conditional.c 11 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509
  1. /* Authors: Karl MacMillan <kmacmillan@tresys.com>
  2. * Frank Mayer <mayerf@tresys.com>
  3. *
  4. * Copyright (C) 2003 - 2004 Tresys Technology, LLC
  5. * This program is free software; you can redistribute it and/or modify
  6. * it under the terms of the GNU General Public License as published by
  7. * the Free Software Foundation, version 2.
  8. */
  9. #include <linux/kernel.h>
  10. #include <linux/errno.h>
  11. #include <linux/string.h>
  12. #include <linux/spinlock.h>
  13. #include <asm/semaphore.h>
  14. #include <linux/slab.h>
  15. #include "security.h"
  16. #include "conditional.h"
  17. /*
  18. * cond_evaluate_expr evaluates a conditional expr
  19. * in reverse polish notation. It returns true (1), false (0),
  20. * or undefined (-1). Undefined occurs when the expression
  21. * exceeds the stack depth of COND_EXPR_MAXDEPTH.
  22. */
  23. static int cond_evaluate_expr(struct policydb *p, struct cond_expr *expr)
  24. {
  25. struct cond_expr *cur;
  26. int s[COND_EXPR_MAXDEPTH];
  27. int sp = -1;
  28. for (cur = expr; cur != NULL; cur = cur->next) {
  29. switch (cur->expr_type) {
  30. case COND_BOOL:
  31. if (sp == (COND_EXPR_MAXDEPTH - 1))
  32. return -1;
  33. sp++;
  34. s[sp] = p->bool_val_to_struct[cur->bool - 1]->state;
  35. break;
  36. case COND_NOT:
  37. if (sp < 0)
  38. return -1;
  39. s[sp] = !s[sp];
  40. break;
  41. case COND_OR:
  42. if (sp < 1)
  43. return -1;
  44. sp--;
  45. s[sp] |= s[sp + 1];
  46. break;
  47. case COND_AND:
  48. if (sp < 1)
  49. return -1;
  50. sp--;
  51. s[sp] &= s[sp + 1];
  52. break;
  53. case COND_XOR:
  54. if (sp < 1)
  55. return -1;
  56. sp--;
  57. s[sp] ^= s[sp + 1];
  58. break;
  59. case COND_EQ:
  60. if (sp < 1)
  61. return -1;
  62. sp--;
  63. s[sp] = (s[sp] == s[sp + 1]);
  64. break;
  65. case COND_NEQ:
  66. if (sp < 1)
  67. return -1;
  68. sp--;
  69. s[sp] = (s[sp] != s[sp + 1]);
  70. break;
  71. default:
  72. return -1;
  73. }
  74. }
  75. return s[0];
  76. }
  77. /*
  78. * evaluate_cond_node evaluates the conditional stored in
  79. * a struct cond_node and if the result is different than the
  80. * current state of the node it sets the rules in the true/false
  81. * list appropriately. If the result of the expression is undefined
  82. * all of the rules are disabled for safety.
