2 * Implementation of the policy database.
4 * Author : Stephen Smalley, <sds@epoch.ncsc.mil>
8 * Updated: Trusted Computer Solutions, Inc. <dgoeddel@trustedcs.com>
10 * Support for enhanced MLS infrastructure.
12 * Updated: Frank Mayer <mayerf@tresys.com> and Karl MacMillan <kmacmillan@tresys.com>
14 * Added conditional policy language extensions
16 * Updated: Hewlett-Packard <paul.moore@hp.com>
18 * Added support for the policy capability bitmap
20 * Copyright (C) 2007 Hewlett-Packard Development Company, L.P.
21 * Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
22 * Copyright (C) 2003 - 2004 Tresys Technology, LLC
23 * This program is free software; you can redistribute it and/or modify
24 * it under the terms of the GNU General Public License as published by
25 * the Free Software Foundation, version 2.
28 #include <linux/kernel.h>
29 #include <linux/sched.h>
30 #include <linux/slab.h>
31 #include <linux/string.h>
32 #include <linux/errno.h>
33 #include <linux/audit.h>
34 #include <linux/flex_array.h>
38 #include "conditional.h"
45 static const char *symtab_name
[SYM_NUM
] = {
57 static unsigned int symtab_sizes
[SYM_NUM
] = {
68 struct policydb_compat_info
{
74 /* These need to be updated if SYM_NUM or OCON_NUM changes */
75 static struct policydb_compat_info policydb_compat
[] = {
77 .version
= POLICYDB_VERSION_BASE
,
78 .sym_num
= SYM_NUM
- 3,
79 .ocon_num
= OCON_NUM
- 1,
82 .version
= POLICYDB_VERSION_BOOL
,
83 .sym_num
= SYM_NUM
- 2,
84 .ocon_num
= OCON_NUM
- 1,
87 .version
= POLICYDB_VERSION_IPV6
,
88 .sym_num
= SYM_NUM
- 2,
92 .version
= POLICYDB_VERSION_NLCLASS
,
93 .sym_num
= SYM_NUM
- 2,
97 .version
= POLICYDB_VERSION_MLS
,
102 .version
= POLICYDB_VERSION_AVTAB
,
104 .ocon_num
= OCON_NUM
,
107 .version
= POLICYDB_VERSION_RANGETRANS
,
109 .ocon_num
= OCON_NUM
,
112 .version
= POLICYDB_VERSION_POLCAP
,
114 .ocon_num
= OCON_NUM
,
117 .version
= POLICYDB_VERSION_PERMISSIVE
,
119 .ocon_num
= OCON_NUM
,
122 .version
= POLICYDB_VERSION_BOUNDARY
,
124 .ocon_num
= OCON_NUM
,
127 .version
= POLICYDB_VERSION_FILENAME_TRANS
,
129 .ocon_num
= OCON_NUM
,
132 .version
= POLICYDB_VERSION_ROLETRANS
,
134 .ocon_num
= OCON_NUM
,
138 static struct policydb_compat_info
*policydb_lookup_compat(int version
)
141 struct policydb_compat_info
*info
= NULL
;
143 for (i
= 0; i
< ARRAY_SIZE(policydb_compat
); i
++) {
144 if (policydb_compat
[i
].version
== version
) {
145 info
= &policydb_compat
[i
];
153 * Initialize the role table.
155 static int roles_init(struct policydb
*p
)
159 struct role_datum
*role
;
162 role
= kzalloc(sizeof(*role
), GFP_KERNEL
);
167 role
->value
= ++p
->p_roles
.nprim
;
168 if (role
->value
!= OBJECT_R_VAL
)
172 key
= kstrdup(OBJECT_R
, GFP_KERNEL
);
176 rc
= hashtab_insert(p
->p_roles
.table
, key
, role
);
187 static u32
rangetr_hash(struct hashtab
*h
, const void *k
)
189 const struct range_trans
*key
= k
;
190 return (key
->source_type
+ (key
->target_type
<< 3) +
191 (key
->target_class
<< 5)) & (h
->size
- 1);
194 static int rangetr_cmp(struct hashtab
*h
, const void *k1
, const void *k2
)
196 const struct range_trans
*key1
= k1
, *key2
= k2
;
199 v
= key1
->source_type
- key2
->source_type
;
203 v
= key1
->target_type
- key2
->target_type
;
207 v
= key1
->target_class
- key2
->target_class
;
213 * Initialize a policy database structure.
215 static int policydb_init(struct policydb
*p
)
219 memset(p
, 0, sizeof(*p
));
221 for (i
= 0; i
< SYM_NUM
; i
++) {
222 rc
= symtab_init(&p
->symtab
[i
], symtab_sizes
[i
]);
227 rc
= avtab_init(&p
->te_avtab
);
235 rc
= cond_policydb_init(p
);
239 p
->range_tr
= hashtab_create(rangetr_hash
, rangetr_cmp
, 256);
243 ebitmap_init(&p
->policycaps
);
244 ebitmap_init(&p
->permissive_map
);
248 for (i
= 0; i
< SYM_NUM
; i
++)
249 hashtab_destroy(p
->symtab
[i
].table
);
254 * The following *_index functions are used to
255 * define the val_to_name and val_to_struct arrays
256 * in a policy database structure. The val_to_name
257 * arrays are used when converting security context
258 * structures into string representations. The
259 * val_to_struct arrays are used when the attributes
260 * of a class, role, or user are needed.
263 static int common_index(void *key
, void *datum
, void *datap
)
266 struct common_datum
*comdatum
;
267 struct flex_array
*fa
;
271 if (!comdatum
->value
|| comdatum
->value
> p
->p_commons
.nprim
)
274 fa
= p
->sym_val_to_name
[SYM_COMMONS
];
275 if (flex_array_put_ptr(fa
, comdatum
->value
- 1, key
,
276 GFP_KERNEL
| __GFP_ZERO
))
281 static int class_index(void *key
, void *datum
, void *datap
)
284 struct class_datum
*cladatum
;
285 struct flex_array
*fa
;
289 if (!cladatum
->value
|| cladatum
->value
> p
->p_classes
.nprim
)
291 fa
= p
->sym_val_to_name
[SYM_CLASSES
];
292 if (flex_array_put_ptr(fa
, cladatum
->value
- 1, key
,
293 GFP_KERNEL
| __GFP_ZERO
))
295 p
->class_val_to_struct
[cladatum
->value
- 1] = cladatum
;
299 static int role_index(void *key
, void *datum
, void *datap
)
302 struct role_datum
*role
;
303 struct flex_array
*fa
;
308 || role
->value
> p
->p_roles
.nprim
309 || role
->bounds
> p
->p_roles
.nprim
)
312 fa
= p
->sym_val_to_name
[SYM_ROLES
];
313 if (flex_array_put_ptr(fa
, role
->value
- 1, key
,
314 GFP_KERNEL
| __GFP_ZERO
))
316 p
->role_val_to_struct
[role
->value
- 1] = role
;
320 static int type_index(void *key
, void *datum
, void *datap
)
323 struct type_datum
*typdatum
;
324 struct flex_array
*fa
;
329 if (typdatum
->primary
) {
331 || typdatum
->value
> p
->p_types
.nprim
332 || typdatum
->bounds
> p
->p_types
.nprim
)
334 fa
= p
->sym_val_to_name
[SYM_TYPES
];
335 if (flex_array_put_ptr(fa
, typdatum
->value
- 1, key
,
336 GFP_KERNEL
| __GFP_ZERO
))
339 fa
= p
->type_val_to_struct_array
;
340 if (flex_array_put_ptr(fa
, typdatum
->value
- 1, typdatum
,
341 GFP_KERNEL
| __GFP_ZERO
))
348 static int user_index(void *key
, void *datum
, void *datap
)
351 struct user_datum
*usrdatum
;
352 struct flex_array
*fa
;
357 || usrdatum
->value
> p
->p_users
.nprim
358 || usrdatum
->bounds
> p
->p_users
.nprim
)
361 fa
= p
->sym_val_to_name
[SYM_USERS
];
362 if (flex_array_put_ptr(fa
, usrdatum
->value
- 1, key
,
363 GFP_KERNEL
| __GFP_ZERO
))
365 p
->user_val_to_struct
[usrdatum
->value
- 1] = usrdatum
;
369 static int sens_index(void *key
, void *datum
, void *datap
)
372 struct level_datum
*levdatum
;
373 struct flex_array
*fa
;
378 if (!levdatum
->isalias
) {
379 if (!levdatum
->level
->sens
||
380 levdatum
->level
->sens
> p
->p_levels
.nprim
)
382 fa
= p
->sym_val_to_name
[SYM_LEVELS
];
383 if (flex_array_put_ptr(fa
, levdatum
->level
->sens
- 1, key
,
384 GFP_KERNEL
| __GFP_ZERO
))
391 static int cat_index(void *key
, void *datum
, void *datap
)
394 struct cat_datum
*catdatum
;
395 struct flex_array
*fa
;
400 if (!catdatum
->isalias
) {
401 if (!catdatum
->value
|| catdatum
->value
> p
->p_cats
.nprim
)
403 fa
= p
->sym_val_to_name
[SYM_CATS
];
404 if (flex_array_put_ptr(fa
, catdatum
->value
- 1, key
,
405 GFP_KERNEL
| __GFP_ZERO
))
412 static int (*index_f
[SYM_NUM
]) (void *key
, void *datum
, void *datap
) =
425 static void symtab_hash_eval(struct symtab
*s
)
429 for (i
= 0; i
< SYM_NUM
; i
++) {
430 struct hashtab
*h
= s
[i
].table
;
431 struct hashtab_info info
;
433 hashtab_stat(h
, &info
);
434 printk(KERN_DEBUG
"SELinux: %s: %d entries and %d/%d buckets used, "
435 "longest chain length %d\n", symtab_name
[i
], h
->nel
,
436 info
.slots_used
, h
->size
, info
.max_chain_len
);
440 static void rangetr_hash_eval(struct hashtab
*h
)
442 struct hashtab_info info
;
444 hashtab_stat(h
, &info
);
445 printk(KERN_DEBUG
"SELinux: rangetr: %d entries and %d/%d buckets used, "
446 "longest chain length %d\n", h
->nel
,
447 info
.slots_used
, h
->size
, info
.max_chain_len
);
450 static inline void rangetr_hash_eval(struct hashtab
*h
)
456 * Define the other val_to_name and val_to_struct arrays
457 * in a policy database structure.
