| #include <stdarg.h> |
| #include <stdio.h> |
| #include <stdlib.h> |
| #include <string.h> |
| #include <inttypes.h> |
| #include <sys/types.h> |
| #include <unistd.h> |
| |
| #include <arpa/inet.h> |
| #include <errno.h> |
| #include <netinet/in.h> |
| #ifndef IPPROTO_DCCP |
| #define IPPROTO_DCCP 33 |
| #endif |
| #ifndef IPPROTO_SCTP |
| #define IPPROTO_SCTP 132 |
| #endif |
| |
| #include <sepol/policydb/avtab.h> |
| #include <sepol/policydb/conditional.h> |
| #include <sepol/policydb/flask.h> |
| #include <sepol/policydb/hashtab.h> |
| #include <sepol/policydb/polcaps.h> |
| #include <sepol/policydb/policydb.h> |
| #include <sepol/policydb/services.h> |
| #include <sepol/policydb/util.h> |
| |
| #include "kernel_to_common.h" |
| |
| |
| static char *cond_expr_to_str(struct policydb *pdb, struct cond_expr *expr) |
| { |
| struct cond_expr *curr; |
| struct strs *stack; |
| char *new_val; |
| char *str = NULL; |
| int rc; |
| |
| rc = stack_init(&stack); |
| if (rc != 0) { |
| goto exit; |
| } |
| |
| for (curr = expr; curr != NULL; curr = curr->next) { |
| if (curr->expr_type == COND_BOOL) { |
| char *val1 = pdb->p_bool_val_to_name[curr->bool - 1]; |
| new_val = create_str("%s", 1, val1); |
| } else { |
| const char *op; |
| uint32_t num_params; |
| char *val1 = NULL; |
| char *val2 = NULL; |
| |
| switch(curr->expr_type) { |
| case COND_NOT: op = "not"; num_params = 1; break; |
| case COND_OR: op = "or"; num_params = 2; break; |
| case COND_AND: op = "and"; num_params = 2; break; |
| case COND_XOR: op = "xor"; num_params = 2; break; |
| case COND_EQ: op = "eq"; num_params = 2; break; |
| case COND_NEQ: op = "neq"; num_params = 2; break; |
| default: |
| sepol_log_err("Unknown conditional operator: %i", |
| curr->expr_type); |
| goto exit; |
| } |
| |
| if (num_params == 2) { |
| val2 = stack_pop(stack); |
| if (!val2) { |
| sepol_log_err("Invalid conditional expression"); |
| goto exit; |
| } |
| } |
| val1 = stack_pop(stack); |
| if (!val1) { |
| sepol_log_err("Invalid conditional expression"); |
| free(val2); |
| goto exit; |
| } |
| if (num_params == 2) { |
| new_val = create_str("(%s %s %s)", 3, op, val1, val2); |
| free(val2); |
| } else { |
| new_val = create_str("(%s %s)", 2, op, val1); |
| } |
| free(val1); |
| } |
| if (!new_val) { |
| sepol_log_err("Invalid conditional expression"); |
| goto exit; |
| } |
| rc = stack_push(stack, new_val); |
| if (rc != 0) { |
| sepol_log_err("Out of memory"); |
| goto exit; |
| } |
| } |
| |
| new_val = stack_pop(stack); |
| if (!new_val || !stack_empty(stack)) { |
| sepol_log_err("Invalid conditional expression"); |
| goto exit; |
| } |
| |
| str = new_val; |
| |
| stack_destroy(&stack); |
| return str; |
| |
| exit: |
| while ((new_val = stack_pop(stack)) != NULL) { |
| free(new_val); |
| } |
| stack_destroy(&stack); |
| |
| return NULL; |
| } |
| |
| static char *constraint_expr_to_str(struct policydb *pdb, struct constraint_expr *expr, int *use_mls) |
| { |
| struct constraint_expr *curr; |
| struct strs *stack = NULL; |
| char *new_val = NULL; |
| const char *op; |
| char *str = NULL; |
| int rc; |
| |
| *use_mls = 0; |
| |
| rc = stack_init(&stack); |
| if (rc != 0) { |
| goto exit; |
| } |
| |
| for (curr = expr; curr; curr = curr->next) { |
| if (curr->expr_type == CEXPR_ATTR || curr->expr_type == CEXPR_NAMES) { |
| const char *attr1 = NULL; |
| const char *attr2 = NULL; |
| |
| switch (curr->op) { |
| case CEXPR_EQ: op = "eq"; break; |
| case CEXPR_NEQ: op = "neq"; break; |
| case CEXPR_DOM: op = "dom"; break; |
| case CEXPR_DOMBY: op = "domby"; break; |
| case CEXPR_INCOMP: op = "incomp"; break; |
| default: |
| sepol_log_err("Unknown constraint operator: %i", curr->op); |
| goto exit; |
| } |
| |
| switch (curr->attr) { |
| case CEXPR_USER: attr1 ="u1"; attr2 ="u2"; break; |
| case CEXPR_USER | CEXPR_TARGET: attr1 ="u2"; attr2 =""; break; |
| case CEXPR_USER | CEXPR_XTARGET: attr1 ="u3"; attr2 =""; break; |
| case CEXPR_ROLE: attr1 ="r1"; attr2 ="r2"; break; |
| case CEXPR_ROLE | CEXPR_TARGET: attr1 ="r2"; attr2 =""; break; |
| case CEXPR_ROLE | CEXPR_XTARGET: attr1 ="r3"; attr2 =""; break; |
| case CEXPR_TYPE: attr1 ="t1"; attr2 ="t2"; break; |
| case CEXPR_TYPE | CEXPR_TARGET: attr1 ="t2"; attr2 =""; break; |
| case CEXPR_TYPE | CEXPR_XTARGET: attr1 ="t3"; attr2 =""; break; |
| case CEXPR_L1L2: attr1 ="l1"; attr2 ="l2"; break; |
| case CEXPR_L1H2: attr1 ="l1"; attr2 ="h2"; break; |
| case CEXPR_H1L2: attr1 ="h1"; attr2 ="l2"; break; |
| case CEXPR_H1H2: attr1 ="h1"; attr2 ="h2"; break; |
| case CEXPR_L1H1: attr1 ="l1"; attr2 ="h1"; break; |
| case CEXPR_L2H2: attr1 ="l2"; attr2 ="h2"; break; |
| default: |
| sepol_log_err("Unknown constraint attribute: %i", |
| curr->attr); |
| goto exit; |
| } |
| |
| if (curr->attr >= CEXPR_XTARGET) { |
| *use_mls = 1; |
| } |
| |
| if (curr->expr_type == CEXPR_ATTR) { |
| new_val = create_str("(%s %s %s)", 3, op, attr1, attr2); |
| } else { |
| char *names = NULL; |
| if (curr->attr & CEXPR_TYPE) { |
| struct type_set *ts = curr->type_names; |
| names = ebitmap_to_str(&ts->types, pdb->p_type_val_to_name, 1); |
| } else if (curr->attr & CEXPR_USER) { |
| names = ebitmap_to_str(&curr->names, pdb->p_user_val_to_name, 1); |
| } else if (curr->attr & CEXPR_ROLE) { |
| names = ebitmap_to_str(&curr->names, pdb->p_role_val_to_name, 1); |
| } |
| if (!names) { |
| goto exit; |
| } |
| new_val = create_str("(%s %s %s)", 3, op, attr1, names); |
| free(names); |
| } |
| } else { |
| uint32_t num_params; |
| char *val1 = NULL; |
| char *val2 = NULL; |
| |
| switch (curr->expr_type) { |
| case CEXPR_NOT: op = "not"; num_params = 1; break; |
| case CEXPR_AND: op = "and"; num_params = 2; break; |
| case CEXPR_OR: op = "or"; num_params = 2; break; |
| default: |
| sepol_log_err("Unknown constraint expression type: %i", |
| curr->expr_type); |
| goto exit; |
| } |
| |
| if (num_params == 2) { |
| val2 = stack_pop(stack); |
| if (!val2) { |
| sepol_log_err("Invalid constraint expression"); |
| goto exit; |
| } |
| } |
| val1 = stack_pop(stack); |
| if (!val1) { |
| sepol_log_err("Invalid constraint expression"); |
| goto exit; |
| } |
| |
| if (num_params == 2) { |
| new_val = create_str("(%s %s %s)", 3, op, val1, val2); |
| free(val2); |
| } else { |
| new_val = create_str("(%s %s)", 2, op, val1); |
| } |
| free(val1); |
| } |
| if (!new_val) { |
| goto exit; |
| } |
| rc = stack_push(stack, new_val); |
| if (rc != 0) { |
| sepol_log_err("Out of memory"); |
| goto exit; |
| } |
| } |
| |
| new_val = stack_pop(stack); |
| if (!new_val || !stack_empty(stack)) { |
| sepol_log_err("Invalid constraint expression"); |
| goto exit; |
| } |
| |
| str = new_val; |
| |
| stack_destroy(&stack); |
| |
| return str; |
| |
| exit: |
| while ((new_val = stack_pop(stack)) != NULL) { |
| free(new_val); |
| } |
| stack_destroy(&stack); |
| |
| return NULL; |
| } |
| |
| static int class_constraint_rules_to_strs(struct policydb *pdb, char *classkey, |
| class_datum_t *class, |
| struct constraint_node *constraint_rules, |
| struct strs *mls_list, |
| struct strs *non_mls_list) |
| { |
| int rc = 0; |
| struct constraint_node *curr; |
| char *expr = NULL; |
| int is_mls; |
| char *perms; |
| const char *format_str; |
| struct strs *strs; |
| |
| for (curr = constraint_rules; curr != NULL; curr = curr->next) { |
| expr = constraint_expr_to_str(pdb, curr->expr, &is_mls); |
| if (!expr) { |
| rc = -1; |
| goto exit; |
| } |
| |
| perms = sepol_av_to_string(pdb, class->s.value, curr->permissions); |
| |
| if (is_mls) { |
| format_str = "(mlsconstrain (%s (%s)) %s)"; |
| strs = mls_list; |
| } else { |
| format_str = "(constrain (%s (%s)) %s)"; |
| strs = non_mls_list; |
| } |
| |
| rc = strs_create_and_add(strs, format_str, 3, classkey, perms+1, expr); |
| free(expr); |
| if (rc != 0) { |
| goto exit; |
| } |
| } |
| |
| return 0; |
| exit: |
| sepol_log_err("Error gathering constraint rules\n"); |
| return rc; |
| } |
| |
| static int class_validatetrans_rules_to_strs(struct policydb *pdb, char *classkey, |
| struct constraint_node *validatetrans_rules, |
| struct strs *mls_list, |
| struct strs *non_mls_list) |
| { |
| struct constraint_node *curr; |
| char *expr = NULL; |
| int is_mls; |
| const char *format_str; |
| struct strs *strs; |
| int rc = 0; |
| |
| for (curr = validatetrans_rules; curr != NULL; curr = curr->next) { |
| expr = constraint_expr_to_str(pdb, curr->expr, &is_mls); |
| if (!expr) { |
| rc = -1; |
| goto exit; |
| } |
| |
| if (is_mls) { |
| format_str = "(mlsvalidatetrans %s %s)"; |
| strs = mls_list; |
| } else { |
| format_str = "(validatetrans %s %s)"; |
| strs = non_mls_list; |
| } |
| |
| rc = strs_create_and_add(strs, format_str, 2, classkey, expr); |
| free(expr); |
| if (rc != 0) { |
| goto exit; |
| } |
| } |
| |
| exit: |
| return rc; |
| } |
| |
| static int constraint_rules_to_strs(struct policydb *pdb, struct strs *mls_strs, struct strs *non_mls_strs) |
| { |
| class_datum_t *class; |
| char *name; |
| unsigned i; |
| int rc = 0; |
| |
| for (i=0; i < pdb->p_classes.nprim; i++) { |
| class = pdb->class_val_to_struct[i]; |
| if (class->constraints) { |
| name = pdb->p_class_val_to_name[i]; |
| rc = class_constraint_rules_to_strs(pdb, name, class, class->constraints, mls_strs, non_mls_strs); |
| if (rc != 0) { |
| goto exit; |
| } |
| } |
| } |
| |
| strs_sort(mls_strs); |
| strs_sort(non_mls_strs); |
| |
| exit: |
| return rc; |
| } |
| |
