Lines Matching +full:rc +full:- +full:map +full:- +full:name
1 // SPDX-License-Identifier: GPL-2.0-only
17 * Updated: Hewlett-Packard <paul@paul-moore.com>
35 * Copyright (C) 2006, 2007 Hewlett-Packard Development Company, L.P.
36 * Copyright (C) 2004-2006 Trusted Computer Solutions, Inc.
37 * Copyright (C) 2003 - 2004, 2006 Tresys Technology, LLC
102 const struct security_class_mapping *map, in selinux_set_mapping() argument
110 if (!map) in selinux_set_mapping()
111 return -EINVAL; in selinux_set_mapping()
113 while (map[i].name) in selinux_set_mapping()
117 out_map->mapping = kcalloc(++i, sizeof(*out_map->mapping), GFP_ATOMIC); in selinux_set_mapping()
118 if (!out_map->mapping) in selinux_set_mapping()
119 return -ENOMEM; in selinux_set_mapping()
123 while (map[j].name) { in selinux_set_mapping()
124 const struct security_class_mapping *p_in = map + (j++); in selinux_set_mapping()
125 struct selinux_mapping *p_out = out_map->mapping + j; in selinux_set_mapping()
128 if (!strcmp(p_in->name, "")) { in selinux_set_mapping()
129 p_out->num_perms = 0; in selinux_set_mapping()
133 p_out->value = string_to_security_class(pol, p_in->name); in selinux_set_mapping()
134 if (!p_out->value) { in selinux_set_mapping()
136 p_in->name); in selinux_set_mapping()
137 if (pol->reject_unknown) in selinux_set_mapping()
139 p_out->num_perms = 0; in selinux_set_mapping()
145 while (p_in->perms[k]) { in selinux_set_mapping()
147 if (!*p_in->perms[k]) { in selinux_set_mapping()
151 p_out->perms[k] = string_to_av_perm(pol, p_out->value, in selinux_set_mapping()
152 p_in->perms[k]); in selinux_set_mapping()
153 if (!p_out->perms[k]) { in selinux_set_mapping()
155 p_in->perms[k], p_in->name); in selinux_set_mapping()
156 if (pol->reject_unknown) in selinux_set_mapping()
163 p_out->num_perms = k; in selinux_set_mapping()
168 pol->allow_unknown ? "allowed" : "denied"); in selinux_set_mapping()
170 out_map->size = i; in selinux_set_mapping()
173 kfree(out_map->mapping); in selinux_set_mapping()
174 out_map->mapping = NULL; in selinux_set_mapping()
175 return -EINVAL; in selinux_set_mapping()
182 static u16 unmap_class(struct selinux_map *map, u16 tclass) in unmap_class() argument
184 if (tclass < map->size) in unmap_class()
185 return map->mapping[tclass].value; in unmap_class()
193 static u16 map_class(struct selinux_map *map, u16 pol_value) in map_class() argument
197 for (i = 1; i < map->size; i++) { in map_class()
198 if (map->mapping[i].value == pol_value) in map_class()
205 static void map_decision(struct selinux_map *map, in map_decision() argument
209 if (tclass < map->size) { in map_decision()
210 struct selinux_mapping *mapping = &map->mapping[tclass]; in map_decision()
211 unsigned int i, n = mapping->num_perms; in map_decision()
215 if (avd->allowed & mapping->perms[i]) in map_decision()
217 if (allow_unknown && !mapping->perms[i]) in map_decision()
220 avd->allowed = result; in map_decision()
223 if (avd->auditallow & mapping->perms[i]) in map_decision()
225 avd->auditallow = result; in map_decision()
228 if (avd->auditdeny & mapping->perms[i]) in map_decision()
230 if (!allow_unknown && !mapping->perms[i]) in map_decision()
240 avd->auditdeny = result; in map_decision()
253 policy = rcu_dereference(state->policy); in security_mls_enabled()
254 mls_enabled = policy->policydb.mls_enabled; in security_mls_enabled()
282 int sp = -1; in constraint_expr_eval()
284 for (e = cexpr; e; e = e->next) { in constraint_expr_eval()
285 switch (e->expr_type) { in constraint_expr_eval()
292 sp--; in constraint_expr_eval()
297 sp--; in constraint_expr_eval()
301 if (sp == (CEXPR_MAXDEPTH - 1)) in constraint_expr_eval()
303 switch (e->attr) { in constraint_expr_eval()
305 val1 = scontext->user; in constraint_expr_eval()
306 val2 = tcontext->user; in constraint_expr_eval()
309 val1 = scontext->type; in constraint_expr_eval()
310 val2 = tcontext->type; in constraint_expr_eval()
313 val1 = scontext->role; in constraint_expr_eval()
314 val2 = tcontext->role; in constraint_expr_eval()
315 r1 = policydb->role_val_to_struct[val1 - 1]; in constraint_expr_eval()
316 r2 = policydb->role_val_to_struct[val2 - 1]; in constraint_expr_eval()
317 switch (e->op) { in constraint_expr_eval()
319 s[++sp] = ebitmap_get_bit(&r1->dominates, in constraint_expr_eval()
320 val2 - 1); in constraint_expr_eval()
323 s[++sp] = ebitmap_get_bit(&r2->dominates, in constraint_expr_eval()
324 val1 - 1); in constraint_expr_eval()
327 s[++sp] = (!ebitmap_get_bit(&r1->dominates, in constraint_expr_eval()
328 val2 - 1) && in constraint_expr_eval()
329 !ebitmap_get_bit(&r2->dominates, in constraint_expr_eval()
330 val1 - 1)); in constraint_expr_eval()
337 l1 = &(scontext->range.level[0]); in constraint_expr_eval()
338 l2 = &(tcontext->range.level[0]); in constraint_expr_eval()
341 l1 = &(scontext->range.level[0]); in constraint_expr_eval()
342 l2 = &(tcontext->range.level[1]); in constraint_expr_eval()
345 l1 = &(scontext->range.level[1]); in constraint_expr_eval()
346 l2 = &(tcontext->range.level[0]); in constraint_expr_eval()
349 l1 = &(scontext->range.level[1]); in constraint_expr_eval()
350 l2 = &(tcontext->range.level[1]); in constraint_expr_eval()
353 l1 = &(scontext->range.level[0]); in constraint_expr_eval()
354 l2 = &(scontext->range.level[1]); in constraint_expr_eval()
357 l1 = &(tcontext->range.level[0]); in constraint_expr_eval()
358 l2 = &(tcontext->range.level[1]); in constraint_expr_eval()
361 switch (e->op) { in constraint_expr_eval()
387 switch (e->op) { in constraint_expr_eval()
400 if (sp == (CEXPR_MAXDEPTH-1)) in constraint_expr_eval()
403 if (e->attr & CEXPR_TARGET) in constraint_expr_eval()
405 else if (e->attr & CEXPR_XTARGET) { in constraint_expr_eval()
412 if (e->attr & CEXPR_USER) in constraint_expr_eval()
413 val1 = c->user; in constraint_expr_eval()
414 else if (e->attr & CEXPR_ROLE) in constraint_expr_eval()
415 val1 = c->role; in constraint_expr_eval()
416 else if (e->attr & CEXPR_TYPE) in constraint_expr_eval()
417 val1 = c->type; in constraint_expr_eval()
423 switch (e->op) { in constraint_expr_eval()
425 s[++sp] = ebitmap_get_bit(&e->names, val1 - 1); in constraint_expr_eval()
428 s[++sp] = !ebitmap_get_bit(&e->names, val1 - 1); in constraint_expr_eval()
446 * security_dump_masked_av - dumps masked permissions during
454 BUG_ON(pdatum->value < 1 || pdatum->value > 32); in dump_masked_av_helper()
456 permission_names[pdatum->value - 1] = (char *)k; in dump_masked_av_helper()
482 tclass_name = sym_name(policydb, SYM_CLASSES, tclass - 1); in security_dump_masked_av()
483 tclass_dat = policydb->class_val_to_struct[tclass - 1]; in security_dump_masked_av()
484 common_dat = tclass_dat->comdatum; in security_dump_masked_av()
488 hashtab_map(&common_dat->permissions.table, in security_dump_masked_av()
492 if (hashtab_map(&tclass_dat->permissions.table, in security_dump_masked_av()
535 * security_boundary_permission - drops violated permissions
551 source = policydb->type_val_to_struct[scontext->type - 1]; in type_attribute_bounds_av()
554 if (!source->bounds) in type_attribute_bounds_av()
557 target = policydb->type_val_to_struct[tcontext->type - 1]; in type_attribute_bounds_av()
