Merge branch 'for-2.6.31' of git://fieldses.org/git/linux-nfsd
[linux-2.6] / security / selinux / ss / policydb.c
1 /*
2  * Implementation of the policy database.
3  *
4  * Author : Stephen Smalley, <sds@epoch.ncsc.mil>
5  */
6
7 /*
8  * Updated: Trusted Computer Solutions, Inc. <dgoeddel@trustedcs.com>
9  *
10  *      Support for enhanced MLS infrastructure.
11  *
12  * Updated: Frank Mayer <mayerf@tresys.com> and Karl MacMillan <kmacmillan@tresys.com>
13  *
14  *      Added conditional policy language extensions
15  *
16  * Updated: Hewlett-Packard <paul.moore@hp.com>
17  *
18  *      Added support for the policy capability bitmap
19  *
20  * Copyright (C) 2007 Hewlett-Packard Development Company, L.P.
21  * Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
22  * Copyright (C) 2003 - 2004 Tresys Technology, LLC
23  *      This program is free software; you can redistribute it and/or modify
24  *      it under the terms of the GNU General Public License as published by
25  *      the Free Software Foundation, version 2.
26  */
27
28 #include <linux/kernel.h>
29 #include <linux/sched.h>
30 #include <linux/slab.h>
31 #include <linux/string.h>
32 #include <linux/errno.h>
33 #include <linux/audit.h>
34 #include "security.h"
35
36 #include "policydb.h"
37 #include "conditional.h"
38 #include "mls.h"
39
40 #define _DEBUG_HASHES
41
42 #ifdef DEBUG_HASHES
43 static char *symtab_name[SYM_NUM] = {
44         "common prefixes",
45         "classes",
46         "roles",
47         "types",
48         "users",
49         "bools",
50         "levels",
51         "categories",
52 };
53 #endif
54
55 int selinux_mls_enabled;
56
57 static unsigned int symtab_sizes[SYM_NUM] = {
58         2,
59         32,
60         16,
61         512,
62         128,
63         16,
64         16,
65         16,
66 };
67
68 struct policydb_compat_info {
69         int version;
70         int sym_num;
71         int ocon_num;
72 };
73
74 /* These need to be updated if SYM_NUM or OCON_NUM changes */
75 static struct policydb_compat_info policydb_compat[] = {
76         {
77                 .version        = POLICYDB_VERSION_BASE,
78                 .sym_num        = SYM_NUM - 3,
79                 .ocon_num       = OCON_NUM - 1,
80         },
81         {
82                 .version        = POLICYDB_VERSION_BOOL,
83                 .sym_num        = SYM_NUM - 2,
84                 .ocon_num       = OCON_NUM - 1,
85         },
86         {
87                 .version        = POLICYDB_VERSION_IPV6,
88                 .sym_num        = SYM_NUM - 2,
89                 .ocon_num       = OCON_NUM,
90         },
91         {
92                 .version        = POLICYDB_VERSION_NLCLASS,
93                 .sym_num        = SYM_NUM - 2,
94                 .ocon_num       = OCON_NUM,
95         },
96         {
97                 .version        = POLICYDB_VERSION_MLS,
98                 .sym_num        = SYM_NUM,
99                 .ocon_num       = OCON_NUM,
100         },
101         {
102                 .version        = POLICYDB_VERSION_AVTAB,
103                 .sym_num        = SYM_NUM,
104                 .ocon_num       = OCON_NUM,
105         },
106         {
107                 .version        = POLICYDB_VERSION_RANGETRANS,
108                 .sym_num        = SYM_NUM,
109                 .ocon_num       = OCON_NUM,
110         },
111         {
112                 .version        = POLICYDB_VERSION_POLCAP,
113                 .sym_num        = SYM_NUM,
114                 .ocon_num       = OCON_NUM,
115         },
116         {
117                 .version        = POLICYDB_VERSION_PERMISSIVE,
118                 .sym_num        = SYM_NUM,
119                 .ocon_num       = OCON_NUM,
120         },
121         {
122                 .version        = POLICYDB_VERSION_BOUNDARY,
123                 .sym_num        = SYM_NUM,
124                 .ocon_num       = OCON_NUM,
125         },
126 };
127
128 static struct policydb_compat_info *policydb_lookup_compat(int version)
129 {
130         int i;
131         struct policydb_compat_info *info = NULL;
132
133         for (i = 0; i < ARRAY_SIZE(policydb_compat); i++) {
134                 if (policydb_compat[i].version == version) {
135                         info = &policydb_compat[i];
136                         break;
137                 }
138         }
139         return info;
140 }
141
142 /*
143  * Initialize the role table.
144  */
145 static int roles_init(struct policydb *p)
146 {
147         char *key = NULL;
148         int rc;
149         struct role_datum *role;
150
151         role = kzalloc(sizeof(*role), GFP_KERNEL);
152         if (!role) {
153                 rc = -ENOMEM;
154                 goto out;
155         }
156         role->value = ++p->p_roles.nprim;
157         if (role->value != OBJECT_R_VAL) {
158                 rc = -EINVAL;
159                 goto out_free_role;
160         }
161         key = kmalloc(strlen(OBJECT_R)+1, GFP_KERNEL);
162         if (!key) {
163                 rc = -ENOMEM;
164                 goto out_free_role;
165         }
166         strcpy(key, OBJECT_R);
167         rc = hashtab_insert(p->p_roles.table, key, role);
168         if (rc)
169                 goto out_free_key;
170 out:
171         return rc;
172
173 out_free_key:
174         kfree(key);
175 out_free_role:
176         kfree(role);
177         goto out;
178 }
179
180 /*
181  * Initialize a policy database structure.
182  */
183 static int policydb_init(struct policydb *p)
184 {
185         int i, rc;
186
187         memset(p, 0, sizeof(*p));
188
189         for (i = 0; i < SYM_NUM; i++) {
190                 rc = symtab_init(&p->symtab[i], symtab_sizes[i]);
191                 if (rc)
192                         goto out_free_symtab;
193         }
194
195         rc = avtab_init(&p->te_avtab);
196         if (rc)
197                 goto out_free_symtab;
198
199         rc = roles_init(p);
200         if (rc)
201                 goto out_free_symtab;
202
203         rc = cond_policydb_init(p);
204         if (rc)
205                 goto out_free_symtab;
206
207         ebitmap_init(&p->policycaps);
208         ebitmap_init(&p->permissive_map);
209
210 out:
211         return rc;
212
213 out_free_symtab:
214         for (i = 0; i < SYM_NUM; i++)
215                 hashtab_destroy(p->symtab[i].table);
216         goto out;
217 }
218
219 /*
220  * The following *_index functions are used to
221  * define the val_to_name and val_to_struct arrays
222  * in a policy database structure.  The val_to_name
223  * arrays are used when converting security context
224  * structures into string representations.  The
225  * val_to_struct arrays are used when the attributes
226  * of a class, role, or user are needed.
227  */
228
229 static int common_index(void *key, void *datum, void *datap)
230 {
231         struct policydb *p;
232         struct common_datum *comdatum;
233
234         comdatum = datum;
235         p = datap;
236         if (!comdatum->value || comdatum->value > p->p_commons.nprim)
237                 return -EINVAL;
238         p->p_common_val_to_name[comdatum->value - 1] = key;
239         return 0;
240 }
241
242 static int class_index(void *key, void *datum, void *datap)
243 {
244         struct policydb *p;
245         struct class_datum *cladatum;
246
247         cladatum = datum;
248         p = datap;
249         if (!cladatum->value || cladatum->value > p->p_classes.nprim)
250                 return -EINVAL;
251         p->p_class_val_to_name[cladatum->value - 1] = key;
252         p->class_val_to_struct[cladatum->value - 1] = cladatum;
253         return 0;
254 }
255
256 static int role_index(void *key, void *datum, void *datap)
257 {
258         struct policydb *p;
259         struct role_datum *role;
260
261         role = datum;
262         p = datap;
263         if (!role->value
264             || role->value > p->p_roles.nprim
265             || role->bounds > p->p_roles.nprim)
266                 return -EINVAL;
267         p->p_role_val_to_name[role->value - 1] = key;
268         p->role_val_to_struct[role->value - 1] = role;
269         return 0;
270 }
271
272 static int type_index(void *key, void *datum, void *datap)
273 {
274         struct policydb *p;
275         struct type_datum *typdatum;
276
277         typdatum = datum;
278         p = datap;
279
280         if (typdatum->primary) {
281                 if (!typdatum->value
282                     || typdatum->value > p->p_types.nprim
283                     || typdatum->bounds > p->p_types.nprim)
284                         return -EINVAL;
285                 p->p_type_val_to_name[typdatum->value - 1] = key;
286                 p->type_val_to_struct[typdatum->value - 1] = typdatum;
287         }
288
289         return 0;
290 }
291
292 static int user_index(void *key, void *datum, void *datap)
293 {
294         struct policydb *p;
295         struct user_datum *usrdatum;
296
297         usrdatum = datum;
298         p = datap;
299         if (!usrdatum->value
300             || usrdatum->value > p->p_users.nprim
301             || usrdatum->bounds > p->p_users.nprim)
302                 return -EINVAL;
303         p->p_user_val_to_name[usrdatum->value - 1] = key;
304         p->user_val_to_struct[usrdatum->value - 1] = usrdatum;
305         return 0;
306 }
307
308 static int sens_index(void *key, void *datum, void *datap)
309 {
310         struct policydb *p;
311         struct level_datum *levdatum;
312
313         levdatum = datum;
314         p = datap;
315
316         if (!levdatum->isalias) {
317                 if (!levdatum->level->sens ||
318                     levdatum->level->sens > p->p_levels.nprim)
319                         return -EINVAL;
320                 p->p_sens_val_to_name[levdatum->level->sens - 1] = key;
321         }
322
323         return 0;
324 }
325
326 static int cat_index(void *key, void *datum, void *datap)
327 {
328         struct policydb *p;
329         struct cat_datum *catdatum;
330
331         catdatum = datum;
332         p = datap;
333
334         if (!catdatum->isalias) {
335                 if (!catdatum->value || catdatum->value > p->p_cats.nprim)
336                         return -EINVAL;
337                 p->p_cat_val_to_name[catdatum->value - 1] = key;
338         }
339
340         return 0;
341 }
342
343 static int (*index_f[SYM_NUM]) (void *key, void *datum, void *datap) =
344 {
345         common_index,
346         class_index,
347         role_index,
348         type_index,
349         user_index,
350         cond_index_bool,
351         sens_index,
352         cat_index,
353 };
354
355 /*
356  * Define the common val_to_name array and the class
357  * val_to_name and val_to_struct arrays in a policy
358  * database structure.