  83. */
  84. int evaluate_cond_node(struct policydb *p, struct cond_node *node)
  85. {
  86. int new_state;
  87. struct cond_av_list* cur;
  88. new_state = cond_evaluate_expr(p, node->expr);
  89. if (new_state != node->cur_state) {
  90. node->cur_state = new_state;
  91. if (new_state == -1)
  92. printk(KERN_ERR "security: expression result was undefined - disabling all rules.\n");
  93. /* turn the rules on or off */
  94. for (cur = node->true_list; cur != NULL; cur = cur->next) {
  95. if (new_state <= 0) {
  96. cur->node->key.specified &= ~AVTAB_ENABLED;
  97. } else {
  98. cur->node->key.specified |= AVTAB_ENABLED;
  99. }
  100. }
  101. for (cur = node->false_list; cur != NULL; cur = cur->next) {
  102. /* -1 or 1 */
  103. if (new_state) {
  104. cur->node->key.specified &= ~AVTAB_ENABLED;
  105. } else {
  106. cur->node->key.specified |= AVTAB_ENABLED;
  107. }
  108. }
  109. }
  110. return 0;
  111. }
  112. int cond_policydb_init(struct policydb *p)
  113. {
  114. p->bool_val_to_struct = NULL;
  115. p->cond_list = NULL;
  116. if (avtab_init(&p->te_cond_avtab))
  117. return -1;
  118. return 0;
  119. }
  120. static void cond_av_list_destroy(struct cond_av_list *list)
  121. {
  122. struct cond_av_list *cur, *next;
  123. for (cur = list; cur != NULL; cur = next) {
  124. next = cur->next;
  125. /* the avtab_ptr_t node is destroy by the avtab */
  126. kfree(cur);
  127. }
  128. }
  129. static void cond_node_destroy(struct cond_node *node)
  130. {
  131. struct cond_expr *cur_expr, *next_expr;
  132. for (cur_expr = node->expr; cur_expr != NULL; cur_expr = next_expr) {
  133. next_expr = cur_expr->next;
  134. kfree(cur_expr);
  135. }
  136. cond_av_list_destroy(node->true_list);
  137. cond_av_list_destroy(node->false_list);
  138. kfree(node);
  139. }
  140. static void cond_list_destroy(struct cond_node *list)
  141. {
  142. struct cond_node *next, *cur;
  143. if (list == NULL)
  144. return;
  145. for (cur = list; cur != NULL; cur = next) {
  146. next = cur->next;
  147. cond_node_destroy(cur);
  148. }
  149. }
  150. void cond_policydb_destroy(struct policydb *p)
  151. {
  152. kfree(p->bool_val_to_struct);
  153. avtab_destroy(&p->te_cond_avtab);
  154. cond_list_destroy(p->cond_list);
  155. }
  156. int cond_init_bool_indexes(struct policydb *p)
  157. {
  158. kfree(p->bool_val_to_struct);
  159. p->bool_val_to_struct = (struct cond_bool_datum**)
  160. kmalloc(p->p_bools.nprim * sizeof(struct cond_bool_datum*), GFP_KERNEL);
  161. if (!p->bool_val_to_struct)
  162. return -1;
  163. return 0;
  164. }
  165. int cond_destroy_bool(void *key, void *datum, void *p)
  166. {
  167. kfree(key);
  168. kfree(datum);
  169. return 0;
  170. }
  171. int cond_index_bool(void *key, void *datum, void *datap)
  172. {
  173. struct policydb *p;
  174. struct cond_bool_datum *booldatum;
  175. booldatum = datum;
  176. p = datap;
  177. if (!booldatum->value || booldatum->value > p->p_bools.nprim)
  178. return -EINVAL;
  179. p->p_bool_val_to_name[booldatum->value - 1] = key;
  180. p->bool_val_to_struct[booldatum->value -1] = booldatum;
  181. return 0;
  182. }
  183. static int bool_isvalid(struct cond_bool_datum *b)
  184. {
  185. if (!(b->state == 0 || b->state == 1))
  186. return 0;
  187. return 1;
  188. }
  189. int cond_read_bool(struct policydb *p, struct hashtab *h, void *fp)
  190. {
  191. char *key = NULL;
  192. struct cond_bool_datum *booldatum;
  193. __le32 buf[3];
  194. u32 len;
  195. int rc;
  196. booldatum = kzalloc(sizeof(struct cond_bool_datum), GFP_KERNEL);
  197. if (!booldatum)
  198. return -1;
  199. rc = next_entry(buf, fp, sizeof buf);
  200. if (rc < 0)
  201. goto err;
  202. booldatum->value = le32_to_cpu(buf[0]);
  203. booldatum->state = le32_to_cpu(buf[1]);
  204. if (!bool_isvalid(booldatum))
  205. goto err;
  206. len = le32_to_cpu(buf[2]);
  207. key = kmalloc(len + 1, GFP_KERNEL);
  208. if (!key)
  209. goto err;
  210. rc = next_entry(key, fp, len);
  211. if (rc < 0)
  212. goto err;
  213. key[len] = 0;
  214. if (hashtab_insert(h, key, booldatum))
  215. goto err;
  216. return 0;
  217. err:
  218. cond_destroy_bool(key, booldatum, NULL);
  219. return -1;
  220. }
  221. struct cond_insertf_data
  222. {
  223. struct policydb *p;
  224. struct cond_av_list *other;
  225. struct cond_av_list *head;
  226. struct cond_av_list *tail;
  227. };
  228. static int cond_insertf(struct avtab *a, struct avtab_key *k, struct avtab_datum *d, void *ptr)
  229. {
  230. struct cond_insertf_data *data = ptr;
  231. struct policydb *p = data->p;
  232. struct cond_av_list *other = data->other, *list, *cur;
  233. struct avtab_node *node_ptr;
  234. u8 found;
  235. /*
  236. * For type rules we have to make certain there aren't any
  237. * conflicting rules by searching the te_avtab and the
  238. * cond_te_avtab.