563 lo_scontext.type = source->bounds; in type_attribute_bounds_av()
565 if (target->bounds) { in type_attribute_bounds_av()
567 lo_tcontext.type = target->bounds; in type_attribute_bounds_av()
577 masked = ~lo_avd.allowed & avd->allowed; in type_attribute_bounds_av()
583 avd->allowed &= ~masked; in type_attribute_bounds_av()
600 if (node->datum.u.xperms->specified == AVTAB_XPERMS_IOCTLDRIVER) { in services_compute_xperms_drivers()
602 for (i = 0; i < ARRAY_SIZE(xperms->drivers.p); i++) in services_compute_xperms_drivers()
603 xperms->drivers.p[i] |= node->datum.u.xperms->perms.p[i]; in services_compute_xperms_drivers()
604 } else if (node->datum.u.xperms->specified == AVTAB_XPERMS_IOCTLFUNCTION) { in services_compute_xperms_drivers()
606 security_xperm_set(xperms->drivers.p, in services_compute_xperms_drivers()
607 node->datum.u.xperms->driver); in services_compute_xperms_drivers()
610 xperms->len = 1; in services_compute_xperms_drivers()
633 avd->allowed = 0; in context_struct_compute_av()
634 avd->auditallow = 0; in context_struct_compute_av()
635 avd->auditdeny = 0xffffffff; in context_struct_compute_av()
637 memset(&xperms->drivers, 0, sizeof(xperms->drivers)); in context_struct_compute_av()
638 xperms->len = 0; in context_struct_compute_av()
641 if (unlikely(!tclass || tclass > policydb->p_classes.nprim)) { in context_struct_compute_av()
647 tclass_datum = policydb->class_val_to_struct[tclass - 1]; in context_struct_compute_av()
655 sattr = &policydb->type_attr_map_array[scontext->type - 1]; in context_struct_compute_av()
656 tattr = &policydb->type_attr_map_array[tcontext->type - 1]; in context_struct_compute_av()
661 for (node = avtab_search_node(&policydb->te_avtab, in context_struct_compute_av()
665 if (node->key.specified == AVTAB_ALLOWED) in context_struct_compute_av()
666 avd->allowed |= node->datum.u.data; in context_struct_compute_av()
667 else if (node->key.specified == AVTAB_AUDITALLOW) in context_struct_compute_av()
668 avd->auditallow |= node->datum.u.data; in context_struct_compute_av()
669 else if (node->key.specified == AVTAB_AUDITDENY) in context_struct_compute_av()
670 avd->auditdeny &= node->datum.u.data; in context_struct_compute_av()
671 else if (xperms && (node->key.specified & AVTAB_XPERMS)) in context_struct_compute_av()
676 cond_compute_av(&policydb->te_cond_avtab, &avkey, in context_struct_compute_av()
686 constraint = tclass_datum->constraints; in context_struct_compute_av()
688 if ((constraint->permissions & (avd->allowed)) && in context_struct_compute_av()
690 constraint->expr)) { in context_struct_compute_av()
691 avd->allowed &= ~(constraint->permissions); in context_struct_compute_av()
693 constraint = constraint->next; in context_struct_compute_av()
701 if (tclass == policydb->process_class && in context_struct_compute_av()
702 (avd->allowed & policydb->process_trans_perms) && in context_struct_compute_av()
703 scontext->role != tcontext->role) { in context_struct_compute_av()
704 for (ra = policydb->role_allow; ra; ra = ra->next) { in context_struct_compute_av()
705 if (scontext->role == ra->role && in context_struct_compute_av()
706 tcontext->role == ra->new_role) in context_struct_compute_av()
710 avd->allowed &= ~policydb->process_trans_perms; in context_struct_compute_av()
729 struct policydb *p = &policy->policydb; in security_validtrans_handle_fail()
730 struct sidtab *sidtab = policy->sidtab; in security_validtrans_handle_fail()
743 o, n, t, sym_name(p, SYM_CLASSES, tclass-1)); in security_validtrans_handle_fail()
751 return -EPERM; in security_validtrans_handle_fail()
767 int rc = 0; in security_compute_validatetrans() local
775 policy = rcu_dereference(state->policy); in security_compute_validatetrans()
776 policydb = &policy->policydb; in security_compute_validatetrans()
777 sidtab = policy->sidtab; in security_compute_validatetrans()
780 tclass = unmap_class(&policy->map, orig_tclass); in security_compute_validatetrans()
784 if (!tclass || tclass > policydb->p_classes.nprim) { in security_compute_validatetrans()
785 rc = -EINVAL; in security_compute_validatetrans()
788 tclass_datum = policydb->class_val_to_struct[tclass - 1]; in security_compute_validatetrans()
794 rc = -EINVAL; in security_compute_validatetrans()
802 rc = -EINVAL; in security_compute_validatetrans()
810 rc = -EINVAL; in security_compute_validatetrans()
814 constraint = tclass_datum->validatetrans; in security_compute_validatetrans()
816 if (!constraint_expr_eval(policydb, &oentry->context, in security_compute_validatetrans()
817 &nentry->context, &tentry->context, in security_compute_validatetrans()
818 constraint->expr)) { in security_compute_validatetrans()
820 rc = -EPERM; in security_compute_validatetrans()
822 rc = security_validtrans_handle_fail(state, in security_compute_validatetrans()
830 constraint = constraint->next; in security_compute_validatetrans()
835 return rc; in security_compute_validatetrans()
855 * security_bounded_transition - check whether the given
873 int rc; in security_bounded_transition() local
879 policy = rcu_dereference(state->policy); in security_bounded_transition()
880 policydb = &policy->policydb; in security_bounded_transition()
881 sidtab = policy->sidtab; in security_bounded_transition()
883 rc = -EINVAL; in security_bounded_transition()
891 rc = -EINVAL; in security_bounded_transition()
899 rc = 0; in security_bounded_transition()
901 if (old_entry->context.type == new_entry->context.type) in security_bounded_transition()
904 index = new_entry->context.type; in security_bounded_transition()
906 type = policydb->type_val_to_struct[index - 1]; in security_bounded_transition()
910 rc = -EPERM; in security_bounded_transition()
911 if (!type->bounds) in security_bounded_transition()
915 rc = 0; in security_bounded_transition()
916 if (type->bounds == old_entry->context.type) in security_bounded_transition()
919 index = type->bounds; in security_bounded_transition()
922 if (rc) { in security_bounded_transition()
944 return rc; in security_bounded_transition()
949 avd->allowed = 0; in avd_init()
950 avd->auditallow = 0; in avd_init()
951 avd->auditdeny = 0xffffffff; in avd_init()
953 avd->seqno = policy->latest_granting; in avd_init()
955 avd->seqno = 0; in avd_init()
956 avd->flags = 0; in avd_init()
964 if (node->datum.u.xperms->specified == AVTAB_XPERMS_IOCTLFUNCTION) { in services_compute_xperms_decision()
965 if (xpermd->driver != node->datum.u.xperms->driver) in services_compute_xperms_decision()
967 } else if (node->datum.u.xperms->specified == AVTAB_XPERMS_IOCTLDRIVER) { in services_compute_xperms_decision()
968 if (!security_xperm_test(node->datum.u.xperms->perms.p, in services_compute_xperms_decision()
969 xpermd->driver)) in services_compute_xperms_decision()
975 if (node->key.specified == AVTAB_XPERMS_ALLOWED) { in services_compute_xperms_decision()
976 xpermd->used |= XPERMS_ALLOWED; in services_compute_xperms_decision()
977 if (node->datum.u.xperms->specified == AVTAB_XPERMS_IOCTLDRIVER) { in services_compute_xperms_decision()
978 memset(xpermd->allowed->p, 0xff, in services_compute_xperms_decision()
