Linux Audio

Check our new training course

Loading...
v3.15
 
  1/* Authors: Karl MacMillan <kmacmillan@tresys.com>
  2 *	    Frank Mayer <mayerf@tresys.com>
  3 *
  4 * Copyright (C) 2003 - 2004 Tresys Technology, LLC
  5 *	This program is free software; you can redistribute it and/or modify
  6 *	it under the terms of the GNU General Public License as published by
  7 *	the Free Software Foundation, version 2.
  8 */
  9
 10#include <linux/kernel.h>
 11#include <linux/errno.h>
 12#include <linux/string.h>
 13#include <linux/spinlock.h>
 14#include <linux/slab.h>
 15
 16#include "security.h"
 17#include "conditional.h"
 
 18
 19/*
 20 * cond_evaluate_expr evaluates a conditional expr
 21 * in reverse polish notation. It returns true (1), false (0),
 22 * or undefined (-1). Undefined occurs when the expression
 23 * exceeds the stack depth of COND_EXPR_MAXDEPTH.
 24 */
 25static int cond_evaluate_expr(struct policydb *p, struct cond_expr *expr)
 26{
 27
 28	struct cond_expr *cur;
 29	int s[COND_EXPR_MAXDEPTH];
 30	int sp = -1;
 31
 32	for (cur = expr; cur; cur = cur->next) {
 33		switch (cur->expr_type) {
 34		case COND_BOOL:
 35			if (sp == (COND_EXPR_MAXDEPTH - 1))
 36				return -1;
 37			sp++;
 38			s[sp] = p->bool_val_to_struct[cur->bool - 1]->state;
 39			break;
 40		case COND_NOT:
 41			if (sp < 0)
 42				return -1;
 43			s[sp] = !s[sp];
 44			break;
 45		case COND_OR:
 46			if (sp < 1)
 47				return -1;
 48			sp--;
 49			s[sp] |= s[sp + 1];
 50			break;
 51		case COND_AND:
 52			if (sp < 1)
 53				return -1;
 54			sp--;
 55			s[sp] &= s[sp + 1];
 56			break;
 57		case COND_XOR:
 58			if (sp < 1)
 59				return -1;
 60			sp--;
 61			s[sp] ^= s[sp + 1];
 62			break;
 63		case COND_EQ:
 64			if (sp < 1)
 65				return -1;
 66			sp--;
 67			s[sp] = (s[sp] == s[sp + 1]);
 68			break;
 69		case COND_NEQ:
 70			if (sp < 1)
 71				return -1;
 72			sp--;
 73			s[sp] = (s[sp] != s[sp + 1]);
 74			break;
 75		default:
 76			return -1;
 77		}
 78	}
 79	return s[0];
 80}
 81
 82/*
 83 * evaluate_cond_node evaluates the conditional stored in
 84 * a struct cond_node and if the result is different than the
 85 * current state of the node it sets the rules in the true/false
 86 * list appropriately. If the result of the expression is undefined
 87 * all of the rules are disabled for safety.
 88 */
 89int evaluate_cond_node(struct policydb *p, struct cond_node *node)
 90{
 91	int new_state;
 92	struct cond_av_list *cur;
 93
 94	new_state = cond_evaluate_expr(p, node->expr);
 95	if (new_state != node->cur_state) {
 96		node->cur_state = new_state;
 97		if (new_state == -1)
 98			printk(KERN_ERR "SELinux: expression result was undefined - disabling all rules.\n");
 99		/* turn the rules on or off */
100		for (cur = node->true_list; cur; cur = cur->next) {
101			if (new_state <= 0)
102				cur->node->key.specified &= ~AVTAB_ENABLED;
103			else
104				cur->node->key.specified |= AVTAB_ENABLED;
105		}
106
107		for (cur = node->false_list; cur; cur = cur->next) {
108			/* -1 or 1 */
109			if (new_state)
110				cur->node->key.specified &= ~AVTAB_ENABLED;
111			else
112				cur->node->key.specified |= AVTAB_ENABLED;
113		}
114	}
115	return 0;
116}
117
118int cond_policydb_init(struct policydb *p)
119{
120	int rc;
121
122	p->bool_val_to_struct = NULL;
123	p->cond_list = NULL;
124
125	rc = avtab_init(&p->te_cond_avtab);
126	if (rc)
127		return rc;
128
129	return 0;
130}
131
132static void cond_av_list_destroy(struct cond_av_list *list)
133{
134	struct cond_av_list *cur, *next;
135	for (cur = list; cur; cur = next) {
136		next = cur->next;
137		/* the avtab_ptr_t node is destroy by the avtab */
138		kfree(cur);
139	}
140}
141
142static void cond_node_destroy(struct cond_node *node)
143{
144	struct cond_expr *cur_expr, *next_expr;
145
146	for (cur_expr = node->expr; cur_expr; cur_expr = next_expr) {
147		next_expr = cur_expr->next;
148		kfree(cur_expr);
149	}
150	cond_av_list_destroy(node->true_list);
151	cond_av_list_destroy(node->false_list);
152	kfree(node);
153}
154
155static void cond_list_destroy(struct cond_node *list)
156{
157	struct cond_node *next, *cur;
158
159	if (list == NULL)
160		return;
161
162	for (cur = list; cur; cur = next) {
163		next = cur->next;
164		cond_node_destroy(cur);
165	}
166}
167
168void cond_policydb_destroy(struct policydb *p)
169{
170	kfree(p->bool_val_to_struct);
171	avtab_destroy(&p->te_cond_avtab);
172	cond_list_destroy(p->cond_list);
173}
174
175int cond_init_bool_indexes(struct policydb *p)
176{
177	kfree(p->bool_val_to_struct);
178	p->bool_val_to_struct =
179		kmalloc(p->p_bools.nprim * sizeof(struct cond_bool_datum *), GFP_KERNEL);
 
