Lines Matching +full:rc +full:- +full:map +full:- +full:name
1 // SPDX-License-Identifier: GPL-2.0-only
17 * Updated: Hewlett-Packard <paul@paul-moore.com>
35 * Copyright (C) 2006, 2007 Hewlett-Packard Development Company, L.P.
36 * Copyright (C) 2004-2006 Trusted Computer Solutions, Inc.
37 * Copyright (C) 2003 - 2004, 2006 Tresys Technology, LLC
89 struct security_class_mapping *map, in selinux_set_mapping() argument
97 if (!map) in selinux_set_mapping()
98 return -EINVAL; in selinux_set_mapping()
100 while (map[i].name) in selinux_set_mapping()
104 out_map->mapping = kcalloc(++i, sizeof(*out_map->mapping), GFP_ATOMIC); in selinux_set_mapping()
105 if (!out_map->mapping) in selinux_set_mapping()
106 return -ENOMEM; in selinux_set_mapping()
110 while (map[j].name) { in selinux_set_mapping()
111 struct security_class_mapping *p_in = map + (j++); in selinux_set_mapping()
112 struct selinux_mapping *p_out = out_map->mapping + j; in selinux_set_mapping()
115 if (!strcmp(p_in->name, "")) { in selinux_set_mapping()
116 p_out->num_perms = 0; in selinux_set_mapping()
120 p_out->value = string_to_security_class(pol, p_in->name); in selinux_set_mapping()
121 if (!p_out->value) { in selinux_set_mapping()
123 p_in->name); in selinux_set_mapping()
124 if (pol->reject_unknown) in selinux_set_mapping()
126 p_out->num_perms = 0; in selinux_set_mapping()
132 while (p_in->perms[k]) { in selinux_set_mapping()
134 if (!*p_in->perms[k]) { in selinux_set_mapping()
138 p_out->perms[k] = string_to_av_perm(pol, p_out->value, in selinux_set_mapping()
139 p_in->perms[k]); in selinux_set_mapping()
140 if (!p_out->perms[k]) { in selinux_set_mapping()
142 p_in->perms[k], p_in->name); in selinux_set_mapping()
143 if (pol->reject_unknown) in selinux_set_mapping()
150 p_out->num_perms = k; in selinux_set_mapping()
155 pol->allow_unknown ? "allowed" : "denied"); in selinux_set_mapping()
157 out_map->size = i; in selinux_set_mapping()
160 kfree(out_map->mapping); in selinux_set_mapping()
161 out_map->mapping = NULL; in selinux_set_mapping()
162 return -EINVAL; in selinux_set_mapping()
169 static u16 unmap_class(struct selinux_map *map, u16 tclass) in unmap_class() argument
171 if (tclass < map->size) in unmap_class()
172 return map->mapping[tclass].value; in unmap_class()
180 static u16 map_class(struct selinux_map *map, u16 pol_value) in map_class() argument
184 for (i = 1; i < map->size; i++) { in map_class()
185 if (map->mapping[i].value == pol_value) in map_class()
192 static void map_decision(struct selinux_map *map, in map_decision() argument
196 if (tclass < map->size) { in map_decision()
197 struct selinux_mapping *mapping = &map->mapping[tclass]; in map_decision()
198 unsigned int i, n = mapping->num_perms; in map_decision()
202 if (avd->allowed & mapping->perms[i]) in map_decision()
204 if (allow_unknown && !mapping->perms[i]) in map_decision()
207 avd->allowed = result; in map_decision()
210 if (avd->auditallow & mapping->perms[i]) in map_decision()
212 avd->auditallow = result; in map_decision()
215 if (avd->auditdeny & mapping->perms[i]) in map_decision()
217 if (!allow_unknown && !mapping->perms[i]) in map_decision()
227 avd->auditdeny = result; in map_decision()
240 policy = rcu_dereference(state->policy); in security_mls_enabled()
241 mls_enabled = policy->policydb.mls_enabled; in security_mls_enabled()
269 int sp = -1; in constraint_expr_eval()
271 for (e = cexpr; e; e = e->next) { in constraint_expr_eval()
272 switch (e->expr_type) { in constraint_expr_eval()
279 sp--; in constraint_expr_eval()
284 sp--; in constraint_expr_eval()
288 if (sp == (CEXPR_MAXDEPTH - 1)) in constraint_expr_eval()
290 switch (e->attr) { in constraint_expr_eval()
292 val1 = scontext->user; in constraint_expr_eval()
293 val2 = tcontext->user; in constraint_expr_eval()
296 val1 = scontext->type; in constraint_expr_eval()
297 val2 = tcontext->type; in constraint_expr_eval()
300 val1 = scontext->role; in constraint_expr_eval()
301 val2 = tcontext->role; in constraint_expr_eval()
302 r1 = policydb->role_val_to_struct[val1 - 1]; in constraint_expr_eval()
303 r2 = policydb->role_val_to_struct[val2 - 1]; in constraint_expr_eval()
304 switch (e->op) { in constraint_expr_eval()
306 s[++sp] = ebitmap_get_bit(&r1->dominates, in constraint_expr_eval()
307 val2 - 1); in constraint_expr_eval()
310 s[++sp] = ebitmap_get_bit(&r2->dominates, in constraint_expr_eval()
311 val1 - 1); in constraint_expr_eval()
314 s[++sp] = (!ebitmap_get_bit(&r1->dominates, in constraint_expr_eval()
315 val2 - 1) && in constraint_expr_eval()
316 !ebitmap_get_bit(&r2->dominates, in constraint_expr_eval()
317 val1 - 1)); in constraint_expr_eval()
324 l1 = &(scontext->range.level[0]); in constraint_expr_eval()
325 l2 = &(tcontext->range.level[0]); in constraint_expr_eval()
328 l1 = &(scontext->range.level[0]); in constraint_expr_eval()
329 l2 = &(tcontext->range.level[1]); in constraint_expr_eval()
332 l1 = &(scontext->range.level[1]); in constraint_expr_eval()
333 l2 = &(tcontext->range.level[0]); in constraint_expr_eval()
336 l1 = &(scontext->range.level[1]); in constraint_expr_eval()
337 l2 = &(tcontext->range.level[1]); in constraint_expr_eval()
340 l1 = &(scontext->range.level[0]); in constraint_expr_eval()
341 l2 = &(scontext->range.level[1]); in constraint_expr_eval()
344 l1 = &(tcontext->range.level[0]); in constraint_expr_eval()
345 l2 = &(tcontext->range.level[1]); in constraint_expr_eval()
348 switch (e->op) { in constraint_expr_eval()
374 switch (e->op) { in constraint_expr_eval()
387 if (sp == (CEXPR_MAXDEPTH-1)) in constraint_expr_eval()
390 if (e->attr & CEXPR_TARGET) in constraint_expr_eval()
392 else if (e->attr & CEXPR_XTARGET) { in constraint_expr_eval()
399 if (e->attr & CEXPR_USER) in constraint_expr_eval()
400 val1 = c->user; in constraint_expr_eval()
401 else if (e->attr & CEXPR_ROLE) in constraint_expr_eval()
402 val1 = c->role; in constraint_expr_eval()
403 else if (e->attr & CEXPR_TYPE) in constraint_expr_eval()
404 val1 = c->type; in constraint_expr_eval()
410 switch (e->op) { in constraint_expr_eval()
412 s[++sp] = ebitmap_get_bit(&e->names, val1 - 1); in constraint_expr_eval()
415 s[++sp] = !ebitmap_get_bit(&e->names, val1 - 1); in constraint_expr_eval()
433 * security_dump_masked_av - dumps masked permissions during
441 BUG_ON(pdatum->value < 1 || pdatum->value > 32); in dump_masked_av_helper()
443 permission_names[pdatum->value - 1] = (char *)k; in dump_masked_av_helper()
469 tclass_name = sym_name(policydb, SYM_CLASSES, tclass - 1); in security_dump_masked_av()
470 tclass_dat = policydb->class_val_to_struct[tclass - 1]; in security_dump_masked_av()
471 common_dat = tclass_dat->comdatum; in security_dump_masked_av()
475 hashtab_map(&common_dat->permissions.table, in security_dump_masked_av()
479 if (hashtab_map(&tclass_dat->permissions.table, in security_dump_masked_av()
524 * security_boundary_permission - drops violated permissions
540 source = policydb->type_val_to_struct[scontext->type - 1]; in type_attribute_bounds_av()
543 if (!source->bounds) in type_attribute_bounds_av()
546 target = policydb->type_val_to_struct[tcontext->type - 1]; in type_attribute_bounds_av()