459 * Caller must clean up on failure.
461 static int policydb_index(struct policydb
*p
)
465 printk(KERN_DEBUG
"SELinux: %d users, %d roles, %d types, %d bools",
466 p
->p_users
.nprim
, p
->p_roles
.nprim
, p
->p_types
.nprim
, p
->p_bools
.nprim
);
468 printk(", %d sens, %d cats", p
->p_levels
.nprim
,
472 printk(KERN_DEBUG
"SELinux: %d classes, %d rules\n",
473 p
->p_classes
.nprim
, p
->te_avtab
.nel
);
476 avtab_hash_eval(&p
->te_avtab
, "rules");
477 symtab_hash_eval(p
->symtab
);
481 p
->class_val_to_struct
=
482 kmalloc(p
->p_classes
.nprim
* sizeof(*(p
->class_val_to_struct
)),
484 if (!p
->class_val_to_struct
)
488 p
->role_val_to_struct
=
489 kmalloc(p
->p_roles
.nprim
* sizeof(*(p
->role_val_to_struct
)),
491 if (!p
->role_val_to_struct
)
495 p
->user_val_to_struct
=
496 kmalloc(p
->p_users
.nprim
* sizeof(*(p
->user_val_to_struct
)),
498 if (!p
->user_val_to_struct
)
501 /* Yes, I want the sizeof the pointer, not the structure */
503 p
->type_val_to_struct_array
= flex_array_alloc(sizeof(struct type_datum
*),
505 GFP_KERNEL
| __GFP_ZERO
);
506 if (!p
->type_val_to_struct_array
)
509 rc
= flex_array_prealloc(p
->type_val_to_struct_array
, 0,
510 p
->p_types
.nprim
- 1, GFP_KERNEL
| __GFP_ZERO
);
514 rc
= cond_init_bool_indexes(p
);
518 for (i
= 0; i
< SYM_NUM
; i
++) {
520 p
->sym_val_to_name
[i
] = flex_array_alloc(sizeof(char *),
522 GFP_KERNEL
| __GFP_ZERO
);
523 if (!p
->sym_val_to_name
[i
])
526 rc
= flex_array_prealloc(p
->sym_val_to_name
[i
],
527 0, p
->symtab
[i
].nprim
- 1,
528 GFP_KERNEL
| __GFP_ZERO
);
532 rc
= hashtab_map(p
->symtab
[i
].table
, index_f
[i
], p
);
542 * The following *_destroy functions are used to
543 * free any memory allocated for each kind of
544 * symbol data in the policy database.
547 static int perm_destroy(void *key
, void *datum
, void *p
)
554 static int common_destroy(void *key
, void *datum
, void *p
)
556 struct common_datum
*comdatum
;
561 hashtab_map(comdatum
->permissions
.table
, perm_destroy
, NULL
);
562 hashtab_destroy(comdatum
->permissions
.table
);
568 static int cls_destroy(void *key
, void *datum
, void *p
)
570 struct class_datum
*cladatum
;
571 struct constraint_node
*constraint
, *ctemp
;
572 struct constraint_expr
*e
, *etmp
;
577 hashtab_map(cladatum
->permissions
.table
, perm_destroy
, NULL
);
578 hashtab_destroy(cladatum
->permissions
.table
);
579 constraint
= cladatum
->constraints
;
581 e
= constraint
->expr
;
583 ebitmap_destroy(&e
->names
);
589 constraint
= constraint
->next
;
593 constraint
= cladatum
->validatetrans
;
595 e
= constraint
->expr
;
597 ebitmap_destroy(&e
->names
);
603 constraint
= constraint
->next
;
607 kfree(cladatum
->comkey
);
613 static int role_destroy(void *key
, void *datum
, void *p
)
615 struct role_datum
*role
;
620 ebitmap_destroy(&role
->dominates
);
621 ebitmap_destroy(&role
->types
);
627 static int type_destroy(void *key
, void *datum
, void *p
)
634 static int user_destroy(void *key
, void *datum
, void *p
)
636 struct user_datum
*usrdatum
;
641 ebitmap_destroy(&usrdatum
->roles
);
642 ebitmap_destroy(&usrdatum
->range
.level
[0].cat
);
643 ebitmap_destroy(&usrdatum
->range
.level
[1].cat
);
644 ebitmap_destroy(&usrdatum
->dfltlevel
.cat
);
650 static int sens_destroy(void *key
, void *datum
, void *p
)
652 struct level_datum
*levdatum
;
657 ebitmap_destroy(&levdatum
->level
->cat
);
658 kfree(levdatum
->level
);
664 static int cat_destroy(void *key
, void *datum
, void *p
)
671 static int (*destroy_f
[SYM_NUM
]) (void *key
, void *datum
, void *datap
) =
683 static int range_tr_destroy(void *key
, void *datum
, void *p
)
685 struct mls_range
*rt
= datum
;
687 ebitmap_destroy(&rt
->level
[0].cat
);
688 ebitmap_destroy(&rt
->level
[1].cat
);
694 static void ocontext_destroy(struct ocontext
*c
, int i
)
699 context_destroy(&c
->context
[0]);
700 context_destroy(&c
->context
[1]);
701 if (i
== OCON_ISID
|| i
== OCON_FS
||
702 i
== OCON_NETIF
|| i
== OCON_FSUSE
)
708 * Free any memory allocated by a policy database structure.
710 void policydb_destroy(struct policydb
*p
)
712 struct ocontext
*c
, *ctmp
;
713 struct genfs
*g
, *gtmp
;
715 struct role_allow
*ra
, *lra
= NULL
;
716 struct role_trans
*tr
, *ltr
= NULL
;
717 struct filename_trans
*ft
, *nft
;
719 for (i
= 0; i
< SYM_NUM
; i
++) {
721 hashtab_map(p
->symtab
[i
].table
, destroy_f
[i
], NULL
);
722 hashtab_destroy(p
->symtab
[i
].table
);
725 for (i
= 0; i
< SYM_NUM
; i
++) {
726 if (p
->sym_val_to_name
[i
])
727 flex_array_free(p
->sym_val_to_name
[i
]);
730 kfree(p
->class_val_to_struct
);
731 kfree(p
->role_val_to_struct
);
732 kfree(p
->user_val_to_struct
);
733 if (p
->type_val_to_struct_array
)
734 flex_array_free(p
->type_val_to_struct_array
);
736 avtab_destroy(&p
->te_avtab
);
738 for (i
= 0; i
< OCON_NUM
; i
++) {
744 ocontext_destroy(ctmp
, i
);
746 p
->ocontexts
[i
] = NULL
;
757 ocontext_destroy(ctmp
, OCON_FSUSE
);
765 cond_policydb_destroy(p
);
767 for (tr
= p
->role_tr
; tr
; tr
= tr
->next
) {
774 for (ra
= p
->role_allow
; ra
; ra
= ra
->next
) {
781 hashtab_map(p
->range_tr
, range_tr_destroy
, NULL
);
782 hashtab_destroy(p
->range_tr
);
784 if (p
->type_attr_map_array
) {
785 for (i
= 0; i
< p
->p_types
.nprim
; i
++) {
788 e
= flex_array_get(p
->type_attr_map_array
, i
);
793 flex_array_free(p
->type_attr_map_array
);
796 ft
= p
->filename_trans
;
804 ebitmap_destroy(&p
->policycaps
);
805 ebitmap_destroy(&p
->permissive_map
);
811 * Load the initial SIDs specified in a policy database
812 * structure into a SID table.
814 int policydb_load_isids(struct policydb
*p
, struct sidtab
*s
)
816 struct ocontext
*head
, *c
;
821 printk(KERN_ERR
"SELinux: out of memory on SID table init\n");
825 head
= p
->ocontexts
[OCON_ISID
];
826 for (c
= head
; c
; c
= c
->next
) {
828 if (!c
->context
[0].user
) {
829 printk(KERN_ERR
"SELinux: SID %s was never defined.\n",
834 rc
= sidtab_insert(s
, c
->sid
[0], &c
->context
[0]);
836 printk(KERN_ERR
"SELinux: unable to load initial SID %s.\n",
846 int policydb_class_isvalid(struct policydb
*p
, unsigned int class)
848 if (!class || class > p
->p_classes
.nprim
)
853 int policydb_role_isvalid(struct policydb
*p
, unsigned int role
)
855 if (!role
|| role
> p
->p_roles
.nprim
)
860 int policydb_type_isvalid(struct policydb
*p
, unsigned int type
)
862 if (!type
|| type
> p
->p_types
.nprim
)
868 * Return 1 if the fields in the security context
869 * structure `c' are valid. Return 0 otherwise.
871 int policydb_context_isvalid(struct policydb
*p
, struct context
*c
)
873 struct role_datum
*role
;
874 struct user_datum
*usrdatum
;
876 if (!c
->role
|| c
->role
> p
->p_roles
.nprim
)
879 if (!c
->user
|| c
->user
> p
->p_users
.nprim
)
882 if (!c
->type
|| c
->type
> p
->p_types
.nprim
)
885 if (c
->role
!= OBJECT_R_VAL
) {
887 * Role must be authorized for the type.