180	if (!p->bool_val_to_struct)
181		return -ENOMEM;
182	return 0;
183}
184
185int cond_destroy_bool(void *key, void *datum, void *p)
186{
187	kfree(key);
188	kfree(datum);
189	return 0;
190}
191
192int cond_index_bool(void *key, void *datum, void *datap)
193{
194	struct policydb *p;
195	struct cond_bool_datum *booldatum;
196	struct flex_array *fa;
197
198	booldatum = datum;
199	p = datap;
200
201	if (!booldatum->value || booldatum->value > p->p_bools.nprim)
202		return -EINVAL;
203
204	fa = p->sym_val_to_name[SYM_BOOLS];
205	if (flex_array_put_ptr(fa, booldatum->value - 1, key,
206			       GFP_KERNEL | __GFP_ZERO))
207		BUG();
208	p->bool_val_to_struct[booldatum->value - 1] = booldatum;
209
210	return 0;
211}
212
213static int bool_isvalid(struct cond_bool_datum *b)
214{
215	if (!(b->state == 0 || b->state == 1))
216		return 0;
217	return 1;
218}
219
220int cond_read_bool(struct policydb *p, struct hashtab *h, void *fp)
221{
222	char *key = NULL;
223	struct cond_bool_datum *booldatum;
224	__le32 buf[3];
225	u32 len;
226	int rc;
227
228	booldatum = kzalloc(sizeof(struct cond_bool_datum), GFP_KERNEL);
229	if (!booldatum)
230		return -ENOMEM;
231
232	rc = next_entry(buf, fp, sizeof buf);
233	if (rc)
234		goto err;
235
236	booldatum->value = le32_to_cpu(buf[0]);
237	booldatum->state = le32_to_cpu(buf[1]);
238
239	rc = -EINVAL;
240	if (!bool_isvalid(booldatum))
241		goto err;
242
243	len = le32_to_cpu(buf[2]);
 
