security/selinux/ss/conditional.c

   1 /* Authors: Karl MacMillan <kmacmillan@tresys.com>
   2  *          Frank Mayer <mayerf@tresys.com>
   3  *
   4  * Copyright (C) 2003 - 2004 Tresys Technology, LLC
   5  *      This program is free software; you can redistribute it and/or modify
   6  *      it under the terms of the GNU General Public License as published by
   7  *      the Free Software Foundation, version 2.
   8  */
   9
  10 #include <linux/kernel.h>
  11 #include <linux/errno.h>
  12 #include <linux/string.h>
  13 #include <linux/spinlock.h>
  14 #include <linux/slab.h>
  15
  16 #include "security.h"
  17 #include "conditional.h"
  18 #include "services.h"
  19
  20 /*
  21  * cond_evaluate_expr evaluates a conditional expr
  22  * in reverse polish notation. It returns true (1), false (0),
  23  * or undefined (-1). Undefined occurs when the expression
  24  * exceeds the stack depth of COND_EXPR_MAXDEPTH.
  25  */
  26 static int cond_evaluate_expr(struct policydb *p, struct cond_expr *expr)
  27 {
  28
  29         struct cond_expr *cur;
  30         int s[COND_EXPR_MAXDEPTH];
  31         int sp = -1;
  32
  33         for (cur = expr; cur; cur = cur->next) {
  34                 switch (cur->expr_type) {
  35                 case COND_BOOL:
  36                         if (sp == (COND_EXPR_MAXDEPTH - 1))
  37                                 return -1;
  38                         sp++;
  39                         s[sp] = p->bool_val_to_struct[cur->bool - 1]->state;
  40                         break;
  41                 case COND_NOT:
  42                         if (sp < 0)
  43                                 return -1;
  44                         s[sp] = !s[sp];
  45                         break;
  46                 case COND_OR:
  47                         if (sp < 1)
  48                                 return -1;
  49                         sp--;
  50                         s[sp] |= s[sp + 1];
  51                         break;
  52                 case COND_AND:
  53                         if (sp < 1)
  54                                 return -1;
  55                         sp--;
  56                         s[sp] &= s[sp + 1];
  57                         break;
  58                 case COND_XOR:
  59                         if (sp < 1)
  60                                 return -1;
  61                         sp--;
  62                         s[sp] ^= s[sp + 1];
  63                         break;
  64                 case COND_EQ:
  65                         if (sp < 1)
  66                                 return -1;
  67                         sp--;
  68                         s[sp] = (s[sp] == s[sp + 1]);
  69                         break;
  70                 case COND_NEQ:
  71                         if (sp < 1)
  72                                 return -1;
  73                         sp--;
  74                         s[sp] = (s[sp] != s[sp + 1]);
  75                         break;
  76                 default:
  77                         return -1;
  78                 }
  79         }
  80         return s[0];
  81 }
  82
  83 /*
  84  * evaluate_cond_node evaluates the conditional stored in
  85  * a struct cond_node and if the result is different than the
  86  * current state of the node it sets the rules in the true/false
  87  * list appropriately. If the result of the expression is undefined
  88  * all of the rules are disabled for safety.