889 role
= p
->role_val_to_struct
[c
->role
- 1];
890 if (!ebitmap_get_bit(&role
->types
, c
->type
- 1))
891 /* role may not be associated with type */
895 * User must be authorized for the role.
897 usrdatum
= p
->user_val_to_struct
[c
->user
- 1];
901 if (!ebitmap_get_bit(&usrdatum
->roles
, c
->role
- 1))
902 /* user may not be associated with role */
906 if (!mls_context_isvalid(p
, c
))
913 * Read a MLS range structure from a policydb binary
914 * representation file.
916 static int mls_read_range_helper(struct mls_range
*r
, void *fp
)
922 rc
= next_entry(buf
, fp
, sizeof(u32
));
927 items
= le32_to_cpu(buf
[0]);
928 if (items
> ARRAY_SIZE(buf
)) {
929 printk(KERN_ERR
"SELinux: mls: range overflow\n");
933 rc
= next_entry(buf
, fp
, sizeof(u32
) * items
);
935 printk(KERN_ERR
"SELinux: mls: truncated range\n");
939 r
->level
[0].sens
= le32_to_cpu(buf
[0]);
941 r
->level
[1].sens
= le32_to_cpu(buf
[1]);
943 r
->level
[1].sens
= r
->level
[0].sens
;
945 rc
= ebitmap_read(&r
->level
[0].cat
, fp
);
947 printk(KERN_ERR
"SELinux: mls: error reading low categories\n");
951 rc
= ebitmap_read(&r
->level
[1].cat
, fp
);
953 printk(KERN_ERR
"SELinux: mls: error reading high categories\n");
957 rc
= ebitmap_cpy(&r
->level
[1].cat
, &r
->level
[0].cat
);
959 printk(KERN_ERR
"SELinux: mls: out of memory\n");
966 ebitmap_destroy(&r
->level
[0].cat
);
972 * Read and validate a security context structure
973 * from a policydb binary representation file.
975 static int context_read_and_validate(struct context
*c
,
982 rc
= next_entry(buf
, fp
, sizeof buf
);
984 printk(KERN_ERR
"SELinux: context truncated\n");
987 c
->user
= le32_to_cpu(buf
[0]);
988 c
->role
= le32_to_cpu(buf
[1]);
989 c
->type
= le32_to_cpu(buf
[2]);
990 if (p
->policyvers
>= POLICYDB_VERSION_MLS
) {
991 rc
= mls_read_range_helper(&c
->range
, fp
);
993 printk(KERN_ERR
"SELinux: error reading MLS range of context\n");
999 if (!policydb_context_isvalid(p
, c
)) {
1000 printk(KERN_ERR
"SELinux: invalid security context\n");
1010 * The following *_read functions are used to
1011 * read the symbol data from a policy database
1012 * binary representation file.
1015 static int perm_read(struct policydb
*p
, struct hashtab
*h
, void *fp
)
1018 struct perm_datum
*perdatum
;
1024 perdatum
= kzalloc(sizeof(*perdatum
), GFP_KERNEL
);
1028 rc
= next_entry(buf
, fp
, sizeof buf
);
1032 len
= le32_to_cpu(buf
[0]);
1033 perdatum
->value
= le32_to_cpu(buf
[1]);
1036 key
= kmalloc(len
+ 1, GFP_KERNEL
);
1040 rc
= next_entry(key
, fp
, len
);
1045 rc
= hashtab_insert(h
, key
, perdatum
);
1051 perm_destroy(key
, perdatum
, NULL
);
1055 static int common_read(struct policydb
*p
, struct hashtab
*h
, void *fp
)
1058 struct common_datum
*comdatum
;
1064 comdatum
= kzalloc(sizeof(*comdatum
), GFP_KERNEL
);
1068 rc
= next_entry(buf
, fp
, sizeof buf
);
1072 len
= le32_to_cpu(buf
[0]);
1073 comdatum
->value
= le32_to_cpu(buf
[1]);
1075 rc
= symtab_init(&comdatum
->permissions
, PERM_SYMTAB_SIZE
);
1078 comdatum
->permissions
.nprim
= le32_to_cpu(buf
[2]);
1079 nel
= le32_to_cpu(buf
[3]);
1082 key
= kmalloc(len
+ 1, GFP_KERNEL
);
1086 rc
= next_entry(key
, fp
, len
);
1091 for (i
= 0; i
< nel
; i
++) {
1092 rc
= perm_read(p
, comdatum
->permissions
.table
, fp
);
1097 rc
= hashtab_insert(h
, key
, comdatum
);
1102 common_destroy(key
, comdatum
, NULL
);
1106 static int read_cons_helper(struct constraint_node
**nodep
, int ncons
,
1107 int allowxtarget
, void *fp
)
1109 struct constraint_node
*c
, *lc
;
1110 struct constraint_expr
*e
, *le
;
1113 int rc
, i
, j
, depth
;
1116 for (i
= 0; i
< ncons
; i
++) {
1117 c
= kzalloc(sizeof(*c
), GFP_KERNEL
);
1126 rc
= next_entry(buf
, fp
, (sizeof(u32
) * 2));
1129 c
->permissions
= le32_to_cpu(buf
[0]);
1130 nexpr
= le32_to_cpu(buf
[1]);
1133 for (j
= 0; j
< nexpr
; j
++) {
1134 e
= kzalloc(sizeof(*e
), GFP_KERNEL
);
1143 rc
= next_entry(buf
, fp
, (sizeof(u32
) * 3));
1146 e
->expr_type
= le32_to_cpu(buf
[0]);
1147 e
->attr
= le32_to_cpu(buf
[1]);
1148 e
->op
= le32_to_cpu(buf
[2]);
1150 switch (e
->expr_type
) {
1162 if (depth
== (CEXPR_MAXDEPTH
- 1))
1167 if (!allowxtarget
&& (e
->attr
& CEXPR_XTARGET
))
1169 if (depth
== (CEXPR_MAXDEPTH
- 1))
1172 rc
= ebitmap_read(&e
->names
, fp
);
1189 static int class_read(struct policydb
*p
, struct hashtab
*h
, void *fp
)
1192 struct class_datum
*cladatum
;
1194 u32 len
, len2
, ncons
, nel
;
1198 cladatum
= kzalloc(sizeof(*cladatum
), GFP_KERNEL
);
1202 rc
= next_entry(buf
, fp
, sizeof(u32
)*6);
1206 len
= le32_to_cpu(buf
[0]);
1207 len2
= le32_to_cpu(buf
[1]);
1208 cladatum
->value
= le32_to_cpu(buf
[2]);
1210 rc
= symtab_init(&cladatum
->permissions
, PERM_SYMTAB_SIZE
);
1213 cladatum
->permissions
.nprim
= le32_to_cpu(buf
[3]);
1214 nel
= le32_to_cpu(buf
[4]);
1216 ncons
= le32_to_cpu(buf
[5]);
1219 key
= kmalloc(len
+ 1, GFP_KERNEL
);
1223 rc
= next_entry(key
, fp
, len
);
1230 cladatum
->comkey
= kmalloc(len2
+ 1, GFP_KERNEL
);
1231 if (!cladatum
->comkey
)
1233 rc
= next_entry(cladatum
->comkey
, fp
, len2
);
1236 cladatum
->comkey
[len2
] = '\0';
1239 cladatum
->comdatum
= hashtab_search(p
->p_commons
.table
, cladatum
->comkey
);
1240 if (!cladatum
->comdatum
) {
1241 printk(KERN_ERR
"SELinux: unknown common %s\n", cladatum
->comkey
);
1245 for (i
= 0; i
< nel
; i
++) {
1246 rc
= perm_read(p
, cladatum
->permissions
.table
, fp
);
1251 rc
= read_cons_helper(&cladatum
->constraints
, ncons
, 0, fp
);
1255 if (p
->policyvers
>= POLICYDB_VERSION_VALIDATETRANS
) {
1256 /* grab the validatetrans rules */
1257 rc
= next_entry(buf
, fp
, sizeof(u32
));
1260 ncons
= le32_to_cpu(buf
[0]);
1261 rc
= read_cons_helper(&cladatum
->validatetrans
, ncons
, 1, fp
);
1266 rc
= hashtab_insert(h
, key
, cladatum
);
1272 cls_destroy(key
, cladatum
, NULL
);
1276 static int role_read(struct policydb
*p
, struct hashtab
*h
, void *fp
)
1279 struct role_datum
*role
;
1280 int rc
, to_read
= 2;
1285 role
= kzalloc(sizeof(*role
), GFP_KERNEL
);
1289 if (p
->policyvers
>= POLICYDB_VERSION_BOUNDARY
)
1292 rc
= next_entry(buf
, fp
, sizeof(buf
[0]) * to_read
);
1296 len
= le32_to_cpu(buf
[0]);
1297 role
->value
= le32_to_cpu(buf
[1]);
1298 if (p
->policyvers
>= POLICYDB_VERSION_BOUNDARY
)
1299 role
->bounds
= le32_to_cpu(buf
[2]);
1302 key
= kmalloc(len
+ 1, GFP_KERNEL
);
1306 rc
= next_entry(key
, fp
, len
);
1311 rc
= ebitmap_read(&role
->dominates
, fp
);
1315 rc
= ebitmap_read(&role
->types
, fp
);
1319 if (strcmp(key
, OBJECT_R
) == 0) {
1321 if (role
->value
!= OBJECT_R_VAL
) {
1322 printk(KERN_ERR
"SELinux: Role %s has wrong value %d\n",
1323 OBJECT_R
, role
->value
);
1330 rc
= hashtab_insert(h
, key
, role
);
1335 role_destroy(key
, role
, NULL
);
1339 static int type_read(struct policydb
*p
, struct hashtab
*h
, void *fp
)
1342 struct type_datum
*typdatum
;
1343 int rc
, to_read
= 3;
1348 typdatum
= kzalloc(sizeof(*typdatum
), GFP_KERNEL
);
1352 if (p
->policyvers
>= POLICYDB_VERSION_BOUNDARY
)
1355 rc
= next_entry(buf
, fp
, sizeof(buf
[0]) * to_read
);
1359 len
= le32_to_cpu(buf
[0]);
1360 typdatum
->value
= le32_to_cpu(buf
[1]);
1361 if (p
->policyvers
>= POLICYDB_VERSION_BOUNDARY
) {
1362 u32 prop
= le32_to_cpu(buf
[2]);
1364 if (prop
& TYPEDATUM_PROPERTY_PRIMARY
)
1365 typdatum
->primary
= 1;
1366 if (prop
& TYPEDATUM_PROPERTY_ATTRIBUTE
)
1367 typdatum
->attribute
= 1;
1369 typdatum
->bounds
= le32_to_cpu(buf
[3]);
1371 typdatum
->primary
= le32_to_cpu(buf
[2]);
1375 key
= kmalloc(len
+ 1, GFP_KERNEL
);
1378 rc
= next_entry(key
, fp
, len
);
1383 rc
= hashtab_insert(h
, key
, typdatum
);
1388 type_destroy(key
, typdatum
, NULL
);
1394 * Read a MLS level structure from a policydb binary
1395 * representation file.
