]>
Commit | Line | Data |
---|---|---|
93c06cbb SH |
1 | /* |
2 | * | |
3 | * mdp - make dummy policy | |
4 | * | |
5 | * When pointed at a kernel tree, builds a dummy policy for that kernel | |
6 | * with exactly one type with full rights to itself. | |
7 | * | |
8 | * This program is free software; you can redistribute it and/or modify | |
9 | * it under the terms of the GNU General Public License as published by | |
10 | * the Free Software Foundation; either version 2 of the License, or | |
11 | * (at your option) any later version. | |
12 | * | |
13 | * This program is distributed in the hope that it will be useful, | |
14 | * but WITHOUT ANY WARRANTY; without even the implied warranty of | |
15 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the | |
16 | * GNU General Public License for more details. | |
17 | * | |
18 | * You should have received a copy of the GNU General Public License | |
19 | * along with this program; if not, write to the Free Software | |
20 | * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. | |
21 | * | |
22 | * Copyright (C) IBM Corporation, 2006 | |
23 | * | |
24 | * Authors: Serge E. Hallyn <serue@us.ibm.com> | |
25 | */ | |
26 | ||
bfc5e3a6 PM |
27 | |
28 | /* NOTE: we really do want to use the kernel headers here */ | |
29 | #define __EXPORTED_HEADERS__ | |
30 | ||
93c06cbb SH |
31 | #include <stdio.h> |
32 | #include <stdlib.h> | |
33 | #include <unistd.h> | |
34 | #include <string.h> | |
35 | ||
5c725138 | 36 | static void usage(char *name) |
93c06cbb SH |
37 | { |
38 | printf("usage: %s [-m] policy_file context_file\n", name); | |
39 | exit(1); | |
40 | } | |
41 | ||
c6d3aaa4 SS |
42 | /* Class/perm mapping support */ |
43 | struct security_class_mapping { | |
44 | const char *name; | |
45 | const char *perms[sizeof(unsigned) * 8 + 1]; | |
93c06cbb | 46 | }; |
93c06cbb | 47 | |
c6d3aaa4 | 48 | #include "classmap.h" |
93c06cbb SH |
49 | #include "initial_sid_to_string.h" |
50 | ||
93c06cbb SH |
51 | int main(int argc, char *argv[]) |
52 | { | |
53 | int i, j, mls = 0; | |
c6d3aaa4 | 54 | int initial_sid_to_string_len; |
93c06cbb | 55 | char **arg, *polout, *ctxout; |
c6d3aaa4 | 56 | |
93c06cbb SH |
57 | FILE *fout; |
58 | ||
59 | if (argc < 3) | |
60 | usage(argv[0]); | |
61 | arg = argv+1; | |
62 | if (argc==4 && strcmp(argv[1], "-m") == 0) { | |
63 | mls = 1; | |
64 | arg++; | |
65 | } | |
66 | polout = *arg++; | |
67 | ctxout = *arg; | |
68 | ||
69 | fout = fopen(polout, "w"); | |
70 | if (!fout) { | |
71 | printf("Could not open %s for writing\n", polout); | |
72 | usage(argv[0]); | |
73 | } | |
74 | ||
93c06cbb | 75 | /* print out the classes */ |
c6d3aaa4 SS |
76 | for (i = 0; secclass_map[i].name; i++) |
77 | fprintf(fout, "class %s\n", secclass_map[i].name); | |
93c06cbb SH |
78 | fprintf(fout, "\n"); |
79 | ||
80 | initial_sid_to_string_len = sizeof(initial_sid_to_string) / sizeof (char *); | |
81 | /* print out the sids */ | |
c6d3aaa4 | 82 | for (i = 1; i < initial_sid_to_string_len; i++) |
93c06cbb SH |
83 | fprintf(fout, "sid %s\n", initial_sid_to_string[i]); |
84 | fprintf(fout, "\n"); | |