| static int validatetrans_rules_to_strs(struct policydb *pdb, struct strs *mls_strs, struct strs *non_mls_strs) |
| { |
| class_datum_t *class; |
| char *name; |
| unsigned i; |
| int rc = 0; |
| |
| for (i=0; i < pdb->p_classes.nprim; i++) { |
| class = pdb->class_val_to_struct[i]; |
| if (class->validatetrans) { |
| name = pdb->p_class_val_to_name[i]; |
| rc = class_validatetrans_rules_to_strs(pdb, name, class->validatetrans, mls_strs, non_mls_strs); |
| if (rc != 0) { |
| goto exit; |
| } |
| } |
| } |
| |
| strs_sort(mls_strs); |
| strs_sort(non_mls_strs); |
| |
| exit: |
| return rc; |
| } |
| |
| static int write_handle_unknown_to_cil(FILE *out, struct policydb *pdb) |
| { |
| const char *action; |
| |
| switch (pdb->handle_unknown) { |
| case SEPOL_DENY_UNKNOWN: |
| action = "deny"; |
| break; |
| case SEPOL_REJECT_UNKNOWN: |
| action = "reject"; |
| break; |
| case SEPOL_ALLOW_UNKNOWN: |
| action = "allow"; |
| break; |
| default: |
| sepol_log_err("Unknown value for handle-unknown: %i", pdb->handle_unknown); |
| return -1; |
| } |
| |
| sepol_printf(out, "(handleunknown %s)\n", action); |
| |
| return 0; |
| } |
| |
| static char *class_or_common_perms_to_str(symtab_t *permtab) |
| { |
| struct strs *strs; |
| char *perms = NULL; |
| int rc; |
| |
| rc = strs_init(&strs, permtab->nprim); |
| if (rc != 0) { |
| goto exit; |
| } |
| |
| rc = hashtab_map(permtab->table, hashtab_ordered_to_strs, strs); |
| if (rc != 0) { |
| goto exit; |
| } |
| |
| if (strs_num_items(strs) > 0) { |
| perms = strs_to_str(strs); |
| } |
| |
| exit: |
| strs_destroy(&strs); |
| |
| return perms; |
| } |
| |
| static int write_class_decl_rules_to_cil(FILE *out, struct policydb *pdb) |
| { |
| class_datum_t *class; |
| common_datum_t *common; |
| int *used; |
| char *name, *perms; |
| unsigned i; |
| int rc = 0; |
| |
| /* class */ |
| for (i=0; i < pdb->p_classes.nprim; i++) { |
| class = pdb->class_val_to_struct[i]; |
| name = pdb->p_class_val_to_name[i]; |
| perms = class_or_common_perms_to_str(&class->permissions); |
| if (perms) { |
| sepol_printf(out, "(class %s (%s))\n", name, perms); |
| free(perms); |
| } else { |
| sepol_printf(out, "(class %s ())\n", name); |
| } |
| } |
| |
| /* classorder */ |
| sepol_printf(out, "(classorder ("); |
| name = NULL; |
| for (i=0; i < pdb->p_classes.nprim; i++) { |
| if (name) { |
| sepol_printf(out, "%s ", name); |
| } |
| name = pdb->p_class_val_to_name[i]; |
| } |
| if (name) { |
| sepol_printf(out, "%s", name); |
| } |
| sepol_printf(out, "))\n"); |
| |
| /* classcommon */ |
| for (i=0; i < pdb->p_classes.nprim; i++) { |
| class = pdb->class_val_to_struct[i]; |
| name = pdb->p_class_val_to_name[i]; |
| if (class->comkey != NULL) { |
| sepol_printf(out, "(classcommon %s %s)\n", name, class->comkey); |
| } |
| } |
| |
| /* common */ |
| used = calloc(pdb->p_commons.nprim, sizeof(*used)); |
| if (!used) { |
| sepol_log_err("Out of memory"); |
| rc = -1; |
| goto exit; |
| } |
| for (i=0; i < pdb->p_classes.nprim; i++) { |
| class = pdb->class_val_to_struct[i]; |
| name = class->comkey; |
| if (name != NULL) { |
| common = hashtab_search(pdb->p_commons.table, name); |
| if (!common) { |
| rc = -1; |
| free(used); |
| goto exit; |
| } |
| /* Only write common rule once */ |
| if (!used[common->s.value-1]) { |
| perms = class_or_common_perms_to_str(&common->permissions); |
| if (!perms) { |
| rc = -1; |
| free(perms); |
| free(used); |
| goto exit; |
| } |
| |
| sepol_printf(out, "(common %s (%s))\n", name, perms); |
| free(perms); |
| used[common->s.value-1] = 1; |
| } |
| } |
| } |
| free(used); |
| |
| exit: |
| if (rc != 0) { |
| sepol_log_err("Error writing class rules to CIL\n"); |
| } |
| |
| return rc; |
| } |
| |
| static int write_sids_to_cil(FILE *out, const char *const *sid_to_str, struct ocontext *isids) |
| { |
| struct ocontext *isid; |
| struct strs *strs; |
| char *sid; |
| char *prev; |
| unsigned i; |
| int rc; |
| |
| rc = strs_init(&strs, SECINITSID_NUM+1); |
| if (rc != 0) { |
| goto exit; |
| } |
| |
| for (isid = isids; isid != NULL; isid = isid->next) { |
| i = isid->sid[0]; |
| rc = strs_add_at_index(strs, (char *)sid_to_str[i], i); |
| if (rc != 0) { |
| goto exit; |
| } |
| } |
| |
| for (i=0; i<strs_num_items(strs); i++) { |
| sid = strs_read_at_index(strs, i); |
| if (!sid) { |
| continue; |
| } |
| sepol_printf(out, "(sid %s)\n", sid); |
| } |
| |
| sepol_printf(out, "(sidorder ("); |
| prev = NULL; |
| for (i=0; i<strs_num_items(strs); i++) { |
| sid = strs_read_at_index(strs, i); |
| if (!sid) { |
| continue; |
| } |
| if (prev) { |
| sepol_printf(out, "%s ", prev); |
| } |
| prev = sid; |
| } |
| if (prev) { |
| sepol_printf(out, "%s", prev); |
| } |
| sepol_printf(out, "))\n"); |
| |
| exit: |
| strs_destroy(&strs); |
| if (rc != 0) { |
| sepol_log_err("Error writing sid rules to CIL\n"); |
| } |
| |
| return rc; |
| } |
| |
| static int write_sid_decl_rules_to_cil(FILE *out, struct policydb *pdb) |
| { |
| int rc = 0; |
| |
| if (pdb->target_platform == SEPOL_TARGET_SELINUX) { |
| rc = write_sids_to_cil(out, selinux_sid_to_str, pdb->ocontexts[0]); |
| } else if (pdb->target_platform == SEPOL_TARGET_XEN) { |
| rc = write_sids_to_cil(out, xen_sid_to_str, pdb->ocontexts[0]); |
| } else { |
| sepol_log_err("Unknown target platform: %i", pdb->target_platform); |
| rc = -1; |
| } |
| |
| return rc; |
| } |
| |
| static int write_default_user_to_cil(FILE *out, char *class_name, class_datum_t *class) |
| { |
| const char *dft; |
| |
| switch (class->default_user) { |
| case DEFAULT_SOURCE: |
| dft = "source"; |
| break; |
| case DEFAULT_TARGET: |
| dft = "target"; |
| break; |
| default: |
| sepol_log_err("Unknown default role value: %i", class->default_user); |
| return -1; |
| } |
| sepol_printf(out, "(defaultuser %s %s)\n", class_name, dft); |
| |
| return 0; |
| } |
| |
| static int write_default_role_to_cil(FILE *out, char *class_name, class_datum_t *class) |
| { |
| const char *dft; |
| |
| switch (class->default_role) { |
| case DEFAULT_SOURCE: |
| dft = "source"; |
| break; |
| case DEFAULT_TARGET: |
| dft = "target"; |
| break; |
| default: |
| sepol_log_err("Unknown default role value: %i", class->default_role); |
| return -1; |
| } |
| sepol_printf(out, "(defaultrole %s %s)\n", class_name, dft); |
| |
| return 0; |
| } |
| |
| static int write_default_type_to_cil(FILE *out, char *class_name, class_datum_t *class) |
| { |
| const char *dft; |
| |
| switch (class->default_type) { |
| case DEFAULT_SOURCE: |
| dft = "source"; |
| break; |
| case DEFAULT_TARGET: |
| dft = "target"; |
| break; |
| default: |
| sepol_log_err("Unknown default type value: %i", class->default_type); |
| return -1; |
| } |
| sepol_printf(out, "(defaulttype %s %s)\n", class_name, dft); |
| |
| return 0; |
| } |
| |
| static int write_default_range_to_cil(FILE *out, char *class_name, class_datum_t *class) |
| { |
| const char *dft; |
| |
| switch (class->default_range) { |
| case DEFAULT_SOURCE_LOW: |
| dft = "source low"; |
| break; |
| case DEFAULT_SOURCE_HIGH: |
| dft = "source high"; |
| break; |
| case DEFAULT_SOURCE_LOW_HIGH: |
| dft = "source low-high"; |
| break; |
| case DEFAULT_TARGET_LOW: |
| dft = "target low"; |
| break; |
| case DEFAULT_TARGET_HIGH: |
| dft = "target high"; |
| break; |
| case DEFAULT_TARGET_LOW_HIGH: |
| dft = "target low-high"; |
| break; |
| default: |
| sepol_log_err("Unknown default type value: %i", class->default_range); |
| return -1; |
| } |
| sepol_printf(out, "(defaultrange %s %s)\n", class_name, dft); |
| |
| return 0; |
| } |
| |
| static int write_default_rules_to_cil(FILE *out, struct policydb *pdb) |
| { |
| class_datum_t *class; |
| unsigned i; |
| int rc = 0; |
| |
| /* default_user */ |
| for (i=0; i < pdb->p_classes.nprim; i++) { |
| class = pdb->class_val_to_struct[i]; |
| if (class->default_user != 0) { |
| rc = write_default_user_to_cil(out, pdb->p_class_val_to_name[i], class); |
| if (rc != 0) { |
| goto exit; |
| } |
| } |
| } |
| |
| /* default_role */ |
| for (i=0; i < pdb->p_classes.nprim; i++) { |
| class = pdb->class_val_to_struct[i]; |
| if (class->default_role != 0) { |
| rc = write_default_role_to_cil(out, pdb->p_class_val_to_name[i], class); |
| if (rc != 0) { |
| goto exit; |
| } |
| } |
| } |
| |
| /* default_type */ |
| for (i=0; i < pdb->p_classes.nprim; i++) { |
| class = pdb->class_val_to_struct[i]; |
| if (class->default_type != 0) { |
| rc = write_default_type_to_cil(out, pdb->p_class_val_to_name[i], class); |
| if (rc != 0) { |
| goto exit; |
| } |
| } |
| } |
| |
| if (!pdb->mls) { |
| return 0; |
| } |
| |
| /* default_range */ |
| for (i=0; i < pdb->p_classes.nprim; i++) { |
| class = pdb->class_val_to_struct[i]; |
| if (class->default_range) { |
| rc = write_default_range_to_cil(out, pdb->p_class_val_to_name[i], class); |
| if (rc != 0) { |
| goto exit; |
| } |
| } |
| } |
| |
| exit: |
| if (rc != 0) { |
| sepol_log_err("Error writing default rules to CIL\n"); |
| } |
| |
| return rc; |
| } |
| |
| static void write_default_mls_level(FILE *out) |
| { |
| sepol_printf(out, "(sensitivity s0)"); |
| sepol_printf(out, "(sensitivityorder (s0))"); |
| sepol_printf(out, "(level %s (s0))", DEFAULT_LEVEL); |
| } |
| |
| static int map_sensitivity_aliases_to_strs(char *key, void *data, void *args) |
| { |
| level_datum_t *sens = data; |
| struct strs *strs = args; |
| int rc = 0; |
| |
| if (sens->isalias) { |
| rc = strs_add(strs, key); |
| } |
| |
| return rc; |
| } |
| |