  89  */
  90 int evaluate_cond_node(struct policydb *p, struct cond_node *node)
  91 {
  92         int new_state;
  93         struct cond_av_list *cur;
  94
  95         new_state = cond_evaluate_expr(p, node->expr);
  96         if (new_state != node->cur_state) {
  97                 node->cur_state = new_state;
  98                 if (new_state == -1)
  99                         printk(KERN_ERR "SELinux: expression result was undefined - disabling all rules.\n");
 100                 /* turn the rules on or off */
 101                 for (cur = node->true_list; cur; cur = cur->next) {
 102                         if (new_state <= 0)
 103                                 cur->node->key.specified &= ~AVTAB_ENABLED;
 104                         else
 105                                 cur->node->key.specified |= AVTAB_ENABLED;
 106                 }
 107
 108                 for (cur = node->false_list; cur; cur = cur->next) {
 109                         /* -1 or 1 */
 110                         if (new_state)
 111                                 cur->node->key.specified &= ~AVTAB_ENABLED;
 112                         else
 113                                 cur->node->key.specified |= AVTAB_ENABLED;
 114                 }
 115         }
 116         return 0;
 117 }
 118
 119 int cond_policydb_init(struct policydb *p)
 120 {
 121         int rc;
 122
 123         p->bool_val_to_struct = NULL;
 124         p->cond_list = NULL;
 125
 126         rc = avtab_init(&p->te_cond_avtab);
 127         if (rc)
 128                 return rc;
 129
 130         return 0;
 131 }
 132
 133 static void cond_av_list_destroy(struct cond_av_list *list)
 134 {
 135         struct cond_av_list *cur, *next;
 136         for (cur = list; cur; cur = next) {
 137                 next = cur->next;
 138                 /* the avtab_ptr_t node is destroy by the avtab */
 139                 kfree(cur);
 140         }
 141 }
 142
 143 static void cond_node_destroy(struct cond_node *node)
 144 {
 145         struct cond_expr *cur_expr, *next_expr;
 146
 147         for (cur_expr = node->expr; cur_expr; cur_expr = next_expr) {
 148                 next_expr = cur_expr->next;
 149                 kfree(cur_expr);
 150         }
 151         cond_av_list_destroy(node->true_list);
 152         cond_av_list_destroy(node->false_list);
 153         kfree(node);
 154 }
 155
 156 static void cond_list_destroy(struct cond_node *list)
 157 {
 158         struct cond_node *next, *cur;
 159
 160         if (list == NULL)
 161                 return;
 162
 163         for (cur = list; cur; cur = next) {
 164                 next = cur->next;
 165                 cond_node_destroy(cur);
 166         }
 167 }
 168
 169 void cond_policydb_destroy(struct policydb *p)
 170 {
 171         kfree(p->bool_val_to_struct);
 172         avtab_destroy(&p->te_cond_avtab);
 173         cond_list_destroy(p->cond_list);
 174 }
 175
 176 int cond_init_bool_indexes(struct policydb *p)
 177 {
 178         kfree(p->bool_val_to_struct);
 179         p->bool_val_to_struct =
 180                 kmalloc(p->p_bools.nprim * sizeof(struct cond_bool_datum *), GFP_KERNEL);
 181         if (!p->bool_val_to_struct)
 182                 return -ENOMEM;
 183         return 0;
 184 }
 185
 186 int cond_destroy_bool(void *key, void *datum, void *p)
 187 {
 188         kfree(key);
 189         kfree(datum);
 190         return 0;
 191 }
 192
 193 int cond_index_bool(void *key, void *datum, void *datap)
 194 {
 195         struct policydb *p;
 196         struct cond_bool_datum *booldatum;
 197         struct flex_array *fa;
 198
 199         booldatum = datum;
 200         p = datap;
 201
 202         if (!booldatum->value || booldatum->value > p->p_bools.nprim)
 203                 return -EINVAL;
 204
 205         fa = p->sym_val_to_name[SYM_BOOLS];
 206         if (flex_array_put_ptr(fa, booldatum->value - 1, key,
 207                                GFP_KERNEL | __GFP_ZERO))
 208                 BUG();
 209         p->bool_val_to_struct[booldatum->value - 1] = booldatum;
 210
