Merge branch 'kmem_death' of master.kernel.org:/pub/scm/linux/kernel/git/lethal/sh-2.6
[linux-2.6] / security / selinux / ss / mls.c
1 /*
2  * Implementation of the multi-level security (MLS) policy.
3  *
4  * Author : Stephen Smalley, <sds@epoch.ncsc.mil>
5  */
6 /*
7  * Updated: Trusted Computer Solutions, Inc. <dgoeddel@trustedcs.com>
8  *
9  *      Support for enhanced MLS infrastructure.
10  *
11  * Copyright (C) 2004-2006 Trusted Computer Solutions, Inc.
12  */
13 /*
14  * Updated: Hewlett-Packard <paul.moore@hp.com>
15  *
16  *      Added support to import/export the MLS label from NetLabel
17  *
18  * (c) Copyright Hewlett-Packard Development Company, L.P., 2006
19  */
20
21 #include <linux/kernel.h>
22 #include <linux/slab.h>
23 #include <linux/string.h>
24 #include <linux/errno.h>
25 #include <net/netlabel.h>
26 #include "sidtab.h"
27 #include "mls.h"
28 #include "policydb.h"
29 #include "services.h"
30
31 /*
32  * Return the length in bytes for the MLS fields of the
33  * security context string representation of `context'.
34  */
35 int mls_compute_context_len(struct context * context)
36 {
37         int i, l, len, range;
38         struct ebitmap_node *node;
39
40         if (!selinux_mls_enabled)
41                 return 0;
42
43         len = 1; /* for the beginning ":" */
44         for (l = 0; l < 2; l++) {
45                 range = 0;
46                 len += strlen(policydb.p_sens_val_to_name[context->range.level[l].sens - 1]);
47
48                 ebitmap_for_each_bit(&context->range.level[l].cat, node, i) {
49                         if (ebitmap_node_get_bit(node, i)) {
50                                 if (range) {
51                                         range++;
52                                         continue;
53                                 }
54
55                                 len += strlen(policydb.p_cat_val_to_name[i]) + 1;
56                                 range++;
57                         } else {
58                                 if (range > 1)
59                                         len += strlen(policydb.p_cat_val_to_name[i - 1]) + 1;
60                                 range = 0;
61                         }
62                 }
63                 /* Handle case where last category is the end of range */
64                 if (range > 1)
65                         len += strlen(policydb.p_cat_val_to_name[i - 1]) + 1;
66
67                 if (l == 0) {
68                         if (mls_level_eq(&context->range.level[0],
69                                          &context->range.level[1]))
70                                 break;
71                         else
72                                 len++;
73                 }
74         }
75
76         return len;
77 }
78
79 /*
80  * Write the security context string representation of
81  * the MLS fields of `context' into the string `*scontext'.
82  * Update `*scontext' to point to the end of the MLS fields.
83  */
84 void mls_sid_to_context(struct context *context,
85                         char **scontext)
86 {
87         char *scontextp;
88         int i, l, range, wrote_sep;
89         struct ebitmap_node *node;
90
91         if (!selinux_mls_enabled)
92                 return;
93
94         scontextp = *scontext;
95
96         *scontextp = ':';
97         scontextp++;
98
99         for (l = 0; l < 2; l++) {
100                 range = 0;
101                 wrote_sep = 0;
102                 strcpy(scontextp,
103                        policydb.p_sens_val_to_name[context->range.level[l].sens - 1]);
104                 scontextp += strlen(policydb.p_sens_val_to_name[context->range.level[l].sens - 1]);
105
106                 /* categories */
107                 ebitmap_for_each_bit(&context->range.level[l].cat, node, i) {
108                         if (ebitmap_node_get_bit(node, i)) {
109                                 if (range) {
110                                         range++;
111                                         continue;
112                                 }
113
114                                 if (!wrote_sep) {
115                                         *scontextp++ = ':';
116                                         wrote_sep = 1;
117                                 } else
118                                         *scontextp++ = ',';
119                                 strcpy(scontextp, policydb.p_cat_val_to_name[i]);
120                                 scontextp += strlen(policydb.p_cat_val_to_name[i]);
121                                 range++;
122                         } else {
123                                 if (range > 1) {
124                                         if (range > 2)
125                                                 *scontextp++ = '.';
126                                         else
127                                                 *scontextp++ = ',';
128
129                                         strcpy(scontextp, policydb.p_cat_val_to_name[i - 1]);
130                                         scontextp += strlen(policydb.p_cat_val_to_name[i - 1]);
131                                 }
132                                 range = 0;
133                         }
134                 }
135
136                 /* Handle case where last category is the end of range */
137                 if (range > 1) {
138                         if (range > 2)
139                                 *scontextp++ = '.';
140                         else
141                                 *scontextp++ = ',';
142
143                         strcpy(scontextp, policydb.p_cat_val_to_name[i - 1]);
144                         scontextp += strlen(policydb.p_cat_val_to_name[i - 1]);
145                 }
146
147                 if (l == 0) {
148                         if (mls_level_eq(&context->range.level[0],
149                                          &context->range.level[1]))
150                                 break;
151                         else {
152                                 *scontextp = '-';
153                                 scontextp++;
154                         }
155                 }
156         }
157
158         *scontext = scontextp;
159         return;
160 }
161
162 /*
163  * Return 1 if the MLS fields in the security context
164  * structure `c' are valid.  Return 0 otherwise.
