Lines Matching +full:space +full:- +full:constraint
1 // SPDX-License-Identifier: GPL-2.0-only
17 * Updated: Hewlett-Packard <paul@paul-moore.com>
35 * Copyright (C) 2006, 2007 Hewlett-Packard Development Company, L.P.
36 * Copyright (C) 2004-2006 Trusted Computer Solutions, Inc.
37 * Copyright (C) 2003 - 2004, 2006 Tresys Technology, LLC
104 return -EINVAL; in selinux_set_mapping()
109 /* Allocate space for the class records, plus one for class zero */ in selinux_set_mapping()
110 out_map->mapping = kcalloc(++i, sizeof(*out_map->mapping), GFP_ATOMIC); in selinux_set_mapping()
111 if (!out_map->mapping) in selinux_set_mapping()
112 return -ENOMEM; in selinux_set_mapping()
118 struct selinux_mapping *p_out = out_map->mapping + j; in selinux_set_mapping()
122 if (!strcmp(p_in->name, "")) { in selinux_set_mapping()
123 p_out->num_perms = 0; in selinux_set_mapping()
127 p_out->value = string_to_security_class(pol, p_in->name); in selinux_set_mapping()
128 if (!p_out->value) { in selinux_set_mapping()
130 p_in->name); in selinux_set_mapping()
131 if (pol->reject_unknown) in selinux_set_mapping()
133 p_out->num_perms = 0; in selinux_set_mapping()
139 while (p_in->perms[k]) { in selinux_set_mapping()
141 if (!*p_in->perms[k]) { in selinux_set_mapping()
145 p_out->perms[k] = string_to_av_perm(pol, p_out->value, in selinux_set_mapping()
146 p_in->perms[k]); in selinux_set_mapping()
147 if (!p_out->perms[k]) { in selinux_set_mapping()
149 p_in->perms[k], p_in->name); in selinux_set_mapping()
150 if (pol->reject_unknown) in selinux_set_mapping()
157 p_out->num_perms = k; in selinux_set_mapping()
162 pol->allow_unknown ? "allowed" : "denied"); in selinux_set_mapping()
164 out_map->size = i; in selinux_set_mapping()
167 kfree(out_map->mapping); in selinux_set_mapping()
168 out_map->mapping = NULL; in selinux_set_mapping()
169 return -EINVAL; in selinux_set_mapping()
178 if (tclass < map->size) in unmap_class()
179 return map->mapping[tclass].value; in unmap_class()
191 for (i = 1; i < map->size; i++) { in map_class()
192 if (map->mapping[i].value == pol_value) in map_class()
203 if (tclass < map->size) { in map_decision()
204 struct selinux_mapping *mapping = &map->mapping[tclass]; in map_decision()
205 unsigned int i, n = mapping->num_perms; in map_decision()
209 if (avd->allowed & mapping->perms[i]) in map_decision()
211 if (allow_unknown && !mapping->perms[i]) in map_decision()
214 avd->allowed = result; in map_decision()
217 if (avd->auditallow & mapping->perms[i]) in map_decision()
219 avd->auditallow = result; in map_decision()
222 if (avd->auditdeny & mapping->perms[i]) in map_decision()
224 if (!allow_unknown && !mapping->perms[i]) in map_decision()
234 avd->auditdeny = result; in map_decision()
248 mls_enabled = policy->policydb.mls_enabled; in security_mls_enabled()
254 * Return the boolean value of a constraint expression
276 int sp = -1; in constraint_expr_eval()
278 for (e = cexpr; e; e = e->next) { in constraint_expr_eval()
279 switch (e->expr_type) { in constraint_expr_eval()
286 sp--; in constraint_expr_eval()
291 sp--; in constraint_expr_eval()
295 if (sp == (CEXPR_MAXDEPTH - 1)) in constraint_expr_eval()
297 switch (e->attr) { in constraint_expr_eval()
299 val1 = scontext->user; in constraint_expr_eval()
300 val2 = tcontext->user; in constraint_expr_eval()
303 val1 = scontext->type; in constraint_expr_eval()
304 val2 = tcontext->type; in constraint_expr_eval()
307 val1 = scontext->role; in constraint_expr_eval()
308 val2 = tcontext->role; in constraint_expr_eval()
309 r1 = policydb->role_val_to_struct[val1 - 1]; in constraint_expr_eval()
310 r2 = policydb->role_val_to_struct[val2 - 1]; in constraint_expr_eval()
311 switch (e->op) { in constraint_expr_eval()
313 s[++sp] = ebitmap_get_bit(&r1->dominates, in constraint_expr_eval()
314 val2 - 1); in constraint_expr_eval()
317 s[++sp] = ebitmap_get_bit(&r2->dominates, in constraint_expr_eval()
318 val1 - 1); in constraint_expr_eval()
321 s[++sp] = (!ebitmap_get_bit(&r1->dominates, in constraint_expr_eval()
322 val2 - 1) && in constraint_expr_eval()
323 !ebitmap_get_bit(&r2->dominates, in constraint_expr_eval()
324 val1 - 1)); in constraint_expr_eval()
331 l1 = &(scontext->range.level[0]); in constraint_expr_eval()
332 l2 = &(tcontext->range.level[0]); in constraint_expr_eval()
335 l1 = &(scontext->range.level[0]); in constraint_expr_eval()
336 l2 = &(tcontext->range.level[1]); in constraint_expr_eval()
339 l1 = &(scontext->range.level[1]); in constraint_expr_eval()
340 l2 = &(tcontext->range.level[0]); in constraint_expr_eval()
343 l1 = &(scontext->range.level[1]); in constraint_expr_eval()
344 l2 = &(tcontext->range.level[1]); in constraint_expr_eval()
347 l1 = &(scontext->range.level[0]); in constraint_expr_eval()
348 l2 = &(scontext->range.level[1]); in constraint_expr_eval()
351 l1 = &(tcontext->range.level[0]); in constraint_expr_eval()
352 l2 = &(tcontext->range.level[1]); in constraint_expr_eval()
355 switch (e->op) { in constraint_expr_eval()
381 switch (e->op) { in constraint_expr_eval()
394 if (sp == (CEXPR_MAXDEPTH-1)) in constraint_expr_eval()
397 if (e->attr & CEXPR_TARGET) in constraint_expr_eval()
399 else if (e->attr & CEXPR_XTARGET) { in constraint_expr_eval()
406 if (e->attr & CEXPR_USER) in constraint_expr_eval()
407 val1 = c->user; in constraint_expr_eval()
408 else if (e->attr & CEXPR_ROLE) in constraint_expr_eval()
409 val1 = c->role; in constraint_expr_eval()
410 else if (e->attr & CEXPR_TYPE) in constraint_expr_eval()
411 val1 = c->type; in constraint_expr_eval()
417 switch (e->op) { in constraint_expr_eval()
419 s[++sp] = ebitmap_get_bit(&e->names, val1 - 1); in constraint_expr_eval()
422 s[++sp] = !ebitmap_get_bit(&e->names, val1 - 1); in constraint_expr_eval()
440 * security_dump_masked_av - dumps masked permissions during
441 * security_compute_av due to RBAC, MLS/Constraint and Type bounds.