 211         return 0;
 212 }
 213
 214 static int bool_isvalid(struct cond_bool_datum *b)
 215 {
 216         if (!(b->state == 0 || b->state == 1))
 217                 return 0;
 218         return 1;
 219 }
 220
 221 int cond_read_bool(struct policydb *p, struct hashtab *h, void *fp)
 222 {
 223         char *key = NULL;
 224         struct cond_bool_datum *booldatum;
 225         __le32 buf[3];
 226         u32 len;
 227         int rc;
 228
 229         booldatum = kzalloc(sizeof(struct cond_bool_datum), GFP_KERNEL);
 230         if (!booldatum)
 231                 return -ENOMEM;
 232
 233         rc = next_entry(buf, fp, sizeof buf);
 234         if (rc)
 235                 goto err;
 236
 237         booldatum->value = le32_to_cpu(buf[0]);
 238         booldatum->state = le32_to_cpu(buf[1]);
 239
 240         rc = -EINVAL;
 241         if (!bool_isvalid(booldatum))
 242                 goto err;
 243
 244         len = le32_to_cpu(buf[2]);
 245
 246         rc = -ENOMEM;
 247         key = kmalloc(len + 1, GFP_KERNEL);
 248         if (!key)
 249                 goto err;
 250         rc = next_entry(key, fp, len);
 251         if (rc)
 252                 goto err;
 253         key[len] = '\0';
 254         rc = hashtab_insert(h, key, booldatum);
 255         if (rc)
 256                 goto err;
 257
 258         return 0;
 259 err:
 260         cond_destroy_bool(key, booldatum, NULL);
 261         return rc;
 262 }
 263
 264 struct cond_insertf_data {
 265         struct policydb *p;
 266         struct cond_av_list *other;
 267         struct cond_av_list *head;
 268         struct cond_av_list *tail;
 269 };
 270
 271 static int cond_insertf(struct avtab *a, struct avtab_key *k, struct avtab_datum *d, void *ptr)
 272 {
 273         struct cond_insertf_data *data = ptr;
 274         struct policydb *p = data->p;
 275         struct cond_av_list *other = data->other, *list, *cur;
 276         struct avtab_node *node_ptr;
 277         u8 found;
 278         int rc = -EINVAL;
 279
 280         /*
 281          * For type rules we have to make certain there aren't any
 282          * conflicting rules by searching the te_avtab and the
 283          * cond_te_avtab.
 284          */
 285         if (k->specified & AVTAB_TYPE) {
 286                 if (avtab_search(&p->te_avtab, k)) {
 287                         printk(KERN_ERR "SELinux: type rule already exists outside of a conditional.\n");
 288                         goto err;
 289                 }
 290                 /*
 291                  * If we are reading the false list other will be a pointer to
 292                  * the true list. We can have duplicate entries if there is only
 293                  * 1 other entry and it is in our true list.
 294                  *
 295                  * If we are reading the true list (other == NULL) there shouldn't
 296                  * be any other entries.
 297                  */
 298                 if (other) {
 299                         node_ptr = avtab_search_node(&p->te_cond_avtab, k);
 300                         if (node_ptr) {
 301                                 if (avtab_search_node_next(node_ptr, k->specified)) {
 302                                         printk(KERN_ERR "SELinux: too many conflicting type rules.\n");
 303                                         goto err;
 304                                 }
 305                                 found = 0;
 306                                 for (cur = other; cur; cur = cur->next) {
 307                                         if (cur->node == node_ptr) {
 308                                                 found = 1;
 309                                                 break;
 310                                         }
 311                                 }
 312                                 if (!found) {
 313                                         printk(KERN_ERR "SELinux: conflicting type rules.\n");
 314                                         goto err;
 315                                 }
 316                         }