| static int write_sensitivity_rules_to_cil(FILE *out, struct policydb *pdb) |
| { |
| level_datum_t *level; |
| char *prev, *name, *actual; |
| struct strs *strs; |
| unsigned i, num; |
| int rc = 0; |
| |
| rc = strs_init(&strs, pdb->p_levels.nprim); |
| if (rc != 0) { |
| goto exit; |
| } |
| |
| /* sensitivities */ |
| for (i=0; i < pdb->p_levels.nprim; i++) { |
| name = pdb->p_sens_val_to_name[i]; |
| if (!name) continue; |
| level = hashtab_search(pdb->p_levels.table, name); |
| if (!level) { |
| rc = -1; |
| goto exit; |
| } |
| if (level->isalias) continue; |
| |
| sepol_printf(out, "(sensitivity %s)\n", name); |
| } |
| |
| /* sensitivityorder */ |
| sepol_printf(out, "(sensitivityorder ("); |
| prev = NULL; |
| for (i=0; i < pdb->p_levels.nprim; i++) { |
| name = pdb->p_sens_val_to_name[i]; |
| if (!name) continue; |
| level = hashtab_search(pdb->p_levels.table, name); |
| if (!level) { |
| rc = -1; |
| goto exit; |
| } |
| if (level->isalias) continue; |
| |
| if (prev) { |
| sepol_printf(out, "%s ", prev); |
| } |
| prev = name; |
| } |
| if (prev) { |
| sepol_printf(out, "%s", prev); |
| } |
| sepol_printf(out, "))\n"); |
| |
| rc = hashtab_map(pdb->p_levels.table, map_sensitivity_aliases_to_strs, strs); |
| if (rc != 0) { |
| goto exit; |
| } |
| |
| strs_sort(strs); |
| |
| num = strs_num_items(strs); |
| |
| /* sensitivity aliases */ |
| for (i=0; i < num; i++) { |
| name = strs_read_at_index(strs, i); |
| level = hashtab_search(pdb->p_levels.table, name); |
| if (!level) { |
| rc = -1; |
| goto exit; |
| } |
| sepol_printf(out, "(sensitivityalias %s)\n", name); |
| } |
| |
| /* sensitivity aliases to actual */ |
| for (i=0; i < num; i++) { |
| name = strs_read_at_index(strs, i); |
| level = hashtab_search(pdb->p_levels.table, name); |
| if (!level) { |
| rc = -1; |
| goto exit; |
| } |
| actual = pdb->p_sens_val_to_name[level->level->sens - 1]; |
| sepol_printf(out, "(sensitivityaliasactual %s %s)\n", name, actual); |
| } |
| |
| exit: |
| strs_destroy(&strs); |
| |
| if (rc != 0) { |
| sepol_log_err("Error writing sensitivity rules to CIL\n"); |
| } |
| |
| return rc; |
| } |
| |
| static int map_category_aliases_to_strs(char *key, void *data, void *args) |
| { |
| cat_datum_t *cat = data; |
| struct strs *strs = args; |
| int rc = 0; |
| |
| if (cat->isalias) { |
| rc = strs_add(strs, key); |
| } |
| |
| return rc; |
| } |
| |
| static int write_category_rules_to_cil(FILE *out, struct policydb *pdb) |
| { |
| cat_datum_t *cat; |
| char *prev, *name, *actual; |
| struct strs *strs; |
| unsigned i, num; |
| int rc = 0; |
| |
| rc = strs_init(&strs, pdb->p_levels.nprim); |
| if (rc != 0) { |
| goto exit; |
| } |
| |
| /* categories */ |
| for (i=0; i < pdb->p_cats.nprim; i++) { |
| name = pdb->p_cat_val_to_name[i]; |
| if (!name) continue; |
| cat = hashtab_search(pdb->p_cats.table, name); |
| if (!cat) { |
| rc = -1; |
| goto exit; |
| } |
| if (cat->isalias) continue; |
| |
| sepol_printf(out, "(category %s)\n", name); |
| } |
| |
| /* categoryorder */ |
| sepol_printf(out, "(categoryorder ("); |
| prev = NULL; |
| for (i=0; i < pdb->p_cats.nprim; i++) { |
| name = pdb->p_cat_val_to_name[i]; |
| if (!name) continue; |
| cat = hashtab_search(pdb->p_cats.table, name); |
| if (!cat) { |
| rc = -1; |
| goto exit; |
| } |
| if (cat->isalias) continue; |
| |
| if (prev) { |
| sepol_printf(out, "%s ", prev); |
| } |
| prev = name; |
| } |
| if (prev) { |
| sepol_printf(out, "%s", prev); |
| } |
| sepol_printf(out, "))\n"); |
| |
| rc = hashtab_map(pdb->p_cats.table, map_category_aliases_to_strs, strs); |
| if (rc != 0) { |
| goto exit; |
| } |
| |
| strs_sort(strs); |
| |
| num = strs_num_items(strs); |
| |
| /* category aliases */ |
| for (i=0; i < num; i++) { |
| name = strs_read_at_index(strs, i); |
| cat = hashtab_search(pdb->p_cats.table, name); |
| if (!cat) { |
| rc = -1; |
| goto exit; |
| } |
| sepol_printf(out, "(categoryalias %s)\n", name); |
| } |
| |
| /* category aliases to actual */ |
| for (i=0; i < num; i++) { |
| name = strs_read_at_index(strs, i); |
| cat = hashtab_search(pdb->p_cats.table, name); |
| if (!cat) { |
| rc = -1; |
| goto exit; |
| } |
| actual = pdb->p_cat_val_to_name[cat->s.value - 1]; |
| sepol_printf(out, "(categoryaliasactual %s %s)\n", name, actual); |
| } |
| |
| exit: |
| strs_destroy(&strs); |
| |
| if (rc != 0) { |
| sepol_log_err("Error writing category rules to CIL\n"); |
| } |
| |
| return rc; |
| } |
| |
| static size_t cats_ebitmap_len(struct ebitmap *cats, char **val_to_name) |
| { |
| struct ebitmap_node *node; |
| uint32_t i, start, range; |
| size_t len = 0; |
| |
| range = 0; |
| ebitmap_for_each_bit(cats, node, i) { |
| if (!ebitmap_get_bit(cats, i)) |
| continue; |
| |
| if (range == 0) |
| start = i; |
| |
| range++; |
| |
| if (ebitmap_get_bit(cats, i+1)) |
| continue; |
| |
| len += strlen(val_to_name[start]); |
| if (range > 2) { |
| len += strlen(val_to_name[i-1]) + strlen("(range ) "); |
| } else if (range == 2) { |
| len += strlen(val_to_name[i-1]) + 2; |
| } else if (range == 1) { |
| len += 1; |
| } |
| |
| range = 0; |
| } |
| |
| if (len > 0) { |
| len += 2; /* For '(' and ')'. '\0' overwrites last ' ' */ |
| } |
| |
| return len; |
| } |
| |
| static char *cats_ebitmap_to_str(struct ebitmap *cats, char **val_to_name) |
| { |
| struct ebitmap_node *node; |
| uint32_t i, start, range; |
| char *catsbuf, *p; |
| const char *fmt; |
| int len, remaining; |
| |
| remaining = (int)cats_ebitmap_len(cats, val_to_name); |
| catsbuf = malloc(remaining); |
| if (!catsbuf) { |
| goto exit; |
| } |
| |
| p = catsbuf; |
| |
| *p++ = '('; |
| remaining--;; |
| |
| range = 0; |
| ebitmap_for_each_bit(cats, node, i) { |
| if (!ebitmap_get_bit(cats, i)) |
| continue; |
| |
| if (range == 0) |
| start = i; |
| |
| range++; |
| |
| if (ebitmap_get_bit(cats, i+1)) |
| continue; |
| |
| if (range > 1) { |
| fmt = (range == 2) ? "%s %s " : "(range %s %s) "; |
| len = snprintf(p, remaining, fmt, |
| val_to_name[start], val_to_name[i]); |
| } else { |
| len = snprintf(p, remaining, "%s ", val_to_name[start]); |
| } |
| if (len < 0 || len >= remaining) { |
| goto exit; |
| } |
| p += len; |
| remaining -= len; |
| |
| range = 0; |
| } |
| |
| *(p-1) = ')'; /* Remove trailing ' ' */ |
| *p = '\0'; |
| |
| return catsbuf; |
| |
| exit: |
| free(catsbuf); |
| return NULL; |
| } |
| |
| static int write_sensitivitycategory_rules_to_cil(FILE *out, struct policydb *pdb) |
| { |
| level_datum_t *level; |
| char *name, *cats; |
| unsigned i; |
| int rc = 0; |
| |
| /* sensitivities */ |
| for (i=0; i < pdb->p_levels.nprim; i++) { |
| name = pdb->p_sens_val_to_name[i]; |
| if (!name) continue; |
| level = hashtab_search(pdb->p_levels.table, name); |
| if (!level) { |
| rc = -1; |
| goto exit; |
| } |
| if (level->isalias) continue; |
| |
| if (ebitmap_cardinality(&level->level->cat) > 0) { |
| cats = cats_ebitmap_to_str(&level->level->cat, pdb->p_cat_val_to_name); |
| sepol_printf(out, "(sensitivitycategory %s %s)\n", name, cats); |
| free(cats); |
| } |
| } |
| |
| exit: |
| if (rc != 0) { |
| sepol_log_err("Error writing sensitivitycategory rules to CIL\n"); |
| } |
| |
| return rc; |
| } |
| |
| static int write_mls_rules_to_cil(FILE *out, struct policydb *pdb) |
| { |
| int rc = 0; |
| |
| if (!pdb->mls) { |
| sepol_printf(out, "(mls false)\n"); |
| /* CIL requires MLS, even if the kernel binary won't have it */ |
| write_default_mls_level(out); |
| return 0; |
| } |
| |
| sepol_printf(out, "(mls true)\n"); |
| |
| rc = write_sensitivity_rules_to_cil(out, pdb); |
| if (rc != 0) { |
| goto exit; |
| } |
| |
| rc = write_category_rules_to_cil(out, pdb); |
| if (rc != 0) { |
| goto exit; |
| } |
| |
| rc = write_sensitivitycategory_rules_to_cil(out, pdb); |
| if (rc != 0) { |
| goto exit; |
| } |
| |
| exit: |
| if (rc != 0) { |
| sepol_log_err("Error writing mls rules to CIL\n"); |
| } |
| |
| return rc; |
| } |
| |
| static int write_polcap_rules_to_cil(FILE *out, struct policydb *pdb) |
| { |
| struct strs *strs; |
| struct ebitmap_node *node; |
| const char *name; |
| uint32_t i; |
| int rc = 0; |
| |
| rc = strs_init(&strs, 32); |
| if (rc != 0) { |
| goto exit; |
| } |
| |
| ebitmap_for_each_bit(&pdb->policycaps, node, i) { |
| if (!ebitmap_get_bit(&pdb->policycaps, i)) continue; |
| |
| name = sepol_polcap_getname(i); |
| if (name == NULL) { |
| sepol_log_err("Unknown policy capability id: %i", i); |
| rc = -1; |
| goto exit; |
| } |
| |
| rc = strs_create_and_add(strs, "(policycap %s)", 1, name); |
| if (rc != 0) { |
| goto exit; |
| } |
| } |
| |
| strs_sort(strs); |
| strs_write_each(strs, out); |
| |
| exit: |
| strs_free_all(strs); |
| strs_destroy(&strs); |
| |
| if (rc != 0) { |
| sepol_log_err("Error writing polcap rules to CIL\n"); |
| } |
| |
| return rc; |
| } |
| |
| static int write_type_attributes_to_cil(FILE *out, struct policydb *pdb) |
| { |
| type_datum_t *type; |
| char *name; |
| struct strs *strs; |
| unsigned i, num; |
| int rc = 0; |
| |
| rc = strs_init(&strs, pdb->p_types.nprim); |
| if (rc != 0) { |
| goto exit; |
| } |
| |
| for (i=0; i < pdb->p_types.nprim; i++) { |
| type = pdb->type_val_to_struct[i]; |
| if (type->flavor == TYPE_ATTRIB) { |
| rc = strs_add(strs, pdb->p_type_val_to_name[i]); |
| if (rc != 0) { |
| goto exit; |
| } |
| } |
| } |
| |
| strs_sort(strs); |
| |
| num = strs_num_items(strs); |
| for (i = 0; i < num; i++) { |
| name = strs_read_at_index(strs, i); |
| if (!name) { |
| rc = -1; |
| goto exit; |
| } |