448 BUG_ON(pdatum->value < 1 || pdatum->value > 32); in dump_masked_av_helper()
450 permission_names[pdatum->value - 1] = (char *)k; in dump_masked_av_helper()
476 tclass_name = sym_name(policydb, SYM_CLASSES, tclass - 1); in security_dump_masked_av()
477 tclass_dat = policydb->class_val_to_struct[tclass - 1]; in security_dump_masked_av()
478 common_dat = tclass_dat->comdatum; in security_dump_masked_av()
482 hashtab_map(&common_dat->permissions.table, in security_dump_masked_av()
486 if (hashtab_map(&tclass_dat->permissions.table, in security_dump_masked_av()
529 * security_boundary_permission - drops violated permissions
530 * on boundary constraint.
545 source = policydb->type_val_to_struct[scontext->type - 1]; in type_attribute_bounds_av()
548 if (!source->bounds) in type_attribute_bounds_av()
551 target = policydb->type_val_to_struct[tcontext->type - 1]; in type_attribute_bounds_av()
557 lo_scontext.type = source->bounds; in type_attribute_bounds_av()
559 if (target->bounds) { in type_attribute_bounds_av()
561 lo_tcontext.type = target->bounds; in type_attribute_bounds_av()
571 masked = ~lo_avd.allowed & avd->allowed; in type_attribute_bounds_av()
577 avd->allowed &= ~masked; in type_attribute_bounds_av()
594 if (node->datum.u.xperms->specified == AVTAB_XPERMS_IOCTLDRIVER) { in services_compute_xperms_drivers()
596 for (i = 0; i < ARRAY_SIZE(xperms->drivers.p); i++) in services_compute_xperms_drivers()
597 xperms->drivers.p[i] |= node->datum.u.xperms->perms.p[i]; in services_compute_xperms_drivers()
598 } else if (node->datum.u.xperms->specified == AVTAB_XPERMS_IOCTLFUNCTION) { in services_compute_xperms_drivers()
600 security_xperm_set(xperms->drivers.p, in services_compute_xperms_drivers()
601 node->datum.u.xperms->driver); in services_compute_xperms_drivers()
604 xperms->len = 1; in services_compute_xperms_drivers()
618 struct constraint_node *constraint; in context_struct_compute_av() local
627 avd->allowed = 0; in context_struct_compute_av()
628 avd->auditallow = 0; in context_struct_compute_av()
629 avd->auditdeny = 0xffffffff; in context_struct_compute_av()
631 memset(&xperms->drivers, 0, sizeof(xperms->drivers)); in context_struct_compute_av()
632 xperms->len = 0; in context_struct_compute_av()
635 if (unlikely(!tclass || tclass > policydb->p_classes.nprim)) { in context_struct_compute_av()
641 tclass_datum = policydb->class_val_to_struct[tclass - 1]; in context_struct_compute_av()
649 sattr = &policydb->type_attr_map_array[scontext->type - 1]; in context_struct_compute_av()
650 tattr = &policydb->type_attr_map_array[tcontext->type - 1]; in context_struct_compute_av()
655 for (node = avtab_search_node(&policydb->te_avtab, in context_struct_compute_av()
659 if (node->key.specified == AVTAB_ALLOWED) in context_struct_compute_av()
660 avd->allowed |= node->datum.u.data; in context_struct_compute_av()
661 else if (node->key.specified == AVTAB_AUDITALLOW) in context_struct_compute_av()
662 avd->auditallow |= node->datum.u.data; in context_struct_compute_av()
663 else if (node->key.specified == AVTAB_AUDITDENY) in context_struct_compute_av()
664 avd->auditdeny &= node->datum.u.data; in context_struct_compute_av()
665 else if (xperms && (node->key.specified & AVTAB_XPERMS)) in context_struct_compute_av()
670 cond_compute_av(&policydb->te_cond_avtab, &avkey, in context_struct_compute_av()
677 * Remove any permissions prohibited by a constraint (this includes in context_struct_compute_av()
680 constraint = tclass_datum->constraints; in context_struct_compute_av()
681 while (constraint) { in context_struct_compute_av()
682 if ((constraint->permissions & (avd->allowed)) && in context_struct_compute_av()
684 constraint->expr)) { in context_struct_compute_av()
685 avd->allowed &= ~(constraint->permissions); in context_struct_compute_av()
687 constraint = constraint->next; in context_struct_compute_av()
695 if (tclass == policydb->process_class && in context_struct_compute_av()
696 (avd->allowed & policydb->process_trans_perms) && in context_struct_compute_av()
697 scontext->role != tcontext->role) { in context_struct_compute_av()
698 for (ra = policydb->role_allow; ra; ra = ra->next) { in context_struct_compute_av()
699 if (scontext->role == ra->role && in context_struct_compute_av()
700 tcontext->role == ra->new_role) in context_struct_compute_av()
704 avd->allowed &= ~policydb->process_trans_perms; in context_struct_compute_av()
709 * constraint, lazy checks have to mask any violated in context_struct_compute_av()
722 struct policydb *p = &policy->policydb; in security_validtrans_handle_fail()
723 struct sidtab *sidtab = policy->sidtab; in security_validtrans_handle_fail()
736 o, n, t, sym_name(p, SYM_CLASSES, tclass-1)); in security_validtrans_handle_fail()
744 return -EPERM; in security_validtrans_handle_fail()
757 struct constraint_node *constraint; in security_compute_validatetrans() local
768 policydb = &policy->policydb; in security_compute_validatetrans()
769 sidtab = policy->sidtab; in security_compute_validatetrans()
772 tclass = unmap_class(&policy->map, orig_tclass); in security_compute_validatetrans()
776 if (!tclass || tclass > policydb->p_classes.nprim) { in security_compute_validatetrans()
777 rc = -EINVAL; in security_compute_validatetrans()
780 tclass_datum = policydb->class_val_to_struct[tclass - 1]; in security_compute_validatetrans()
786 rc = -EINVAL; in security_compute_validatetrans()
794 rc = -EINVAL; in security_compute_validatetrans()
802 rc = -EINVAL; in security_compute_validatetrans()
806 constraint = tclass_datum->validatetrans; in security_compute_validatetrans()
807 while (constraint) { in security_compute_validatetrans()