359  *
360  * Caller must clean up upon failure.
361  */
362 static int policydb_index_classes(struct policydb *p)
363 {
364         int rc;
365
366         p->p_common_val_to_name =
367                 kmalloc(p->p_commons.nprim * sizeof(char *), GFP_KERNEL);
368         if (!p->p_common_val_to_name) {
369                 rc = -ENOMEM;
370                 goto out;
371         }
372
373         rc = hashtab_map(p->p_commons.table, common_index, p);
374         if (rc)
375                 goto out;
376
377         p->class_val_to_struct =
378                 kmalloc(p->p_classes.nprim * sizeof(*(p->class_val_to_struct)), GFP_KERNEL);
379         if (!p->class_val_to_struct) {
380                 rc = -ENOMEM;
381                 goto out;
382         }
383
384         p->p_class_val_to_name =
385                 kmalloc(p->p_classes.nprim * sizeof(char *), GFP_KERNEL);
386         if (!p->p_class_val_to_name) {
387                 rc = -ENOMEM;
388                 goto out;
389         }
390
391         rc = hashtab_map(p->p_classes.table, class_index, p);
392 out:
393         return rc;
394 }
395
396 #ifdef DEBUG_HASHES
397 static void symtab_hash_eval(struct symtab *s)
398 {
399         int i;
400
401         for (i = 0; i < SYM_NUM; i++) {
402                 struct hashtab *h = s[i].table;
403                 struct hashtab_info info;
404
405                 hashtab_stat(h, &info);
406                 printk(KERN_DEBUG "SELinux: %s:  %d entries and %d/%d buckets used, "
407                        "longest chain length %d\n", symtab_name[i], h->nel,
408                        info.slots_used, h->size, info.max_chain_len);
409         }
410 }
411 #endif
412
413 /*
414  * Define the other val_to_name and val_to_struct arrays
415  * in a policy database structure.
416  *
417  * Caller must clean up on failure.
418  */
419 static int policydb_index_others(struct policydb *p)
420 {
421         int i, rc = 0;
422
423         printk(KERN_DEBUG "SELinux:  %d users, %d roles, %d types, %d bools",
424                p->p_users.nprim, p->p_roles.nprim, p->p_types.nprim, p->p_bools.nprim);
425         if (selinux_mls_enabled)
426                 printk(", %d sens, %d cats", p->p_levels.nprim,
427                        p->p_cats.nprim);
428         printk("\n");
429
430         printk(KERN_DEBUG "SELinux:  %d classes, %d rules\n",
431                p->p_classes.nprim, p->te_avtab.nel);
432
433 #ifdef DEBUG_HASHES
434         avtab_hash_eval(&p->te_avtab, "rules");
435         symtab_hash_eval(p->symtab);
436 #endif
437
438         p->role_val_to_struct =
439                 kmalloc(p->p_roles.nprim * sizeof(*(p->role_val_to_struct)),
440                         GFP_KERNEL);
441         if (!p->role_val_to_struct) {
442                 rc = -ENOMEM;
443                 goto out;
444         }
445
446         p->user_val_to_struct =
447                 kmalloc(p->p_users.nprim * sizeof(*(p->user_val_to_struct)),
448                         GFP_KERNEL);
449         if (!p->user_val_to_struct) {
450                 rc = -ENOMEM;
451                 goto out;
452         }
453
454         p->type_val_to_struct =
455                 kmalloc(p->p_types.nprim * sizeof(*(p->type_val_to_struct)),
456                         GFP_KERNEL);
457         if (!p->type_val_to_struct) {
458                 rc = -ENOMEM;
459                 goto out;
460         }
461
462         if (cond_init_bool_indexes(p)) {
463                 rc = -ENOMEM;
464                 goto out;
465         }
466
467         for (i = SYM_ROLES; i < SYM_NUM; i++) {
468                 p->sym_val_to_name[i] =
469                         kmalloc(p->symtab[i].nprim * sizeof(char *), GFP_KERNEL);
470                 if (!p->sym_val_to_name[i]) {
471                         rc = -ENOMEM;
472                         goto out;
473                 }
474                 rc = hashtab_map(p->symtab[i].table, index_f[i], p);
475                 if (rc)
476                         goto out;
477         }
478
479 out:
480         return rc;
481 }
482
483 /*
484  * The following *_destroy functions are used to
485  * free any memory allocated for each kind of
486  * symbol data in the policy database.
487  */
488
489 static int perm_destroy(void *key, void *datum, void *p)
490 {
491         kfree(key);
492         kfree(datum);
493         return 0;
494 }
495
496 static int common_destroy(void *key, void *datum, void *p)
497 {
498         struct common_datum *comdatum;
499
500         kfree(key);
501         comdatum = datum;
502         hashtab_map(comdatum->permissions.table, perm_destroy, NULL);
503         hashtab_destroy(comdatum->permissions.table);
504         kfree(datum);
505         return 0;
506 }
507
508 static int cls_destroy(void *key, void *datum, void *p)
509 {
510         struct class_datum *cladatum;
511         struct constraint_node *constraint, *ctemp;
512         struct constraint_expr *e, *etmp;
513
514         kfree(key);
515         cladatum = datum;
516         hashtab_map(cladatum->permissions.table, perm_destroy, NULL);
517         hashtab_destroy(cladatum->permissions.table);
518         constraint = cladatum->constraints;
519         while (constraint) {
520                 e = constraint->expr;
521                 while (e) {
522                         ebitmap_destroy(&e->names);
523                         etmp = e;
524                         e = e->next;
525                         kfree(etmp);
526                 }
527                 ctemp = constraint;
528                 constraint = constraint->next;
529                 kfree(ctemp);
530         }
531
532         constraint = cladatum->validatetrans;
533         while (constraint) {
534                 e = constraint->expr;
535                 while (e) {
536                         ebitmap_destroy(&e->names);
537                         etmp = e;
538                         e = e->next;
539                         kfree(etmp);
540                 }
541                 ctemp = constraint;
542                 constraint = constraint->next;
543                 kfree(ctemp);
544         }
545
546         kfree(cladatum->comkey);
547         kfree(datum);
548         return 0;
549 }
550
551 static int role_destroy(void *key, void *datum, void *p)
552 {
553         struct role_datum *role;
554
555         kfree(key);
556         role = datum;
557         ebitmap_destroy(&role->dominates);
558         ebitmap_destroy(&role->types);
559         kfree(datum);
560         return 0;
561 }
562
563 static int type_destroy(void *key, void *datum, void *p)
564 {
565         kfree(key);
566         kfree(datum);
567         return 0;
568 }
569
570 static int user_destroy(void *key, void *datum, void *p)
571 {
572         struct user_datum *usrdatum;
573
574         kfree(key);
575         usrdatum = datum;
576         ebitmap_destroy(&usrdatum->roles);
577         ebitmap_destroy(&usrdatum->range.level[0].cat);
578         ebitmap_destroy(&usrdatum->range.level[1].cat);
579         ebitmap_destroy(&usrdatum->dfltlevel.cat);
580         kfree(datum);
581         return 0;
582 }
583
584 static int sens_destroy(void *key, void *datum, void *p)
585 {
586         struct level_datum *levdatum;
587
588         kfree(key);
589         levdatum = datum;
590         ebitmap_destroy(&levdatum->level->cat);
591         kfree(levdatum->level);
592         kfree(datum);
593         return 0;
594 }
595
596 static int cat_destroy(void *key, void *datum, void *p)
597 {
598         kfree(key);
599         kfree(datum);
600         return 0;
601 }
602
603 static int (*destroy_f[SYM_NUM]) (void *key, void *datum, void *datap) =
604 {
605         common_destroy,
606         cls_destroy,
607         role_destroy,
608         type_destroy,
609         user_destroy,
610         cond_destroy_bool,
611         sens_destroy,
612         cat_destroy,
613 };
614
615 static void ocontext_destroy(struct ocontext *c, int i)
616 {
617         context_destroy(&c->context[0]);
618         context_destroy(&c->context[1]);
619         if (i == OCON_ISID || i == OCON_FS ||
620             i == OCON_NETIF || i == OCON_FSUSE)
621                 kfree(c->u.name);
622         kfree(c);
623 }
624
625 /*
626  * Free any memory allocated by a policy database structure.