979 sizeof(xpermd->allowed->p)); in services_compute_xperms_decision()
981 if (node->datum.u.xperms->specified == AVTAB_XPERMS_IOCTLFUNCTION) { in services_compute_xperms_decision()
982 for (i = 0; i < ARRAY_SIZE(xpermd->allowed->p); i++) in services_compute_xperms_decision()
983 xpermd->allowed->p[i] |= in services_compute_xperms_decision()
984 node->datum.u.xperms->perms.p[i]; in services_compute_xperms_decision()
986 } else if (node->key.specified == AVTAB_XPERMS_AUDITALLOW) { in services_compute_xperms_decision()
987 xpermd->used |= XPERMS_AUDITALLOW; in services_compute_xperms_decision()
988 if (node->datum.u.xperms->specified == AVTAB_XPERMS_IOCTLDRIVER) { in services_compute_xperms_decision()
989 memset(xpermd->auditallow->p, 0xff, in services_compute_xperms_decision()
990 sizeof(xpermd->auditallow->p)); in services_compute_xperms_decision()
992 if (node->datum.u.xperms->specified == AVTAB_XPERMS_IOCTLFUNCTION) { in services_compute_xperms_decision()
993 for (i = 0; i < ARRAY_SIZE(xpermd->auditallow->p); i++) in services_compute_xperms_decision()
994 xpermd->auditallow->p[i] |= in services_compute_xperms_decision()
995 node->datum.u.xperms->perms.p[i]; in services_compute_xperms_decision()
997 } else if (node->key.specified == AVTAB_XPERMS_DONTAUDIT) { in services_compute_xperms_decision()
998 xpermd->used |= XPERMS_DONTAUDIT; in services_compute_xperms_decision()
999 if (node->datum.u.xperms->specified == AVTAB_XPERMS_IOCTLDRIVER) { in services_compute_xperms_decision()
1000 memset(xpermd->dontaudit->p, 0xff, in services_compute_xperms_decision()
1001 sizeof(xpermd->dontaudit->p)); in services_compute_xperms_decision()
1003 if (node->datum.u.xperms->specified == AVTAB_XPERMS_IOCTLFUNCTION) { in services_compute_xperms_decision()
1004 for (i = 0; i < ARRAY_SIZE(xpermd->dontaudit->p); i++) in services_compute_xperms_decision()
1005 xpermd->dontaudit->p[i] |= in services_compute_xperms_decision()
1006 node->datum.u.xperms->perms.p[i]; in services_compute_xperms_decision()
1031 xpermd->driver = driver; in security_compute_xperms_decision()
1032 xpermd->used = 0; in security_compute_xperms_decision()
1033 memset(xpermd->allowed->p, 0, sizeof(xpermd->allowed->p)); in security_compute_xperms_decision()
1034 memset(xpermd->auditallow->p, 0, sizeof(xpermd->auditallow->p)); in security_compute_xperms_decision()
1035 memset(xpermd->dontaudit->p, 0, sizeof(xpermd->dontaudit->p)); in security_compute_xperms_decision()
1041 policy = rcu_dereference(state->policy); in security_compute_xperms_decision()
1042 policydb = &policy->policydb; in security_compute_xperms_decision()
1043 sidtab = policy->sidtab; in security_compute_xperms_decision()
1059 tclass = unmap_class(&policy->map, orig_tclass); in security_compute_xperms_decision()
1061 if (policydb->allow_unknown) in security_compute_xperms_decision()
1067 if (unlikely(!tclass || tclass > policydb->p_classes.nprim)) { in security_compute_xperms_decision()
1074 sattr = &policydb->type_attr_map_array[scontext->type - 1]; in security_compute_xperms_decision()
1075 tattr = &policydb->type_attr_map_array[tcontext->type - 1]; in security_compute_xperms_decision()
1080 for (node = avtab_search_node(&policydb->te_avtab, in security_compute_xperms_decision()
1086 cond_compute_xperms(&policydb->te_cond_avtab, in security_compute_xperms_decision()
1094 memset(xpermd->allowed->p, 0xff, sizeof(xpermd->allowed->p)); in security_compute_xperms_decision()
1099 * security_compute_av - Compute access vector decisions.
1124 policy = rcu_dereference(state->policy); in security_compute_av()
1126 xperms->len = 0; in security_compute_av()
1130 policydb = &policy->policydb; in security_compute_av()
1131 sidtab = policy->sidtab; in security_compute_av()
1141 if (ebitmap_get_bit(&policydb->permissive_map, scontext->type)) in security_compute_av()
1142 avd->flags |= AVD_FLAGS_PERMISSIVE; in security_compute_av()
1151 tclass = unmap_class(&policy->map, orig_tclass); in security_compute_av()
1153 if (policydb->allow_unknown) in security_compute_av()
1159 map_decision(&policy->map, orig_tclass, avd, in security_compute_av()
1160 policydb->allow_unknown); in security_compute_av()
1165 avd->allowed = 0xffffffff; in security_compute_av()
1181 policy = rcu_dereference(state->policy); in security_compute_av_user()
1186 policydb = &policy->policydb; in security_compute_av_user()
1187 sidtab = policy->sidtab; in security_compute_av_user()
1197 if (ebitmap_get_bit(&policydb->permissive_map, scontext->type)) in security_compute_av_user()
1198 avd->flags |= AVD_FLAGS_PERMISSIVE; in security_compute_av_user()
1208 if (policydb->allow_unknown) in security_compute_av_user()
1219 avd->allowed = 0xffffffff; in security_compute_av_user()
1240 if (context->len) { in context_struct_to_string()
1241 *scontext_len = context->len; in context_struct_to_string()
1243 *scontext = kstrdup(context->str, GFP_ATOMIC); in context_struct_to_string()
1245 return -ENOMEM; in context_struct_to_string()
1251 *scontext_len += strlen(sym_name(p, SYM_USERS, context->user - 1)) + 1; in context_struct_to_string()
1252 *scontext_len += strlen(sym_name(p, SYM_ROLES, context->role - 1)) + 1; in context_struct_to_string()
1253 *scontext_len += strlen(sym_name(p, SYM_TYPES, context->type - 1)) + 1; in context_struct_to_string()
1262 return -ENOMEM; in context_struct_to_string()
1266 * Copy the user name, role name and type name into the context. in context_struct_to_string()
1269 sym_name(p, SYM_USERS, context->user - 1), in context_struct_to_string()
1270 sym_name(p, SYM_ROLES, context->role - 1), in context_struct_to_string()
1271 sym_name(p, SYM_TYPES, context->type - 1)); in context_struct_to_string()
1285 int rc = sidtab_sid2str_get(sidtab, entry, scontext, scontext_len); in sidtab_entry_to_string() local
1287 if (rc != -ENOENT) in sidtab_entry_to_string()
1288 return rc; in sidtab_entry_to_string()
1290 rc = context_struct_to_string(p, &entry->context, scontext, in sidtab_entry_to_string()
1292 if (!rc && scontext) in sidtab_entry_to_string()
1294 return rc; in sidtab_entry_to_string()
1302 int rc; in security_sidtab_hash_stats() local
1307 return -EINVAL; in security_sidtab_hash_stats()
1311 policy = rcu_dereference(state->policy); in security_sidtab_hash_stats()
1312 rc = sidtab_hash_stats(policy->sidtab, page); in security_sidtab_hash_stats()
1315 return rc; in security_sidtab_hash_stats()
1334 int rc = 0; in security_sid_to_context_core() local
1346 return -EINVAL; in security_sid_to_context_core()
1352 return -ENOMEM; in security_sid_to_context_core()
1358 return -EINVAL; in security_sid_to_context_core()
1361 policy = rcu_dereference(state->policy); in security_sid_to_context_core()
1362 policydb = &policy->policydb; in security_sid_to_context_core()
1363 sidtab = policy->sidtab; in security_sid_to_context_core()
1372 rc = -EINVAL; in security_sid_to_context_core()
1375 if (only_invalid && !entry->context.len) in security_sid_to_context_core()
1378 rc = sidtab_entry_to_string(policydb, sidtab, entry, scontext, in security_sid_to_context_core()
1383 return rc; in security_sid_to_context_core()
1388 * security_sid_to_context - Obtain a context for a given SID.
