Lines Matching +full:user +full:- +full:level
1 // SPDX-License-Identifier: GPL-2.0
3 * Implementation of the multi-level security (MLS) policy.
12 * Copyright (C) 2004-2006 Trusted Computer Solutions, Inc.
15 * Updated: Hewlett-Packard <paul@paul-moore.com>
19 * (c) Copyright Hewlett-Packard Development Company, L.P., 2006
43 if (!p->mls_enabled) in mls_compute_context_len()
48 u32 index_sens = context->range.level[l].sens; in mls_compute_context_len()
49 len += strlen(sym_name(p, SYM_LEVELS, index_sens - 1)); in mls_compute_context_len()
52 head = -2; in mls_compute_context_len()
53 prev = -2; in mls_compute_context_len()
54 e = &context->range.level[l].cat; in mls_compute_context_len()
56 if (i - prev > 1) { in mls_compute_context_len()
73 if (mls_level_eq(&context->range.level[0], in mls_compute_context_len()
74 &context->range.level[1])) in mls_compute_context_len()
98 if (!p->mls_enabled) in mls_sid_to_context()
108 context->range.level[l].sens - 1)); in mls_sid_to_context()
112 head = -2; in mls_sid_to_context()
113 prev = -2; in mls_sid_to_context()
114 e = &context->range.level[l].cat; in mls_sid_to_context()
116 if (i - prev > 1) { in mls_sid_to_context()
119 if (prev - head > 1) in mls_sid_to_context()
140 if (prev - head > 1) in mls_sid_to_context()
150 if (mls_level_eq(&context->range.level[0], in mls_sid_to_context()
151 &context->range.level[1])) in mls_sid_to_context()
154 *scontextp++ = '-'; in mls_sid_to_context()
165 if (!l->sens || l->sens > p->p_levels.nprim) in mls_level_isvalid()
167 levdatum = symtab_search(&p->p_levels, in mls_level_isvalid()
168 sym_name(p, SYM_LEVELS, l->sens - 1)); in mls_level_isvalid()
173 * Return 1 iff all the bits set in l->cat are also be set in in mls_level_isvalid()
174 * levdatum->level->cat and no bit in l->cat is larger than in mls_level_isvalid()
175 * p->p_cats.nprim. in mls_level_isvalid()
177 return ebitmap_contains(&levdatum->level->cat, &l->cat, in mls_level_isvalid()
178 p->p_cats.nprim); in mls_level_isvalid()
183 return (mls_level_isvalid(p, &r->level[0]) && in mls_range_isvalid()
184 mls_level_isvalid(p, &r->level[1]) && in mls_range_isvalid()
185 mls_level_dom(&r->level[1], &r->level[0])); in mls_range_isvalid()
196 if (!p->mls_enabled) in mls_context_isvalid()
199 if (!mls_range_isvalid(p, &c->range)) in mls_context_isvalid()
202 if (c->role == OBJECT_R_VAL) in mls_context_isvalid()
206 * User must be authorized for the MLS range. in mls_context_isvalid()
208 if (!c->user || c->user > p->p_users.nprim) in mls_context_isvalid()
210 usrdatum = p->user_val_to_struct[c->user - 1]; in mls_context_isvalid()
211 if (!mls_range_contains(usrdatum->range, c->range)) in mls_context_isvalid()
212 return 0; /* user may not be associated with range */ in mls_context_isvalid()
230 * Policy read-lock must be held for sidtab lookup.
247 if (!pol->mls_enabled) { in mls_context_to_sid()
249 * With no MLS, only return -EINVAL if there is a MLS field in mls_context_to_sid()
253 return -EINVAL; in mls_context_to_sid()
265 return -EINVAL; in mls_context_to_sid()
269 return -EINVAL; in mls_context_to_sid()
279 rangep[1] = strchr(scontext, '-'); in mls_context_to_sid()
296 levdatum = symtab_search(&pol->p_levels, sensitivity); in mls_context_to_sid()
298 return -EINVAL; in mls_context_to_sid()
299 context->range.level[l].sens = levdatum->level->sens; in mls_context_to_sid()
315 catdatum = symtab_search(&pol->p_cats, cur_cat); in mls_context_to_sid()
317 return -EINVAL; in mls_context_to_sid()
319 rc = ebitmap_set_bit(&context->range.level[l].cat, in mls_context_to_sid()
320 catdatum->value - 1, 1); in mls_context_to_sid()
328 rngdatum = symtab_search(&pol->p_cats, rngptr); in mls_context_to_sid()
330 return -EINVAL; in mls_context_to_sid()
332 if (catdatum->value >= rngdatum->value) in mls_context_to_sid()
333 return -EINVAL; in mls_context_to_sid()
335 for (i = catdatum->value; i < rngdatum->value; i++) { in mls_context_to_sid()
336 rc = ebitmap_set_bit(&context->range.level[l].cat, i, 1); in mls_context_to_sid()
343 /* If we didn't see a '-', the range start is also the range end. */ in mls_context_to_sid()
345 context->range.level[1].sens = context->range.level[0].sens; in mls_context_to_sid()
346 rc = ebitmap_cpy(&context->range.level[1].cat, in mls_context_to_sid()