1397 static int mls_read_level(struct mls_level
*lp
, void *fp
)
1402 memset(lp
, 0, sizeof(*lp
));
1404 rc
= next_entry(buf
, fp
, sizeof buf
);
1406 printk(KERN_ERR
"SELinux: mls: truncated level\n");
1409 lp
->sens
= le32_to_cpu(buf
[0]);
1411 rc
= ebitmap_read(&lp
->cat
, fp
);
1413 printk(KERN_ERR
"SELinux: mls: error reading level categories\n");
1419 static int user_read(struct policydb
*p
, struct hashtab
*h
, void *fp
)
1422 struct user_datum
*usrdatum
;
1423 int rc
, to_read
= 2;
1428 usrdatum
= kzalloc(sizeof(*usrdatum
), GFP_KERNEL
);
1432 if (p
->policyvers
>= POLICYDB_VERSION_BOUNDARY
)
1435 rc
= next_entry(buf
, fp
, sizeof(buf
[0]) * to_read
);
1439 len
= le32_to_cpu(buf
[0]);
1440 usrdatum
->value
= le32_to_cpu(buf
[1]);
1441 if (p
->policyvers
>= POLICYDB_VERSION_BOUNDARY
)
1442 usrdatum
->bounds
= le32_to_cpu(buf
[2]);
1445 key
= kmalloc(len
+ 1, GFP_KERNEL
);
1448 rc
= next_entry(key
, fp
, len
);
1453 rc
= ebitmap_read(&usrdatum
->roles
, fp
);
1457 if (p
->policyvers
>= POLICYDB_VERSION_MLS
) {
1458 rc
= mls_read_range_helper(&usrdatum
->range
, fp
);
1461 rc
= mls_read_level(&usrdatum
->dfltlevel
, fp
);
1466 rc
= hashtab_insert(h
, key
, usrdatum
);
1471 user_destroy(key
, usrdatum
, NULL
);
1475 static int sens_read(struct policydb
*p
, struct hashtab
*h
, void *fp
)
1478 struct level_datum
*levdatum
;
1484 levdatum
= kzalloc(sizeof(*levdatum
), GFP_ATOMIC
);
1488 rc
= next_entry(buf
, fp
, sizeof buf
);
1492 len
= le32_to_cpu(buf
[0]);
1493 levdatum
->isalias
= le32_to_cpu(buf
[1]);
1496 key
= kmalloc(len
+ 1, GFP_ATOMIC
);
1499 rc
= next_entry(key
, fp
, len
);
1505 levdatum
->level
= kmalloc(sizeof(struct mls_level
), GFP_ATOMIC
);
1506 if (!levdatum
->level
)
1509 rc
= mls_read_level(levdatum
->level
, fp
);
1513 rc
= hashtab_insert(h
, key
, levdatum
);
1518 sens_destroy(key
, levdatum
, NULL
);
1522 static int cat_read(struct policydb
*p
, struct hashtab
*h
, void *fp
)
1525 struct cat_datum
*catdatum
;
1531 catdatum
= kzalloc(sizeof(*catdatum
), GFP_ATOMIC
);
1535 rc
= next_entry(buf
, fp
, sizeof buf
);
1539 len
= le32_to_cpu(buf
[0]);
1540 catdatum
->value
= le32_to_cpu(buf
[1]);
1541 catdatum
->isalias
= le32_to_cpu(buf
[2]);
1544 key
= kmalloc(len
+ 1, GFP_ATOMIC
);
1547 rc
= next_entry(key
, fp
, len
);
1552 rc
= hashtab_insert(h
, key
, catdatum
);
1557 cat_destroy(key
, catdatum
, NULL
);
1561 static int (*read_f
[SYM_NUM
]) (struct policydb
*p
, struct hashtab
*h
, void *fp
) =
1573 static int user_bounds_sanity_check(void *key
, void *datum
, void *datap
)
1575 struct user_datum
*upper
, *user
;
1576 struct policydb
*p
= datap
;
1579 upper
= user
= datum
;
1580 while (upper
->bounds
) {
1581 struct ebitmap_node
*node
;
1584 if (++depth
== POLICYDB_BOUNDS_MAXDEPTH
) {
1585 printk(KERN_ERR
"SELinux: user %s: "
1586 "too deep or looped boundary",
1591 upper
= p
->user_val_to_struct
[upper
->bounds
- 1];
1592 ebitmap_for_each_positive_bit(&user
->roles
, node
, bit
) {
1593 if (ebitmap_get_bit(&upper
->roles
, bit
))
1597 "SELinux: boundary violated policy: "
1598 "user=%s role=%s bounds=%s\n",
1599 sym_name(p
, SYM_USERS
, user
->value
- 1),
1600 sym_name(p
, SYM_ROLES
, bit
),
1601 sym_name(p
, SYM_USERS
, upper
->value
- 1));
1610 static int role_bounds_sanity_check(void *key
, void *datum
, void *datap
)
1612 struct role_datum
*upper
, *role
;
1613 struct policydb
*p
= datap
;
1616 upper
= role
= datum
;
1617 while (upper
->bounds
) {
1618 struct ebitmap_node
*node
;
1621 if (++depth
== POLICYDB_BOUNDS_MAXDEPTH
) {
1622 printk(KERN_ERR
"SELinux: role %s: "
1623 "too deep or looped bounds\n",
1628 upper
= p
->role_val_to_struct
[upper
->bounds
- 1];
1629 ebitmap_for_each_positive_bit(&role
->types
, node
, bit
) {
1630 if (ebitmap_get_bit(&upper
->types
, bit
))
1634 "SELinux: boundary violated policy: "
1635 "role=%s type=%s bounds=%s\n",
1636 sym_name(p
, SYM_ROLES
, role
->value
- 1),
1637 sym_name(p
, SYM_TYPES
, bit
),
1638 sym_name(p
, SYM_ROLES
, upper
->value
- 1));
1647 static int type_bounds_sanity_check(void *key
, void *datum
, void *datap
)
1649 struct type_datum
*upper
;
1650 struct policydb
*p
= datap
;
1654 while (upper
->bounds
) {
1655 if (++depth
== POLICYDB_BOUNDS_MAXDEPTH
) {
1656 printk(KERN_ERR
"SELinux: type %s: "
1657 "too deep or looped boundary\n",
1662 upper
= flex_array_get_ptr(p
->type_val_to_struct_array
,
1666 if (upper
->attribute
) {
1667 printk(KERN_ERR
"SELinux: type %s: "
1668 "bounded by attribute %s",
1670 sym_name(p
, SYM_TYPES
, upper
->value
- 1));
1678 static int policydb_bounds_sanity_check(struct policydb
*p
)
1682 if (p
->policyvers
< POLICYDB_VERSION_BOUNDARY
)
1685 rc
= hashtab_map(p
->p_users
.table
,
1686 user_bounds_sanity_check
, p
);
1690 rc
= hashtab_map(p
->p_roles
.table
,
1691 role_bounds_sanity_check
, p
);
1695 rc
= hashtab_map(p
->p_types
.table
,
1696 type_bounds_sanity_check
, p
);
1703 extern int ss_initialized
;
1705 u16
string_to_security_class(struct policydb
*p
, const char *name
)
1707 struct class_datum
*cladatum
;
1709 cladatum
= hashtab_search(p
->p_classes
.table
, name
);
1713 return cladatum
->value
;
1716 u32
string_to_av_perm(struct policydb
*p
, u16 tclass
, const char *name
)
1718 struct class_datum
*cladatum
;
1719 struct perm_datum
*perdatum
= NULL
;
1720 struct common_datum
*comdatum
;
1722 if (!tclass
|| tclass
> p
->p_classes
.nprim
)
1725 cladatum
= p
->class_val_to_struct
[tclass
-1];
1726 comdatum
= cladatum
->comdatum
;
1728 perdatum
= hashtab_search(comdatum
->permissions
.table
,
1731 perdatum
= hashtab_search(cladatum
->permissions
.table
,
1736 return 1U << (perdatum
->value
-1);
1739 static int range_read(struct policydb
*p
, void *fp
)
1741 struct range_trans
*rt
= NULL
;
1742 struct mls_range
*r
= NULL
;
1747 if (p
->policyvers
< POLICYDB_VERSION_MLS
)
1750 rc
= next_entry(buf
, fp
, sizeof(u32
));
1754 nel
= le32_to_cpu(buf
[0]);
