2 * Implementation of the multi-level security (MLS) policy.
4 * Author : Stephen Smalley, <sds@epoch.ncsc.mil>
7 * Updated: Trusted Computer Solutions, Inc. <dgoeddel@trustedcs.com>
9 * Support for enhanced MLS infrastructure.
11 * Copyright (C) 2004-2006 Trusted Computer Solutions, Inc.
14 * Updated: Hewlett-Packard <paul.moore@hp.com>
16 * Added support to import/export the MLS label from NetLabel
18 * (c) Copyright Hewlett-Packard Development Company, L.P., 2006
21 #include <linux/kernel.h>
22 #include <linux/slab.h>
23 #include <linux/string.h>
24 #include <linux/errno.h>
25 #include <net/netlabel.h>
32 * Return the length in bytes for the MLS fields of the
33 * security context string representation of `context'.
35 int mls_compute_context_len(struct context * context)
37 int i, l, len, head, prev;
40 struct ebitmap_node *node;
42 if (!selinux_mls_enabled)
45 len = 1; /* for the beginning ":" */
46 for (l = 0; l < 2; l++) {
47 int index_sens = context->range.level[l].sens;
48 len += strlen(policydb.p_sens_val_to_name[index_sens - 1]);
53 e = &context->range.level[l].cat;
54 ebitmap_for_each_positive_bit(e, node, i) {
56 /* one or more negative bits are skipped */
58 nm = policydb.p_cat_val_to_name[prev];
59 len += strlen(nm) + 1;
61 nm = policydb.p_cat_val_to_name[i];
62 len += strlen(nm) + 1;
68 nm = policydb.p_cat_val_to_name[prev];
69 len += strlen(nm) + 1;
72 if (mls_level_eq(&context->range.level[0],
73 &context->range.level[1]))
84 * Write the security context string representation of
85 * the MLS fields of `context' into the string `*scontext'.
86 * Update `*scontext' to point to the end of the MLS fields.
88 void mls_sid_to_context(struct context *context,
94 struct ebitmap_node *node;
96 if (!selinux_mls_enabled)
99 scontextp = *scontext;
104 for (l = 0; l < 2; l++) {
106 policydb.p_sens_val_to_name[context->range.level[l].sens - 1]);
107 scontextp += strlen(scontextp);
112 e = &context->range.level[l].cat;
113 ebitmap_for_each_positive_bit(e, node, i) {
115 /* one or more negative bits are skipped */
121 nm = policydb.p_cat_val_to_name[prev];
122 strcpy(scontextp, nm);
123 scontextp += strlen(nm);
129 nm = policydb.p_cat_val_to_name[i];
130 strcpy(scontextp, nm);
131 scontextp += strlen(nm);
142 nm = policydb.p_cat_val_to_name[prev];
143 strcpy(scontextp, nm);
144 scontextp += strlen(nm);
148 if (mls_level_eq(&context->range.level[0],
149 &context->range.level[1]))
156 *scontext = scontextp;
160 int mls_level_isvalid(struct policydb *p, struct mls_level *l)
162 struct level_datum *levdatum;
163 struct ebitmap_node *node;
166 if (!l->sens || l->sens > p->p_levels.nprim)
168 levdatum = hashtab_search(p->p_levels.table,
169 p->p_sens_val_to_name[l->sens - 1]);
173 ebitmap_for_each_positive_bit(&l->cat, node, i) {
174 if (i > p->p_cats.nprim)
176 if (!ebitmap_get_bit(&levdatum->level->cat, i)) {
178 * Category may not be associated with
188 int mls_range_isvalid(struct policydb *p, struct mls_range *r)
190 return (mls_level_isvalid(p, &r->level[0]) &&
191 mls_level_isvalid(p, &r->level[1]) &&
192 mls_level_dom(&r->level[1], &r->level[0]));
196 * Return 1 if the MLS fields in the security context
197 * structure `c' are valid. Return 0 otherwise.
199 int mls_context_isvalid(struct policydb *p, struct context *c)
201 struct user_datum *usrdatum;
203 if (!selinux_mls_enabled)
206 if (!mls_range_isvalid(p, &c->range))
209 if (c->role == OBJECT_R_VAL)
213 * User must be authorized for the MLS range.
215 if (!c->user || c->user > p->p_users.nprim)
217 usrdatum = p->user_val_to_struct[c->user - 1];
218 if (!mls_range_contains(usrdatum->range, c->range))
219 return 0; /* user may not be associated with range */
225 * Set the MLS fields in the security context structure
226 * `context' based on the string representation in
227 * the string `*scontext'. Update `*scontext' to
228 * point to the end of the string representation of
231 * This function modifies the string in place, inserting
232 * NULL characters to terminate the MLS fields.
234 * If a def_sid is provided and no MLS field is present,
235 * copy the MLS field of the associated default context.