627  */
628 void policydb_destroy(struct policydb *p)
629 {
630         struct ocontext *c, *ctmp;
631         struct genfs *g, *gtmp;
632         int i;
633         struct role_allow *ra, *lra = NULL;
634         struct role_trans *tr, *ltr = NULL;
635         struct range_trans *rt, *lrt = NULL;
636
637         for (i = 0; i < SYM_NUM; i++) {
638                 cond_resched();
639                 hashtab_map(p->symtab[i].table, destroy_f[i], NULL);
640                 hashtab_destroy(p->symtab[i].table);
641         }
642
643         for (i = 0; i < SYM_NUM; i++)
644                 kfree(p->sym_val_to_name[i]);
645
646         kfree(p->class_val_to_struct);
647         kfree(p->role_val_to_struct);
648         kfree(p->user_val_to_struct);
649         kfree(p->type_val_to_struct);
650
651         avtab_destroy(&p->te_avtab);
652
653         for (i = 0; i < OCON_NUM; i++) {
654                 cond_resched();
655                 c = p->ocontexts[i];
656                 while (c) {
657                         ctmp = c;
658                         c = c->next;
659                         ocontext_destroy(ctmp, i);
660                 }
661                 p->ocontexts[i] = NULL;
662         }
663
664         g = p->genfs;
665         while (g) {
666                 cond_resched();
667                 kfree(g->fstype);
668                 c = g->head;
669                 while (c) {
670                         ctmp = c;
671                         c = c->next;
672                         ocontext_destroy(ctmp, OCON_FSUSE);
673                 }
674                 gtmp = g;
675                 g = g->next;
676                 kfree(gtmp);
677         }
678         p->genfs = NULL;
679
680         cond_policydb_destroy(p);
681
682         for (tr = p->role_tr; tr; tr = tr->next) {
683                 cond_resched();
684                 kfree(ltr);
685                 ltr = tr;
686         }
687         kfree(ltr);
688
689         for (ra = p->role_allow; ra; ra = ra->next) {
690                 cond_resched();
691                 kfree(lra);
692                 lra = ra;
693         }
694         kfree(lra);
695
696         for (rt = p->range_tr; rt; rt = rt->next) {
697                 cond_resched();
698                 if (lrt) {
699                         ebitmap_destroy(&lrt->target_range.level[0].cat);
700                         ebitmap_destroy(&lrt->target_range.level[1].cat);
701                         kfree(lrt);
702                 }
703                 lrt = rt;
704         }
705         if (lrt) {
706                 ebitmap_destroy(&lrt->target_range.level[0].cat);
707                 ebitmap_destroy(&lrt->target_range.level[1].cat);
708                 kfree(lrt);
709         }
710
711         if (p->type_attr_map) {
712                 for (i = 0; i < p->p_types.nprim; i++)
713                         ebitmap_destroy(&p->type_attr_map[i]);
714         }
715         kfree(p->type_attr_map);
716         kfree(p->undefined_perms);
717         ebitmap_destroy(&p->policycaps);
718         ebitmap_destroy(&p->permissive_map);
719
720         return;
721 }
722
723 /*
724  * Load the initial SIDs specified in a policy database
725  * structure into a SID table.
726  */
727 int policydb_load_isids(struct policydb *p, struct sidtab *s)
728 {
729         struct ocontext *head, *c;
730         int rc;
731
732         rc = sidtab_init(s);
733         if (rc) {
734                 printk(KERN_ERR "SELinux:  out of memory on SID table init\n");
735                 goto out;
736         }
737
738         head = p->ocontexts[OCON_ISID];
739         for (c = head; c; c = c->next) {
740                 if (!c->context[0].user) {
741                         printk(KERN_ERR "SELinux:  SID %s was never "
742                                "defined.\n", c->u.name);
743                         rc = -EINVAL;
744                         goto out;
745                 }
746                 if (sidtab_insert(s, c->sid[0], &c->context[0])) {
747                         printk(KERN_ERR "SELinux:  unable to load initial "
748                                "SID %s.\n", c->u.name);
749                         rc = -EINVAL;
750                         goto out;
751                 }
752         }
753 out:
754         return rc;
755 }
756
757 int policydb_class_isvalid(struct policydb *p, unsigned int class)
758 {
759         if (!class || class > p->p_classes.nprim)
760                 return 0;
761         return 1;
762 }
763
764 int policydb_role_isvalid(struct policydb *p, unsigned int role)
765 {
766         if (!role || role > p->p_roles.nprim)
767                 return 0;
768         return 1;
769 }
770
771 int policydb_type_isvalid(struct policydb *p, unsigned int type)
772 {
773         if (!type || type > p->p_types.nprim)
774                 return 0;
775         return 1;
776 }
777
778 /*
779  * Return 1 if the fields in the security context
780  * structure `c' are valid.  Return 0 otherwise.
781  */
782 int policydb_context_isvalid(struct policydb *p, struct context *c)
783 {
784         struct role_datum *role;
785         struct user_datum *usrdatum;
786
787         if (!c->role || c->role > p->p_roles.nprim)
788                 return 0;
789
790         if (!c->user || c->user > p->p_users.nprim)
791                 return 0;
792
793         if (!c->type || c->type > p->p_types.nprim)
794                 return 0;
795
796         if (c->role != OBJECT_R_VAL) {
797                 /*
798                  * Role must be authorized for the type.
799                  */
800                 role = p->role_val_to_struct[c->role - 1];
801                 if (!ebitmap_get_bit(&role->types,
802                                      c->type - 1))
803                         /* role may not be associated with type */
804                         return 0;
805
806                 /*
807                  * User must be authorized for the role.
808                  */
809                 usrdatum = p->user_val_to_struct[c->user - 1];
810                 if (!usrdatum)
811                         return 0;
812
813                 if (!ebitmap_get_bit(&usrdatum->roles,
814                                      c->role - 1))
815                         /* user may not be associated with role */
816                         return 0;
817         }
818
819         if (!mls_context_isvalid(p, c))
820                 return 0;
821
822         return 1;
823 }
824
825 /*
826  * Read a MLS range structure from a policydb binary
827  * representation file.
828  */
829 static int mls_read_range_helper(struct mls_range *r, void *fp)
830 {
831         __le32 buf[2];
832         u32 items;
833         int rc;
834
835         rc = next_entry(buf, fp, sizeof(u32));
836         if (rc < 0)
837                 goto out;
838
839         items = le32_to_cpu(buf[0]);
840         if (items > ARRAY_SIZE(buf)) {
841                 printk(KERN_ERR "SELinux: mls:  range overflow\n");
842                 rc = -EINVAL;
843                 goto out;
844         }
845         rc = next_entry(buf, fp, sizeof(u32) * items);
846         if (rc < 0) {
847                 printk(KERN_ERR "SELinux: mls:  truncated range\n");
848                 goto out;
849         }
850         r->level[0].sens = le32_to_cpu(buf[0]);
851         if (items > 1)
852                 r->level[1].sens = le32_to_cpu(buf[1]);
853         else
854                 r->level[1].sens = r->level[0].sens;
855
856         rc = ebitmap_read(&r->level[0].cat, fp);
857         if (rc) {
858                 printk(KERN_ERR "SELinux: mls:  error reading low "
859                        "categories\n");
860                 goto out;
861         }
862         if (items > 1) {
863                 rc = ebitmap_read(&r->level[1].cat, fp);
864                 if (rc) {
865                         printk(KERN_ERR "SELinux: mls:  error reading high "
866                                "categories\n");
867                         goto bad_high;
868                 }
869         } else {
870                 rc = ebitmap_cpy(&r->level[1].cat, &r->level[0].cat);
871                 if (rc) {
872                         printk(KERN_ERR "SELinux: mls:  out of memory\n");
873                         goto bad_high;
874                 }
875         }
876
877         rc = 0;
878 out:
879         return rc;
880 bad_high:
881         ebitmap_destroy(&r->level[0].cat);
882         goto out;
883 }
884
885 /*
886  * Read and validate a security context structure
887  * from a policydb binary representation file.