552 lo_scontext.type = source->bounds; in type_attribute_bounds_av()
554 if (target->bounds) { in type_attribute_bounds_av()
556 lo_tcontext.type = target->bounds; in type_attribute_bounds_av()
566 masked = ~lo_avd.allowed & avd->allowed; in type_attribute_bounds_av()
572 avd->allowed &= ~masked; in type_attribute_bounds_av()
589 if (node->datum.u.xperms->specified == AVTAB_XPERMS_IOCTLDRIVER) { in services_compute_xperms_drivers()
591 for (i = 0; i < ARRAY_SIZE(xperms->drivers.p); i++) in services_compute_xperms_drivers()
592 xperms->drivers.p[i] |= node->datum.u.xperms->perms.p[i]; in services_compute_xperms_drivers()
593 } else if (node->datum.u.xperms->specified == AVTAB_XPERMS_IOCTLFUNCTION) { in services_compute_xperms_drivers()
595 security_xperm_set(xperms->drivers.p, in services_compute_xperms_drivers()
596 node->datum.u.xperms->driver); in services_compute_xperms_drivers()
600 if (node->key.specified & AVTAB_XPERMS_ALLOWED) in services_compute_xperms_drivers()
601 xperms->len = 1; in services_compute_xperms_drivers()
624 avd->allowed = 0; in context_struct_compute_av()
625 avd->auditallow = 0; in context_struct_compute_av()
626 avd->auditdeny = 0xffffffff; in context_struct_compute_av()
628 memset(&xperms->drivers, 0, sizeof(xperms->drivers)); in context_struct_compute_av()
629 xperms->len = 0; in context_struct_compute_av()
632 if (unlikely(!tclass || tclass > policydb->p_classes.nprim)) { in context_struct_compute_av()
638 tclass_datum = policydb->class_val_to_struct[tclass - 1]; in context_struct_compute_av()
646 sattr = &policydb->type_attr_map_array[scontext->type - 1]; in context_struct_compute_av()
647 tattr = &policydb->type_attr_map_array[tcontext->type - 1]; in context_struct_compute_av()
652 for (node = avtab_search_node(&policydb->te_avtab, in context_struct_compute_av()
656 if (node->key.specified == AVTAB_ALLOWED) in context_struct_compute_av()
657 avd->allowed |= node->datum.u.data; in context_struct_compute_av()
658 else if (node->key.specified == AVTAB_AUDITALLOW) in context_struct_compute_av()
659 avd->auditallow |= node->datum.u.data; in context_struct_compute_av()
660 else if (node->key.specified == AVTAB_AUDITDENY) in context_struct_compute_av()
661 avd->auditdeny &= node->datum.u.data; in context_struct_compute_av()
662 else if (xperms && (node->key.specified & AVTAB_XPERMS)) in context_struct_compute_av()
667 cond_compute_av(&policydb->te_cond_avtab, &avkey, in context_struct_compute_av()
677 constraint = tclass_datum->constraints; in context_struct_compute_av()
679 if ((constraint->permissions & (avd->allowed)) && in context_struct_compute_av()
681 constraint->expr)) { in context_struct_compute_av()
682 avd->allowed &= ~(constraint->permissions); in context_struct_compute_av()
684 constraint = constraint->next; in context_struct_compute_av()
692 if (tclass == policydb->process_class && in context_struct_compute_av()
693 (avd->allowed & policydb->process_trans_perms) && in context_struct_compute_av()
694 scontext->role != tcontext->role) { in context_struct_compute_av()
695 for (ra = policydb->role_allow; ra; ra = ra->next) { in context_struct_compute_av()
696 if (scontext->role == ra->role && in context_struct_compute_av()
697 tcontext->role == ra->new_role) in context_struct_compute_av()
701 avd->allowed &= ~policydb->process_trans_perms; in context_struct_compute_av()
720 struct policydb *p = &policy->policydb; in security_validtrans_handle_fail()
721 struct sidtab *sidtab = policy->sidtab; in security_validtrans_handle_fail()
734 o, n, t, sym_name(p, SYM_CLASSES, tclass-1)); in security_validtrans_handle_fail()
742 return -EPERM; in security_validtrans_handle_fail()
758 int rc = 0; in security_compute_validatetrans() local
766 policy = rcu_dereference(state->policy); in security_compute_validatetrans()
767 policydb = &policy->policydb; in security_compute_validatetrans()
768 sidtab = policy->sidtab; in security_compute_validatetrans()
771 tclass = unmap_class(&policy->map, orig_tclass); in security_compute_validatetrans()
775 if (!tclass || tclass > policydb->p_classes.nprim) { in security_compute_validatetrans()
776 rc = -EINVAL; in security_compute_validatetrans()
779 tclass_datum = policydb->class_val_to_struct[tclass - 1]; in security_compute_validatetrans()
785 rc = -EINVAL; in security_compute_validatetrans()
793 rc = -EINVAL; in security_compute_validatetrans()
801 rc = -EINVAL; in security_compute_validatetrans()
805 constraint = tclass_datum->validatetrans; in security_compute_validatetrans()
807 if (!constraint_expr_eval(policydb, &oentry->context, in security_compute_validatetrans()
808 &nentry->context, &tentry->context, in security_compute_validatetrans()
809 constraint->expr)) { in security_compute_validatetrans()
811 rc = -EPERM; in security_compute_validatetrans()
813 rc = security_validtrans_handle_fail(state, in security_compute_validatetrans()
821 constraint = constraint->next; in security_compute_validatetrans()
826 return rc; in security_compute_validatetrans()
846 * security_bounded_transition - check whether the given
863 int rc; in security_bounded_transition() local
869 policy = rcu_dereference(state->policy); in security_bounded_transition()
870 policydb = &policy->policydb; in security_bounded_transition()
871 sidtab = policy->sidtab; in security_bounded_transition()
873 rc = -EINVAL; in security_bounded_transition()
881 rc = -EINVAL; in security_bounded_transition()
889 rc = 0; in security_bounded_transition()
891 if (old_entry->context.type == new_entry->context.type) in security_bounded_transition()
894 index = new_entry->context.type; in security_bounded_transition()
896 type = policydb->type_val_to_struct[index - 1]; in security_bounded_transition()
900 rc = -EPERM; in security_bounded_transition()
901 if (!type->bounds) in security_bounded_transition()
905 rc = 0; in security_bounded_transition()
906 if (type->bounds == old_entry->context.type) in security_bounded_transition()
909 index = type->bounds; in security_bounded_transition()
912 if (rc) { in security_bounded_transition()
934 return rc; in security_bounded_transition()
939 avd->allowed = 0; in avd_init()
940 avd->auditallow = 0; in avd_init()
941 avd->auditdeny = 0xffffffff; in avd_init()
943 avd->seqno = policy->latest_granting; in avd_init()
945 avd->seqno = 0; in avd_init()
946 avd->flags = 0; in avd_init()
954 if (node->datum.u.xperms->specified == AVTAB_XPERMS_IOCTLFUNCTION) { in services_compute_xperms_decision()
955 if (xpermd->driver != node->datum.u.xperms->driver) in services_compute_xperms_decision()
957 } else if (node->datum.u.xperms->specified == AVTAB_XPERMS_IOCTLDRIVER) { in services_compute_xperms_decision()
958 if (!security_xperm_test(node->datum.u.xperms->perms.p, in services_compute_xperms_decision()
959 xpermd->driver)) in services_compute_xperms_decision()
965 if (node->key.specified == AVTAB_XPERMS_ALLOWED) { in services_compute_xperms_decision()
966 xpermd->used |= XPERMS_ALLOWED; in services_compute_xperms_decision()
967 if (node->datum.u.xperms->specified == AVTAB_XPERMS_IOCTLDRIVER) { in services_compute_xperms_decision()
968 memset(xpermd->allowed->p, 0xff, in services_compute_xperms_decision()