1755 for (i
= 0; i
< nel
; i
++) {
1757 rt
= kzalloc(sizeof(*rt
), GFP_KERNEL
);
1761 rc
= next_entry(buf
, fp
, (sizeof(u32
) * 2));
1765 rt
->source_type
= le32_to_cpu(buf
[0]);
1766 rt
->target_type
= le32_to_cpu(buf
[1]);
1767 if (p
->policyvers
>= POLICYDB_VERSION_RANGETRANS
) {
1768 rc
= next_entry(buf
, fp
, sizeof(u32
));
1771 rt
->target_class
= le32_to_cpu(buf
[0]);
1773 rt
->target_class
= p
->process_class
;
1776 if (!policydb_type_isvalid(p
, rt
->source_type
) ||
1777 !policydb_type_isvalid(p
, rt
->target_type
) ||
1778 !policydb_class_isvalid(p
, rt
->target_class
))
1782 r
= kzalloc(sizeof(*r
), GFP_KERNEL
);
1786 rc
= mls_read_range_helper(r
, fp
);
1791 if (!mls_range_isvalid(p
, r
)) {
1792 printk(KERN_WARNING
"SELinux: rangetrans: invalid range\n");
1796 rc
= hashtab_insert(p
->range_tr
, rt
, r
);
1803 rangetr_hash_eval(p
->range_tr
);
1811 static int filename_trans_read(struct policydb
*p
, void *fp
)
1813 struct filename_trans
*ft
, *last
;
1819 if (p
->policyvers
< POLICYDB_VERSION_FILENAME_TRANS
)
1822 rc
= next_entry(buf
, fp
, sizeof(u32
));
1825 nel
= le32_to_cpu(buf
[0]);
1827 last
= p
->filename_trans
;
1828 while (last
&& last
->next
)
1831 for (i
= 0; i
< nel
; i
++) {
1833 ft
= kzalloc(sizeof(*ft
), GFP_KERNEL
);
1837 /* add it to the tail of the list */
1839 p
->filename_trans
= ft
;
1844 /* length of the path component string */
1845 rc
= next_entry(buf
, fp
, sizeof(u32
));
1848 len
= le32_to_cpu(buf
[0]);
1851 name
= kmalloc(len
+ 1, GFP_KERNEL
);
1857 /* path component string */
1858 rc
= next_entry(name
, fp
, len
);
1863 rc
= next_entry(buf
, fp
, sizeof(u32
) * 4);
1867 ft
->stype
= le32_to_cpu(buf
[0]);
1868 ft
->ttype
= le32_to_cpu(buf
[1]);
1869 ft
->tclass
= le32_to_cpu(buf
[2]);
1870 ft
->otype
= le32_to_cpu(buf
[3]);
1877 static int genfs_read(struct policydb
*p
, void *fp
)
1880 u32 nel
, nel2
, len
, len2
;
1882 struct ocontext
*l
, *c
;
1883 struct ocontext
*newc
= NULL
;
1884 struct genfs
*genfs_p
, *genfs
;
1885 struct genfs
*newgenfs
= NULL
;
1887 rc
= next_entry(buf
, fp
, sizeof(u32
));
1890 nel
= le32_to_cpu(buf
[0]);
1892 for (i
= 0; i
< nel
; i
++) {
1893 rc
= next_entry(buf
, fp
, sizeof(u32
));
1896 len
= le32_to_cpu(buf
[0]);
1899 newgenfs
= kzalloc(sizeof(*newgenfs
), GFP_KERNEL
);
1904 newgenfs
->fstype
= kmalloc(len
+ 1, GFP_KERNEL
);
1905 if (!newgenfs
->fstype
)
1908 rc
= next_entry(newgenfs
->fstype
, fp
, len
);
1912 newgenfs
->fstype
[len
] = 0;
1914 for (genfs_p
= NULL
, genfs
= p
->genfs
; genfs
;
1915 genfs_p
= genfs
, genfs
= genfs
->next
) {
1917 if (strcmp(newgenfs
->fstype
, genfs
->fstype
) == 0) {
1918 printk(KERN_ERR
"SELinux: dup genfs fstype %s\n",
1922 if (strcmp(newgenfs
->fstype
, genfs
->fstype
) < 0)
1925 newgenfs
->next
= genfs
;
1927 genfs_p
->next
= newgenfs
;
1929 p
->genfs
= newgenfs
;
1933 rc
= next_entry(buf
, fp
, sizeof(u32
));
1937 nel2
= le32_to_cpu(buf
[0]);
1938 for (j
= 0; j
< nel2
; j
++) {
1939 rc
= next_entry(buf
, fp
, sizeof(u32
));
1942 len
= le32_to_cpu(buf
[0]);
1945 newc
= kzalloc(sizeof(*newc
), GFP_KERNEL
);
1950 newc
->u
.name
= kmalloc(len
+ 1, GFP_KERNEL
);
1954 rc
= next_entry(newc
->u
.name
, fp
, len
);
1957 newc
->u
.name
[len
] = 0;
1959 rc
= next_entry(buf
, fp
, sizeof(u32
));
1963 newc
->v
.sclass
= le32_to_cpu(buf
[0]);
1964 rc
= context_read_and_validate(&newc
->context
[0], p
, fp
);
1968 for (l
= NULL
, c
= genfs
->head
; c
;
1969 l
= c
, c
= c
->next
) {
1971 if (!strcmp(newc
->u
.name
, c
->u
.name
) &&
1972 (!c
->v
.sclass
|| !newc
->v
.sclass
||
1973 newc
->v
.sclass
== c
->v
.sclass
)) {
1974 printk(KERN_ERR
"SELinux: dup genfs entry (%s,%s)\n",
1975 genfs
->fstype
, c
->u
.name
);
1978 len
= strlen(newc
->u
.name
);
1979 len2
= strlen(c
->u
.name
);
1995 kfree(newgenfs
->fstype
);
1997 ocontext_destroy(newc
, OCON_FSUSE
);
2002 static int ocontext_read(struct policydb
*p
, struct policydb_compat_info
*info
,
2008 struct ocontext
*l
, *c
;
2011 for (i
= 0; i
< info
->ocon_num
; i
++) {
2012 rc
= next_entry(buf
, fp
, sizeof(u32
));
2015 nel
= le32_to_cpu(buf
[0]);
2018 for (j
= 0; j
< nel
; j
++) {
2020 c
= kzalloc(sizeof(*c
), GFP_KERNEL
);
2026 p
->ocontexts
[i
] = c
;
2031 rc
= next_entry(buf
, fp
, sizeof(u32
));
2035 c
->sid
[0] = le32_to_cpu(buf
[0]);
2036 rc
= context_read_and_validate(&c
->context
[0], p
, fp
);
2042 rc
= next_entry(buf
, fp
, sizeof(u32
));
2045 len
= le32_to_cpu(buf
[0]);
2048 c
->u
.name
= kmalloc(len
+ 1, GFP_KERNEL
);
2052 rc
= next_entry(c
->u
.name
, fp
, len
);
2057 rc
= context_read_and_validate(&c
->context
[0], p
, fp
);
2060 rc
= context_read_and_validate(&c
->context
[1], p
, fp
);
2065 rc
= next_entry(buf
, fp
, sizeof(u32
)*3);
2068 c
->u
.port
.protocol
= le32_to_cpu(buf
[0]);
2069 c
->u
.port
.low_port
= le32_to_cpu(buf
[1]);
2070 c
->u
.port
.high_port
= le32_to_cpu(buf
[2]);
2071 rc
= context_read_and_validate(&c
->context
[0], p
, fp
);
2076 rc
= next_entry(nodebuf
, fp
, sizeof(u32
) * 2);
2079 c
->u
.node
.addr
= nodebuf
[0]; /* network order */
2080 c
->u
.node
.mask
= nodebuf
[1]; /* network order */
2081 rc
= context_read_and_validate(&c
->context
[0], p
, fp
);
2086 rc
= next_entry(buf
, fp
, sizeof(u32
)*2);
2091 c
->v
.behavior
= le32_to_cpu(buf
[0]);
2092 if (c
->v
.behavior
> SECURITY_FS_USE_NONE
)
2096 len
= le32_to_cpu(buf
[1]);
2097 c
->u
.name
= kmalloc(len
+ 1, GFP_KERNEL
);
2101 rc
= next_entry(c
->u
.name
, fp
, len
);
2105 rc
= context_read_and_validate(&c
->context
[0], p
, fp
);
2112 rc
= next_entry(nodebuf
, fp
, sizeof(u32
) * 8);
2115 for (k
= 0; k
< 4; k
++)
2116 c
->u
.node6
.addr
[k
] = nodebuf
[k
];
2117 for (k
= 0; k
< 4; k
++)
2118 c
->u
.node6
.mask
[k
] = nodebuf
[k
+4];
2119 rc
= context_read_and_validate(&c
->context
[0], p
, fp
);
2133 * Read the configuration data from a policy database binary
2134 * representation file into a policy database structure.
