Joshua Brindle | 13cd4c8 | 2008-08-19 15:30:36 -0400 | [diff] [blame] | 1 | /* |
| 2 | * String representation support for classes and permissions. |
| 3 | */ |
| 4 | #include <sys/stat.h> |
| 5 | #include <dirent.h> |
| 6 | #include <fcntl.h> |
| 7 | #include <limits.h> |
| 8 | #include <unistd.h> |
| 9 | #include <errno.h> |
| 10 | #include <stddef.h> |
| 11 | #include <stdio.h> |
| 12 | #include <stdlib.h> |
| 13 | #include <string.h> |
| 14 | #include <stdint.h> |
| 15 | #include <ctype.h> |
Joshua Brindle | 13cd4c8 | 2008-08-19 15:30:36 -0400 | [diff] [blame] | 16 | #include "selinux_internal.h" |
| 17 | #include "policy.h" |
| 18 | #include "mapping.h" |
| 19 | |
Joshua Brindle | 13cd4c8 | 2008-08-19 15:30:36 -0400 | [diff] [blame] | 20 | #define MAXVECTORS 8*sizeof(access_vector_t) |
| 21 | |
Joshua Brindle | 13cd4c8 | 2008-08-19 15:30:36 -0400 | [diff] [blame] | 22 | struct discover_class_node { |
| 23 | char *name; |
| 24 | security_class_t value; |
| 25 | char **perms; |
| 26 | |
| 27 | struct discover_class_node *next; |
| 28 | }; |
| 29 | |
| 30 | static struct discover_class_node *discover_class_cache = NULL; |
| 31 | |
| 32 | static struct discover_class_node * get_class_cache_entry_name(const char *s) |
| 33 | { |
| 34 | struct discover_class_node *node = discover_class_cache; |
| 35 | |
| 36 | for (; node != NULL && strcmp(s,node->name) != 0; node = node->next); |
| 37 | |
| 38 | return node; |
| 39 | } |
| 40 | |
| 41 | static struct discover_class_node * get_class_cache_entry_value(security_class_t c) |
| 42 | { |
| 43 | struct discover_class_node *node = discover_class_cache; |
| 44 | |
| 45 | for (; node != NULL && c != node->value; node = node->next); |
| 46 | |
| 47 | return node; |
| 48 | } |
| 49 | |
| 50 | static struct discover_class_node * discover_class(const char *s) |
| 51 | { |
| 52 | int fd, ret; |
| 53 | char path[PATH_MAX]; |
| 54 | char buf[20]; |
| 55 | DIR *dir; |
| 56 | struct dirent *dentry; |
| 57 | size_t i; |
| 58 | |
| 59 | struct discover_class_node *node; |
| 60 | |
| 61 | if (!selinux_mnt) { |
| 62 | errno = ENOENT; |
| 63 | return NULL; |
| 64 | } |
| 65 | |
| 66 | /* allocate a node */ |
| 67 | node = malloc(sizeof(struct discover_class_node)); |
| 68 | if (node == NULL) |
| 69 | return NULL; |
| 70 | |
| 71 | /* allocate array for perms */ |
Stephen Smalley | 76913d8 | 2014-07-09 13:25:56 -0400 | [diff] [blame] | 72 | node->perms = calloc(MAXVECTORS,sizeof(char*)); |
Joshua Brindle | 13cd4c8 | 2008-08-19 15:30:36 -0400 | [diff] [blame] | 73 | if (node->perms == NULL) |
| 74 | goto err1; |
| 75 | |
| 76 | /* load up the name */ |
| 77 | node->name = strdup(s); |
| 78 | if (node->name == NULL) |
| 79 | goto err2; |
| 80 | |
| 81 | /* load up class index */ |