969 sizeof(xpermd->allowed->p)); in services_compute_xperms_decision()
971 if (node->datum.u.xperms->specified == AVTAB_XPERMS_IOCTLFUNCTION) { in services_compute_xperms_decision()
972 for (i = 0; i < ARRAY_SIZE(xpermd->allowed->p); i++) in services_compute_xperms_decision()
973 xpermd->allowed->p[i] |= in services_compute_xperms_decision()
974 node->datum.u.xperms->perms.p[i]; in services_compute_xperms_decision()
976 } else if (node->key.specified == AVTAB_XPERMS_AUDITALLOW) { in services_compute_xperms_decision()
977 xpermd->used |= XPERMS_AUDITALLOW; in services_compute_xperms_decision()
978 if (node->datum.u.xperms->specified == AVTAB_XPERMS_IOCTLDRIVER) { in services_compute_xperms_decision()
979 memset(xpermd->auditallow->p, 0xff, in services_compute_xperms_decision()
980 sizeof(xpermd->auditallow->p)); in services_compute_xperms_decision()
982 if (node->datum.u.xperms->specified == AVTAB_XPERMS_IOCTLFUNCTION) { in services_compute_xperms_decision()
983 for (i = 0; i < ARRAY_SIZE(xpermd->auditallow->p); i++) in services_compute_xperms_decision()
984 xpermd->auditallow->p[i] |= in services_compute_xperms_decision()
985 node->datum.u.xperms->perms.p[i]; in services_compute_xperms_decision()
987 } else if (node->key.specified == AVTAB_XPERMS_DONTAUDIT) { in services_compute_xperms_decision()
988 xpermd->used |= XPERMS_DONTAUDIT; in services_compute_xperms_decision()
989 if (node->datum.u.xperms->specified == AVTAB_XPERMS_IOCTLDRIVER) { in services_compute_xperms_decision()
990 memset(xpermd->dontaudit->p, 0xff, in services_compute_xperms_decision()
991 sizeof(xpermd->dontaudit->p)); in services_compute_xperms_decision()
993 if (node->datum.u.xperms->specified == AVTAB_XPERMS_IOCTLFUNCTION) { in services_compute_xperms_decision()
994 for (i = 0; i < ARRAY_SIZE(xpermd->dontaudit->p); i++) in services_compute_xperms_decision()
995 xpermd->dontaudit->p[i] |= in services_compute_xperms_decision()
996 node->datum.u.xperms->perms.p[i]; in services_compute_xperms_decision()
1021 xpermd->driver = driver; in security_compute_xperms_decision()
1022 xpermd->used = 0; in security_compute_xperms_decision()
1023 memset(xpermd->allowed->p, 0, sizeof(xpermd->allowed->p)); in security_compute_xperms_decision()
1024 memset(xpermd->auditallow->p, 0, sizeof(xpermd->auditallow->p)); in security_compute_xperms_decision()
1025 memset(xpermd->dontaudit->p, 0, sizeof(xpermd->dontaudit->p)); in security_compute_xperms_decision()
1031 policy = rcu_dereference(state->policy); in security_compute_xperms_decision()
1032 policydb = &policy->policydb; in security_compute_xperms_decision()
1033 sidtab = policy->sidtab; in security_compute_xperms_decision()
1049 tclass = unmap_class(&policy->map, orig_tclass); in security_compute_xperms_decision()
1051 if (policydb->allow_unknown) in security_compute_xperms_decision()
1057 if (unlikely(!tclass || tclass > policydb->p_classes.nprim)) { in security_compute_xperms_decision()
1064 sattr = &policydb->type_attr_map_array[scontext->type - 1]; in security_compute_xperms_decision()
1065 tattr = &policydb->type_attr_map_array[tcontext->type - 1]; in security_compute_xperms_decision()
1070 for (node = avtab_search_node(&policydb->te_avtab, in security_compute_xperms_decision()
1076 cond_compute_xperms(&policydb->te_cond_avtab, in security_compute_xperms_decision()
1084 memset(xpermd->allowed->p, 0xff, sizeof(xpermd->allowed->p)); in security_compute_xperms_decision()
1089 * security_compute_av - Compute access vector decisions.
1113 policy = rcu_dereference(state->policy); in security_compute_av()
1115 xperms->len = 0; in security_compute_av()
1119 policydb = &policy->policydb; in security_compute_av()
1120 sidtab = policy->sidtab; in security_compute_av()
1130 if (ebitmap_get_bit(&policydb->permissive_map, scontext->type)) in security_compute_av()
1131 avd->flags |= AVD_FLAGS_PERMISSIVE; in security_compute_av()
1140 tclass = unmap_class(&policy->map, orig_tclass); in security_compute_av()
1142 if (policydb->allow_unknown) in security_compute_av()
1148 map_decision(&policy->map, orig_tclass, avd, in security_compute_av()
1149 policydb->allow_unknown); in security_compute_av()
1154 avd->allowed = 0xffffffff; in security_compute_av()
1170 policy = rcu_dereference(state->policy); in security_compute_av_user()
1175 policydb = &policy->policydb; in security_compute_av_user()
1176 sidtab = policy->sidtab; in security_compute_av_user()
1186 if (ebitmap_get_bit(&policydb->permissive_map, scontext->type)) in security_compute_av_user()
1187 avd->flags |= AVD_FLAGS_PERMISSIVE; in security_compute_av_user()
1197 if (policydb->allow_unknown) in security_compute_av_user()
1208 avd->allowed = 0xffffffff; in security_compute_av_user()
1229 if (context->len) { in context_struct_to_string()
1230 *scontext_len = context->len; in context_struct_to_string()
1232 *scontext = kstrdup(context->str, GFP_ATOMIC); in context_struct_to_string()
1234 return -ENOMEM; in context_struct_to_string()
1240 *scontext_len += strlen(sym_name(p, SYM_USERS, context->user - 1)) + 1; in context_struct_to_string()
1241 *scontext_len += strlen(sym_name(p, SYM_ROLES, context->role - 1)) + 1; in context_struct_to_string()
1242 *scontext_len += strlen(sym_name(p, SYM_TYPES, context->type - 1)) + 1; in context_struct_to_string()
1251 return -ENOMEM; in context_struct_to_string()
1255 * Copy the user name, role name and type name into the context. in context_struct_to_string()
1258 sym_name(p, SYM_USERS, context->user - 1), in context_struct_to_string()
1259 sym_name(p, SYM_ROLES, context->role - 1), in context_struct_to_string()
1260 sym_name(p, SYM_TYPES, context->type - 1)); in context_struct_to_string()
1274 int rc = sidtab_sid2str_get(sidtab, entry, scontext, scontext_len); in sidtab_entry_to_string() local
1276 if (rc != -ENOENT) in sidtab_entry_to_string()
1277 return rc; in sidtab_entry_to_string()
1279 rc = context_struct_to_string(p, &entry->context, scontext, in sidtab_entry_to_string()
1281 if (!rc && scontext) in sidtab_entry_to_string()
1283 return rc; in sidtab_entry_to_string()
1291 int rc; in security_sidtab_hash_stats() local
1296 return -EINVAL; in security_sidtab_hash_stats()
1300 policy = rcu_dereference(state->policy); in security_sidtab_hash_stats()
1301 rc = sidtab_hash_stats(policy->sidtab, page); in security_sidtab_hash_stats()
1304 return rc; in security_sidtab_hash_stats()
1323 int rc = 0; in security_sid_to_context_core() local
1335 return -EINVAL; in security_sid_to_context_core()
1341 return -ENOMEM; in security_sid_to_context_core()
1347 return -EINVAL; in security_sid_to_context_core()
1350 policy = rcu_dereference(state->policy); in security_sid_to_context_core()
1351 policydb = &policy->policydb; in security_sid_to_context_core()
1352 sidtab = policy->sidtab; in security_sid_to_context_core()
1361 rc = -EINVAL; in security_sid_to_context_core()
1364 if (only_invalid && !entry->context.len) in security_sid_to_context_core()
1367 rc = sidtab_entry_to_string(policydb, sidtab, entry, scontext, in security_sid_to_context_core()
1372 return rc; in security_sid_to_context_core()
1377 * security_sid_to_context - Obtain a context for a given SID.