1413 * security_sid_to_context_inval - Obtain a context for a given SID if it
1446 int rc = 0; in string_to_context_struct() local
1452 rc = -EINVAL; in string_to_context_struct()
1465 usrdatum = symtab_search(&pol->p_users, scontextp); in string_to_context_struct()
1469 ctx->user = usrdatum->value; in string_to_context_struct()
1481 role = symtab_search(&pol->p_roles, scontextp); in string_to_context_struct()
1484 ctx->role = role->value; in string_to_context_struct()
1493 typdatum = symtab_search(&pol->p_types, scontextp); in string_to_context_struct()
1494 if (!typdatum || typdatum->attribute) in string_to_context_struct()
1497 ctx->type = typdatum->value; in string_to_context_struct()
1499 rc = mls_context_to_sid(pol, oldc, p, ctx, sidtabp, def_sid); in string_to_context_struct()
1500 if (rc) in string_to_context_struct()
1504 rc = -EINVAL; in string_to_context_struct()
1507 rc = 0; in string_to_context_struct()
1509 if (rc) in string_to_context_struct()
1511 return rc; in string_to_context_struct()
1524 int rc = 0; in security_context_to_sid_core() local
1528 return -EINVAL; in security_context_to_sid_core()
1533 return -ENOMEM; in security_context_to_sid_core()
1553 rc = -ENOMEM; in security_context_to_sid_core()
1560 policy = rcu_dereference(state->policy); in security_context_to_sid_core()
1561 policydb = &policy->policydb; in security_context_to_sid_core()
1562 sidtab = policy->sidtab; in security_context_to_sid_core()
1563 rc = string_to_context_struct(policydb, sidtab, scontext2, in security_context_to_sid_core()
1565 if (rc == -EINVAL && force) { in security_context_to_sid_core()
1569 } else if (rc) in security_context_to_sid_core()
1571 rc = sidtab_context_to_sid(sidtab, &context, sid); in security_context_to_sid_core()
1572 if (rc == -ESTALE) { in security_context_to_sid_core()
1587 return rc; in security_context_to_sid_core()
1591 * security_context_to_sid - Obtain a SID for a given security context.
1600 * Returns -%EINVAL if the context is invalid, -%ENOMEM if insufficient
1619 * security_context_to_sid_default - Obtain a SID for a given security context,
1627 * @gfp_flags: the allocator get-free-page (GFP) flags
1635 * Returns -%EINVAL if the context is invalid, -%ENOMEM if insufficient
1662 struct policydb *policydb = &policy->policydb; in compute_sid_handle_invalid_context()
1663 struct sidtab *sidtab = policy->sidtab; in compute_sid_handle_invalid_context()
1680 audit_log_n_untrustedstring(ab, n, nlen - 1); in compute_sid_handle_invalid_context()
1682 s, t, sym_name(policydb, SYM_CLASSES, tclass-1)); in compute_sid_handle_invalid_context()
1690 return -EACCES; in compute_sid_handle_invalid_context()
1706 if (!ebitmap_get_bit(&policydb->filename_trans_ttypes, ttype)) in filename_compute_type()
1711 ft.name = objname; in filename_compute_type()
1715 if (ebitmap_get_bit(&datum->stypes, stype - 1)) { in filename_compute_type()
1716 newcontext->type = datum->otype; in filename_compute_type()
1719 datum = datum->next; in filename_compute_type()
1742 int rc = 0; in security_compute_sid() local
1763 policy = rcu_dereference(state->policy); in security_compute_sid()
1766 tclass = unmap_class(&policy->map, orig_tclass); in security_compute_sid()
1770 sock = security_is_socket_class(map_class(&policy->map, in security_compute_sid()
1774 policydb = &policy->policydb; in security_compute_sid()
1775 sidtab = policy->sidtab; in security_compute_sid()
1781 rc = -EINVAL; in security_compute_sid()
1788 rc = -EINVAL; in security_compute_sid()
1792 scontext = &sentry->context; in security_compute_sid()
1793 tcontext = &tentry->context; in security_compute_sid()
1795 if (tclass && tclass <= policydb->p_classes.nprim) in security_compute_sid()
1796 cladatum = policydb->class_val_to_struct[tclass - 1]; in security_compute_sid()
1802 if (cladatum && cladatum->default_user == DEFAULT_TARGET) { in security_compute_sid()
1803 newcontext.user = tcontext->user; in security_compute_sid()
1807 newcontext.user = scontext->user; in security_compute_sid()
1812 newcontext.user = tcontext->user; in security_compute_sid()
1817 if (cladatum && cladatum->default_role == DEFAULT_SOURCE) { in security_compute_sid()
1818 newcontext.role = scontext->role; in security_compute_sid()
1819 } else if (cladatum && cladatum->default_role == DEFAULT_TARGET) { in security_compute_sid()
1820 newcontext.role = tcontext->role; in security_compute_sid()
1822 if ((tclass == policydb->process_class) || sock) in security_compute_sid()
1823 newcontext.role = scontext->role; in security_compute_sid()
1829 if (cladatum && cladatum->default_type == DEFAULT_SOURCE) { in security_compute_sid()
1830 newcontext.type = scontext->type; in security_compute_sid()
1831 } else if (cladatum && cladatum->default_type == DEFAULT_TARGET) { in security_compute_sid()
1832 newcontext.type = tcontext->type; in security_compute_sid()
1834 if ((tclass == policydb->process_class) || sock) { in security_compute_sid()
1836 newcontext.type = scontext->type; in security_compute_sid()
1839 newcontext.type = tcontext->type; in security_compute_sid()
1844 avkey.source_type = scontext->type; in security_compute_sid()
1845 avkey.target_type = tcontext->type; in security_compute_sid()
1848 avdatum = avtab_search(&policydb->te_avtab, &avkey); in security_compute_sid()
1852 node = avtab_search_node(&policydb->te_cond_avtab, &avkey); in security_compute_sid()
1854 if (node->key.specified & AVTAB_ENABLED) { in security_compute_sid()
1855 avdatum = &node->datum; in security_compute_sid()
1863 newcontext.type = avdatum->u.data; in security_compute_sid()
1868 filename_compute_type(policydb, &newcontext, scontext->type, in security_compute_sid()
1869 tcontext->type, tclass, objname); in security_compute_sid()
1871 /* Check for class-specific changes. */ in security_compute_sid()
1876 .role = scontext->role, in security_compute_sid()
1877 .type = tcontext->type, in security_compute_sid()
1883 newcontext.role = rtd->new_role; in security_compute_sid()
1888 rc = mls_compute_sid(policydb, scontext, tcontext, tclass, specified, in security_compute_sid()
1890 if (rc) in security_compute_sid()
1895 rc = compute_sid_handle_invalid_context(state, policy, sentry, in security_compute_sid()
1898 if (rc) in security_compute_sid()
1902 rc = sidtab_context_to_sid(sidtab, &newcontext, out_sid); in security_compute_sid()
1903 if (rc == -ESTALE) { in security_compute_sid()
1912 return rc; in security_compute_sid()
1916 * security_transition_sid - Compute the SID for a new subject/object.
1921 * @qstr: object name
1926 * Return -%EINVAL if any of the parameters are invalid, -%ENOMEM
1936 qstr ? qstr->name : NULL, out_sid, true); in security_transition_sid()
1949 * security_member_sid - Compute the SID for member selection.
1958 * Return -%EINVAL if any of the parameters are invalid, -%ENOMEM
1974 * security_change_sid - Compute the SID for object relabeling.
