security/selinux/ss/conditional.c

   1 // SPDX-License-Identifier: GPL-2.0-only
   2 /* Authors: Karl MacMillan <kmacmillan@tresys.com>
   3  *          Frank Mayer <mayerf@tresys.com>
   4  *
   5  * Copyright (C) 2003 - 2004 Tresys Technology, LLC
   6  */
   7
   8 #include <linux/kernel.h>
   9 #include <linux/errno.h>
  10 #include <linux/string.h>
  11 #include <linux/spinlock.h>
  12 #include <linux/slab.h>
  13
  14 #include "security.h"
  15 #include "conditional.h"
  16 #include "services.h"
  17
  18 /*
  19  * cond_evaluate_expr evaluates a conditional expr
  20  * in reverse polish notation. It returns true (1), false (0),
  21  * or undefined (-1). Undefined occurs when the expression
  22  * exceeds the stack depth of COND_EXPR_MAXDEPTH.
  23  */
  24 static int cond_evaluate_expr(struct policydb *p, struct cond_expr *expr)
  25 {
  26         u32 i;
  27         int s[COND_EXPR_MAXDEPTH];
  28         int sp = -1;
  29
  30         if (expr->len == 0)
  31                 return -1;
  32
  33         for (i = 0; i < expr->len; i++) {
  34                 struct cond_expr_node *node = &expr->nodes[i];
  35
  36                 switch (node->expr_type) {
  37                 case COND_BOOL:
  38                         if (sp == (COND_EXPR_MAXDEPTH - 1))
  39                                 return -1;
  40                         sp++;
  41                         s[sp] = p->bool_val_to_struct[node->bool - 1]->state;
  42                         break;
  43                 case COND_NOT:
  44                         if (sp < 0)
  45                                 return -1;
  46                         s[sp] = !s[sp];
  47                         break;
  48                 case COND_OR:
  49                         if (sp < 1)
  50                                 return -1;
  51                         sp--;
  52                         s[sp] |= s[sp + 1];
  53                         break;
  54                 case COND_AND:
  55                         if (sp < 1)
  56                                 return -1;
  57                         sp--;
  58                         s[sp] &= s[sp + 1];
  59                         break;
  60                 case COND_XOR:
  61                         if (sp < 1)
  62                                 return -1;
  63                         sp--;
  64                         s[sp] ^= s[sp + 1];
  65                         break;
  66                 case COND_EQ:
  67                         if (sp < 1)
  68                                 return -1;
  69                         sp--;
  70                         s[sp] = (s[sp] == s[sp + 1]);
  71                         break;
  72                 case COND_NEQ:
  73                         if (sp < 1)
  74                                 return -1;
  75                         sp--;
  76                         s[sp] = (s[sp] != s[sp + 1]);
  77                         break;
  78                 default:
  79                         return -1;
  80                 }
  81         }
  82         return s[0];
  83 }
  84
  85 /*
  86  * evaluate_cond_node evaluates the conditional stored in
  87  * a struct cond_node and if the result is different than the
  88  * current state of the node it sets the rules in the true/false
  89  * list appropriately. If the result of the expression is undefined
  90  * all of the rules are disabled for safety.
  91  */
  92 static void evaluate_cond_node(struct policydb *p, struct cond_node *node)
  93 {
  94         struct avtab_node *avnode;
  95         int new_state;
  96         u32 i;
  97
  98         new_state = cond_evaluate_expr(p, &node->expr);
  99         if (new_state != node->cur_state) {
 100                 node->cur_state = new_state;
 101                 if (new_state == -1)
 102                         pr_err("SELinux: expression result was undefined - disabling all rules.\n");
 103                 /* turn the rules on or off */
 104                 for (i = 0; i < node->true_list.len; i++) {
 105                         avnode = node->true_list.nodes[i];
 106                         if (new_state <= 0)
 107                                 avnode->key.specified &= ~AVTAB_ENABLED;
 108                         else
 109                                 avnode->key.specified |= AVTAB_ENABLED;
 110                 }
 111
 112                 for (i = 0; i < node->false_list.len; i++) {
 113                         avnode = node->false_list.nodes[i];
 114                         /* -1 or 1 */
 115                         if (new_state)
 116                                 avnode->key.specified &= ~AVTAB_ENABLED;
 117                         else
 118                                 avnode->key.specified |= AVTAB_ENABLED;
 119                 }
 120         }
 121 }
 122
 123 void evaluate_cond_nodes(struct policydb *p)
 124 {
 125         u32 i;
 126
 127         for (i = 0; i < p->cond_list_len; i++)