888  */
889 static int context_read_and_validate(struct context *c,
890                                      struct policydb *p,
891                                      void *fp)
892 {
893         __le32 buf[3];
894         int rc;
895
896         rc = next_entry(buf, fp, sizeof buf);
897         if (rc < 0) {
898                 printk(KERN_ERR "SELinux: context truncated\n");
899                 goto out;
900         }
901         c->user = le32_to_cpu(buf[0]);
902         c->role = le32_to_cpu(buf[1]);
903         c->type = le32_to_cpu(buf[2]);
904         if (p->policyvers >= POLICYDB_VERSION_MLS) {
905                 if (mls_read_range_helper(&c->range, fp)) {
906                         printk(KERN_ERR "SELinux: error reading MLS range of "
907                                "context\n");
908                         rc = -EINVAL;
909                         goto out;
910                 }
911         }
912
913         if (!policydb_context_isvalid(p, c)) {
914                 printk(KERN_ERR "SELinux:  invalid security context\n");
915                 context_destroy(c);
916                 rc = -EINVAL;
917         }
918 out:
919         return rc;
920 }
921
922 /*
923  * The following *_read functions are used to
924  * read the symbol data from a policy database
925  * binary representation file.
926  */
927
928 static int perm_read(struct policydb *p, struct hashtab *h, void *fp)
929 {
930         char *key = NULL;
931         struct perm_datum *perdatum;
932         int rc;
933         __le32 buf[2];
934         u32 len;
935
936         perdatum = kzalloc(sizeof(*perdatum), GFP_KERNEL);
937         if (!perdatum) {
938                 rc = -ENOMEM;
939                 goto out;
940         }
941
942         rc = next_entry(buf, fp, sizeof buf);
943         if (rc < 0)
944                 goto bad;
945
946         len = le32_to_cpu(buf[0]);
947         perdatum->value = le32_to_cpu(buf[1]);
948
949         key = kmalloc(len + 1, GFP_KERNEL);
950         if (!key) {
951                 rc = -ENOMEM;
952                 goto bad;
953         }
954         rc = next_entry(key, fp, len);
955         if (rc < 0)
956                 goto bad;
957         key[len] = '\0';
958
959         rc = hashtab_insert(h, key, perdatum);
960         if (rc)
961                 goto bad;
962 out:
963         return rc;
964 bad:
965         perm_destroy(key, perdatum, NULL);
966         goto out;
967 }
968
969 static int common_read(struct policydb *p, struct hashtab *h, void *fp)
970 {
971         char *key = NULL;
972         struct common_datum *comdatum;
973         __le32 buf[4];
974         u32 len, nel;
975         int i, rc;
976
977         comdatum = kzalloc(sizeof(*comdatum), GFP_KERNEL);
978         if (!comdatum) {
979                 rc = -ENOMEM;
980                 goto out;
981         }
982
983         rc = next_entry(buf, fp, sizeof buf);
984         if (rc < 0)
985                 goto bad;
986
987         len = le32_to_cpu(buf[0]);
988         comdatum->value = le32_to_cpu(buf[1]);
989
990         rc = symtab_init(&comdatum->permissions, PERM_SYMTAB_SIZE);
991         if (rc)
992                 goto bad;
993         comdatum->permissions.nprim = le32_to_cpu(buf[2]);
994         nel = le32_to_cpu(buf[3]);
995
996         key = kmalloc(len + 1, GFP_KERNEL);
997         if (!key) {
998                 rc = -ENOMEM;
999                 goto bad;
1000         }
1001         rc = next_entry(key, fp, len);
1002         if (rc < 0)
1003                 goto bad;
1004         key[len] = '\0';
1005
1006         for (i = 0; i < nel; i++) {
1007                 rc = perm_read(p, comdatum->permissions.table, fp);
1008                 if (rc)
1009                         goto bad;
1010         }
1011
1012         rc = hashtab_insert(h, key, comdatum);
1013         if (rc)
1014                 goto bad;
1015 out:
1016         return rc;
1017 bad:
1018         common_destroy(key, comdatum, NULL);
1019         goto out;
1020 }
1021
1022 static int read_cons_helper(struct constraint_node **nodep, int ncons,
1023                             int allowxtarget, void *fp)
1024 {
1025         struct constraint_node *c, *lc;
1026         struct constraint_expr *e, *le;
1027         __le32 buf[3];
1028         u32 nexpr;
1029         int rc, i, j, depth;
1030
1031         lc = NULL;
1032         for (i = 0; i < ncons; i++) {
1033                 c = kzalloc(sizeof(*c), GFP_KERNEL);
1034                 if (!c)
1035                         return -ENOMEM;
1036
1037                 if (lc)
1038                         lc->next = c;
1039                 else
1040                         *nodep = c;
1041
1042                 rc = next_entry(buf, fp, (sizeof(u32) * 2));
1043                 if (rc < 0)
1044                         return rc;
1045                 c->permissions = le32_to_cpu(buf[0]);
1046                 nexpr = le32_to_cpu(buf[1]);
1047                 le = NULL;
1048                 depth = -1;
1049                 for (j = 0; j < nexpr; j++) {
1050                         e = kzalloc(sizeof(*e), GFP_KERNEL);
1051                         if (!e)
1052                                 return -ENOMEM;
1053
1054                         if (le)
1055                                 le->next = e;
1056                         else
1057                                 c->expr = e;
1058
1059                         rc = next_entry(buf, fp, (sizeof(u32) * 3));
1060                         if (rc < 0)
1061                                 return rc;
1062                         e->expr_type = le32_to_cpu(buf[0]);
1063                         e->attr = le32_to_cpu(buf[1]);
1064                         e->op = le32_to_cpu(buf[2]);
1065
1066                         switch (e->expr_type) {
1067                         case CEXPR_NOT:
1068                                 if (depth < 0)
1069                                         return -EINVAL;
1070                                 break;
1071                         case CEXPR_AND:
1072                         case CEXPR_OR:
1073                                 if (depth < 1)
1074                                         return -EINVAL;
1075                                 depth--;
1076                                 break;
1077                         case CEXPR_ATTR:
1078                                 if (depth == (CEXPR_MAXDEPTH - 1))
1079                                         return -EINVAL;
1080                                 depth++;
1081                                 break;
1082                         case CEXPR_NAMES:
1083                                 if (!allowxtarget && (e->attr & CEXPR_XTARGET))
1084                                         return -EINVAL;
1085                                 if (depth == (CEXPR_MAXDEPTH - 1))
1086                                         return -EINVAL;
1087                                 depth++;
1088                                 if (ebitmap_read(&e->names, fp))
1089                                         return -EINVAL;
1090                                 break;
1091                         default:
1092                                 return -EINVAL;
1093                         }
1094                         le = e;
1095                 }
1096                 if (depth != 0)
1097                         return -EINVAL;
1098                 lc = c;
1099         }
1100
1101         return 0;
1102 }
1103
1104 static int class_read(struct policydb *p, struct hashtab *h, void *fp)
1105 {
1106         char *key = NULL;
1107         struct class_datum *cladatum;
1108         __le32 buf[6];
1109         u32 len, len2, ncons, nel;
1110         int i, rc;
1111
1112         cladatum = kzalloc(sizeof(*cladatum), GFP_KERNEL);
1113         if (!cladatum) {
1114                 rc = -ENOMEM;
1115                 goto out;
1116         }
1117
1118         rc = next_entry(buf, fp, sizeof(u32)*6);
1119         if (rc < 0)
1120                 goto bad;
1121
1122         len = le32_to_cpu(buf[0]);
1123         len2 = le32_to_cpu(buf[1]);
1124         cladatum->value = le32_to_cpu(buf[2]);
1125
1126         rc = symtab_init(&cladatum->permissions, PERM_SYMTAB_SIZE);
1127         if (rc)
1128                 goto bad;
1129         cladatum->permissions.nprim = le32_to_cpu(buf[3]);
1130         nel = le32_to_cpu(buf[4]);
1131