1983 * Return -%EINVAL if any of the parameters are invalid, -%ENOMEM
2007 return -EINVAL; in convert_context_handle_invalid_context()
2020 * in the policy `p->oldp' to the values specified
2021 * in the policy `p->newp', storing the new context
2035 int rc; in convert_context() local
2039 if (oldc->str) { in convert_context()
2040 s = kstrdup(oldc->str, gfp_flags); in convert_context()
2042 return -ENOMEM; in convert_context()
2044 rc = string_to_context_struct(args->newp, NULL, s, in convert_context()
2046 if (rc == -EINVAL) { in convert_context()
2050 * IMPORTANT: We need to copy the contents of oldc->str in convert_context()
2054 memcpy(s, oldc->str, oldc->len); in convert_context()
2056 newc->str = s; in convert_context()
2057 newc->len = oldc->len; in convert_context()
2061 if (rc) { in convert_context()
2063 pr_err("SELinux: Unable to map context %s, rc = %d.\n", in convert_context()
2064 oldc->str, -rc); in convert_context()
2065 return rc; in convert_context()
2068 oldc->str); in convert_context()
2075 usrdatum = symtab_search(&args->newp->p_users, in convert_context()
2076 sym_name(args->oldp, in convert_context()
2077 SYM_USERS, oldc->user - 1)); in convert_context()
2080 newc->user = usrdatum->value; in convert_context()
2083 role = symtab_search(&args->newp->p_roles, in convert_context()
2084 sym_name(args->oldp, SYM_ROLES, oldc->role - 1)); in convert_context()
2087 newc->role = role->value; in convert_context()
2090 typdatum = symtab_search(&args->newp->p_types, in convert_context()
2091 sym_name(args->oldp, in convert_context()
2092 SYM_TYPES, oldc->type - 1)); in convert_context()
2095 newc->type = typdatum->value; in convert_context()
2098 if (args->oldp->mls_enabled && args->newp->mls_enabled) { in convert_context()
2099 rc = mls_convert_context(args->oldp, args->newp, oldc, newc); in convert_context()
2100 if (rc) in convert_context()
2102 } else if (!args->oldp->mls_enabled && args->newp->mls_enabled) { in convert_context()
2104 * Switching between non-MLS and MLS policy: in convert_context()
2110 oc = args->newp->ocontexts[OCON_ISID]; in convert_context()
2111 while (oc && oc->sid[0] != SECINITSID_UNLABELED) in convert_context()
2112 oc = oc->next; in convert_context()
2118 rc = mls_range_set(newc, &oc->context[0].range); in convert_context()
2119 if (rc) in convert_context()
2124 if (!policydb_context_isvalid(args->newp, newc)) { in convert_context()
2125 rc = convert_context_handle_invalid_context(args->state, in convert_context()
2126 args->oldp, in convert_context()
2128 if (rc) in convert_context()
2134 /* Map old representation to string and save it. */ in convert_context()
2135 rc = context_struct_to_string(args->oldp, oldc, &s, &len); in convert_context()
2136 if (rc) in convert_context()
2137 return rc; in convert_context()
2139 newc->str = s; in convert_context()
2140 newc->len = len; in convert_context()
2142 newc->str); in convert_context()
2153 p = &policy->policydb; in security_load_policycaps()
2155 for (i = 0; i < ARRAY_SIZE(state->policycap); i++) in security_load_policycaps()
2156 WRITE_ONCE(state->policycap[i], in security_load_policycaps()
2157 ebitmap_get_bit(&p->policycaps, i)); in security_load_policycaps()
2162 ebitmap_get_bit(&p->policycaps, i)); in security_load_policycaps()
2164 ebitmap_for_each_positive_bit(&p->policycaps, node, i) { in security_load_policycaps()
2179 sidtab_destroy(policy->sidtab); in selinux_policy_free()
2180 kfree(policy->map.mapping); in selinux_policy_free()
2181 policydb_destroy(&policy->policydb); in selinux_policy_free()
2182 kfree(policy->sidtab); in selinux_policy_free()
2188 cond_policydb_destroy_dup(&policy->policydb); in selinux_policy_cond_free()
2197 oldpolicy = rcu_dereference_protected(state->policy, in selinux_policy_cancel()
2198 lockdep_is_held(&state->policy_mutex)); in selinux_policy_cancel()
2200 sidtab_cancel_convert(oldpolicy->sidtab); in selinux_policy_cancel()
2201 selinux_policy_free(load_state->policy); in selinux_policy_cancel()
2202 kfree(load_state->convert_data); in selinux_policy_cancel()
2209 avc_ss_reset(state->avc, seqno); in selinux_notify_policy_change()
2220 struct selinux_policy *oldpolicy, *newpolicy = load_state->policy; in selinux_policy_commit()
2224 oldpolicy = rcu_dereference_protected(state->policy, in selinux_policy_commit()
2225 lockdep_is_held(&state->policy_mutex)); in selinux_policy_commit()
2229 if (oldpolicy->policydb.mls_enabled && !newpolicy->policydb.mls_enabled) in selinux_policy_commit()
2231 else if (!oldpolicy->policydb.mls_enabled && newpolicy->policydb.mls_enabled) in selinux_policy_commit()
2237 newpolicy->latest_granting = oldpolicy->latest_granting + 1; in selinux_policy_commit()
2239 newpolicy->latest_granting = 1; in selinux_policy_commit()
2240 seqno = newpolicy->latest_granting; in selinux_policy_commit()
2244 sidtab_freeze_begin(oldpolicy->sidtab, &flags); in selinux_policy_commit()
2245 rcu_assign_pointer(state->policy, newpolicy); in selinux_policy_commit()
2246 sidtab_freeze_end(oldpolicy->sidtab, &flags); in selinux_policy_commit()
2248 rcu_assign_pointer(state->policy, newpolicy); in selinux_policy_commit()
2267 kfree(load_state->convert_data); in selinux_policy_commit()
2274 * security_load_policy - Load a security policy configuration.
2290 int rc = 0; in security_load_policy() local
2295 return -ENOMEM; in security_load_policy()
2297 newpolicy->sidtab = kzalloc(sizeof(*newpolicy->sidtab), GFP_KERNEL); in security_load_policy()
2298 if (!newpolicy->sidtab) { in security_load_policy()
2299 rc = -ENOMEM; in security_load_policy()
2303 rc = policydb_read(&newpolicy->policydb, fp); in security_load_policy()
2304 if (rc) in security_load_policy()
2307 newpolicy->policydb.len = len; in security_load_policy()
2308 rc = selinux_set_mapping(&newpolicy->policydb, secclass_map, in security_load_policy()
2309 &newpolicy->map); in security_load_policy()
2310 if (rc) in security_load_policy()
2313 rc = policydb_load_isids(&newpolicy->policydb, newpolicy->sidtab); in security_load_policy()
2314 if (rc) { in security_load_policy()
2321 load_state->policy = newpolicy; in security_load_policy()
2322 load_state->convert_data = NULL; in security_load_policy()
2326 oldpolicy = rcu_dereference_protected(state->policy, in security_load_policy()
2327 lockdep_is_held(&state->policy_mutex)); in security_load_policy()
2330 rc = security_preserve_bools(oldpolicy, newpolicy); in security_load_policy()
2331 if (rc) { in security_load_policy()
2338 rc = -ENOMEM; in security_load_policy()
2346 convert_data->args.state = state; in security_load_policy()
2347 convert_data->args.oldp = &oldpolicy->policydb; in security_load_policy()
2348 convert_data->args.newp = &newpolicy->policydb; in security_load_policy()
2350 convert_data->sidtab_params.func = convert_context; in security_load_policy()
2351 convert_data->sidtab_params.args = &convert_data->args; in security_load_policy()
2352 convert_data->sidtab_params.target = newpolicy->sidtab; in security_load_policy()
2354 rc = sidtab_convert(oldpolicy->sidtab, &convert_data->sidtab_params); in security_load_policy()
2355 if (rc) { in security_load_policy()
2362 load_state->policy = newpolicy; in security_load_policy()
2363 load_state->convert_data = convert_data; in security_load_policy()
2369 sidtab_destroy(newpolicy->sidtab); in security_load_policy()
2371 kfree(newpolicy->map.mapping); in security_load_policy()
2373 policydb_destroy(&newpolicy->policydb); in security_load_policy()
2375 kfree(newpolicy->sidtab); in security_load_policy()
2379 return rc; in security_load_policy()
2383 * ocontext_to_sid - Helper to safely get sid for an ocontext
2390 * on-demand when needed. Since updating the SID value is an SMP-sensitive
2393 * WARNING: This function may return -ESTALE, indicating that the caller
2394 * must retry the operation after re-acquiring the policy pointer!
2399 int rc; in ocontext_to_sid() local
2403 sid = smp_load_acquire(&c->sid[index]); in ocontext_to_sid()
2405 rc = sidtab_context_to_sid(sidtab, &c->context[index], &sid); in ocontext_to_sid()
2406 if (rc) in ocontext_to_sid()
2407 return rc; in ocontext_to_sid()
2413 smp_store_release(&c->sid[index], sid); in ocontext_to_sid()
2420 * security_port_sid - Obtain the SID for a port.
2433 int rc; in security_port_sid() local
2441 rc = 0; in security_port_sid()
2443 policy = rcu_dereference(state->policy); in security_port_sid()
2444 policydb = &policy->policydb; in security_port_sid()
2445 sidtab = policy->sidtab; in security_port_sid()
2447 c = policydb->ocontexts[OCON_PORT]; in security_port_sid()
2449 if (c->u.port.protocol == protocol && in security_port_sid()
2450 c->u.port.low_port <= port && in security_port_sid()
2451 c->u.port.high_port >= port) in security_port_sid()
2453 c = c->next; in security_port_sid()
2457 rc = ocontext_to_sid(sidtab, c, 0, out_sid); in security_port_sid()
2458 if (rc == -ESTALE) { in security_port_sid()
2462 if (rc) in security_port_sid()
2470 return rc; in security_port_sid()
2474 * security_ib_pkey_sid - Obtain the SID for a pkey.