808 if (!constraint_expr_eval(policydb, &oentry->context, in security_compute_validatetrans()
809 &nentry->context, &tentry->context, in security_compute_validatetrans()
810 constraint->expr)) { in security_compute_validatetrans()
812 rc = -EPERM; in security_compute_validatetrans()
821 constraint = constraint->next; in security_compute_validatetrans()
844 * security_bounded_transition - check whether the given
867 policydb = &policy->policydb; in security_bounded_transition()
868 sidtab = policy->sidtab; in security_bounded_transition()
870 rc = -EINVAL; in security_bounded_transition()
878 rc = -EINVAL; in security_bounded_transition()
888 if (old_entry->context.type == new_entry->context.type) in security_bounded_transition()
891 index = new_entry->context.type; in security_bounded_transition()
893 type = policydb->type_val_to_struct[index - 1]; in security_bounded_transition()
897 rc = -EPERM; in security_bounded_transition()
898 if (!type->bounds) in security_bounded_transition()
903 if (type->bounds == old_entry->context.type) in security_bounded_transition()
906 index = type->bounds; in security_bounded_transition()
936 avd->allowed = 0; in avd_init()
937 avd->auditallow = 0; in avd_init()
938 avd->auditdeny = 0xffffffff; in avd_init()
940 avd->seqno = policy->latest_granting; in avd_init()
942 avd->seqno = 0; in avd_init()
943 avd->flags = 0; in avd_init()
951 if (node->datum.u.xperms->specified == AVTAB_XPERMS_IOCTLFUNCTION) { in services_compute_xperms_decision()
952 if (xpermd->driver != node->datum.u.xperms->driver) in services_compute_xperms_decision()
954 } else if (node->datum.u.xperms->specified == AVTAB_XPERMS_IOCTLDRIVER) { in services_compute_xperms_decision()
955 if (!security_xperm_test(node->datum.u.xperms->perms.p, in services_compute_xperms_decision()
956 xpermd->driver)) in services_compute_xperms_decision()
962 if (node->key.specified == AVTAB_XPERMS_ALLOWED) { in services_compute_xperms_decision()
963 xpermd->used |= XPERMS_ALLOWED; in services_compute_xperms_decision()
964 if (node->datum.u.xperms->specified == AVTAB_XPERMS_IOCTLDRIVER) { in services_compute_xperms_decision()
965 memset(xpermd->allowed->p, 0xff, in services_compute_xperms_decision()
966 sizeof(xpermd->allowed->p)); in services_compute_xperms_decision()
968 if (node->datum.u.xperms->specified == AVTAB_XPERMS_IOCTLFUNCTION) { in services_compute_xperms_decision()
969 for (i = 0; i < ARRAY_SIZE(xpermd->allowed->p); i++) in services_compute_xperms_decision()
970 xpermd->allowed->p[i] |= in services_compute_xperms_decision()
971 node->datum.u.xperms->perms.p[i]; in services_compute_xperms_decision()
973 } else if (node->key.specified == AVTAB_XPERMS_AUDITALLOW) { in services_compute_xperms_decision()
974 xpermd->used |= XPERMS_AUDITALLOW; in services_compute_xperms_decision()
975 if (node->datum.u.xperms->specified == AVTAB_XPERMS_IOCTLDRIVER) { in services_compute_xperms_decision()
976 memset(xpermd->auditallow->p, 0xff, in services_compute_xperms_decision()
977 sizeof(xpermd->auditallow->p)); in services_compute_xperms_decision()
979 if (node->datum.u.xperms->specified == AVTAB_XPERMS_IOCTLFUNCTION) { in services_compute_xperms_decision()
980 for (i = 0; i < ARRAY_SIZE(xpermd->auditallow->p); i++) in services_compute_xperms_decision()
981 xpermd->auditallow->p[i] |= in services_compute_xperms_decision()
982 node->datum.u.xperms->perms.p[i]; in services_compute_xperms_decision()
984 } else if (node->key.specified == AVTAB_XPERMS_DONTAUDIT) { in services_compute_xperms_decision()
985 xpermd->used |= XPERMS_DONTAUDIT; in services_compute_xperms_decision()
986 if (node->datum.u.xperms->specified == AVTAB_XPERMS_IOCTLDRIVER) { in services_compute_xperms_decision()
987 memset(xpermd->dontaudit->p, 0xff, in services_compute_xperms_decision()
988 sizeof(xpermd->dontaudit->p)); in services_compute_xperms_decision()
990 if (node->datum.u.xperms->specified == AVTAB_XPERMS_IOCTLFUNCTION) { in services_compute_xperms_decision()
991 for (i = 0; i < ARRAY_SIZE(xpermd->dontaudit->p); i++) in services_compute_xperms_decision()
992 xpermd->dontaudit->p[i] |= in services_compute_xperms_decision()
993 node->datum.u.xperms->perms.p[i]; in services_compute_xperms_decision()
1017 xpermd->driver = driver; in security_compute_xperms_decision()
1018 xpermd->used = 0; in security_compute_xperms_decision()
1019 memset(xpermd->allowed->p, 0, sizeof(xpermd->allowed->p)); in security_compute_xperms_decision()
1020 memset(xpermd->auditallow->p, 0, sizeof(xpermd->auditallow->p)); in security_compute_xperms_decision()
1021 memset(xpermd->dontaudit->p, 0, sizeof(xpermd->dontaudit->p)); in security_compute_xperms_decision()
1028 policydb = &policy->policydb; in security_compute_xperms_decision()
1029 sidtab = policy->sidtab; in security_compute_xperms_decision()
1045 tclass = unmap_class(&policy->map, orig_tclass); in security_compute_xperms_decision()
1047 if (policydb->allow_unknown) in security_compute_xperms_decision()
1053 if (unlikely(!tclass || tclass > policydb->p_classes.nprim)) { in security_compute_xperms_decision()
1060 sattr = &policydb->type_attr_map_array[scontext->type - 1]; in security_compute_xperms_decision()
1061 tattr = &policydb->type_attr_map_array[tcontext->type - 1]; in security_compute_xperms_decision()
1066 for (node = avtab_search_node(&policydb->te_avtab, in security_compute_xperms_decision()
1072 cond_compute_xperms(&policydb->te_cond_avtab, in security_compute_xperms_decision()
1080 memset(xpermd->allowed->p, 0xff, sizeof(xpermd->allowed->p)); in security_compute_xperms_decision()
1085 * security_compute_av - Compute access vector decisions.