165  */
166 int mls_context_isvalid(struct policydb *p, struct context *c)
167 {
168         struct level_datum *levdatum;
169         struct user_datum *usrdatum;
170         struct ebitmap_node *node;
171         int i, l;
172
173         if (!selinux_mls_enabled)
174                 return 1;
175
176         /*
177          * MLS range validity checks: high must dominate low, low level must
178          * be valid (category set <-> sensitivity check), and high level must
179          * be valid (category set <-> sensitivity check)
180          */
181         if (!mls_level_dom(&c->range.level[1], &c->range.level[0]))
182                 /* High does not dominate low. */
183                 return 0;
184
185         for (l = 0; l < 2; l++) {
186                 if (!c->range.level[l].sens || c->range.level[l].sens > p->p_levels.nprim)
187                         return 0;
188                 levdatum = hashtab_search(p->p_levels.table,
189                         p->p_sens_val_to_name[c->range.level[l].sens - 1]);
190                 if (!levdatum)
191                         return 0;
192
193                 ebitmap_for_each_bit(&c->range.level[l].cat, node, i) {
194                         if (ebitmap_node_get_bit(node, i)) {
195                                 if (i > p->p_cats.nprim)
196                                         return 0;
197                                 if (!ebitmap_get_bit(&levdatum->level->cat, i))
198                                         /*
199                                          * Category may not be associated with
200                                          * sensitivity in low level.
201                                          */
202                                         return 0;
203                         }
204                 }
205         }
206
207         if (c->role == OBJECT_R_VAL)
208                 return 1;
209
210         /*
211          * User must be authorized for the MLS range.
212          */
213         if (!c->user || c->user > p->p_users.nprim)
214                 return 0;
215         usrdatum = p->user_val_to_struct[c->user - 1];
216         if (!mls_range_contains(usrdatum->range, c->range))
217                 return 0; /* user may not be associated with range */
218
219         return 1;
220 }
221
222 /*
223  * Set the MLS fields in the security context structure
224  * `context' based on the string representation in
225  * the string `*scontext'.  Update `*scontext' to
226  * point to the end of the string representation of
227  * the MLS fields.
228  *
229  * This function modifies the string in place, inserting
230  * NULL characters to terminate the MLS fields.
231  *
232  * If a def_sid is provided and no MLS field is present,
233  * copy the MLS field of the associated default context.
234  * Used for upgraded to MLS systems where objects may lack
235  * MLS fields.
236  *
237  * Policy read-lock must be held for sidtab lookup.
238  *
239  */
240 int mls_context_to_sid(char oldc,
241                        char **scontext,
242                        struct context *context,
243                        struct sidtab *s,
244                        u32 def_sid)
245 {
246
247         char delim;
248         char *scontextp, *p, *rngptr;
249         struct level_datum *levdatum;
250         struct cat_datum *catdatum, *rngdatum;
251         int l, rc = -EINVAL;
252
253         if (!selinux_mls_enabled) {
254                 if (def_sid != SECSID_NULL && oldc)
255                         *scontext += strlen(*scontext)+1;
256                 return 0;
257         }
258
259         /*
260          * No MLS component to the security context, try and map to
261          * default if provided.