347 &context->range.level[0].cat); in mls_context_to_sid()
367 if (!p->mls_enabled) in mls_from_string()
368 return -EINVAL; in mls_from_string()
372 rc = -ENOMEM; in mls_from_string()
392 context->range.level[l].sens = range->level[l].sens; in mls_range_set()
393 rc = ebitmap_cpy(&context->range.level[l].cat, in mls_range_set()
394 &range->level[l].cat); in mls_range_set()
403 struct context *fromcon, struct user_datum *user, in mls_setup_user_range() argument
406 if (p->mls_enabled) { in mls_setup_user_range()
407 struct mls_level *fromcon_sen = &(fromcon->range.level[0]); in mls_setup_user_range()
408 struct mls_level *fromcon_clr = &(fromcon->range.level[1]); in mls_setup_user_range()
409 struct mls_level *user_low = &(user->range.level[0]); in mls_setup_user_range()
410 struct mls_level *user_clr = &(user->range.level[1]); in mls_setup_user_range()
411 struct mls_level *user_def = &(user->dfltlevel); in mls_setup_user_range()
412 struct mls_level *usercon_sen = &(usercon->range.level[0]); in mls_setup_user_range()
413 struct mls_level *usercon_clr = &(usercon->range.level[1]); in mls_setup_user_range()
415 /* Honor the user's default level if we can */ in mls_setup_user_range()
423 return -EINVAL; in mls_setup_user_range()
427 that of the user's default clearance (but in mls_setup_user_range()
429 the user's computed sensitivity level) */ in mls_setup_user_range()
435 return -EINVAL; in mls_setup_user_range()
458 if (!oldp->mls_enabled || !newp->mls_enabled) in mls_convert_context()
463 oldc->range.level[l].sens - 1); in mls_convert_context()
465 levdatum = symtab_search(&newp->p_levels, name); in mls_convert_context()
468 return -EINVAL; in mls_convert_context()
469 newc->range.level[l].sens = levdatum->level->sens; in mls_convert_context()
471 ebitmap_for_each_positive_bit(&oldc->range.level[l].cat, in mls_convert_context()
475 catdatum = symtab_search(&newp->p_cats, in mls_convert_context()
478 return -EINVAL; in mls_convert_context()
479 rc = ebitmap_set_bit(&newc->range.level[l].cat, in mls_convert_context()
480 catdatum->value - 1, 1); in mls_convert_context()
502 if (!p->mls_enabled) in mls_compute_sid()
508 rtr.source_type = scontext->type; in mls_compute_sid()
509 rtr.target_type = tcontext->type; in mls_compute_sid()
515 if (tclass && tclass <= p->p_classes.nprim) { in mls_compute_sid()
516 cladatum = p->class_val_to_struct[tclass - 1]; in mls_compute_sid()
518 default_range = cladatum->default_range; in mls_compute_sid()
541 if ((tclass == p->process_class) || sock) in mls_compute_sid()
551 return -EINVAL; in mls_compute_sid()
556 * mls_export_netlbl_lvl - Export the MLS sensitivity levels to NetLabel
562 * Given the security context copy the low MLS sensitivity level into the
563 * NetLabel MLS sensitivity level field.
570 if (!p->mls_enabled) in mls_export_netlbl_lvl()
573 secattr->attr.mls.lvl = context->range.level[0].sens - 1; in mls_export_netlbl_lvl()
574 secattr->flags |= NETLBL_SECATTR_MLS_LVL; in mls_export_netlbl_lvl()
578 * mls_import_netlbl_lvl - Import the NetLabel MLS sensitivity levels
585 * NetLabel MLS sensitivity level into the context.
592 if (!p->mls_enabled) in mls_import_netlbl_lvl()
595 context->range.level[0].sens = secattr->attr.mls.lvl + 1; in mls_import_netlbl_lvl()
596 context->range.level[1].sens = context->range.level[0].sens; in mls_import_netlbl_lvl()
600 * mls_export_netlbl_cat - Export the MLS categories to NetLabel
616 if (!p->mls_enabled) in mls_export_netlbl_cat()
619 rc = ebitmap_netlbl_export(&context->range.level[0].cat, in mls_export_netlbl_cat()
620 &secattr->attr.mls.cat); in mls_export_netlbl_cat()
621 if (rc == 0 && secattr->attr.mls.cat != NULL) in mls_export_netlbl_cat()
622 secattr->flags |= NETLBL_SECATTR_MLS_CAT; in mls_export_netlbl_cat()
628 * mls_import_netlbl_cat - Import the MLS categories from NetLabel
646 if (!p->mls_enabled) in mls_import_netlbl_cat()
649 rc = ebitmap_netlbl_import(&context->range.level[0].cat, in mls_import_netlbl_cat()
650 secattr->attr.mls.cat); in mls_import_netlbl_cat()
653 memcpy(&context->range.level[1].cat, &context->range.level[0].cat, in mls_import_netlbl_cat()
654 sizeof(context->range.level[0].cat)); in mls_import_netlbl_cat()
659 ebitmap_destroy(&context->range.level[0].cat); in mls_import_netlbl_cat()