1110 xperms->len = 0; in security_compute_av()
1114 policydb = &policy->policydb; in security_compute_av()
1115 sidtab = policy->sidtab; in security_compute_av()
1125 if (ebitmap_get_bit(&policydb->permissive_map, scontext->type)) in security_compute_av()
1126 avd->flags |= AVD_FLAGS_PERMISSIVE; in security_compute_av()
1135 tclass = unmap_class(&policy->map, orig_tclass); in security_compute_av()
1137 if (policydb->allow_unknown) in security_compute_av()
1143 map_decision(&policy->map, orig_tclass, avd, in security_compute_av()
1144 policydb->allow_unknown); in security_compute_av()
1149 avd->allowed = 0xffffffff; in security_compute_av()
1169 policydb = &policy->policydb; in security_compute_av_user()
1170 sidtab = policy->sidtab; in security_compute_av_user()
1180 if (ebitmap_get_bit(&policydb->permissive_map, scontext->type)) in security_compute_av_user()
1181 avd->flags |= AVD_FLAGS_PERMISSIVE; in security_compute_av_user()
1191 if (policydb->allow_unknown) in security_compute_av_user()
1202 avd->allowed = 0xffffffff; in security_compute_av_user()
1223 if (context->len) { in context_struct_to_string()
1224 *scontext_len = context->len; in context_struct_to_string()
1226 *scontext = kstrdup(context->str, GFP_ATOMIC); in context_struct_to_string()
1228 return -ENOMEM; in context_struct_to_string()
1234 *scontext_len += strlen(sym_name(p, SYM_USERS, context->user - 1)) + 1; in context_struct_to_string()
1235 *scontext_len += strlen(sym_name(p, SYM_ROLES, context->role - 1)) + 1; in context_struct_to_string()
1236 *scontext_len += strlen(sym_name(p, SYM_TYPES, context->type - 1)) + 1; in context_struct_to_string()
1242 /* Allocate space for the context; caller must free this space. */ in context_struct_to_string()
1245 return -ENOMEM; in context_struct_to_string()
1252 sym_name(p, SYM_USERS, context->user - 1), in context_struct_to_string()
1253 sym_name(p, SYM_ROLES, context->role - 1), in context_struct_to_string()
1254 sym_name(p, SYM_TYPES, context->type - 1)); in context_struct_to_string()
1270 if (rc != -ENOENT) in sidtab_entry_to_string()
1273 rc = context_struct_to_string(p, &entry->context, scontext, in sidtab_entry_to_string()
1290 return -EINVAL; in security_sidtab_hash_stats()
1295 rc = sidtab_hash_stats(policy->sidtab, page); in security_sidtab_hash_stats()
1328 return -EINVAL; in security_sid_to_context_core()
1334 return -ENOMEM; in security_sid_to_context_core()
1340 return -EINVAL; in security_sid_to_context_core()
1344 policydb = &policy->policydb; in security_sid_to_context_core()
1345 sidtab = policy->sidtab; in security_sid_to_context_core()
1354 rc = -EINVAL; in security_sid_to_context_core()
1357 if (only_invalid && !entry->context.len) in security_sid_to_context_core()
1370 * security_sid_to_context - Obtain a context for a given SID.
1393 * security_sid_to_context_inval - Obtain a context for a given SID if it
1431 rc = -EINVAL; in string_to_context_struct()
1444 usrdatum = symtab_search(&pol->p_users, scontextp); in string_to_context_struct()
1448 ctx->user = usrdatum->value; in string_to_context_struct()
1460 role = symtab_search(&pol->p_roles, scontextp); in string_to_context_struct()
1463 ctx->role = role->value; in string_to_context_struct()
1472 typdatum = symtab_search(&pol->p_types, scontextp); in string_to_context_struct()
1473 if (!typdatum || typdatum->attribute) in string_to_context_struct()
1476 ctx->type = typdatum->value; in string_to_context_struct()
1483 rc = -EINVAL; in string_to_context_struct()
1506 return -EINVAL; in security_context_to_sid_core()
1511 return -ENOMEM; in security_context_to_sid_core()
1531 rc = -ENOMEM; in security_context_to_sid_core()
1539 policydb = &policy->policydb; in security_context_to_sid_core()
1540 sidtab = policy->sidtab; in security_context_to_sid_core()
1543 if (rc == -EINVAL && force) { in security_context_to_sid_core()
1550 if (rc == -ESTALE) { in security_context_to_sid_core()
1569 * security_context_to_sid - Obtain a SID for a given security context.
1577 * Returns -%EINVAL if the context is invalid, -%ENOMEM if insufficient
1594 * security_context_to_sid_default - Obtain a SID for a given security context,
1601 * @gfp_flags: the allocator get-free-page (GFP) flags
1609 * Returns -%EINVAL if the context is invalid, -%ENOMEM if insufficient
1633 struct policydb *policydb = &policy->policydb; in compute_sid_handle_invalid_context()
1634 struct sidtab *sidtab = policy->sidtab; in compute_sid_handle_invalid_context()
1651 audit_log_n_untrustedstring(ab, n, nlen - 1); in compute_sid_handle_invalid_context()
1653 s, t, sym_name(policydb, SYM_CLASSES, tclass-1)); in compute_sid_handle_invalid_context()
1661 return -EACCES; in compute_sid_handle_invalid_context()
1677 if (!ebitmap_get_bit(&policydb->filename_trans_ttypes, ttype)) in filename_compute_type()
1686 if (ebitmap_get_bit(&datum->stypes, stype - 1)) { in filename_compute_type()
1687 newcontext->type = datum->otype; in filename_compute_type()
1690 datum = datum->next; in filename_compute_type()
1735 tclass = unmap_class(&policy->map, orig_tclass); in security_compute_sid()
1739 sock = security_is_socket_class(map_class(&policy->map, in security_compute_sid()
1743 policydb = &policy->policydb; in security_compute_sid()
1744 sidtab = policy->sidtab; in security_compute_sid()
1750 rc = -EINVAL; in security_compute_sid()
1757 rc = -EINVAL; in security_compute_sid()
1761 scontext = &sentry->context; in security_compute_sid()
1762 tcontext = &tentry->context; in security_compute_sid()
1764 if (tclass && tclass <= policydb->p_classes.nprim) in security_compute_sid()
1765 cladatum = policydb->class_val_to_struct[tclass - 1]; in security_compute_sid()
1771 if (cladatum && cladatum->default_user == DEFAULT_TARGET) { in security_compute_sid()
1772 newcontext.user = tcontext->user; in security_compute_sid()
1776 newcontext.user = scontext->user; in security_compute_sid()
1781 newcontext.user = tcontext->user; in security_compute_sid()
1786 if (cladatum && cladatum->default_role == DEFAULT_SOURCE) { in security_compute_sid()
1787 newcontext.role = scontext->role; in security_compute_sid()
1788 } else if (cladatum && cladatum->default_role == DEFAULT_TARGET) { in security_compute_sid()
1789 newcontext.role = tcontext->role; in security_compute_sid()
1791 if ((tclass == policydb->process_class) || sock) in security_compute_sid()
1792 newcontext.role = scontext->role; in security_compute_sid()
1798 if (cladatum && cladatum->default_type == DEFAULT_SOURCE) { in security_compute_sid()
1799 newcontext.type = scontext->type; in security_compute_sid()
1800 } else if (cladatum && cladatum->default_type == DEFAULT_TARGET) { in security_compute_sid()
1801 newcontext.type = tcontext->type; in security_compute_sid()
1803 if ((tclass == policydb->process_class) || sock) { in security_compute_sid()
1805 newcontext.type = scontext->type; in security_compute_sid()
1808 newcontext.type = tcontext->type; in security_compute_sid()
1813 avkey.source_type = scontext->type; in security_compute_sid()
1814 avkey.target_type = tcontext->type; in security_compute_sid()
1817 avnode = avtab_search_node(&policydb->te_avtab, &avkey); in security_compute_sid()
1821 node = avtab_search_node(&policydb->te_cond_avtab, &avkey); in security_compute_sid()
1823 if (node->key.specified & AVTAB_ENABLED) { in security_compute_sid()
1832 newcontext.type = avnode->datum.u.data; in security_compute_sid()
1837 filename_compute_type(policydb, &newcontext, scontext->type, in security_compute_sid()
1838 tcontext->type, tclass, objname); in security_compute_sid()
1840 /* Check for class-specific changes. */ in security_compute_sid()
1845 .role = scontext->role, in security_compute_sid()
1846 .type = tcontext->type, in security_compute_sid()
1852 newcontext.role = rtd->new_role; in security_compute_sid()
1872 if (rc == -ESTALE) { in security_compute_sid()
1885 * security_transition_sid - Compute the SID for a new subject/object.