 
244
245	rc = -ENOMEM;
246	key = kmalloc(len + 1, GFP_KERNEL);
247	if (!key)
248		goto err;
249	rc = next_entry(key, fp, len);
250	if (rc)
251		goto err;
252	key[len] = '\0';
253	rc = hashtab_insert(h, key, booldatum);
254	if (rc)
255		goto err;
256
257	return 0;
258err:
259	cond_destroy_bool(key, booldatum, NULL);
260	return rc;
261}
262
263struct cond_insertf_data {
264	struct policydb *p;
265	struct cond_av_list *other;
266	struct cond_av_list *head;
267	struct cond_av_list *tail;
268};
269
270static int cond_insertf(struct avtab *a, struct avtab_key *k, struct avtab_datum *d, void *ptr)
271{
272	struct cond_insertf_data *data = ptr;
273	struct policydb *p = data->p;
274	struct cond_av_list *other = data->other, *list, *cur;
275	struct avtab_node *node_ptr;
276	u8 found;
277	int rc = -EINVAL;
278
279	/*
280	 * For type rules we have to make certain there aren't any
281	 * conflicting rules by searching the te_avtab and the
282	 * cond_te_avtab.
283	 */
284	if (k->specified & AVTAB_TYPE) {
285		if (avtab_search(&p->te_avtab, k)) {
286			printk(KERN_ERR "SELinux: type rule already exists outside of a conditional.\n");
287			goto err;
288		}
289		/*
290		 * If we are reading the false list other will be a pointer to
291		 * the true list. We can have duplicate entries if there is only
292		 * 1 other entry and it is in our true list.
293		 *
294		 * If we are reading the true list (other == NULL) there shouldn't
295		 * be any other entries.
296		 */
297		if (other) {
298			node_ptr = avtab_search_node(&p->te_cond_avtab, k);
299			if (node_ptr) {
300				if (avtab_search_node_next(node_ptr, k->specified)) {
301					printk(KERN_ERR "SELinux: too many conflicting type rules.\n");
302					goto err;
303				}
304				found = 0;
305				for (cur = other; cur; cur = cur->next) {
306					if (cur->node == node_ptr) {
307						found = 1;
308						break;
309					}
310				}
311				if (!found) {
312					printk(KERN_ERR "SELinux: conflicting type rules.\n");
313					goto err;
314				}
315			}
316		} else {
317			if (avtab_search(&p->te_cond_avtab, k)) {
318				printk(KERN_ERR "SELinux: conflicting type rules when adding type rule for true.\n");
319				goto err;
320			}
321		}
322	}
323
324	node_ptr = avtab_insert_nonunique(&p->te_cond_avtab, k, d);
325	if (!node_ptr) {
326		printk(KERN_ERR "SELinux: could not insert rule.\n");
327		rc = -ENOMEM;
328		goto err;
329	}
330
331	list = kzalloc(sizeof(struct cond_av_list), GFP_KERNEL);
332	if (!list) {
333		rc = -ENOMEM;
334		goto err;
335	}
336
337	list->node = node_ptr;
338	if (!data->head)
339		data->head = list;
340	else
341		data->tail->next = list;
342	data->tail = list;
343	return 0;
344
345err:
346	cond_av_list_destroy(data->head);
347	data->head = NULL;
348	return rc;
349}
350
351static int cond_read_av_list(struct policydb *p, void *fp, struct cond_av_list **ret_list, struct cond_av_list *other)
352{
353	int i, rc;
354	__le32 buf[1];
355	u32 len;
356	struct cond_insertf_data data;
357
358	*ret_list = NULL;
359
360	len = 0;
361	rc = next_entry(buf, fp, sizeof(u32));
362	if (rc)
363		return rc;
364
365	len = le32_to_cpu(buf[0]);
366	if (len == 0)
367		return 0;
368
369	data.p = p;
370	data.other = other;
371	data.head = NULL;
372	data.tail = NULL;
373	for (i = 0; i < len; i++) {
374		rc = avtab_read_item(&p->te_cond_avtab, fp, p, cond_insertf,
375				     &data);
376		if (rc)
377			return rc;
378	}
379
380	*ret_list = data.head;
381	return 0;
382}
383
384static int expr_isvalid(struct policydb *p, struct cond_expr *expr)
385{
386	if (expr->expr_type <= 0 || expr->expr_type > COND_LAST) {
387		printk(KERN_ERR "SELinux: conditional expressions uses unknown operator.\n");
388		return 0;
389	}
390
391	if (expr->bool > p->p_bools.nprim) {
392		printk(KERN_ERR "SELinux: conditional expressions uses unknown bool.\n");
393		return 0;
394	}
395	return 1;
396}
397
398static int cond_read_node(struct policydb *p, struct cond_node *node, void *fp)
399{
400	__le32 buf[2];
401	u32 len, i;
402	int rc;
403	struct cond_expr *expr = NULL, *last = NULL;
404
405	rc = next_entry(buf, fp, sizeof(u32));
406	if (rc)
407		return rc;
408
409	node->cur_state = le32_to_cpu(buf[0]);
410
411	len = 0;
412	rc = next_entry(buf, fp, sizeof(u32));
413	if (rc)
414		return rc;
415
416	/* expr */
417	len = le32_to_cpu(buf[0]);
418
419	for (i = 0; i < len; i++) {
420		rc = next_entry(buf, fp, sizeof(u32) * 2);
421		if (rc)
422			goto err;
423
424		rc = -ENOMEM;
425		expr = kzalloc(sizeof(struct cond_expr), GFP_KERNEL);
426		if (!expr)
427			goto err;
428
429		expr->expr_type = le32_to_cpu(buf[0]);
430		expr->bool = le32_to_cpu(buf[1]);
431