| 82 | snprintf(path, sizeof path, "%s/class/%s/index", selinux_mnt,s); |
| 83 | fd = open(path, O_RDONLY); |
| 84 | if (fd < 0) |
| 85 | goto err3; |
| 86 | |
| 87 | memset(buf, 0, sizeof(buf)); |
| 88 | ret = read(fd, buf, sizeof(buf) - 1); |
| 89 | close(fd); |
| 90 | if (ret < 0) |
| 91 | goto err3; |
| 92 | |
Eamon Walsh | b27ff33 | 2009-02-27 18:05:24 -0500 | [diff] [blame] | 93 | if (sscanf(buf, "%hu", &node->value) != 1) |
Joshua Brindle | 13cd4c8 | 2008-08-19 15:30:36 -0400 | [diff] [blame] | 94 | goto err3; |
| 95 | |
| 96 | /* load up permission indicies */ |
| 97 | snprintf(path, sizeof path, "%s/class/%s/perms",selinux_mnt,s); |
| 98 | dir = opendir(path); |
| 99 | if (dir == NULL) |
| 100 | goto err3; |
| 101 | |
| 102 | dentry = readdir(dir); |
| 103 | while (dentry != NULL) { |
| 104 | unsigned int value; |
| 105 | struct stat m; |
| 106 | |
| 107 | snprintf(path, sizeof path, "%s/class/%s/perms/%s", selinux_mnt,s,dentry->d_name); |
Eric Paris | aa62cd6 | 2012-11-29 09:41:38 -0500 | [diff] [blame] | 108 | fd = open(path, O_RDONLY | O_CLOEXEC); |
| 109 | if (fd < 0) |
Joshua Brindle | 13cd4c8 | 2008-08-19 15:30:36 -0400 | [diff] [blame] | 110 | goto err4; |
| 111 | |
Eric Paris | aa62cd6 | 2012-11-29 09:41:38 -0500 | [diff] [blame] | 112 | if (fstat(fd, &m) < 0) { |
| 113 | close(fd); |
| 114 | goto err4; |
| 115 | } |
| 116 | |
Joshua Brindle | 13cd4c8 | 2008-08-19 15:30:36 -0400 | [diff] [blame] | 117 | if (m.st_mode & S_IFDIR) { |
Eric Paris | aa62cd6 | 2012-11-29 09:41:38 -0500 | [diff] [blame] | 118 | close(fd); |
Joshua Brindle | 13cd4c8 | 2008-08-19 15:30:36 -0400 | [diff] [blame] | 119 | dentry = readdir(dir); |
| 120 | continue; |
| 121 | } |
| 122 | |
Joshua Brindle | 13cd4c8 | 2008-08-19 15:30:36 -0400 | [diff] [blame] | 123 | memset(buf, 0, sizeof(buf)); |
| 124 | ret = read(fd, buf, sizeof(buf) - 1); |
| 125 | close(fd); |
| 126 | if (ret < 0) |
| 127 | goto err4; |
| 128 | |
| 129 | if (sscanf(buf, "%u", &value) != 1) |
| 130 | goto err4; |
| 131 | |
Stephen Smalley | 76913d8 | 2014-07-09 13:25:56 -0400 | [diff] [blame] | 132 | if (value == 0 || value > MAXVECTORS) |
Eric Paris | aa62cd6 | 2012-11-29 09:41:38 -0500 | [diff] [blame] | 133 | goto err4; |
| 134 | |
Joshua Brindle | 13cd4c8 | 2008-08-19 15:30:36 -0400 | [diff] [blame] | 135 | node->perms[value-1] = strdup(dentry->d_name); |
| 136 | if (node->perms[value-1] == NULL) |
| 137 | goto err4; |
| 138 | |
| 139 | dentry = readdir(dir); |
| 140 | } |
| 141 | closedir(dir); |
| 142 | |
| 143 | node->next = discover_class_cache; |
| 144 | discover_class_cache = node; |
| 145 | |
| 146 | return node; |
| 147 | |
| 148 | err4: |
| 149 | closedir(dir); |
Stephen Smalley | 76913d8 | 2014-07-09 13:25:56 -0400 | [diff] [blame] | 150 | for (i=0; i<MAXVECTORS; i++) |