1132         ncons = le32_to_cpu(buf[5]);
1133
1134         key = kmalloc(len + 1, GFP_KERNEL);
1135         if (!key) {
1136                 rc = -ENOMEM;
1137                 goto bad;
1138         }
1139         rc = next_entry(key, fp, len);
1140         if (rc < 0)
1141                 goto bad;
1142         key[len] = '\0';
1143
1144         if (len2) {
1145                 cladatum->comkey = kmalloc(len2 + 1, GFP_KERNEL);
1146                 if (!cladatum->comkey) {
1147                         rc = -ENOMEM;
1148                         goto bad;
1149                 }
1150                 rc = next_entry(cladatum->comkey, fp, len2);
1151                 if (rc < 0)
1152                         goto bad;
1153                 cladatum->comkey[len2] = '\0';
1154
1155                 cladatum->comdatum = hashtab_search(p->p_commons.table,
1156                                                     cladatum->comkey);
1157                 if (!cladatum->comdatum) {
1158                         printk(KERN_ERR "SELinux:  unknown common %s\n",
1159                                cladatum->comkey);
1160                         rc = -EINVAL;
1161                         goto bad;
1162                 }
1163         }
1164         for (i = 0; i < nel; i++) {
1165                 rc = perm_read(p, cladatum->permissions.table, fp);
1166                 if (rc)
1167                         goto bad;
1168         }
1169
1170         rc = read_cons_helper(&cladatum->constraints, ncons, 0, fp);
1171         if (rc)
1172                 goto bad;
1173
1174         if (p->policyvers >= POLICYDB_VERSION_VALIDATETRANS) {
1175                 /* grab the validatetrans rules */
1176                 rc = next_entry(buf, fp, sizeof(u32));
1177                 if (rc < 0)
1178                         goto bad;
1179                 ncons = le32_to_cpu(buf[0]);
1180                 rc = read_cons_helper(&cladatum->validatetrans, ncons, 1, fp);
1181                 if (rc)
1182                         goto bad;
1183         }
1184
1185         rc = hashtab_insert(h, key, cladatum);
1186         if (rc)
1187                 goto bad;
1188
1189         rc = 0;
1190 out:
1191         return rc;
1192 bad:
1193         cls_destroy(key, cladatum, NULL);
1194         goto out;
1195 }
1196
1197 static int role_read(struct policydb *p, struct hashtab *h, void *fp)
1198 {
1199         char *key = NULL;
1200         struct role_datum *role;
1201         int rc, to_read = 2;
1202         __le32 buf[3];
1203         u32 len;
1204
1205         role = kzalloc(sizeof(*role), GFP_KERNEL);
1206         if (!role) {
1207                 rc = -ENOMEM;
1208                 goto out;
1209         }
1210
1211         if (p->policyvers >= POLICYDB_VERSION_BOUNDARY)
1212                 to_read = 3;
1213
1214         rc = next_entry(buf, fp, sizeof(buf[0]) * to_read);
1215         if (rc < 0)
1216                 goto bad;
1217
1218         len = le32_to_cpu(buf[0]);
1219         role->value = le32_to_cpu(buf[1]);
1220         if (p->policyvers >= POLICYDB_VERSION_BOUNDARY)
1221                 role->bounds = le32_to_cpu(buf[2]);
1222
1223         key = kmalloc(len + 1, GFP_KERNEL);
1224         if (!key) {
1225                 rc = -ENOMEM;
1226                 goto bad;
1227         }
1228         rc = next_entry(key, fp, len);
1229         if (rc < 0)
1230                 goto bad;
1231         key[len] = '\0';
1232
1233         rc = ebitmap_read(&role->dominates, fp);
1234         if (rc)
1235                 goto bad;
1236
1237         rc = ebitmap_read(&role->types, fp);
1238         if (rc)
1239                 goto bad;
1240
1241         if (strcmp(key, OBJECT_R) == 0) {
1242                 if (role->value != OBJECT_R_VAL) {
1243                         printk(KERN_ERR "SELinux: Role %s has wrong value %d\n",
1244                                OBJECT_R, role->value);
1245                         rc = -EINVAL;
1246                         goto bad;
1247                 }
1248                 rc = 0;
1249                 goto bad;
1250         }
1251
1252         rc = hashtab_insert(h, key, role);
1253         if (rc)
1254                 goto bad;
1255 out:
1256         return rc;
1257 bad:
1258         role_destroy(key, role, NULL);
1259         goto out;
1260 }
1261
1262 static int type_read(struct policydb *p, struct hashtab *h, void *fp)
1263 {
1264         char *key = NULL;
1265         struct type_datum *typdatum;
1266         int rc, to_read = 3;
1267         __le32 buf[4];
1268         u32 len;
1269
1270         typdatum = kzalloc(sizeof(*typdatum), GFP_KERNEL);
1271         if (!typdatum) {
1272                 rc = -ENOMEM;
1273                 return rc;
1274         }
1275
1276         if (p->policyvers >= POLICYDB_VERSION_BOUNDARY)
1277                 to_read = 4;
1278
1279         rc = next_entry(buf, fp, sizeof(buf[0]) * to_read);
1280         if (rc < 0)
1281                 goto bad;
1282
1283         len = le32_to_cpu(buf[0]);
1284         typdatum->value = le32_to_cpu(buf[1]);
1285         if (p->policyvers >= POLICYDB_VERSION_BOUNDARY) {
1286                 u32 prop = le32_to_cpu(buf[2]);
1287
1288                 if (prop & TYPEDATUM_PROPERTY_PRIMARY)
1289                         typdatum->primary = 1;
1290                 if (prop & TYPEDATUM_PROPERTY_ATTRIBUTE)
1291                         typdatum->attribute = 1;
1292
1293                 typdatum->bounds = le32_to_cpu(buf[3]);
1294         } else {
1295                 typdatum->primary = le32_to_cpu(buf[2]);
1296         }
1297
1298         key = kmalloc(len + 1, GFP_KERNEL);
1299         if (!key) {
1300                 rc = -ENOMEM;
1301                 goto bad;
1302         }
1303         rc = next_entry(key, fp, len);
1304         if (rc < 0)
1305                 goto bad;
1306         key[len] = '\0';
1307
1308         rc = hashtab_insert(h, key, typdatum);
1309         if (rc)
1310                 goto bad;
1311 out:
1312         return rc;
1313 bad:
1314         type_destroy(key, typdatum, NULL);
1315         goto out;
1316 }
1317
1318
1319 /*
1320  * Read a MLS level structure from a policydb binary
1321  * representation file.
1322  */
1323 static int mls_read_level(struct mls_level *lp, void *fp)
1324 {
1325         __le32 buf[1];
1326         int rc;
1327
1328         memset(lp, 0, sizeof(*lp));
1329
1330         rc = next_entry(buf, fp, sizeof buf);
1331         if (rc < 0) {
1332                 printk(KERN_ERR "SELinux: mls: truncated level\n");
1333                 goto bad;
1334         }
1335         lp->sens = le32_to_cpu(buf[0]);
1336
1337         if (ebitmap_read(&lp->cat, fp)) {
1338                 printk(KERN_ERR "SELinux: mls:  error reading level "
1339                        "categories\n");
1340                 goto bad;
1341         }
1342
1343         return 0;
1344
1345 bad:
1346         return -EINVAL;
1347 }
1348
1349 static int user_read(struct policydb *p, struct hashtab *h, void *fp)
1350 {
1351         char *key = NULL;
1352         struct user_datum *usrdatum;
1353         int rc, to_read = 2;
1354         __le32 buf[3];
1355         u32 len;
1356
1357         usrdatum = kzalloc(sizeof(*usrdatum), GFP_KERNEL);
1358         if (!usrdatum) {
1359                 rc = -ENOMEM;
1360                 goto out;
1361         }
1362
1363         if (p->policyvers >= POLICYDB_VERSION_BOUNDARY)
1364                 to_read = 3;
1365
1366         rc = next_entry(buf, fp, sizeof(buf[0]) * to_read);
1367         if (rc < 0)
1368                 goto bad;
1369
1370         len = le32_to_cpu(buf[0]);
1371         usrdatum->value = le32_to_cpu(buf[1]);
1372         if (p->policyvers >= POLICYDB_VERSION_BOUNDARY)
1373                 usrdatum->bounds = le32_to_cpu(buf[2]);
1374
1375         key = kmalloc(len + 1, GFP_KERNEL);
1376         if (!key) {
1377                 rc = -ENOMEM;
1378                 goto bad;
1379         }
1380         rc = next_entry(key, fp, len);
1381         if (rc < 0)
1382                 goto bad;
1383         key[len] = '\0';
1384
1385         rc = ebitmap_read(&usrdatum->roles, fp);
1386         if (rc)
1387                 goto bad;
1388
1389         if (p->policyvers >= POLICYDB_VERSION_MLS) {
1390                 rc = mls_read_range_helper(&usrdatum->range, fp);
1391                 if (rc)
1392                         goto bad;