432		if (!expr_isvalid(p, expr)) {
433			rc = -EINVAL;
434			kfree(expr);
435			goto err;
436		}
437
438		if (i == 0)
439			node->expr = expr;
440		else
441			last->next = expr;
442		last = expr;
443	}
444
445	rc = cond_read_av_list(p, fp, &node->true_list, NULL);
446	if (rc)
447		goto err;
448	rc = cond_read_av_list(p, fp, &node->false_list, node->true_list);
449	if (rc)
450		goto err;
451	return 0;
452err:
453	cond_node_destroy(node);
454	return rc;
455}
456
457int cond_read_list(struct policydb *p, void *fp)
458{
459	struct cond_node *node, *last = NULL;
460	__le32 buf[1];
461	u32 i, len;
462	int rc;
463
464	rc = next_entry(buf, fp, sizeof buf);
465	if (rc)
466		return rc;
467
468	len = le32_to_cpu(buf[0]);
469
470	rc = avtab_alloc(&(p->te_cond_avtab), p->te_avtab.nel);
471	if (rc)
472		goto err;
473
474	for (i = 0; i < len; i++) {
475		rc = -ENOMEM;
476		node = kzalloc(sizeof(struct cond_node), GFP_KERNEL);
477		if (!node)
478			goto err;
479
480		rc = cond_read_node(p, node, fp);
481		if (rc)
482			goto err;
483
484		if (i == 0)
485			p->cond_list = node;
486		else
487			last->next = node;
488		last = node;
489	}
490	return 0;
491err:
492	cond_list_destroy(p->cond_list);
493	p->cond_list = NULL;
494	return rc;
495}
496
497int cond_write_bool(void *vkey, void *datum, void *ptr)
498{
499	char *key = vkey;
500	struct cond_bool_datum *booldatum = datum;
501	struct policy_data *pd = ptr;
502	void *fp = pd->fp;
503	__le32 buf[3];
504	u32 len;
505	int rc;
506
507	len = strlen(key);
508	buf[0] = cpu_to_le32(booldatum->value);
509	buf[1] = cpu_to_le32(booldatum->state);
510	buf[2] = cpu_to_le32(len);
511	rc = put_entry(buf, sizeof(u32), 3, fp);
512	if (rc)
513		return rc;
514	rc = put_entry(key, 1, len, fp);
515	if (rc)
516		return rc;
517	return 0;
518}
519
520/*
521 * cond_write_cond_av_list doesn't write out the av_list nodes.
522 * Instead it writes out the key/value pairs from the avtab. This
523 * is necessary because there is no way to uniquely identifying rules
524 * in the avtab so it is not possible to associate individual rules
525 * in the avtab with a conditional without saving them as part of
526 * the conditional. This means that the avtab with the conditional
527 * rules will not be saved but will be rebuilt on policy load.
528 */
529static int cond_write_av_list(struct policydb *p,
530			      struct cond_av_list *list, struct policy_file *fp)
531{
532	__le32 buf[1];
533	struct cond_av_list *cur_list;
534	u32 len;
535	int rc;
536
537	len = 0;
538	for (cur_list = list; cur_list != NULL; cur_list = cur_list->next)
539		len++;
540
541	buf[0] = cpu_to_le32(len);
542	rc = put_entry(buf, sizeof(u32), 1, fp);
543	if (rc)
544		return rc;
545
546	if (len == 0)
547		return 0;
548
549	for (cur_list = list; cur_list != NULL; cur_list = cur_list->next) {
550		rc = avtab_write_item(p, cur_list->node, fp);
551		if (rc)
552			return rc;
553	}
554
555	return 0;
556}
557
558static int cond_write_node(struct policydb *p, struct cond_node *node,
559		    struct policy_file *fp)
560{
561	struct cond_expr *cur_expr;
562	__le32 buf[2];
563	int rc;
564	u32 len = 0;
565
566	buf[0] = cpu_to_le32(node->cur_state);
567	rc = put_entry(buf, sizeof(u32), 1, fp);
568	if (rc)
569		return rc;
570
571	for (cur_expr = node->expr; cur_expr != NULL; cur_expr = cur_expr->next)
572		len++;
573
574	buf[0] = cpu_to_le32(len);
575	rc = put_entry(buf, sizeof(u32), 1, fp);
576	if (rc)
577		return rc;
578
579	for (cur_expr = node->expr; cur_expr != NULL; cur_expr = cur_expr->next) {
580		buf[0] = cpu_to_le32(cur_expr->expr_type);
581		buf[1] = cpu_to_le32(cur_expr->bool);
582		rc = put_entry(buf, sizeof(u32), 2, fp);
583		if (rc)
584			return rc;
585	}
586
587	rc = cond_write_av_list(p, node->true_list, fp);
588	if (rc)
589		return rc;
590	rc = cond_write_av_list(p, node->false_list, fp);
591	if (rc)
592		return rc;
593
594	return 0;
595}
596
597int cond_write_list(struct policydb *p, struct cond_node *list, void *fp)
598{
599	struct cond_node *cur;
600	u32 len;
601	__le32 buf[1];
602	int rc;
603
604	len = 0;
605	for (cur = list; cur != NULL; cur = cur->next)
606		len++;
607	buf[0] = cpu_to_le32(len);
608	rc = put_entry(buf, sizeof(u32), 1, fp);
609	if (rc)
610		return rc;
611
612	for (cur = list; cur != NULL; cur = cur->next) {
613		rc = cond_write_node(p, cur, fp);
614		if (rc)
615			return rc;
616	}
617
618	return 0;
619}
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
620/* Determine whether additional permissions are granted by the conditional
621 * av table, and if so, add them to the result
622 */
623void cond_compute_av(struct avtab *ctab, struct avtab_key *key, struct av_decision *avd)
 
