1 /* Authors: Karl MacMillan <kmacmillan (at) mentalrootkit.com> 2 * Jason Tang <jtang (at) tresys.com> 3 * Joshua Brindle <jbrindle (at) tresys.com> 4 * 5 * Copyright (C) 2004-2005 Tresys Technology, LLC 6 * Copyright (C) 2007 Red Hat, Inc. 7 * 8 * This library is free software; you can redistribute it and/or 9 * modify it under the terms of the GNU Lesser General Public 10 * License as published by the Free Software Foundation; either 11 * version 2.1 of the License, or (at your option) any later version. 12 * 13 * This library is distributed in the hope that it will be useful, 14 * but WITHOUT ANY WARRANTY; without even the implied warranty of 15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU 16 * Lesser General Public License for more details. 17 * 18 * You should have received a copy of the GNU Lesser General Public 19 * License along with this library; if not, write to the Free Software 20 * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA 21 */ 22 23 #include "context.h" 24 #include <sepol/policydb/policydb.h> 25 #include <sepol/policydb/conditional.h> 26 #include <sepol/policydb/hashtab.h> 27 #include <sepol/policydb/expand.h> 28 #include <sepol/policydb/hierarchy.h> 29 #include <sepol/policydb/avrule_block.h> 30 31 #include <stdlib.h> 32 #include <stdarg.h> 33 #include <stdio.h> 34 #include <string.h> 35 #include <assert.h> 36 37 #include "debug.h" 38 #include "private.h" 39 40 typedef struct expand_state { 41 int verbose; 42 uint32_t *typemap; 43 uint32_t *boolmap; 44 uint32_t *rolemap; 45 uint32_t *usermap; 46 policydb_t *base; 47 policydb_t *out; 48 sepol_handle_t *handle; 49 int expand_neverallow; 50 } expand_state_t; 51 52 static void expand_state_init(expand_state_t * state) 53 { 54 memset(state, 0, sizeof(expand_state_t)); 55 } 56 57 static int map_ebitmap(ebitmap_t * src, ebitmap_t * dst, uint32_t * map) 58 { 59 unsigned int i; 60 ebitmap_node_t *tnode; 61 ebitmap_init(dst); 62 63 ebitmap_for_each_bit(src, tnode, i) { 64 if (!ebitmap_node_get_bit(tnode, i)) 65 continue; 66 if (!map[i]) 67 continue; 68 if (ebitmap_set_bit(dst, map[i] - 1, 1)) 69 return -1; 70 } 71 return 0; 72 } 73 74 static int type_copy_callback(hashtab_key_t key, hashtab_datum_t datum, 75 void *data) 76 { 77 int ret; 78 char *id, *new_id; 79 type_datum_t *type, *new_type; 80 expand_state_t *state; 81 82 id = (char *)key; 83 type = (type_datum_t *) datum; 84 state = (expand_state_t *) data; 85 86 if ((type->flavor == TYPE_TYPE && !type->primary) 87 || type->flavor == TYPE_ALIAS) { 88 /* aliases are handled later */ 89 return 0; 90 } 91 if (!is_id_enabled(id, state->base, SYM_TYPES)) { 92 /* identifier's scope is not enabled */ 93 return 0; 94 } 95 96 if (state->verbose) 97 INFO(state->handle, "copying type or attribute %s", id); 98 99 new_id = strdup(id); 100 if (new_id == NULL) { 101 ERR(state->handle, "Out of memory!"); 102 return -1; 103 } 104 105 new_type = (type_datum_t *) malloc(sizeof(type_datum_t)); 106 if (!new_type) { 107 ERR(state->handle, "Out of memory!"); 108 free(new_id); 109 return SEPOL_ENOMEM; 110 } 111 memset(new_type, 0, sizeof(type_datum_t)); 112 113 new_type->flavor = type->flavor; 114 new_type->flags = type->flags; 115 new_type->s.value = ++state->out->p_types.nprim; 116 if (new_type->s.value > UINT16_MAX) { 117 free(new_id); 118 free(new_type); 119 ERR(state->handle, "type space overflow"); 120 return -1; 121 } 122 new_type->primary = 1; 123 state->typemap[type->s.value - 1] = new_type->s.value; 124 125 ret = hashtab_insert(state->out->p_types.table, 126 (hashtab_key_t) new_id, 127 (hashtab_datum_t) new_type); 128 if (ret) { 129 free(new_id); 130 free(new_type); 131 ERR(state->handle, "hashtab overflow"); 132 return -1; 133 } 134 135 if (new_type->flags & TYPE_FLAGS_PERMISSIVE) 136 if (ebitmap_set_bit(&state->out->permissive_map, new_type->s.value, 1)) { 137 ERR(state->handle, "Out of memory!\n"); 138 return -1; 139 } 140 141 return 0; 142 } 143 144 static int attr_convert_callback(hashtab_key_t key, hashtab_datum_t datum, 145 void *data) 146 { 147 char *id; 148 type_datum_t *type, *new_type; 149 expand_state_t *state; 150 ebitmap_t tmp_union; 151 152 id = (char *)key; 153 type = (type_datum_t *) datum; 154 state = (expand_state_t *) data; 155 156 if (type->flavor != TYPE_ATTRIB) 157 return 0; 158 159 if (!is_id_enabled(id, state->base, SYM_TYPES)) { 160 /* identifier's scope is not enabled */ 161 return 0; 162 } 163 164 if (state->verbose) 165 INFO(state->handle, "converting attribute %s", id); 166 167 new_type = hashtab_search(state->out->p_types.table, id); 168 if (!new_type) { 169 ERR(state->handle, "attribute %s vanished!", id); 170 return -1; 171 } 172 if (map_ebitmap(&type->types, &tmp_union, state->typemap)) { 173 ERR(state->handle, "out of memory"); 174 return -1; 175 } 176 177 /* then union tmp_union onto &new_type->types */ 178 if (ebitmap_union(&new_type->types, &tmp_union)) { 179 ERR(state->handle, "Out of memory!"); 180 return -1; 181 } 182 ebitmap_destroy(&tmp_union); 183 184 return 0; 185 } 186 187 static int perm_copy_callback(hashtab_key_t key, hashtab_datum_t datum, 188 void *data) 189 { 190 int ret; 191 char *id, *new_id; 192 symtab_t *s; 193 perm_datum_t *perm, *new_perm; 194 195 id = key; 196 perm = (perm_datum_t *) datum; 197 s = (symtab_t *) data; 198 199 new_perm = (perm_datum_t *) malloc(sizeof(perm_datum_t)); 200 if (!new_perm) { 201 return -1; 202 } 203 memset(new_perm, 0, sizeof(perm_datum_t)); 204 205 new_id = strdup(id); 206 if (!new_id) { 207 free(new_perm); 208 return -1; 209 } 210 211 new_perm->s.value = perm->s.value; 212 s->nprim++; 213 214 ret = hashtab_insert(s->table, new_id, (hashtab_datum_t *) new_perm); 215 if (ret) { 216 free(new_id); 217 free(new_perm); 218 return -1; 219 } 220 221 return 0; 222 } 223 224 static int common_copy_callback(hashtab_key_t key, hashtab_datum_t datum, 225 void *data) 226 { 227 int ret; 228 char *id, *new_id; 229 common_datum_t *common, *new_common; 230 expand_state_t *state; 231 232 id = (char *)key; 233 common = (common_datum_t *) datum; 234 state = (expand_state_t *) data; 235 236 if (state->verbose) 237 INFO(state->handle, "copying common %s", id); 238 239 new_common = (common_datum_t *) malloc(sizeof(common_datum_t)); 240 if (!new_common) { 241 ERR(state->handle, "Out of memory!"); 242 return -1; 243 } 244 memset(new_common, 0, sizeof(common_datum_t)); 245 if (symtab_init(&new_common->permissions, PERM_SYMTAB_SIZE)) { 246 ERR(state->handle, "Out of memory!"); 247 free(new_common); 248 return -1; 249 } 250 251 new_id = strdup(id); 252 if (!new_id) { 253 ERR(state->handle, "Out of memory!"); 254 symtab_destroy(&new_common->permissions); 255 free(new_common); 256 return -1; 257 } 258 259 new_common->s.value = common->s.value; 260 state->out->p_commons.nprim++; 261 262 ret = 263 hashtab_insert(state->out->p_commons.table, new_id, 264 (hashtab_datum_t *) new_common); 265 if (ret) { 266 ERR(state->handle, "hashtab overflow"); 267 symtab_destroy(&new_common->permissions); 268 free(new_common); 269 free(new_id); 270 return -1; 271 } 272 273 if (hashtab_map 274 (common->permissions.table, perm_copy_callback, 275 &new_common->permissions)) { 276 ERR(state->handle, "Out of memory!"); 277 return -1; 278 } 279 280 return 0; 281 } 282 283 static int constraint_node_clone(constraint_node_t ** dst, 284 constraint_node_t * src, 285 expand_state_t * state) 286 { 287 constraint_node_t *new_con = NULL, *last_new_con = NULL; 288 constraint_expr_t *new_expr = NULL; 289 *dst = NULL; 290 while (src != NULL) { 291 constraint_expr_t *expr, *expr_l = NULL; 292 new_con = 293 (constraint_node_t *) malloc(sizeof(constraint_node_t)); 294 if (!new_con) { 295 goto out_of_mem; 296 } 297 memset(new_con, 0, sizeof(constraint_node_t)); 298 new_con->permissions = src->permissions; 299 for (expr = src->expr; expr; expr = expr->next) { 300 if ((new_expr = calloc(1, sizeof(*new_expr))) == NULL) { 301 goto out_of_mem; 302 } 303 if (constraint_expr_init(new_expr) == -1) { 304 goto out_of_mem; 305 } 306 new_expr->expr_type = expr->expr_type; 307 new_expr->attr = expr->attr; 308 new_expr->op = expr->op; 309 if (new_expr->expr_type == CEXPR_NAMES) { 310 if (new_expr->attr & CEXPR_TYPE) { 311 /* Type sets require expansion and conversion. */ 312 if (expand_convert_type_set(state->out, 313 state-> 314 typemap, 315 expr-> 316 type_names, 317 &new_expr-> 318 names, 1)) { 319 goto out_of_mem; 320 } 321 } else if (new_expr->attr & CEXPR_ROLE) { 322 if (map_ebitmap(&expr->names, &new_expr->names, state->rolemap)) { 323 goto out_of_mem; 324 } 325 } else if (new_expr->attr & CEXPR_USER) { 326 if (map_ebitmap(&expr->names, &new_expr->names, state->usermap)) { 327 goto out_of_mem; 328 } 329 } else { 330 /* Other kinds of sets do not. */ 331 if (ebitmap_cpy(&new_expr->names, 332 &expr->names)) { 333 goto out_of_mem; 334 } 335 } 336 } 337 if (expr_l) { 338 expr_l->next = new_expr; 339 } else { 340 new_con->expr = new_expr; 341 } 342 expr_l = new_expr; 343 new_expr = NULL; 344 } 345 if (last_new_con == NULL) { 346 *dst = new_con; 347 } else { 348 last_new_con->next = new_con; 349 } 350 last_new_con = new_con; 351 src = src->next; 352 } 353 354 return 0; 355 out_of_mem: 356 ERR(state->handle, "Out of memory!"); 357 if (new_con) 358 free(new_con); 359 constraint_expr_destroy(new_expr); 360 return -1; 361 } 362 363 static int class_copy_default_new_object(expand_state_t *state, 364 class_datum_t *olddatum, 365 class_datum_t *newdatum) 366 { 367 if (olddatum->default_user) { 368 if (newdatum->default_user && olddatum->default_user != newdatum->default_user) { 369 ERR(state->handle, "Found conflicting default user definitions"); 370 return SEPOL_ENOTSUP; 371 } 372 newdatum->default_user = olddatum->default_user; 373 374 } 375 if (olddatum->default_role) { 376 if (newdatum->default_role && olddatum->default_role != newdatum->default_role) { 377 ERR(state->handle, "Found conflicting default role definitions"); 378 return SEPOL_ENOTSUP; 379 } 380 newdatum->default_role = olddatum->default_role; 381 } 382 if (olddatum->default_range) { 383 if (newdatum->default_range && olddatum->default_range != newdatum->default_range) { 384 ERR(state->handle, "Found conflicting default range definitions"); 385 return SEPOL_ENOTSUP; 386 } 387 newdatum->default_range = olddatum->default_range; 388 } 389 return 0; 390 } 391 392 static int class_copy_callback(hashtab_key_t key, hashtab_datum_t datum, 393 void *data) 394 { 395 int ret; 396 char *id, *new_id; 397 class_datum_t *class, *new_class; 398 expand_state_t *state; 399 400 id = (char *)key; 401 class = (class_datum_t *) datum; 402 state = (expand_state_t *) data; 403 404 if (!is_id_enabled(id, state->base, SYM_CLASSES)) { 405 /* identifier's scope is not enabled */ 406 return 0; 407 } 408 409 if (state->verbose) 410 INFO(state->handle, "copying class %s", id); 411 412 new_class = (class_datum_t *) malloc(sizeof(class_datum_t)); 413 if (!new_class) { 414 ERR(state->handle, "Out of memory!"); 415 return -1; 416 } 417 memset(new_class, 0, sizeof(class_datum_t)); 418 if (symtab_init(&new_class->permissions, PERM_SYMTAB_SIZE)) { 419 ERR(state->handle, "Out of memory!"); 420 free(new_class); 421 return -1; 422 } 423 424 new_class->s.value = class->s.value; 425 state->out->p_classes.nprim++; 426 427 ret = class_copy_default_new_object(state, class, new_class); 428 if (ret) { 429 free(new_class); 430 return ret; 431 } 432 433 new_id = strdup(id); 434 if (!new_id) { 435 ERR(state->handle, "Out of memory!"); 436 free(new_class); 437 return -1; 438 } 439 440 ret = 441 hashtab_insert(state->out->p_classes.table, new_id, 442 (hashtab_datum_t *) new_class); 443 if (ret) { 444 ERR(state->handle, "hashtab overflow"); 445 free(new_class); 446 free(new_id); 447 return -1; 448 } 449 450 if (hashtab_map 451 (class->permissions.table, perm_copy_callback, 452 &new_class->permissions)) { 453 ERR(state->handle, "hashtab overflow"); 454 return -1; 455 } 456 457 if (class->comkey) { 458 new_class->comkey = strdup(class->comkey); 459 if (!new_class->comkey) { 460 ERR(state->handle, "Out of memory!"); 461 return -1; 462 } 463 464 new_class->comdatum = 465 hashtab_search(state->out->p_commons.table, 466 new_class->comkey); 467 if (!new_class->comdatum) { 468 ERR(state->handle, "could not find common datum %s", 469 new_class->comkey); 470 return -1; 471 } 472 new_class->permissions.nprim += 473 new_class->comdatum->permissions.nprim; 474 } 475 476 return 0; 477 } 478 479 static int constraint_copy_callback(hashtab_key_t key, hashtab_datum_t datum, 480 void *data) 481 { 482 char *id; 483 class_datum_t *class, *new_class; 484 expand_state_t *state; 485 486 id = (char *)key; 487 class = (class_datum_t *) datum; 488 state = (expand_state_t *) data; 489 490 new_class = hashtab_search(state->out->p_classes.table, id); 491 if (!new_class) { 492 ERR(state->handle, "class %s vanished", id); 493 return -1; 494 } 495 496 /* constraints */ 497 if (constraint_node_clone 498 (&new_class->constraints, class->constraints, state) == -1 499 || constraint_node_clone(&new_class->validatetrans, 500 class->validatetrans, state) == -1) { 501 return -1; 502 } 503 return 0; 504 } 505 506 /* 507 * The boundaries have to be copied after the types/roles/users are copied, 508 * because it refers hashtab to lookup destinated objects. 509 */ 510 static int type_bounds_copy_callback(hashtab_key_t key, 511 hashtab_datum_t datum, void *data) 512 { 513 expand_state_t *state = (expand_state_t *) data; 514 type_datum_t *type = (type_datum_t *) datum; 515 type_datum_t *dest; 516 uint32_t bounds_val; 517 518 if (!type->bounds) 519 return 0; 520 521 if (!is_id_enabled((char *)key, state->base, SYM_TYPES)) 522 return 0; 523 524 bounds_val = state->typemap[type->bounds - 1]; 525 526 dest = hashtab_search(state->out->p_types.table, (char *)key); 527 if (!dest) { 528 ERR(state->handle, "Type lookup failed for %s", (char *)key); 529 return -1; 530 } 531 if (dest->bounds != 0 && dest->bounds != bounds_val) { 532 ERR(state->handle, "Inconsistent boundary for %s", (char *)key); 533 return -1; 534 } 535 dest->bounds = bounds_val; 536 537 return 0; 538 } 539 540 static int role_bounds_copy_callback(hashtab_key_t key, 541 hashtab_datum_t datum, void *data) 542 { 543 expand_state_t *state = (expand_state_t *) data; 544 role_datum_t *role = (role_datum_t *) datum; 545 role_datum_t *dest; 546 uint32_t bounds_val; 547 548 if (!role->bounds) 549 return 0; 550 551 if (!is_id_enabled((char *)key, state->base, SYM_ROLES)) 552 return 0; 553 554 bounds_val = state->rolemap[role->bounds - 1]; 555 556 dest = hashtab_search(state->out->p_roles.table, (char *)key); 557 if (!dest) { 558 ERR(state->handle, "Role lookup failed for %s", (char *)key); 559 return -1; 560 } 561 if (dest->bounds != 0 && dest->bounds != bounds_val) { 562 ERR(state->handle, "Inconsistent boundary for %s", (char *)key); 563 return -1; 564 } 565 dest->bounds = bounds_val; 566 567 return 0; 568 } 569 570 static int user_bounds_copy_callback(hashtab_key_t key, 571 hashtab_datum_t datum, void *data) 572 { 573 expand_state_t *state = (expand_state_t *) data; 574 user_datum_t *user = (user_datum_t *) datum; 575 user_datum_t *dest; 576 uint32_t bounds_val; 577 578 if (!user->bounds) 579 return 0; 580 581 if (!is_id_enabled((char *)key, state->base, SYM_USERS)) 582 return 0; 583 584 bounds_val = state->usermap[user->bounds - 1]; 585 586 dest = hashtab_search(state->out->p_users.table, (char *)key); 587 if (!dest) { 588 ERR(state->handle, "User lookup failed for %s", (char *)key); 589 return -1; 590 } 591 if (dest->bounds != 0 && dest->bounds != bounds_val) { 592 ERR(state->handle, "Inconsistent boundary for %s", (char *)key); 593 return -1; 594 } 595 dest->bounds = bounds_val; 596 597 return 0; 598 } 599 600 /* The aliases have to be copied after the types and attributes to be certain that 601 * the out symbol table will have the type that the alias refers. Otherwise, we 602 * won't be able to find the type value for the alias. We can't depend on the 603 * declaration ordering because of the hash table. 604 */ 605 static int alias_copy_callback(hashtab_key_t key, hashtab_datum_t datum, 606 void *data) 607 { 608 int ret; 609 char *id, *new_id; 610 type_datum_t *alias, *new_alias; 611 expand_state_t *state; 612 uint32_t prival; 613 614 id = (char *)key; 615 alias = (type_datum_t *) datum; 616 state = (expand_state_t *) data; 617 618 /* ignore regular types */ 619 if (alias->flavor == TYPE_TYPE && alias->primary) 620 return 0; 621 622 /* ignore attributes */ 623 if (alias->flavor == TYPE_ATTRIB) 624 return 0; 625 626 if (alias->flavor == TYPE_ALIAS) 627 prival = alias->primary; 628 else 629 prival = alias->s.value; 630 631 if (!is_id_enabled(state->base->p_type_val_to_name[prival - 1], 632 state->base, SYM_TYPES)) { 633 /* The primary type for this alias is not enabled, the alias 634 * shouldn't be either */ 635 return 0; 636 } 637 638 if (state->verbose) 639 INFO(state->handle, "copying alias %s", id); 640 641 new_id = strdup(id); 642 if (!new_id) { 643 ERR(state->handle, "Out of memory!"); 644 return -1; 645 } 646 647 new_alias = (type_datum_t *) malloc(sizeof(type_datum_t)); 648 if (!new_alias) { 649 ERR(state->handle, "Out of memory!"); 650 free(new_id); 651 return SEPOL_ENOMEM; 652 } 653 memset(new_alias, 0, sizeof(type_datum_t)); 654 if (alias->flavor == TYPE_TYPE) 655 new_alias->s.value = state->typemap[alias->s.value - 1]; 656 else if (alias->flavor == TYPE_ALIAS) 657 new_alias->s.value = state->typemap[alias->primary - 1]; 658 else 659 assert(0); /* unreachable */ 660 661 new_alias->flags = alias->flags; 662 663 ret = hashtab_insert(state->out->p_types.table, 664 (hashtab_key_t) new_id, 665 (hashtab_datum_t) new_alias); 666 667 if (ret) { 668 ERR(state->handle, "hashtab overflow"); 669 free(new_alias); 670 free(new_id); 671 return -1; 672 } 673 674 state->typemap[alias->s.value - 1] = new_alias->s.value; 675 676 if (new_alias->flags & TYPE_FLAGS_PERMISSIVE) 677 if (ebitmap_set_bit(&state->out->permissive_map, new_alias->s.value, 1)) { 678 ERR(state->handle, "Out of memory!"); 679 return -1; 680 } 681 682 return 0; 683 } 684 685 static int role_remap_dominates(hashtab_key_t key __attribute__ ((unused)), hashtab_datum_t datum, void *data) 686 { 687 ebitmap_t mapped_roles; 688 role_datum_t *role = (role_datum_t *) datum; 689 expand_state_t *state = (expand_state_t *) data; 690 691 if (map_ebitmap(&role->dominates, &mapped_roles, state->rolemap)) 692 return -1; 693 694 ebitmap_destroy(&role->dominates); 695 696 if (ebitmap_cpy(&role->dominates, &mapped_roles)) 697 return -1; 698 699 ebitmap_destroy(&mapped_roles); 700 701 return 0; 702 } 703 704 /* For the role attribute in the base module, escalate its counterpart's 705 * types.types ebitmap in the out module to the counterparts of all the 706 * regular role that belongs to the current role attribute. Note, must be 707 * invoked after role_copy_callback so that state->rolemap is available. 708 */ 709 static int role_fix_callback(hashtab_key_t key, hashtab_datum_t datum, 710 void *data) 711 { 712 char *id, *base_reg_role_id; 713 role_datum_t *role, *new_role, *regular_role; 714 expand_state_t *state; 715 ebitmap_node_t *rnode; 716 unsigned int i; 717 ebitmap_t mapped_roles; 718 719 id = key; 720 role = (role_datum_t *)datum; 721 state = (expand_state_t *)data; 722 723 if (strcmp(id, OBJECT_R) == 0) { 724 /* object_r is never a role attribute by far */ 725 return 0; 726 } 727 728 if (!is_id_enabled(id, state->base, SYM_ROLES)) { 729 /* identifier's scope is not enabled */ 730 return 0; 731 } 732 733 if (role->flavor != ROLE_ATTRIB) 734 return 0; 735 736 if (state->verbose) 737 INFO(state->handle, "fixing role attribute %s", id); 738 739 new_role = 740 (role_datum_t *)hashtab_search(state->out->p_roles.table, id); 741 742 assert(new_role != NULL && new_role->flavor == ROLE_ATTRIB); 743 744 ebitmap_init(&mapped_roles); 745 if (map_ebitmap(&role->roles, &mapped_roles, state->rolemap)) 746 return -1; 747 if (ebitmap_union(&new_role->roles, &mapped_roles)) { 748 ERR(state->handle, "Out of memory!"); 749 ebitmap_destroy(&mapped_roles); 750 return -1; 751 } 752 ebitmap_destroy(&mapped_roles); 753 754 ebitmap_for_each_bit(&role->roles, rnode, i) { 755 if (ebitmap_node_get_bit(rnode, i)) { 756 /* take advantage of sym_val_to_name[] 757 * of the base module */ 758 base_reg_role_id = state->base->p_role_val_to_name[i]; 759 regular_role = (role_datum_t *)hashtab_search( 760 state->out->p_roles.table, 761 base_reg_role_id); 762 assert(regular_role != NULL && 763 regular_role->flavor == ROLE_ROLE); 764 765 if (ebitmap_union(®ular_role->types.types, 766 &new_role->types.types)) { 767 ERR(state->handle, "Out of memory!"); 768 return -1; 769 } 770 } 771 } 772 773 return 0; 774 } 775 776 static int role_copy_callback(hashtab_key_t key, hashtab_datum_t datum, 777 void *data) 778 { 779 int ret; 780 char *id, *new_id; 781 role_datum_t *role; 782 role_datum_t *new_role; 783 expand_state_t *state; 784 ebitmap_t tmp_union_types; 785 786 id = key; 787 role = (role_datum_t *) datum; 788 state = (expand_state_t *) data; 789 790 if (strcmp(id, OBJECT_R) == 0) { 791 /* object_r is always value 1 */ 792 state->rolemap[role->s.value - 1] = 1; 793 return 0; 794 } 795 796 if (!is_id_enabled(id, state->base, SYM_ROLES)) { 797 /* identifier's scope is not enabled */ 798 return 0; 799 } 800 801 if (state->verbose) 802 INFO(state->handle, "copying role %s", id); 803 804 new_role = 805 (role_datum_t *) hashtab_search(state->out->p_roles.table, id); 806 if (!new_role) { 807 new_role = (role_datum_t *) malloc(sizeof(role_datum_t)); 808 if (!new_role) { 809 ERR(state->handle, "Out of memory!"); 810 return -1; 811 } 812 memset(new_role, 0, sizeof(role_datum_t)); 813 814 new_id = strdup(id); 815 if (!new_id) { 816 ERR(state->handle, "Out of memory!"); 817 free(new_role); 818 return -1; 819 } 820 821 state->out->p_roles.nprim++; 822 new_role->flavor = role->flavor; 823 new_role->s.value = state->out->p_roles.nprim; 824 state->rolemap[role->s.value - 1] = new_role->s.value; 825 ret = hashtab_insert(state->out->p_roles.table, 826 (hashtab_key_t) new_id, 827 (hashtab_datum_t) new_role); 828 829 if (ret) { 830 ERR(state->handle, "hashtab overflow"); 831 free(new_role); 832 free(new_id); 833 return -1; 834 } 835 } 836 837 /* The dominates bitmap is going to be wrong for the moment, 838 * we'll come back later and remap them, after we are sure all 839 * the roles have been added */ 840 if (ebitmap_union(&new_role->dominates, &role->dominates)) { 841 ERR(state->handle, "Out of memory!"); 842 return -1; 843 } 844 845 ebitmap_init(&tmp_union_types); 846 847 /* convert types in the role datum in the global symtab */ 848 if (expand_convert_type_set 849 (state->out, state->typemap, &role->types, &tmp_union_types, 1)) { 850 ebitmap_destroy(&tmp_union_types); 851 ERR(state->handle, "Out of memory!"); 852 return -1; 853 } 854 855 if (ebitmap_union(&new_role->types.types, &tmp_union_types)) { 856 ERR(state->handle, "Out of memory!"); 857 ebitmap_destroy(&tmp_union_types); 858 return -1; 859 } 860 ebitmap_destroy(&tmp_union_types); 861 862 return 0; 863 } 864 865 int mls_semantic_level_expand(mls_semantic_level_t * sl, mls_level_t * l, 866 policydb_t * p, sepol_handle_t * h) 867 { 868 mls_semantic_cat_t *cat; 869 level_datum_t *levdatum; 870 unsigned int i; 871 872 mls_level_init(l); 873 874 if (!p->mls) 875 return 0; 876 877 /* Required not declared. */ 878 if (!sl->sens) 879 return 0; 880 881 l->sens = sl->sens; 882 levdatum = (level_datum_t *) hashtab_search(p->p_levels.table, 883 p->p_sens_val_to_name[l-> 884 sens - 885 1]); 886 for (cat = sl->cat; cat; cat = cat->next) { 887 if (cat->low > cat->high) { 888 ERR(h, "Category range is not valid %s.