2136 int policydb_read(struct policydb
*p
, void *fp
)
2138 struct role_allow
*ra
, *lra
;
2139 struct role_trans
*tr
, *ltr
;
2142 u32 len
, nprim
, nel
;
2145 struct policydb_compat_info
*info
;
2147 rc
= policydb_init(p
);
2151 /* Read the magic number and string length. */
2152 rc
= next_entry(buf
, fp
, sizeof(u32
) * 2);
2157 if (le32_to_cpu(buf
[0]) != POLICYDB_MAGIC
) {
2158 printk(KERN_ERR
"SELinux: policydb magic number 0x%x does "
2159 "not match expected magic number 0x%x\n",
2160 le32_to_cpu(buf
[0]), POLICYDB_MAGIC
);
2165 len
= le32_to_cpu(buf
[1]);
2166 if (len
!= strlen(POLICYDB_STRING
)) {
2167 printk(KERN_ERR
"SELinux: policydb string length %d does not "
2168 "match expected length %Zu\n",
2169 len
, strlen(POLICYDB_STRING
));
2174 policydb_str
= kmalloc(len
+ 1, GFP_KERNEL
);
2175 if (!policydb_str
) {
2176 printk(KERN_ERR
"SELinux: unable to allocate memory for policydb "
2177 "string of length %d\n", len
);
2181 rc
= next_entry(policydb_str
, fp
, len
);
2183 printk(KERN_ERR
"SELinux: truncated policydb string identifier\n");
2184 kfree(policydb_str
);
2189 policydb_str
[len
] = '\0';
2190 if (strcmp(policydb_str
, POLICYDB_STRING
)) {
2191 printk(KERN_ERR
"SELinux: policydb string %s does not match "
2192 "my string %s\n", policydb_str
, POLICYDB_STRING
);
2193 kfree(policydb_str
);
2196 /* Done with policydb_str. */
2197 kfree(policydb_str
);
2198 policydb_str
= NULL
;
2200 /* Read the version and table sizes. */
2201 rc
= next_entry(buf
, fp
, sizeof(u32
)*4);
2206 p
->policyvers
= le32_to_cpu(buf
[0]);
2207 if (p
->policyvers
< POLICYDB_VERSION_MIN
||
2208 p
->policyvers
> POLICYDB_VERSION_MAX
) {
2209 printk(KERN_ERR
"SELinux: policydb version %d does not match "
2210 "my version range %d-%d\n",
2211 le32_to_cpu(buf
[0]), POLICYDB_VERSION_MIN
, POLICYDB_VERSION_MAX
);
2215 if ((le32_to_cpu(buf
[1]) & POLICYDB_CONFIG_MLS
)) {
2219 if (p
->policyvers
< POLICYDB_VERSION_MLS
) {
2220 printk(KERN_ERR
"SELinux: security policydb version %d "
2221 "(MLS) not backwards compatible\n",
2226 p
->reject_unknown
= !!(le32_to_cpu(buf
[1]) & REJECT_UNKNOWN
);
2227 p
->allow_unknown
= !!(le32_to_cpu(buf
[1]) & ALLOW_UNKNOWN
);
2229 if (p
->policyvers
>= POLICYDB_VERSION_POLCAP
) {
2230 rc
= ebitmap_read(&p
->policycaps
, fp
);
2235 if (p
->policyvers
>= POLICYDB_VERSION_PERMISSIVE
) {
2236 rc
= ebitmap_read(&p
->permissive_map
, fp
);
2242 info
= policydb_lookup_compat(p
->policyvers
);
2244 printk(KERN_ERR
"SELinux: unable to find policy compat info "
2245 "for version %d\n", p
->policyvers
);
2250 if (le32_to_cpu(buf
[2]) != info
->sym_num
||
2251 le32_to_cpu(buf
[3]) != info
->ocon_num
) {
2252 printk(KERN_ERR
"SELinux: policydb table sizes (%d,%d) do "
2253 "not match mine (%d,%d)\n", le32_to_cpu(buf
[2]),
2254 le32_to_cpu(buf
[3]),
2255 info
->sym_num
, info
->ocon_num
);
2259 for (i
= 0; i
< info
->sym_num
; i
++) {
2260 rc
= next_entry(buf
, fp
, sizeof(u32
)*2);
2263 nprim
= le32_to_cpu(buf
[0]);
2264 nel
= le32_to_cpu(buf
[1]);
2265 for (j
= 0; j
< nel
; j
++) {
2266 rc
= read_f
[i
](p
, p
->symtab
[i
].table
, fp
);
2271 p
->symtab
[i
].nprim
= nprim
;
2275 p
->process_class
= string_to_security_class(p
, "process");
2276 if (!p
->process_class
)
2279 rc
= avtab_read(&p
->te_avtab
, fp
, p
);
2283 if (p
->policyvers
>= POLICYDB_VERSION_BOOL
) {
2284 rc
= cond_read_list(p
, fp
);
2289 rc
= next_entry(buf
, fp
, sizeof(u32
));
2292 nel
= le32_to_cpu(buf
[0]);
2294 for (i
= 0; i
< nel
; i
++) {
2296 tr
= kzalloc(sizeof(*tr
), GFP_KERNEL
);
2303 rc
= next_entry(buf
, fp
, sizeof(u32
)*3);
2308 tr
->role
= le32_to_cpu(buf
[0]);
2309 tr
->type
= le32_to_cpu(buf
[1]);
2310 tr
->new_role
= le32_to_cpu(buf
[2]);
2311 if (p
->policyvers
>= POLICYDB_VERSION_ROLETRANS
) {
2312 rc
= next_entry(buf
, fp
, sizeof(u32
));
2315 tr
->tclass
= le32_to_cpu(buf
[0]);
2317 tr
->tclass
= p
->process_class
;
2319 if (!policydb_role_isvalid(p
, tr
->role
) ||
2320 !policydb_type_isvalid(p
, tr
->type
) ||
2321 !policydb_class_isvalid(p
, tr
->tclass
) ||
2322 !policydb_role_isvalid(p
, tr
->new_role
))
2327 rc
= next_entry(buf
, fp
, sizeof(u32
));
2330 nel
= le32_to_cpu(buf
[0]);
2332 for (i
= 0; i
< nel
; i
++) {
2334 ra
= kzalloc(sizeof(*ra
), GFP_KERNEL
);
2341 rc
= next_entry(buf
, fp
, sizeof(u32
)*2);
2346 ra
->role
= le32_to_cpu(buf
[0]);
2347 ra
->new_role
= le32_to_cpu(buf
[1]);
2348 if (!policydb_role_isvalid(p
, ra
->role
) ||
2349 !policydb_role_isvalid(p
, ra
->new_role
))
2354 rc
= filename_trans_read(p
, fp
);
2358 rc
= policydb_index(p
);
2363 p
->process_trans_perms
= string_to_av_perm(p
, p
->process_class
, "transition");
2364 p
->process_trans_perms
|= string_to_av_perm(p
, p
->process_class
, "dyntransition");
2365 if (!p
->process_trans_perms
)
2368 rc
= ocontext_read(p
, info
, fp
);
2372 rc
= genfs_read(p
, fp
);
2376 rc
= range_read(p
, fp
);
2381 p
->type_attr_map_array
= flex_array_alloc(sizeof(struct ebitmap
),
2383 GFP_KERNEL
| __GFP_ZERO
);
2384 if (!p
->type_attr_map_array
)
2387 /* preallocate so we don't have to worry about the put ever failing */
2388 rc
= flex_array_prealloc(p
->type_attr_map_array
, 0, p
->p_types
.nprim
- 1,
2389 GFP_KERNEL
| __GFP_ZERO
);
2393 for (i
= 0; i
< p
->p_types
.nprim
; i
++) {
2394 struct ebitmap
*e
= flex_array_get(p
->type_attr_map_array
, i
);
2398 if (p
->policyvers
>= POLICYDB_VERSION_AVTAB
) {
2399 rc
= ebitmap_read(e
, fp
);
2403 /* add the type itself as the degenerate case */
2404 rc
= ebitmap_set_bit(e
, i
, 1);
2409 rc
= policydb_bounds_sanity_check(p
);
2417 policydb_destroy(p
);
2422 * Write a MLS level structure to a policydb binary
2423 * representation file.
2425 static int mls_write_level(struct mls_level
*l
, void *fp
)
2430 buf
[0] = cpu_to_le32(l
->sens
);
2431 rc
= put_entry(buf
, sizeof(u32
), 1, fp
);
2435 rc
= ebitmap_write(&l
->cat
, fp
);
2443 * Write a MLS range structure to a policydb binary
2444 * representation file.