| sepol_printf(out, "(typeattribute %s)\n", name); |
| } |
| |
| exit: |
| strs_destroy(&strs); |
| |
| if (rc != 0) { |
| sepol_log_err("Error writing typeattribute rules to CIL\n"); |
| } |
| |
| return rc; |
| } |
| |
| static int write_role_attributes_to_cil(FILE *out, struct policydb *pdb) |
| { |
| role_datum_t *role; |
| char *name; |
| struct strs *strs; |
| unsigned i, num; |
| int rc = 0; |
| |
| rc = strs_init(&strs, pdb->p_roles.nprim); |
| if (rc != 0) { |
| goto exit; |
| } |
| |
| for (i=0; i < pdb->p_roles.nprim; i++) { |
| role = pdb->role_val_to_struct[i]; |
| if (role && role->flavor == ROLE_ATTRIB) { |
| rc = strs_add(strs, pdb->p_role_val_to_name[i]); |
| if (rc != 0) { |
| goto exit; |
| } |
| } |
| } |
| |
| strs_sort(strs); |
| |
| num = strs_num_items(strs); |
| for (i=0; i<num; i++) { |
| name = strs_read_at_index(strs, i); |
| if (!name) { |
| rc = -1; |
| goto exit; |
| } |
| sepol_printf(out, "(roleattribute %s)\n", name); |
| } |
| |
| exit: |
| strs_destroy(&strs); |
| |
| if (rc != 0) { |
| sepol_log_err("Error writing roleattribute rules to CIL\n"); |
| } |
| |
| return rc; |
| } |
| |
| static int map_boolean_to_strs(char *key, void *data, void *args) |
| { |
| struct strs *strs = (struct strs *)args; |
| struct cond_bool_datum *boolean = data; |
| const char *value; |
| |
| value = boolean->state ? "true" : "false"; |
| |
| return strs_create_and_add(strs, "(boolean %s %s)", 2, key, value); |
| } |
| |
| static int write_boolean_decl_rules_to_cil(FILE *out, struct policydb *pdb) |
| { |
| struct strs *strs; |
| int rc = 0; |
| |
| rc = strs_init(&strs, 32); |
| if (rc != 0) { |
| goto exit; |
| } |
| |
| rc = hashtab_map(pdb->p_bools.table, map_boolean_to_strs, strs); |
| if (rc != 0) { |
| goto exit; |
| } |
| |
| strs_sort(strs); |
| strs_write_each(strs, out); |
| |
| exit: |
| strs_free_all(strs); |
| strs_destroy(&strs); |
| |
| if (rc != 0) { |
| sepol_log_err("Error writing boolean declarations to CIL\n"); |
| } |
| |
| return rc; |
| } |
| |
| static int write_type_decl_rules_to_cil(FILE *out, struct policydb *pdb) |
| { |
| type_datum_t *type; |
| struct strs *strs; |
| char *name; |
| unsigned i, num; |
| int rc = 0; |
| |
| rc = strs_init(&strs, pdb->p_types.nprim); |
| if (rc != 0) { |
| goto exit; |
| } |
| |
| for (i=0; i < pdb->p_types.nprim; i++) { |
| type = pdb->type_val_to_struct[i]; |
| if (type->flavor == TYPE_TYPE && type->primary) { |
| rc = strs_add(strs, pdb->p_type_val_to_name[i]); |
| if (rc != 0) { |
| goto exit; |
| } |
| } |
| } |
| |
| strs_sort(strs); |
| |
| num = strs_num_items(strs); |
| for (i=0; i<num; i++) { |
| name = strs_read_at_index(strs, i); |
| if (!name) { |
| rc = -1; |
| goto exit; |
| } |
| sepol_printf(out, "(type %s)\n", name); |
| } |
| |
| exit: |
| strs_destroy(&strs); |
| |
| if (rc != 0) { |
| sepol_log_err("Error writing type declarations to CIL\n"); |
| } |
| |
| return rc; |
| } |
| |
| static int write_type_alias_rules_to_cil(FILE *out, struct policydb *pdb) |
| { |
| type_datum_t *alias; |
| struct strs *strs; |
| char *name; |
| char *type; |
| unsigned i, num; |
| int rc = 0; |
| |
| rc = strs_init(&strs, pdb->p_types.nprim); |
| if (rc != 0) { |
| goto exit; |
| } |
| |
| for (i=0; i < pdb->p_types.nprim; i++) { |
| alias = pdb->type_val_to_struct[i]; |
| if (!alias->primary) { |
| rc = strs_add(strs, pdb->p_type_val_to_name[i]); |
| if (rc != 0) { |
| goto exit; |
| } |
| } |
| } |
| |
| strs_sort(strs); |
| |
| num = strs_num_items(strs); |
| for (i=0; i<num; i++) { |
| name = strs_read_at_index(strs, i); |
| if (!name) { |
| rc = -1; |
| goto exit; |
| } |
| sepol_printf(out, "(typealias %s)\n", name); |
| } |
| |
| for (i=0; i<num; i++) { |
| name = strs_read_at_index(strs, i); |
| if (!name) { |
| rc = -1; |
| goto exit; |
| } |
| alias = hashtab_search(pdb->p_types.table, name); |
| if (!alias) { |
| rc = -1; |
| goto exit; |
| } |
| type = pdb->p_type_val_to_name[alias->s.value - 1]; |
| sepol_printf(out, "(typealiasactual %s %s)\n", name, type); |
| } |
| |
| exit: |
| strs_destroy(&strs); |
| |
| if (rc != 0) { |
| sepol_log_err("Error writing type alias rules to CIL\n"); |
| } |
| |
| return rc; |
| } |
| |
| static int write_type_bounds_rules_to_cil(FILE *out, struct policydb *pdb) |
| { |
| type_datum_t *type; |
| struct strs *strs; |
| char *parent; |
| char *child; |
| unsigned i, num; |
| int rc = 0; |
| |
| rc = strs_init(&strs, pdb->p_types.nprim); |
| if (rc != 0) { |
| goto exit; |
| } |
| |
| for (i=0; i < pdb->p_types.nprim; i++) { |
| type = pdb->type_val_to_struct[i]; |
| if (type->flavor == TYPE_TYPE) { |
| if (type->bounds > 0) { |
| rc = strs_add(strs, pdb->p_type_val_to_name[i]); |
| if (rc != 0) { |
| goto exit; |
| } |
| } |
| } |
| } |
| |
| strs_sort(strs); |
| |
| num = strs_num_items(strs); |
| for (i=0; i<num; i++) { |
| child = strs_read_at_index(strs, i); |
| if (!child) { |
| rc = -1; |
| goto exit; |
| } |
| type = hashtab_search(pdb->p_types.table, child); |
| if (!type) { |
| rc = -1; |
| goto exit; |
| } |
| parent = pdb->p_type_val_to_name[type->bounds - 1]; |
| sepol_printf(out, "(typebounds %s %s)\n", parent, child); |
| } |
| |
| exit: |
| strs_destroy(&strs); |
| |
| if (rc != 0) { |
| sepol_log_err("Error writing type bounds rules to CIL\n"); |
| } |
| |
| return rc; |
| } |
| |
| static int write_type_attribute_sets_to_cil(FILE *out, struct policydb *pdb) |
| { |
| type_datum_t *attr; |
| struct strs *strs; |
| ebitmap_t *typemap; |
| char *name, *types; |
| unsigned i; |
| int rc; |
| |
| rc = strs_init(&strs, pdb->p_types.nprim); |
| if (rc != 0) { |
| goto exit; |
| } |
| |
| for (i=0; i < pdb->p_types.nprim; i++) { |
| attr = pdb->type_val_to_struct[i]; |
| if (attr->flavor != TYPE_ATTRIB) continue; |
| name = pdb->p_type_val_to_name[i]; |
| typemap = &pdb->attr_type_map[i]; |
| if (ebitmap_cardinality(typemap) == 0) continue; |
| types = ebitmap_to_str(typemap, pdb->p_type_val_to_name, 1); |
| if (!types) { |
| rc = -1; |
| goto exit; |
| } |
| |
| rc = strs_create_and_add(strs, "(typeattributeset %s (%s))", |
| 2, name, types); |
| free(types); |
| if (rc != 0) { |
| goto exit; |
| } |
| } |
| |
| strs_sort(strs); |
| strs_write_each(strs, out); |
| |
| exit: |
| strs_free_all(strs); |
| strs_destroy(&strs); |
| |
| if (rc != 0) { |
| sepol_log_err("Error writing typeattributeset rules to CIL\n"); |
| } |
| |
| return rc; |
| } |
| |
| static int write_type_permissive_rules_to_cil(FILE *out, struct policydb *pdb) |
| { |
| type_datum_t *type; |
| struct strs *strs; |
| char *name; |
| unsigned i, num; |
| int rc = 0; |
| |
| rc = strs_init(&strs, pdb->p_types.nprim); |
| if (rc != 0) { |
| goto exit; |
| } |
| |
| for (i=0; i < pdb->p_types.nprim; i++) { |
| type = pdb->type_val_to_struct[i]; |
| if (type->flavor == TYPE_TYPE && (type->flags & TYPE_FLAGS_PERMISSIVE)) { |
| rc = strs_add(strs, pdb->p_type_val_to_name[i]); |
| if (rc != 0) { |
| goto exit; |
| } |
| } |
| } |
| |
| strs_sort(strs); |
| |
| num = strs_num_items(strs); |
| for (i=0; i<num; i++) { |
| name = strs_read_at_index(strs, i); |
| if (!name) { |
| rc = -1; |
| goto exit; |
| } |
| sepol_printf(out, "(typepermissive %s)\n", name); |
| } |
| |
| exit: |
| strs_destroy(&strs); |
| |
| if (rc != 0) { |
| sepol_log_err("Error writing typepermissive rules to CIL\n"); |
| } |
| |
| return rc; |
| } |
| |
| #define next_bit_in_range(i, p) ((i + 1 < sizeof(p)*8) && xperm_test((i + 1), p)) |
| |
| static char *xperms_to_str(avtab_extended_perms_t *xperms) |
| { |
| uint16_t value; |
| uint16_t low_bit; |
| uint16_t low_value; |
| unsigned int bit; |
| unsigned int in_range = 0; |
| static char xpermsbuf[2048]; |
| char *p; |
| int len, remaining; |
| |
| p = xpermsbuf; |
| remaining = sizeof(xpermsbuf); |
| |
| if ((xperms->specified != AVTAB_XPERMS_IOCTLFUNCTION) |
| && (xperms->specified != AVTAB_XPERMS_IOCTLDRIVER)) { |
| return NULL; |
| } |
| |
| for (bit = 0; bit < sizeof(xperms->perms)*8; bit++) { |
| len = 0; |
| |
| if (!xperm_test(bit, xperms->perms)) |
| continue; |
| |
| if (in_range && next_bit_in_range(bit, xperms->perms)) { |
| /* continue until high value found */ |
| continue; |
| } else if (next_bit_in_range(bit, xperms->perms)) { |
| /* low value */ |
| low_bit = bit; |
| in_range = 1; |
| continue; |
| } |
| |
| if (xperms->specified & AVTAB_XPERMS_IOCTLFUNCTION) { |
| value = xperms->driver<<8 | bit; |
| low_value = xperms->driver<<8 | low_bit; |
| if (in_range) { |
| len = snprintf(p, remaining, " (range 0x%hx 0x%hx)", low_value, value); |
| in_range = 0; |
| } else { |
| len = snprintf(p, remaining, " 0x%hx", value); |
| } |
| } else if (xperms->specified & AVTAB_XPERMS_IOCTLDRIVER) { |
| value = bit << 8; |
| low_value = low_bit << 8; |
| if (in_range) { |
| len = snprintf(p, remaining, " (range 0x%hx 0x%hx)", low_value, (uint16_t) (value|0xff)); |
| in_range = 0; |
| } else { |
| len = snprintf(p, remaining, " (range 0x%hx 0x%hx)", value, (uint16_t) (value|0xff)); |
| } |
| |
| } |
| if (len < 0 || len >= remaining) { |
| return NULL; |
| } |
| p += len; |
| remaining -= len; |
| } |
| |
| if (remaining < 2) { |
| return NULL; |
| } |
| |
| xpermsbuf[0] = '('; |
| *p++ = ')'; |
| *p = '\0'; |
| |
| return xpermsbuf; |
| } |
| |
| static char *avtab_node_to_str(struct policydb *pdb, avtab_key_t *key, avtab_datum_t *datum) |
| { |
| uint32_t data = datum->data; |
| type_datum_t *type; |
| const char *flavor, *tgt; |
| char *src, *class, *perms, *new; |
