_expr); 149 } 150 cond_av_list_destroy(node->true_list); 151 cond_av_list_destroy(node->false_list); 152 kfree(node); 153} 154 155static void cond_list_destroy(struct cond_node *list) 156{ 157 struct cond_node *next, *cur; 158 159 if (list == NULL) 160 return; 161 162 for (cur = list; cur; cur = next) { 163 next = cur->next; 164 cond_node_destroy(cur); 165 } 166} 167 168void cond_policydb_destroy(struct policydb *p) 169{ 170 kfree(p->bool_val_to_struct); 171 avtab_destroy(&p->te_cond_avtab); 172 cond_list_destroy(p->cond_list); 173} 174 175int cond_init_bool_indexes(struct policydb *p) 176{ 177 kfree(p->bool_val_to_struct); 178 p->bool_val_to_struct = 179 kmalloc(p->p_bools.nprim * sizeof(struct cond_bool_datum *), GFP_KERNEL); 180 if (!p->bool_val_to_struct) 181 return -ENOMEM; 182 return 0; 183} 184 185int cond_destroy_bool(void *key, void *datum, void *p) 186{ 187 kfree(key); 188 kfree(datum); 189 return 0; 190} 191 192int cond_index_bool(void *key, void *datum, void *datap) 193{ 194 struct policydb *p; 195 struct cond_bool_datum *booldatum; 196 struct flex_array *fa; 197 198 booldatum = datum; 199 p = datap; 200 201 if (!booldatum->value || booldatum->value > p->p_bools.nprim) 202 return -EINVAL; 203 204 fa = p->sym_val_to_name[SYM_BOOLS]; 205 if (flex_array_put_ptr(fa, booldatum->value - 1, key, 206 GFP_KERNEL | __GFP_ZERO)) 207 BUG(); 208 p->bool_val_to_struct[booldatum->value - 1] = booldatum; 209 210 return 0; 211} 212 213static int bool_isvalid(struct cond_bool_datum *b) 214{ 215 if (!(b->state == 0 || b->state == 1)) 216 return 0; 217 return 1; 218} 219 220int cond_read_bool(struct policydb *p, struct hashtab *h, void *fp) 221{ 222 char *key = NULL; 223 struct cond_bool_datum *booldatum; 224 __le32 buf[3]; 225 u32 len; 226 int rc; 227 228 booldatum = kzalloc(sizeof(struct cond_bool_datum), GFP_KERNEL); 229 if (!booldatum) 230 return -ENOMEM; 231 232 rc = next_entry(buf, fp, sizeof buf); 233 if (rc) 234 goto err; 235 236 booldatum->value = le32_to_cpu(buf[0]); 237 booldatum->state = le32_to_cpu(buf[1]); 238 239 rc = -EINVAL; 240 if (!bool_isvalid(booldatum)) 241 goto err; 242 243 len = le32_to_cpu(buf[2]); 244 245 rc = -ENOMEM; 246 key = kmalloc(len + 1, GFP_KERNEL); 247 if (!key) 248 goto err; 249 rc = next_entry(key, fp, len); 250 if (rc) 251 goto err; 252 key[len] = '\0'; 253 rc = hashtab_insert(h, key, booldatum); 254 if (rc) 255 goto err; 256 257 return 0; 258err: 259 cond_destroy_bool(key, booldatum, NULL); 260 return rc; 261} 262 263struct cond_insertf_data { 264 struct policydb *p; 265 struct cond_av_list *other; 266 struct cond_av_list *head; 267 struct cond_av_list *tail; 268}; 269 270static int cond_insertf(struct avtab *a, struct avtab_key *k, struct avtab_datum *d, void *ptr) 271{ 272 struct cond_insertf_data *data = ptr; 273 struct policydb *p = data->p; 274 struct cond_av_list *other = data->other, *list, *cur; 275 struct avtab_node *node_ptr; 276 u8 found; 277 int rc = -EINVAL; 278 279 /* 280 * For type rules we have to make certain there aren't any 281 * conflicting rules by searching the te_avtab and the 282 * cond_te_avtab. 