2487 int rc; in security_ib_pkey_sid() local
2495 rc = 0; in security_ib_pkey_sid()
2497 policy = rcu_dereference(state->policy); in security_ib_pkey_sid()
2498 policydb = &policy->policydb; in security_ib_pkey_sid()
2499 sidtab = policy->sidtab; in security_ib_pkey_sid()
2501 c = policydb->ocontexts[OCON_IBPKEY]; in security_ib_pkey_sid()
2503 if (c->u.ibpkey.low_pkey <= pkey_num && in security_ib_pkey_sid()
2504 c->u.ibpkey.high_pkey >= pkey_num && in security_ib_pkey_sid()
2505 c->u.ibpkey.subnet_prefix == subnet_prefix) in security_ib_pkey_sid()
2508 c = c->next; in security_ib_pkey_sid()
2512 rc = ocontext_to_sid(sidtab, c, 0, out_sid); in security_ib_pkey_sid()
2513 if (rc == -ESTALE) { in security_ib_pkey_sid()
2517 if (rc) in security_ib_pkey_sid()
2524 return rc; in security_ib_pkey_sid()
2528 * security_ib_endport_sid - Obtain the SID for a subnet management interface.
2530 * @dev_name: device name
2541 int rc; in security_ib_endport_sid() local
2549 rc = 0; in security_ib_endport_sid()
2551 policy = rcu_dereference(state->policy); in security_ib_endport_sid()
2552 policydb = &policy->policydb; in security_ib_endport_sid()
2553 sidtab = policy->sidtab; in security_ib_endport_sid()
2555 c = policydb->ocontexts[OCON_IBENDPORT]; in security_ib_endport_sid()
2557 if (c->u.ibendport.port == port_num && in security_ib_endport_sid()
2558 !strncmp(c->u.ibendport.dev_name, in security_ib_endport_sid()
2563 c = c->next; in security_ib_endport_sid()
2567 rc = ocontext_to_sid(sidtab, c, 0, out_sid); in security_ib_endport_sid()
2568 if (rc == -ESTALE) { in security_ib_endport_sid()
2572 if (rc) in security_ib_endport_sid()
2579 return rc; in security_ib_endport_sid()
2583 * security_netif_sid - Obtain the SID for a network interface.
2585 * @name: interface name
2589 char *name, u32 *if_sid) in security_netif_sid() argument
2594 int rc; in security_netif_sid() local
2603 rc = 0; in security_netif_sid()
2605 policy = rcu_dereference(state->policy); in security_netif_sid()
2606 policydb = &policy->policydb; in security_netif_sid()
2607 sidtab = policy->sidtab; in security_netif_sid()
2609 c = policydb->ocontexts[OCON_NETIF]; in security_netif_sid()
2611 if (strcmp(name, c->u.name) == 0) in security_netif_sid()
2613 c = c->next; in security_netif_sid()
2617 rc = ocontext_to_sid(sidtab, c, 0, if_sid); in security_netif_sid()
2618 if (rc == -ESTALE) { in security_netif_sid()
2622 if (rc) in security_netif_sid()
2629 return rc; in security_netif_sid()
2646 * security_node_sid - Obtain the SID for a node (host).
2662 int rc; in security_node_sid() local
2672 policy = rcu_dereference(state->policy); in security_node_sid()
2673 policydb = &policy->policydb; in security_node_sid()
2674 sidtab = policy->sidtab; in security_node_sid()
2680 rc = -EINVAL; in security_node_sid()
2686 c = policydb->ocontexts[OCON_NODE]; in security_node_sid()
2688 if (c->u.node.addr == (addr & c->u.node.mask)) in security_node_sid()
2690 c = c->next; in security_node_sid()
2696 rc = -EINVAL; in security_node_sid()
2699 c = policydb->ocontexts[OCON_NODE6]; in security_node_sid()
2701 if (match_ipv6_addrmask(addrp, c->u.node6.addr, in security_node_sid()
2702 c->u.node6.mask)) in security_node_sid()
2704 c = c->next; in security_node_sid()
2709 rc = 0; in security_node_sid()
2715 rc = ocontext_to_sid(sidtab, c, 0, out_sid); in security_node_sid()
2716 if (rc == -ESTALE) { in security_node_sid()
2720 if (rc) in security_node_sid()
2726 rc = 0; in security_node_sid()
2729 return rc; in security_node_sid()
2735 * security_get_user_sids - Obtain reachable SIDs for a user.
2764 int rc; in security_get_user_sids() local
2774 return -ENOMEM; in security_get_user_sids()
2779 policy = rcu_dereference(state->policy); in security_get_user_sids()
2780 policydb = &policy->policydb; in security_get_user_sids()
2781 sidtab = policy->sidtab; in security_get_user_sids()
2785 rc = -EINVAL; in security_get_user_sids()
2790 rc = -EINVAL; in security_get_user_sids()
2791 user = symtab_search(&policydb->p_users, username); in security_get_user_sids()
2795 usercon.user = user->value; in security_get_user_sids()
2797 ebitmap_for_each_positive_bit(&user->roles, rnode, i) { in security_get_user_sids()
2798 role = policydb->role_val_to_struct[i]; in security_get_user_sids()
2800 ebitmap_for_each_positive_bit(&role->types, tnode, j) { in security_get_user_sids()
2807 rc = sidtab_context_to_sid(sidtab, &usercon, &sid); in security_get_user_sids()
2808 if (rc == -ESTALE) { in security_get_user_sids()
2812 if (rc) in security_get_user_sids()
2817 rc = -ENOMEM; in security_get_user_sids()
2829 rc = 0; in security_get_user_sids()
2832 if (rc || !mynel) { in security_get_user_sids()
2834 return rc; in security_get_user_sids()
2837 rc = -ENOMEM; in security_get_user_sids()
2841 return rc; in security_get_user_sids()
2845 rc = avc_has_perm_noaudit(state, in security_get_user_sids()
2850 if (!rc) in security_get_user_sids()
2861 * __security_genfs_sid - Helper to obtain a SID for a file in a filesystem
2872 * WARNING: This function may return -ESTALE, indicating that the caller
2873 * must retry the operation after re-acquiring the policy pointer!
2881 struct policydb *policydb = &policy->policydb; in __security_genfs_sid()
2882 struct sidtab *sidtab = policy->sidtab; in __security_genfs_sid()
2892 sclass = unmap_class(&policy->map, orig_sclass); in __security_genfs_sid()
2895 for (genfs = policydb->genfs; genfs; genfs = genfs->next) { in __security_genfs_sid()
2896 cmp = strcmp(fstype, genfs->fstype); in __security_genfs_sid()
2902 return -ENOENT; in __security_genfs_sid()
2904 for (c = genfs->head; c; c = c->next) { in __security_genfs_sid()
2905 len = strlen(c->u.name); in __security_genfs_sid()
2906 if ((!c->v.sclass || sclass == c->v.sclass) && in __security_genfs_sid()
2907 (strncmp(c->u.name, path, len) == 0)) in __security_genfs_sid()
2912 return -ENOENT; in __security_genfs_sid()
2918 * security_genfs_sid - Obtain a SID for a file in a filesystem
2944 policy = rcu_dereference(state->policy); in security_genfs_sid()
2948 } while (retval == -ESTALE); in security_genfs_sid()
2963 * security_fs_use - Determine how to handle labeling for a filesystem.