1894 * Return -%EINVAL if any of the parameters are invalid, -%ENOMEM
1903 qstr ? qstr->name : NULL, out_sid, true); in security_transition_sid()
1915 * security_member_sid - Compute the SID for member selection.
1923 * Return -%EINVAL if any of the parameters are invalid, -%ENOMEM
1938 * security_change_sid - Compute the SID for object relabeling.
1946 * Return -%EINVAL if any of the parameters are invalid, -%ENOMEM
1967 return -EINVAL; in convert_context_handle_invalid_context()
1978 * services_convert_context - Convert a security context across policies.
1985 * specified in the policy @args->oldp to the values specified in the policy
1986 * @args->newp, storing the new context in @newc, and verifying that the
2001 if (oldc->str) { in services_convert_context()
2002 s = kstrdup(oldc->str, gfp_flags); in services_convert_context()
2004 return -ENOMEM; in services_convert_context()
2006 rc = string_to_context_struct(args->newp, NULL, s, newc, SECSID_NULL); in services_convert_context()
2007 if (rc == -EINVAL) { in services_convert_context()
2011 * IMPORTANT: We need to copy the contents of oldc->str in services_convert_context()
2015 memcpy(s, oldc->str, oldc->len); in services_convert_context()
2017 newc->str = s; in services_convert_context()
2018 newc->len = oldc->len; in services_convert_context()
2025 oldc->str, -rc); in services_convert_context()
2029 oldc->str); in services_convert_context()
2036 usrdatum = symtab_search(&args->newp->p_users, in services_convert_context()
2037 sym_name(args->oldp, SYM_USERS, oldc->user - 1)); in services_convert_context()
2040 newc->user = usrdatum->value; in services_convert_context()
2043 role = symtab_search(&args->newp->p_roles, in services_convert_context()
2044 sym_name(args->oldp, SYM_ROLES, oldc->role - 1)); in services_convert_context()
2047 newc->role = role->value; in services_convert_context()
2050 typdatum = symtab_search(&args->newp->p_types, in services_convert_context()
2051 sym_name(args->oldp, SYM_TYPES, oldc->type - 1)); in services_convert_context()
2054 newc->type = typdatum->value; in services_convert_context()
2057 if (args->oldp->mls_enabled && args->newp->mls_enabled) { in services_convert_context()
2058 rc = mls_convert_context(args->oldp, args->newp, oldc, newc); in services_convert_context()
2061 } else if (!args->oldp->mls_enabled && args->newp->mls_enabled) { in services_convert_context()
2063 * Switching between non-MLS and MLS policy: in services_convert_context()
2069 oc = args->newp->ocontexts[OCON_ISID]; in services_convert_context()
2070 while (oc && oc->sid[0] != SECINITSID_UNLABELED) in services_convert_context()
2071 oc = oc->next; in services_convert_context()
2077 rc = mls_range_set(newc, &oc->context[0].range); in services_convert_context()
2083 if (!policydb_context_isvalid(args->newp, newc)) { in services_convert_context()
2084 rc = convert_context_handle_invalid_context(args->oldp, oldc); in services_convert_context()
2092 rc = context_struct_to_string(args->oldp, oldc, &s, &len); in services_convert_context()
2096 newc->str = s; in services_convert_context()
2097 newc->len = len; in services_convert_context()
2099 newc->str); in services_convert_context()
2109 p = &policy->policydb; in security_load_policycaps()
2113 ebitmap_get_bit(&p->policycaps, i)); in security_load_policycaps()
2118 ebitmap_get_bit(&p->policycaps, i)); in security_load_policycaps()
2120 ebitmap_for_each_positive_bit(&p->policycaps, node, i) { in security_load_policycaps()
2135 sidtab_destroy(policy->sidtab); in selinux_policy_free()
2136 kfree(policy->map.mapping); in selinux_policy_free()
2137 policydb_destroy(&policy->policydb); in selinux_policy_free()
2138 kfree(policy->sidtab); in selinux_policy_free()
2144 cond_policydb_destroy_dup(&policy->policydb); in selinux_policy_cond_free()
2153 oldpolicy = rcu_dereference_protected(state->policy, in selinux_policy_cancel()
2154 lockdep_is_held(&state->policy_mutex)); in selinux_policy_cancel()
2156 sidtab_cancel_convert(oldpolicy->sidtab); in selinux_policy_cancel()
2157 selinux_policy_free(load_state->policy); in selinux_policy_cancel()
2158 kfree(load_state->convert_data); in selinux_policy_cancel()
2175 struct selinux_policy *oldpolicy, *newpolicy = load_state->policy; in selinux_policy_commit()
2179 oldpolicy = rcu_dereference_protected(state->policy, in selinux_policy_commit()
2180 lockdep_is_held(&state->policy_mutex)); in selinux_policy_commit()
2184 if (oldpolicy->policydb.mls_enabled && !newpolicy->policydb.mls_enabled) in selinux_policy_commit()
2186 else if (!oldpolicy->policydb.mls_enabled && newpolicy->policydb.mls_enabled) in selinux_policy_commit()
2192 newpolicy->latest_granting = oldpolicy->latest_granting + 1; in selinux_policy_commit()
2194 newpolicy->latest_granting = 1; in selinux_policy_commit()
2195 seqno = newpolicy->latest_granting; in selinux_policy_commit()
2199 sidtab_freeze_begin(oldpolicy->sidtab, &flags); in selinux_policy_commit()
2200 rcu_assign_pointer(state->policy, newpolicy); in selinux_policy_commit()
2201 sidtab_freeze_end(oldpolicy->sidtab, &flags); in selinux_policy_commit()
2203 rcu_assign_pointer(state->policy, newpolicy); in selinux_policy_commit()
2222 kfree(load_state->convert_data); in selinux_policy_commit()
2229 * security_load_policy - Load a security policy configuration.
2250 return -ENOMEM; in security_load_policy()
2252 newpolicy->sidtab = kzalloc(sizeof(*newpolicy->sidtab), GFP_KERNEL); in security_load_policy()
2253 if (!newpolicy->sidtab) { in security_load_policy()
2254 rc = -ENOMEM; in security_load_policy()
2258 rc = policydb_read(&newpolicy->policydb, fp); in security_load_policy()
2262 newpolicy->policydb.len = len; in security_load_policy()
2263 rc = selinux_set_mapping(&newpolicy->policydb, secclass_map, in security_load_policy()
2264 &newpolicy->map); in security_load_policy()
2268 rc = policydb_load_isids(&newpolicy->policydb, newpolicy->sidtab); in security_load_policy()
2276 load_state->policy = newpolicy; in security_load_policy()
2277 load_state->convert_data = NULL; in security_load_policy()
2281 oldpolicy = rcu_dereference_protected(state->policy, in security_load_policy()
2282 lockdep_is_held(&state->policy_mutex)); in security_load_policy()
2298 rc = -ENOMEM; in security_load_policy()
2302 convert_data->args.oldp = &oldpolicy->policydb; in security_load_policy()
2303 convert_data->args.newp = &newpolicy->policydb; in security_load_policy()
2305 convert_data->sidtab_params.args = &convert_data->args; in security_load_policy()
2306 convert_data->sidtab_params.target = newpolicy->sidtab; in security_load_policy()
2308 rc = sidtab_convert(oldpolicy->sidtab, &convert_data->sidtab_params); in security_load_policy()
2316 load_state->policy = newpolicy; in security_load_policy()
2317 load_state->convert_data = convert_data; in security_load_policy()
2323 sidtab_destroy(newpolicy->sidtab); in security_load_policy()
2325 kfree(newpolicy->map.mapping); in security_load_policy()
2327 policydb_destroy(&newpolicy->policydb); in security_load_policy()
2329 kfree(newpolicy->sidtab); in security_load_policy()
2337 * ocontext_to_sid - Helper to safely get sid for an ocontext
2344 * on-demand when needed. Since updating the SID value is an SMP-sensitive
2347 * WARNING: This function may return -ESTALE, indicating that the caller
2348 * must retry the operation after re-acquiring the policy pointer!