1393                 rc = mls_read_level(&usrdatum->dfltlevel, fp);
1394                 if (rc)
1395                         goto bad;
1396         }
1397
1398         rc = hashtab_insert(h, key, usrdatum);
1399         if (rc)
1400                 goto bad;
1401 out:
1402         return rc;
1403 bad:
1404         user_destroy(key, usrdatum, NULL);
1405         goto out;
1406 }
1407
1408 static int sens_read(struct policydb *p, struct hashtab *h, void *fp)
1409 {
1410         char *key = NULL;
1411         struct level_datum *levdatum;
1412         int rc;
1413         __le32 buf[2];
1414         u32 len;
1415
1416         levdatum = kzalloc(sizeof(*levdatum), GFP_ATOMIC);
1417         if (!levdatum) {
1418                 rc = -ENOMEM;
1419                 goto out;
1420         }
1421
1422         rc = next_entry(buf, fp, sizeof buf);
1423         if (rc < 0)
1424                 goto bad;
1425
1426         len = le32_to_cpu(buf[0]);
1427         levdatum->isalias = le32_to_cpu(buf[1]);
1428
1429         key = kmalloc(len + 1, GFP_ATOMIC);
1430         if (!key) {
1431                 rc = -ENOMEM;
1432                 goto bad;
1433         }
1434         rc = next_entry(key, fp, len);
1435         if (rc < 0)
1436                 goto bad;
1437         key[len] = '\0';
1438
1439         levdatum->level = kmalloc(sizeof(struct mls_level), GFP_ATOMIC);
1440         if (!levdatum->level) {
1441                 rc = -ENOMEM;
1442                 goto bad;
1443         }
1444         if (mls_read_level(levdatum->level, fp)) {
1445                 rc = -EINVAL;
1446                 goto bad;
1447         }
1448
1449         rc = hashtab_insert(h, key, levdatum);
1450         if (rc)
1451                 goto bad;
1452 out:
1453         return rc;
1454 bad:
1455         sens_destroy(key, levdatum, NULL);
1456         goto out;
1457 }
1458
1459 static int cat_read(struct policydb *p, struct hashtab *h, void *fp)
1460 {
1461         char *key = NULL;
1462         struct cat_datum *catdatum;
1463         int rc;
1464         __le32 buf[3];
1465         u32 len;
1466
1467         catdatum = kzalloc(sizeof(*catdatum), GFP_ATOMIC);
1468         if (!catdatum) {
1469                 rc = -ENOMEM;
1470                 goto out;
1471         }
1472
1473         rc = next_entry(buf, fp, sizeof buf);
1474         if (rc < 0)
1475                 goto bad;
1476
1477         len = le32_to_cpu(buf[0]);
1478         catdatum->value = le32_to_cpu(buf[1]);
1479         catdatum->isalias = le32_to_cpu(buf[2]);
1480
1481         key = kmalloc(len + 1, GFP_ATOMIC);
1482         if (!key) {
1483                 rc = -ENOMEM;
1484                 goto bad;
1485         }
1486         rc = next_entry(key, fp, len);
1487         if (rc < 0)
1488                 goto bad;
1489         key[len] = '\0';
1490
1491         rc = hashtab_insert(h, key, catdatum);
1492         if (rc)
1493                 goto bad;
1494 out:
1495         return rc;
1496
1497 bad:
1498         cat_destroy(key, catdatum, NULL);
1499         goto out;
1500 }
1501
1502 static int (*read_f[SYM_NUM]) (struct policydb *p, struct hashtab *h, void *fp) =
1503 {
1504         common_read,
1505         class_read,
1506         role_read,
1507         type_read,
1508         user_read,
1509         cond_read_bool,
1510         sens_read,
1511         cat_read,
1512 };
1513
1514 static int user_bounds_sanity_check(void *key, void *datum, void *datap)
1515 {
1516         struct user_datum *upper, *user;
1517         struct policydb *p = datap;
1518         int depth = 0;
1519
1520         upper = user = datum;
1521         while (upper->bounds) {
1522                 struct ebitmap_node *node;
1523                 unsigned long bit;
1524
1525                 if (++depth == POLICYDB_BOUNDS_MAXDEPTH) {
1526                         printk(KERN_ERR "SELinux: user %s: "
1527                                "too deep or looped boundary",
1528                                (char *) key);
1529                         return -EINVAL;
1530                 }
1531
1532                 upper = p->user_val_to_struct[upper->bounds - 1];
1533                 ebitmap_for_each_positive_bit(&user->roles, node, bit) {
1534                         if (ebitmap_get_bit(&upper->roles, bit))
1535                                 continue;
1536
1537                         printk(KERN_ERR
1538                                "SELinux: boundary violated policy: "
1539                                "user=%s role=%s bounds=%s\n",
1540                                p->p_user_val_to_name[user->value - 1],
1541                                p->p_role_val_to_name[bit],
1542                                p->p_user_val_to_name[upper->value - 1]);
1543
1544                         return -EINVAL;
1545                 }
1546         }
1547
1548         return 0;
1549 }
1550
1551 static int role_bounds_sanity_check(void *key, void *datum, void *datap)
1552 {
1553         struct role_datum *upper, *role;
1554         struct policydb *p = datap;
1555         int depth = 0;
1556
1557         upper = role = datum;
1558         while (upper->bounds) {
1559                 struct ebitmap_node *node;
1560                 unsigned long bit;
1561
1562                 if (++depth == POLICYDB_BOUNDS_MAXDEPTH) {
1563                         printk(KERN_ERR "SELinux: role %s: "
1564                                "too deep or looped bounds\n",
1565                                (char *) key);
1566                         return -EINVAL;
1567                 }
1568
1569                 upper = p->role_val_to_struct[upper->bounds - 1];
1570                 ebitmap_for_each_positive_bit(&role->types, node, bit) {
1571                         if (ebitmap_get_bit(&upper->types, bit))
1572                                 continue;
1573
1574                         printk(KERN_ERR
1575                                "SELinux: boundary violated policy: "
1576                                "role=%s type=%s bounds=%s\n",
1577                                p->p_role_val_to_name[role->value - 1],
1578                                p->p_type_val_to_name[bit],
1579                                p->p_role_val_to_name[upper->value - 1]);
1580
1581                         return -EINVAL;
1582                 }
1583         }
1584
1585         return 0;
1586 }
1587
1588 static int type_bounds_sanity_check(void *key, void *datum, void *datap)
1589 {
1590         struct type_datum *upper, *type;
1591         struct policydb *p = datap;
1592         int depth = 0;
1593
1594         upper = type = datum;
1595         while (upper->bounds) {
1596                 if (++depth == POLICYDB_BOUNDS_MAXDEPTH) {
1597                         printk(KERN_ERR "SELinux: type %s: "
1598                                "too deep or looped boundary\n",
1599                                (char *) key);
1600                         return -EINVAL;
1601                 }
1602
1603                 upper = p->type_val_to_struct[upper->bounds - 1];
1604                 if (upper->attribute) {
1605                         printk(KERN_ERR "SELinux: type %s: "
1606                                "bounded by attribute %s",
1607                                (char *) key,
1608                                p->p_type_val_to_name[upper->value - 1]);
1609                         return -EINVAL;
1610                 }
1611         }
1612
1613         return 0;
1614 }
1615
1616 static int policydb_bounds_sanity_check(struct policydb *p)
1617 {
1618         int rc;
1619
1620         if (p->policyvers < POLICYDB_VERSION_BOUNDARY)
1621                 return 0;
1622
1623         rc = hashtab_map(p->p_users.table,
1624                          user_bounds_sanity_check, p);
1625         if (rc)
1626                 return rc;
1627
1628         rc = hashtab_map(p->p_roles.table,
1629                          role_bounds_sanity_check, p);
1630         if (rc)
1631                 return rc;
1632
1633         rc = hashtab_map(p->p_types.table,
1634                          type_bounds_sanity_check, p);
1635         if (rc)
1636                 return rc;
1637
1638         return 0;
1639 }
1640
1641 extern int ss_initialized;
1642
1643 /*
1644  * Read the configuration data from a policy database binary
1645  * representation file into a policy database structure.