624{
625	struct avtab_node *node;
626
627	if (!ctab || !key || !avd)
628		return;
629
630	for (node = avtab_search_node(ctab, key); node;
631				node = avtab_search_node_next(node, key->specified)) {
632		if ((u16)(AVTAB_ALLOWED|AVTAB_ENABLED) ==
633		    (node->key.specified & (AVTAB_ALLOWED|AVTAB_ENABLED)))
634			avd->allowed |= node->datum.data;
635		if ((u16)(AVTAB_AUDITDENY|AVTAB_ENABLED) ==
636		    (node->key.specified & (AVTAB_AUDITDENY|AVTAB_ENABLED)))
637			/* Since a '0' in an auditdeny mask represents a
638			 * permission we do NOT want to audit (dontaudit), we use
639			 * the '&' operand to ensure that all '0's in the mask
640			 * are retained (much unlike the allow and auditallow cases).
641			 */
642			avd->auditdeny &= node->datum.data;
643		if ((u16)(AVTAB_AUDITALLOW|AVTAB_ENABLED) ==
644		    (node->key.specified & (AVTAB_AUDITALLOW|AVTAB_ENABLED)))
645			avd->auditallow |= node->datum.data;
 
 
 
646	}
647	return;
648}
v5.4
  1// SPDX-License-Identifier: GPL-2.0-only
  2/* Authors: Karl MacMillan <kmacmillan@tresys.com>
  3 *	    Frank Mayer <mayerf@tresys.com>
  4 *
  5 * Copyright (C) 2003 - 2004 Tresys Technology, LLC
 
 
 
  6 */
  7
  8#include <linux/kernel.h>
  9#include <linux/errno.h>
 10#include <linux/string.h>
 11#include <linux/spinlock.h>
 12#include <linux/slab.h>
 13
 14#include "security.h"
 15#include "conditional.h"
 16#include "services.h"
 17
 18/*
 19 * cond_evaluate_expr evaluates a conditional expr
 20 * in reverse polish notation. It returns true (1), false (0),
 21 * or undefined (-1). Undefined occurs when the expression
 22 * exceeds the stack depth of COND_EXPR_MAXDEPTH.
 23 */
 24static int cond_evaluate_expr(struct policydb *p, struct cond_expr *expr)
 25{
 26
 27	struct cond_expr *cur;
 28	int s[COND_EXPR_MAXDEPTH];
 29	int sp = -1;
 30
 31	for (cur = expr; cur; cur = cur->next) {
 32		switch (cur->expr_type) {
 33		case COND_BOOL:
 34			if (sp == (COND_EXPR_MAXDEPTH - 1))
 35				return -1;
 36			sp++;
 37			s[sp] = p->bool_val_to_struct[cur->bool - 1]->state;
 38			break;
 39		case COND_NOT:
 40			if (sp < 0)
 41				return -1;
 42			s[sp] = !s[sp];
 43			break;
 44		case COND_OR:
 45			if (sp < 1)
 46				return -1;
 47			sp--;
 48			s[sp] |= s[sp + 1];
 49			break;
 50		case COND_AND:
 51			if (sp < 1)
 52				return -1;
 53			sp--;
 54			s[sp] &= s[sp + 1];
 55			break;
 56		case COND_XOR:
 57			if (sp < 1)
 58				return -1;
 59			sp--;
 60			s[sp] ^= s[sp + 1];
 61			break;
 62		case COND_EQ:
 63			if (sp < 1)
 64				return -1;
 65			sp--;
 66			s[sp] = (s[sp] == s[sp + 1]);
 67			break;
 68		case COND_NEQ:
 69			if (sp < 1)
 70				return -1;
 71			sp--;
 72			s[sp] = (s[sp] != s[sp + 1]);
 73			break;
 74		default:
 75			return -1;
 76		}
 77	}
 78	return s[0];
 79}
 80
 81/*
 82 * evaluate_cond_node evaluates the conditional stored in
 83 * a struct cond_node and if the result is different than the
 84 * current state of the node it sets the rules in the true/false
 85 * list appropriately. If the result of the expression is undefined
 86 * all of the rules are disabled for safety.
 87 */
 88int evaluate_cond_node(struct policydb *p, struct cond_node *node)
 89{
 90	int new_state;
 91	struct cond_av_list *cur;
 92
 93	new_state = cond_evaluate_expr(p, node->expr);
 94	if (new_state != node->cur_state) {
 95		node->cur_state = new_state;
 96		if (new_state == -1)
 97			pr_err("SELinux: expression result was undefined - disabling all rules.\n");
 98		/* turn the rules on or off */
 99		for (cur = node->true_list; cur; cur = cur->next) {
100			if (new_state <= 0)
101				cur->node->key.specified &= ~AVTAB_ENABLED;
102			else
103				cur->node->key.specified |= AVTAB_ENABLED;
104		}
105
106		for (cur = node->false_list; cur; cur = cur->next) {
107			/* -1 or 1 */
108			if (new_state)
109				cur->node->key.specified &= ~AVTAB_ENABLED;
110			else
111				cur->node->key.specified |= AVTAB_ENABLED;
112		}
113	}
114	return 0;
115}
116
117int cond_policydb_init(struct policydb *p)
118{
119	int rc;
120
121	p->bool_val_to_struct = NULL;
122	p->cond_list = NULL;
123
124	rc = avtab_init(&p->te_cond_avtab);
125	if (rc)
126		return rc;
127
128	return 0;
129}
130
131static void cond_av_list_destroy(struct cond_av_list *list)
132{
133	struct cond_av_list *cur, *next;
134	for (cur = list; cur; cur = next) {
135		next = cur->next;
136		/* the avtab_ptr_t node is destroy by the avtab */
137		kfree(cur);
138	}
139}
140
141static void cond_node_destroy(struct cond_node *node)
142{
143	struct cond_expr *cur_expr, *next_expr;
144
145	for (cur_expr = node->expr; cur_expr; cur_expr = next_expr) {
146		next_expr = cur_expr->next;
147		kfree(cur_expr);
148	}
149	cond_av_list_destroy(node->true_list);
150	cond_av_list_destroy(node->false_list);
151	kfree(node);
152}
153
154static void cond_list_destroy(struct cond_node *list)
155{
156	struct cond_node *next, *cur;
157
158	if (list == NULL)
159		return;
160
161	for (cur = list; cur; cur = next) {
162		next = cur->next;
163		cond_node_destroy(cur);
164	}
165}
166
167void cond_policydb_destroy(struct policydb *p)
168{
169	kfree(p->bool_val_to_struct);
170	avtab_destroy(&p->te_cond_avtab);
171	cond_list_destroy(p->cond_list);
172}
173
174int cond_init_bool_indexes(struct policydb *p)
175{
176	kfree(p->bool_val_to_struct);
177	p->bool_val_to_struct = kmalloc_array(p->p_bools.nprim,
178					      sizeof(*p->bool_val_to_struct),
179					      GFP_KERNEL);
180	if (!p->bool_val_to_struct)
181		return -ENOMEM;
182	return 0;
183}
184
185int cond_destroy_bool(void *key, void *datum, void *p)
186{
187	kfree(key);
188	kfree(datum);
189	return 0;
190}
191
192int cond_index_bool(void *key, void *datum, void *datap)
193{
194	struct policydb *p;
195	struct cond_bool_datum *booldatum;
 