283 */ 284 if (k->specified & AVTAB_TYPE) { 285 if (avtab_search(&p->te_avtab, k)) { 286 printk(KERN_ERR "SELinux: type rule already exists outside of a conditional.\n"); 287 goto err; 288 } 289 /* 290 * If we are reading the false list other will be a pointer to 291 * the true list. We can have duplicate entries if there is only 292 * 1 other entry and it is in our true list. 293 * 294 * If we are reading the true list (other == NULL) there shouldn't 295 * be any other entries. 296 */ 297 if (other) { 298 node_ptr = avtab_search_node(&p->te_cond_avtab, k); 299 if (node_ptr) { 300 if (avtab_search_node_next(node_ptr, k->specified)) { 301 printk(KERN_ERR "SELinux: too many conflicting type rules.\n"); 302 goto err; 303 } 304 found = 0; 305 for (cur = other; cur; cur = cur->next) { 306 if (cur->node == node_ptr) { 307 found = 1; 308 break; 309 } 310 } 311 if (!found) { 312 printk(KERN_ERR "SELinux: conflicting type rules.\n"); 313 goto err; 314 } 315 } 316 } else { 317 if (avtab_search(&p->te_cond_avtab, k)) { 318 printk(KERN_ERR "SELinux: conflicting type rules when adding type rule for true.\n"); 319 goto err; 320 } 321 } 322 } 323 324 node_ptr = avtab_insert_nonunique(&p->te_cond_avtab, k, d); 325 if (!node_ptr) { 326 printk(KERN_ERR "SELinux: could not insert rule.\n"); 327 rc = -ENOMEM; 328 goto err; 329 } 330 331 list = kzalloc(sizeof(struct cond_av_list), GFP_KERNEL); 332 if (!list) { 333 rc = -ENOMEM; 334 goto err; 335 } 336 337 list->node = node_ptr; 338 if (!data->head) 339 data->head = list; 340 else 341 data->tail->next = list; 342 data->tail = list; 343 return 0; 344 345err: 346 cond_av_list_destroy(data->head); 347 data->head = NULL; 348 return rc; 349} 350 351static int cond_read_av_list(struct policydb *p, void *fp, struct cond_av_list **ret_list, struct cond_av_list *other) 352{ 353 int i, rc; 354 __le32 buf[1]; 355 u32 len; 356 struct cond_insertf_data data; 357 358 *ret_list = NULL; 359 360 len = 0; 361 rc = next_entry(buf, fp, sizeof(u32)); 362 if (rc) 363 return rc; 364 365 len = le32_to_cpu(buf[0]); 366 if (len == 0) 367 return 0; 368 369 data.p = p; 370 data.other = other; 371 data.head = NULL; 372 data.tail = NULL; 373 for (i = 0; i < len; i++) { 374 rc = avtab_read_item(&p->te_cond_avtab, fp, p, cond_insertf, 375 &data); 376 if (rc) 377 return rc; 378 } 379 380 *ret_list = data.head; 381 return 0; 382} 383 384static int expr_isvalid(struct policydb *p, struct cond_expr *expr) 385{ 386 if (expr->expr_type <= 0 || expr->expr_type > COND_LAST) { 387 printk(KERN_ERR "SELinux: conditional expressions uses unknown operator.\n"); 388 return 0; 389 } 390 391 if (expr->bool > p->p_bools.nprim) { 392 printk(KERN_ERR "SELinux: conditional expressions uses unknown bool.