2972 int rc; in security_fs_use() local
2975 const char *fstype = sb->s_type->name; in security_fs_use()
2978 sbsec->behavior = SECURITY_FS_USE_NONE; in security_fs_use()
2979 sbsec->sid = SECINITSID_UNLABELED; in security_fs_use()
2985 policy = rcu_dereference(state->policy); in security_fs_use()
2986 policydb = &policy->policydb; in security_fs_use()
2987 sidtab = policy->sidtab; in security_fs_use()
2989 c = policydb->ocontexts[OCON_FSUSE]; in security_fs_use()
2991 if (strcmp(fstype, c->u.name) == 0) in security_fs_use()
2993 c = c->next; in security_fs_use()
2997 sbsec->behavior = c->v.behavior; in security_fs_use()
2998 rc = ocontext_to_sid(sidtab, c, 0, &sbsec->sid); in security_fs_use()
2999 if (rc == -ESTALE) { in security_fs_use()
3003 if (rc) in security_fs_use()
3006 rc = __security_genfs_sid(policy, fstype, "/", in security_fs_use()
3007 SECCLASS_DIR, &sbsec->sid); in security_fs_use()
3008 if (rc == -ESTALE) { in security_fs_use()
3012 if (rc) { in security_fs_use()
3013 sbsec->behavior = SECURITY_FS_USE_NONE; in security_fs_use()
3014 rc = 0; in security_fs_use()
3016 sbsec->behavior = SECURITY_FS_USE_GENFS; in security_fs_use()
3022 return rc; in security_fs_use()
3030 int rc; in security_get_bools() local
3032 policydb = &policy->policydb; in security_get_bools()
3037 rc = 0; in security_get_bools()
3038 *len = policydb->p_bools.nprim; in security_get_bools()
3042 rc = -ENOMEM; in security_get_bools()
3047 rc = -ENOMEM; in security_get_bools()
3053 (*values)[i] = policydb->bool_val_to_struct[i]->state; in security_get_bools()
3055 rc = -ENOMEM; in security_get_bools()
3061 rc = 0; in security_get_bools()
3063 return rc; in security_get_bools()
3081 int rc; in security_set_bools() local
3085 return -EINVAL; in security_set_bools()
3087 oldpolicy = rcu_dereference_protected(state->policy, in security_set_bools()
3088 lockdep_is_held(&state->policy_mutex)); in security_set_bools()
3091 if (WARN_ON(len != oldpolicy->policydb.p_bools.nprim)) in security_set_bools()
3092 return -EINVAL; in security_set_bools()
3096 return -ENOMEM; in security_set_bools()
3102 rc = cond_policydb_dup(&newpolicy->policydb, &oldpolicy->policydb); in security_set_bools()
3103 if (rc) { in security_set_bools()
3105 return -ENOMEM; in security_set_bools()
3111 int old_state = newpolicy->policydb.bool_val_to_struct[i]->state; in security_set_bools()
3117 sym_name(&newpolicy->policydb, SYM_BOOLS, i), in security_set_bools()
3122 newpolicy->policydb.bool_val_to_struct[i]->state = new_state; in security_set_bools()
3126 /* Re-evaluate the conditional rules in the copy */ in security_set_bools()
3127 evaluate_cond_nodes(&newpolicy->policydb); in security_set_bools()
3130 newpolicy->latest_granting = oldpolicy->latest_granting + 1; in security_set_bools()
3131 seqno = newpolicy->latest_granting; in security_set_bools()
3134 rcu_assign_pointer(state->policy, newpolicy); in security_set_bools()
3154 int rc; in security_get_bool_value() local
3161 policy = rcu_dereference(state->policy); in security_get_bool_value()
3162 policydb = &policy->policydb; in security_get_bool_value()
3164 rc = -EFAULT; in security_get_bool_value()
3165 len = policydb->p_bools.nprim; in security_get_bool_value()
3169 rc = policydb->bool_val_to_struct[index]->state; in security_get_bool_value()
3172 return rc; in security_get_bool_value()
3178 int rc, *bvalues = NULL; in security_preserve_bools() local
3183 rc = security_get_bools(oldpolicy, &nbools, &bnames, &bvalues); in security_preserve_bools()
3184 if (rc) in security_preserve_bools()
3187 booldatum = symtab_search(&newpolicy->policydb.p_bools, in security_preserve_bools()
3190 booldatum->state = bvalues[i]; in security_preserve_bools()
3192 evaluate_cond_nodes(&newpolicy->policydb); in security_preserve_bools()
3201 return rc; in security_preserve_bools()
3205 * security_sid_mls_copy() - computes a new sid based on the given
3219 int rc; in security_sid_mls_copy() local
3227 rc = 0; in security_sid_mls_copy()
3231 policy = rcu_dereference(state->policy); in security_sid_mls_copy()
3232 policydb = &policy->policydb; in security_sid_mls_copy()
3233 sidtab = policy->sidtab; in security_sid_mls_copy()
3235 if (!policydb->mls_enabled) { in security_sid_mls_copy()
3240 rc = -EINVAL; in security_sid_mls_copy()
3248 rc = -EINVAL; in security_sid_mls_copy()
3256 newcon.user = context1->user; in security_sid_mls_copy()
3257 newcon.role = context1->role; in security_sid_mls_copy()
3258 newcon.type = context1->type; in security_sid_mls_copy()
3259 rc = mls_context_cpy(&newcon, context2); in security_sid_mls_copy()
3260 if (rc) in security_sid_mls_copy()
3265 rc = convert_context_handle_invalid_context(state, policydb, in security_sid_mls_copy()
3267 if (rc) { in security_sid_mls_copy()
3278 audit_log_n_untrustedstring(ab, s, len - 1); in security_sid_mls_copy()
3285 rc = sidtab_context_to_sid(sidtab, &newcon, new_sid); in security_sid_mls_copy()
3286 if (rc == -ESTALE) { in security_sid_mls_copy()
3294 return rc; in security_sid_mls_copy()
3298 * security_net_peersid_resolve - Compare and resolve two network peer SIDs
3312 * ------------------------------+-----------------+-----------------
3316 * multiple, inconsistent labels | -<errno> | SECSID_NULL
3327 int rc; in security_net_peersid_resolve() local
3352 policy = rcu_dereference(state->policy); in security_net_peersid_resolve()
3353 policydb = &policy->policydb; in security_net_peersid_resolve()
3354 sidtab = policy->sidtab; in security_net_peersid_resolve()
3359 * security server was initialized and state->initialized was true. in security_net_peersid_resolve()
3361 if (!policydb->mls_enabled) { in security_net_peersid_resolve()
3362 rc = 0; in security_net_peersid_resolve()
3366 rc = -EINVAL; in security_net_peersid_resolve()
3373 rc = -EINVAL; in security_net_peersid_resolve()
3380 rc = (mls_context_cmp(nlbl_ctx, xfrm_ctx) ? 0 : -EACCES); in security_net_peersid_resolve()
3381 if (rc) in security_net_peersid_resolve()
3392 return rc; in security_net_peersid_resolve()
3398 char *name = k, **classes = args; in get_classes_callback() local
3399 int value = datum->value - 1; in get_classes_callback()
3401 classes[value] = kstrdup(name, GFP_ATOMIC); in get_classes_callback()
3403 return -ENOMEM; in get_classes_callback()
3412 int rc; in security_get_classes() local
3414 policydb = &policy->policydb; in security_get_classes()
3416 rc = -ENOMEM; in security_get_classes()
3417 *nclasses = policydb->p_classes.nprim; in security_get_classes()
3422 rc = hashtab_map(&policydb->p_classes.table, get_classes_callback, in security_get_classes()
3424 if (rc) { in security_get_classes()
3432 return rc; in security_get_classes()
3438 char *name = k, **perms = args; in get_permissions_callback() local
3439 int value = datum->value - 1; in get_permissions_callback()
3441 perms[value] = kstrdup(name, GFP_ATOMIC); in get_permissions_callback()
3443 return -ENOMEM; in get_permissions_callback()
3452 int rc, i; in security_get_permissions() local
3455 policydb = &policy->policydb; in security_get_permissions()
3457 rc = -EINVAL; in security_get_permissions()
3458 match = symtab_search(&policydb->p_classes, class); in security_get_permissions()
3465 rc = -ENOMEM; in security_get_permissions()
3466 *nperms = match->permissions.nprim; in security_get_permissions()
3471 if (match->comdatum) { in security_get_permissions()
3472 rc = hashtab_map(&match->comdatum->permissions.table, in security_get_permissions()
3474 if (rc) in security_get_permissions()
3478 rc = hashtab_map(&match->permissions.table, get_permissions_callback, in security_get_permissions()
3480 if (rc) in security_get_permissions()
3484 return rc; in security_get_permissions()
3490 return rc; in security_get_permissions()
3502 policy = rcu_dereference(state->policy); in security_get_reject_unknown()
3503 value = policy->policydb.reject_unknown; in security_get_reject_unknown()
3517 policy = rcu_dereference(state->policy); in security_get_allow_unknown()