%s", 889 p->p_cat_val_to_name[cat->low - 1], 890 p->p_cat_val_to_name[cat->high - 1]); 891 return -1; 892 } 893 for (i = cat->low - 1; i < cat->high; i++) { 894 if (!ebitmap_get_bit(&levdatum->level->cat, i)) { 895 ERR(h, "Category %s can not be associate with " 896 "level %s", 897 p->p_cat_val_to_name[i], 898 p->p_sens_val_to_name[l->sens - 1]); 899 } 900 if (ebitmap_set_bit(&l->cat, i, 1)) { 901 ERR(h, "Out of memory!"); 902 return -1; 903 } 904 } 905 } 906 907 return 0; 908 } 909 910 int mls_semantic_range_expand(mls_semantic_range_t * sr, mls_range_t * r, 911 policydb_t * p, sepol_handle_t * h) 912 { 913 if (mls_semantic_level_expand(&sr->level[0], &r->level[0], p, h) < 0) 914 return -1; 915 916 if (mls_semantic_level_expand(&sr->level[1], &r->level[1], p, h) < 0) { 917 mls_semantic_level_destroy(&sr->level[0]); 918 return -1; 919 } 920 921 if (!mls_level_dom(&r->level[1], &r->level[0])) { 922 mls_range_destroy(r); 923 ERR(h, "MLS range high level does not dominate low level"); 924 return -1; 925 } 926 927 return 0; 928 } 929 930 static int user_copy_callback(hashtab_key_t key, hashtab_datum_t datum, 931 void *data) 932 { 933 int ret; 934 expand_state_t *state; 935 user_datum_t *user; 936 user_datum_t *new_user; 937 char *id, *new_id; 938 ebitmap_t tmp_union; 939 940 id = key; 941 user = (user_datum_t *) datum; 942 state = (expand_state_t *) data; 943 944 if (!is_id_enabled(id, state->base, SYM_USERS)) { 945 /* identifier's scope is not enabled */ 946 return 0; 947 } 948 949 if (state->verbose) 950 INFO(state->handle, "copying user %s", id); 951 952 new_user = 953 (user_datum_t *) hashtab_search(state->out->p_users.table, id); 954 if (!new_user) { 955 new_user = (user_datum_t *) malloc(sizeof(user_datum_t)); 956 if (!new_user) { 957 ERR(state->handle, "Out of memory!"); 958 return -1; 959 } 960 memset(new_user, 0, sizeof(user_datum_t)); 961 962 state->out->p_users.nprim++; 963 new_user->s.value = state->out->p_users.nprim; 964 state->usermap[user->s.value - 1] = new_user->s.value; 965 966 new_id = strdup(id); 967 if (!new_id) { 968 ERR(state->handle, "Out of memory!"); 969 free(new_user); 970 return -1; 971 } 972 ret = hashtab_insert(state->out->p_users.table, 973 (hashtab_key_t) new_id, 974 (hashtab_datum_t) new_user); 975 if (ret) { 976 ERR(state->handle, "hashtab overflow"); 977 user_datum_destroy(new_user); 978 free(new_user); 979 free(new_id); 980 return -1; 981 } 982 983 /* expand the semantic MLS info */ 984 if (mls_semantic_range_expand(&user->range, 985 &new_user->exp_range, 986 state->out, state->handle)) { 987 return -1; 988 } 989 if (mls_semantic_level_expand(&user->dfltlevel, 990 &new_user->exp_dfltlevel, 991 state->out, state->handle)) { 992 return -1; 993 } 994 if (!mls_level_between(&new_user->exp_dfltlevel, 995 &new_user->exp_range.level[0], 996 &new_user->exp_range.level[1])) { 997 ERR(state->handle, "default level not within user " 998 "range"); 999 return -1; 1000 } 1001 } else { 1002 /* require that the MLS info match */ 1003 mls_range_t tmp_range; 1004 mls_level_t tmp_level; 1005 1006 if (mls_semantic_range_expand(&user->range, &tmp_range, 1007 state->out, state->handle)) { 1008 return -1; 1009 } 1010 if (mls_semantic_level_expand(&user->dfltlevel, &tmp_level, 1011 state->out, state->handle)) { 1012 mls_range_destroy(&tmp_range); 1013 return -1; 1014 } 1015 if (!mls_range_eq(&new_user->exp_range, &tmp_range) || 1016 !mls_level_eq(&new_user->exp_dfltlevel, &tmp_level)) { 1017 mls_range_destroy(&tmp_range); 1018 mls_level_destroy(&tmp_level); 1019 return -1; 1020 } 1021 mls_range_destroy(&tmp_range); 1022 mls_level_destroy(&tmp_level); 1023 } 1024 1025 ebitmap_init(&tmp_union); 1026 1027 /* get global roles for this user */ 1028 if (role_set_expand(&user->roles, &tmp_union, state->out, state->base, state->rolemap)) { 1029 ERR(state->handle, "Out of memory!"); 1030 ebitmap_destroy(&tmp_union); 1031 return -1; 1032 } 1033 1034 if (ebitmap_union(&new_user->roles.roles, &tmp_union)) { 1035 ERR(state->handle, "Out of memory!"); 1036 ebitmap_destroy(&tmp_union); 1037 return -1; 1038 } 1039 ebitmap_destroy(&tmp_union); 1040 1041 return 0; 1042 } 1043 1044 static int bool_copy_callback(hashtab_key_t key, hashtab_datum_t datum, 1045 void *data) 1046 { 1047 int ret; 1048 expand_state_t *state; 1049 cond_bool_datum_t *bool, *new_bool; 1050 char *id, *new_id; 1051 1052 id = key; 1053 bool = (cond_bool_datum_t *) datum; 1054 state = (expand_state_t *) data; 1055 1056 if (!is_id_enabled(id, state->base, SYM_BOOLS)) { 1057 /* identifier's scope is not enabled */ 1058 return 0; 1059 } 1060 1061 if (bool->flags & COND_BOOL_FLAGS_TUNABLE) { 1062 /* Skip tunables */ 1063 return 0; 1064 } 1065 1066 if (state->verbose) 1067 INFO(state->handle, "copying boolean %s", id); 1068 1069 new_bool = (cond_bool_datum_t *) malloc(sizeof(cond_bool_datum_t)); 1070 if (!new_bool) { 1071 ERR(state->handle, "Out of memory!"); 1072 return -1; 1073 } 1074 1075 new_id = strdup(id); 1076 if (!new_id) { 1077 ERR(state->handle, "Out of memory!"); 1078 free(new_bool); 1079 return -1; 1080 } 1081 1082 state->out->p_bools.nprim++; 1083 new_bool->s.value = state->out->p_bools.nprim; 1084 1085 ret = hashtab_insert(state->out->p_bools.table, 1086 (hashtab_key_t) new_id, 1087 (hashtab_datum_t) new_bool); 1088 if (ret) { 1089 ERR(state->handle, "hashtab overflow"); 1090 free(new_bool); 1091 free(new_id); 1092 return -1; 1093 } 1094 1095 state->boolmap[bool->s.value - 1] = new_bool->s.value; 1096 1097 new_bool->state = bool->state; 1098 new_bool->flags = bool->flags; 1099 1100 return 0; 1101 } 1102 1103 static int sens_copy_callback(hashtab_key_t key, hashtab_datum_t datum, 1104 void *data) 1105 { 1106 expand_state_t *state = (expand_state_t *) data; 1107 level_datum_t *level = (level_datum_t *) datum, *new_level = NULL; 1108 char *id = (char *)key, *new_id = NULL; 1109 1110 if (!is_id_enabled(id, state->base, SYM_LEVELS)) { 1111 /* identifier's scope is not enabled */ 1112 return 0; 1113 } 1114 1115 if (state->verbose) 1116 INFO(state->handle, "copying sensitivity level %s", id); 1117 1118 new_level = (level_datum_t *) malloc(sizeof(level_datum_t)); 1119 if (!new_level) 1120 goto out_of_mem; 1121 level_datum_init(new_level); 1122 new_level->level = (mls_level_t *) malloc(sizeof(mls_level_t)); 1123 if (!new_level->level) 1124 goto out_of_mem; 1125 mls_level_init(new_level->level); 1126 new_id = strdup(id); 1127 if (!new_id) 1128 goto out_of_mem; 1129 1130 if (mls_level_cpy(new_level->level, level->level)) { 1131 goto out_of_mem; 1132 } 1133 new_level->isalias = level->isalias; 1134 state->out->p_levels.nprim++; 1135 1136 if (hashtab_insert(state->out->p_levels.table, 1137 (hashtab_key_t) new_id, 1138 (hashtab_datum_t) new_level)) { 1139 goto out_of_mem; 1140 } 1141 return 0; 1142 1143 out_of_mem: 1144 ERR(state->handle, "Out of memory!"); 1145 if (new_level != NULL && new_level->level != NULL) { 1146 mls_level_destroy(new_level->level); 1147 free(new_level->level); 1148 } 1149 level_datum_destroy(new_level); 1150 free(new_level); 1151 free(new_id); 1152 return -1; 1153 } 1154 1155 static int cats_copy_callback(hashtab_key_t key, hashtab_datum_t datum, 1156 void *data) 1157 { 1158 expand_state_t *state = (expand_state_t *) data; 1159 cat_datum_t *cat = (cat_datum_t *) datum, *new_cat = NULL; 1160 char *id = (char *)key, *new_id = NULL; 1161 1162 if (!is_id_enabled(id, state->base, SYM_CATS)) { 1163 /* identifier's scope is not enabled */ 1164 return 0; 1165 } 1166 1167 if (state->verbose) 1168 INFO(state->handle, "copying category attribute %s", id); 1169 1170 new_cat = (cat_datum_t *) malloc(sizeof(cat_datum_t)); 1171 if (!new_cat) 1172 goto out_of_mem; 1173 cat_datum_init(new_cat); 1174 new_id = strdup(id); 1175 if (!new_id) 1176 goto out_of_mem; 1177 1178 new_cat->s.value = cat->s.value; 1179 new_cat->isalias = cat->isalias; 1180 state->out->p_cats.nprim++; 1181 if (hashtab_insert(state->out->p_cats.table, 1182 (hashtab_key_t) new_id, (hashtab_datum_t) new_cat)) { 1183 goto out_of_mem; 1184 } 1185 1186 return 0; 1187 1188 out_of_mem: 1189 ERR(state->handle, "Out of memory!"); 1190 cat_datum_destroy(new_cat); 1191 free(new_cat); 1192 free(new_id); 1193 return -1; 1194 } 1195 1196 static int copy_role_allows(expand_state_t * state, role_allow_rule_t * rules) 1197 { 1198 unsigned int i, j; 1199 role_allow_t *cur_allow, *n, *l; 1200 role_allow_rule_t *cur; 1201 ebitmap_t roles, new_roles; 1202 ebitmap_node_t *snode, *tnode; 1203 1204 /* start at the end of the list */ 1205 for (l = state->out->role_allow; l && l->next; l = l->next) ; 1206 1207 cur = rules; 1208 while (cur) { 1209 ebitmap_init(&roles); 1210 ebitmap_init(&new_roles); 1211 1212 if (role_set_expand(&cur->roles, &roles, state->out, state->base, state->rolemap)) { 1213 ERR(state->handle, "Out of memory!"); 1214 return -1; 1215 } 1216 1217 if (role_set_expand(&cur->new_roles, &new_roles, state->out, state->base, state->rolemap)) { 1218 ERR(state->handle, "Out of memory!"); 1219 return -1; 1220 } 1221 1222 ebitmap_for_each_bit(&roles, snode, i) { 1223 if (!ebitmap_node_get_bit(snode, i)) 1224 continue; 1225 ebitmap_for_each_bit(&new_roles, tnode, j) { 1226 if (!ebitmap_node_get_bit(tnode, j)) 1227 continue; 1228 /* check for duplicates */ 1229 cur_allow = state->out->role_allow; 1230 while (cur_allow) { 1231 if ((cur_allow->role == i + 1) && 1232 (cur_allow->new_role == j + 1)) 1233 break; 1234 cur_allow = cur_allow->next; 1235 } 1236 if (cur_allow) 1237 continue; 1238 n = (role_allow_t *) 1239 malloc(sizeof(role_allow_t)); 1240 if (!n) { 1241 ERR(state->handle, "Out of memory!"); 1242 return -1; 1243 } 1244 memset(n, 0, sizeof(role_allow_t)); 1245 n->role = i + 1; 1246 n->new_role = j + 1; 1247 if (l) { 1248 l->next = n; 1249 } else { 1250 state->out->role_allow = n; 1251 } 1252 l = n; 1253 } 1254 } 1255 1256 ebitmap_destroy(&roles); 1257 ebitmap_destroy(&new_roles); 1258 1259 cur = cur->next; 1260 } 1261 1262 return 0; 1263 } 1264 1265 static int copy_role_trans(expand_state_t * state, role_trans_rule_t * rules) 1266 { 1267 unsigned int i, j, k; 1268 role_trans_t *n, *l, *cur_trans; 1269 role_trans_rule_t *cur; 1270 ebitmap_t roles, types; 1271 ebitmap_node_t *rnode, *tnode, *cnode; 1272 1273 /* start at the end of the list */ 1274 for (l = state->out->role_tr; l && l->next; l = l->next) ; 1275 1276 cur = rules; 1277 while (cur) { 1278 ebitmap_init(&roles); 1279 ebitmap_init(&types); 1280 1281 if (role_set_expand(&cur->roles, &roles, state->out, state->base, state->rolemap)) { 1282 ERR(state->handle, "Out of memory!"); 1283 return -1; 1284 } 1285 if (expand_convert_type_set 1286 (state->out, state->typemap, &cur->types, &types, 1)) { 1287 ERR(state->handle, "Out of memory!"); 1288 return -1; 1289 } 1290 ebitmap_for_each_bit(&roles, rnode, i) { 1291 if (!ebitmap_node_get_bit(rnode, i)) 1292 