| char *rule = NULL; |
| |
| switch (0xFFF & key->specified) { |
| case AVTAB_ALLOWED: |
| flavor = "allow"; |
| break; |
| case AVTAB_AUDITALLOW: |
| flavor = "auditallow"; |
| break; |
| case AVTAB_AUDITDENY: |
| flavor = "dontaudit"; |
| data = ~data; |
| break; |
| case AVTAB_XPERMS_ALLOWED: |
| flavor = "allowx"; |
| break; |
| case AVTAB_XPERMS_AUDITALLOW: |
| flavor = "auditallowx"; |
| break; |
| case AVTAB_XPERMS_DONTAUDIT: |
| flavor = "dontauditx"; |
| break; |
| case AVTAB_TRANSITION: |
| flavor = "typetransition"; |
| break; |
| case AVTAB_MEMBER: |
| flavor = "typemember"; |
| break; |
| case AVTAB_CHANGE: |
| flavor = "typechange"; |
| break; |
| default: |
| sepol_log_err("Unknown avtab type: %i", key->specified); |
| goto exit; |
| } |
| |
| src = pdb->p_type_val_to_name[key->source_type - 1]; |
| tgt = pdb->p_type_val_to_name[key->target_type - 1]; |
| if (key->source_type == key->target_type && !(key->specified & AVTAB_TYPE)) { |
| type = pdb->type_val_to_struct[key->source_type - 1]; |
| if (type->flavor != TYPE_ATTRIB) { |
| tgt = "self"; |
| } |
| } |
| class = pdb->p_class_val_to_name[key->target_class - 1]; |
| |
| if (key->specified & AVTAB_AV) { |
| perms = sepol_av_to_string(pdb, key->target_class, data); |
| if (perms == NULL) { |
| sepol_log_err("Failed to generate permission string"); |
| goto exit; |
| } |
| rule = create_str("(%s %s %s (%s (%s)))", 5, |
| flavor, src, tgt, class, perms+1); |
| } else if (key->specified & AVTAB_XPERMS) { |
| perms = xperms_to_str(datum->xperms); |
| if (perms == NULL) { |
| sepol_log_err("Failed to generate extended permission string"); |
| goto exit; |
| } |
| |
| rule = create_str("(%s %s %s (%s %s (%s)))", 6, |
| flavor, src, tgt, "ioctl", class, perms); |
| } else { |
| new = pdb->p_type_val_to_name[data - 1]; |
| |
| rule = create_str("(%s %s %s %s %s)", 5, flavor, src, tgt, class, new); |
| } |
| |
| if (!rule) { |
| goto exit; |
| } |
| |
| return rule; |
| |
| exit: |
| return NULL; |
| } |
| |
| struct map_avtab_args { |
| struct policydb *pdb; |
| uint32_t flavor; |
| struct strs *strs; |
| }; |
| |
| static int map_avtab_write_helper(avtab_key_t *key, avtab_datum_t *datum, void *args) |
| { |
| struct map_avtab_args *map_args = args; |
| uint32_t flavor = map_args->flavor; |
| struct policydb *pdb = map_args->pdb; |
| struct strs *strs = map_args->strs; |
| char *rule; |
| int rc = 0; |
| |
| if (key->specified & flavor) { |
| rule = avtab_node_to_str(pdb, key, datum); |
| if (!rule) { |
| rc = -1; |
| goto exit; |
| } |
| rc = strs_add(strs, rule); |
| if (rc != 0) { |
| free(rule); |
| goto exit; |
| } |
| } |
| |
| exit: |
| return rc; |
| } |
| |
| static int write_avtab_flavor_to_cil(FILE *out, struct policydb *pdb, uint32_t flavor, int indent) |
| { |
| struct map_avtab_args args; |
| struct strs *strs; |
| int rc = 0; |
| |
| rc = strs_init(&strs, 1000); |
| if (rc != 0) { |
| goto exit; |
| } |
| |
| args.pdb = pdb; |
| args.flavor = flavor; |
| args.strs = strs; |
| |
| rc = avtab_map(&pdb->te_avtab, map_avtab_write_helper, &args); |
| if (rc != 0) { |
| goto exit; |
| } |
| |
| strs_sort(strs); |
| strs_write_each_indented(strs, out, indent); |
| |
| exit: |
| strs_free_all(strs); |
| strs_destroy(&strs); |
| |
| return rc; |
| } |
| |
| static int write_avtab_to_cil(FILE *out, struct policydb *pdb, int indent) |
| { |
| unsigned i; |
| int rc = 0; |
| |
| for (i = 0; i < AVTAB_FLAVORS_SZ; i++) { |
| rc = write_avtab_flavor_to_cil(out, pdb, avtab_flavors[i], indent); |
| if (rc != 0) { |
| goto exit; |
| } |
| } |
| |
| exit: |
| if (rc != 0) { |
| sepol_log_err("Error writing avtab rules to CIL\n"); |
| } |
| |
| return rc; |
| } |
| |
| struct map_filename_trans_args { |
| struct policydb *pdb; |
| struct strs *strs; |
| }; |
| |
| static int map_filename_trans_to_str(hashtab_key_t key, void *data, void *arg) |
| { |
| filename_trans_t *ft = (filename_trans_t *)key; |
| filename_trans_datum_t *datum = data; |
| struct map_filename_trans_args *map_args = arg; |
| struct policydb *pdb = map_args->pdb; |
| struct strs *strs = map_args->strs; |
| char *src, *tgt, *class, *filename, *new; |
| |
| src = pdb->p_type_val_to_name[ft->stype - 1]; |
| tgt = pdb->p_type_val_to_name[ft->ttype - 1]; |
| class = pdb->p_class_val_to_name[ft->tclass - 1]; |
| filename = ft->name; |
| new = pdb->p_type_val_to_name[datum->otype - 1]; |
| |
| return strs_create_and_add(strs, "(typetransition %s %s %s %s %s)", 5, |
| src, tgt, class, filename, new); |
| } |
| |
| static int write_filename_trans_rules_to_cil(FILE *out, struct policydb *pdb) |
| { |
| struct map_filename_trans_args args; |
| struct strs *strs; |
| int rc = 0; |
| |
| rc = strs_init(&strs, 100); |
| if (rc != 0) { |
| goto exit; |
| } |
| |
| args.pdb = pdb; |
| args.strs = strs; |
| |
| rc = hashtab_map(pdb->filename_trans, map_filename_trans_to_str, &args); |
| if (rc != 0) { |
| goto exit; |
| } |
| |
| strs_sort(strs); |
| strs_write_each(strs, out); |
| |
| exit: |
| strs_free_all(strs); |
| strs_destroy(&strs); |
| |
| if (rc != 0) { |
| sepol_log_err("Error writing filename typetransition rules to CIL\n"); |
| } |
| |
| return rc; |
| } |
| |
| static char *level_to_str(struct policydb *pdb, struct mls_level *level) |
| { |
| ebitmap_t *cats = &level->cat; |
| char *level_str = NULL; |
| char *sens_str = pdb->p_sens_val_to_name[level->sens - 1]; |
| char *cats_str; |
| |
| if (ebitmap_cardinality(cats) > 0) { |
| cats_str = cats_ebitmap_to_str(cats, pdb->p_cat_val_to_name); |
| level_str = create_str("(%s %s)", 2, sens_str, cats_str); |
| free(cats_str); |
| } else { |
| level_str = create_str("(%s)", 1, sens_str); |
| } |
| |
| return level_str; |
| } |
| |
| static char *range_to_str(struct policydb *pdb, mls_range_t *range) |
| { |
| char *low = NULL; |
| char *high = NULL; |
| char *range_str = NULL; |
| |
| low = level_to_str(pdb, &range->level[0]); |
| if (!low) { |
| goto exit; |
| } |
| |
| high = level_to_str(pdb, &range->level[1]); |
| if (!high) { |
| goto exit; |
| } |
| |
| range_str = create_str("(%s %s)", 2, low, high); |
| |
| exit: |
| free(low); |
| free(high); |
| |
| return range_str; |
| } |
| |
| struct map_range_trans_args { |
| struct policydb *pdb; |
| struct strs *strs; |
| }; |
| |
| static int map_range_trans_to_str(hashtab_key_t key, void *data, void *arg) |
| { |
| range_trans_t *rt = (range_trans_t *)key; |
| mls_range_t *mls_range = data; |
| struct map_range_trans_args *map_args = arg; |
| struct policydb *pdb = map_args->pdb; |
| struct strs *strs = map_args->strs; |
| char *src, *tgt, *class, *range; |
| int rc; |
| |
| src = pdb->p_type_val_to_name[rt->source_type - 1]; |
| tgt = pdb->p_type_val_to_name[rt->target_type - 1]; |
| class = pdb->p_class_val_to_name[rt->target_class - 1]; |
| range = range_to_str(pdb, mls_range); |
| if (!range) { |
| rc = -1; |
| goto exit; |
| } |
| |
| rc = strs_create_and_add(strs, "(rangetransition %s %s %s %s)", 4, |
| src, tgt, class, range); |
| free(range); |
| if (rc != 0) { |
| goto exit; |
| } |
| |
| exit: |
| return rc; |
| } |
| |
| static int write_range_trans_rules_to_cil(FILE *out, struct policydb *pdb) |
| { |
| struct map_range_trans_args args; |
| struct strs *strs; |
| int rc = 0; |
| |
| rc = strs_init(&strs, 100); |
| if (rc != 0) { |
| goto exit; |
| } |
| |
| args.pdb = pdb; |
| args.strs = strs; |
| |
| rc = hashtab_map(pdb->range_tr, map_range_trans_to_str, &args); |
| if (rc != 0) { |
| goto exit; |
| } |
| |
| strs_sort(strs); |
| strs_write_each(strs, out); |
| |
| exit: |
| strs_free_all(strs); |
| strs_destroy(&strs); |
| |
| if (rc != 0) { |
| sepol_log_err("Error writing range transition rules to CIL\n"); |
| } |
| |
| return rc; |
| } |
| |
| static int write_cond_av_list_to_cil(FILE *out, struct policydb *pdb, cond_av_list_t *cond_list, int indent) |
| { |
| cond_av_list_t *cond_av; |
| avtab_ptr_t node; |
| uint32_t flavor; |
| avtab_key_t *key; |
| avtab_datum_t *datum; |
| struct strs *strs; |
| char *rule; |
| unsigned i; |
| int rc; |
| |
| for (i = 0; i < AVTAB_FLAVORS_SZ; i++) { |
| flavor = avtab_flavors[i]; |
| rc = strs_init(&strs, 64); |
| if (rc != 0) { |
| goto exit; |
| } |
| |
| for (cond_av = cond_list; cond_av != NULL; cond_av = cond_av->next) { |
| node = cond_av->node; |
| key = &node->key; |
| datum = &node->datum; |
| if (key->specified & flavor) { |
| rule = avtab_node_to_str(pdb, key, datum); |
| if (!rule) { |
| rc = -1; |
| goto exit; |
| } |
| rc = strs_add(strs, rule); |
| if (rc != 0) { |
| free(rule); |
| goto exit; |
| } |
| } |
| } |
| |
| strs_sort(strs); |
| strs_write_each_indented(strs, out, indent); |
| strs_free_all(strs); |
| strs_destroy(&strs); |
| } |
| |
| return 0; |
| |
| exit: |
| return rc; |
| } |
| |
| struct cond_data { |
| char *expr; |
| struct cond_node *cond; |
| }; |
| |
| static int cond_node_cmp(const void *a, const void *b) |
| { |
| const struct cond_data *aa = a; |
| const struct cond_data *bb = b; |
| return strcmp(aa->expr, bb->expr); |
| } |
| |
| static int write_cond_nodes_to_cil(FILE *out, struct policydb *pdb) |
| { |
| struct cond_data *cond_data; |
| char *expr; |
| struct cond_node *cond; |
| unsigned i, num = 0; |
| int rc = 0; |
| |
| for (cond = pdb->cond_list; cond != NULL; cond = cond->next) { |
| num++; |
| } |
| |
| cond_data = calloc(num, sizeof(struct cond_data)); |
| if (!cond_data) { |
| rc = -1; |
| goto exit; |
| } |
| |
| i = 0; |