3518 value = policy->policydb.allow_unknown; in security_get_allow_unknown()
3524 * security_policycap_supported - Check for a specific policy capability
3538 int rc; in security_policycap_supported() local
3544 policy = rcu_dereference(state->policy); in security_policycap_supported()
3545 rc = ebitmap_get_bit(&policy->policydb.policycaps, req_cap); in security_policycap_supported()
3548 return rc; in security_policycap_supported()
3561 context_destroy(&rule->au_ctxt); in selinux_audit_rule_free()
3576 int rc = 0; in selinux_audit_rule_init() local
3581 return -EOPNOTSUPP; in selinux_audit_rule_init()
3592 return -EINVAL; in selinux_audit_rule_init()
3598 /* we do not allow a range, indicated by the presence of '-' */ in selinux_audit_rule_init()
3599 if (strchr(rulestr, '-')) in selinux_audit_rule_init()
3600 return -EINVAL; in selinux_audit_rule_init()
3604 return -EINVAL; in selinux_audit_rule_init()
3609 return -ENOMEM; in selinux_audit_rule_init()
3611 context_init(&tmprule->au_ctxt); in selinux_audit_rule_init()
3614 policy = rcu_dereference(state->policy); in selinux_audit_rule_init()
3615 policydb = &policy->policydb; in selinux_audit_rule_init()
3617 tmprule->au_seqno = policy->latest_granting; in selinux_audit_rule_init()
3622 rc = -EINVAL; in selinux_audit_rule_init()
3623 userdatum = symtab_search(&policydb->p_users, rulestr); in selinux_audit_rule_init()
3626 tmprule->au_ctxt.user = userdatum->value; in selinux_audit_rule_init()
3630 rc = -EINVAL; in selinux_audit_rule_init()
3631 roledatum = symtab_search(&policydb->p_roles, rulestr); in selinux_audit_rule_init()
3634 tmprule->au_ctxt.role = roledatum->value; in selinux_audit_rule_init()
3638 rc = -EINVAL; in selinux_audit_rule_init()
3639 typedatum = symtab_search(&policydb->p_types, rulestr); in selinux_audit_rule_init()
3642 tmprule->au_ctxt.type = typedatum->value; in selinux_audit_rule_init()
3648 rc = mls_from_string(policydb, rulestr, &tmprule->au_ctxt, in selinux_audit_rule_init()
3650 if (rc) in selinux_audit_rule_init()
3654 rc = 0; in selinux_audit_rule_init()
3658 if (rc) { in selinux_audit_rule_init()
3665 return rc; in selinux_audit_rule_init()
3673 for (i = 0; i < rule->field_count; i++) { in selinux_audit_rule_known()
3674 struct audit_field *f = &rule->fields[i]; in selinux_audit_rule_known()
3675 switch (f->type) { in selinux_audit_rule_known()
3704 return -ENOENT; in selinux_audit_rule_match()
3712 policy = rcu_dereference(state->policy); in selinux_audit_rule_match()
3714 if (rule->au_seqno < policy->latest_granting) { in selinux_audit_rule_match()
3715 match = -ESTALE; in selinux_audit_rule_match()
3719 ctxt = sidtab_search(policy->sidtab, sid); in selinux_audit_rule_match()
3723 match = -ENOENT; in selinux_audit_rule_match()
3734 match = (ctxt->user == rule->au_ctxt.user); in selinux_audit_rule_match()
3737 match = (ctxt->user != rule->au_ctxt.user); in selinux_audit_rule_match()
3745 match = (ctxt->role == rule->au_ctxt.role); in selinux_audit_rule_match()
3748 match = (ctxt->role != rule->au_ctxt.role); in selinux_audit_rule_match()
3756 match = (ctxt->type == rule->au_ctxt.type); in selinux_audit_rule_match()
3759 match = (ctxt->type != rule->au_ctxt.type); in selinux_audit_rule_match()
3769 &ctxt->range.level[0] : &ctxt->range.level[1]); in selinux_audit_rule_match()
3772 match = mls_level_eq(&rule->au_ctxt.range.level[0], in selinux_audit_rule_match()
3776 match = !mls_level_eq(&rule->au_ctxt.range.level[0], in selinux_audit_rule_match()
3780 match = (mls_level_dom(&rule->au_ctxt.range.level[0], in selinux_audit_rule_match()
3782 !mls_level_eq(&rule->au_ctxt.range.level[0], in selinux_audit_rule_match()
3786 match = mls_level_dom(&rule->au_ctxt.range.level[0], in selinux_audit_rule_match()
3791 &rule->au_ctxt.range.level[0]) && in selinux_audit_rule_match()
3793 &rule->au_ctxt.range.level[0])); in selinux_audit_rule_match()
3797 &rule->au_ctxt.range.level[0]); in selinux_audit_rule_match()
3828 * security_netlbl_cache_add - Add an entry to the NetLabel cache
3846 secattr->cache = netlbl_secattr_cache_alloc(GFP_ATOMIC); in security_netlbl_cache_add()
3847 if (secattr->cache == NULL) { in security_netlbl_cache_add()
3853 secattr->cache->free = kfree; in security_netlbl_cache_add()
3854 secattr->cache->data = sid_cache; in security_netlbl_cache_add()
3855 secattr->flags |= NETLBL_SECATTR_CACHE; in security_netlbl_cache_add()
3859 * security_netlbl_secattr_to_sid - Convert a NetLabel secattr to a SELinux SID
3881 int rc; in security_netlbl_secattr_to_sid() local
3891 rc = 0; in security_netlbl_secattr_to_sid()
3893 policy = rcu_dereference(state->policy); in security_netlbl_secattr_to_sid()
3894 policydb = &policy->policydb; in security_netlbl_secattr_to_sid()
3895 sidtab = policy->sidtab; in security_netlbl_secattr_to_sid()
3897 if (secattr->flags & NETLBL_SECATTR_CACHE) in security_netlbl_secattr_to_sid()
3898 *sid = *(u32 *)secattr->cache->data; in security_netlbl_secattr_to_sid()
3899 else if (secattr->flags & NETLBL_SECATTR_SECID) in security_netlbl_secattr_to_sid()
3900 *sid = secattr->attr.secid; in security_netlbl_secattr_to_sid()
3901 else if (secattr->flags & NETLBL_SECATTR_MLS_LVL) { in security_netlbl_secattr_to_sid()
3902 rc = -EIDRM; in security_netlbl_secattr_to_sid()
3908 ctx_new.user = ctx->user; in security_netlbl_secattr_to_sid()
3909 ctx_new.role = ctx->role; in security_netlbl_secattr_to_sid()
3910 ctx_new.type = ctx->type; in security_netlbl_secattr_to_sid()
3912 if (secattr->flags & NETLBL_SECATTR_MLS_CAT) { in security_netlbl_secattr_to_sid()
3913 rc = mls_import_netlbl_cat(policydb, &ctx_new, secattr); in security_netlbl_secattr_to_sid()
3914 if (rc) in security_netlbl_secattr_to_sid()
3917 rc = -EIDRM; in security_netlbl_secattr_to_sid()
3923 rc = sidtab_context_to_sid(sidtab, &ctx_new, sid); in security_netlbl_secattr_to_sid()
3925 if (rc == -ESTALE) { in security_netlbl_secattr_to_sid()
3929 if (rc) in security_netlbl_secattr_to_sid()
3938 return rc; in security_netlbl_secattr_to_sid()
3942 * security_netlbl_sid_to_secattr - Convert a SELinux SID to a NetLabel secattr
3957 int rc; in security_netlbl_sid_to_secattr() local
3964 policy = rcu_dereference(state->policy); in security_netlbl_sid_to_secattr()
3965 policydb = &policy->policydb; in security_netlbl_sid_to_secattr()
3967 rc = -ENOENT; in security_netlbl_sid_to_secattr()
3968 ctx = sidtab_search(policy->sidtab, sid); in security_netlbl_sid_to_secattr()
3972 rc = -ENOMEM; in security_netlbl_sid_to_secattr()
3973 secattr->domain = kstrdup(sym_name(policydb, SYM_TYPES, ctx->type - 1), in security_netlbl_sid_to_secattr()
3975 if (secattr->domain == NULL) in security_netlbl_sid_to_secattr()
3978 secattr->attr.secid = sid; in security_netlbl_sid_to_secattr()
3979 secattr->flags |= NETLBL_SECATTR_DOMAIN_CPY | NETLBL_SECATTR_SECID; in security_netlbl_sid_to_secattr()
3981 rc = mls_export_netlbl_cat(policydb, ctx, secattr); in security_netlbl_sid_to_secattr()
3984 return rc; in security_netlbl_sid_to_secattr()
3989 * __security_read_policy - read the policy.
3998 int rc; in __security_read_policy() local
4004 rc = policydb_write(&policy->policydb, &fp); in __security_read_policy()
4005 if (rc) in __security_read_policy()
4006 return rc; in __security_read_policy()
4008 *len = (unsigned long)fp.data - (unsigned long)data; in __security_read_policy()
4013 * security_read_policy - read the policy.
4025 state->policy, lockdep_is_held(&state->policy_mutex)); in security_read_policy()
4027 return -EINVAL; in security_read_policy()
4029 *len = policy->policydb.len; in security_read_policy()
4032 return -ENOMEM; in security_read_policy()
4038 * security_read_state_kernel - read the policy.
4056 state->policy, lockdep_is_held(&state->policy_mutex)); in security_read_state_kernel()
4058 return -EINVAL; in security_read_state_kernel()
4060 *len = policy->policydb.len; in security_read_state_kernel()
4063 return -ENOMEM; in security_read_state_kernel()