continue; 1293 ebitmap_for_each_bit(&types, tnode, j) { 1294 if (!ebitmap_node_get_bit(tnode, j)) 1295 continue; 1296 ebitmap_for_each_bit(&cur->classes, cnode, k) { 1297 if (!ebitmap_node_get_bit(cnode, k)) 1298 continue; 1299 1300 cur_trans = state->out->role_tr; 1301 while (cur_trans) { 1302 unsigned int mapped_role; 1303 1304 mapped_role = state->rolemap[cur->new_role - 1]; 1305 1306 if ((cur_trans->role == 1307 i + 1) && 1308 (cur_trans->type == 1309 j + 1) && 1310 (cur_trans->tclass == 1311 k + 1)) { 1312 if (cur_trans->new_role == mapped_role) { 1313 break; 1314 } else { 1315 ERR(state->handle, 1316 "Conflicting role trans rule %s %s : %s { %s vs %s }", 1317 state->out->p_role_val_to_name[i], 1318 state->out->p_type_val_to_name[j], 1319 state->out->p_class_val_to_name[k], 1320 state->out->p_role_val_to_name[mapped_role - 1], 1321 state->out->p_role_val_to_name[cur_trans->new_role - 1]); 1322 return -1; 1323 } 1324 } 1325 cur_trans = cur_trans->next; 1326 } 1327 if (cur_trans) 1328 continue; 1329 1330 n = (role_trans_t *) 1331 malloc(sizeof(role_trans_t)); 1332 if (!n) { 1333 ERR(state->handle, 1334 "Out of memory!"); 1335 return -1; 1336 } 1337 memset(n, 0, sizeof(role_trans_t)); 1338 n->role = i + 1; 1339 n->type = j + 1; 1340 n->tclass = k + 1; 1341 n->new_role = state->rolemap 1342 [cur->new_role - 1]; 1343 if (l) 1344 l->next = n; 1345 else 1346 state->out->role_tr = n; 1347 1348 l = n; 1349 } 1350 } 1351 } 1352 1353 ebitmap_destroy(&roles); 1354 ebitmap_destroy(&types); 1355 1356 cur = cur->next; 1357 } 1358 return 0; 1359 } 1360 1361 static int expand_filename_trans(expand_state_t *state, filename_trans_rule_t *rules) 1362 { 1363 unsigned int i, j; 1364 filename_trans_t *new_trans, *cur_trans; 1365 filename_trans_rule_t *cur_rule; 1366 ebitmap_t stypes, ttypes; 1367 ebitmap_node_t *snode, *tnode; 1368 1369 cur_rule = rules; 1370 while (cur_rule) { 1371 uint32_t mapped_otype; 1372 1373 ebitmap_init(&stypes); 1374 ebitmap_init(&ttypes); 1375 1376 if (expand_convert_type_set(state->out, state->typemap, 1377 &cur_rule->stypes, &stypes, 1)) { 1378 ERR(state->handle, "Out of memory!"); 1379 return -1; 1380 } 1381 1382 if (expand_convert_type_set(state->out, state->typemap, 1383 &cur_rule->ttypes, &ttypes, 1)) { 1384 ERR(state->handle, "Out of memory!"); 1385 return -1; 1386 } 1387 1388 mapped_otype = state->typemap[cur_rule->otype - 1]; 1389 1390 ebitmap_for_each_bit(&stypes, snode, i) { 1391 if (!ebitmap_node_get_bit(snode, i)) 1392 continue; 1393 ebitmap_for_each_bit(&ttypes, tnode, j) { 1394 if (!ebitmap_node_get_bit(tnode, j)) 1395 continue; 1396 1397 cur_trans = state->out->filename_trans; 1398 while (cur_trans) { 1399 if ((cur_trans->stype == i + 1) && 1400 (cur_trans->ttype == j + 1) && 1401 (cur_trans->tclass == cur_rule->tclass) && 1402 (!strcmp(cur_trans->name, cur_rule->name))) { 1403 /* duplicate rule, who cares */ 1404 if (cur_trans->otype == mapped_otype) 1405 break; 1406 1407 ERR(state->handle, "Conflicting filename trans rules %s %s %s : %s otype1:%s otype2:%s", 1408 cur_trans->name, 1409 state->out->p_type_val_to_name[i], 1410 state->out->p_type_val_to_name[j], 1411 state->out->p_class_val_to_name[cur_trans->tclass - 1], 1412 state->out->p_type_val_to_name[cur_trans->otype - 1], 1413 state->out->p_type_val_to_name[mapped_otype - 1]); 1414 1415 return -1; 1416 } 1417 cur_trans = cur_trans->next; 1418 } 1419 /* duplicate rule, who cares */ 1420 if (cur_trans) 1421 continue; 1422 1423 new_trans = malloc(sizeof(*new_trans)); 1424 if (!new_trans) { 1425 ERR(state->handle, "Out of memory!"); 1426 return -1; 1427 } 1428 memset(new_trans, 0, sizeof(*new_trans)); 1429 new_trans->next = state->out->filename_trans; 1430 state->out->filename_trans = new_trans; 1431 1432 new_trans->name = strdup(cur_rule->name); 1433 if (!new_trans->name) { 1434 ERR(state->handle, "Out of memory!"); 1435 return -1; 1436 } 1437 new_trans->stype = i + 1; 1438 new_trans->ttype = j + 1; 1439 new_trans->tclass = cur_rule->tclass; 1440 new_trans->otype = mapped_otype; 1441 } 1442 } 1443 1444 ebitmap_destroy(&stypes); 1445 ebitmap_destroy(&ttypes); 1446 1447 cur_rule = cur_rule->next; 1448 } 1449 return 0; 1450 } 1451 1452 static int exp_rangetr_helper(uint32_t stype, uint32_t ttype, uint32_t tclass, 1453 mls_semantic_range_t * trange, 1454 expand_state_t * state) 1455 { 1456 range_trans_t *rt, *check_rt = state->out->range_tr; 1457 mls_range_t exp_range; 1458 int rc = -1; 1459 1460 if (mls_semantic_range_expand(trange, &exp_range, state->out, 1461 state->handle)) 1462 goto out; 1463 1464 /* check for duplicates/conflicts */ 1465 while (check_rt) { 1466 if ((check_rt->source_type == stype) && 1467 (check_rt->target_type == ttype) && 1468 (check_rt->target_class == tclass)) { 1469 if (mls_range_eq(&check_rt->target_range, &exp_range)) { 1470 /* duplicate */ 1471 break; 1472 } else { 1473 /* conflict */ 1474 ERR(state->handle, 1475 "Conflicting range trans rule %s %s : %s", 1476 state->out->p_type_val_to_name[stype - 1], 1477 state->out->p_type_val_to_name[ttype - 1], 1478 state->out->p_class_val_to_name[tclass - 1479 1]); 1480 goto out; 1481 } 1482 } 1483 check_rt = check_rt->next; 1484 } 1485 if (check_rt) { 1486 /* this is a dup - skip */ 1487 rc = 0; 1488 goto out; 1489 } 1490 1491 rt = (range_trans_t *) calloc(1, sizeof(range_trans_t)); 1492 if (!rt) { 1493 ERR(state->handle, "Out of memory!"); 1494 goto out; 1495 } 1496 1497 rt->next = state->out->range_tr; 1498 state->out->range_tr = rt; 1499 1500 rt->source_type = stype; 1501 rt->target_type = ttype; 1502 rt->target_class = tclass; 1503 if (mls_range_cpy(&rt->target_range, &exp_range)) { 1504 ERR(state->handle, "Out of memory!"); 1505 goto out; 1506 } 1507 1508 rc = 0; 1509 1510 out: 1511 mls_range_destroy(&exp_range); 1512 return rc; 1513 } 1514 1515 static int expand_range_trans(expand_state_t * state, 1516 range_trans_rule_t * rules) 1517 { 1518 unsigned int i, j, k; 1519 range_trans_rule_t *rule; 1520 1521 ebitmap_t stypes, ttypes; 1522 ebitmap_node_t *snode, *tnode, *cnode; 1523 1524 if (state->verbose) 1525 INFO(state->handle, "expanding range transitions"); 1526 1527 for (rule = rules; rule; rule = rule->next) { 1528 ebitmap_init(&stypes); 1529 ebitmap_init(&ttypes); 1530 1531 /* expand the type sets */ 1532 if (expand_convert_type_set(state->out, state->typemap, 1533 &rule->stypes, &stypes, 1)) { 1534 ERR(state->handle, "Out of memory!"); 1535 return -1; 1536 } 1537 if (expand_convert_type_set(state->out, state->typemap, 1538 &rule->ttypes, &ttypes, 1)) { 1539 ebitmap_destroy(&stypes); 1540 ERR(state->handle, "Out of memory!"); 1541 return -1; 1542 } 1543 1544 /* loop on source type */ 1545 ebitmap_for_each_bit(&stypes, snode, i) { 1546 if (!ebitmap_node_get_bit(snode, i)) 1547 continue; 1548 /* loop on target type */ 1549 ebitmap_for_each_bit(&ttypes, tnode, j) { 1550 if (!ebitmap_node_get_bit(tnode, j)) 1551 continue; 1552 /* loop on target class */ 1553 ebitmap_for_each_bit(&rule->tclasses, cnode, k) { 1554 if (!ebitmap_node_get_bit(cnode, k)) 1555 continue; 1556 1557 if (exp_rangetr_helper(i + 1, 1558 j + 1, 1559 k + 1, 1560 &rule->trange, 1561 state)) { 1562 ebitmap_destroy(&stypes); 1563 ebitmap_destroy(&ttypes); 1564 return -1; 1565 } 1566 } 1567 } 1568 } 1569 1570 ebitmap_destroy(&stypes); 1571 ebitmap_destroy(&ttypes); 1572 } 1573 1574 return 0; 1575 } 1576 1577 /* Search for an AV tab node within a hash table with the given key. 1578 * If the node does not exist, create it and return it; otherwise 1579 * return the pre-existing one. 1580 */ 1581 static avtab_ptr_t find_avtab_node(sepol_handle_t * handle, 1582 avtab_t * avtab, avtab_key_t * key, 1583 cond_av_list_t ** cond) 1584 { 1585 avtab_ptr_t node; 1586 avtab_datum_t avdatum; 1587 cond_av_list_t *nl; 1588 1589 node = avtab_search_node(avtab, key); 1590 1591 /* If this is for conditional policies, keep searching in case 1592 the node is part of my conditional avtab. */ 1593 if (cond) { 1594 while (node) { 1595 if (node->parse_context == cond) 1596 break; 1597 node = avtab_search_node_next(node, key->specified); 1598 } 1599 } 1600 1601 if (!node) { 1602 memset(&avdatum, 0, sizeof avdatum); 1603 /* this is used to get the node - insertion is actually unique */ 1604 node = avtab_insert_nonunique(avtab, key, &avdatum); 1605 if (!node) { 1606 ERR(handle, "hash table overflow"); 1607 return NULL; 1608 } 1609 if (cond) { 1610 node->parse_context = cond; 1611 nl = (cond_av_list_t *) malloc(sizeof(cond_av_list_t)); 1612 if (!nl) { 1613 ERR(handle, "Memory error"); 1614 return NULL; 1615 } 1616 memset(nl, 0, sizeof(cond_av_list_t)); 1617 nl->node = node; 1618 nl->next = *cond; 1619 *cond = nl; 1620 } 1621 } 1622 1623 return node; 1624 } 1625 1626 #define EXPAND_RULE_SUCCESS 1 1627 #define EXPAND_RULE_CONFLICT 0 1628 #define EXPAND_RULE_ERROR -1 1629 1630 static int expand_terule_helper(sepol_handle_t * handle, 1631 policydb_t * p, uint32_t * typemap, 1632 uint32_t specified, cond_av_list_t ** cond, 1633 cond_av_list_t ** other, uint32_t stype, 1634 uint32_t ttype, class_perm_node_t * perms, 1635 avtab_t * avtab, int enabled) 1636 { 1637 avtab_key_t avkey; 1638 avtab_datum_t *avdatump; 1639 avtab_ptr_t node; 1640 class_perm_node_t *cur; 1641 int conflict; 1642 uint32_t oldtype = 0, spec = 0; 1643 1644 if (specified & AVRULE_TRANSITION) { 1645 spec = AVTAB_TRANSITION; 1646 } else if (specified & AVRULE_MEMBER) { 1647 spec = AVTAB_MEMBER; 1648 } else if (specified & AVRULE_CHANGE) { 1649 spec = AVTAB_CHANGE; 1650 } else { 1651 assert(0); /* unreachable */ 1652 } 1653 1654 cur = perms; 1655 while (cur) { 1656 uint32_t remapped_data = 1657 typemap ? typemap[cur->data - 1] : cur->data; 1658 avkey.source_type = stype + 1; 1659 avkey.target_type = ttype + 1; 1660 avkey.target_class = cur->class; 1661 avkey.specified = spec; 1662 1663 conflict = 0; 1664 /* check to see if the expanded TE already exists -- 1665 * either in the global scope or in another 1666 * conditional AV tab */ 1667 node = avtab_search_node(&p->te_avtab, &avkey); 1668 if (node) { 1669 conflict = 1; 1670 } else { 1671 node = avtab_search_node(&p->te_cond_avtab, &avkey); 1672 if (node && node->parse_context != other) { 1673 conflict = 2; 1674 } 1675 } 1676 1677 if (conflict) { 1678 avdatump = &node->datum; 1679 if (specified & AVRULE_TRANSITION) { 1680 oldtype = avdatump->data; 1681 } else if (specified & AVRULE_MEMBER) { 1682 oldtype = avdatump->data; 1683 } else if (specified & AVRULE_CHANGE) { 1684 oldtype = avdatump->data; 1685 } 1686 1687 if (oldtype == remapped_data) { 1688 /* if the duplicate is inside the same scope (eg., unconditional 1689 * or in same conditional then ignore it */ 1690 if ((conflict == 1 && cond == NULL) 1691 || node->parse_context == cond) 1692 return EXPAND_RULE_SUCCESS; 1693 ERR(handle, "duplicate TE rule for %s %s:%s %s", 1694 p->p_type_val_to_name[avkey.source_type - 1695 1], 1696 p->p_type_val_to_name[avkey.target_type - 1697 1], 1698 p->p_class_val_to_name[avkey.target_class - 1699 1], 1700 p->p_type_val_to_name[oldtype - 1]); 1701 return EXPAND_RULE_CONFLICT; 1702 } 1703 ERR(handle, 1704 "conflicting TE rule for (%s, %s:%s): old was %s, new is %s", 1705 p->p_type_val_to_name[avkey.source_type - 1], 1706 p->p_type_val_to_name[avkey.target_type - 1], 1707 p->p_class_val_to_name[avkey.target_class - 1], 1708 p->p_type_val_to_name[oldtype - 1], 1709 p->p_type_val_to_name[remapped_data - 1]); 1710 return EXPAND_RULE_CONFLICT; 1711 } 1712 1713 node = find_avtab_node(handle, avtab, &avkey, cond); 1714 if (!node) 1715 