 317                 } else {
 318                         if (avtab_search(&p->te_cond_avtab, k)) {
 319                                 printk(KERN_ERR "SELinux: conflicting type rules when adding type rule for true.\n");
 320                                 goto err;
 321                         }
 322                 }
 323         }
 324
 325         node_ptr = avtab_insert_nonunique(&p->te_cond_avtab, k, d);
 326         if (!node_ptr) {
 327                 printk(KERN_ERR "SELinux: could not insert rule.\n");
 328                 rc = -ENOMEM;
 329                 goto err;
 330         }
 331
 332         list = kzalloc(sizeof(struct cond_av_list), GFP_KERNEL);
 333         if (!list) {
 334                 rc = -ENOMEM;
 335                 goto err;
 336         }
 337
 338         list->node = node_ptr;
 339         if (!data->head)
 340                 data->head = list;
 341         else
 342                 data->tail->next = list;
 343         data->tail = list;
 344         return 0;
 345
 346 err:
 347         cond_av_list_destroy(data->head);
 348         data->head = NULL;
 349         return rc;
 350 }
 351
 352 static int cond_read_av_list(struct policydb *p, void *fp, struct cond_av_list **ret_list, struct cond_av_list *other)
 353 {
 354         int i, rc;
 355         __le32 buf[1];
 356         u32 len;
 357         struct cond_insertf_data data;
 358
 359         *ret_list = NULL;
 360
 361         len = 0;
 362         rc = next_entry(buf, fp, sizeof(u32));
 363         if (rc)
 364                 return rc;
 365
 366         len = le32_to_cpu(buf[0]);
 367         if (len == 0)
 368                 return 0;
 369
 370         data.p = p;
 371         data.other = other;
 372         data.head = NULL;
 373         data.tail = NULL;
 374         for (i = 0; i < len; i++) {
 375                 rc = avtab_read_item(&p->te_cond_avtab, fp, p, cond_insertf,
 376                                      &data);
 377                 if (rc)
 378                         return rc;
 379         }
 380
 381         *ret_list = data.head;
 382         return 0;
 383 }
 384
 385 static int expr_isvalid(struct policydb *p, struct cond_expr *expr)
 386 {
 387         if (expr->expr_type <= 0 || expr->expr_type > COND_LAST) {
 388                 printk(KERN_ERR "SELinux: conditional expressions uses unknown operator.\n");
 389                 return 0;
 390         }
 391
 392         if (expr->bool > p->p_bools.nprim) {
 393                 printk(KERN_ERR "SELinux: conditional expressions uses unknown bool.\n");
 394                 return 0;
 395         }
 396         return 1;
 397 }
 398
 399 static int cond_read_node(struct policydb *p, struct cond_node *node, void *fp)
 400 {
 401         __le32 buf[2];
 402         u32 len, i;
 403         int rc;
 404         struct cond_expr *expr = NULL, *last = NULL;
 405
 406         rc = next_entry(buf, fp, sizeof(u32));
 407         if (rc)
 408                 return rc;
 409
 410         node->cur_state = le32_to_cpu(buf[0]);
 411
 412         len = 0;
 413         rc = next_entry(buf, fp, sizeof(u32));
 414         if (rc)
 415                 return rc;
 416
 417         /* expr */
 418         len = le32_to_cpu(buf[0]);
 419
 420         for (i = 0; i < len; i++) {
 421                 rc = next_entry(buf, fp, sizeof(u32) * 2);
 422                 if (rc)
 423                         goto err;
 424
 425                 rc = -ENOMEM;
 426                 expr = kzalloc(sizeof(struct cond_expr), GFP_KERNEL);
 427                 if (!expr)
 428                         goto err;
 429
 430                 expr->expr_type = le32_to_cpu(buf[0]);
 431                 expr->bool = le32_to_cpu(buf[1]);
 432
 433                 if (!expr_isvalid(p, expr)) {
 434                         rc = -EINVAL;
 435                         kfree(expr);
 436                         goto err;
 437                 }
 438
 439                 if (i == 0)
 440                         node->expr = expr;
 441                 else
 442                         last->next = expr;