2446 static int mls_write_range_helper(struct mls_range
*r
, void *fp
)
2452 eq
= mls_level_eq(&r
->level
[1], &r
->level
[0]);
2458 buf
[0] = cpu_to_le32(items
-1);
2459 buf
[1] = cpu_to_le32(r
->level
[0].sens
);
2461 buf
[2] = cpu_to_le32(r
->level
[1].sens
);
2463 BUG_ON(items
> (sizeof(buf
)/sizeof(buf
[0])));
2465 rc
= put_entry(buf
, sizeof(u32
), items
, fp
);
2469 rc
= ebitmap_write(&r
->level
[0].cat
, fp
);
2473 rc
= ebitmap_write(&r
->level
[1].cat
, fp
);
2481 static int sens_write(void *vkey
, void *datum
, void *ptr
)
2484 struct level_datum
*levdatum
= datum
;
2485 struct policy_data
*pd
= ptr
;
2492 buf
[0] = cpu_to_le32(len
);
2493 buf
[1] = cpu_to_le32(levdatum
->isalias
);
2494 rc
= put_entry(buf
, sizeof(u32
), 2, fp
);
2498 rc
= put_entry(key
, 1, len
, fp
);
2502 rc
= mls_write_level(levdatum
->level
, fp
);
2509 static int cat_write(void *vkey
, void *datum
, void *ptr
)
2512 struct cat_datum
*catdatum
= datum
;
2513 struct policy_data
*pd
= ptr
;
2520 buf
[0] = cpu_to_le32(len
);
2521 buf
[1] = cpu_to_le32(catdatum
->value
);
2522 buf
[2] = cpu_to_le32(catdatum
->isalias
);
2523 rc
= put_entry(buf
, sizeof(u32
), 3, fp
);
2527 rc
= put_entry(key
, 1, len
, fp
);
2534 static int role_trans_write(struct policydb
*p
, void *fp
)
2536 struct role_trans
*r
= p
->role_tr
;
2537 struct role_trans
*tr
;
2543 for (tr
= r
; tr
; tr
= tr
->next
)
2545 buf
[0] = cpu_to_le32(nel
);
2546 rc
= put_entry(buf
, sizeof(u32
), 1, fp
);
2549 for (tr
= r
; tr
; tr
= tr
->next
) {
2550 buf
[0] = cpu_to_le32(tr
->role
);
2551 buf
[1] = cpu_to_le32(tr
->type
);
2552 buf
[2] = cpu_to_le32(tr
->new_role
);
2553 rc
= put_entry(buf
, sizeof(u32
), 3, fp
);
2556 if (p
->policyvers
>= POLICYDB_VERSION_ROLETRANS
) {
2557 buf
[0] = cpu_to_le32(tr
->tclass
);
2558 rc
= put_entry(buf
, sizeof(u32
), 1, fp
);
2567 static int role_allow_write(struct role_allow
*r
, void *fp
)
2569 struct role_allow
*ra
;
2575 for (ra
= r
; ra
; ra
= ra
->next
)
2577 buf
[0] = cpu_to_le32(nel
);
2578 rc
= put_entry(buf
, sizeof(u32
), 1, fp
);
2581 for (ra
= r
; ra
; ra
= ra
->next
) {
2582 buf
[0] = cpu_to_le32(ra
->role
);
2583 buf
[1] = cpu_to_le32(ra
->new_role
);
2584 rc
= put_entry(buf
, sizeof(u32
), 2, fp
);
2592 * Write a security context structure
2593 * to a policydb binary representation file.
2595 static int context_write(struct policydb
*p
, struct context
*c
,
2601 buf
[0] = cpu_to_le32(c
->user
);
2602 buf
[1] = cpu_to_le32(c
->role
);
2603 buf
[2] = cpu_to_le32(c
->type
);
2605 rc
= put_entry(buf
, sizeof(u32
), 3, fp
);
2609 rc
= mls_write_range_helper(&c
->range
, fp
);
2617 * The following *_write functions are used to
2618 * write the symbol data to a policy database
2619 * binary representation file.
2622 static int perm_write(void *vkey
, void *datum
, void *fp
)
2625 struct perm_datum
*perdatum
= datum
;
2631 buf
[0] = cpu_to_le32(len
);
2632 buf
[1] = cpu_to_le32(perdatum
->value
);
2633 rc
= put_entry(buf
, sizeof(u32
), 2, fp
);
2637 rc
= put_entry(key
, 1, len
, fp
);
2644 static int common_write(void *vkey
, void *datum
, void *ptr
)
2647 struct common_datum
*comdatum
= datum
;
2648 struct policy_data
*pd
= ptr
;
2655 buf
[0] = cpu_to_le32(len
);
2656 buf
[1] = cpu_to_le32(comdatum
->value
);
2657 buf
[2] = cpu_to_le32(comdatum
->permissions
.nprim
);
2658 buf
[3] = cpu_to_le32(comdatum
->permissions
.table
->nel
);
2659 rc
= put_entry(buf
, sizeof(u32
), 4, fp
);
2663 rc
= put_entry(key
, 1, len
, fp
);
2667 rc
= hashtab_map(comdatum
->permissions
.table
, perm_write
, fp
);
2674 static int write_cons_helper(struct policydb
*p
, struct constraint_node
*node
,
2677 struct constraint_node
*c
;
2678 struct constraint_expr
*e
;
2683 for (c
= node
; c
; c
= c
->next
) {
2685 for (e
= c
->expr
; e
; e
= e
->next
)
2687 buf
[0] = cpu_to_le32(c
->permissions
);
2688 buf
[1] = cpu_to_le32(nel
);
2689 rc
= put_entry(buf
, sizeof(u32
), 2, fp
);
2692 for (e
= c
->expr
; e
; e
= e
->next
) {
2693 buf
[0] = cpu_to_le32(e
->expr_type
);
2694 buf
[1] = cpu_to_le32(e
->attr
);
2695 buf
[2] = cpu_to_le32(e
->op
);
2696 rc
= put_entry(buf
, sizeof(u32
), 3, fp
);
2700 switch (e
->expr_type
) {
2702 rc
= ebitmap_write(&e
->names
, fp
);
2715 static int class_write(void *vkey
, void *datum
, void *ptr
)
2718 struct class_datum
*cladatum
= datum
;
2719 struct policy_data
*pd
= ptr
;
2721 struct policydb
*p
= pd
->p
;
2722 struct constraint_node
*c
;
2729 if (cladatum
->comkey
)
2730 len2
= strlen(cladatum
->comkey
);
2735 for (c
= cladatum
->constraints
; c
; c
= c
->next
)
2738 buf
[0] = cpu_to_le32(len
);
2739 buf
[1] = cpu_to_le32(len2
);
2740 buf
[2] = cpu_to_le32(cladatum
->value
);
2741 buf
[3] = cpu_to_le32(cladatum
->permissions
.nprim
);
2742 if (cladatum
->permissions
.table
)
2743 buf
[4] = cpu_to_le32(cladatum
->permissions
.table
->nel
);
2746 buf
[5] = cpu_to_le32(ncons
);
2747 rc
= put_entry(buf
, sizeof(u32
), 6, fp
);
2751 rc
= put_entry(key
, 1, len
, fp
);
2755 if (cladatum
->comkey
) {
2756 rc
= put_entry(cladatum
->comkey
, 1, len2
, fp
);
2761 rc
= hashtab_map(cladatum
->permissions
.table
, perm_write
, fp
);
2765 rc
= write_cons_helper(p
, cladatum
->constraints
, fp
);
2769 /* write out the validatetrans rule */
2771 for (c
= cladatum
->validatetrans
; c
; c
= c
->next
)
2774 buf
[0] = cpu_to_le32(ncons
);
2775 rc
= put_entry(buf
, sizeof(u32
), 1, fp
);
2779 rc
= write_cons_helper(p
, cladatum
->validatetrans
, fp
);
2786 static int role_write(void *vkey
, void *datum
, void *ptr
)
2789 struct role_datum
*role
= datum
;
2790 struct policy_data
*pd
= ptr
;
2792 struct policydb
*p
= pd
->p
;
2799 buf
[items
++] = cpu_to_le32(len
);
2800 buf
[items
++] = cpu_to_le32(role
->value
);
2801 if (p
->policyvers
>= POLICYDB_VERSION_BOUNDARY
)
2802 buf
[items
++] = cpu_to_le32(role
->bounds
);
2804 BUG_ON(items
> (sizeof(buf
)/sizeof(buf
[0])));
2806 rc
= put_entry(buf
, sizeof(u32
), items
, fp
);
2810 rc
= put_entry(key
, 1, len
, fp
);
2814 rc
= ebitmap_write(&role
->dominates
, fp
);
2818 rc
= ebitmap_write(&role
->types
, fp
);
2825 static int type_write(void *vkey
, void *datum
, void *ptr
)
2828 struct type_datum
*typdatum
= datum
;
2829 struct policy_data
*pd
= ptr
;
2830 struct policydb
*p
= pd
->p
;
2838 buf
[items
++] = cpu_to_le32(len
);
2839 buf
[items
++] = cpu_to_le32(typdatum
->value
);
2840 if (p
->policyvers
>= POLICYDB_VERSION_BOUNDARY
) {
2843 if (typdatum
->primary
)
2844 properties
|= TYPEDATUM_PROPERTY_PRIMARY
;
2846 if (typdatum
->attribute
)
2847 properties
|= TYPEDATUM_PROPERTY_ATTRIBUTE
;
2849 buf
[items
++] = cpu_to_le32(properties
);
2850 buf
[items
++] = cpu_to_le32(typdatum
->bounds
);
2852 buf
[items
++] = cpu_to_le32(typdatum
->primary
);
2854 BUG_ON(items
> (sizeof(buf
) / sizeof(buf
[0])));
2855 rc
= put_entry(buf
, sizeof(u32
), items
, fp
);
2859 rc
= put_entry(key
, 1, len
, fp
);
2866 static int user_write(void *vkey
, void *datum
, void *ptr
)
2869 struct user_datum
*usrdatum
= datum
;
2870 struct policy_data
*pd
= ptr
;
2871 struct policydb
*p
= pd
->p
;
2879 buf
[items
++] = cpu_to_le32(len
);
2880 buf
[items
++] = cpu_to_le32(usrdatum
->value
);
2881 if (p
->policyvers
>= POLICYDB_VERSION_BOUNDARY
)
2882 buf
[items
++] = cpu_to_le32(usrdatum
->bounds
);
2883 BUG_ON(items
> (sizeof(buf
) / sizeof(buf