  239. */
  240. if (k->specified & AVTAB_TYPE) {
  241. if (avtab_search(&p->te_avtab, k)) {
  242. printk("security: type rule already exists outside of a conditional.");
  243. goto err;
  244. }
  245. /*
  246. * If we are reading the false list other will be a pointer to
  247. * the true list. We can have duplicate entries if there is only
  248. * 1 other entry and it is in our true list.
  249. *
  250. * If we are reading the true list (other == NULL) there shouldn't
  251. * be any other entries.
  252. */
  253. if (other) {
  254. node_ptr = avtab_search_node(&p->te_cond_avtab, k);
  255. if (node_ptr) {
  256. if (avtab_search_node_next(node_ptr, k->specified)) {
  257. printk("security: too many conflicting type rules.");
  258. goto err;
  259. }
  260. found = 0;
  261. for (cur = other; cur != NULL; cur = cur->next) {
  262. if (cur->node == node_ptr) {
  263. found = 1;
  264. break;
  265. }
  266. }
  267. if (!found) {
  268. printk("security: conflicting type rules.\n");
  269. goto err;
  270. }
  271. }
  272. } else {
  273. if (avtab_search(&p->te_cond_avtab, k)) {
  274. printk("security: conflicting type rules when adding type rule for true.\n");
  275. goto err;
  276. }
  277. }
  278. }
  279. node_ptr = avtab_insert_nonunique(&p->te_cond_avtab, k, d);
  280. if (!node_ptr) {
  281. printk("security: could not insert rule.");
  282. goto err;
  283. }
  284. list = kzalloc(sizeof(struct cond_av_list), GFP_KERNEL);
  285. if (!list)
  286. goto err;
  287. list->node = node_ptr;
  288. if (!data->head)
  289. data->head = list;
  290. else
  291. data->tail->next = list;
  292. data->tail = list;
  293. return 0;
  294. err:
  295. cond_av_list_destroy(data->head);
  296. data->head = NULL;
  297. return -1;
  298. }
  299. static int cond_read_av_list(struct policydb *p, void *fp, struct cond_av_list **ret_list, struct cond_av_list *other)
  300. {
  301. int i, rc;
  302. __le32 buf[1];
  303. u32 len;
  304. struct cond_insertf_data data;
  305. *ret_list = NULL;
  306. len = 0;
  307. rc = next_entry(buf, fp, sizeof(u32));
  308. if (rc < 0)
  309. return -1;
  310. len = le32_to_cpu(buf[0]);
  311. if (len == 0) {
  312. return 0;
  313. }
  314. data.p = p;
  315. data.other = other;
  316. data.head = NULL;
  317. data.tail = NULL;
  318. for (i = 0; i < len; i++) {
  319. rc = avtab_read_item(fp, p->policyvers, &p->te_cond_avtab, cond_insertf, &data);
  320. if (rc)
  321. return rc;
  322. }
  323. *ret_list = data.head;
  324. return 0;
  325. }
  326. static int expr_isvalid(struct policydb *p, struct cond_expr *expr)
  327. {
  328. if (expr->expr_type <= 0 || expr->expr_type > COND_LAST) {
  329. printk("security: conditional expressions uses unknown operator.\n");
  330. return 0;
  331. }
  332. if (expr->bool > p->p_bools.nprim) {
  333. printk("security: conditional expressions uses unknown bool.\n");
  334. return 0;
  335. }
  336. return 1;
  337. }
  338. static int cond_read_node(struct policydb *p, struct cond_node *node, void *fp)
  339. {
  340. __le32 buf[2];
  341. u32 len, i;