\n"); 393 return 0; 394 } 395 return 1; 396} 397 398static int cond_read_node(struct policydb *p, struct cond_node *node, void *fp) 399{ 400 __le32 buf[2]; 401 u32 len, i; 402 int rc; 403 struct cond_expr *expr = NULL, *last = NULL; 404 405 rc = next_entry(buf, fp, sizeof(u32) * 2); 406 if (rc) 407 goto err; 408 409 node->cur_state = le32_to_cpu(buf[0]); 410 411 /* expr */ 412 len = le32_to_cpu(buf[1]); 413 414 for (i = 0; i < len; i++) { 415 rc = next_entry(buf, fp, sizeof(u32) * 2); 416 if (rc) 417 goto err; 418 419 rc = -ENOMEM; 420 expr = kzalloc(sizeof(struct cond_expr), GFP_KERNEL); 421 if (!expr) 422 goto err; 423 424 expr->expr_type = le32_to_cpu(buf[0]); 425 expr->bool = le32_to_cpu(buf[1]); 426 427 if (!expr_isvalid(p, expr)) { 428 rc = -EINVAL; 429 kfree(expr); 430 goto err; 431 } 432 433 if (i == 0) 434 node->expr = expr; 435 else 436 last->next = expr; 437 last = expr; 438 } 439 440 rc = cond_read_av_list(p, fp, &node->true_list, NULL); 441 if (rc) 442 goto err; 443 rc = cond_read_av_list(p, fp, &node->false_list, node->true_list); 444 if (rc) 445 goto err; 446 return 0; 447err: 448 cond_node_destroy(node); 449 return rc; 450} 451 452int cond_read_list(struct policydb *p, void *fp) 453{ 454 struct cond_node *node, *last = NULL; 455 __le32 buf[1]; 456 u32 i, len; 457 int rc; 458 459 rc = next_entry(buf, fp, sizeof buf); 460 if (rc) 461 return rc; 462 463 len = le32_to_cpu(buf[0]); 464 465 rc = avtab_alloc(&(p->te_cond_avtab), p->te_avtab.nel); 466 if (rc) 467 goto err; 468 469 for (i = 0; i < len; i++) { 470 rc = -ENOMEM; 471 node = kzalloc(sizeof(struct cond_node), GFP_KERNEL); 472 if (!node) 473 goto err; 474 475 rc = cond_read_node(p, node, fp); 476 if (rc) 477 goto err; 478 479 if (i == 0) 480 p->cond_list = node; 481 else 482 last->next = node; 483 last = node; 484 } 485 return 0; 486err: 487 cond_list_destroy(p->cond_list); 488 p->cond_list = NULL; 489 return rc; 490} 491 492int cond_write_bool(void *vkey, void *datum, void *ptr) 493{ 494 char *key = vkey; 495 struct cond_bool_datum *booldatum = datum; 496 struct policy_data *pd = ptr; 497 void *fp = pd->fp; 498 __le32 buf[3]; 499 u32 len; 500 int rc; 501 502 len = strlen(key); 503 buf[0] = cpu_to_le32(booldatum->value); 504 buf[1] = cpu_to_le32(booldatum->state); 505 buf[2] = cpu_to_le32(len); 506 rc = put_entry(buf, sizeof(u32), 3, fp); 507 if (rc) 508 return rc; 509 rc = put_entry(key, 1, len, fp); 510 if (rc) 511 return rc; 512 return 0; 513} 514 515/* 516 * cond_write_cond_av_list doesn't write out the av_list nodes. 517 * Instead it writes out the key/value pairs from the avtab. This 518 * is necessary because there is no way to uniquely identifying rules 519 * in the avtab so it is not possible to associate individual rules 520 * in the avtab with a conditional without saving them as part of 521 * the conditional. This means that the avtab with the conditional 522 * rules will not be saved but will be rebuilt on policy load. 523 */ 524static int cond_write_av_list(struct policydb *p, 525 struct cond_av_list *list, struct policy_file *fp) 526{ 527 __le32 buf[1]; 528 struct cond_av_list *cur_list; 529 u32 len; 530 int rc; 