 128                 evaluate_cond_node(p, &p->cond_list[i]);
 129 }
 130
 131 void cond_policydb_init(struct policydb *p)
 132 {
 133         p->bool_val_to_struct = NULL;
 134         p->cond_list = NULL;
 135         p->cond_list_len = 0;
 136
 137         avtab_init(&p->te_cond_avtab);
 138 }
 139
 140 static void cond_node_destroy(struct cond_node *node)
 141 {
 142         kfree(node->expr.nodes);
 143         /* the avtab_ptr_t nodes are destroyed by the avtab */
 144         kfree(node->true_list.nodes);
 145         kfree(node->false_list.nodes);
 146 }
 147
 148 static void cond_list_destroy(struct policydb *p)
 149 {
 150         u32 i;
 151
 152         for (i = 0; i < p->cond_list_len; i++)
 153                 cond_node_destroy(&p->cond_list[i]);
 154         kfree(p->cond_list);
 155 }
 156
 157 void cond_policydb_destroy(struct policydb *p)
 158 {
 159         kfree(p->bool_val_to_struct);
 160         avtab_destroy(&p->te_cond_avtab);
 161         cond_list_destroy(p);
 162 }
 163
 164 int cond_init_bool_indexes(struct policydb *p)
 165 {
 166         kfree(p->bool_val_to_struct);
 167         p->bool_val_to_struct = kmalloc_array(p->p_bools.nprim,
 168                                               sizeof(*p->bool_val_to_struct),
 169                                               GFP_KERNEL);
 170         if (!p->bool_val_to_struct)
 171                 return -ENOMEM;
 172         return 0;
 173 }
 174
 175 int cond_destroy_bool(void *key, void *datum, void *p)
 176 {
 177         kfree(key);
 178         kfree(datum);
 179         return 0;
 180 }
 181
 182 int cond_index_bool(void *key, void *datum, void *datap)
 183 {
 184         struct policydb *p;
 185         struct cond_bool_datum *booldatum;
 186
 187         booldatum = datum;
 188         p = datap;
 189
 190         if (!booldatum->value || booldatum->value > p->p_bools.nprim)
 191                 return -EINVAL;
 192
 193         p->sym_val_to_name[SYM_BOOLS][booldatum->value - 1] = key;
 194         p->bool_val_to_struct[booldatum->value - 1] = booldatum;
 195
 196         return 0;
 197 }
 198
 199 static int bool_isvalid(struct cond_bool_datum *b)
 200 {
 201         if (!(b->state == 0 || b->state == 1))
 202                 return 0;
 203         return 1;
 204 }
 205
 206 int cond_read_bool(struct policydb *p, struct hashtab *h, void *fp)
 207 {
 208         char *key = NULL;
 209         struct cond_bool_datum *booldatum;
 210         __le32 buf[3];
 211         u32 len;
 212         int rc;
 213
 214         booldatum = kzalloc(sizeof(*booldatum), GFP_KERNEL);
 215         if (!booldatum)
 216                 return -ENOMEM;
 217
 218         rc = next_entry(buf, fp, sizeof buf);
 219         if (rc)
 220                 goto err;
 221
 222         booldatum->value = le32_to_cpu(buf[0]);
 223         booldatum->state = le32_to_cpu(buf[1]);
 224
 225         rc = -EINVAL;
 226         if (!bool_isvalid(booldatum))
 227                 goto err;
 228
 229         len = le32_to_cpu(buf[2]);
 230         if (((len == 0) || (len == (u32)-1)))
 231                 goto err;
 232
 233         rc = -ENOMEM;
 234         key = kmalloc(len + 1, GFP_KERNEL);
 235         if (!key)
 236                 goto err;
 237         rc = next_entry(key, fp, len);
 238         if (rc)
 239                 goto err;
 240         key[len] = '\0';
 241         rc = hashtab_insert(h, key, booldatum);
 242         if (rc)
 243                 goto err;
 244
 245         return 0;
 246 err:
 247         cond_destroy_bool(key, booldatum, NULL);
 248         return rc;
 249 }
 250
 251 struct cond_insertf_data {
 252         struct policydb *p;
 253         struct avtab_node **dst;
 254         struct cond_av_list *other;
 255 };
 256
 257 static int cond_insertf(struct avtab *a, struct avtab_key *k, struct avtab_datum *d, void *ptr)
 258 {
 259         struct cond_insertf_data *data = ptr;
 260         struct policydb *p = data->p;
 261         struct cond_av_list *other = data->other;
 262         struct avtab_node *node_ptr;
 263         u32 i;
 264         bool found;
 265
 266         /*
 267          * For type rules we have to make certain there aren't any
 268          * conflicting rules by searching the te_avtab and the
 269          * cond_te_avtab.
 270          */
 271         if (k->specified & AVTAB_TYPE) {
 272                 if (avtab_search(&p->te_avtab, k)) {
 273                         pr_err("SELinux: type rule already exists outside of a conditional.\n");
 274                         return -EINVAL;
 275                 }
 276                 /*
 277                  * If we are reading the false list other will be a pointer to
 278                  * the true list. We can have duplicate entries if there is only
 279                  * 1 other entry and it is in our true list.
 280                  *
 281                  * If we are reading the true list (other == NULL) there shouldn't
 282                  * be any other entries.