236 * Used for upgraded to MLS systems where objects may lack
239 * Policy read-lock must be held for sidtab lookup.
242 int mls_context_to_sid(char oldc,
244 struct context *context,
250 char *scontextp, *p, *rngptr;
251 struct level_datum *levdatum;
252 struct cat_datum *catdatum, *rngdatum;
255 if (!selinux_mls_enabled) {
256 if (def_sid != SECSID_NULL && oldc)
257 *scontext += strlen(*scontext)+1;
262 * No MLS component to the security context, try and map to
263 * default if provided.
266 struct context *defcon;
268 if (def_sid == SECSID_NULL)
271 defcon = sidtab_search(s, def_sid);
275 rc = mls_context_cpy(context, defcon);
279 /* Extract low sensitivity. */
280 scontextp = p = *scontext;
281 while (*p && *p != ':' && *p != '-')
288 for (l = 0; l < 2; l++) {
289 levdatum = hashtab_search(policydb.p_levels.table, scontextp);
295 context->range.level[l].sens = levdatum->level->sens;
298 /* Extract category set. */
301 while (*p && *p != ',' && *p != '-')
307 /* Separate into range if exists */
308 if ((rngptr = strchr(scontextp, '.')) != NULL) {
313 catdatum = hashtab_search(policydb.p_cats.table,
320 rc = ebitmap_set_bit(&context->range.level[l].cat,
321 catdatum->value - 1, 1);
325 /* If range, set all categories in range */
329 rngdatum = hashtab_search(policydb.p_cats.table, rngptr);
335 if (catdatum->value >= rngdatum->value) {
340 for (i = catdatum->value; i < rngdatum->value; i++) {
341 rc = ebitmap_set_bit(&context->range.level[l].cat, i, 1);
352 /* Extract high sensitivity. */
354 while (*p && *p != ':')
365 context->range.level[1].sens = context->range.level[0].sens;
366 rc = ebitmap_cpy(&context->range.level[1].cat,
367 &context->range.level[0].cat);
378 * Set the MLS fields in the security context structure
379 * `context' based on the string representation in
380 * the string `str'. This function will allocate temporary memory with the
381 * given constraints of gfp_mask.
383 int mls_from_string(char *str, struct context *context, gfp_t gfp_mask)
385 char *tmpstr, *freestr;
388 if (!selinux_mls_enabled)
391 /* we need freestr because mls_context_to_sid will change
392 the value of tmpstr */
393 tmpstr = freestr = kstrdup(str, gfp_mask);
397 rc = mls_context_to_sid(':', &tmpstr, context,
406 * Copies the MLS range `range' into `context'.
408 static inline int mls_range_set(struct context *context,
409 struct mls_range *range)
413 /* Copy the MLS range into the context */
414 for (l = 0; l < 2; l++) {
415 context->range.level[l].sens = range->level[l].sens;
416 rc = ebitmap_cpy(&context->range.level[l].cat,
417 &range->level[l].cat);
425 int mls_setup_user_range(struct context *fromcon, struct user_datum *user,
426 struct context *usercon)
428 if (selinux_mls_enabled) {
429 struct mls_level *fromcon_sen = &(fromcon->range.level[0]);
430 struct mls_level *fromcon_clr = &(fromcon->range.level[1]);
431 struct mls_level *user_low = &(user->range.level[0]);
432 struct mls_level *user_clr = &(user->range.level[1]);
433 struct mls_level *user_def = &(user->dfltlevel);
434 struct mls_level *usercon_sen = &(usercon->range.level[0]);
435 struct mls_level *usercon_clr = &(usercon->range.level[1]);
437 /* Honor the user's default level if we can */
438 if (mls_level_between(user_def, fromcon_sen, fromcon_clr)) {
439 *usercon_sen = *user_def;
440 } else if (mls_level_between(fromcon_sen, user_def, user_clr)) {
441 *usercon_sen = *fromcon_sen;
442 } else if (mls_level_between(fromcon_clr, user_low, user_def)) {
443 *usercon_sen = *user_low;
447 /* Lower the clearance of available contexts
448 if the clearance of "fromcon" is lower than
449 that of the user's default clearance (but
450 only if the "fromcon" clearance dominates
451 the user's computed sensitivity level) */
452 if (mls_level_dom(user_clr, fromcon_clr)) {
453 *usercon_clr = *fromcon_clr;
454 } else if (mls_level_dom(fromcon_clr, user_clr)) {
455 *usercon_clr = *user_clr;
464 * Convert the MLS fields in the security context
465 * structure `c' from the values specified in the
466 * policy `oldp' to the values specified in the policy `newp'.