1401 * security_sid_to_context_inval - Obtain a context for a given SID if it
1433 int rc = 0; in string_to_context_struct() local
1439 rc = -EINVAL; in string_to_context_struct()
1452 usrdatum = symtab_search(&pol->p_users, scontextp); in string_to_context_struct()
1456 ctx->user = usrdatum->value; in string_to_context_struct()
1468 role = symtab_search(&pol->p_roles, scontextp); in string_to_context_struct()
1471 ctx->role = role->value; in string_to_context_struct()
1480 typdatum = symtab_search(&pol->p_types, scontextp); in string_to_context_struct()
1481 if (!typdatum || typdatum->attribute) in string_to_context_struct()
1484 ctx->type = typdatum->value; in string_to_context_struct()
1486 rc = mls_context_to_sid(pol, oldc, p, ctx, sidtabp, def_sid); in string_to_context_struct()
1487 if (rc) in string_to_context_struct()
1491 rc = -EINVAL; in string_to_context_struct()
1494 rc = 0; in string_to_context_struct()
1496 if (rc) in string_to_context_struct()
1498 return rc; in string_to_context_struct()
1511 int rc = 0; in security_context_to_sid_core() local
1515 return -EINVAL; in security_context_to_sid_core()
1520 return -ENOMEM; in security_context_to_sid_core()
1540 rc = -ENOMEM; in security_context_to_sid_core()
1546 policy = rcu_dereference(state->policy); in security_context_to_sid_core()
1547 policydb = &policy->policydb; in security_context_to_sid_core()
1548 sidtab = policy->sidtab; in security_context_to_sid_core()
1549 rc = string_to_context_struct(policydb, sidtab, scontext2, in security_context_to_sid_core()
1551 if (rc == -EINVAL && force) { in security_context_to_sid_core()
1555 } else if (rc) in security_context_to_sid_core()
1557 rc = sidtab_context_to_sid(sidtab, &context, sid); in security_context_to_sid_core()
1564 return rc; in security_context_to_sid_core()
1568 * security_context_to_sid - Obtain a SID for a given security context.
1576 * Returns -%EINVAL if the context is invalid, -%ENOMEM if insufficient
1595 * security_context_to_sid_default - Obtain a SID for a given security context,
1609 * Returns -%EINVAL if the context is invalid, -%ENOMEM if insufficient
1636 struct policydb *policydb = &policy->policydb; in compute_sid_handle_invalid_context()
1637 struct sidtab *sidtab = policy->sidtab; in compute_sid_handle_invalid_context()
1652 audit_log_n_untrustedstring(ab, n, nlen - 1); in compute_sid_handle_invalid_context()
1654 s, t, sym_name(policydb, SYM_CLASSES, tclass-1)); in compute_sid_handle_invalid_context()
1662 return -EACCES; in compute_sid_handle_invalid_context()
1678 if (!ebitmap_get_bit(&policydb->filename_trans_ttypes, ttype)) in filename_compute_type()
1683 ft.name = objname; in filename_compute_type()
1687 if (ebitmap_get_bit(&datum->stypes, stype - 1)) { in filename_compute_type()
1688 newcontext->type = datum->otype; in filename_compute_type()
1691 datum = datum->next; in filename_compute_type()
1714 int rc = 0; in security_compute_sid() local
1733 policy = rcu_dereference(state->policy); in security_compute_sid()
1736 tclass = unmap_class(&policy->map, orig_tclass); in security_compute_sid()
1740 sock = security_is_socket_class(map_class(&policy->map, in security_compute_sid()
1744 policydb = &policy->policydb; in security_compute_sid()
1745 sidtab = policy->sidtab; in security_compute_sid()
1751 rc = -EINVAL; in security_compute_sid()
1758 rc = -EINVAL; in security_compute_sid()
1762 scontext = &sentry->context; in security_compute_sid()
1763 tcontext = &tentry->context; in security_compute_sid()
1765 if (tclass && tclass <= policydb->p_classes.nprim) in security_compute_sid()
1766 cladatum = policydb->class_val_to_struct[tclass - 1]; in security_compute_sid()
1772 if (cladatum && cladatum->default_user == DEFAULT_TARGET) { in security_compute_sid()
1773 newcontext.user = tcontext->user; in security_compute_sid()
1777 newcontext.user = scontext->user; in security_compute_sid()
1782 newcontext.user = tcontext->user; in security_compute_sid()
1787 if (cladatum && cladatum->default_role == DEFAULT_SOURCE) { in security_compute_sid()
1788 newcontext.role = scontext->role; in security_compute_sid()
1789 } else if (cladatum && cladatum->default_role == DEFAULT_TARGET) { in security_compute_sid()
1790 newcontext.role = tcontext->role; in security_compute_sid()
1792 if ((tclass == policydb->process_class) || sock) in security_compute_sid()
1793 newcontext.role = scontext->role; in security_compute_sid()
1799 if (cladatum && cladatum->default_type == DEFAULT_SOURCE) { in security_compute_sid()
1800 newcontext.type = scontext->type; in security_compute_sid()
1801 } else if (cladatum && cladatum->default_type == DEFAULT_TARGET) { in security_compute_sid()
1802 newcontext.type = tcontext->type; in security_compute_sid()
1804 if ((tclass == policydb->process_class) || sock) { in security_compute_sid()
1806 newcontext.type = scontext->type; in security_compute_sid()
1809 newcontext.type = tcontext->type; in security_compute_sid()
1814 avkey.source_type = scontext->type; in security_compute_sid()
1815 avkey.target_type = tcontext->type; in security_compute_sid()
1818 avdatum = avtab_search(&policydb->te_avtab, &avkey); in security_compute_sid()
1822 node = avtab_search_node(&policydb->te_cond_avtab, &avkey); in security_compute_sid()
1824 if (node->key.specified & AVTAB_ENABLED) { in security_compute_sid()
1825 avdatum = &node->datum; in security_compute_sid()
1833 newcontext.type = avdatum->u.data; in security_compute_sid()
1838 filename_compute_type(policydb, &newcontext, scontext->type, in security_compute_sid()
1839 tcontext->type, tclass, objname); in security_compute_sid()
1841 /* Check for class-specific changes. */ in security_compute_sid()
1846 .role = scontext->role, in security_compute_sid()
1847 .type = tcontext->type, in security_compute_sid()
1853 newcontext.role = rtd->new_role; in security_compute_sid()
1858 rc = mls_compute_sid(policydb, scontext, tcontext, tclass, specified, in security_compute_sid()
1860 if (rc) in security_compute_sid()
1865 rc = compute_sid_handle_invalid_context(state, policy, sentry, in security_compute_sid()
1868 if (rc) in security_compute_sid()
1872 rc = sidtab_context_to_sid(sidtab, &newcontext, out_sid); in security_compute_sid()
1877 return rc; in security_compute_sid()
1881 * security_transition_sid - Compute the SID for a new subject/object.
1889 * Return -%EINVAL if any of the parameters are invalid, -%ENOMEM
1899 qstr ? qstr->name : NULL, out_sid, true); in security_transition_sid()
1912 * security_member_sid - Compute the SID for member selection.
1920 * Return -%EINVAL if any of the parameters are invalid, -%ENOMEM
1936 * security_change_sid - Compute the SID for object relabeling.