| for (cond = pdb->cond_list; cond != NULL; cond = cond->next) { |
| cond_data[i].cond = cond; |
| expr = cond_expr_to_str(pdb, cond->expr); |
| if (!expr) { |
| num = i; |
| goto exit; |
| } |
| cond_data[i].expr = expr; |
| i++; |
| } |
| |
| qsort(cond_data, num, sizeof(*cond_data), cond_node_cmp); |
| |
| for (i=0; i<num; i++) { |
| expr = cond_data[i].expr; |
| cond = cond_data[i].cond; |
| |
| sepol_printf(out, "(booleanif %s\n", expr); |
| |
| if (cond->true_list != NULL) { |
| sepol_indent(out, 1); |
| sepol_printf(out, "(true\n"); |
| rc = write_cond_av_list_to_cil(out, pdb, cond->true_list, 2); |
| if (rc != 0) { |
| goto exit; |
| } |
| sepol_indent(out, 1); |
| sepol_printf(out, ")\n"); |
| } |
| |
| if (cond->false_list != NULL) { |
| sepol_indent(out, 1); |
| sepol_printf(out, "(false\n"); |
| rc = write_cond_av_list_to_cil(out, pdb, cond->false_list, 2); |
| if (rc != 0) { |
| goto exit; |
| } |
| sepol_indent(out, 1); |
| sepol_printf(out, ")\n"); |
| } |
| sepol_printf(out, ")\n"); |
| } |
| |
| exit: |
| if (cond_data) { |
| for (i=0; i<num; i++) { |
| free(cond_data[i].expr); |
| } |
| free(cond_data); |
| } |
| |
| if (rc != 0) { |
| sepol_log_err("Error writing conditional rules to CIL\n"); |
| } |
| |
| return rc; |
| } |
| |
| static int write_role_decl_rules_to_cil(FILE *out, struct policydb *pdb) |
| { |
| struct role_datum *role; |
| struct strs *strs, *type_strs; |
| char *name, *parent, *child, *type; |
| struct ebitmap *types; |
| struct type_datum *type_datum; |
| unsigned i, num, j, num_types; |
| int rc = 0; |
| |
| rc = strs_init(&strs, pdb->p_roles.nprim); |
| if (rc != 0) { |
| goto exit; |
| } |
| |
| for (i=0; i < pdb->p_roles.nprim; i++) { |
| role = pdb->role_val_to_struct[i]; |
| if (role && role->flavor == ROLE_ROLE) { |
| rc = strs_add(strs, pdb->p_role_val_to_name[i]); |
| if (rc != 0) { |
| goto exit; |
| } |
| } |
| } |
| |
| strs_sort(strs); |
| |
| num = strs_num_items(strs); |
| |
| for (i=0; i<num; i++) { |
| name = strs_read_at_index(strs, i); |
| if (!name) { |
| continue; |
| } |
| sepol_printf(out, "(role %s)\n", name); |
| } |
| |
| for (i=0; i<num; i++) { |
| child = strs_read_at_index(strs, i); |
| if (!child) { |
| continue; |
| } |
| role = hashtab_search(pdb->p_roles.table, child); |
| if (!role) { |
| rc = -1; |
| goto exit; |
| } |
| |
| if (role->bounds > 0) { |
| parent = pdb->p_role_val_to_name[role->bounds - 1]; |
| sepol_printf(out, "(rolebounds %s %s)\n", parent, child); |
| } |
| } |
| |
| for (i=0; i<num; i++) { |
| name = strs_read_at_index(strs, i); |
| if (!name) { |
| continue; |
| } |
| role = hashtab_search(pdb->p_roles.table, name); |
| if (!role) { |
| rc = -1; |
| goto exit; |
| } |
| types = &role->types.types; |
| if (types && (ebitmap_cardinality(types) > 0)) { |
| rc = strs_init(&type_strs, pdb->p_types.nprim); |
| if (rc != 0) { |
| goto exit; |
| } |
| rc = ebitmap_to_strs(types, type_strs, pdb->p_type_val_to_name); |
| if (rc != 0) { |
| strs_destroy(&type_strs); |
| goto exit; |
| } |
| strs_sort(type_strs); |
| |
| num_types = strs_num_items(type_strs); |
| for (j=0; j<num_types; j++) { |
| type = strs_read_at_index(type_strs, j); |
| sepol_printf(out, "(roletype %s %s)\n", name, type); |
| } |
| strs_destroy(&type_strs); |
| } |
| } |
| |
| strs_destroy(&strs); |
| |
| rc = strs_init(&strs, pdb->p_types.nprim); |
| if (rc != 0) { |
| goto exit; |
| } |
| |
| for (i=0; i < pdb->p_types.nprim; i++) { |
| type_datum = pdb->type_val_to_struct[i]; |
| if (type_datum->flavor == TYPE_TYPE && type_datum->primary) { |
| rc = strs_add(strs, pdb->p_type_val_to_name[i]); |
| if (rc != 0) { |
| goto exit; |
| } |
| } |
| } |
| |
| strs_sort(strs); |
| |
| num = strs_num_items(strs); |
| |
| for (i=0; i<num; i++) { |
| name = strs_read_at_index(strs, i); |
| if (!name) { |
| continue; |
| } |
| sepol_printf(out, "(roletype %s %s)\n", DEFAULT_OBJECT, name); |
| } |
| |
| exit: |
| strs_destroy(&strs); |
| |
| if (rc != 0) { |
| sepol_log_err("Error writing role declarations to CIL\n"); |
| } |
| |
| return rc; |
| } |
| |
| static int write_role_transition_rules_to_cil(FILE *out, struct policydb *pdb) |
| { |
| role_trans_t *curr = pdb->role_tr; |
| struct strs *strs; |
| char *role, *type, *class, *new; |
| int rc = 0; |
| |
| rc = strs_init(&strs, 32); |
| if (rc != 0) { |
| goto exit; |
| } |
| |
| while (curr) { |
| role = pdb->p_role_val_to_name[curr->role - 1]; |
| type = pdb->p_type_val_to_name[curr->type - 1]; |
| class = pdb->p_class_val_to_name[curr->tclass - 1]; |
| new = pdb->p_role_val_to_name[curr->new_role - 1]; |
| |
| rc = strs_create_and_add(strs, "(roletransition %s %s %s %s)", 4, |
| role, type, class, new); |
| if (rc != 0) { |
| goto exit; |
| } |
| |
| curr = curr->next; |
| } |
| |
| strs_sort(strs); |
| strs_write_each(strs, out); |
| |
| exit: |
| strs_free_all(strs); |
| strs_destroy(&strs); |
| |
| if (rc != 0) { |
| sepol_log_err("Error writing role transition rules to CIL\n"); |
| } |
| |
| return rc; |
| } |
| |
| static int write_role_allow_rules_to_cil(FILE *out, struct policydb *pdb) |
| { |
| role_allow_t *curr = pdb->role_allow; |
| struct strs *strs; |
| char *role, *new; |
| int rc = 0; |
| |
| rc = strs_init(&strs, 32); |
| if (rc != 0) { |
| goto exit; |
| } |
| |
| while (curr) { |
| role = pdb->p_role_val_to_name[curr->role - 1]; |
| new = pdb->p_role_val_to_name[curr->new_role - 1]; |
| |
| rc = strs_create_and_add(strs, "(roleallow %s %s)", 2, role, new); |
| if (rc != 0) { |
| goto exit; |
| } |
| |
| curr = curr->next; |
| } |
| |
| strs_sort(strs); |
| strs_write_each(strs, out); |
| |
| exit: |
| strs_free_all(strs); |
| strs_destroy(&strs); |
| |
| if (rc != 0) { |
| sepol_log_err("Error writing role allow rules to CIL\n"); |
| } |
| |
| return rc; |
| } |
| |
| static int write_user_decl_rules_to_cil(FILE *out, struct policydb *pdb) |
| { |
| struct user_datum *user; |
| struct strs *strs, *role_strs; |
| char *name, *role, *level, *range; |
| struct ebitmap *roles; |
| unsigned i, j, num, num_roles; |
| int rc = 0; |
| |
| rc = strs_init(&strs, pdb->p_users.nprim); |
| if (rc != 0) { |
| goto exit; |
| } |
| |
| for (i=0; i < pdb->p_users.nprim; i++) { |
| rc = strs_add(strs, pdb->p_user_val_to_name[i]); |
| if (rc != 0) { |
| goto exit; |
| } |
| } |
| |
| strs_sort(strs); |
| |
| num = strs_num_items(strs); |
| |
| for (i=0; i<num; i++) { |
| name = strs_read_at_index(strs, i); |
| if (!name) { |
| continue; |
| } |
| sepol_printf(out, "(user %s)\n", name); |
| } |
| |
| for (i=0; i<num; i++) { |
| name = strs_read_at_index(strs, i); |
| if (!name) { |
| continue; |
| } |
| |
| user = hashtab_search(pdb->p_users.table, name); |
| if (!user) { |
| rc = -1; |
| goto exit; |
| } |
| |
| roles = &user->roles.roles; |
| if (roles && (ebitmap_cardinality(roles) > 0)) { |
| rc = strs_init(&role_strs, pdb->p_roles.nprim); |
| if (rc != 0) { |
| goto exit; |
| } |
| rc = ebitmap_to_strs(roles, role_strs, pdb->p_role_val_to_name); |
| if (rc != 0) { |
| strs_destroy(&role_strs); |
| goto exit; |
| } |
| |
| rc = strs_add(role_strs, (char *)DEFAULT_OBJECT); |
| if (rc != 0) { |
| strs_destroy(&role_strs); |
| goto exit; |
| } |
| |
| strs_sort(role_strs); |
| |
| num_roles = strs_num_items(role_strs); |
| for (j=0; j<num_roles; j++) { |
| role = strs_read_at_index(role_strs, j); |
| sepol_printf(out, "(userrole %s %s)\n", name, role); |
| } |
| strs_destroy(&role_strs); |
| } |
| } |
| |
| for (i=0; i<num; i++) { |
| name = strs_read_at_index(strs, i); |
| if (!name) { |
| continue; |
| } |
| |
| user = hashtab_search(pdb->p_users.table, name); |
| if (!user) { |
| rc = -1; |
| goto exit; |
| } |
| |
| sepol_printf(out, "(userlevel %s ", name); |
| |
| if (pdb->mls) { |
| level = level_to_str(pdb, &user->exp_dfltlevel); |
| if (!level) { |
| rc = -1; |
| goto exit; |
| } |
| sepol_printf(out, "%s", level); |
| free(level); |
| } else { |
| sepol_printf(out, "%s", DEFAULT_LEVEL); |
| } |
| sepol_printf(out, ")\n"); |
| } |
| |
| for (i=0; i<num; i++) { |
| name = strs_read_at_index(strs, i); |
| if (!name) { |
| continue; |
| } |
| |
| user = hashtab_search(pdb->p_users.table, name); |
| if (!user) { |
| rc = -1; |
| goto exit; |
| } |
| |
| sepol_printf(out, "(userrange %s ", name); |
| if (pdb->mls) { |
| range = range_to_str(pdb, &user->exp_range); |
| if (!range) { |
| rc = -1; |
| goto exit; |
| } |
| sepol_printf(out, "%s", range); |
| free(range); |
| } else { |
| sepol_printf(out, "(%s %s)", DEFAULT_LEVEL, DEFAULT_LEVEL); |
| } |
| sepol_printf(out, ")\n"); |
| } |
| |
| strs_destroy(&strs); |
| |
| exit: |
| if (rc != 0) { |
| sepol_log_err("Error writing user declarations to CIL\n"); |
| } |
| |
| return rc; |
| } |
| |
| static char *context_to_str(struct policydb *pdb, struct context_struct *con) |
| { |
| char *user, *role, *type, *range; |
| char *ctx = NULL; |
| |
| user = pdb->p_user_val_to_name[con->user - 1]; |
| role = pdb->p_role_val_to_name[con->role - 1]; |
| type = pdb->p_type_val_to_name[con->type - 1]; |
| |
| if (pdb->mls) { |
| range = range_to_str(pdb, &con->range); |
| } else { |
| range = create_str("(%s %s)", 2, DEFAULT_LEVEL, DEFAULT_LEVEL); |
| } |
| if (!range) { |
| goto exit; |
| } |
| |
| ctx = create_str("(%s %s %s %s)", 4, user, role, type, range); |
| free(range); |
| |
| exit: |
| return ctx; |
| } |
| |
| static int write_sid_context_rules_to_cil(FILE *out, struct policydb *pdb, const char *const *sid_to_str) |
| { |
| struct ocontext *isid; |