468 int mls_convert_context(struct policydb *oldp,
469 struct policydb *newp,
472 struct level_datum *levdatum;
473 struct cat_datum *catdatum;
474 struct ebitmap bitmap;
475 struct ebitmap_node *node;
478 if (!selinux_mls_enabled)
481 for (l = 0; l < 2; l++) {
482 levdatum = hashtab_search(newp->p_levels.table,
483 oldp->p_sens_val_to_name[c->range.level[l].sens - 1]);
487 c->range.level[l].sens = levdatum->level->sens;
489 ebitmap_init(&bitmap);
490 ebitmap_for_each_positive_bit(&c->range.level[l].cat, node, i) {
493 catdatum = hashtab_search(newp->p_cats.table,
494 oldp->p_cat_val_to_name[i]);
497 rc = ebitmap_set_bit(&bitmap, catdatum->value - 1, 1);
501 ebitmap_destroy(&c->range.level[l].cat);
502 c->range.level[l].cat = bitmap;
508 int mls_compute_sid(struct context *scontext,
509 struct context *tcontext,
512 struct context *newcontext)
514 struct range_trans *rtr;
516 if (!selinux_mls_enabled)
520 case AVTAB_TRANSITION:
521 /* Look for a range transition rule. */
522 for (rtr = policydb.range_tr; rtr; rtr = rtr->next) {
523 if (rtr->source_type == scontext->type &&
524 rtr->target_type == tcontext->type &&
525 rtr->target_class == tclass) {
526 /* Set the range from the rule */
527 return mls_range_set(newcontext,
533 if (tclass == SECCLASS_PROCESS)
534 /* Use the process MLS attributes. */
535 return mls_context_cpy(newcontext, scontext);
537 /* Use the process effective MLS attributes. */
538 return mls_context_cpy_low(newcontext, scontext);
540 /* Only polyinstantiate the MLS attributes if
541 the type is being polyinstantiated */
542 if (newcontext->type != tcontext->type) {
543 /* Use the process effective MLS attributes. */
544 return mls_context_cpy_low(newcontext, scontext);
546 /* Use the related object MLS attributes. */
547 return mls_context_cpy(newcontext, tcontext);
555 #ifdef CONFIG_NETLABEL
557 * mls_export_netlbl_lvl - Export the MLS sensitivity levels to NetLabel
558 * @context: the security context
559 * @secattr: the NetLabel security attributes
562 * Given the security context copy the low MLS sensitivity level into the
563 * NetLabel MLS sensitivity level field.
566 void mls_export_netlbl_lvl(struct context *context,
567 struct netlbl_lsm_secattr *secattr)
569 if (!selinux_mls_enabled)
572 secattr->mls_lvl = context->range.level[0].sens - 1;
573 secattr->flags |= NETLBL_SECATTR_MLS_LVL;
577 * mls_import_netlbl_lvl - Import the NetLabel MLS sensitivity levels
578 * @context: the security context
579 * @secattr: the NetLabel security attributes
582 * Given the security context and the NetLabel security attributes, copy the
583 * NetLabel MLS sensitivity level into the context.
586 void mls_import_netlbl_lvl(struct context *context,
587 struct netlbl_lsm_secattr *secattr)
589 if (!selinux_mls_enabled)
592 context->range.level[0].sens = secattr->mls_lvl + 1;
593 context->range.level[1].sens = context->range.level[0].sens;
597 * mls_export_netlbl_cat - Export the MLS categories to NetLabel
598 * @context: the security context
599 * @secattr: the NetLabel security attributes
602 * Given the security context copy the low MLS categories into the NetLabel
603 * MLS category field. Returns zero on success, negative values on failure.
606 int mls_export_netlbl_cat(struct context *context,
607 struct netlbl_lsm_secattr *secattr)
611 if (!selinux_mls_enabled)
614 rc = ebitmap_netlbl_export(&context->range.level[0].cat,
616 if (rc == 0 && secattr->mls_cat != NULL)
617 secattr->flags |= NETLBL_SECATTR_MLS_CAT;
623 * mls_import_netlbl_cat - Import the MLS categories from NetLabel
624 * @context: the security context
625 * @secattr: the NetLabel security attributes
628 * Copy the NetLabel security attributes into the SELinux context; since the
629 * NetLabel security attribute only contains a single MLS category use it for
630 * both the low and high categories of the context. Returns zero on success,
631 * negative values on failure.
634 int mls_import_netlbl_cat(struct context *context,
635 struct netlbl_lsm_secattr *secattr)
639 if (!selinux_mls_enabled)
642 rc = ebitmap_netlbl_import(&context->range.level[0].cat,
645 goto import_netlbl_cat_failure;
647 rc = ebitmap_cpy(&context->range.level[1].cat,
648 &context->range.level[0].cat);
650 goto import_netlbl_cat_failure;
654 import_netlbl_cat_failure:
655 ebitmap_destroy(&context->range.level[0].cat);
656 ebitmap_destroy(&context->range.level[1].cat);
659 #endif /* CONFIG_NETLABEL */