196
197	booldatum = datum;
198	p = datap;
199
200	if (!booldatum->value || booldatum->value > p->p_bools.nprim)
201		return -EINVAL;
202
203	p->sym_val_to_name[SYM_BOOLS][booldatum->value - 1] = key;
 
 
 
204	p->bool_val_to_struct[booldatum->value - 1] = booldatum;
205
206	return 0;
207}
208
209static int bool_isvalid(struct cond_bool_datum *b)
210{
211	if (!(b->state == 0 || b->state == 1))
212		return 0;
213	return 1;
214}
215
216int cond_read_bool(struct policydb *p, struct hashtab *h, void *fp)
217{
218	char *key = NULL;
219	struct cond_bool_datum *booldatum;
220	__le32 buf[3];
221	u32 len;
222	int rc;
223
224	booldatum = kzalloc(sizeof(*booldatum), GFP_KERNEL);
225	if (!booldatum)
226		return -ENOMEM;
227
228	rc = next_entry(buf, fp, sizeof buf);
229	if (rc)
230		goto err;
231
232	booldatum->value = le32_to_cpu(buf[0]);
233	booldatum->state = le32_to_cpu(buf[1]);
234
235	rc = -EINVAL;
236	if (!bool_isvalid(booldatum))
237		goto err;
238
239	len = le32_to_cpu(buf[2]);
240	if (((len == 0) || (len == (u32)-1)))
241		goto err;
242
243	rc = -ENOMEM;
244	key = kmalloc(len + 1, GFP_KERNEL);
245	if (!key)
246		goto err;
247	rc = next_entry(key, fp, len);
248	if (rc)
249		goto err;
250	key[len] = '\0';
251	rc = hashtab_insert(h, key, booldatum);
252	if (rc)
253		goto err;
254
255	return 0;
256err:
257	cond_destroy_bool(key, booldatum, NULL);
258	return rc;
259}
260
261struct cond_insertf_data {
262	struct policydb *p;
263	struct cond_av_list *other;
264	struct cond_av_list *head;
265	struct cond_av_list *tail;
266};
267
268static int cond_insertf(struct avtab *a, struct avtab_key *k, struct avtab_datum *d, void *ptr)
269{
270	struct cond_insertf_data *data = ptr;
271	struct policydb *p = data->p;
272	struct cond_av_list *other = data->other, *list, *cur;
273	struct avtab_node *node_ptr;
274	u8 found;
275	int rc = -EINVAL;
276
277	/*
278	 * For type rules we have to make certain there aren't any
279	 * conflicting rules by searching the te_avtab and the
280	 * cond_te_avtab.
281	 */
282	if (k->specified & AVTAB_TYPE) {
283		if (avtab_search(&p->te_avtab, k)) {
284			pr_err("SELinux: type rule already exists outside of a conditional.\n");
285			goto err;
286		}
287		/*
288		 * If we are reading the false list other will be a pointer to
289		 * the true list. We can have duplicate entries if there is only
290		 * 1 other entry and it is in our true list.
291		 *
292		 * If we are reading the true list (other == NULL) there shouldn't
293		 * be any other entries.
294		 */
295		if (other) {
296			node_ptr = avtab_search_node(&p->te_cond_avtab, k);
297			if (node_ptr) {
298				if (avtab_search_node_next(node_ptr, k->specified)) {
299					pr_err("SELinux: too many conflicting type rules.\n");
300					goto err;
301				}
302				found = 0;
303				for (cur = other; cur; cur = cur->next) {
304					if (cur->node == node_ptr) {
305						found = 1;
306						break;
307					}
308				}
309				if (!found) {
310					pr_err("SELinux: conflicting type rules.\n");
311					goto err;
312				}
313			}
314		} else {
315			if (avtab_search(&p->te_cond_avtab, k)) {
316				pr_err("SELinux: conflicting type rules when adding type rule for true.\n");
317				goto err;
318			}
319		}
320	}
321
322	node_ptr = avtab_insert_nonunique(&p->te_cond_avtab, k, d);
323	if (!node_ptr) {
324		pr_err("SELinux: could not insert rule.\n");
325		rc = -ENOMEM;
326		goto err;
327	}
328
329	list = kzalloc(sizeof(*list), GFP_KERNEL);
330	if (!list) {
331		rc = -ENOMEM;
332		goto err;
333	}
334
335	list->node = node_ptr;
336	if (!data->head)
337		data->head = list;
338	else
339		data->tail->next = list;
340	data->tail = list;
341	return 0;
342
343err:
344	cond_av_list_destroy(data->head);
345	data->head = NULL;
346	return rc;
347}
348
349static int cond_read_av_list(struct policydb *p, void *fp, struct cond_av_list **ret_list, struct cond_av_list *other)
350{
351	int i, rc;
352	__le32 buf[1];
353	u32 len;
354	struct cond_insertf_data data;
355
356	*ret_list = NULL;
357
 