1944 * Return -%EINVAL if any of the parameters are invalid, -%ENOMEM
1968 return -EINVAL; in convert_context_handle_invalid_context()
1987 * in the policy `p->oldp' to the values specified
1988 * in the policy `p->newp', storing the new context
2001 int rc; in convert_context() local
2005 if (oldc->str) { in convert_context()
2006 s = kstrdup(oldc->str, GFP_KERNEL); in convert_context()
2008 return -ENOMEM; in convert_context()
2010 rc = string_to_context_struct(args->newp, NULL, s, in convert_context()
2012 if (rc == -EINVAL) { in convert_context()
2016 * IMPORTANT: We need to copy the contents of oldc->str in convert_context()
2020 memcpy(s, oldc->str, oldc->len); in convert_context()
2022 newc->str = s; in convert_context()
2023 newc->len = oldc->len; in convert_context()
2027 if (rc) { in convert_context()
2029 pr_err("SELinux: Unable to map context %s, rc = %d.\n", in convert_context()
2030 oldc->str, -rc); in convert_context()
2031 return rc; in convert_context()
2034 oldc->str); in convert_context()
2041 rc = -EINVAL; in convert_context()
2042 usrdatum = symtab_search(&args->newp->p_users, in convert_context()
2043 sym_name(args->oldp, in convert_context()
2044 SYM_USERS, oldc->user - 1)); in convert_context()
2047 newc->user = usrdatum->value; in convert_context()
2050 rc = -EINVAL; in convert_context()
2051 role = symtab_search(&args->newp->p_roles, in convert_context()
2052 sym_name(args->oldp, SYM_ROLES, oldc->role - 1)); in convert_context()
2055 newc->role = role->value; in convert_context()
2058 rc = -EINVAL; in convert_context()
2059 typdatum = symtab_search(&args->newp->p_types, in convert_context()
2060 sym_name(args->oldp, in convert_context()
2061 SYM_TYPES, oldc->type - 1)); in convert_context()
2064 newc->type = typdatum->value; in convert_context()
2067 if (args->oldp->mls_enabled && args->newp->mls_enabled) { in convert_context()
2068 rc = mls_convert_context(args->oldp, args->newp, oldc, newc); in convert_context()
2069 if (rc) in convert_context()
2071 } else if (!args->oldp->mls_enabled && args->newp->mls_enabled) { in convert_context()
2073 * Switching between non-MLS and MLS policy: in convert_context()
2079 oc = args->newp->ocontexts[OCON_ISID]; in convert_context()
2080 while (oc && oc->sid[0] != SECINITSID_UNLABELED) in convert_context()
2081 oc = oc->next; in convert_context()
2082 rc = -EINVAL; in convert_context()
2088 rc = mls_range_set(newc, &oc->context[0].range); in convert_context()
2089 if (rc) in convert_context()
2094 if (!policydb_context_isvalid(args->newp, newc)) { in convert_context()
2095 rc = convert_context_handle_invalid_context(args->state, in convert_context()
2096 args->oldp, in convert_context()
2098 if (rc) in convert_context()
2104 /* Map old representation to string and save it. */ in convert_context()
2105 rc = context_struct_to_string(args->oldp, oldc, &s, &len); in convert_context()
2106 if (rc) in convert_context()
2107 return rc; in convert_context()
2109 newc->str = s; in convert_context()
2110 newc->len = len; in convert_context()
2112 newc->str); in convert_context()
2123 p = &policy->policydb; in security_load_policycaps()
2125 for (i = 0; i < ARRAY_SIZE(state->policycap); i++) in security_load_policycaps()
2126 WRITE_ONCE(state->policycap[i], in security_load_policycaps()
2127 ebitmap_get_bit(&p->policycaps, i)); in security_load_policycaps()
2132 ebitmap_get_bit(&p->policycaps, i)); in security_load_policycaps()
2134 ebitmap_for_each_positive_bit(&p->policycaps, node, i) { in security_load_policycaps()
2149 sidtab_destroy(policy->sidtab); in selinux_policy_free()
2150 kfree(policy->map.mapping); in selinux_policy_free()
2151 policydb_destroy(&policy->policydb); in selinux_policy_free()
2152 kfree(policy->sidtab); in selinux_policy_free()
2158 cond_policydb_destroy_dup(&policy->policydb); in selinux_policy_cond_free()
2167 oldpolicy = rcu_dereference_protected(state->policy, in selinux_policy_cancel()
2168 lockdep_is_held(&state->policy_mutex)); in selinux_policy_cancel()
2170 sidtab_cancel_convert(oldpolicy->sidtab); in selinux_policy_cancel()
2178 avc_ss_reset(state->avc, seqno); in selinux_notify_policy_change()
2191 oldpolicy = rcu_dereference_protected(state->policy, in selinux_policy_commit()
2192 lockdep_is_held(&state->policy_mutex)); in selinux_policy_commit()
2196 if (oldpolicy->policydb.mls_enabled && !newpolicy->policydb.mls_enabled) in selinux_policy_commit()
2198 else if (!oldpolicy->policydb.mls_enabled && newpolicy->policydb.mls_enabled) in selinux_policy_commit()
2204 newpolicy->latest_granting = oldpolicy->latest_granting + 1; in selinux_policy_commit()
2206 newpolicy->latest_granting = 1; in selinux_policy_commit()
2207 seqno = newpolicy->latest_granting; in selinux_policy_commit()
2210 rcu_assign_pointer(state->policy, newpolicy); in selinux_policy_commit()
2234 * security_load_policy - Load a security policy configuration.
2249 int rc = 0; in security_load_policy() local
2254 return -ENOMEM; in security_load_policy()
2256 newpolicy->sidtab = kzalloc(sizeof(*newpolicy->sidtab), GFP_KERNEL); in security_load_policy()
2257 if (!newpolicy->sidtab) { in security_load_policy()
2258 rc = -ENOMEM; in security_load_policy()
2262 rc = policydb_read(&newpolicy->policydb, fp); in security_load_policy()
2263 if (rc) in security_load_policy()
2266 newpolicy->policydb.len = len; in security_load_policy()
2267 rc = selinux_set_mapping(&newpolicy->policydb, secclass_map, in security_load_policy()
2268 &newpolicy->map); in security_load_policy()
2269 if (rc) in security_load_policy()
2272 rc = policydb_load_isids(&newpolicy->policydb, newpolicy->sidtab); in security_load_policy()
2273 if (rc) { in security_load_policy()
2285 oldpolicy = rcu_dereference_protected(state->policy, in security_load_policy()
2286 lockdep_is_held(&state->policy_mutex)); in security_load_policy()
2289 rc = security_preserve_bools(oldpolicy, newpolicy); in security_load_policy()
2290 if (rc) { in security_load_policy()
2300 args.oldp = &oldpolicy->policydb; in security_load_policy()
2301 args.newp = &newpolicy->policydb; in security_load_policy()
2305 convert_params.target = newpolicy->sidtab; in security_load_policy()
2307 rc = sidtab_convert(oldpolicy->sidtab, &convert_params); in security_load_policy()
2308 if (rc) { in security_load_policy()
2319 sidtab_destroy(newpolicy->sidtab); in security_load_policy()
2321 kfree(newpolicy->map.mapping); in security_load_policy()
2323 policydb_destroy(&newpolicy->policydb); in security_load_policy()
2325 kfree(newpolicy->sidtab); in security_load_policy()
2329 return rc; in security_load_policy()
2333 * security_port_sid - Obtain the SID for a port.
2345 int rc = 0; in security_port_sid() local
2353 policy = rcu_dereference(state->policy); in security_port_sid()
2354 policydb = &policy->policydb; in security_port_sid()
2355 sidtab = policy->sidtab; in security_port_sid()
2357 c = policydb->ocontexts[OCON_PORT]; in security_port_sid()
2359 if (c->u.port.protocol == protocol && in security_port_sid()
2360 c->u.port.low_port <= port && in security_port_sid()
2361 c->u.port.high_port >= port) in security_port_sid()
2363 c = c->next; in security_port_sid()
2367 if (!c->sid[0]) { in security_port_sid()
2368 rc = sidtab_context_to_sid(sidtab, &c->context[0], in security_port_sid()
2369 &c->sid[0]); in security_port_sid()
2370 if (rc) in security_port_sid()
2373 *out_sid = c->sid[0]; in security_port_sid()
2380 return rc; in security_port_sid()
2384 * security_pkey_sid - Obtain the SID for a pkey.
2396 int rc = 0; in security_ib_pkey_sid() local
2404 policy = rcu_dereference(state->policy); in security_ib_pkey_sid()
2405 policydb = &policy->policydb; in security_ib_pkey_sid()
2406 sidtab = policy->sidtab; in security_ib_pkey_sid()
2408 c = policydb->ocontexts[OCON_IBPKEY]; in security_ib_pkey_sid()
2410 if (c->u.ibpkey.low_pkey <= pkey_num && in security_ib_pkey_sid()
2411 c->u.ibpkey.high_pkey >= pkey_num && in security_ib_pkey_sid()
2412 c->u.ibpkey.subnet_prefix == subnet_prefix) in security_ib_pkey_sid()
2415 c = c->next; in security_ib_pkey_sid()
2419 if (!c->sid[0]) { in security_ib_pkey_sid()
2420 rc = sidtab_context_to_sid(sidtab, in security_ib_pkey_sid()
2421 &c->context[0], in security_ib_pkey_sid()
2422 &c->sid[0]); in security_ib_pkey_sid()
2423 if (rc) in security_ib_pkey_sid()
2426 *out_sid = c->sid[0]; in security_ib_pkey_sid()
2432 return rc; in security_ib_pkey_sid()
2436 * security_ib_endport_sid - Obtain the SID for a subnet management interface.