Joshua Brindle | 13cd4c8 | 2008-08-19 15:30:36 -0400 | [diff] [blame] | 151 | free(node->perms[i]); |
| 152 | err3: |
| 153 | free(node->name); |
| 154 | err2: |
| 155 | free(node->perms); |
| 156 | err1: |
| 157 | free(node); |
| 158 | return NULL; |
| 159 | } |
| 160 | |
Joshua Brindle | 13cd4c8 | 2008-08-19 15:30:36 -0400 | [diff] [blame] | 161 | security_class_t string_to_security_class(const char *s) |
| 162 | { |
| 163 | struct discover_class_node *node; |
| 164 | |
Joshua Brindle | 13cd4c8 | 2008-08-19 15:30:36 -0400 | [diff] [blame] | 165 | node = get_class_cache_entry_name(s); |
| 166 | if (node == NULL) { |
| 167 | node = discover_class(s); |
| 168 | |
| 169 | if (node == NULL) { |
| 170 | errno = EINVAL; |
| 171 | return 0; |
| 172 | } |
| 173 | } |
| 174 | |
| 175 | return map_class(node->value); |
| 176 | } |
| 177 | |
rhatdan | 13b599d | 2012-10-17 15:28:49 -0400 | [diff] [blame] | 178 | security_class_t mode_to_security_class(mode_t m) { |
| 179 | |
| 180 | if (S_ISREG(m)) |
| 181 | return string_to_security_class("file"); |
| 182 | if (S_ISDIR(m)) |
| 183 | return string_to_security_class("dir"); |
| 184 | if (S_ISCHR(m)) |
| 185 | return string_to_security_class("chr_file"); |
| 186 | if (S_ISBLK(m)) |
| 187 | return string_to_security_class("blk_file"); |
| 188 | if (S_ISFIFO(m)) |
| 189 | return string_to_security_class("fifo_file"); |
| 190 | if (S_ISLNK(m)) |
| 191 | return string_to_security_class("lnk_file"); |
| 192 | if (S_ISSOCK(m)) |
| 193 | return string_to_security_class("sock_file"); |
| 194 | |
| 195 | errno=EINVAL; |
| 196 | return 0; |
| 197 | } |
| 198 | |
Joshua Brindle | 13cd4c8 | 2008-08-19 15:30:36 -0400 | [diff] [blame] | 199 | access_vector_t string_to_av_perm(security_class_t tclass, const char *s) |
| 200 | { |
| 201 | struct discover_class_node *node; |
| 202 | security_class_t kclass = unmap_class(tclass); |
| 203 | |
Joshua Brindle | 13cd4c8 | 2008-08-19 15:30:36 -0400 | [diff] [blame] | 204 | node = get_class_cache_entry_value(kclass); |
| 205 | if (node != NULL) { |
| 206 | size_t i; |
| 207 | for (i=0; i<MAXVECTORS && node->perms[i] != NULL; i++) |
| 208 | if (strcmp(node->perms[i],s) == 0) |
| 209 | return map_perm(tclass, 1<<i); |
| 210 | } |
| 211 | |
| 212 | errno = EINVAL; |
| 213 | return 0; |
| 214 | } |
| 215 | |
| 216 | const char *security_class_to_string(security_class_t tclass) |
| 217 | { |
| 218 | struct discover_class_node *node; |
| 219 | |
| 220 | tclass = unmap_class(tclass); |
| 221 | |
Joshua Brindle | 13cd4c8 | 2008-08-19 15:30:36 -0400 | [diff] [blame] | 222 | node = get_class_cache_entry_value(tclass); |
| 223 | if (node == NULL) |
Stephen Smalley | 76913d8 | 2014-07-09 13:25:56 -0400 | [diff] [blame] | 224 | return NULL; |