85 | ||
93c06cbb | 86 | /* print out the class permissions */ |
c6d3aaa4 SS |
87 | for (i = 0; secclass_map[i].name; i++) { |
88 | struct security_class_mapping *map = &secclass_map[i]; | |
89 | fprintf(fout, "class %s\n", map->name); | |
90 | fprintf(fout, "{\n"); | |
91 | for (j = 0; map->perms[j]; j++) | |
92 | fprintf(fout, "\t%s\n", map->perms[j]); | |
93 | fprintf(fout, "}\n\n"); | |
93c06cbb SH |
94 | } |
95 | fprintf(fout, "\n"); | |
96 | ||
97 | /* NOW PRINT OUT MLS STUFF */ | |
98 | if (mls) { | |
99 | printf("MLS not yet implemented\n"); | |
100 | exit(1); | |
101 | } | |
102 | ||
103 | /* types, roles, and allows */ | |
104 | fprintf(fout, "type base_t;\n"); | |
fda4d578 | 105 | fprintf(fout, "role base_r;\n"); |
93c06cbb | 106 | fprintf(fout, "role base_r types { base_t };\n"); |
c6d3aaa4 SS |
107 | for (i = 0; secclass_map[i].name; i++) |
108 | fprintf(fout, "allow base_t base_t:%s *;\n", | |
109 | secclass_map[i].name); | |
93c06cbb SH |
110 | fprintf(fout, "user user_u roles { base_r };\n"); |
111 | fprintf(fout, "\n"); | |
112 | ||
113 | /* default sids */ | |
c6d3aaa4 | 114 | for (i = 1; i < initial_sid_to_string_len; i++) |
93c06cbb SH |
115 | fprintf(fout, "sid %s user_u:base_r:base_t\n", initial_sid_to_string[i]); |
116 | fprintf(fout, "\n"); | |
117 | ||
93c06cbb SH |
118 | fprintf(fout, "fs_use_xattr ext2 user_u:base_r:base_t;\n"); |
119 | fprintf(fout, "fs_use_xattr ext3 user_u:base_r:base_t;\n"); | |
c6d3aaa4 | 120 | fprintf(fout, "fs_use_xattr ext4 user_u:base_r:base_t;\n"); |
93c06cbb SH |
121 | fprintf(fout, "fs_use_xattr jfs user_u:base_r:base_t;\n"); |
122 | fprintf(fout, "fs_use_xattr xfs user_u:base_r:base_t;\n"); | |
123 | fprintf(fout, "fs_use_xattr reiserfs user_u:base_r:base_t;\n"); | |
c6d3aaa4 SS |
124 | fprintf(fout, "fs_use_xattr jffs2 user_u:base_r:base_t;\n"); |
125 | fprintf(fout, "fs_use_xattr gfs2 user_u:base_r:base_t;\n"); | |
126 | fprintf(fout, "fs_use_xattr lustre user_u:base_r:base_t;\n"); | |
93c06cbb | 127 | |
c6d3aaa4 | 128 | fprintf(fout, "fs_use_task eventpollfs user_u:base_r:base_t;\n"); |
93c06cbb SH |
129 | fprintf(fout, "fs_use_task pipefs user_u:base_r:base_t;\n"); |
130 | fprintf(fout, "fs_use_task sockfs user_u:base_r:base_t;\n"); | |
131 | ||
c6d3aaa4 | 132 | fprintf(fout, "fs_use_trans mqueue user_u:base_r:base_t;\n"); |
93c06cbb | 133 | fprintf(fout, "fs_use_trans devpts user_u:base_r:base_t;\n"); |
c6d3aaa4 | 134 | fprintf(fout, "fs_use_trans hugetlbfs user_u:base_r:base_t;\n"); |
93c06cbb SH |
135 | fprintf(fout, "fs_use_trans tmpfs user_u:base_r:base_t;\n"); |
136 | fprintf(fout, "fs_use_trans shm user_u:base_r:base_t;\n"); | |
137 | ||
138 | fprintf(fout, "genfscon proc / user_u:base_r:base_t\n"); | |
139 | ||
140 | fclose(fout); | |
141 | ||
142 | fout = fopen(ctxout, "w"); | |
143 | if (!fout) { | |
144 | printf("Wrote policy, but cannot open %s for writing\n", ctxout); | |
145 | usage(argv[0]); | |
146 | } | |
147 | fprintf(fout, "/ user_u:base_r:base_t\n"); | |
148 | fprintf(fout, "/.* user_u:base_r:base_t\n"); | |
149 | fclose(fout); | |
150 | ||
151 | return 0; | |
152 | } |