2357 sid = smp_load_acquire(&c->sid[index]); in ocontext_to_sid()
2359 rc = sidtab_context_to_sid(sidtab, &c->context[index], &sid); in ocontext_to_sid()
2367 smp_store_release(&c->sid[index], sid); in ocontext_to_sid()
2374 * security_port_sid - Obtain the SID for a port.
2396 policydb = &policy->policydb; in security_port_sid()
2397 sidtab = policy->sidtab; in security_port_sid()
2399 c = policydb->ocontexts[OCON_PORT]; in security_port_sid()
2401 if (c->u.port.protocol == protocol && in security_port_sid()
2402 c->u.port.low_port <= port && in security_port_sid()
2403 c->u.port.high_port >= port) in security_port_sid()
2405 c = c->next; in security_port_sid()
2410 if (rc == -ESTALE) { in security_port_sid()
2426 * security_ib_pkey_sid - Obtain the SID for a pkey.
2448 policydb = &policy->policydb; in security_ib_pkey_sid()
2449 sidtab = policy->sidtab; in security_ib_pkey_sid()
2451 c = policydb->ocontexts[OCON_IBPKEY]; in security_ib_pkey_sid()
2453 if (c->u.ibpkey.low_pkey <= pkey_num && in security_ib_pkey_sid()
2454 c->u.ibpkey.high_pkey >= pkey_num && in security_ib_pkey_sid()
2455 c->u.ibpkey.subnet_prefix == subnet_prefix) in security_ib_pkey_sid()
2458 c = c->next; in security_ib_pkey_sid()
2463 if (rc == -ESTALE) { in security_ib_pkey_sid()
2478 * security_ib_endport_sid - Obtain the SID for a subnet management interface.
2500 policydb = &policy->policydb; in security_ib_endport_sid()
2501 sidtab = policy->sidtab; in security_ib_endport_sid()
2503 c = policydb->ocontexts[OCON_IBENDPORT]; in security_ib_endport_sid()
2505 if (c->u.ibendport.port == port_num && in security_ib_endport_sid()
2506 !strncmp(c->u.ibendport.dev_name, in security_ib_endport_sid()
2511 c = c->next; in security_ib_endport_sid()
2516 if (rc == -ESTALE) { in security_ib_endport_sid()
2531 * security_netif_sid - Obtain the SID for a network interface.
2552 policydb = &policy->policydb; in security_netif_sid()
2553 sidtab = policy->sidtab; in security_netif_sid()
2555 c = policydb->ocontexts[OCON_NETIF]; in security_netif_sid()
2557 if (strcmp(name, c->u.name) == 0) in security_netif_sid()
2559 c = c->next; in security_netif_sid()
2564 if (rc == -ESTALE) { in security_netif_sid()
2592 * security_node_sid - Obtain the SID for a node (host).
2617 policydb = &policy->policydb; in security_node_sid()
2618 sidtab = policy->sidtab; in security_node_sid()
2624 rc = -EINVAL; in security_node_sid()
2630 c = policydb->ocontexts[OCON_NODE]; in security_node_sid()
2632 if (c->u.node.addr == (addr & c->u.node.mask)) in security_node_sid()
2634 c = c->next; in security_node_sid()
2640 rc = -EINVAL; in security_node_sid()
2643 c = policydb->ocontexts[OCON_NODE6]; in security_node_sid()
2645 if (match_ipv6_addrmask(addrp, c->u.node6.addr, in security_node_sid()
2646 c->u.node6.mask)) in security_node_sid()
2648 c = c->next; in security_node_sid()
2660 if (rc == -ESTALE) { in security_node_sid()
2679 * security_get_user_sids - Obtain reachable SIDs for a user.
2716 return -ENOMEM; in security_get_user_sids()
2722 policydb = &policy->policydb; in security_get_user_sids()
2723 sidtab = policy->sidtab; in security_get_user_sids()
2727 rc = -EINVAL; in security_get_user_sids()
2732 rc = -EINVAL; in security_get_user_sids()
2733 user = symtab_search(&policydb->p_users, username); in security_get_user_sids()
2737 usercon.user = user->value; in security_get_user_sids()
2739 ebitmap_for_each_positive_bit(&user->roles, rnode, i) { in security_get_user_sids()
2740 role = policydb->role_val_to_struct[i]; in security_get_user_sids()
2742 ebitmap_for_each_positive_bit(&role->types, tnode, j) { in security_get_user_sids()
2750 if (rc == -ESTALE) { in security_get_user_sids()
2759 rc = -ENOMEM; in security_get_user_sids()
2779 rc = -ENOMEM; in security_get_user_sids()
2802 * __security_genfs_sid - Helper to obtain a SID for a file in a filesystem
2813 * WARNING: This function may return -ESTALE, indicating that the caller
2814 * must retry the operation after re-acquiring the policy pointer!
2822 struct policydb *policydb = &policy->policydb; in __security_genfs_sid()
2823 struct sidtab *sidtab = policy->sidtab; in __security_genfs_sid()
2832 sclass = unmap_class(&policy->map, orig_sclass); in __security_genfs_sid()
2835 for (genfs = policydb->genfs; genfs; genfs = genfs->next) { in __security_genfs_sid()
2836 cmp = strcmp(fstype, genfs->fstype); in __security_genfs_sid()
2842 return -ENOENT; in __security_genfs_sid()
2844 for (c = genfs->head; c; c = c->next) { in __security_genfs_sid()
2845 size_t len = strlen(c->u.name); in __security_genfs_sid()
2846 if ((!c->v.sclass || sclass == c->v.sclass) && in __security_genfs_sid()
2847 (strncmp(c->u.name, path, len) == 0)) in __security_genfs_sid()
2852 return -ENOENT; in __security_genfs_sid()
2858 * security_genfs_sid - Obtain a SID for a file in a filesystem
2886 } while (retval == -ESTALE); in security_genfs_sid()
2901 * security_fs_use - Determine how to handle labeling for a filesystem.