358	rc = next_entry(buf, fp, sizeof(u32));
359	if (rc)
360		return rc;
361
362	len = le32_to_cpu(buf[0]);
363	if (len == 0)
364		return 0;
365
366	data.p = p;
367	data.other = other;
368	data.head = NULL;
369	data.tail = NULL;
370	for (i = 0; i < len; i++) {
371		rc = avtab_read_item(&p->te_cond_avtab, fp, p, cond_insertf,
372				     &data);
373		if (rc)
374			return rc;
375	}
376
377	*ret_list = data.head;
378	return 0;
379}
380
381static int expr_isvalid(struct policydb *p, struct cond_expr *expr)
382{
383	if (expr->expr_type <= 0 || expr->expr_type > COND_LAST) {
384		pr_err("SELinux: conditional expressions uses unknown operator.\n");
385		return 0;
386	}
387
388	if (expr->bool > p->p_bools.nprim) {
389		pr_err("SELinux: conditional expressions uses unknown bool.\n");
390		return 0;
391	}
392	return 1;
393}
394
395static int cond_read_node(struct policydb *p, struct cond_node *node, void *fp)
396{
397	__le32 buf[2];
398	u32 len, i;
399	int rc;
400	struct cond_expr *expr = NULL, *last = NULL;
401
402	rc = next_entry(buf, fp, sizeof(u32) * 2);
403	if (rc)
404		goto err;
405
406	node->cur_state = le32_to_cpu(buf[0]);
407
 
 
 
 
 