2437 * @dev_name: device name
2448 int rc = 0; in security_ib_endport_sid() local
2456 policy = rcu_dereference(state->policy); in security_ib_endport_sid()
2457 policydb = &policy->policydb; in security_ib_endport_sid()
2458 sidtab = policy->sidtab; in security_ib_endport_sid()
2460 c = policydb->ocontexts[OCON_IBENDPORT]; in security_ib_endport_sid()
2462 if (c->u.ibendport.port == port_num && in security_ib_endport_sid()
2463 !strncmp(c->u.ibendport.dev_name, in security_ib_endport_sid()
2468 c = c->next; in security_ib_endport_sid()
2472 if (!c->sid[0]) { in security_ib_endport_sid()
2473 rc = sidtab_context_to_sid(sidtab, &c->context[0], in security_ib_endport_sid()
2474 &c->sid[0]); in security_ib_endport_sid()
2475 if (rc) in security_ib_endport_sid()
2478 *out_sid = c->sid[0]; in security_ib_endport_sid()
2484 return rc; in security_ib_endport_sid()
2488 * security_netif_sid - Obtain the SID for a network interface.
2489 * @name: interface name
2493 char *name, u32 *if_sid) in security_netif_sid() argument
2498 int rc = 0; in security_netif_sid() local
2507 policy = rcu_dereference(state->policy); in security_netif_sid()
2508 policydb = &policy->policydb; in security_netif_sid()
2509 sidtab = policy->sidtab; in security_netif_sid()
2511 c = policydb->ocontexts[OCON_NETIF]; in security_netif_sid()
2513 if (strcmp(name, c->u.name) == 0) in security_netif_sid()
2515 c = c->next; in security_netif_sid()
2519 if (!c->sid[0] || !c->sid[1]) { in security_netif_sid()
2520 rc = sidtab_context_to_sid(sidtab, &c->context[0], in security_netif_sid()
2521 &c->sid[0]); in security_netif_sid()
2522 if (rc) in security_netif_sid()
2524 rc = sidtab_context_to_sid(sidtab, &c->context[1], in security_netif_sid()
2525 &c->sid[1]); in security_netif_sid()
2526 if (rc) in security_netif_sid()
2529 *if_sid = c->sid[0]; in security_netif_sid()
2535 return rc; in security_netif_sid()
2552 * security_node_sid - Obtain the SID for a node (host).
2567 int rc; in security_node_sid() local
2576 policy = rcu_dereference(state->policy); in security_node_sid()
2577 policydb = &policy->policydb; in security_node_sid()
2578 sidtab = policy->sidtab; in security_node_sid()
2584 rc = -EINVAL; in security_node_sid()
2590 c = policydb->ocontexts[OCON_NODE]; in security_node_sid()
2592 if (c->u.node.addr == (addr & c->u.node.mask)) in security_node_sid()
2594 c = c->next; in security_node_sid()
2600 rc = -EINVAL; in security_node_sid()
2603 c = policydb->ocontexts[OCON_NODE6]; in security_node_sid()
2605 if (match_ipv6_addrmask(addrp, c->u.node6.addr, in security_node_sid()
2606 c->u.node6.mask)) in security_node_sid()
2608 c = c->next; in security_node_sid()
2613 rc = 0; in security_node_sid()
2619 if (!c->sid[0]) { in security_node_sid()
2620 rc = sidtab_context_to_sid(sidtab, in security_node_sid()
2621 &c->context[0], in security_node_sid()
2622 &c->sid[0]); in security_node_sid()
2623 if (rc) in security_node_sid()
2626 *out_sid = c->sid[0]; in security_node_sid()
2631 rc = 0; in security_node_sid()
2634 return rc; in security_node_sid()
2640 * security_get_user_sids - Obtain reachable SIDs for a user.
2668 int rc = 0, i, j; in security_get_user_sids() local
2677 policy = rcu_dereference(state->policy); in security_get_user_sids()
2678 policydb = &policy->policydb; in security_get_user_sids()
2679 sidtab = policy->sidtab; in security_get_user_sids()
2683 rc = -EINVAL; in security_get_user_sids()
2688 rc = -EINVAL; in security_get_user_sids()
2689 user = symtab_search(&policydb->p_users, username); in security_get_user_sids()
2693 usercon.user = user->value; in security_get_user_sids()
2695 rc = -ENOMEM; in security_get_user_sids()
2700 ebitmap_for_each_positive_bit(&user->roles, rnode, i) { in security_get_user_sids()
2701 role = policydb->role_val_to_struct[i]; in security_get_user_sids()
2703 ebitmap_for_each_positive_bit(&role->types, tnode, j) { in security_get_user_sids()
2710 rc = sidtab_context_to_sid(sidtab, &usercon, &sid); in security_get_user_sids()
2711 if (rc) in security_get_user_sids()
2716 rc = -ENOMEM; in security_get_user_sids()
2728 rc = 0; in security_get_user_sids()
2731 if (rc || !mynel) { in security_get_user_sids()
2736 rc = -ENOMEM; in security_get_user_sids()
2744 rc = avc_has_perm_noaudit(state, in security_get_user_sids()
2749 if (!rc) in security_get_user_sids()
2753 rc = 0; in security_get_user_sids()
2758 return rc; in security_get_user_sids()
2762 * __security_genfs_sid - Helper to obtain a SID for a file in a filesystem
2778 struct policydb *policydb = &policy->policydb; in __security_genfs_sid()
2779 struct sidtab *sidtab = policy->sidtab; in __security_genfs_sid()
2784 int rc, cmp = 0; in __security_genfs_sid() local
2789 sclass = unmap_class(&policy->map, orig_sclass); in __security_genfs_sid()
2792 for (genfs = policydb->genfs; genfs; genfs = genfs->next) { in __security_genfs_sid()
2793 cmp = strcmp(fstype, genfs->fstype); in __security_genfs_sid()
2798 rc = -ENOENT; in __security_genfs_sid()
2802 for (c = genfs->head; c; c = c->next) { in __security_genfs_sid()
2803 len = strlen(c->u.name); in __security_genfs_sid()
2804 if ((!c->v.sclass || sclass == c->v.sclass) && in __security_genfs_sid()
2805 (strncmp(c->u.name, path, len) == 0)) in __security_genfs_sid()
2809 rc = -ENOENT; in __security_genfs_sid()
2813 if (!c->sid[0]) { in __security_genfs_sid()
2814 rc = sidtab_context_to_sid(sidtab, &c->context[0], &c->sid[0]); in __security_genfs_sid()
2815 if (rc) in __security_genfs_sid()
2819 *sid = c->sid[0]; in __security_genfs_sid()
2820 rc = 0; in __security_genfs_sid()
2822 return rc; in __security_genfs_sid()
2826 * security_genfs_sid - Obtain a SID for a file in a filesystem
2850 policy = rcu_dereference(state->policy); in security_genfs_sid()
2868 * security_fs_use - Determine how to handle labeling for a filesystem.