1646  */
1647 int policydb_read(struct policydb *p, void *fp)
1648 {
1649         struct role_allow *ra, *lra;
1650         struct role_trans *tr, *ltr;
1651         struct ocontext *l, *c, *newc;
1652         struct genfs *genfs_p, *genfs, *newgenfs;
1653         int i, j, rc;
1654         __le32 buf[4];
1655         u32 nodebuf[8];
1656         u32 len, len2, config, nprim, nel, nel2;
1657         char *policydb_str;
1658         struct policydb_compat_info *info;
1659         struct range_trans *rt, *lrt;
1660
1661         config = 0;
1662
1663         rc = policydb_init(p);
1664         if (rc)
1665                 goto out;
1666
1667         /* Read the magic number and string length. */
1668         rc = next_entry(buf, fp, sizeof(u32) * 2);
1669         if (rc < 0)
1670                 goto bad;
1671
1672         if (le32_to_cpu(buf[0]) != POLICYDB_MAGIC) {
1673                 printk(KERN_ERR "SELinux:  policydb magic number 0x%x does "
1674                        "not match expected magic number 0x%x\n",
1675                        le32_to_cpu(buf[0]), POLICYDB_MAGIC);
1676                 goto bad;
1677         }
1678
1679         len = le32_to_cpu(buf[1]);
1680         if (len != strlen(POLICYDB_STRING)) {
1681                 printk(KERN_ERR "SELinux:  policydb string length %d does not "
1682                        "match expected length %Zu\n",
1683                        len, strlen(POLICYDB_STRING));
1684                 goto bad;
1685         }
1686         policydb_str = kmalloc(len + 1, GFP_KERNEL);
1687         if (!policydb_str) {
1688                 printk(KERN_ERR "SELinux:  unable to allocate memory for policydb "
1689                        "string of length %d\n", len);
1690                 rc = -ENOMEM;
1691                 goto bad;
1692         }
1693         rc = next_entry(policydb_str, fp, len);
1694         if (rc < 0) {
1695                 printk(KERN_ERR "SELinux:  truncated policydb string identifier\n");
1696                 kfree(policydb_str);
1697                 goto bad;
1698         }
1699         policydb_str[len] = '\0';
1700         if (strcmp(policydb_str, POLICYDB_STRING)) {
1701                 printk(KERN_ERR "SELinux:  policydb string %s does not match "
1702                        "my string %s\n", policydb_str, POLICYDB_STRING);
1703                 kfree(policydb_str);
1704                 goto bad;
1705         }
1706         /* Done with policydb_str. */
1707         kfree(policydb_str);
1708         policydb_str = NULL;
1709
1710         /* Read the version, config, and table sizes. */
1711         rc = next_entry(buf, fp, sizeof(u32)*4);
1712         if (rc < 0)
1713                 goto bad;
1714
1715         p->policyvers = le32_to_cpu(buf[0]);
1716         if (p->policyvers < POLICYDB_VERSION_MIN ||
1717             p->policyvers > POLICYDB_VERSION_MAX) {
1718                 printk(KERN_ERR "SELinux:  policydb version %d does not match "
1719                        "my version range %d-%d\n",
1720                        le32_to_cpu(buf[0]), POLICYDB_VERSION_MIN, POLICYDB_VERSION_MAX);
1721                 goto bad;
1722         }
1723
1724         if ((le32_to_cpu(buf[1]) & POLICYDB_CONFIG_MLS)) {
1725                 if (ss_initialized && !selinux_mls_enabled) {
1726                         printk(KERN_ERR "SELinux: Cannot switch between non-MLS"
1727                                 " and MLS policies\n");
1728                         goto bad;
1729                 }
1730                 selinux_mls_enabled = 1;
1731                 config |= POLICYDB_CONFIG_MLS;
1732
1733                 if (p->policyvers < POLICYDB_VERSION_MLS) {
1734                         printk(KERN_ERR "SELinux: security policydb version %d "
1735                                 "(MLS) not backwards compatible\n",
1736                                 p->policyvers);
1737                         goto bad;
1738                 }
1739         } else {
1740                 if (ss_initialized && selinux_mls_enabled) {
1741                         printk(KERN_ERR "SELinux: Cannot switch between MLS and"
1742                                 " non-MLS policies\n");
1743                         goto bad;
1744                 }
1745         }
1746         p->reject_unknown = !!(le32_to_cpu(buf[1]) & REJECT_UNKNOWN);
1747         p->allow_unknown = !!(le32_to_cpu(buf[1]) & ALLOW_UNKNOWN);
1748
1749         if (p->policyvers >= POLICYDB_VERSION_POLCAP &&
1750             ebitmap_read(&p->policycaps, fp) != 0)
1751                 goto bad;
1752
1753         if (p->policyvers >= POLICYDB_VERSION_PERMISSIVE &&
1754             ebitmap_read(&p->permissive_map, fp) != 0)
1755                 goto bad;
1756
1757         info = policydb_lookup_compat(p->policyvers);
1758         if (!info) {
1759                 printk(KERN_ERR "SELinux:  unable to find policy compat info "
1760                        "for version %d\n", p->policyvers);
1761                 goto bad;
1762         }
1763
1764         if (le32_to_cpu(buf[2]) != info->sym_num ||
1765                 le32_to_cpu(buf[3]) != info->ocon_num) {
1766                 printk(KERN_ERR "SELinux:  policydb table sizes (%d,%d) do "
1767                        "not match mine (%d,%d)\n", le32_to_cpu(buf[2]),
1768                         le32_to_cpu(buf[3]),
1769                        info->sym_num, info->ocon_num);
1770                 goto bad;
1771         }
1772
1773         for (i = 0; i < info->sym_num; i++) {
1774                 rc = next_entry(buf, fp, sizeof(u32)*2);
1775                 if (rc < 0)
1776                         goto bad;
1777                 nprim = le32_to_cpu(buf[0]);
1778                 nel = le32_to_cpu(buf[1]);
1779                 for (j = 0; j < nel; j++) {
1780                         rc = read_f[i](p, p->symtab[i].table, fp);
1781                         if (rc)
1782                                 goto bad;
1783                 }
1784
1785                 p->symtab[i].nprim = nprim;
1786         }
1787
1788         rc = avtab_read(&p->te_avtab, fp, p);
1789         if (rc)
1790                 goto bad;
1791
1792         if (p->policyvers >= POLICYDB_VERSION_BOOL) {
1793                 rc = cond_read_list(p, fp);
1794                 if (rc)
1795                         goto bad;
1796         }
1797
1798         rc = next_entry(buf, fp, sizeof(u32));
1799         if (rc < 0)
1800                 goto bad;
1801         nel = le32_to_cpu(buf[0]);
1802         ltr = NULL;
1803         for (i = 0; i < nel; i++) {
1804                 tr = kzalloc(sizeof(*tr), GFP_KERNEL);
1805                 if (!tr) {
1806                         rc = -ENOMEM;
1807                         goto bad;
1808                 }
1809                 if (ltr)
1810                         ltr->next = tr;
1811                 else
1812                         p->role_tr = tr;
1813                 rc = next_entry(buf, fp, sizeof(u32)*3);
1814                 if (rc < 0)
1815                         goto bad;
1816                 tr->role = le32_to_cpu(buf[0]);
1817                 tr->type = le32_to_cpu(buf[1]);
1818                 tr->new_role = le32_to_cpu(buf[2]);
1819                 if (!policydb_role_isvalid(p, tr->role) ||
1820                     !policydb_type_isvalid(p, tr->type) ||
1821                     !policydb_role_isvalid(p, tr->new_role)) {
1822                         rc = -EINVAL;
1823                         goto bad;
1824                 }
1825                 ltr = tr;
1826         }
1827
1828         rc = next_entry(buf, fp, sizeof(u32));
1829         if (rc < 0)
1830                 goto bad;
1831         nel = le32_to_cpu(buf[0]);
1832         lra = NULL;
1833         for (i = 0; i < nel; i++) {
1834                 ra = kzalloc(sizeof(*ra), GFP_KERNEL);
1835                 if (!ra) {
1836                         rc = -ENOMEM;
1837                         goto bad;
1838                 }
1839                 if (lra)
1840                         lra->next = ra;
1841                 else
1842                         p->role_allow = ra;
1843                 rc = next_entry(buf, fp, sizeof(u32)*2);
1844                 if (rc < 0)
1845                         goto bad;
1846                 ra->role = le32_to_cpu(buf[0]);
1847                 ra->new_role = le32_to_cpu(buf[1]);
1848                 if (!policydb_role_isvalid(p, ra->role) ||
1849                     !policydb_role_isvalid(p, ra->new_role)) {
1850                         rc = -EINVAL;
1851                         goto bad;
1852                 }
1853                 lra = ra;
1854         }
1855
1856         rc = policydb_index_classes(p);
1857         if (rc)
1858                 goto bad;
1859
1860         rc = policydb_index_others(p);
1861         if (rc)
1862                 goto bad;
1863
1864         for (i = 0; i < info->ocon_num; i++) {
1865                 rc = next_entry(buf, fp, sizeof(u32));
1866                 if (rc < 0)
1867                         goto bad;
1868                 nel = le32_to_cpu(buf[0]);
1869                 l = NULL;
1870                 for (j = 0; j < nel; j++) {
1871                         c = kzalloc(sizeof(*c), GFP_KERNEL);
1872                         if (!c) {
1873                                 rc = -ENOMEM;
1874                                 goto bad;
1875                         }
1876                         if (l)
1877                                 l->next = c;
1878                         else
1879                                 p->ocontexts[i] = c;
1880                         l = c;
1881                         rc = -EINVAL;
1882                         switch (i) {
1883                         case OCON_ISID:
1884                                 rc = next_entry(buf, fp, sizeof(u32));
1885                                 if (rc < 0)
1886                                         goto bad;
1887                                 c->sid[0] = le32_to_cpu(buf[0]);
1888                                 rc = context_read_and_validate(&c->context[0], p, fp);
1889                                 if (rc)
1890                                         goto bad;
1891                                 break;
1892                         case OCON_FS:
1893                         case OCON_NETIF:
1894                                 rc = next_entry(buf, fp, sizeof(u32));
1895                                 if (rc < 0)
1896                                         goto bad;
1897                                 len = le32_to_cpu(buf[0]);
1898                                 c->u.name = kmalloc(len + 1, GFP_KERNEL);
1899                                 if (!c->u.name) {
1900                                         rc = -ENOMEM;
1901                                         goto bad;
1902                                 }
1903                                 rc = next_entry(c->u.name, fp, len);
1904                                 if (rc < 0)
1905                                         goto bad;
1906                                 c->u.name[len] = 0;
1907                                 rc = context_read_and_validate(&c->context[0], p, fp);
1908                                 if (rc)
1909                                         goto bad;
1910                                 rc = context_read_and_validate(&c->context[1], p, fp);
1911                                 if (rc)
1912                                         goto bad;
1913                                 break;
1914                         case OCON_PORT:
1915                                 rc = next_entry(buf, fp, sizeof(u32)*3);
1916                                 if (rc < 0)