531 532 len = 0; 533 for (cur_list = list; cur_list != NULL; cur_list = cur_list->next) 534 len++; 535 536 buf[0] = cpu_to_le32(len); 537 rc = put_entry(buf, sizeof(u32), 1, fp); 538 if (rc) 539 return rc; 540 541 if (len == 0) 542 return 0; 543 544 for (cur_list = list; cur_list != NULL; cur_list = cur_list->next) { 545 rc = avtab_write_item(p, cur_list->node, fp); 546 if (rc) 547 return rc; 548 } 549 550 return 0; 551} 552 553static int cond_write_node(struct policydb *p, struct cond_node *node, 554 struct policy_file *fp) 555{ 556 struct cond_expr *cur_expr; 557 __le32 buf[2]; 558 int rc; 559 u32 len = 0; 560 561 buf[0] = cpu_to_le32(node->cur_state); 562 rc = put_entry(buf, sizeof(u32), 1, fp); 563 if (rc) 564 return rc; 565 566 for (cur_expr = node->expr; cur_expr != NULL; cur_expr = cur_expr->next) 567 len++; 568 569 buf[0] = cpu_to_le32(len); 570 rc = put_entry(buf, sizeof(u32), 1, fp); 571 if (rc) 572 return rc; 573 574 for (cur_expr = node->expr; cur_expr != NULL; cur_expr = cur_expr->next) { 575 buf[0] = cpu_to_le32(cur_expr->expr_type); 576 buf[1] = cpu_to_le32(cur_expr->bool); 577 rc = put_entry(buf, sizeof(u32), 2, fp); 578 if (rc) 579 return rc; 580 } 581 582 rc = cond_write_av_list(p, node->true_list, fp); 583 if (rc) 584 return rc; 585 rc = cond_write_av_list(p, node->false_list, fp); 586 if (rc) 587 return rc; 588 589 return 0; 590} 591 592int cond_write_list(struct policydb *p, struct cond_node *list, void *fp) 593{ 594 struct cond_node *cur; 595 u32 len; 596 __le32 buf[1]; 597 int rc; 598 599 len = 0; 600 for (cur = list; cur != NULL; cur = cur->next) 601 len++; 602 buf[0] = cpu_to_le32(len); 603 rc = put_entry(buf, sizeof(u32), 1, fp); 604 if (rc) 605 return rc; 606 607 for (cur = list; cur != NULL; cur = cur->next) { 608 rc = cond_write_node(p, cur, fp); 609 if (rc) 610 return rc; 611 } 612 613 return 0; 614} 615/* Determine whether additional permissions are granted by the conditional 616 * av table, and if so, add them to the result 617 */ 618void cond_compute_av(struct avtab *ctab, struct avtab_key *key, struct av_decision *avd) 619{ 620 struct avtab_node *node; 621 622 if (!ctab || !key || !avd) 623 return; 624 625 for (node = avtab_search_node(ctab, key); node; 626 node = avtab_search_node_next(node, key->specified)) { 627 if ((u16)(AVTAB_ALLOWED|AVTAB_ENABLED) == 628 (node->key.specified & (AVTAB_ALLOWED|AVTAB_ENABLED))) 629 avd->allowed |= node->datum.data; 630 if ((u16)(AVTAB_AUDITDENY|AVTAB_ENABLED) == 631 (node->key.specified & (AVTAB_AUDITDENY|AVTAB_ENABLED))) 632 /* Since a '0' in an auditdeny mask represents a 633 * permission we do NOT want to audit (dontaudit), we use 634 * the '&' operand to ensure that all '0's in the mask 635 * are retained (much unlike the allow and auditallow cases). 636 */ 637 avd->auditdeny &= node->datum.data; 638 if ((u16)(AVTAB_AUDITALLOW|AVTAB_ENABLED) == 639 (node->key.specified & (AVTAB_AUDITALLOW|AVTAB_ENABLED))) 640 avd->auditallow |= node->datum.data; 641 } 642 return; 643} 644