2912 const char *fstype = sb->s_type->name; in security_fs_use()
2915 sbsec->behavior = SECURITY_FS_USE_NONE; in security_fs_use()
2916 sbsec->sid = SECINITSID_UNLABELED; in security_fs_use()
2923 policydb = &policy->policydb; in security_fs_use()
2924 sidtab = policy->sidtab; in security_fs_use()
2926 c = policydb->ocontexts[OCON_FSUSE]; in security_fs_use()
2928 if (strcmp(fstype, c->u.name) == 0) in security_fs_use()
2930 c = c->next; in security_fs_use()
2934 sbsec->behavior = c->v.behavior; in security_fs_use()
2935 rc = ocontext_to_sid(sidtab, c, 0, &sbsec->sid); in security_fs_use()
2936 if (rc == -ESTALE) { in security_fs_use()
2944 SECCLASS_DIR, &sbsec->sid); in security_fs_use()
2945 if (rc == -ESTALE) { in security_fs_use()
2950 sbsec->behavior = SECURITY_FS_USE_NONE; in security_fs_use()
2953 sbsec->behavior = SECURITY_FS_USE_GENFS; in security_fs_use()
2969 policydb = &policy->policydb; in security_get_bools()
2975 *len = policydb->p_bools.nprim; in security_get_bools()
2979 rc = -ENOMEM; in security_get_bools()
2984 rc = -ENOMEM; in security_get_bools()
2990 (*values)[i] = policydb->bool_val_to_struct[i]->state; in security_get_bools()
2992 rc = -ENOMEM; in security_get_bools()
3023 return -EINVAL; in security_set_bools()
3025 oldpolicy = rcu_dereference_protected(state->policy, in security_set_bools()
3026 lockdep_is_held(&state->policy_mutex)); in security_set_bools()
3029 if (WARN_ON(len != oldpolicy->policydb.p_bools.nprim)) in security_set_bools()
3030 return -EINVAL; in security_set_bools()
3034 return -ENOMEM; in security_set_bools()
3040 rc = cond_policydb_dup(&newpolicy->policydb, &oldpolicy->policydb); in security_set_bools()
3043 return -ENOMEM; in security_set_bools()
3049 int old_state = newpolicy->policydb.bool_val_to_struct[i]->state; in security_set_bools()
3055 sym_name(&newpolicy->policydb, SYM_BOOLS, i), in security_set_bools()
3060 newpolicy->policydb.bool_val_to_struct[i]->state = new_state; in security_set_bools()
3064 /* Re-evaluate the conditional rules in the copy */ in security_set_bools()
3065 evaluate_cond_nodes(&newpolicy->policydb); in security_set_bools()
3068 newpolicy->latest_granting = oldpolicy->latest_granting + 1; in security_set_bools()
3069 seqno = newpolicy->latest_granting; in security_set_bools()
3072 rcu_assign_pointer(state->policy, newpolicy); in security_set_bools()
3099 policydb = &policy->policydb; in security_get_bool_value()
3101 rc = -EFAULT; in security_get_bool_value()
3102 len = policydb->p_bools.nprim; in security_get_bool_value()
3106 rc = policydb->bool_val_to_struct[index]->state; in security_get_bool_value()
3124 booldatum = symtab_search(&newpolicy->policydb.p_bools, in security_preserve_bools()
3127 booldatum->state = bvalues[i]; in security_preserve_bools()
3129 evaluate_cond_nodes(&newpolicy->policydb); in security_preserve_bools()
3142 * security_sid_mls_copy() - computes a new sid based on the given
3168 policydb = &policy->policydb; in security_sid_mls_copy()
3169 sidtab = policy->sidtab; in security_sid_mls_copy()
3171 if (!policydb->mls_enabled) { in security_sid_mls_copy()
3176 rc = -EINVAL; in security_sid_mls_copy()
3184 rc = -EINVAL; in security_sid_mls_copy()
3192 newcon.user = context1->user; in security_sid_mls_copy()
3193 newcon.role = context1->role; in security_sid_mls_copy()
3194 newcon.type = context1->type; in security_sid_mls_copy()
3214 audit_log_n_untrustedstring(ab, s, len - 1); in security_sid_mls_copy()
3222 if (rc == -ESTALE) { in security_sid_mls_copy()
3234 * security_net_peersid_resolve - Compare and resolve two network peer SIDs
3247 * ------------------------------+-----------------+-----------------
3251 * multiple, inconsistent labels | -<errno> | SECSID_NULL
3287 policydb = &policy->policydb; in security_net_peersid_resolve()
3288 sidtab = policy->sidtab; in security_net_peersid_resolve()
3293 * security server was initialized and state->initialized was true. in security_net_peersid_resolve()
3295 if (!policydb->mls_enabled) { in security_net_peersid_resolve()
3300 rc = -EINVAL; in security_net_peersid_resolve()
3307 rc = -EINVAL; in security_net_peersid_resolve()
3314 rc = (mls_context_cmp(nlbl_ctx, xfrm_ctx) ? 0 : -EACCES); in security_net_peersid_resolve()
3333 u32 value = datum->value - 1; in get_classes_callback()
3337 return -ENOMEM; in get_classes_callback()
3348 policydb = &policy->policydb; in security_get_classes()
3350 rc = -ENOMEM; in security_get_classes()
3351 *nclasses = policydb->p_classes.nprim; in security_get_classes()
3356 rc = hashtab_map(&policydb->p_classes.table, get_classes_callback, in security_get_classes()
3374 u32 value = datum->value - 1; in get_permissions_callback()
3378 return -ENOMEM; in get_permissions_callback()
3391 policydb = &policy->policydb; in security_get_permissions()
3393 rc = -EINVAL; in security_get_permissions()
3394 match = symtab_search(&policydb->p_classes, class); in security_get_permissions()
3401 rc = -ENOMEM; in security_get_permissions()
3402 *nperms = match->permissions.nprim; in security_get_permissions()
3407 if (match->comdatum) { in security_get_permissions()
3408 rc = hashtab_map(&match->comdatum->permissions.table, in security_get_permissions()
3414 rc = hashtab_map(&match->permissions.table, get_permissions_callback, in security_get_permissions()
3439 value = policy->policydb.reject_unknown; in security_get_reject_unknown()
3454 value = policy->policydb.allow_unknown; in security_get_allow_unknown()
3460 * security_policycap_supported - Check for a specific policy capability
3479 rc = ebitmap_get_bit(&policy->policydb.policycaps, req_cap); in security_policycap_supported()
3495 context_destroy(&rule->au_ctxt); in selinux_audit_rule_free()
3515 return -EOPNOTSUPP; in selinux_audit_rule_init()
3526 return -EINVAL; in selinux_audit_rule_init()
3532 /* we do not allow a range, indicated by the presence of '-' */ in selinux_audit_rule_init()
3533 if (strchr(rulestr, '-')) in selinux_audit_rule_init()
3534 return -EINVAL; in selinux_audit_rule_init()