 443                 last = expr;
 444         }
 445
 446         rc = cond_read_av_list(p, fp, &node->true_list, NULL);
 447         if (rc)
 448                 goto err;
 449         rc = cond_read_av_list(p, fp, &node->false_list, node->true_list);
 450         if (rc)
 451                 goto err;
 452         return 0;
 453 err:
 454         cond_node_destroy(node);
 455         return rc;
 456 }
 457
 458 int cond_read_list(struct policydb *p, void *fp)
 459 {
 460         struct cond_node *node, *last = NULL;
 461         __le32 buf[1];
 462         u32 i, len;
 463         int rc;
 464
 465         rc = next_entry(buf, fp, sizeof buf);
 466         if (rc)
 467                 return rc;
 468
 469         len = le32_to_cpu(buf[0]);
 470
 471         rc = avtab_alloc(&(p->te_cond_avtab), p->te_avtab.nel);
 472         if (rc)
 473                 goto err;
 474
 475         for (i = 0; i < len; i++) {
 476                 rc = -ENOMEM;
 477                 node = kzalloc(sizeof(struct cond_node), GFP_KERNEL);
 478                 if (!node)
 479                         goto err;
 480
 481                 rc = cond_read_node(p, node, fp);
 482                 if (rc)
 483                         goto err;
 484
 485                 if (i == 0)
 486                         p->cond_list = node;
 487                 else
 488                         last->next = node;
 489                 last = node;
 490         }
 491         return 0;
 492 err:
 493         cond_list_destroy(p->cond_list);
 494         p->cond_list = NULL;
 495         return rc;
 496 }
 497
 498 int cond_write_bool(void *vkey, void *datum, void *ptr)
 499 {
 500         char *key = vkey;
 501         struct cond_bool_datum *booldatum = datum;
 502         struct policy_data *pd = ptr;
 503         void *fp = pd->fp;
 504         __le32 buf[3];
 505         u32 len;
 506         int rc;
 507
 508         len = strlen(key);
 509         buf[0] = cpu_to_le32(booldatum->value);
 510         buf[1] = cpu_to_le32(booldatum->state);
 511         buf[2] = cpu_to_le32(len);
 512         rc = put_entry(buf, sizeof(u32), 3, fp);
 513         if (rc)
 514                 return rc;
 515         rc = put_entry(key, 1, len, fp);
 516         if (rc)
 517                 return rc;
 518         return 0;
 519 }
 520
 521 /*
 522  * cond_write_cond_av_list doesn't write out the av_list nodes.
 523  * Instead it writes out the key/value pairs from the avtab. This
 524  * is necessary because there is no way to uniquely identifying rules
 525  * in the avtab so it is not possible to associate individual rules
 526  * in the avtab with a conditional without saving them as part of
 527  * the conditional. This means that the avtab with the conditional
 528  * rules will not be saved but will be rebuilt on policy load.
 529  */
 530 static int cond_write_av_list(struct policydb *p,
 531                               struct cond_av_list *list, struct policy_file *fp)
 532 {
 533         __le32 buf[1];
 534         struct cond_av_list *cur_list;
 535         u32 len;
 536         int rc;
 537
 538         len = 0;
 539         for (cur_list = list; cur_list != NULL; cur_list = cur_list->next)
 540                 len++;
 541
 542         buf[0] = cpu_to_le32(len);
 543         rc = put_entry(buf, sizeof(u32), 1, fp);
 544         if (rc)
 545                 return rc;
 546
 547         if (len == 0)
 548                 return 0;
 549
 550         for (cur_list = list; cur_list != NULL; cur_list = cur_list->next) {
 551                 rc = avtab_write_item(p, cur_list->node, fp);
 552                 if (rc)
 553                         return rc;
 554         }
 555
 556         return 0;
 557 }
 558
 559 static int cond_write_node(struct policydb *p, struct cond_node *node,
 560                     struct policy_file *fp)
 561 {
 562         struct cond_expr *cur_expr;
 563         __le32 buf[2];
 564         int rc;
 565         u32 len = 0;
 566
 567         buf[0] = cpu_to_le32(node->cur_state);
 568         rc = put_entry(buf, sizeof(u32), 1, fp);