  342. int rc;
  343. struct cond_expr *expr = NULL, *last = NULL;
  344. rc = next_entry(buf, fp, sizeof(u32));
  345. if (rc < 0)
  346. return -1;
  347. node->cur_state = le32_to_cpu(buf[0]);
  348. len = 0;
  349. rc = next_entry(buf, fp, sizeof(u32));
  350. if (rc < 0)
  351. return -1;
  352. /* expr */
  353. len = le32_to_cpu(buf[0]);
  354. for (i = 0; i < len; i++ ) {
  355. rc = next_entry(buf, fp, sizeof(u32) * 2);
  356. if (rc < 0)
  357. goto err;
  358. expr = kzalloc(sizeof(struct cond_expr), GFP_KERNEL);
  359. if (!expr) {
  360. goto err;
  361. }
  362. expr->expr_type = le32_to_cpu(buf[0]);
  363. expr->bool = le32_to_cpu(buf[1]);
  364. if (!expr_isvalid(p, expr)) {
  365. kfree(expr);
  366. goto err;
  367. }
  368. if (i == 0) {
  369. node->expr = expr;
  370. } else {
  371. last->next = expr;
  372. }
  373. last = expr;
  374. }
  375. if (cond_read_av_list(p, fp, &node->true_list, NULL) != 0)
  376. goto err;
  377. if (cond_read_av_list(p, fp, &node->false_list, node->true_list) != 0)
  378. goto err;
  379. return 0;
  380. err:
  381. cond_node_destroy(node);
  382. return -1;
  383. }
  384. int cond_read_list(struct policydb *p, void *fp)
  385. {
  386. struct cond_node *node, *last = NULL;
  387. __le32 buf[1];
  388. u32 i, len;
  389. int rc;
  390. rc = next_entry(buf, fp, sizeof buf);
  391. if (rc < 0)
  392. return -1;
  393. len = le32_to_cpu(buf[0]);
  394. for (i = 0; i < len; i++) {
  395. node = kzalloc(sizeof(struct cond_node), GFP_KERNEL);
  396. if (!node)
  397. goto err;
  398. if (cond_read_node(p, node, fp) != 0)
  399. goto err;
  400. if (i == 0) {
  401. p->cond_list = node;
  402. } else {
  403. last->next = node;
  404. }
  405. last = node;
  406. }
  407. return 0;
  408. err:
  409. cond_list_destroy(p->cond_list);
  410. p->cond_list = NULL;
  411. return -1;
  412. }
  413. /* Determine whether additional permissions are granted by the conditional
  414. * av table, and if so, add them to the result
  415. */
  416. void cond_compute_av(struct avtab *ctab, struct avtab_key *key, struct av_decision *avd)
  417. {
  418. struct avtab_node *node;
  419. if(!ctab || !key || !avd)
  420. return;
  421. for(node = avtab_search_node(ctab, key); node != NULL;
  422. node = avtab_search_node_next(node, key->specified)) {
  423. if ( (u16) (AVTAB_ALLOWED|AVTAB_ENABLED) ==
  424. (node->key.specified & (AVTAB_ALLOWED|AVTAB_ENABLED)))
  425. avd->allowed |= node->datum.data;
  426. if ( (u16) (AVTAB_AUDITDENY|AVTAB_ENABLED) ==
  427. (node->key.specified & (AVTAB_AUDITDENY|AVTAB_ENABLED)))
  428. /* Since a '0' in an auditdeny mask represents a
  429. * permission we do NOT want to audit (dontaudit), we use
  430. * the '&' operand to ensure that all '0's in the mask
  431. * are retained (much unlike the allow and auditallow cases).
  432. */
  433. avd->auditdeny &= node->datum.data;
  434. if ( (u16) (AVTAB_AUDITALLOW|AVTAB_ENABLED) ==
  435. (node->key.specified & (AVTAB_AUDITALLOW|AVTAB_ENABLED)))
  436. avd->auditallow |= node->datum.data;
  437. }
  438. return;
  439. }