return -1; 1716 if (enabled) { 1717 node->key.specified |= AVTAB_ENABLED; 1718 } else { 1719 node->key.specified &= ~AVTAB_ENABLED; 1720 } 1721 1722 avdatump = &node->datum; 1723 if (specified & AVRULE_TRANSITION) { 1724 avdatump->data = remapped_data; 1725 } else if (specified & AVRULE_MEMBER) { 1726 avdatump->data = remapped_data; 1727 } else if (specified & AVRULE_CHANGE) { 1728 avdatump->data = remapped_data; 1729 } else { 1730 assert(0); /* should never occur */ 1731 } 1732 1733 cur = cur->next; 1734 } 1735 1736 return EXPAND_RULE_SUCCESS; 1737 } 1738 1739 static int expand_avrule_helper(sepol_handle_t * handle, 1740 uint32_t specified, 1741 cond_av_list_t ** cond, 1742 uint32_t stype, uint32_t ttype, 1743 class_perm_node_t * perms, avtab_t * avtab, 1744 int enabled) 1745 { 1746 avtab_key_t avkey; 1747 avtab_datum_t *avdatump; 1748 avtab_ptr_t node; 1749 class_perm_node_t *cur; 1750 uint32_t spec = 0; 1751 1752 if (specified & AVRULE_ALLOWED) { 1753 spec = AVTAB_ALLOWED; 1754 } else if (specified & AVRULE_AUDITALLOW) { 1755 spec = AVTAB_AUDITALLOW; 1756 } else if (specified & AVRULE_AUDITDENY) { 1757 spec = AVTAB_AUDITDENY; 1758 } else if (specified & AVRULE_DONTAUDIT) { 1759 if (handle && handle->disable_dontaudit) 1760 return EXPAND_RULE_SUCCESS; 1761 spec = AVTAB_AUDITDENY; 1762 } else if (specified & AVRULE_NEVERALLOW) { 1763 spec = AVTAB_NEVERALLOW; 1764 } else { 1765 assert(0); /* unreachable */ 1766 } 1767 1768 cur = perms; 1769 while (cur) { 1770 avkey.source_type = stype + 1; 1771 avkey.target_type = ttype + 1; 1772 avkey.target_class = cur->class; 1773 avkey.specified = spec; 1774 1775 node = find_avtab_node(handle, avtab, &avkey, cond); 1776 if (!node) 1777 return EXPAND_RULE_ERROR; 1778 if (enabled) { 1779 node->key.specified |= AVTAB_ENABLED; 1780 } else { 1781 node->key.specified &= ~AVTAB_ENABLED; 1782 } 1783 1784 avdatump = &node->datum; 1785 if (specified & AVRULE_ALLOWED) { 1786 avdatump->data |= cur->data; 1787 } else if (specified & AVRULE_AUDITALLOW) { 1788 avdatump->data |= cur->data; 1789 } else if (specified & AVRULE_NEVERALLOW) { 1790 avdatump->data |= cur->data; 1791 } else if (specified & AVRULE_AUDITDENY) { 1792 /* Since a '0' in an auditdeny mask represents 1793 * a permission we do NOT want to audit 1794 * (dontaudit), we use the '&' operand to 1795 * ensure that all '0's in the mask are 1796 * retained (much unlike the allow and 1797 * auditallow cases). 1798 */ 1799 avdatump->data &= cur->data; 1800 } else if (specified & AVRULE_DONTAUDIT) { 1801 if (avdatump->data) 1802 avdatump->data &= ~cur->data; 1803 else 1804 avdatump->data = ~cur->data; 1805 } else { 1806 assert(0); /* should never occur */ 1807 } 1808 1809 cur = cur->next; 1810 } 1811 return EXPAND_RULE_SUCCESS; 1812 } 1813 1814 static int expand_rule_helper(sepol_handle_t * handle, 1815 policydb_t * p, uint32_t * typemap, 1816 avrule_t * source_rule, avtab_t * dest_avtab, 1817 cond_av_list_t ** cond, cond_av_list_t ** other, 1818 int enabled, 1819 ebitmap_t * stypes, ebitmap_t * ttypes) 1820 { 1821 unsigned int i, j; 1822 int retval; 1823 ebitmap_node_t *snode, *tnode; 1824 1825 ebitmap_for_each_bit(stypes, snode, i) { 1826 if (!ebitmap_node_get_bit(snode, i)) 1827 continue; 1828 if (source_rule->flags & RULE_SELF) { 1829 if (source_rule->specified & AVRULE_AV) { 1830 retval = expand_avrule_helper(handle, source_rule->specified, 1831 cond, i, i, source_rule->perms, 1832 dest_avtab, enabled); 1833 if (retval != EXPAND_RULE_SUCCESS) 1834 return retval; 1835 } else { 1836 retval = expand_terule_helper(handle, p, typemap, 1837 source_rule->specified, cond, 1838 other, i, i, source_rule->perms, 1839 dest_avtab, enabled); 1840 if (retval != EXPAND_RULE_SUCCESS) 1841 return retval; 1842 } 1843 } 1844 ebitmap_for_each_bit(ttypes, tnode, j) { 1845 if (!ebitmap_node_get_bit(tnode, j)) 1846 continue; 1847 if (source_rule->specified & AVRULE_AV) { 1848 retval = expand_avrule_helper(handle, source_rule->specified, 1849 cond, i, j, source_rule->perms, 1850 dest_avtab, enabled); 1851 if (retval != EXPAND_RULE_SUCCESS) 1852 return retval; 1853 } else { 1854 retval = expand_terule_helper(handle, p, typemap, 1855 source_rule->specified, cond, 1856 other, i, j, source_rule->perms, 1857 dest_avtab, enabled); 1858 if (retval != EXPAND_RULE_SUCCESS) 1859 return retval; 1860 } 1861 } 1862 } 1863 1864 return EXPAND_RULE_SUCCESS; 1865 } 1866 1867 /* 1868 * Expand a rule into a given avtab - checking for conflicting type 1869 * rules in the destination policy. Return EXPAND_RULE_SUCCESS on 1870 * success, EXPAND_RULE_CONFLICT if the rule conflicts with something 1871 * (and hence was not added), or EXPAND_RULE_ERROR on error. 1872 */ 1873 static int convert_and_expand_rule(sepol_handle_t * handle, 1874 policydb_t * dest_pol, uint32_t * typemap, 1875 avrule_t * source_rule, avtab_t * dest_avtab, 1876 cond_av_list_t ** cond, 1877 cond_av_list_t ** other, int enabled, 1878 int do_neverallow) 1879 { 1880 int retval; 1881 ebitmap_t stypes, ttypes; 1882 unsigned char alwaysexpand; 1883 1884 if (!do_neverallow && source_rule->specified & AVRULE_NEVERALLOW) 1885 return EXPAND_RULE_SUCCESS; 1886 1887 ebitmap_init(&stypes); 1888 ebitmap_init(&ttypes); 1889 1890 /* Force expansion for type rules and for self rules. */ 1891 alwaysexpand = ((source_rule->specified & AVRULE_TYPE) || 1892 (source_rule->flags & RULE_SELF)); 1893 1894 if (expand_convert_type_set 1895 (dest_pol, typemap, &source_rule->stypes, &stypes, alwaysexpand)) 1896 return EXPAND_RULE_ERROR; 1897 if (expand_convert_type_set 1898 (dest_pol, typemap, &source_rule->ttypes, &ttypes, alwaysexpand)) 1899 return EXPAND_RULE_ERROR; 1900 1901 retval = expand_rule_helper(handle, dest_pol, typemap, 1902 source_rule, dest_avtab, 1903 cond, other, enabled, &stypes, &ttypes); 1904 ebitmap_destroy(&stypes); 1905 ebitmap_destroy(&ttypes); 1906 return retval; 1907 } 1908 1909 static int cond_avrule_list_copy(policydb_t * dest_pol, avrule_t * source_rules, 1910 avtab_t * dest_avtab, cond_av_list_t ** list, 1911 cond_av_list_t ** other, uint32_t * typemap, 1912 int enabled, expand_state_t * state) 1913 { 1914 avrule_t *cur; 1915 1916 cur = source_rules; 1917 while (cur) { 1918 if (convert_and_expand_rule(state->handle, dest_pol, 1919 typemap, cur, dest_avtab, 1920 list, other, enabled, 1921 0) != EXPAND_RULE_SUCCESS) { 1922 return -1; 1923 } 1924 1925 cur = cur->next; 1926 } 1927 1928 return 0; 1929 } 1930 1931 static int cond_node_map_bools(expand_state_t * state, cond_node_t * cn) 1932 { 1933 cond_expr_t *cur; 1934 unsigned int i; 1935 1936 cur = cn->expr; 1937 while (cur) { 1938 if (cur->bool) 1939 cur->bool = state->boolmap[cur->bool - 1]; 1940 cur = cur->next; 1941 } 1942 1943 for (i = 0; i < min(cn->nbools, COND_MAX_BOOLS); i++) 1944 cn->bool_ids[i] = state->boolmap[cn->bool_ids[i] - 1]; 1945 1946 if (cond_normalize_expr(state->out, cn)) { 1947 ERR(state->handle, "Error while normalizing conditional"); 1948 return -1; 1949 } 1950 1951 return 0; 1952 } 1953 1954 /* copy the nodes in *reverse* order -- the result is that the last 1955 * given conditional appears first in the policy, so as to match the 1956 * behavior of the upstream compiler */ 1957 static int cond_node_copy(expand_state_t * state, cond_node_t * cn) 1958 { 1959 cond_node_t *new_cond, *tmp; 1960 1961 if (cn == NULL) { 1962 return 0; 1963 } 1964 if (cond_node_copy(state, cn->next)) { 1965 return -1; 1966 } 1967 1968 /* If current cond_node_t is of tunable, its effective branch 1969 * has been appended to its home decl->avrules list during link 1970 * and now we should just skip it. */ 1971 if (cn->flags & COND_NODE_FLAGS_TUNABLE) 1972 return 0; 1973 1974 if (cond_normalize_expr(state->base, cn)) { 1975 ERR(state->handle, "Error while normalizing conditional"); 1976 return -1; 1977 } 1978 1979 /* create a new temporary conditional node with the booleans 1980 * mapped */ 1981 tmp = cond_node_create(state->base, cn); 1982 if (!tmp) { 1983 ERR(state->handle, "Out of memory"); 1984 return -1; 1985 } 1986 1987 if (cond_node_map_bools(state, tmp)) { 1988 ERR(state->handle, "Error mapping booleans"); 1989 free(tmp); 1990 return -1; 1991 } 1992 1993 new_cond = cond_node_search(state->out, state->out->cond_list, tmp); 1994 if (!new_cond) { 1995 cond_node_destroy(tmp); 1996 free(tmp); 1997 ERR(state->handle, "Out of memory!"); 1998 return -1; 1999 } 2000 cond_node_destroy(tmp); 2001 free(tmp); 2002 2003 if (cond_avrule_list_copy 2004 (state->out, cn->avtrue_list, &state->out->te_cond_avtab, 2005 &new_cond->true_list, &new_cond->false_list, state->typemap, 2006 new_cond->cur_state, state)) 2007 return -1; 2008 if (cond_avrule_list_copy 2009 (state->out, cn->avfalse_list, &state->out->te_cond_avtab, 2010 &new_cond->false_list, &new_cond->true_list, state->typemap, 2011 !new_cond->cur_state, state)) 2012 return -1; 2013 2014 return 0; 2015 } 2016 2017 static int context_copy(context_struct_t * dst, context_struct_t * src, 2018 expand_state_t * state) 2019 { 2020 dst->user = state->usermap[src->user - 1]; 2021 dst->role = state->rolemap[src->role - 1]; 2022 dst->type = state->typemap[src->type - 1]; 2023 return mls_context_cpy(dst, src); 2024 } 2025 2026 static int ocontext_copy_xen(expand_state_t *state) 2027 { 2028 unsigned int i; 2029 ocontext_t *c, *n, *l; 2030 2031 for (i = 0; i < OCON_NUM; i++) { 2032 l = NULL; 2033 for (c = state->base->ocontexts[i]; c; c = c->next) { 2034 n = malloc(sizeof(ocontext_t)); 2035 if (!n) { 2036 ERR(state->handle, "Out of memory!"); 2037 return -1; 2038 } 2039 memset(n, 0, sizeof(ocontext_t)); 2040 if (l) 2041 l->next = n; 2042 else 2043 state->out->ocontexts[i] = n; 2044 l = n; 2045 switch (i) { 2046 case OCON_XEN_ISID: 2047 if (c->context[0].user == 0) { 2048 ERR(state->handle, 2049 "Missing context for %s initial sid", 2050 c->u.name); 2051 return -1; 2052 } 2053 n->sid[0] = c->sid[0]; 2054 break; 2055 case OCON_XEN_PIRQ: 2056 n->u.pirq = c->u.pirq; 2057 break; 2058 case OCON_XEN_IOPORT: 2059 n->u.ioport.low_ioport = c->u.ioport.low_ioport; 2060 n->u.ioport.high_ioport = 2061 c->u.ioport.high_ioport; 2062 break; 2063 case OCON_XEN_IOMEM: 2064 n->u.iomem.low_iomem = c->u.iomem.low_iomem; 2065 n->u.iomem.high_iomem = c->u.iomem.high_iomem; 2066 break; 2067 case OCON_XEN_PCIDEVICE: 2068 n->u.device = c->u.device; 2069 break; 2070 default: 2071 /* shouldn't get here */ 2072 ERR(state->handle, "Unknown ocontext"); 2073 return -1; 2074 } 2075 if (context_copy(&n->context[0], &c->context[0], 2076 state)) { 2077 ERR(state->handle, "Out of memory!"); 2078 return -1; 2079 } 2080 } 2081 } 2082 return 0; 2083 } 2084 2085 static int ocontext_copy_selinux(expand_state_t *state) 2086 { 2087 unsigned int i, j; 2088 ocontext_t *c, *n, *l; 2089 2090 for (i = 0; i < OCON_NUM; i++) { 2091 l = NULL; 2092 for (c = state->base->ocontexts[i]; c; c = c->next) { 2093 n = malloc(sizeof(ocontext_t)); 2094 if (!n) { 2095 ERR(state->handle, "Out of memory!"); 2096 return -1; 2097 } 2098 memset(n, 0, sizeof(ocontext_t)); 2099 if (l) 2100 l->next = n; 2101 else 2102 state->out->ocontexts[i] = n; 2103 l = n; 2104 switch (i) { 2105 case OCON_ISID: 2106 if (c->context[0].user == 0) { 2107 ERR(state->handle, 2108 "Missing context for %s initial sid", 2109 c->u.name); 2110 return -1; 2111 } 2112 n->sid[0] = c->sid[0]; 2113 break; 2114 case OCON_FS: /* FALLTHROUGH */ 2115 case OCON_NETIF: 2116 n->u.name = strdup(c->u.name); 2117 if (!n->u.name) { 2118 ERR(state->handle, "Out of memory!"); 2119 return -1; 2120 } 2121 if (context_copy 2122 (&n->context[1], &c->context[1], state)) { 2123 ERR(state->handle, "Out of memory!"); 2124 return -1; 2125 } 2126 break; 2127 case OCON_PORT: 2128 n->u.port.protocol = c->u.port.protocol; 2129 n->u.port.low_port = c->u.port.low_port; 2130 n->u.port.high_port = c->u.port.high_port; 2131 break; 2132 case OCON_NODE: 2133 n->u.node.addr = c->u.node.addr; 2134 n->u.node.mask = c->u.node.mask; 2135 break; 2136 case OCON_FSUSE: 2137 n->v.behavior = c->v.behavior; 2138 n->u.name = strdup(c->u.name); 2139 if (!n->u.name) { 2140 ERR(state->handle, "Out of memory!"); 2141 return -1; 2142 } 2143 break; 2144 case OCON_NODE6: 2145 for (j = 0; j < 4; j++) 2146 n->u.node6.addr[j] = c->u.node6.addr[j]; 2147 for (j = 0; j < 4; j++) 2148 n->u.node6.mask[j] = c->u.node6.mask[j]; 2149 break; 2150 default: 2151 /* shouldn't get here */ 2152 ERR(state->handle, "Unknown ocontext"); 2153 return -1; 2154 } 2155 if (context_copy(&n->context[0], &c->context[0], state)) { 2156 ERR(state->handle, "Out of memory!"); 2157 return -1; 2158 } 2159 } 2160 } 2161 return 0; 2162 } 2163 2164 static int ocontext_copy(expand_state_t *state, uint32_t target) 2165 { 2166 int rc = -1; 2167 switch (target) { 2168 case SEPOL_TARGET_SELINUX: 2169 rc = ocontext_copy_selinux(state); 2170 break; 2171 case SEPOL_TARGET_XEN: 2172 rc = ocontext_copy_xen(state); 2173 break; 2174 default: 2175 ERR(state->handle, "Unknown target"); 2176 return -1; 2177 } 2178 return rc; 2179 } 2180 2181 static int genfs_copy(expand_state_t * state) 2182 { 2183 ocontext_t *c, *newc, *l; 2184 genfs_t *genfs, *newgenfs, *end; 2185 2186 end = NULL; 2187 for (genfs = state->base->genfs; genfs; genfs = genfs->next) { 2188 newgenfs = malloc(sizeof(genfs_t)); 2189 if (!newgenfs) { 2190 ERR(state->handle, "Out of memory!"); 2191 return -1; 2192 } 2193 memset(newgenfs, 0, sizeof(genfs_t)); 2194 newgenfs->fstype = strdup(genfs->fstype); 2195 if (!newgenfs->fstype) { 2196 ERR(state->handle, "Out of memory!"); 2197 free(newgenfs); 2198 return -1; 2199 } 2200 2201 l = NULL; 2202 for (c = genfs->head; c; c = c->next) { 2203 newc = malloc(sizeof(ocontext_t)); 2204 if (!newc) { 2205 ERR(state->handle, "Out of memory!"); 2206 free(newgenfs->fstype); 2207 free(newgenfs); 2208 return -1; 2209 } 2210 memset(newc, 0, sizeof(ocontext_t)); 2211 newc->u.name = strdup(c->u.name); 2212 if (!newc->u.name) { 2213 ERR(state->handle, "Out of memory!"); 2214 free(newc); 2215 free(newgenfs->fstype); 2216 free(newgenfs); 2217 return -1; 2218 } 2219 newc->v.sclass = c->v.sclass; 2220 context_copy(&newc->context[0], &c->context[0], state); 2221 if (l) 2222 l->next = newc; 2223 else 2224 newgenfs->head = newc; 2225 l = newc; 2226 } 2227 if (!end) { 2228 state->out->genfs = newgenfs; 2229 } else { 2230 end->next = newgenfs; 2231 } 2232 end = newgenfs; 2233 } 2234 return 0; 2235 } 2236 2237 static int type_attr_map(hashtab_key_t key 2238 __attribute__ ((unused)), hashtab_datum_t datum, 2239 void *ptr) 2240 { 2241 type_datum_t *type; 2242 expand_state_t *state = ptr; 2243 policydb_t *p = state->out; 2244 unsigned int i; 2245 ebitmap_node_t *tnode; 2246 2247 type = (type_datum_t *) datum; 2248 if (type->flavor == TYPE_ATTRIB) { 2249 if (ebitmap_cpy(&p->attr_type_map[type->s.value - 1], 2250 &type->types)) { 2251 ERR(state->handle, "Out of memory!"); 2252 return -1; 2253 } 2254 ebitmap_for_each_bit(&type->types, tnode, i) { 2255 if (!ebitmap_node_get_bit(tnode, i)) 2256 continue; 2257 if (ebitmap_set_bit(&p->type_attr_map[i], 2258 type->s.value - 1, 1)) { 2259 ERR(state->handle, "Out of memory!"); 2260 return -1; 2261 } 2262 } 2263 } 2264 return 0; 2265 } 2266 2267 /* converts typeset using typemap and expands into ebitmap_t types using the attributes in the passed in policy. 2268 * this should not be called until after all the blocks have been processed and the attributes in target policy 2269 * are complete. */ 2270 int expand_convert_type_set(policydb_t * p, uint32_t * typemap, 2271 type_set_t * set, ebitmap_t * types, 2272 unsigned char alwaysexpand) 2273 { 2274 type_set_t tmpset; 2275 2276 type_set_init(&tmpset); 2277 2278 if (map_ebitmap(&set->types, &tmpset.types, typemap)) 2279 return -1; 2280 2281 if (map_ebitmap(&set->negset, &tmpset.negset, typemap)) 2282 return -1; 2283 2284 tmpset.flags = set->flags; 2285 2286 if (type_set_expand(&tmpset, types, p, alwaysexpand)) 2287 return -1; 2288 2289 type_set_destroy(&tmpset); 2290 2291 return 0; 2292 } 2293 2294 /* Expand a rule into a given avtab - checking for conflicting type 2295 * rules. Return 1 on success, 0 if the rule conflicts with something 2296 * (and hence was not added), or -1 on error. */ 2297 int expand_rule(sepol_handle_t * handle, 2298 policydb_t * source_pol, 2299 avrule_t * source_rule, avtab_t * dest_avtab, 2300 cond_av_list_t ** cond, cond_av_list_t ** other, int enabled) 2301 { 2302 int retval; 2303 ebitmap_t stypes, ttypes; 2304 2305 if (source_rule->specified & AVRULE_NEVERALLOW) 2306 return 1; 2307 2308 ebitmap_init(&stypes); 2309 ebitmap_init(&ttypes); 2310 2311 if (type_set_expand(&source_rule->stypes, &stypes, source_pol, 1)) 2312 return -1; 2313 if (type_set_expand(&source_rule->ttypes, &ttypes, source_pol, 1)) 2314 return -1; 2315 retval = expand_rule_helper(handle, source_pol, NULL, 2316 source_rule, dest_avtab, 2317 cond, other, enabled, &stypes, &ttypes); 2318 ebitmap_destroy(&stypes); 2319 ebitmap_destroy(&ttypes); 2320 return retval; 2321 } 2322 2323 /* Expand a role set into an ebitmap containing the roles. 2324 * This handles the attribute and flags. 2325 * Attribute expansion depends on if the rolemap is available. 2326 * During module compile the rolemap is not available, the 2327 * possible duplicates of a regular role and the role attribute 2328 * the regular role belongs to could be properly handled by 2329 * copy_role_trans and copy_role_allow. 2330 */ 2331 int role_set_expand(role_set_t * x, ebitmap_t * r, policydb_t * out, policydb_t * base, uint32_t * rolemap) 2332 { 2333 unsigned int i; 2334 ebitmap_node_t *rnode; 2335 ebitmap_t mapped_roles, roles; 2336 policydb_t *p = out; 2337 role_datum_t *role; 2338 2339 ebitmap_init(r); 2340 2341 if (x->flags & ROLE_STAR) { 2342 for (i = 0; i < p->p_roles.nprim++; i++) 2343 if (ebitmap_set_bit(r, i, 1)) 2344 return -1; 2345 return 0; 2346 } 2347 2348 ebitmap_init(&mapped_roles); 2349 ebitmap_init(&roles); 2350 2351 if (rolemap) { 2352 assert(base != NULL); 2353 ebitmap_for_each_bit(&x->roles, rnode, i) { 2354 if (ebitmap_node_get_bit(rnode, i)) { 2355 /* take advantage of p_role_val_to_struct[] 2356 * of the base module */ 2357 role = base->role_val_to_struct[i]; 2358 assert(role != NULL); 2359 if (role->flavor == ROLE_ATTRIB) { 2360 if (ebitmap_union(&roles, 2361 &role->roles)) 2362 goto bad; 2363 } else { 2364 if (ebitmap_set_bit(&roles, i, 1)) 2365 goto bad; 2366 } 2367 } 2368 } 2369 if (map_ebitmap(&roles, &mapped_roles, rolemap)) 2370 goto bad; 2371 } else { 2372 if (ebitmap_cpy(&mapped_roles, &x->roles)) 2373 goto bad; 2374 } 2375 2376 ebitmap_for_each_bit(&mapped_roles, rnode, i) { 2377 if (ebitmap_node_get_bit(rnode, i)) { 2378 if (ebitmap_set_bit(r, i, 1)) 2379 goto bad; 2380 } 2381 } 2382 2383 ebitmap_destroy(&mapped_roles); 2384 ebitmap_destroy(&roles); 2385 2386 /* if role is to be complimented, invert the entire bitmap here */ 2387 if (x->flags & ROLE_COMP) { 2388 for (i = 0; i < ebitmap_length(r); i++) { 2389 if (ebitmap_get_bit(r, i)) { 2390 if (ebitmap_set_bit(r, i, 0)) 2391 return -1; 2392 } else { 2393 if (ebitmap_set_bit(r, i, 1)) 2394 return -1; 2395 } 2396 } 2397 } 2398 return 0; 2399 2400 bad: 2401 ebitmap_destroy(&mapped_roles); 2402 ebitmap_destroy(&roles); 2403 return -1; 2404 } 2405 2406 /* Expand a type set into an ebitmap containing the types. This 2407 * handles the negset, attributes, and flags. 2408 * Attribute expansion depends on several factors: 2409 * - if alwaysexpand is 1, then they will be expanded, 2410 * - if the type set has a negset or flags, then they will be expanded, 2411 * - otherwise, they will not be expanded. 2412 */ 2413 int type_set_expand(type_set_t * set, ebitmap_t * t, policydb_t * p, 2414 unsigned char alwaysexpand) 2415 { 2416 unsigned int i; 2417 ebitmap_t types, neg_types; 2418 ebitmap_node_t *tnode; 2419 2420 ebitmap_init(&types); 2421 ebitmap_init(t); 2422 2423 if (alwaysexpand || ebitmap_length(&set->negset) || set->flags) { 2424 /* First go through the types and OR all the attributes to types */ 2425 ebitmap_for_each_bit(&set->types, tnode, i) { 2426 if (ebitmap_node_get_bit(tnode, i)) { 2427 if (p->type_val_to_struct[i]->flavor == 2428 TYPE_ATTRIB) { 2429 if (ebitmap_union 2430 (&types, 2431 &p->type_val_to_struct[i]-> 2432 types)) { 2433 return -1; 2434 } 2435 } else { 2436 if (ebitmap_set_bit(&types, i, 1)) { 2437 return -1; 2438 } 2439 } 2440 } 2441 } 2442 } else { 2443 /* No expansion of attributes, just copy the set as is. */ 2444 if (ebitmap_cpy(&types, &set->types)) 2445 return -1; 2446 } 2447 2448 /* Now do the same thing for negset */ 2449 ebitmap_init(&neg_types); 2450 ebitmap_for_each_bit(&set->negset, tnode, i) { 2451 if (ebitmap_node_get_bit(tnode, i)) { 2452 if (p->type_val_to_struct[i] && 2453 p->type_val_to_struct[i]->flavor == TYPE_ATTRIB) { 2454 if (ebitmap_union 2455 (&neg_types, 2456 &p->type_val_to_struct[i]->types)) { 2457 return -1; 2458 } 2459 } else { 2460 if (ebitmap_set_bit(&neg_types, i, 1)) { 2461 return -1; 2462 } 2463 } 2464 } 2465 } 2466 2467 if (set->flags & TYPE_STAR) { 2468 /* set all types not in neg_types */ 2469 for (i = 0; i < p->p_types.nprim; i++) { 2470 if (ebitmap_get_bit(&neg_types, i)) 2471 continue; 2472 if (p->type_val_to_struct[i] && 2473 p->type_val_to_struct[i]->flavor == TYPE_ATTRIB) 2474 continue; 2475 if (ebitmap_set_bit(t, i, 1)) 2476 return -1; 2477 } 2478 goto out; 2479 } 2480 2481 ebitmap_for_each_bit(&types, tnode, i) { 2482 if (ebitmap_node_get_bit(tnode, i) 2483 && (!ebitmap_get_bit(&neg_types, i))) 2484 if (ebitmap_set_bit(t, i, 1)) 2485 return -1; 2486 } 2487 2488 if (set->flags & TYPE_COMP) { 2489 for (i = 0; i < p->p_types.nprim; i++) { 2490 if (p->type_val_to_struct[i] && 2491 p->type_val_to_struct[i]->flavor == TYPE_ATTRIB) { 2492 assert(!ebitmap_get_bit(t, i)); 2493 continue; 2494 } 2495 if (ebitmap_get_bit(t, i)) { 2496 if (ebitmap_set_bit(t, i, 0)) 2497 return -1; 2498 } else { 2499 if (ebitmap_set_bit(t, i, 1)) 2500 return -1; 2501 } 2502 } 2503 } 2504 2505 out: 2506 2507 ebitmap_destroy(&types); 2508 ebitmap_destroy(&neg_types); 2509 2510 return 0; 2511 } 2512 2513 static int copy_neverallow(policydb_t * dest_pol, uint32_t * typemap, 2514 avrule_t * source_rule) 2515 { 2516 ebitmap_t stypes, ttypes; 2517 avrule_t *avrule; 2518 class_perm_node_t *cur_perm, *new_perm, *tail_perm; 2519 2520 ebitmap_init(&stypes); 2521 ebitmap_init(&ttypes); 2522 2523 if (expand_convert_type_set 2524 (dest_pol, typemap, &source_rule->stypes, &stypes, 1)) 2525 return -1; 2526 if (expand_convert_type_set 2527 (dest_pol, typemap, &source_rule->ttypes, &ttypes, 1)) 2528 return -1; 2529 2530 avrule = (avrule_t *) malloc(sizeof(avrule_t)); 2531 if (!avrule) 2532 return -1; 2533 2534 avrule_init(avrule); 2535 avrule->specified = AVRULE_NEVERALLOW; 2536 avrule->line = source_rule->line; 2537 avrule->flags = source_rule->flags; 2538 2539 if (ebitmap_cpy(&avrule->stypes.types, &stypes)) 2540 goto err; 2541 2542 if (ebitmap_cpy(&avrule->ttypes.types, &ttypes)) 2543 goto err; 2544 2545 cur_perm = source_rule->perms; 2546 tail_perm = NULL; 2547 while (cur_perm) { 2548 new_perm = 2549 (class_perm_node_t *) malloc(sizeof(class_perm_node_t)); 2550 if (!new_perm) 2551 goto err; 2552 class_perm_node_init(new_perm); 2553 new_perm->class = cur_perm->class; 2554 assert(new_perm->class); 2555 2556 /* once we have modules with permissions we'll need to map the permissions (and classes) */ 2557 new_perm->data = cur_perm->data; 2558 2559 if (!avrule->perms) 2560 avrule->perms = new_perm; 2561 2562 if (tail_perm) 2563 tail_perm->next = new_perm; 2564 tail_perm = new_perm; 2565 cur_perm = cur_perm->next; 2566 } 2567 2568 /* just prepend the avrule to the first branch; it'll never be 2569 written to disk */ 2570 if (!dest_pol->global->branch_list->avrules) 2571 dest_pol->global->branch_list->avrules = avrule; 2572 else { 2573 avrule->next = dest_pol->global->branch_list->avrules; 2574 dest_pol->global->branch_list->avrules = avrule; 2575 } 2576 2577 ebitmap_destroy(&stypes); 2578 ebitmap_destroy(&ttypes); 2579 2580 return 0; 2581 2582 err: 2583 ebitmap_destroy(&stypes); 2584 ebitmap_destroy(&ttypes); 2585 ebitmap_destroy(&avrule->stypes.types); 2586 ebitmap_destroy(&avrule->ttypes.types); 2587 cur_perm = avrule->perms; 2588 while (cur_perm) { 2589 tail_perm = cur_perm->next; 2590 free(cur_perm); 2591 cur_perm = tail_perm; 2592 } 2593 free(avrule); 2594 return -1; 2595 } 2596 2597 /* 2598 * Expands the avrule blocks for a policy. RBAC rules are copied. Neverallow 2599 * rules are copied or expanded as per the settings in the state object; all 2600 * other AV rules are expanded. If neverallow rules are expanded, they are not 2601 * copied, otherwise they are copied for later use by the assertion checker. 