| struct strs *strs; |
| const char *sid; |
| char *ctx, *rule; |
| unsigned i; |
| int rc = -1; |
| |
| rc = strs_init(&strs, 32); |
| if (rc != 0) { |
| goto exit; |
| } |
| |
| for (isid = pdb->ocontexts[0]; isid != NULL; isid = isid->next) { |
| i = isid->sid[0]; |
| sid = sid_to_str[i]; |
| ctx = context_to_str(pdb, &isid->context[0]); |
| if (!ctx) { |
| rc = -1; |
| goto exit; |
| } |
| |
| rule = create_str("(sidcontext %s %s)", 2, sid, ctx); |
| free(ctx); |
| if (!rule) { |
| rc = -1; |
| goto exit; |
| } |
| |
| rc = strs_add_at_index(strs, rule, i); |
| if (rc != 0) { |
| free(rule); |
| goto exit; |
| } |
| } |
| |
| strs_write_each(strs, out); |
| |
| exit: |
| strs_free_all(strs); |
| strs_destroy(&strs); |
| |
| if (rc != 0) { |
| sepol_log_err("Error writing sidcontext rules to CIL\n"); |
| } |
| |
| return rc; |
| } |
| |
| static int write_selinux_isid_rules_to_cil(FILE *out, struct policydb *pdb) |
| { |
| return write_sid_context_rules_to_cil(out, pdb, selinux_sid_to_str); |
| } |
| |
| static int write_selinux_fsuse_rules_to_cil(FILE *out, struct policydb *pdb) |
| { |
| struct ocontext *fsuse; |
| const char *behavior; |
| char *name, *ctx; |
| int rc = 0; |
| |
| for (fsuse = pdb->ocontexts[5]; fsuse != NULL; fsuse = fsuse->next) { |
| switch (fsuse->v.behavior) { |
| case SECURITY_FS_USE_XATTR: behavior = "xattr"; break; |
| case SECURITY_FS_USE_TRANS: behavior = "trans"; break; |
| case SECURITY_FS_USE_TASK: behavior = "task"; break; |
| default: |
| sepol_log_err("Unknown fsuse behavior: %i", fsuse->v.behavior); |
| rc = -1; |
| goto exit; |
| } |
| |
| name = fsuse->u.name; |
| ctx = context_to_str(pdb, &fsuse->context[0]); |
| if (!ctx) { |
| rc = -1; |
| goto exit; |
| } |
| |
| sepol_printf(out, "(fsuse %s %s %s)\n", behavior, name, ctx); |
| |
| free(ctx); |
| } |
| |
| exit: |
| if (rc != 0) { |
| sepol_log_err("Error writing fsuse rules to CIL\n"); |
| } |
| |
| return rc; |
| } |
| |
| static int write_genfscon_rules_to_cil(FILE *out, struct policydb *pdb) |
| { |
| struct genfs *genfs; |
| struct ocontext *ocon; |
| struct strs *strs; |
| char *fstype, *name, *ctx; |
| int rc; |
| |
| rc = strs_init(&strs, 32); |
| if (rc != 0) { |
| goto exit; |
| } |
| |
| for (genfs = pdb->genfs; genfs != NULL; genfs = genfs->next) { |
| for (ocon = genfs->head; ocon != NULL; ocon = ocon->next) { |
| fstype = genfs->fstype; |
| name = ocon->u.name; |
| |
| ctx = context_to_str(pdb, &ocon->context[0]); |
| if (!ctx) { |
| rc = -1; |
| goto exit; |
| } |
| |
| rc = strs_create_and_add(strs, "(genfscon %s %s %s)", 3, |
| fstype, name, ctx); |
| free(ctx); |
| if (rc != 0) { |
| goto exit; |
| } |
| } |
| } |
| |
| strs_sort(strs); |
| strs_write_each(strs, out); |
| |
| exit: |
| strs_free_all(strs); |
| strs_destroy(&strs); |
| |
| if (rc != 0) { |
| sepol_log_err("Error writing genfscon rules to CIL\n"); |
| } |
| |
| return rc; |
| } |
| |
| static int write_selinux_port_rules_to_cil(FILE *out, struct policydb *pdb) |
| { |
| struct ocontext *portcon; |
| const char *protocol; |
| uint16_t low; |
| uint16_t high; |
| char low_high_str[44]; /* 2^64 <= 20 digits so "(low high)" <= 44 chars */ |
| char *ctx; |
| int rc = 0; |
| |
| for (portcon = pdb->ocontexts[2]; portcon != NULL; portcon = portcon->next) { |
| switch (portcon->u.port.protocol) { |
| case IPPROTO_TCP: protocol = "tcp"; break; |
| case IPPROTO_UDP: protocol = "udp"; break; |
| case IPPROTO_DCCP: protocol = "dccp"; break; |
| case IPPROTO_SCTP: protocol = "sctp"; break; |
| default: |
| sepol_log_err("Unknown portcon protocol: %i", portcon->u.port.protocol); |
| rc = -1; |
| goto exit; |
| } |
| |
| low = portcon->u.port.low_port; |
| high = portcon->u.port.high_port; |
| if (low == high) { |
| rc = snprintf(low_high_str, 44, "%u", low); |
| } else { |
| rc = snprintf(low_high_str, 44, "(%u %u)", low, high); |
| } |
| if (rc < 0 || rc >= 44) { |
| rc = -1; |
| goto exit; |
| } |
| |
| ctx = context_to_str(pdb, &portcon->context[0]); |
| if (!ctx) { |
| rc = -1; |
| goto exit; |
| } |
| |
| sepol_printf(out, "(portcon %s %s %s)\n", protocol, low_high_str, ctx); |
| |
| free(ctx); |
| } |
| |
| rc = 0; |
| |
| exit: |
| if (rc != 0) { |
| sepol_log_err("Error writing portcon rules to CIL\n"); |
| } |
| |
| return rc; |
| } |
| |
| static int write_selinux_netif_rules_to_cil(FILE *out, struct policydb *pdb) |
| { |
| struct ocontext *netif; |
| char *name, *ctx1, *ctx2; |
| int rc = 0; |
| |
| for (netif = pdb->ocontexts[3]; netif != NULL; netif = netif->next) { |
| name = netif->u.name; |
| ctx1 = context_to_str(pdb, &netif->context[0]); |
| if (!ctx1) { |
| rc = -1; |
| goto exit; |
| } |
| ctx2 = context_to_str(pdb, &netif->context[1]); |
| if (!ctx2) { |
| free(ctx1); |
| rc = -1; |
| goto exit; |
| } |
| |
| sepol_printf(out, "(netifcon %s %s %s)\n", name, ctx1, ctx2); |
| |
| free(ctx1); |
| free(ctx2); |
| } |
| |
| exit: |
| if (rc != 0) { |
| sepol_log_err("Error writing netifcon rules to CIL\n"); |
| } |
| |
| return rc; |
| } |
| |
| static int write_selinux_node_rules_to_cil(FILE *out, struct policydb *pdb) |
| { |
| struct ocontext *node; |
| char addr[INET_ADDRSTRLEN]; |
| char mask[INET_ADDRSTRLEN]; |
| char *ctx; |
| int rc = 0; |
| |
| for (node = pdb->ocontexts[4]; node != NULL; node = node->next) { |
| if (inet_ntop(AF_INET, &node->u.node.addr, addr, INET_ADDRSTRLEN) == NULL) { |
| sepol_log_err("Nodecon address is invalid: %s", strerror(errno)); |
| rc = -1; |
| goto exit; |
| } |
| |
| if (inet_ntop(AF_INET, &node->u.node.mask, mask, INET_ADDRSTRLEN) == NULL) { |
| sepol_log_err("Nodecon mask is invalid: %s", strerror(errno)); |
| rc = -1; |
| goto exit; |
| } |
| |
| ctx = context_to_str(pdb, &node->context[0]); |
| if (!ctx) { |
| rc = -1; |
| goto exit; |
| } |
| |
| sepol_printf(out, "(nodecon (%s) (%s) %s)\n", addr, mask, ctx); |
| |
| free(ctx); |
| } |
| |
| exit: |
| if (rc != 0) { |
| sepol_log_err("Error writing nodecon rules to CIL\n"); |
| } |
| |
| return rc; |
| } |
| |
| static int write_selinux_node6_rules_to_cil(FILE *out, struct policydb *pdb) |
| { |
| struct ocontext *node; |
| char addr[INET6_ADDRSTRLEN]; |
| char mask[INET6_ADDRSTRLEN]; |
| char *ctx; |
| int rc = 0; |
| |
| for (node = pdb->ocontexts[6]; node != NULL; node = node->next) { |
| if (inet_ntop(AF_INET6, &node->u.node6.addr, addr, INET6_ADDRSTRLEN) == NULL) { |
| sepol_log_err("Nodecon address is invalid: %s", strerror(errno)); |
| rc = -1; |
| goto exit; |
| } |
| |
| if (inet_ntop(AF_INET6, &node->u.node6.mask, mask, INET6_ADDRSTRLEN) == NULL) { |
| sepol_log_err("Nodecon mask is invalid: %s", strerror(errno)); |
| rc = -1; |
| goto exit; |
| } |
| |
| ctx = context_to_str(pdb, &node->context[0]); |
| if (!ctx) { |
| rc = -1; |
| goto exit; |
| } |
| |
| sepol_printf(out, "(nodecon (%s) (%s) %s)\n", addr, mask, ctx); |
| |
| free(ctx); |
| } |
| |
| exit: |
| if (rc != 0) { |
| sepol_log_err("Error writing nodecon rules to CIL\n"); |
| } |
| |
| return rc; |
| } |
| |
| static int write_selinux_ibpkey_rules_to_cil(FILE *out, struct policydb *pdb) |
| { |
| struct ocontext *ibpkeycon; |
| char subnet_prefix_str[INET6_ADDRSTRLEN]; |
| struct in6_addr subnet_prefix = IN6ADDR_ANY_INIT; |
| uint16_t low; |
| uint16_t high; |
| char low_high_str[44]; /* 2^64 <= 20 digits so "(low high)" <= 44 chars */ |
| char *ctx; |
| int rc = 0; |
| |
| for (ibpkeycon = pdb->ocontexts[OCON_IBPKEY]; ibpkeycon != NULL; |
| ibpkeycon = ibpkeycon->next) { |
| memcpy(&subnet_prefix.s6_addr, &ibpkeycon->u.ibpkey.subnet_prefix, |
| sizeof(ibpkeycon->u.ibpkey.subnet_prefix)); |
| |
| if (inet_ntop(AF_INET6, &subnet_prefix.s6_addr, |
| subnet_prefix_str, INET6_ADDRSTRLEN) == NULL) { |
| sepol_log_err("ibpkeycon subnet_prefix is invalid: %s", |
| strerror(errno)); |
| rc = -1; |
| goto exit; |
| } |
| |
| low = ibpkeycon->u.ibpkey.low_pkey; |
| high = ibpkeycon->u.ibpkey.high_pkey; |
| if (low == high) { |
| rc = snprintf(low_high_str, 44, "%u", low); |
| } else { |
| rc = snprintf(low_high_str, 44, "(%u %u)", low, high); |
| } |
| if (rc < 0 || rc >= 44) { |
| rc = -1; |
| goto exit; |
| } |
| |
| ctx = context_to_str(pdb, &ibpkeycon->context[0]); |
| if (!ctx) { |
| rc = -1; |
| goto exit; |
| } |
| |
| sepol_printf(out, "(ibpkeycon %s %s %s)\n", subnet_prefix_str, low_high_str, ctx); |
| |
| free(ctx); |
| } |
| |
| rc = 0; |
| |
| exit: |
| if (rc != 0) { |
| sepol_log_err("Error writing ibpkeycon rules to CIL\n"); |
| } |
| |
| return rc; |
| } |
| |
| static int write_selinux_ibendport_rules_to_cil(FILE *out, struct policydb *pdb) |
| { |
| struct ocontext *ibendportcon; |
| char port_str[4]; |
| char *ctx; |
| int rc = 0; |
| |
| for (ibendportcon = pdb->ocontexts[OCON_IBENDPORT]; |
| ibendportcon != NULL; ibendportcon = ibendportcon->next) { |
| rc = snprintf(port_str, 4, "%u", ibendportcon->u.ibendport.port); |
| if (rc < 0 || rc >= 4) { |
| rc = -1; |
| goto exit; |
| } |
| |
| ctx = context_to_str(pdb, &ibendportcon->context[0]); |
| if (!ctx) { |
| rc = -1; |
| goto exit; |
| } |
| |
| sepol_printf(out, "(ibendportcon %s %s %s)\n", |
| ibendportcon->u.ibendport.dev_name, port_str, ctx); |
| |
| free(ctx); |
| } |
| |
| rc = 0; |
| |
| exit: |
| if (rc != 0) { |
| sepol_log_err("Error writing ibendportcon rules to CIL\n"); |
| } |
| |
| return rc; |
| } |
| |
| static int write_xen_isid_rules_to_cil(FILE *out, struct policydb *pdb) |
| { |
| return write_sid_context_rules_to_cil(out, pdb, xen_sid_to_str); |
