]>
Commit | Line | Data |
---|---|---|
93c06cbb SH |
1 | /* |
2 | * | |
3 | * mdp - make dummy policy | |
4 | * | |
5 | * When pointed at a kernel tree, builds a dummy policy for that kernel | |
6 | * with exactly one type with full rights to itself. | |
7 | * | |
8 | * This program is free software; you can redistribute it and/or modify | |
9 | * it under the terms of the GNU General Public License as published by | |
10 | * the Free Software Foundation; either version 2 of the License, or | |
11 | * (at your option) any later version. | |
12 | * | |
13 | * This program is distributed in the hope that it will be useful, | |
14 | * but WITHOUT ANY WARRANTY; without even the implied warranty of | |
15 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the | |
16 | * GNU General Public License for more details. | |
17 | * | |
18 | * You should have received a copy of the GNU General Public License | |
19 | * along with this program; if not, write to the Free Software | |
20 | * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. | |
21 | * | |
22 | * Copyright (C) IBM Corporation, 2006 | |
23 | * | |
24 | * Authors: Serge E. Hallyn <serue@us.ibm.com> | |
25 | */ | |
26 | ||
27 | #include <stdio.h> | |
28 | #include <stdlib.h> | |
29 | #include <unistd.h> | |
30 | #include <string.h> | |
31 | ||
32 | #include "flask.h" | |
33 | ||
34 | void usage(char *name) | |
35 | { | |
36 | printf("usage: %s [-m] policy_file context_file\n", name); | |
37 | exit(1); | |
38 | } | |
39 | ||
40 | void find_common_name(char *cname, char *dest, int len) | |
41 | { | |
42 | char *start, *end; | |
43 | ||
44 | start = strchr(cname, '_')+1; | |
45 | end = strchr(start, '_'); | |
46 | if (!start || !end || start-cname > len || end-start > len) { | |
47 | printf("Error with commons defines\n"); | |
48 | exit(1); | |
49 | } | |
50 | strncpy(dest, start, end-start); | |
51 | dest[end-start] = '\0'; | |
52 | } | |
53 | ||
54 | #define S_(x) x, | |
55 | static char *classlist[] = { | |
56 | #include "class_to_string.h" | |
57 | NULL | |
58 | }; | |
59 | #undef S_ | |
60 | ||
61 | #include "initial_sid_to_string.h" | |
62 | ||
63 | #define TB_(x) char *x[] = { | |
64 | #define TE_(x) NULL }; | |
65 | #define S_(x) x, | |
66 | #include "common_perm_to_string.h" | |
67 | #undef TB_ | |
68 | #undef TE_ | |
69 | #undef S_ | |
70 | ||
71 | struct common { | |
72 | char *cname; | |
73 | char **perms; | |
74 | }; | |
75 | struct common common[] = { | |
76 | #define TB_(x) { #x, x }, | |
77 | #define S_(x) | |
78 | #define TE_(x) | |
79 | #include "common_perm_to_string.h" | |
80 | #undef TB_ | |
81 | #undef TE_ | |
82 | #undef S_ | |
83 | }; | |
84 | ||
85 | #define S_(x, y, z) {x, #y}, | |
86 | struct av_inherit { | |
87 | int class; | |
88 | char *common; | |
89 | }; | |
90 | struct av_inherit av_inherit[] = { | |
91 | #include "av_inherit.h" | |
92 | }; | |
93 | #undef S_ | |
94 | ||
95 | #include "av_permissions.h" | |
96 | #define S_(x, y, z) {x, y, z}, | |
97 | struct av_perms { | |
98 | int class; | |
99 | int perm_i; | |
100 | char *perm_s; | |
101 | }; | |
102 | struct av_perms av_perms[] = { | |
103 | #include "av_perm_to_string.h" | |
104 | }; | |
105 | #undef S_ | |
106 | ||
107 | int main(int argc, char *argv[]) | |
108 | { | |
109 | int i, j, mls = 0; | |
110 | char **arg, *polout, *ctxout; | |
111 | int classlist_len, initial_sid_to_string_len; | |
112 | FILE *fout; | |
113 | ||
114 | if (argc < 3) | |
115 | usage(argv[0]); | |
116 | arg = argv+1; | |
117 | if (argc==4 && strcmp(argv[1], "-m") == 0) { | |
118 | mls = 1; | |
119 | arg++; | |
120 | } | |
121 | polout = *arg++; | |
122 | ctxout = *arg; | |
123 | ||
124 | fout = fopen(polout, "w"); | |
125 | if (!fout) { | |
126 | printf("Could not open %s for writing\n", polout); | |
127 | usage(argv[0]); | |
128 | } | |
129 | ||
130 | classlist_len = sizeof(classlist) / sizeof(char *); | |
131 | /* print out the classes */ | |
132 | for (i=1; i < classlist_len; i++) { | |
133 | if(classlist[i]) | |