3538 return -EINVAL; in selinux_audit_rule_init()
3543 return -ENOMEM; in selinux_audit_rule_init()
3544 context_init(&tmprule->au_ctxt); in selinux_audit_rule_init()
3547 policy = rcu_dereference(state->policy); in selinux_audit_rule_init()
3548 policydb = &policy->policydb; in selinux_audit_rule_init()
3549 tmprule->au_seqno = policy->latest_granting; in selinux_audit_rule_init()
3553 userdatum = symtab_search(&policydb->p_users, rulestr); in selinux_audit_rule_init()
3555 rc = -EINVAL; in selinux_audit_rule_init()
3558 tmprule->au_ctxt.user = userdatum->value; in selinux_audit_rule_init()
3562 roledatum = symtab_search(&policydb->p_roles, rulestr); in selinux_audit_rule_init()
3564 rc = -EINVAL; in selinux_audit_rule_init()
3567 tmprule->au_ctxt.role = roledatum->value; in selinux_audit_rule_init()
3571 typedatum = symtab_search(&policydb->p_types, rulestr); in selinux_audit_rule_init()
3573 rc = -EINVAL; in selinux_audit_rule_init()
3576 tmprule->au_ctxt.type = typedatum->value; in selinux_audit_rule_init()
3582 rc = mls_from_string(policydb, rulestr, &tmprule->au_ctxt, in selinux_audit_rule_init()
3605 for (i = 0; i < rule->field_count; i++) { in selinux_audit_rule_known()
3606 struct audit_field *f = &rule->fields[i]; in selinux_audit_rule_known()
3607 switch (f->type) { in selinux_audit_rule_known()
3636 return -ENOENT; in selinux_audit_rule_match()
3644 policy = rcu_dereference(state->policy); in selinux_audit_rule_match()
3646 if (rule->au_seqno < policy->latest_granting) { in selinux_audit_rule_match()
3647 match = -ESTALE; in selinux_audit_rule_match()
3651 ctxt = sidtab_search(policy->sidtab, sid); in selinux_audit_rule_match()
3655 match = -ENOENT; in selinux_audit_rule_match()
3666 match = (ctxt->user == rule->au_ctxt.user); in selinux_audit_rule_match()
3669 match = (ctxt->user != rule->au_ctxt.user); in selinux_audit_rule_match()
3677 match = (ctxt->role == rule->au_ctxt.role); in selinux_audit_rule_match()
3680 match = (ctxt->role != rule->au_ctxt.role); in selinux_audit_rule_match()
3688 match = (ctxt->type == rule->au_ctxt.type); in selinux_audit_rule_match()
3691 match = (ctxt->type != rule->au_ctxt.type); in selinux_audit_rule_match()
3701 &ctxt->range.level[0] : &ctxt->range.level[1]); in selinux_audit_rule_match()
3704 match = mls_level_eq(&rule->au_ctxt.range.level[0], in selinux_audit_rule_match()
3708 match = !mls_level_eq(&rule->au_ctxt.range.level[0], in selinux_audit_rule_match()
3712 match = (mls_level_dom(&rule->au_ctxt.range.level[0], in selinux_audit_rule_match()
3714 !mls_level_eq(&rule->au_ctxt.range.level[0], in selinux_audit_rule_match()
3718 match = mls_level_dom(&rule->au_ctxt.range.level[0], in selinux_audit_rule_match()
3723 &rule->au_ctxt.range.level[0]) && in selinux_audit_rule_match()
3725 &rule->au_ctxt.range.level[0])); in selinux_audit_rule_match()
3729 &rule->au_ctxt.range.level[0]); in selinux_audit_rule_match()
3760 * security_netlbl_cache_add - Add an entry to the NetLabel cache
3778 secattr->cache = netlbl_secattr_cache_alloc(GFP_ATOMIC); in security_netlbl_cache_add()
3779 if (secattr->cache == NULL) { in security_netlbl_cache_add()
3785 secattr->cache->free = kfree; in security_netlbl_cache_add()
3786 secattr->cache->data = sid_cache; in security_netlbl_cache_add()
3787 secattr->flags |= NETLBL_SECATTR_CACHE; in security_netlbl_cache_add()
3791 * security_netlbl_secattr_to_sid - Convert a NetLabel secattr to a SELinux SID
3824 policydb = &policy->policydb; in security_netlbl_secattr_to_sid()
3825 sidtab = policy->sidtab; in security_netlbl_secattr_to_sid()
3827 if (secattr->flags & NETLBL_SECATTR_CACHE) in security_netlbl_secattr_to_sid()
3828 *sid = *(u32 *)secattr->cache->data; in security_netlbl_secattr_to_sid()
3829 else if (secattr->flags & NETLBL_SECATTR_SECID) in security_netlbl_secattr_to_sid()
3830 *sid = secattr->attr.secid; in security_netlbl_secattr_to_sid()
3831 else if (secattr->flags & NETLBL_SECATTR_MLS_LVL) { in security_netlbl_secattr_to_sid()
3832 rc = -EIDRM; in security_netlbl_secattr_to_sid()
3838 ctx_new.user = ctx->user; in security_netlbl_secattr_to_sid()
3839 ctx_new.role = ctx->role; in security_netlbl_secattr_to_sid()
3840 ctx_new.type = ctx->type; in security_netlbl_secattr_to_sid()
3842 if (secattr->flags & NETLBL_SECATTR_MLS_CAT) { in security_netlbl_secattr_to_sid()
3847 rc = -EIDRM; in security_netlbl_secattr_to_sid()
3855 if (rc == -ESTALE) { in security_netlbl_secattr_to_sid()
3872 * security_netlbl_sid_to_secattr - Convert a SELinux SID to a NetLabel secattr
3893 policydb = &policy->policydb; in security_netlbl_sid_to_secattr()
3895 rc = -ENOENT; in security_netlbl_sid_to_secattr()
3896 ctx = sidtab_search(policy->sidtab, sid); in security_netlbl_sid_to_secattr()
3900 rc = -ENOMEM; in security_netlbl_sid_to_secattr()
3901 secattr->domain = kstrdup(sym_name(policydb, SYM_TYPES, ctx->type - 1), in security_netlbl_sid_to_secattr()
3903 if (secattr->domain == NULL) in security_netlbl_sid_to_secattr()
3906 secattr->attr.secid = sid; in security_netlbl_sid_to_secattr()
3907 secattr->flags |= NETLBL_SECATTR_DOMAIN_CPY | NETLBL_SECATTR_SECID; in security_netlbl_sid_to_secattr()
3917 * __security_read_policy - read the policy.
3932 rc = policydb_write(&policy->policydb, &fp); in __security_read_policy()
3936 *len = (unsigned long)fp.data - (unsigned long)data; in __security_read_policy()
3941 * security_read_policy - read the policy.
3952 state->policy, lockdep_is_held(&state->policy_mutex)); in security_read_policy()
3954 return -EINVAL; in security_read_policy()
3956 *len = policy->policydb.len; in security_read_policy()
3959 return -ENOMEM; in security_read_policy()
3965 * security_read_state_kernel - read the policy.
3971 * be used for returning data to user space.
3982 state->policy, lockdep_is_held(&state->policy_mutex)); in security_read_state_kernel()
3984 return -EINVAL; in security_read_state_kernel()
3986 *len = policy->policydb.len; in security_read_state_kernel()
3989 return -ENOMEM; in security_read_state_kernel()