| } |
| |
| static int write_xen_pirq_rules_to_cil(FILE *out, struct policydb *pdb) |
| { |
| struct ocontext *pirq; |
| char pirq_str[21]; /* 2^64-1 <= 20 digits */ |
| char *ctx; |
| int rc = 0; |
| |
| for (pirq = pdb->ocontexts[1]; pirq != NULL; pirq = pirq->next) { |
| rc = snprintf(pirq_str, 21, "%i", pirq->u.pirq); |
| if (rc < 0 || rc >= 21) { |
| rc = -1; |
| goto exit; |
| } |
| |
| ctx = context_to_str(pdb, &pirq->context[0]); |
| if (!ctx) { |
| rc = -1; |
| goto exit; |
| } |
| |
| sepol_printf(out, "(pirqcon %s %s)\n", pirq_str, ctx); |
| |
| free(ctx); |
| } |
| |
| rc = 0; |
| |
| exit: |
| if (rc != 0) { |
| sepol_log_err("Error writing pirqcon rules to CIL\n"); |
| } |
| |
| return rc; |
| } |
| |
| static int write_xen_ioport_rules_to_cil(FILE *out, struct policydb *pdb) |
| { |
| struct ocontext *ioport; |
| uint32_t low; |
| uint32_t high; |
| char low_high_str[40]; /* 2^64-1 <= 16 digits (hex) so (low high) < 40 chars */ |
| char *ctx; |
| int rc = 0; |
| |
| for (ioport = pdb->ocontexts[2]; ioport != NULL; ioport = ioport->next) { |
| low = ioport->u.ioport.low_ioport; |
| high = ioport->u.ioport.high_ioport; |
| if (low == high) { |
| rc = snprintf(low_high_str, 40, "0x%x", low); |
| } else { |
| rc = snprintf(low_high_str, 40, "(0x%x 0x%x)", low, high); |
| } |
| if (rc < 0 || rc >= 40) { |
| rc = -1; |
| goto exit; |
| } |
| |
| ctx = context_to_str(pdb, &ioport->context[0]); |
| if (!ctx) { |
| rc = -1; |
| goto exit; |
| } |
| |
| sepol_printf(out, "(ioportcon %s %s)\n", low_high_str, ctx); |
| |
| free(ctx); |
| } |
| |
| rc = 0; |
| |
| exit: |
| if (rc != 0) { |
| sepol_log_err("Error writing ioportcon rules to CIL\n"); |
| } |
| |
| return rc; |
| } |
| |
| static int write_xen_iomem_rules_to_cil(FILE *out, struct policydb *pdb) |
| { |
| struct ocontext *iomem; |
| uint64_t low; |
| uint64_t high; |
| char low_high_str[40]; /* 2^64-1 <= 16 digits (hex) so (low high) < 40 chars */ |
| char *ctx; |
| int rc = 0; |
| |
| for (iomem = pdb->ocontexts[3]; iomem != NULL; iomem = iomem->next) { |
| low = iomem->u.iomem.low_iomem; |
| high = iomem->u.iomem.high_iomem; |
| if (low == high) { |
| rc = snprintf(low_high_str, 40, "0x%"PRIx64, low); |
| } else { |
| rc = snprintf(low_high_str, 40, "(0x%"PRIx64" 0x%"PRIx64")", low, high); |
| } |
| if (rc < 0 || rc >= 40) { |
| rc = -1; |
| goto exit; |
| } |
| |
| ctx = context_to_str(pdb, &iomem->context[0]); |
| if (!ctx) { |
| rc = -1; |
| goto exit; |
| } |
| |
| sepol_printf(out, "(iomemcon %s %s)\n", low_high_str, ctx); |
| |
| free(ctx); |
| } |
| |
| rc = 0; |
| |
| exit: |
| if (rc != 0) { |
| sepol_log_err("Error writing iomemcon rules to CIL\n"); |
| } |
| |
| return rc; |
| } |
| |
| static int write_xen_pcidevice_rules_to_cil(FILE *out, struct policydb *pdb) |
| { |
| struct ocontext *pcid; |
| char device_str[20]; /* 2^64-1 <= 16 digits (hex) so (low high) < 19 chars */ |
| char *ctx; |
| int rc = 0; |
| |
| for (pcid = pdb->ocontexts[4]; pcid != NULL; pcid = pcid->next) { |
| rc = snprintf(device_str, 20, "0x%lx", (unsigned long)pcid->u.device); |
| if (rc < 0 || rc >= 20) { |
| rc = -1; |
| goto exit; |
| } |
| |
| ctx = context_to_str(pdb, &pcid->context[0]); |
| if (!ctx) { |
| rc = -1; |
| goto exit; |
| } |
| |
| sepol_printf(out, "(pcidevicecon %s %s)\n", device_str, ctx); |
| |
| free(ctx); |
| } |
| |
| rc = 0; |
| |
| exit: |
| if (rc != 0) { |
| sepol_log_err("Error writing pcidevicecon rules to CIL\n"); |
| } |
| |
| return rc; |
| } |
| |
| static int write_xen_devicetree_rules_to_cil(FILE *out, struct policydb *pdb) |
| { |
| struct ocontext *dtree; |
| char *name, *ctx; |
| int rc = 0; |
| |
| for (dtree = pdb->ocontexts[5]; dtree != NULL; dtree = dtree->next) { |
| name = dtree->u.name; |
| ctx = context_to_str(pdb, &dtree->context[0]); |
| if (!ctx) { |
| rc = -1; |
| goto exit; |
| } |
| |
| sepol_printf(out, "(devicetreecon %s %s)\n", name, ctx); |
| |
| free(ctx); |
| } |
| |
| exit: |
| if (rc != 0) { |
| sepol_log_err("Error writing devicetreecon rules to CIL\n"); |
| } |
| |
| return rc; |
| } |
| |
| int sepol_kernel_policydb_to_cil(FILE *out, struct policydb *pdb) |
| { |
| struct strs *mls_constraints = NULL; |
| struct strs *non_mls_constraints = NULL; |
| struct strs *mls_validatetrans = NULL; |
| struct strs *non_mls_validatetrans = NULL; |
| int rc = 0; |
| |
| rc = strs_init(&mls_constraints, 32); |
| if (rc != 0) { |
| goto exit; |
| } |
| |
| rc = strs_init(&non_mls_constraints, 32); |
| if (rc != 0) { |
| goto exit; |
| } |
| |
| rc = strs_init(&mls_validatetrans, 32); |
| if (rc != 0) { |
| goto exit; |
| } |
| |
| rc = strs_init(&non_mls_validatetrans, 32); |
| if (rc != 0) { |
| goto exit; |
| } |
| |
| if (pdb == NULL) { |
| sepol_log_err("No policy"); |
| rc = -1; |
| goto exit; |
| } |
| |
| if (pdb->policy_type != SEPOL_POLICY_KERN) { |
| sepol_log_err("Policy is not a kernel policy"); |
| rc = -1; |
| goto exit; |
| } |
| |
| rc = constraint_rules_to_strs(pdb, mls_constraints, non_mls_constraints); |
| if (rc != 0) { |
| goto exit; |
| } |
| |
| rc = validatetrans_rules_to_strs(pdb, mls_validatetrans, non_mls_validatetrans); |
| if (rc != 0) { |
| goto exit; |
| } |
| |
| rc = write_handle_unknown_to_cil(out, pdb); |
| if (rc != 0) { |
| goto exit; |
| } |
| |
| rc = write_class_decl_rules_to_cil(out, pdb); |
| if (rc != 0) { |
| goto exit; |
| } |
| |
| rc = write_sid_decl_rules_to_cil(out, pdb); |
| if (rc != 0) { |
| goto exit; |
| } |
| |
| rc = write_default_rules_to_cil(out, pdb); |
| if (rc != 0) { |
| goto exit; |
| } |
| |
| rc = write_mls_rules_to_cil(out, pdb); |
| if (rc != 0) { |
| goto exit; |
| } |
| |
| strs_write_each(mls_constraints, out); |
| strs_write_each(mls_validatetrans, out); |
| |
| rc = write_polcap_rules_to_cil(out, pdb); |
| if (rc != 0) { |
| goto exit; |
| } |
| |
| rc = write_type_attributes_to_cil(out, pdb); |
| if (rc != 0) { |
| goto exit; |
| } |
| |
| rc = write_role_attributes_to_cil(out, pdb); |
| if (rc != 0) { |
| goto exit; |
| } |
| |
| rc = write_boolean_decl_rules_to_cil(out, pdb); |
| if (rc != 0) { |
| goto exit; |
| } |
| |
| rc = write_type_decl_rules_to_cil(out, pdb); |
| if (rc != 0) { |
| goto exit; |
| } |
| |
| rc = write_type_alias_rules_to_cil(out, pdb); |
| if (rc != 0) { |
| goto exit; |
| } |
| |
| rc = write_type_bounds_rules_to_cil(out, pdb); |
| if (rc != 0) { |
| goto exit; |
| } |
| |
| rc = write_type_attribute_sets_to_cil(out, pdb); |
| if (rc != 0) { |
| goto exit; |
| } |
| |
| rc = write_type_permissive_rules_to_cil(out, pdb); |
| if (rc != 0) { |
| goto exit; |
| } |
| |
| rc = write_avtab_to_cil(out, pdb, 0); |
| if (rc != 0) { |
| goto exit; |
| } |
| |
| rc = write_filename_trans_rules_to_cil(out, pdb); |
| if (rc != 0) { |
| goto exit; |
| } |
| |
| if (pdb->mls) { |
| rc = write_range_trans_rules_to_cil(out, pdb); |
| if (rc != 0) { |
| goto exit; |
| } |
| } |
| |
| rc = write_cond_nodes_to_cil(out, pdb); |
| if (rc != 0) { |
| goto exit; |
| } |
| |
| rc = write_role_decl_rules_to_cil(out, pdb); |
| if (rc != 0) { |
| goto exit; |
| } |
| |
| rc = write_role_transition_rules_to_cil(out, pdb); |
| if (rc != 0) { |
| goto exit; |
| } |
| |
| rc = write_role_allow_rules_to_cil(out, pdb); |
| if (rc != 0) { |
| goto exit; |
| } |
| |
| rc = write_user_decl_rules_to_cil(out, pdb); |
| if (rc != 0) { |
| goto exit; |
| } |
| |
| strs_write_each(non_mls_constraints, out); |
| strs_write_each(non_mls_validatetrans, out); |
| |
| rc = sort_ocontexts(pdb); |
| if (rc != 0) { |
| goto exit; |
| } |
| |
| if (pdb->target_platform == SEPOL_TARGET_SELINUX) { |
| rc = write_selinux_isid_rules_to_cil(out, pdb); |
| if (rc != 0) { |
| goto exit; |
| } |
| |
| rc = write_selinux_fsuse_rules_to_cil(out, pdb); |
| if (rc != 0) { |
| goto exit; |
| } |
| |
| rc = write_genfscon_rules_to_cil(out, pdb); |
| if (rc != 0) { |
| goto exit; |
| } |
| |
| rc = write_selinux_port_rules_to_cil(out, pdb); |
| if (rc != 0) { |
| goto exit; |
| } |
| |
| rc = write_selinux_netif_rules_to_cil(out, pdb); |
| if (rc != 0) { |
| goto exit; |
| } |
| |
| rc = write_selinux_node_rules_to_cil(out, pdb); |
| if (rc != 0) { |
| goto exit; |
| } |
| |
| rc = write_selinux_node6_rules_to_cil(out, pdb); |
| if (rc != 0) { |
| goto exit; |
| } |
| |
| rc = write_selinux_ibpkey_rules_to_cil(out, pdb); |
| if (rc != 0) { |
| goto exit; |
| } |
| |
| rc = write_selinux_ibendport_rules_to_cil(out, pdb); |
| if (rc != 0) { |
| goto exit; |
| } |
| } else if (pdb->target_platform == SEPOL_TARGET_XEN) { |
| rc = write_xen_isid_rules_to_cil(out, pdb); |
| if (rc != 0) { |
| goto exit; |
| } |
| |
| rc = write_xen_pirq_rules_to_cil(out, pdb); |
| if (rc != 0) { |
| goto exit; |
| } |
| |
| rc = write_xen_ioport_rules_to_cil(out, pdb); |
| if (rc != 0) { |
| goto exit; |
| } |
| |
| rc = write_xen_iomem_rules_to_cil(out, pdb); |
| if (rc != 0) { |
| goto exit; |
| } |
| |
| rc = write_xen_pcidevice_rules_to_cil(out, pdb); |
| if (rc != 0) { |
| goto exit; |
| } |
| |
| rc = write_xen_devicetree_rules_to_cil(out, pdb); |
| if (rc != 0) { |
| goto exit; |
| } |
| } |
| |
| exit: |
| strs_free_all(mls_constraints); |
| strs_destroy(&mls_constraints); |
| strs_free_all(non_mls_constraints); |
| strs_destroy(&non_mls_constraints); |
| strs_free_all(mls_validatetrans); |
| strs_destroy(&mls_validatetrans); |
| strs_free_all(non_mls_validatetrans); |
| strs_destroy(&non_mls_validatetrans); |
| |
| return rc; |
| } |