2602 */ 2603 static int copy_and_expand_avrule_block(expand_state_t * state) 2604 { 2605 avrule_block_t *curblock = state->base->global; 2606 avrule_block_t *prevblock; 2607 int retval = -1; 2608 2609 if (avtab_alloc(&state->out->te_avtab, MAX_AVTAB_SIZE)) { 2610 ERR(state->handle, "Out of Memory!"); 2611 return -1; 2612 } 2613 2614 if (avtab_alloc(&state->out->te_cond_avtab, MAX_AVTAB_SIZE)) { 2615 ERR(state->handle, "Out of Memory!"); 2616 return -1; 2617 } 2618 2619 while (curblock) { 2620 avrule_decl_t *decl = curblock->enabled; 2621 avrule_t *cur_avrule; 2622 2623 if (decl == NULL) { 2624 /* nothing was enabled within this block */ 2625 goto cont; 2626 } 2627 2628 /* copy role allows and role trans */ 2629 if (copy_role_allows(state, decl->role_allow_rules) != 0 || 2630 copy_role_trans(state, decl->role_tr_rules) != 0) { 2631 goto cleanup; 2632 } 2633 2634 if (expand_filename_trans(state, decl->filename_trans_rules)) 2635 goto cleanup; 2636 2637 /* expand the range transition rules */ 2638 if (expand_range_trans(state, decl->range_tr_rules)) 2639 goto cleanup; 2640 2641 /* copy rules */ 2642 cur_avrule = decl->avrules; 2643 while (cur_avrule != NULL) { 2644 if (!(state->expand_neverallow) 2645 && cur_avrule->specified & AVRULE_NEVERALLOW) { 2646 /* copy this over directly so that assertions are checked later */ 2647 if (copy_neverallow 2648 (state->out, state->typemap, cur_avrule)) 2649 ERR(state->handle, 2650 "Error while copying neverallow."); 2651 } else { 2652 if (cur_avrule->specified & AVRULE_NEVERALLOW) { 2653 state->out->unsupported_format = 1; 2654 } 2655 if (convert_and_expand_rule 2656 (state->handle, state->out, state->typemap, 2657 cur_avrule, &state->out->te_avtab, NULL, 2658 NULL, 0, 2659 state->expand_neverallow) != 2660 EXPAND_RULE_SUCCESS) { 2661 goto cleanup; 2662 } 2663 } 2664 cur_avrule = cur_avrule->next; 2665 } 2666 2667 /* copy conditional rules */ 2668 if (cond_node_copy(state, decl->cond_list)) 2669 goto cleanup; 2670 2671 cont: 2672 prevblock = curblock; 2673 curblock = curblock->next; 2674 2675 if (state->handle && state->handle->expand_consume_base) { 2676 /* set base top avrule block in case there 2677 * is an error condition and the policy needs 2678 * to be destroyed */ 2679 state->base->global = curblock; 2680 avrule_block_destroy(prevblock); 2681 } 2682 } 2683 2684 retval = 0; 2685 2686 cleanup: 2687 return retval; 2688 } 2689 2690 /* 2691 * This function allows external users of the library (such as setools) to 2692 * expand only the avrules and optionally perform expansion of neverallow rules 2693 * or expand into the same policy for analysis purposes. 2694 */ 2695 int expand_module_avrules(sepol_handle_t * handle, policydb_t * base, 2696 policydb_t * out, uint32_t * typemap, 2697 uint32_t * boolmap, uint32_t * rolemap, 2698 uint32_t * usermap, int verbose, 2699 int expand_neverallow) 2700 { 2701 expand_state_t state; 2702 2703 expand_state_init(&state); 2704 2705 state.base = base; 2706 state.out = out; 2707 state.typemap = typemap; 2708 state.boolmap = boolmap; 2709 state.rolemap = rolemap; 2710 state.usermap = usermap; 2711 state.handle = handle; 2712 state.verbose = verbose; 2713 state.expand_neverallow = expand_neverallow; 2714 2715 return copy_and_expand_avrule_block(&state); 2716 } 2717 2718 static void discard_tunables(sepol_handle_t *sh, policydb_t *pol) 2719 { 2720 avrule_block_t *block; 2721 avrule_decl_t *decl; 2722 cond_node_t *cur_node; 2723 cond_expr_t *cur_expr; 2724 int cur_state, preserve_tunables = 0; 2725 avrule_t *tail, *to_be_appended; 2726 2727 if (sh && sh->preserve_tunables) 2728 preserve_tunables = 1; 2729 2730 /* Iterate through all cond_node of all enabled decls, if a cond_node 2731 * is about tunable, calculate its state value and concatenate one of 2732 * its avrule list to the current decl->avrules list. On the other 2733 * hand, the disabled unused branch of a tunable would be discarded. 2734 * 2735 * Note, such tunable cond_node would be skipped over in expansion, 2736 * so we won't have to worry about removing it from decl->cond_list 2737 * here :-) 2738 * 2739 * If tunables are requested to be preserved then they would be 2740 * "transformed" as booleans by having their TUNABLE flag cleared. 2741 */ 2742 for (block = pol->global; block != NULL; block = block->next) { 2743 decl = block->enabled; 2744 if (decl == NULL || decl->enabled == 0) 2745 continue; 2746 2747 tail = decl->avrules; 2748 while (tail && tail->next) 2749 tail = tail->next; 2750 2751 for (cur_node = decl->cond_list; cur_node != NULL; 2752 cur_node = cur_node->next) { 2753 int booleans, tunables, i; 2754 cond_bool_datum_t *booldatum; 2755 cond_bool_datum_t *tmp[COND_EXPR_MAXDEPTH]; 2756 2757 booleans = tunables = 0; 2758 memset(tmp, 0, sizeof(cond_bool_datum_t *) * COND_EXPR_MAXDEPTH); 2759 2760 for (cur_expr = cur_node->expr; cur_expr != NULL; 2761 cur_expr = cur_expr->next) { 2762 if (cur_expr->expr_type != COND_BOOL) 2763 continue; 2764 booldatum = pol->bool_val_to_struct[cur_expr->bool - 1]; 2765 if (booldatum->flags & COND_BOOL_FLAGS_TUNABLE) 2766 tmp[tunables++] = booldatum; 2767 else 2768 booleans++; 2769 } 2770 2771 /* bool_copy_callback() at link phase has ensured 2772 * that no mixture of tunables and booleans in one 2773 * expression. However, this would be broken by the 2774 * request to preserve tunables */ 2775 if (!preserve_tunables) 2776 assert(!(booleans && tunables)); 2777 2778 if (booleans || preserve_tunables) { 2779 cur_node->flags &= ~COND_NODE_FLAGS_TUNABLE; 2780 if (tunables) { 2781 for (i = 0; i < tunables; i++) 2782 tmp[i]->flags &= ~COND_BOOL_FLAGS_TUNABLE; 2783 } 2784 } else { 2785 cur_node->flags |= COND_NODE_FLAGS_TUNABLE; 2786 cur_state = cond_evaluate_expr(pol, cur_node->expr); 2787 if (cur_state == -1) { 2788 printf("Expression result was " 2789 "undefined, skipping all" 2790 "rules\n"); 2791 continue; 2792 } 2793 2794 to_be_appended = (cur_state == 1) ? 2795 cur_node->avtrue_list : cur_node->avfalse_list; 2796 2797 if (tail) 2798 tail->next = to_be_appended; 2799 else 2800 tail = decl->avrules = to_be_appended; 2801 2802 /* Now that the effective branch has been 2803 * appended, neutralize its original pointer */ 2804 if (cur_state == 1) 2805 cur_node->avtrue_list = NULL; 2806 else 2807 cur_node->avfalse_list = NULL; 2808 2809 /* Update the tail of decl->avrules for 2810 * further concatenation */ 2811 while (tail && tail->next) 2812 tail = tail->next; 2813 } 2814 } 2815 } 2816 } 2817 2818 /* Linking should always be done before calling expand, even if 2819 * there is only a base since all optionals are dealt with at link time 2820 * the base passed in should be indexed and avrule blocks should be 2821 * enabled. 2822 */ 2823 int expand_module(sepol_handle_t * handle, 2824 policydb_t * base, policydb_t * out, int verbose, int check) 2825 { 2826 int retval = -1; 2827 unsigned int i; 2828 expand_state_t state; 2829 avrule_block_t *curblock; 2830 2831 /* Append tunable's avtrue_list or avfalse_list to the avrules list 2832 * of its home decl depending on its state value, so that the effect 2833 * rules of a tunable would be added to te_avtab permanently. Whereas 2834 * the disabled unused branch would be discarded. 2835 * 2836 * Originally this function is called at the very end of link phase, 2837 * however, we need to keep the linked policy intact for analysis 2838 * purpose. */ 2839 discard_tunables(handle, base); 2840 2841 expand_state_init(&state); 2842 2843 state.verbose = verbose; 2844 state.typemap = NULL; 2845 state.base = base; 2846 state.out = out; 2847 state.handle = handle; 2848 2849 if (base->policy_type != POLICY_BASE) { 2850 ERR(handle, "Target of expand was not a base policy."); 2851 return -1; 2852 } 2853 2854 state.out->policy_type = POLICY_KERN; 2855 state.out->policyvers = POLICYDB_VERSION_MAX; 2856 2857 /* Copy mls state from base to out */ 2858 out->mls = base->mls; 2859 out->handle_unknown = base->handle_unknown; 2860 2861 /* Copy target from base to out */ 2862 out->target_platform = base->target_platform; 2863 2864 /* Copy policy capabilities */ 2865 if (ebitmap_cpy(&out->policycaps, &base->policycaps)) { 2866 ERR(handle, "Out of memory!"); 2867 goto cleanup; 2868 } 2869 2870 if ((state.typemap = 2871 (uint32_t *) calloc(state.base->p_types.nprim, 2872 sizeof(uint32_t))) == NULL) { 2873 ERR(handle, "Out of memory!"); 2874 goto cleanup; 2875 } 2876 2877 state.boolmap = (uint32_t *)calloc(state.base->p_bools.nprim, sizeof(uint32_t)); 2878 if (!state.boolmap) { 2879 ERR(handle, "Out of memory!"); 2880 goto cleanup; 2881 } 2882 2883 state.rolemap = (uint32_t *)calloc(state.base->p_roles.nprim, sizeof(uint32_t)); 2884 if (!state.rolemap) { 2885 ERR(handle, "Out of memory!"); 2886 goto cleanup; 2887 } 2888 2889 state.usermap = (uint32_t *)calloc(state.base->p_users.nprim, sizeof(uint32_t)); 2890 if (!state.usermap) { 2891 ERR(handle, "Out of memory!"); 2892 goto cleanup; 2893 } 2894 2895 /* order is important - types must be first */ 2896 2897 /* copy types */ 2898 if (hashtab_map(state.base->p_types.table, type_copy_callback, &state)) { 2899 goto cleanup; 2900 } 2901 2902 /* convert attribute type sets */ 2903 if (hashtab_map 2904 (state.base->p_types.table, attr_convert_callback, &state)) { 2905 goto cleanup; 2906 } 2907 2908 /* copy commons */ 2909 if (hashtab_map 2910 (state.base->p_commons.table, common_copy_callback, &state)) { 2911 goto cleanup; 2912 } 2913 2914 /* copy classes, note, this does not copy constraints, constraints can't be 2915 * copied until after all the blocks have been processed and attributes are complete */ 2916 if (hashtab_map 2917 (state.base->p_classes.table, class_copy_callback, &state)) { 2918 goto cleanup; 2919 } 2920 2921 /* copy type bounds */ 2922 if (hashtab_map(state.base->p_types.table, 2923 type_bounds_copy_callback, &state)) 2924 goto cleanup; 2925 2926 /* copy aliases */ 2927 if (hashtab_map(state.base->p_types.table, alias_copy_callback, &state)) 2928 goto cleanup; 2929 2930 /* index here so that type indexes are available for role_copy_callback */ 2931 if (policydb_index_others(handle, out, verbose)) { 2932 ERR(handle, "Error while indexing out symbols"); 2933 goto cleanup; 2934 } 2935 2936 /* copy roles */ 2937 if (hashtab_map(state.base->p_roles.table, role_copy_callback, &state)) 2938 goto cleanup; 2939 if (hashtab_map(state.base->p_roles.table, 2940 role_bounds_copy_callback, &state)) 2941 goto cleanup; 2942 /* escalate the type_set_t in a role attribute to all regular roles 2943 * that belongs to it. */ 2944 if (hashtab_map(state.base->p_roles.table, role_fix_callback, &state)) 2945 goto cleanup; 2946 2947 /* copy MLS's sensitivity level and categories - this needs to be done 2948 * before expanding users (they need to be indexed too) */ 2949 if (hashtab_map(state.base->p_levels.table, sens_copy_callback, &state)) 2950 goto cleanup; 2951 if (hashtab_map(state.base->p_cats.table, cats_copy_callback, &state)) 2952 goto cleanup; 2953 if (policydb_index_others(handle, out, verbose)) { 2954 ERR(handle, "Error while indexing out symbols"); 2955 goto cleanup; 2956 } 2957 2958 /* copy users */ 2959 if (hashtab_map(state.base->p_users.table, user_copy_callback, &state)) 2960 goto cleanup; 2961 if (hashtab_map(state.base->p_users.table, 2962 user_bounds_copy_callback, &state)) 2963 goto cleanup; 2964 2965 /* copy bools */ 2966 if (hashtab_map(state.base->p_bools.table, bool_copy_callback, &state)) 2967 goto cleanup; 2968 2969 if (policydb_index_classes(out)) { 2970 ERR(handle, "Error while indexing out classes"); 2971 goto cleanup; 2972 } 2973 if (policydb_index_others(handle, out, verbose)) { 2974 ERR(handle, "Error while indexing out symbols"); 2975 goto cleanup; 2976 } 2977 2978 /* loop through all decls and union attributes, roles, users */ 2979 for (curblock = state.base->global; curblock != NULL; 2980 curblock = curblock->next) { 2981 avrule_decl_t *decl = curblock->enabled; 2982 2983 if (decl == NULL) { 2984 /* nothing was enabled within this block */ 2985 continue; 2986 } 2987 2988 /* convert attribute type sets */ 2989 if (hashtab_map 2990 (decl->p_types.table, attr_convert_callback, &state)) { 2991 goto cleanup; 2992 } 2993 2994 /* copy roles */ 2995 if (hashtab_map 2996 (decl->p_roles.table, role_copy_callback, &state)) 2997 goto cleanup; 2998 2999 /* copy users */ 3000 if (hashtab_map 3001 (decl->p_users.table, user_copy_callback, &state)) 3002 goto cleanup; 3003 3004 } 3005 3006 /* remap role dominates bitmaps */ 3007 if (hashtab_map(state.out->p_roles.table, role_remap_dominates, &state)) { 3008 goto cleanup; 3009 } 3010 3011 if (copy_and_expand_avrule_block(&state) < 0) { 3012 ERR(handle, "Error during expand"); 3013 goto cleanup; 3014 } 3015 3016 /* copy constraints */ 3017 if (hashtab_map 3018 (state.base->p_classes.table, constraint_copy_callback, &state)) { 3019 goto cleanup; 3020 } 3021 3022 cond_optimize_lists(state.out->cond_list); 3023 evaluate_conds(state.out); 3024 3025 /* copy ocontexts */ 3026 if (ocontext_copy(&state, out->target_platform)) 3027 goto cleanup; 3028 3029 /* copy genfs */ 3030 if (genfs_copy(&state)) 3031 goto cleanup; 3032 3033 /* Build the type<->attribute maps and remove attributes. */ 3034 state.out->attr_type_map = malloc(state.out->p_types.nprim * 3035 sizeof(ebitmap_t)); 3036 state.out->type_attr_map = malloc(state.out->p_types.nprim * 3037 sizeof(ebitmap_t)); 3038 if (!state.out->attr_type_map || !state.out->type_attr_map) { 3039 ERR(handle, "Out of memory!"); 3040 goto cleanup; 3041 } 3042 for (i = 0; i < state.out->p_types.nprim; i++) { 3043 ebitmap_init(&state.out->type_attr_map[i]); 3044 ebitmap_init(&state.out->attr_type_map[i]); 3045 /* add the type itself as the degenerate case */ 3046 if (ebitmap_set_bit(&state.out->type_attr_map[i], i, 1)) { 3047 ERR(handle, "Out of memory!"); 3048 goto cleanup; 3049 } 3050 } 3051 if (hashtab_map(state.out->p_types.table, type_attr_map, &state)) 3052 goto cleanup; 3053 if (check) { 3054 if (hierarchy_check_constraints(handle, state.out)) 3055 goto cleanup; 3056 3057 if (check_assertions 3058 (handle, state.out, 3059 state.out->global->branch_list->avrules)) 3060 goto cleanup; 3061 } 3062 3063 retval = 0; 3064 3065 cleanup: 3066 free(state.typemap); 3067 free(state.boolmap); 3068 free(state.rolemap); 3069 free(state.usermap); 3070 return retval; 3071 } 3072 3073 static int expand_avtab_insert(avtab_t * a, avtab_key_t * k, avtab_datum_t * d) 3074 { 3075 avtab_ptr_t node; 3076 avtab_datum_t *avd; 3077 int rc; 3078 3079 node = avtab_search_node(a, k); 3080 if (!node) { 3081 rc = avtab_insert(a, k, d); 3082 if (rc) 3083 ERR(NULL, "Out of memory!"); 3084 return rc; 3085 } 3086 3087 if ((k->specified & AVTAB_ENABLED) != 3088 (node->key.specified & AVTAB_ENABLED)) { 3089 node = avtab_insert_nonunique(a, k, d); 3090 if (!node) { 3091 ERR(NULL, "Out of memory!"); 3092 return -1; 3093 } 3094 return 0; 3095 } 3096 3097 avd = &node->datum; 3098 switch (k->specified & ~AVTAB_ENABLED) { 3099 case AVTAB_ALLOWED: 3100 case AVTAB_AUDITALLOW: 3101 avd->data |= d->data; 3102 break; 3103 case AVTAB_AUDITDENY: 3104 avd->data &= d->data; 3105 break; 3106 default: 3107 ERR(NULL, "Type conflict!"); 3108 return -1; 3109 } 3110 3111 return 0; 3112 } 3113 3114 struct expand_avtab_data { 3115 avtab_t *expa; 3116 policydb_t *p; 3117 3118 }; 3119 3120 static int expand_avtab_node(avtab_key_t * k, avtab_datum_t * d, void *args) 3121 { 3122 struct expand_avtab_data *ptr = args; 3123 avtab_t *expa = ptr->expa; 3124 policydb_t *p = ptr->p; 3125 type_datum_t *stype = p->type_val_to_struct[k->source_type - 1]; 3126 type_datum_t *ttype = p->type_val_to_struct[k->target_type - 1]; 3127 ebitmap_t *sattr = &p->attr_type_map[k->source_type - 1]; 3128 ebitmap_t *tattr = &p->attr_type_map[k->target_type - 1]; 3129 ebitmap_node_t *snode, *tnode; 3130 unsigned int i, j; 3131 avtab_key_t newkey; 3132 int rc; 3133 3134 newkey.target_class = k->target_class; 3135 newkey.specified = k->specified; 3136 3137 if (stype->flavor != TYPE_ATTRIB && ttype->flavor != TYPE_ATTRIB) { 3138 /* Both are individual types, no expansion required. */ 3139 return expand_avtab_insert(expa, k, d); 3140 } 3141 3142 if (stype->flavor != TYPE_ATTRIB) { 3143 /* Source is an individual type, target is an attribute. */ 3144 newkey.source_type = k->source_type; 3145 ebitmap_for_each_bit(tattr, tnode, j) { 3146 if (!ebitmap_node_get_bit(tnode, j)) 3147 continue; 3148 newkey.target_type = j + 1; 3149 rc = expand_avtab_insert(expa, &newkey, d); 3150 if (rc) 3151 return -1; 3152 } 3153 return 0; 3154 } 3155 3156 if (ttype->flavor != TYPE_ATTRIB) { 3157 /* Target is an individual type, source is an attribute. */ 3158 newkey.target_type = k->target_type; 3159 ebitmap_for_each_bit(sattr, snode, i) { 3160 if (!ebitmap_node_get_bit(snode, i)) 3161 continue; 3162 newkey.source_type = i + 1; 3163 rc = expand_avtab_insert(expa, &newkey, d); 3164 if (rc) 3165 return -1; 3166 } 3167 return 0; 3168 } 3169 3170 /* Both source and target type are attributes. */ 3171 ebitmap_for_each_bit(sattr, snode, i) { 3172 if (!ebitmap_node_get_bit(snode, i)) 3173 continue; 3174 ebitmap_for_each_bit(tattr, tnode, j) { 3175 if (!ebitmap_node_get_bit(tnode, j)) 3176 continue; 3177 newkey.source_type = i + 1; 3178 newkey.target_type = j + 1; 3179 rc = expand_avtab_insert(expa, &newkey, d); 3180 if (rc) 3181 return -1; 3182 } 3183 } 3184 3185 return 0; 3186 } 3187 3188 int expand_avtab(policydb_t * p, avtab_t * a, avtab_t * expa) 3189 { 3190 struct expand_avtab_data data; 3191 3192 if (avtab_alloc(expa, MAX_AVTAB_SIZE)) { 3193 ERR(NULL, "Out of memory!"); 3194 return -1; 3195 } 3196 3197 data.expa = expa; 3198 data.p = p; 3199 return avtab_map(a, expand_avtab_node, &data); 3200 } 3201 3202 static int expand_cond_insert(cond_av_list_t ** l, 3203 avtab_t * expa, 3204 avtab_key_t * k, avtab_datum_t * d) 3205 { 3206 avtab_ptr_t node; 3207 avtab_datum_t *avd; 3208 cond_av_list_t *nl; 3209 3210 node = avtab_search_node(expa, k); 3211 if (!node || 3212 (k->specified & AVTAB_ENABLED) != 3213 (node->key.specified & AVTAB_ENABLED)) { 3214 node = avtab_insert_nonunique(expa, k, d); 3215 if (!node) { 3216 ERR(NULL, "Out of memory!"); 3217 return -1; 3218 } 3219 node->parse_context = (void *)1; 3220 nl = (cond_av_list_t *) malloc(sizeof(*nl)); 3221 if (!nl) { 3222 ERR(NULL, "Out of memory!"); 3223 return -1; 3224 } 3225 memset(nl, 0, sizeof(*nl)); 3226 nl->node = node; 3227 nl->next = *l; 3228 *l = nl; 3229 return 0; 3230 } 3231 3232 avd = &node->datum; 3233 switch (k->specified & ~AVTAB_ENABLED) { 3234 case AVTAB_ALLOWED: 3235 case AVTAB_AUDITALLOW: 3236 avd->data |= d->data; 3237 break; 3238 case AVTAB_AUDITDENY: 3239 avd->data &= d->data; 3240 break; 3241 default: 3242 ERR(NULL, "Type conflict!"); 3243 return -1; 3244 } 3245 3246 return 0; 3247 } 3248 3249 int expand_cond_av_node(policydb_t * p, 3250 avtab_ptr_t node, 3251 cond_av_list_t ** newl, avtab_t * expa) 3252 { 3253 avtab_key_t *k = &node->key; 3254 avtab_datum_t *d = &node->datum; 3255 type_datum_t *stype = p->type_val_to_struct[k->source_type - 1]; 3256 type_datum_t *ttype = p->type_val_to_struct[k->target_type - 1]; 3257 ebitmap_t *sattr = &p->attr_type_map[k->source_type - 1]; 3258 ebitmap_t *tattr = &p->attr_type_map[k->target_type - 1]; 3259 ebitmap_node_t *snode, *tnode; 3260 unsigned int i, j; 3261 avtab_key_t newkey; 3262 int rc; 3263 3264 newkey.target_class = k->target_class; 3265 newkey.specified = k->specified; 3266 3267 if (stype->flavor != TYPE_ATTRIB && ttype->flavor != TYPE_ATTRIB) { 3268 /* Both are individual types, no expansion required. */ 3269 return expand_cond_insert(newl, expa, k, d); 3270 } 3271 3272 if (stype->flavor != TYPE_ATTRIB) { 3273 /* Source is an individual type, target is an attribute. */ 3274 newkey.source_type = k->source_type; 3275 ebitmap_for_each_bit(tattr, tnode, j) { 3276 if (!ebitmap_node_get_bit(tnode, j)) 3277 continue; 3278 newkey.target_type = j + 1; 3279 rc = expand_cond_insert(newl, expa, &newkey, d); 3280 if (rc) 3281 return -1; 3282 } 3283 return 0; 3284 } 3285 3286 if (ttype->flavor != TYPE_ATTRIB) { 3287 /* Target is an individual type, source is an attribute. */ 3288 newkey.target_type = k->target_type; 3289 ebitmap_for_each_bit(sattr, snode, i) { 3290 if (!ebitmap_node_get_bit(snode, i)) 3291 continue; 3292 newkey.source_type = i + 1; 3293 rc = expand_cond_insert(newl, expa, &newkey, d); 3294 if (rc) 3295 return -1; 3296 } 3297 return 0; 3298 } 3299 3300 /* Both source and target type are attributes. */ 3301 ebitmap_for_each_bit(sattr, snode, i) { 3302 if (!ebitmap_node_get_bit(snode, i)) 3303 continue; 3304 ebitmap_for_each_bit(tattr, tnode, j) { 3305 if (!ebitmap_node_get_bit(tnode, j)) 3306 continue; 3307 newkey.source_type = i + 1; 3308 newkey.target_type = j + 1; 3309 rc = expand_cond_insert(newl, expa, &newkey, d); 3310 if (rc) 3311 return -1; 3312 } 3313 } 3314 3315 return 0; 3316 } 3317 3318 int expand_cond_av_list(policydb_t * p, cond_av_list_t * l, 3319 cond_av_list_t ** newl, avtab_t * expa) 3320 { 3321 cond_av_list_t *cur; 3322 avtab_ptr_t node; 3323 int rc; 3324 3325 if (avtab_alloc(expa, MAX_AVTAB_SIZE)) { 3326 ERR(NULL, "Out of memory!"); 3327 return -1; 3328 } 3329 3330 *newl = NULL; 3331 for (cur = l; cur; cur = cur->next) { 3332 node = cur->node; 3333 rc = expand_cond_av_node(p, node, newl, expa); 3334 if (rc) 3335 return rc; 3336 } 3337 3338 return 0; 3339 } 3340