1917                                         goto bad;
1918                                 c->u.port.protocol = le32_to_cpu(buf[0]);
1919                                 c->u.port.low_port = le32_to_cpu(buf[1]);
1920                                 c->u.port.high_port = le32_to_cpu(buf[2]);
1921                                 rc = context_read_and_validate(&c->context[0], p, fp);
1922                                 if (rc)
1923                                         goto bad;
1924                                 break;
1925                         case OCON_NODE:
1926                                 rc = next_entry(nodebuf, fp, sizeof(u32) * 2);
1927                                 if (rc < 0)
1928                                         goto bad;
1929                                 c->u.node.addr = nodebuf[0]; /* network order */
1930                                 c->u.node.mask = nodebuf[1]; /* network order */
1931                                 rc = context_read_and_validate(&c->context[0], p, fp);
1932                                 if (rc)
1933                                         goto bad;
1934                                 break;
1935                         case OCON_FSUSE:
1936                                 rc = next_entry(buf, fp, sizeof(u32)*2);
1937                                 if (rc < 0)
1938                                         goto bad;
1939                                 c->v.behavior = le32_to_cpu(buf[0]);
1940                                 if (c->v.behavior > SECURITY_FS_USE_NONE)
1941                                         goto bad;
1942                                 len = le32_to_cpu(buf[1]);
1943                                 c->u.name = kmalloc(len + 1, GFP_KERNEL);
1944                                 if (!c->u.name) {
1945                                         rc = -ENOMEM;
1946                                         goto bad;
1947                                 }
1948                                 rc = next_entry(c->u.name, fp, len);
1949                                 if (rc < 0)
1950                                         goto bad;
1951                                 c->u.name[len] = 0;
1952                                 rc = context_read_and_validate(&c->context[0], p, fp);
1953                                 if (rc)
1954                                         goto bad;
1955                                 break;
1956                         case OCON_NODE6: {
1957                                 int k;
1958
1959                                 rc = next_entry(nodebuf, fp, sizeof(u32) * 8);
1960                                 if (rc < 0)
1961                                         goto bad;
1962                                 for (k = 0; k < 4; k++)
1963                                         c->u.node6.addr[k] = nodebuf[k];
1964                                 for (k = 0; k < 4; k++)
1965                                         c->u.node6.mask[k] = nodebuf[k+4];
1966                                 if (context_read_and_validate(&c->context[0], p, fp))
1967                                         goto bad;
1968                                 break;
1969                         }
1970                         }
1971                 }
1972         }
1973
1974         rc = next_entry(buf, fp, sizeof(u32));
1975         if (rc < 0)
1976                 goto bad;
1977         nel = le32_to_cpu(buf[0]);
1978         genfs_p = NULL;
1979         rc = -EINVAL;
1980         for (i = 0; i < nel; i++) {
1981                 rc = next_entry(buf, fp, sizeof(u32));
1982                 if (rc < 0)
1983                         goto bad;
1984                 len = le32_to_cpu(buf[0]);
1985                 newgenfs = kzalloc(sizeof(*newgenfs), GFP_KERNEL);
1986                 if (!newgenfs) {
1987                         rc = -ENOMEM;
1988                         goto bad;
1989                 }
1990
1991                 newgenfs->fstype = kmalloc(len + 1, GFP_KERNEL);
1992                 if (!newgenfs->fstype) {
1993                         rc = -ENOMEM;
1994                         kfree(newgenfs);
1995                         goto bad;
1996                 }
1997                 rc = next_entry(newgenfs->fstype, fp, len);
1998                 if (rc < 0) {
1999                         kfree(newgenfs->fstype);
2000                         kfree(newgenfs);
2001                         goto bad;
2002                 }
2003                 newgenfs->fstype[len] = 0;
2004                 for (genfs_p = NULL, genfs = p->genfs; genfs;
2005                      genfs_p = genfs, genfs = genfs->next) {
2006                         if (strcmp(newgenfs->fstype, genfs->fstype) == 0) {
2007                                 printk(KERN_ERR "SELinux:  dup genfs "
2008                                        "fstype %s\n", newgenfs->fstype);
2009                                 kfree(newgenfs->fstype);
2010                                 kfree(newgenfs);
2011                                 goto bad;
2012                         }
2013                         if (strcmp(newgenfs->fstype, genfs->fstype) < 0)
2014                                 break;
2015                 }
2016                 newgenfs->next = genfs;
2017                 if (genfs_p)
2018                         genfs_p->next = newgenfs;
2019                 else
2020                         p->genfs = newgenfs;
2021                 rc = next_entry(buf, fp, sizeof(u32));
2022                 if (rc < 0)
2023                         goto bad;
2024                 nel2 = le32_to_cpu(buf[0]);
2025                 for (j = 0; j < nel2; j++) {
2026                         rc = next_entry(buf, fp, sizeof(u32));
2027                         if (rc < 0)
2028                                 goto bad;
2029                         len = le32_to_cpu(buf[0]);
2030
2031                         newc = kzalloc(sizeof(*newc), GFP_KERNEL);
2032                         if (!newc) {
2033                                 rc = -ENOMEM;
2034                                 goto bad;
2035                         }
2036
2037                         newc->u.name = kmalloc(len + 1, GFP_KERNEL);
2038                         if (!newc->u.name) {
2039                                 rc = -ENOMEM;
2040                                 goto bad_newc;
2041                         }
2042                         rc = next_entry(newc->u.name, fp, len);
2043                         if (rc < 0)
2044                                 goto bad_newc;
2045                         newc->u.name[len] = 0;
2046                         rc = next_entry(buf, fp, sizeof(u32));
2047                         if (rc < 0)
2048                                 goto bad_newc;
2049                         newc->v.sclass = le32_to_cpu(buf[0]);
2050                         if (context_read_and_validate(&newc->context[0], p, fp))
2051                                 goto bad_newc;
2052                         for (l = NULL, c = newgenfs->head; c;
2053                              l = c, c = c->next) {
2054                                 if (!strcmp(newc->u.name, c->u.name) &&
2055                                     (!c->v.sclass || !newc->v.sclass ||
2056                                      newc->v.sclass == c->v.sclass)) {
2057                                         printk(KERN_ERR "SELinux:  dup genfs "
2058                                                "entry (%s,%s)\n",
2059                                                newgenfs->fstype, c->u.name);
2060                                         goto bad_newc;
2061                                 }
2062                                 len = strlen(newc->u.name);
2063                                 len2 = strlen(c->u.name);
2064                                 if (len > len2)
2065                                         break;
2066                         }
2067
2068                         newc->next = c;
2069                         if (l)
2070                                 l->next = newc;
2071                         else
2072                                 newgenfs->head = newc;
2073                 }
2074         }
2075
2076         if (p->policyvers >= POLICYDB_VERSION_MLS) {
2077                 int new_rangetr = p->policyvers >= POLICYDB_VERSION_RANGETRANS;
2078                 rc = next_entry(buf, fp, sizeof(u32));
2079                 if (rc < 0)
2080                         goto bad;
2081                 nel = le32_to_cpu(buf[0]);
2082                 lrt = NULL;
2083                 for (i = 0; i < nel; i++) {
2084                         rt = kzalloc(sizeof(*rt), GFP_KERNEL);
2085                         if (!rt) {
2086                                 rc = -ENOMEM;
2087                                 goto bad;
2088                         }
2089                         if (lrt)
2090                                 lrt->next = rt;
2091                         else
2092                                 p->range_tr = rt;
2093                         rc = next_entry(buf, fp, (sizeof(u32) * 2));
2094                         if (rc < 0)
2095                                 goto bad;
2096                         rt->source_type = le32_to_cpu(buf[0]);
2097                         rt->target_type = le32_to_cpu(buf[1]);
2098                         if (new_rangetr) {
2099                                 rc = next_entry(buf, fp, sizeof(u32));
2100                                 if (rc < 0)
2101                                         goto bad;
2102                                 rt->target_class = le32_to_cpu(buf[0]);
2103                         } else
2104                                 rt->target_class = SECCLASS_PROCESS;
2105                         if (!policydb_type_isvalid(p, rt->source_type) ||
2106                             !policydb_type_isvalid(p, rt->target_type) ||
2107                             !policydb_class_isvalid(p, rt->target_class)) {
2108                                 rc = -EINVAL;
2109                                 goto bad;
2110                         }
2111                         rc = mls_read_range_helper(&rt->target_range, fp);
2112                         if (rc)
2113                                 goto bad;
2114                         if (!mls_range_isvalid(p, &rt->target_range)) {
2115                                 printk(KERN_WARNING "SELinux:  rangetrans:  invalid range\n");
2116                                 goto bad;
2117                         }
2118                         lrt = rt;
2119                 }
2120         }
2121
2122         p->type_attr_map = kmalloc(p->p_types.nprim*sizeof(struct ebitmap), GFP_KERNEL);
2123         if (!p->type_attr_map)
2124                 goto bad;
2125
2126         for (i = 0; i < p->p_types.nprim; i++) {
2127                 ebitmap_init(&p->type_attr_map[i]);
2128                 if (p->policyvers >= POLICYDB_VERSION_AVTAB) {
2129                         if (ebitmap_read(&p->type_attr_map[i], fp))
2130                                 goto bad;
2131                 }
2132                 /* add the type itself as the degenerate case */
2133                 if (ebitmap_set_bit(&p->type_attr_map[i], i, 1))
2134                                 goto bad;
2135         }
2136
2137         rc = policydb_bounds_sanity_check(p);
2138         if (rc)
2139                 goto bad;
2140
2141         rc = 0;
2142 out:
2143         return rc;
2144 bad_newc:
2145         ocontext_destroy(newc, OCON_FSUSE);
2146 bad:
2147         if (!rc)
2148                 rc = -EINVAL;
2149         policydb_destroy(p);
2150         goto out;
2151 }