Joshua Brindle | 13cd4c8 | 2008-08-19 15:30:36 -0400 | [diff] [blame] | 225 | else |
| 226 | return node->name; |
| 227 | } |
| 228 | |
| 229 | const char *security_av_perm_to_string(security_class_t tclass, |
| 230 | access_vector_t av) |
| 231 | { |
| 232 | struct discover_class_node *node; |
| 233 | size_t i; |
| 234 | |
| 235 | av = unmap_perm(tclass, av); |
| 236 | tclass = unmap_class(tclass); |
| 237 | |
Joshua Brindle | 13cd4c8 | 2008-08-19 15:30:36 -0400 | [diff] [blame] | 238 | node = get_class_cache_entry_value(tclass); |
| 239 | if (av && node) |
| 240 | for (i = 0; i<MAXVECTORS; i++) |
| 241 | if ((1<<i) & av) |
| 242 | return node->perms[i]; |
| 243 | |
Stephen Smalley | 76913d8 | 2014-07-09 13:25:56 -0400 | [diff] [blame] | 244 | return NULL; |
Joshua Brindle | 13cd4c8 | 2008-08-19 15:30:36 -0400 | [diff] [blame] | 245 | } |
| 246 | |
| 247 | int security_av_string(security_class_t tclass, access_vector_t av, char **res) |
| 248 | { |
| 249 | unsigned int i = 0; |
| 250 | size_t len = 5; |
| 251 | access_vector_t tmp = av; |
| 252 | int rc = 0; |
| 253 | const char *str; |
| 254 | char *ptr; |
| 255 | |
| 256 | /* first pass computes the required length */ |
| 257 | while (tmp) { |
| 258 | if (tmp & 1) { |
| 259 | str = security_av_perm_to_string(tclass, av & (1<<i)); |
| 260 | if (str) |
| 261 | len += strlen(str) + 1; |
| 262 | else { |
| 263 | rc = -1; |
| 264 | errno = EINVAL; |
| 265 | goto out; |
| 266 | } |
| 267 | } |
| 268 | tmp >>= 1; |
| 269 | i++; |
| 270 | } |
| 271 | |
| 272 | *res = malloc(len); |
| 273 | if (!*res) { |
| 274 | rc = -1; |
| 275 | goto out; |
| 276 | } |
| 277 | |
| 278 | /* second pass constructs the string */ |
| 279 | i = 0; |
| 280 | tmp = av; |
| 281 | ptr = *res; |
| 282 | |
| 283 | if (!av) { |
| 284 | sprintf(ptr, "null"); |
| 285 | goto out; |
| 286 | } |
| 287 | |
| 288 | ptr += sprintf(ptr, "{ "); |
| 289 | while (tmp) { |
| 290 | if (tmp & 1) |
| 291 | ptr += sprintf(ptr, "%s ", security_av_perm_to_string( |
| 292 | tclass, av & (1<<i))); |
| 293 | tmp >>= 1; |
| 294 | i++; |
| 295 | } |
| 296 | sprintf(ptr, "}"); |
| 297 | out: |
| 298 | return rc; |
| 299 | } |
| 300 | |
| 301 | void print_access_vector(security_class_t tclass, access_vector_t av) |
| 302 | { |
| 303 | const char *permstr; |
| 304 | access_vector_t bit = 1; |
| 305 | |
| 306 | if (av == 0) { |
| 307 | printf(" null"); |
| 308 | return; |
| 309 | } |
| 310 | |
| 311 | printf(" {"); |
| 312 | |
| 313 | while (av) { |
| 314 | if (av & bit) { |
| 315 | permstr = security_av_perm_to_string(tclass, bit); |
| 316 | if (!permstr) |
| 317 | break; |
| 318 | printf(" %s", permstr); |
| 319 | av &= ~bit; |
| 320 | } |
| 321 | bit <<= 1; |
| 322 | } |
| 323 | |
| 324 | if (av) |
| 325 | printf(" 0x%x", av); |
| 326 | printf(" }"); |
| 327 | } |