[0])));
2884 rc
= put_entry(buf
, sizeof(u32
), items
, fp
);
2888 rc
= put_entry(key
, 1, len
, fp
);
2892 rc
= ebitmap_write(&usrdatum
->roles
, fp
);
2896 rc
= mls_write_range_helper(&usrdatum
->range
, fp
);
2900 rc
= mls_write_level(&usrdatum
->dfltlevel
, fp
);
2907 static int (*write_f
[SYM_NUM
]) (void *key
, void *datum
,
2920 static int ocontext_write(struct policydb
*p
, struct policydb_compat_info
*info
,
2923 unsigned int i
, j
, rc
;
2928 for (i
= 0; i
< info
->ocon_num
; i
++) {
2930 for (c
= p
->ocontexts
[i
]; c
; c
= c
->next
)
2932 buf
[0] = cpu_to_le32(nel
);
2933 rc
= put_entry(buf
, sizeof(u32
), 1, fp
);
2936 for (c
= p
->ocontexts
[i
]; c
; c
= c
->next
) {
2939 buf
[0] = cpu_to_le32(c
->sid
[0]);
2940 rc
= put_entry(buf
, sizeof(u32
), 1, fp
);
2943 rc
= context_write(p
, &c
->context
[0], fp
);
2949 len
= strlen(c
->u
.name
);
2950 buf
[0] = cpu_to_le32(len
);
2951 rc
= put_entry(buf
, sizeof(u32
), 1, fp
);
2954 rc
= put_entry(c
->u
.name
, 1, len
, fp
);
2957 rc
= context_write(p
, &c
->context
[0], fp
);
2960 rc
= context_write(p
, &c
->context
[1], fp
);
2965 buf
[0] = cpu_to_le32(c
->u
.port
.protocol
);
2966 buf
[1] = cpu_to_le32(c
->u
.port
.low_port
);
2967 buf
[2] = cpu_to_le32(c
->u
.port
.high_port
);
2968 rc
= put_entry(buf
, sizeof(u32
), 3, fp
);
2971 rc
= context_write(p
, &c
->context
[0], fp
);
2976 nodebuf
[0] = c
->u
.node
.addr
; /* network order */
2977 nodebuf
[1] = c
->u
.node
.mask
; /* network order */
2978 rc
= put_entry(nodebuf
, sizeof(u32
), 2, fp
);
2981 rc
= context_write(p
, &c
->context
[0], fp
);
2986 buf
[0] = cpu_to_le32(c
->v
.behavior
);
2987 len
= strlen(c
->u
.name
);
2988 buf
[1] = cpu_to_le32(len
);
2989 rc
= put_entry(buf
, sizeof(u32
), 2, fp
);
2992 rc
= put_entry(c
->u
.name
, 1, len
, fp
);
2995 rc
= context_write(p
, &c
->context
[0], fp
);
3000 for (j
= 0; j
< 4; j
++)
3001 nodebuf
[j
] = c
->u
.node6
.addr
[j
]; /* network order */
3002 for (j
= 0; j
< 4; j
++)
3003 nodebuf
[j
+ 4] = c
->u
.node6
.mask
[j
]; /* network order */
3004 rc
= put_entry(nodebuf
, sizeof(u32
), 8, fp
);
3007 rc
= context_write(p
, &c
->context
[0], fp
);
3017 static int genfs_write(struct policydb
*p
, void *fp
)
3019 struct genfs
*genfs
;
3026 for (genfs
= p
->genfs
; genfs
; genfs
= genfs
->next
)
3028 buf
[0] = cpu_to_le32(len
);
3029 rc
= put_entry(buf
, sizeof(u32
), 1, fp
);
3032 for (genfs
= p
->genfs
; genfs
; genfs
= genfs
->next
) {
3033 len
= strlen(genfs
->fstype
);
3034 buf
[0] = cpu_to_le32(len
);
3035 rc
= put_entry(buf
, sizeof(u32
), 1, fp
);
3038 rc
= put_entry(genfs
->fstype
, 1, len
, fp
);
3042 for (c
= genfs
->head
; c
; c
= c
->next
)
3044 buf
[0] = cpu_to_le32(len
);
3045 rc
= put_entry(buf
, sizeof(u32
), 1, fp
);
3048 for (c
= genfs
->head
; c
; c
= c
->next
) {
3049 len
= strlen(c
->u
.name
);
3050 buf
[0] = cpu_to_le32(len
);
3051 rc
= put_entry(buf
, sizeof(u32
), 1, fp
);
3054 rc
= put_entry(c
->u
.name
, 1, len
, fp
);
3057 buf
[0] = cpu_to_le32(c
->v
.sclass
);
3058 rc
= put_entry(buf
, sizeof(u32
), 1, fp
);
3061 rc
= context_write(p
, &c
->context
[0], fp
);
3069 static int range_count(void *key
, void *data
, void *ptr
)
3077 static int range_write_helper(void *key
, void *data
, void *ptr
)
3080 struct range_trans
*rt
= key
;
3081 struct mls_range
*r
= data
;
3082 struct policy_data
*pd
= ptr
;
3084 struct policydb
*p
= pd
->p
;
3087 buf
[0] = cpu_to_le32(rt
->source_type
);
3088 buf
[1] = cpu_to_le32(rt
->target_type
);
3089 rc
= put_entry(buf
, sizeof(u32
), 2, fp
);
3092 if (p
->policyvers
>= POLICYDB_VERSION_RANGETRANS
) {
3093 buf
[0] = cpu_to_le32(rt
->target_class
);
3094 rc
= put_entry(buf
, sizeof(u32
), 1, fp
);
3098 rc
= mls_write_range_helper(r
, fp
);
3105 static int range_write(struct policydb
*p
, void *fp
)
3110 struct policy_data pd
;
3115 /* count the number of entries in the hashtab */
3117 rc
= hashtab_map(p
->range_tr
, range_count
, &nel
);
3121 buf
[0] = cpu_to_le32(nel
);
3122 rc
= put_entry(buf
, sizeof(u32
), 1, fp
);
3126 /* actually write all of the entries */
3127 rc
= hashtab_map(p
->range_tr
, range_write_helper
, &pd
);
3134 static int filename_trans_write(struct policydb
*p
, void *fp
)
3136 struct filename_trans
*ft
;
3141 for (ft
= p
->filename_trans
; ft
; ft
= ft
->next
)
3144 buf
[0] = cpu_to_le32(nel
);
3145 rc
= put_entry(buf
, sizeof(u32
), 1, fp
);
3149 for (ft
= p
->filename_trans
; ft
; ft
= ft
->next
) {
3150 len
= strlen(ft
->name
);
3151 buf
[0] = cpu_to_le32(len
);
3152 rc
= put_entry(buf
, sizeof(u32
), 1, fp
);
3156 rc
= put_entry(ft
->name
, sizeof(char), len
, fp
);
3162 buf
[2] = ft
->tclass
;
3165 rc
= put_entry(buf
, sizeof(u32
), 4, fp
);
3172 * Write the configuration data in a policy database
3173 * structure to a policy database binary representation
3176 int policydb_write(struct policydb
*p
, void *fp
)
3178 unsigned int i
, num_syms
;
3183 struct policydb_compat_info
*info
;
3186 * refuse to write policy older than compressed avtab
3187 * to simplify the writer. There are other tests dropped
3188 * since we assume this throughout the writer code. Be
3189 * careful if you ever try to remove this restriction
3191 if (p
->policyvers
< POLICYDB_VERSION_AVTAB
) {
3192 printk(KERN_ERR
"SELinux: refusing to write policy version %d."
3193 " Because it is less than version %d\n", p
->policyvers
,
3194 POLICYDB_VERSION_AVTAB
);
3200 config
|= POLICYDB_CONFIG_MLS
;
3202 if (p
->reject_unknown
)
3203 config
|= REJECT_UNKNOWN
;
3204 if (p
->allow_unknown
)
3205 config
|= ALLOW_UNKNOWN
;
3207 /* Write the magic number and string identifiers. */
3208 buf
[0] = cpu_to_le32(POLICYDB_MAGIC
);
3209 len
= strlen(POLICYDB_STRING
);
3210 buf
[1] = cpu_to_le32(len
);
3211 rc
= put_entry(buf
, sizeof(u32
), 2, fp
);
3214 rc
= put_entry(POLICYDB_STRING
, 1, len
, fp
);
3218 /* Write the version, config, and table sizes. */
3219 info
= policydb_lookup_compat(p
->policyvers
);
3221 printk(KERN_ERR
"SELinux: compatibility lookup failed for policy "
3222 "version %d", p
->policyvers
);
3226 buf
[0] = cpu_to_le32(p
->policyvers
);
3227 buf
[1] = cpu_to_le32(config
);
3228 buf
[2] = cpu_to_le32(info
->sym_num
);
3229 buf
[3] = cpu_to_le32(info
->ocon_num
);
3231 rc
= put_entry(buf
, sizeof(u32
), 4, fp
);
3235 if (p
->policyvers
>= POLICYDB_VERSION_POLCAP
) {
3236 rc
= ebitmap_write(&p
->policycaps
, fp
);
3241 if (p
->policyvers
>= POLICYDB_VERSION_PERMISSIVE
) {
3242 rc
= ebitmap_write(&p
->permissive_map
, fp
);
3247 num_syms
= info
->sym_num
;
3248 for (i
= 0; i
< num_syms
; i
++) {
3249 struct policy_data pd
;
3254 buf
[0] = cpu_to_le32(p
->symtab
[i
].nprim
);
3255 buf
[1] = cpu_to_le32(p
->symtab
[i
].table
->nel
);
3257 rc
= put_entry(buf
, sizeof(u32
), 2, fp
);
3260 rc
= hashtab_map(p
->symtab
[i
].table
, write_f
[i
], &pd
);
3265 rc
= avtab_write(p
, &p
->te_avtab
, fp
);
3269 rc
= cond_write_list(p
, p
->cond_list
, fp
);
3273 rc
= role_trans_write(p
, fp
);
3277 rc
= role_allow_write(p
->role_allow
, fp
);
3281 rc
= filename_trans_write(p
, fp
);
3285 rc
= ocontext_write(p
, info
, fp
);
3289 rc
= genfs_write(p
, fp
);
3293 rc
= range_write(p
, fp
);
3297 for (i
= 0; i
< p
->p_types
.nprim
; i
++) {
3298 struct ebitmap
*e
= flex_array_get(p
->type_attr_map_array
, i
);
3301 rc
= ebitmap_write(e
, fp
);