2876 int rc = 0; in security_fs_use() local
2878 struct superblock_security_struct *sbsec = sb->s_security; in security_fs_use()
2879 const char *fstype = sb->s_type->name; in security_fs_use()
2882 sbsec->behavior = SECURITY_FS_USE_NONE; in security_fs_use()
2883 sbsec->sid = SECINITSID_UNLABELED; in security_fs_use()
2888 policy = rcu_dereference(state->policy); in security_fs_use()
2889 policydb = &policy->policydb; in security_fs_use()
2890 sidtab = policy->sidtab; in security_fs_use()
2892 c = policydb->ocontexts[OCON_FSUSE]; in security_fs_use()
2894 if (strcmp(fstype, c->u.name) == 0) in security_fs_use()
2896 c = c->next; in security_fs_use()
2900 sbsec->behavior = c->v.behavior; in security_fs_use()
2901 if (!c->sid[0]) { in security_fs_use()
2902 rc = sidtab_context_to_sid(sidtab, &c->context[0], in security_fs_use()
2903 &c->sid[0]); in security_fs_use()
2904 if (rc) in security_fs_use()
2907 sbsec->sid = c->sid[0]; in security_fs_use()
2909 rc = __security_genfs_sid(policy, fstype, "/", in security_fs_use()
2910 SECCLASS_DIR, &sbsec->sid); in security_fs_use()
2911 if (rc) { in security_fs_use()
2912 sbsec->behavior = SECURITY_FS_USE_NONE; in security_fs_use()
2913 rc = 0; in security_fs_use()
2915 sbsec->behavior = SECURITY_FS_USE_GENFS; in security_fs_use()
2921 return rc; in security_fs_use()
2929 int rc; in security_get_bools() local
2931 policydb = &policy->policydb; in security_get_bools()
2936 rc = 0; in security_get_bools()
2937 *len = policydb->p_bools.nprim; in security_get_bools()
2941 rc = -ENOMEM; in security_get_bools()
2946 rc = -ENOMEM; in security_get_bools()
2952 (*values)[i] = policydb->bool_val_to_struct[i]->state; in security_get_bools()
2954 rc = -ENOMEM; in security_get_bools()
2960 rc = 0; in security_get_bools()
2962 return rc; in security_get_bools()
2980 int rc; in security_set_bools() local
2984 return -EINVAL; in security_set_bools()
2986 oldpolicy = rcu_dereference_protected(state->policy, in security_set_bools()
2987 lockdep_is_held(&state->policy_mutex)); in security_set_bools()
2990 if (WARN_ON(len != oldpolicy->policydb.p_bools.nprim)) in security_set_bools()
2991 return -EINVAL; in security_set_bools()
2995 return -ENOMEM; in security_set_bools()
3001 rc = cond_policydb_dup(&newpolicy->policydb, &oldpolicy->policydb); in security_set_bools()
3002 if (rc) { in security_set_bools()
3004 return -ENOMEM; in security_set_bools()
3010 int old_state = newpolicy->policydb.bool_val_to_struct[i]->state; in security_set_bools()
3016 sym_name(&newpolicy->policydb, SYM_BOOLS, i), in security_set_bools()
3021 newpolicy->policydb.bool_val_to_struct[i]->state = new_state; in security_set_bools()
3025 /* Re-evaluate the conditional rules in the copy */ in security_set_bools()
3026 evaluate_cond_nodes(&newpolicy->policydb); in security_set_bools()
3029 newpolicy->latest_granting = oldpolicy->latest_granting + 1; in security_set_bools()
3030 seqno = newpolicy->latest_granting; in security_set_bools()
3033 rcu_assign_pointer(state->policy, newpolicy); in security_set_bools()
3053 int rc; in security_get_bool_value() local
3060 policy = rcu_dereference(state->policy); in security_get_bool_value()
3061 policydb = &policy->policydb; in security_get_bool_value()
3063 rc = -EFAULT; in security_get_bool_value()
3064 len = policydb->p_bools.nprim; in security_get_bool_value()
3068 rc = policydb->bool_val_to_struct[index]->state; in security_get_bool_value()
3071 return rc; in security_get_bool_value()
3077 int rc, *bvalues = NULL; in security_preserve_bools() local
3082 rc = security_get_bools(oldpolicy, &nbools, &bnames, &bvalues); in security_preserve_bools()
3083 if (rc) in security_preserve_bools()
3086 booldatum = symtab_search(&newpolicy->policydb.p_bools, in security_preserve_bools()
3089 booldatum->state = bvalues[i]; in security_preserve_bools()
3091 evaluate_cond_nodes(&newpolicy->policydb); in security_preserve_bools()
3100 return rc; in security_preserve_bools()
3104 * security_sid_mls_copy() - computes a new sid based on the given
3118 int rc; in security_sid_mls_copy() local
3120 rc = 0; in security_sid_mls_copy()
3129 policy = rcu_dereference(state->policy); in security_sid_mls_copy()
3130 policydb = &policy->policydb; in security_sid_mls_copy()
3131 sidtab = policy->sidtab; in security_sid_mls_copy()
3133 if (!policydb->mls_enabled) { in security_sid_mls_copy()
3138 rc = -EINVAL; in security_sid_mls_copy()
3146 rc = -EINVAL; in security_sid_mls_copy()
3154 newcon.user = context1->user; in security_sid_mls_copy()
3155 newcon.role = context1->role; in security_sid_mls_copy()
3156 newcon.type = context1->type; in security_sid_mls_copy()
3157 rc = mls_context_cpy(&newcon, context2); in security_sid_mls_copy()
3158 if (rc) in security_sid_mls_copy()
3163 rc = convert_context_handle_invalid_context(state, policydb, in security_sid_mls_copy()
3165 if (rc) { in security_sid_mls_copy()
3176 audit_log_n_untrustedstring(ab, s, len - 1); in security_sid_mls_copy()
3183 rc = sidtab_context_to_sid(sidtab, &newcon, new_sid); in security_sid_mls_copy()
3188 return rc; in security_sid_mls_copy()
3192 * security_net_peersid_resolve - Compare and resolve two network peer SIDs
3204 * ------------------------------+-----------------+-----------------
3208 * multiple, inconsistent labels | -<errno> | SECSID_NULL
3219 int rc; in security_net_peersid_resolve() local
3244 policy = rcu_dereference(state->policy); in security_net_peersid_resolve()
3245 policydb = &policy->policydb; in security_net_peersid_resolve()
3246 sidtab = policy->sidtab; in security_net_peersid_resolve()
3251 * security server was initialized and state->initialized was true. in security_net_peersid_resolve()
3253 if (!policydb->mls_enabled) { in security_net_peersid_resolve()
3254 rc = 0; in security_net_peersid_resolve()
3258 rc = -EINVAL; in security_net_peersid_resolve()
3265 rc = -EINVAL; in security_net_peersid_resolve()
3272 rc = (mls_context_cmp(nlbl_ctx, xfrm_ctx) ? 0 : -EACCES); in security_net_peersid_resolve()
3273 if (rc) in security_net_peersid_resolve()
3284 return rc; in security_net_peersid_resolve()
3290 char *name = k, **classes = args; in get_classes_callback() local
3291 int value = datum->value - 1; in get_classes_callback()
3293 classes[value] = kstrdup(name, GFP_ATOMIC); in get_classes_callback()
3295 return -ENOMEM; in get_classes_callback()
3304 int rc; in security_get_classes() local
3306 policydb = &policy->policydb; in security_get_classes()
3308 rc = -ENOMEM; in security_get_classes()
3309 *nclasses = policydb->p_classes.nprim; in security_get_classes()
3314 rc = hashtab_map(&policydb->p_classes.table, get_classes_callback, in security_get_classes()
3316 if (rc) { in security_get_classes()
3324 return rc; in security_get_classes()
3330 char *name = k, **perms = args; in get_permissions_callback() local
3331 int value = datum->value - 1; in get_permissions_callback()
3333 perms[value] = kstrdup(name, GFP_ATOMIC); in get_permissions_callback()
3335 return -ENOMEM; in get_permissions_callback()
3344 int rc, i; in security_get_permissions() local
3347 policydb = &policy->policydb; in security_get_permissions()
3349 rc = -EINVAL; in security_get_permissions()
3350 match = symtab_search(&policydb->p_classes, class); in security_get_permissions()
3357 rc = -ENOMEM; in security_get_permissions()
3358 *nperms = match->permissions.nprim; in security_get_permissions()
3363 if (match->comdatum) { in security_get_permissions()
3364 rc = hashtab_map(&match->comdatum->permissions.table, in security_get_permissions()
3366 if (rc) in security_get_permissions()
3370 rc = hashtab_map(&match->permissions.table, get_permissions_callback, in security_get_permissions()
3372 if (rc) in security_get_permissions()
3376 return rc; in security_get_permissions()