262          */
263         if (!oldc) {
264                 struct context *defcon;
265
266                 if (def_sid == SECSID_NULL)
267                         goto out;
268
269                 defcon = sidtab_search(s, def_sid);
270                 if (!defcon)
271                         goto out;
272
273                 rc = mls_context_cpy(context, defcon);
274                 goto out;
275         }
276
277         /* Extract low sensitivity. */
278         scontextp = p = *scontext;
279         while (*p && *p != ':' && *p != '-')
280                 p++;
281
282         delim = *p;
283         if (delim != 0)
284                 *p++ = 0;
285
286         for (l = 0; l < 2; l++) {
287                 levdatum = hashtab_search(policydb.p_levels.table, scontextp);
288                 if (!levdatum) {
289                         rc = -EINVAL;
290                         goto out;
291                 }
292
293                 context->range.level[l].sens = levdatum->level->sens;
294
295                 if (delim == ':') {
296                         /* Extract category set. */
297                         while (1) {
298                                 scontextp = p;
299                                 while (*p && *p != ',' && *p != '-')
300                                         p++;
301                                 delim = *p;
302                                 if (delim != 0)
303                                         *p++ = 0;
304
305                                 /* Separate into range if exists */
306                                 if ((rngptr = strchr(scontextp, '.')) != NULL) {
307                                         /* Remove '.' */
308                                         *rngptr++ = 0;
309                                 }
310
311                                 catdatum = hashtab_search(policydb.p_cats.table,
312                                                           scontextp);
313                                 if (!catdatum) {
314                                         rc = -EINVAL;
315                                         goto out;
316                                 }
317
318                                 rc = ebitmap_set_bit(&context->range.level[l].cat,
319                                                      catdatum->value - 1, 1);
320                                 if (rc)
321                                         goto out;
322
323                                 /* If range, set all categories in range */
324                                 if (rngptr) {
325                                         int i;
326
327                                         rngdatum = hashtab_search(policydb.p_cats.table, rngptr);
328                                         if (!rngdatum) {
329                                                 rc = -EINVAL;
330                                                 goto out;
331                                         }
332
333                                         if (catdatum->value >= rngdatum->value) {
334                                                 rc = -EINVAL;
335                                                 goto out;
336                                         }
337
338                                         for (i = catdatum->value; i < rngdatum->value; i++) {
339                                                 rc = ebitmap_set_bit(&context->range.level[l].cat, i, 1);
340                                                 if (rc)
341                                                         goto out;
342                                         }
343                                 }
344
345                                 if (delim != ',')
346                                         break;
347                         }
348                 }
349                 if (delim == '-') {
350                         /* Extract high sensitivity. */
351                         scontextp = p;
352                         while (*p && *p != ':')
353                                 p++;
354
355                         delim = *p;
356                         if (delim != 0)
357                                 *p++ = 0;
358                 } else
359                         break;
360         }
361
362         if (l == 0) {
363                 context->range.level[1].sens = context->range.level[0].sens;
364                 rc = ebitmap_cpy(&context->range.level[1].cat,
365                                  &context->range.level[0].cat);
366                 if (rc)
367                         goto out;
368         }
369         *scontext = ++p;
370         rc = 0;
371 out:
372         return rc;
373 }
374
375 /*
376  * Set the MLS fields in the security context structure
377  * `context' based on the string representation in
378  * the string `str'.  This function will allocate temporary memory with the
379  * given constraints of gfp_mask.
380  */
381 int mls_from_string(char *str, struct context *context, gfp_t gfp_mask)
382 {
383         char *tmpstr, *freestr;
384         int rc;
385
386         if (!selinux_mls_enabled)
387                 return -EINVAL;
388
389         /* we need freestr because mls_context_to_sid will change
390            the value of tmpstr */
391         tmpstr = freestr = kstrdup(str, gfp_mask);
392         if (!tmpstr) {
393                 rc = -ENOMEM;
394         } else {
395                 rc = mls_context_to_sid(':', &tmpstr, context,
396                                         NULL, SECSID_NULL);
397                 kfree(freestr);
398         }
399
400         return rc;
401 }
402
403 /*
404  * Copies the MLS range `range' into `context'.