134 | fprintf(fout, "class %s\n", classlist[i]); | |
135 | else | |
136 | fprintf(fout, "class user%d\n", i); | |
137 | } | |
138 | fprintf(fout, "\n"); | |
139 | ||
140 | initial_sid_to_string_len = sizeof(initial_sid_to_string) / sizeof (char *); | |
141 | /* print out the sids */ | |
142 | for (i=1; i < initial_sid_to_string_len; i++) | |
143 | fprintf(fout, "sid %s\n", initial_sid_to_string[i]); | |
144 | fprintf(fout, "\n"); | |
145 | ||
146 | /* print out the commons */ | |
147 | for (i=0; i< sizeof(common)/sizeof(struct common); i++) { | |
148 | char cname[101]; | |
149 | find_common_name(common[i].cname, cname, 100); | |
150 | cname[100] = '\0'; | |
151 | fprintf(fout, "common %s\n{\n", cname); | |
152 | for (j=0; common[i].perms[j]; j++) | |
153 | fprintf(fout, "\t%s\n", common[i].perms[j]); | |
154 | fprintf(fout, "}\n\n"); | |
155 | } | |
156 | fprintf(fout, "\n"); | |
157 | ||
158 | /* print out the class permissions */ | |
159 | for (i=1; i < classlist_len; i++) { | |
160 | if (classlist[i]) { | |
161 | int firstperm = -1, numperms = 0; | |
162 | ||
163 | fprintf(fout, "class %s\n", classlist[i]); | |
164 | /* does it inherit from a common? */ | |
165 | for (j=0; j < sizeof(av_inherit)/sizeof(struct av_inherit); j++) | |
166 | if (av_inherit[j].class == i) | |
167 | fprintf(fout, "inherits %s\n", av_inherit[j].common); | |
168 | ||
169 | for (j=0; j < sizeof(av_perms)/sizeof(struct av_perms); j++) { | |
170 | if (av_perms[j].class == i) { | |
171 | if (firstperm == -1) | |
172 | firstperm = j; | |
173 | numperms++; | |
174 | } | |
175 | } | |
176 | if (!numperms) { | |
177 | fprintf(fout, "\n"); | |
178 | continue; | |
179 | } | |
180 | ||
181 | fprintf(fout, "{\n"); | |
182 | /* print out the av_perms */ | |
183 | for (j=0; j < numperms; j++) { | |
184 | fprintf(fout, "\t%s\n", av_perms[firstperm+j].perm_s); | |
185 | } | |
186 | fprintf(fout, "}\n\n"); | |
187 | } | |
188 | } | |
189 | fprintf(fout, "\n"); | |
190 | ||
191 | /* NOW PRINT OUT MLS STUFF */ | |
192 | if (mls) { | |
193 | printf("MLS not yet implemented\n"); | |
194 | exit(1); | |
195 | } | |
196 | ||
197 | /* types, roles, and allows */ | |
198 | fprintf(fout, "type base_t;\n"); | |
199 | fprintf(fout, "role base_r types { base_t };\n"); | |
200 | for (i=1; i < classlist_len; i++) { | |
201 | if (classlist[i]) | |
202 | fprintf(fout, "allow base_t base_t:%s *;\n", classlist[i]); | |
203 | else | |
204 | fprintf(fout, "allow base_t base_t:user%d *;\n", i); | |
205 | } | |
206 | fprintf(fout, "user user_u roles { base_r };\n"); | |
207 | fprintf(fout, "\n"); | |
208 | ||
209 | /* default sids */ | |
210 | for (i=1; i < initial_sid_to_string_len; i++) | |
211 | fprintf(fout, "sid %s user_u:base_r:base_t\n", initial_sid_to_string[i]); | |
212 | fprintf(fout, "\n"); | |
213 | ||
214 | ||
215 | fprintf(fout, "fs_use_xattr ext2 user_u:base_r:base_t;\n"); | |
216 | fprintf(fout, "fs_use_xattr ext3 user_u:base_r:base_t;\n"); | |
217 | fprintf(fout, "fs_use_xattr jfs user_u:base_r:base_t;\n"); | |
218 | fprintf(fout, "fs_use_xattr xfs user_u:base_r:base_t;\n"); | |
219 | fprintf(fout, "fs_use_xattr reiserfs user_u:base_r:base_t;\n"); | |
220 | ||
221 | fprintf(fout, "fs_use_task pipefs user_u:base_r:base_t;\n"); | |
222 | fprintf(fout, "fs_use_task sockfs user_u:base_r:base_t;\n"); | |
223 | ||
224 | fprintf(fout, "fs_use_trans devpts user_u:base_r:base_t;\n"); | |
225 | fprintf(fout, "fs_use_trans tmpfs user_u:base_r:base_t;\n"); | |
226 | fprintf(fout, "fs_use_trans shm user_u:base_r:base_t;\n"); | |
227 | ||
228 | fprintf(fout, "genfscon proc / user_u:base_r:base_t\n"); | |
229 | ||
230 | fclose(fout); | |
231 | ||
232 | fout = fopen(ctxout, "w"); | |
233 | if (!fout) { | |
234 | printf("Wrote policy, but cannot open %s for writing\n", ctxout); | |
235 | usage(argv[0]); | |
236 | } | |
237 | fprintf(fout, "/ user_u:base_r:base_t\n"); | |
238 | fprintf(fout, "/.* user_u:base_r:base_t\n"); | |
239 | fclose(fout); | |
240 | ||
241 | return 0; | |
242 | } |