 569         if (rc)
 570                 return rc;
 571
 572         for (cur_expr = node->expr; cur_expr != NULL; cur_expr = cur_expr->next)
 573                 len++;
 574
 575         buf[0] = cpu_to_le32(len);
 576         rc = put_entry(buf, sizeof(u32), 1, fp);
 577         if (rc)
 578                 return rc;
 579
 580         for (cur_expr = node->expr; cur_expr != NULL; cur_expr = cur_expr->next) {
 581                 buf[0] = cpu_to_le32(cur_expr->expr_type);
 582                 buf[1] = cpu_to_le32(cur_expr->bool);
 583                 rc = put_entry(buf, sizeof(u32), 2, fp);
 584                 if (rc)
 585                         return rc;
 586         }
 587
 588         rc = cond_write_av_list(p, node->true_list, fp);
 589         if (rc)
 590                 return rc;
 591         rc = cond_write_av_list(p, node->false_list, fp);
 592         if (rc)
 593                 return rc;
 594
 595         return 0;
 596 }
 597
 598 int cond_write_list(struct policydb *p, struct cond_node *list, void *fp)
 599 {
 600         struct cond_node *cur;
 601         u32 len;
 602         __le32 buf[1];
 603         int rc;
 604
 605         len = 0;
 606         for (cur = list; cur != NULL; cur = cur->next)
 607                 len++;
 608         buf[0] = cpu_to_le32(len);
 609         rc = put_entry(buf, sizeof(u32), 1, fp);
 610         if (rc)
 611                 return rc;
 612
 613         for (cur = list; cur != NULL; cur = cur->next) {
 614                 rc = cond_write_node(p, cur, fp);
 615                 if (rc)
 616                         return rc;
 617         }
 618
 619         return 0;
 620 }
 621
 622 void cond_compute_xperms(struct avtab *ctab, struct avtab_key *key,
 623                 struct extended_perms_decision *xpermd)
 624 {
 625         struct avtab_node *node;
 626
 627         if (!ctab || !key || !xpermd)
 628                 return;
 629
 630         for (node = avtab_search_node(ctab, key); node;
 631                         node = avtab_search_node_next(node, key->specified)) {
 632                 if (node->key.specified & AVTAB_ENABLED)
 633                         services_compute_xperms_decision(xpermd, node);
 634         }
 635         return;
 636
 637 }
 638 /* Determine whether additional permissions are granted by the conditional
 639  * av table, and if so, add them to the result
 640  */
 641 void cond_compute_av(struct avtab *ctab, struct avtab_key *key,
 642                 struct av_decision *avd, struct extended_perms *xperms)
 643 {
 644         struct avtab_node *node;
 645
 646         if (!ctab || !key || !avd)
 647                 return;
 648
 649         for (node = avtab_search_node(ctab, key); node;
 650                                 node = avtab_search_node_next(node, key->specified)) {
 651                 if ((u16)(AVTAB_ALLOWED|AVTAB_ENABLED) ==
 652                     (node->key.specified & (AVTAB_ALLOWED|AVTAB_ENABLED)))
 653                         avd->allowed |= node->datum.u.data;
 654                 if ((u16)(AVTAB_AUDITDENY|AVTAB_ENABLED) ==
 655                     (node->key.specified & (AVTAB_AUDITDENY|AVTAB_ENABLED)))
 656                         /* Since a '0' in an auditdeny mask represents a
 657                          * permission we do NOT want to audit (dontaudit), we use
 658                          * the '&' operand to ensure that all '0's in the mask
 659                          * are retained (much unlike the allow and auditallow cases).
 660                          */
 661                         avd->auditdeny &= node->datum.u.data;
 662                 if ((u16)(AVTAB_AUDITALLOW|AVTAB_ENABLED) ==
 663                     (node->key.specified & (AVTAB_AUDITALLOW|AVTAB_ENABLED)))
 664                         avd->auditallow |= node->datum.u.data;
 665                 if (xperms && (node->key.specified & AVTAB_ENABLED) &&
 666                                 (node->key.specified & AVTAB_XPERMS))
 667                         services_compute_xperms_drivers(xperms, node);
 668         }
 669         return;
 670 }