405  */
406 static inline int mls_range_set(struct context *context,
407                                 struct mls_range *range)
408 {
409         int l, rc = 0;
410
411         /* Copy the MLS range into the  context */
412         for (l = 0; l < 2; l++) {
413                 context->range.level[l].sens = range->level[l].sens;
414                 rc = ebitmap_cpy(&context->range.level[l].cat,
415                                  &range->level[l].cat);
416                 if (rc)
417                         break;
418         }
419
420         return rc;
421 }
422
423 int mls_setup_user_range(struct context *fromcon, struct user_datum *user,
424                          struct context *usercon)
425 {
426         if (selinux_mls_enabled) {
427                 struct mls_level *fromcon_sen = &(fromcon->range.level[0]);
428                 struct mls_level *fromcon_clr = &(fromcon->range.level[1]);
429                 struct mls_level *user_low = &(user->range.level[0]);
430                 struct mls_level *user_clr = &(user->range.level[1]);
431                 struct mls_level *user_def = &(user->dfltlevel);
432                 struct mls_level *usercon_sen = &(usercon->range.level[0]);
433                 struct mls_level *usercon_clr = &(usercon->range.level[1]);
434
435                 /* Honor the user's default level if we can */
436                 if (mls_level_between(user_def, fromcon_sen, fromcon_clr)) {
437                         *usercon_sen = *user_def;
438                 } else if (mls_level_between(fromcon_sen, user_def, user_clr)) {
439                         *usercon_sen = *fromcon_sen;
440                 } else if (mls_level_between(fromcon_clr, user_low, user_def)) {
441                         *usercon_sen = *user_low;
442                 } else
443                         return -EINVAL;
444
445                 /* Lower the clearance of available contexts
446                    if the clearance of "fromcon" is lower than
447                    that of the user's default clearance (but
448                    only if the "fromcon" clearance dominates
449                    the user's computed sensitivity level) */
450                 if (mls_level_dom(user_clr, fromcon_clr)) {
451                         *usercon_clr = *fromcon_clr;
452                 } else if (mls_level_dom(fromcon_clr, user_clr)) {
453                         *usercon_clr = *user_clr;
454                 } else
455                         return -EINVAL;
456         }
457
458         return 0;
459 }
460
461 /*
462  * Convert the MLS fields in the security context
463  * structure `c' from the values specified in the
464  * policy `oldp' to the values specified in the policy `newp'.
465  */
466 int mls_convert_context(struct policydb *oldp,
467                         struct policydb *newp,
468                         struct context *c)
469 {
470         struct level_datum *levdatum;
471         struct cat_datum *catdatum;
472         struct ebitmap bitmap;
473         struct ebitmap_node *node;
474         int l, i;
475
476         if (!selinux_mls_enabled)
477                 return 0;
478
479         for (l = 0; l < 2; l++) {
480                 levdatum = hashtab_search(newp->p_levels.table,
481                         oldp->p_sens_val_to_name[c->range.level[l].sens - 1]);
482
483                 if (!levdatum)
484                         return -EINVAL;
485                 c->range.level[l].sens = levdatum->level->sens;
486
487                 ebitmap_init(&bitmap);
488                 ebitmap_for_each_bit(&c->range.level[l].cat, node, i) {
489                         if (ebitmap_node_get_bit(node, i)) {
490                                 int rc;
491
492                                 catdatum = hashtab_search(newp->p_cats.table,
493                                                 oldp->p_cat_val_to_name[i]);
494                                 if (!catdatum)
495                                         return -EINVAL;
496                                 rc = ebitmap_set_bit(&bitmap, catdatum->value - 1, 1);
497                                 if (rc)
498                                         return rc;
499                         }
500                 }
501                 ebitmap_destroy(&c->range.level[l].cat);
502                 c->range.level[l].cat = bitmap;
503         }
504
505         return 0;
506 }
507
508 int mls_compute_sid(struct context *scontext,
509                     struct context *tcontext,
510                     u16 tclass,
511                     u32 specified,
512                     struct context *newcontext)
513 {
514         struct range_trans *rtr;
515
516         if (!selinux_mls_enabled)
517                 return 0;
518
519         switch (specified) {
520         case AVTAB_TRANSITION:
521                 /* Look for a range transition rule. */
522                 for (rtr = policydb.range_tr; rtr; rtr = rtr->next) {
523                         if (rtr->source_type == scontext->type &&
524                             rtr->target_type == tcontext->type &&
525                             rtr->target_class == tclass) {
526                                 /* Set the range from the rule */
527                                 return mls_range_set(newcontext,
528                                                      &rtr->target_range);
529                         }
530                 }
531                 /* Fallthrough */
532         case AVTAB_CHANGE:
533                 if (tclass == SECCLASS_PROCESS)
534                         /* Use the process MLS attributes. */
535                         return mls_context_cpy(newcontext, scontext);
536                 else
537                         /* Use the process effective MLS attributes. */
538                         return mls_context_cpy_low(newcontext, scontext);
539         case AVTAB_MEMBER:
540                 /* Only polyinstantiate the MLS attributes if
541                    the type is being polyinstantiated */
542                 if (newcontext->type != tcontext->type) {
543                         /* Use the process effective MLS attributes. */
544                         return mls_context_cpy_low(newcontext, scontext);
545                 } else {
546                         /* Use the related object MLS attributes. */
547                         return mls_context_cpy(newcontext, tcontext);
548                 }
549         default:
550                 return -EINVAL;
551         }
552         return -EINVAL;
553 }
554
555 #ifdef CONFIG_NETLABEL
556 /**
557  * mls_export_netlbl_lvl - Export the MLS sensitivity levels to NetLabel
558  * @context: the security context
559  * @secattr: the NetLabel security attributes
560  *
561  * Description:
562  * Given the security context copy the low MLS sensitivity level into the
563  * NetLabel MLS sensitivity level field.