3382 return rc; in security_get_permissions()
3394 policy = rcu_dereference(state->policy); in security_get_reject_unknown()
3395 value = policy->policydb.reject_unknown; in security_get_reject_unknown()
3409 policy = rcu_dereference(state->policy); in security_get_allow_unknown()
3410 value = policy->policydb.allow_unknown; in security_get_allow_unknown()
3416 * security_policycap_supported - Check for a specific policy capability
3429 int rc; in security_policycap_supported() local
3435 policy = rcu_dereference(state->policy); in security_policycap_supported()
3436 rc = ebitmap_get_bit(&policy->policydb.policycaps, req_cap); in security_policycap_supported()
3439 return rc; in security_policycap_supported()
3452 context_destroy(&rule->au_ctxt); in selinux_audit_rule_free()
3467 int rc = 0; in selinux_audit_rule_init() local
3472 return -EOPNOTSUPP; in selinux_audit_rule_init()
3483 return -EINVAL; in selinux_audit_rule_init()
3489 /* we do not allow a range, indicated by the presence of '-' */ in selinux_audit_rule_init()
3490 if (strchr(rulestr, '-')) in selinux_audit_rule_init()
3491 return -EINVAL; in selinux_audit_rule_init()
3495 return -EINVAL; in selinux_audit_rule_init()
3500 return -ENOMEM; in selinux_audit_rule_init()
3502 context_init(&tmprule->au_ctxt); in selinux_audit_rule_init()
3505 policy = rcu_dereference(state->policy); in selinux_audit_rule_init()
3506 policydb = &policy->policydb; in selinux_audit_rule_init()
3508 tmprule->au_seqno = policy->latest_granting; in selinux_audit_rule_init()
3513 rc = -EINVAL; in selinux_audit_rule_init()
3514 userdatum = symtab_search(&policydb->p_users, rulestr); in selinux_audit_rule_init()
3517 tmprule->au_ctxt.user = userdatum->value; in selinux_audit_rule_init()
3521 rc = -EINVAL; in selinux_audit_rule_init()
3522 roledatum = symtab_search(&policydb->p_roles, rulestr); in selinux_audit_rule_init()
3525 tmprule->au_ctxt.role = roledatum->value; in selinux_audit_rule_init()
3529 rc = -EINVAL; in selinux_audit_rule_init()
3530 typedatum = symtab_search(&policydb->p_types, rulestr); in selinux_audit_rule_init()
3533 tmprule->au_ctxt.type = typedatum->value; in selinux_audit_rule_init()
3539 rc = mls_from_string(policydb, rulestr, &tmprule->au_ctxt, in selinux_audit_rule_init()
3541 if (rc) in selinux_audit_rule_init()
3545 rc = 0; in selinux_audit_rule_init()
3549 if (rc) { in selinux_audit_rule_init()
3556 return rc; in selinux_audit_rule_init()
3564 for (i = 0; i < rule->field_count; i++) { in selinux_audit_rule_known()
3565 struct audit_field *f = &rule->fields[i]; in selinux_audit_rule_known()
3566 switch (f->type) { in selinux_audit_rule_known()
3595 return -ENOENT; in selinux_audit_rule_match()
3603 policy = rcu_dereference(state->policy); in selinux_audit_rule_match()
3605 if (rule->au_seqno < policy->latest_granting) { in selinux_audit_rule_match()
3606 match = -ESTALE; in selinux_audit_rule_match()
3610 ctxt = sidtab_search(policy->sidtab, sid); in selinux_audit_rule_match()
3614 match = -ENOENT; in selinux_audit_rule_match()
3625 match = (ctxt->user == rule->au_ctxt.user); in selinux_audit_rule_match()
3628 match = (ctxt->user != rule->au_ctxt.user); in selinux_audit_rule_match()
3636 match = (ctxt->role == rule->au_ctxt.role); in selinux_audit_rule_match()
3639 match = (ctxt->role != rule->au_ctxt.role); in selinux_audit_rule_match()
3647 match = (ctxt->type == rule->au_ctxt.type); in selinux_audit_rule_match()
3650 match = (ctxt->type != rule->au_ctxt.type); in selinux_audit_rule_match()
3660 &ctxt->range.level[0] : &ctxt->range.level[1]); in selinux_audit_rule_match()
3663 match = mls_level_eq(&rule->au_ctxt.range.level[0], in selinux_audit_rule_match()
3667 match = !mls_level_eq(&rule->au_ctxt.range.level[0], in selinux_audit_rule_match()
3671 match = (mls_level_dom(&rule->au_ctxt.range.level[0], in selinux_audit_rule_match()
3673 !mls_level_eq(&rule->au_ctxt.range.level[0], in selinux_audit_rule_match()
3677 match = mls_level_dom(&rule->au_ctxt.range.level[0], in selinux_audit_rule_match()
3682 &rule->au_ctxt.range.level[0]) && in selinux_audit_rule_match()
3684 &rule->au_ctxt.range.level[0])); in selinux_audit_rule_match()
3688 &rule->au_ctxt.range.level[0]); in selinux_audit_rule_match()
3723 * security_netlbl_cache_add - Add an entry to the NetLabel cache
3741 secattr->cache = netlbl_secattr_cache_alloc(GFP_ATOMIC); in security_netlbl_cache_add()
3742 if (secattr->cache == NULL) { in security_netlbl_cache_add()
3748 secattr->cache->free = kfree; in security_netlbl_cache_add()
3749 secattr->cache->data = sid_cache; in security_netlbl_cache_add()
3750 secattr->flags |= NETLBL_SECATTR_CACHE; in security_netlbl_cache_add()
3754 * security_netlbl_secattr_to_sid - Convert a NetLabel secattr to a SELinux SID
3775 int rc; in security_netlbl_secattr_to_sid() local
3785 policy = rcu_dereference(state->policy); in security_netlbl_secattr_to_sid()
3786 policydb = &policy->policydb; in security_netlbl_secattr_to_sid()
3787 sidtab = policy->sidtab; in security_netlbl_secattr_to_sid()
3789 if (secattr->flags & NETLBL_SECATTR_CACHE) in security_netlbl_secattr_to_sid()
3790 *sid = *(u32 *)secattr->cache->data; in security_netlbl_secattr_to_sid()
3791 else if (secattr->flags & NETLBL_SECATTR_SECID) in security_netlbl_secattr_to_sid()
3792 *sid = secattr->attr.secid; in security_netlbl_secattr_to_sid()
3793 else if (secattr->flags & NETLBL_SECATTR_MLS_LVL) { in security_netlbl_secattr_to_sid()
3794 rc = -EIDRM; in security_netlbl_secattr_to_sid()
3800 ctx_new.user = ctx->user; in security_netlbl_secattr_to_sid()
3801 ctx_new.role = ctx->role; in security_netlbl_secattr_to_sid()
3802 ctx_new.type = ctx->type; in security_netlbl_secattr_to_sid()
3804 if (secattr->flags & NETLBL_SECATTR_MLS_CAT) { in security_netlbl_secattr_to_sid()
3805 rc = mls_import_netlbl_cat(policydb, &ctx_new, secattr); in security_netlbl_secattr_to_sid()
3806 if (rc) in security_netlbl_secattr_to_sid()
3809 rc = -EIDRM; in security_netlbl_secattr_to_sid()
3813 rc = sidtab_context_to_sid(sidtab, &ctx_new, sid); in security_netlbl_secattr_to_sid()
3814 if (rc) in security_netlbl_secattr_to_sid()
3829 return rc; in security_netlbl_secattr_to_sid()
3833 * security_netlbl_sid_to_secattr - Convert a SELinux SID to a NetLabel secattr
3847 int rc; in security_netlbl_sid_to_secattr() local
3854 policy = rcu_dereference(state->policy); in security_netlbl_sid_to_secattr()
3855 policydb = &policy->policydb; in security_netlbl_sid_to_secattr()
3857 rc = -ENOENT; in security_netlbl_sid_to_secattr()
3858 ctx = sidtab_search(policy->sidtab, sid); in security_netlbl_sid_to_secattr()
3862 rc = -ENOMEM; in security_netlbl_sid_to_secattr()
3863 secattr->domain = kstrdup(sym_name(policydb, SYM_TYPES, ctx->type - 1), in security_netlbl_sid_to_secattr()
3865 if (secattr->domain == NULL) in security_netlbl_sid_to_secattr()
3868 secattr->attr.secid = sid; in security_netlbl_sid_to_secattr()
3869 secattr->flags |= NETLBL_SECATTR_DOMAIN_CPY | NETLBL_SECATTR_SECID; in security_netlbl_sid_to_secattr()
3871 rc = mls_export_netlbl_cat(policydb, ctx, secattr); in security_netlbl_sid_to_secattr()
3874 return rc; in security_netlbl_sid_to_secattr()
3879 * security_read_policy - read the policy.
3888 int rc; in security_read_policy() local
3892 state->policy, lockdep_is_held(&state->policy_mutex)); in security_read_policy()
3894 return -EINVAL; in security_read_policy()
3896 *len = policy->policydb.len; in security_read_policy()
3899 return -ENOMEM; in security_read_policy()
3904 rc = policydb_write(&policy->policydb, &fp); in security_read_policy()
3905 if (rc) in security_read_policy()
3906 return rc; in security_read_policy()
3908 *len = (unsigned long)fp.data - (unsigned long)*data; in security_read_policy()