408	/* expr */
409	len = le32_to_cpu(buf[1]);
410
411	for (i = 0; i < len; i++) {
412		rc = next_entry(buf, fp, sizeof(u32) * 2);
413		if (rc)
414			goto err;
415
416		rc = -ENOMEM;
417		expr = kzalloc(sizeof(*expr), GFP_KERNEL);
418		if (!expr)
419			goto err;
420
421		expr->expr_type = le32_to_cpu(buf[0]);
422		expr->bool = le32_to_cpu(buf[1]);
423
424		if (!expr_isvalid(p, expr)) {
425			rc = -EINVAL;
426			kfree(expr);
427			goto err;
428		}
429
430		if (i == 0)
431			node->expr = expr;
432		else
433			last->next = expr;
434		last = expr;
435	}
436
437	rc = cond_read_av_list(p, fp, &node->true_list, NULL);
438	if (rc)
439		goto err;
440	rc = cond_read_av_list(p, fp, &node->false_list, node->true_list);
441	if (rc)
442		goto err;
443	return 0;
444err:
445	cond_node_destroy(node);
446	return rc;
447}
448
449int cond_read_list(struct policydb *p, void *fp)
450{
451	struct cond_node *node, *last = NULL;
452	__le32 buf[1];
453	u32 i, len;
454	int rc;
455
456	rc = next_entry(buf, fp, sizeof buf);
457	if (rc)
458		return rc;
459
460	len = le32_to_cpu(buf[0]);
461
462	rc = avtab_alloc(&(p->te_cond_avtab), p->te_avtab.nel);
463	if (rc)
464		goto err;
465
466	for (i = 0; i < len; i++) {
467		rc = -ENOMEM;
468		node = kzalloc(sizeof(*node), GFP_KERNEL);
469		if (!node)
470			goto err;
471
472		rc = cond_read_node(p, node, fp);
473		if (rc)
474			goto err;
475
476		if (i == 0)
477			p->cond_list = node;
478		else
479			last->next = node;
480		last = node;
481	}
482	return 0;
483err:
484	cond_list_destroy(p->cond_list);
485	p->cond_list = NULL;
486	return rc;
487}
488
489int cond_write_bool(void *vkey, void *datum, void *ptr)
490{
491	char *key = vkey;
492	struct cond_bool_datum *booldatum = datum;
493	struct policy_data *pd = ptr;
494	void *fp = pd->fp;
495	__le32 buf[3];
496	u32 len;
497	int rc;
498
499	len = strlen(key);
500	buf[0] = cpu_to_le32(booldatum->value);
501	buf[1] = cpu_to_le32(booldatum->state);
502	buf[2] = cpu_to_le32(len);
503	rc = put_entry(buf, sizeof(u32), 3, fp);
504	if (rc)
505		return rc;
506	rc = put_entry(key, 1, len, fp);
507	if (rc)
508		return rc;
509	return 0;
510}
511
512/*
513 * cond_write_cond_av_list doesn't write out the av_list nodes.
514 * Instead it writes out the key/value pairs from the avtab. This
515 * is necessary because there is no way to uniquely identifying rules
516 * in the avtab so it is not possible to associate individual rules
517 * in the avtab with a conditional without saving them as part of
518 * the conditional. This means that the avtab with the conditional
519 * rules will not be saved but will be rebuilt on policy load.
520 */
521static int cond_write_av_list(struct policydb *p,
522			      struct cond_av_list *list, struct policy_file *fp)
523{
524	__le32 buf[1];
525	struct cond_av_list *cur_list;
526	u32 len;
527	int rc;
528
529	len = 0;
530	for (cur_list = list; cur_list != NULL; cur_list = cur_list->next)
531		len++;
532
533	buf[0] = cpu_to_le32(len);
534	rc = put_entry(buf, sizeof(u32), 1, fp);
535	if (rc)
536		return rc;
537
538	if (len == 0)
539		return 0;
540
541	for (cur_list = list; cur_list != NULL; cur_list = cur_list->next) {
542		rc = avtab_write_item(p, cur_list->node, fp);
543		if (rc)
544			return rc;
545	}
546
547	return 0;
548}
549
550static int cond_write_node(struct policydb *p, struct cond_node *node,
551		    struct policy_file *fp)
552{
553	struct cond_expr *cur_expr;
554	__le32 buf[2];
555	int rc;
556	u32 len = 0;
557
558	buf[0] = cpu_to_le32(node->cur_state);
559	rc = put_entry(buf, sizeof(u32), 1, fp);
560	if (rc)
561		return rc;
562
563	for (cur_expr = node->expr; cur_expr != NULL; cur_expr = cur_expr->next)
564		len++;
565
566	buf[0] = cpu_to_le32(len);
567	rc = put_entry(buf, sizeof(u32), 1, fp);
568	if (rc)
569		return rc;
570
571	for (cur_expr = node->expr; cur_expr != NULL; cur_expr = cur_expr->next) {
572		buf[0] = cpu_to_le32(cur_expr->expr_type);
573		buf[1] = cpu_to_le32(cur_expr->bool);
574		rc = put_entry(buf, sizeof(u32), 2, fp);
575		if (rc)
576			return rc;
577	}
578
579	rc = cond_write_av_list(p, node->true_list, fp);
580	if (rc)
581		return rc;
582	rc = cond_write_av_list(p, node->false_list, fp);
583	if (rc)
584		return rc;
585
586	return 0;
587}
588
589int cond_write_list(struct policydb *p, struct cond_node *list, void *fp)
590{
591	struct cond_node *cur;
592	u32 len;
593	__le32 buf[1];
594	int rc;
595
596	len = 0;
597	for (cur = list; cur != NULL; cur = cur->next)
598		len++;
599	buf[0] = cpu_to_le32(len);
600	rc = put_entry(buf, sizeof(u32), 1, fp);
601	if (rc)
602		return rc;
603
604	for (cur = list; cur != NULL; cur = cur->next) {
605		rc = cond_write_node(p, cur, fp);
606		if (rc)
607			return rc;
608	}
609
610	return 0;
611}
612
613void cond_compute_xperms(struct avtab *ctab, struct avtab_key *key,
614		struct extended_perms_decision *xpermd)
615{
616	struct avtab_node *node;
617
618	if (!ctab || !key || !xpermd)
619		return;
620
621	for (node = avtab_search_node(ctab, key); node;
622			node = avtab_search_node_next(node, key->specified)) {
623		if (node->key.specified & AVTAB_ENABLED)
624			services_compute_xperms_decision(xpermd, node);
625	}
626	return;
627
628}
629/* Determine whether additional permissions are granted by the conditional
630 * av table, and if so, add them to the result
631 */
632void cond_compute_av(struct avtab *ctab, struct avtab_key *key,
633		struct av_decision *avd, struct extended_perms *xperms)
634{
635	struct avtab_node *node;
636
637	if (!ctab || !key || !avd)
638		return;
639
640	for (node = avtab_search_node(ctab, key); node;
641				node = avtab_search_node_next(node, key->specified)) {
642		if ((u16)(AVTAB_ALLOWED|AVTAB_ENABLED) ==
643		    (node->key.specified & (AVTAB_ALLOWED|AVTAB_ENABLED)))
644			avd->allowed |= node->datum.u.data;
645		if ((u16)(AVTAB_AUDITDENY|AVTAB_ENABLED) ==
646		    (node->key.specified & (AVTAB_AUDITDENY|AVTAB_ENABLED)))
647			/* Since a '0' in an auditdeny mask represents a
648			 * permission we do NOT want to audit (dontaudit), we use
649			 * the '&' operand to ensure that all '0's in the mask
650			 * are retained (much unlike the allow and auditallow cases).
651			 */
652			avd->auditdeny &= node->datum.u.data;
653		if ((u16)(AVTAB_AUDITALLOW|AVTAB_ENABLED) ==
654		    (node->key.specified & (AVTAB_AUDITALLOW|AVTAB_ENABLED)))
655			avd->auditallow |= node->datum.u.data;
656		if (xperms && (node->key.specified & AVTAB_ENABLED) &&
657				(node->key.specified & AVTAB_XPERMS))
658			services_compute_xperms_drivers(xperms, node);
659	}
 
660}