564  *
565  */
566 void mls_export_netlbl_lvl(struct context *context,
567                            struct netlbl_lsm_secattr *secattr)
568 {
569         if (!selinux_mls_enabled)
570                 return;
571
572         secattr->mls_lvl = context->range.level[0].sens - 1;
573         secattr->flags |= NETLBL_SECATTR_MLS_LVL;
574 }
575
576 /**
577  * mls_import_netlbl_lvl - Import the NetLabel MLS sensitivity levels
578  * @context: the security context
579  * @secattr: the NetLabel security attributes
580  *
581  * Description:
582  * Given the security context and the NetLabel security attributes, copy the
583  * NetLabel MLS sensitivity level into the context.
584  *
585  */
586 void mls_import_netlbl_lvl(struct context *context,
587                            struct netlbl_lsm_secattr *secattr)
588 {
589         if (!selinux_mls_enabled)
590                 return;
591
592         context->range.level[0].sens = secattr->mls_lvl + 1;
593         context->range.level[1].sens = context->range.level[0].sens;
594 }
595
596 /**
597  * mls_export_netlbl_cat - Export the MLS categories to NetLabel
598  * @context: the security context
599  * @secattr: the NetLabel security attributes
600  *
601  * Description:
602  * Given the security context copy the low MLS categories into the NetLabel
603  * MLS category field.  Returns zero on success, negative values on failure.
604  *
605  */
606 int mls_export_netlbl_cat(struct context *context,
607                           struct netlbl_lsm_secattr *secattr)
608 {
609         int rc;
610
611         if (!selinux_mls_enabled)
612                 return 0;
613
614         rc = ebitmap_netlbl_export(&context->range.level[0].cat,
615                                    &secattr->mls_cat);
616         if (rc == 0 && secattr->mls_cat != NULL)
617                 secattr->flags |= NETLBL_SECATTR_MLS_CAT;
618
619         return rc;
620 }
621
622 /**
623  * mls_import_netlbl_cat - Import the MLS categories from NetLabel
624  * @context: the security context
625  * @secattr: the NetLabel security attributes
626  *
627  * Description:
628  * Copy the NetLabel security attributes into the SELinux context; since the
629  * NetLabel security attribute only contains a single MLS category use it for
630  * both the low and high categories of the context.  Returns zero on success,
631  * negative values on failure.
632  *
633  */
634 int mls_import_netlbl_cat(struct context *context,
635                           struct netlbl_lsm_secattr *secattr)
636 {
637         int rc;
638
639         if (!selinux_mls_enabled)
640                 return 0;
641
642         rc = ebitmap_netlbl_import(&context->range.level[0].cat,
643                                    secattr->mls_cat);
644         if (rc != 0)
645                 goto import_netlbl_cat_failure;
646
647         rc = ebitmap_cpy(&context->range.level[1].cat,
648                          &context->range.level[0].cat);
649         if (rc != 0)
650                 goto import_netlbl_cat_failure;
651
652         return 0;
653
654 import_netlbl_cat_failure:
655         ebitmap_destroy(&context->range.level[0].cat);
656         ebitmap_destroy(&context->range.level[1].cat);
657         return rc;
658 }
659 #endif /* CONFIG_NETLABEL */