 283                  */
 284                 if (other) {
 285                         node_ptr = avtab_search_node(&p->te_cond_avtab, k);
 286                         if (node_ptr) {
 287                                 if (avtab_search_node_next(node_ptr, k->specified)) {
 288                                         pr_err("SELinux: too many conflicting type rules.\n");
 289                                         return -EINVAL;
 290                                 }
 291                                 found = false;
 292                                 for (i = 0; i < other->len; i++) {
 293                                         if (other->nodes[i] == node_ptr) {
 294                                                 found = true;
 295                                                 break;
 296                                         }
 297                                 }
 298                                 if (!found) {
 299                                         pr_err("SELinux: conflicting type rules.\n");
 300                                         return -EINVAL;
 301                                 }
 302                         }
 303                 } else {
 304                         if (avtab_search(&p->te_cond_avtab, k)) {
 305                                 pr_err("SELinux: conflicting type rules when adding type rule for true.\n");
 306                                 return -EINVAL;
 307                         }
 308                 }
 309         }
 310
 311         node_ptr = avtab_insert_nonunique(&p->te_cond_avtab, k, d);
 312         if (!node_ptr) {
 313                 pr_err("SELinux: could not insert rule.\n");
 314                 return -ENOMEM;
 315         }
 316
 317         *data->dst = node_ptr;
 318         return 0;
 319 }
 320
 321 static int cond_read_av_list(struct policydb *p, void *fp,
 322                              struct cond_av_list *list,
 323                              struct cond_av_list *other)
 324 {
 325         int rc;
 326         __le32 buf[1];
 327         u32 i, len;
 328         struct cond_insertf_data data;
 329
 330         rc = next_entry(buf, fp, sizeof(u32));
 331         if (rc)
 332                 return rc;
 333
 334         len = le32_to_cpu(buf[0]);
 335         if (len == 0)
 336                 return 0;
 337
 338         list->nodes = kcalloc(len, sizeof(*list->nodes), GFP_KERNEL);
 339         if (!list->nodes)
 340                 return -ENOMEM;
 341
 342         data.p = p;
 343         data.other = other;
 344         for (i = 0; i < len; i++) {
 345                 data.dst = &list->nodes[i];
 346                 rc = avtab_read_item(&p->te_cond_avtab, fp, p, cond_insertf,
 347                                      &data);
 348                 if (rc) {
 349                         kfree(list->nodes);
 350                         list->nodes = NULL;
 351                         return rc;
 352                 }
 353         }
 354
 355         list->len = len;
 356         return 0;
 357 }
 358
 359 static int expr_node_isvalid(struct policydb *p, struct cond_expr_node *expr)
 360 {
 361         if (expr->expr_type <= 0 || expr->expr_type > COND_LAST) {
 362                 pr_err("SELinux: conditional expressions uses unknown operator.\n");
 363                 return 0;
 364         }
 365
 366         if (expr->bool > p->p_bools.nprim) {
 367                 pr_err("SELinux: conditional expressions uses unknown bool.\n");
 368                 return 0;
 369         }
 370         return 1;
 371 }
 372
 373 static int cond_read_node(struct policydb *p, struct cond_node *node, void *fp)
 374 {
 375         __le32 buf[2];
 376         u32 i, len;
 377         int rc;
 378
 379         rc = next_entry(buf, fp, sizeof(u32) * 2);
 380         if (rc)
 381                 return rc;
 382
 383         node->cur_state = le32_to_cpu(buf[0]);
 384
 385         /* expr */
 386         len = le32_to_cpu(buf[1]);
 387         node->expr.nodes = kcalloc(len, sizeof(*node->expr.nodes), GFP_KERNEL);
 388         if (!node->expr.nodes)
 389                 return -ENOMEM;
 390
 391         node->expr.len = len;
 392
 393         for (i = 0; i < len; i++) {
 394                 struct cond_expr_node *expr = &node->expr.nodes[i];
 395
 396                 rc = next_entry(buf, fp, sizeof(u32) * 2);
 397                 if (rc)
 398                         return rc;
 399
 400                 expr->expr_type = le32_to_cpu(buf[0]);
 401                 expr->bool = le32_to_cpu(buf[1]);
 402
 403                 if (!expr_node_isvalid(p, expr))
 404                         return -EINVAL;
 405         }
 406
 407         rc = cond_read_av_list(p, fp, &node->true_list, NULL);
 408         if (rc)
 409                 return rc;
 410         return cond_read_av_list(p, fp, &node->false_list, &node->true_list);
 411 }
 412
 413 int cond_read_list(struct policydb *p, void *fp)
 414 {
 415         __le32 buf[1];
 416         u32 i, len;
 417         int rc;
 418
 419         rc = next_entry(buf, fp, sizeof buf);
 420         if (rc)
 421                 return rc;
 422
 423         len = le32_to_cpu(buf[0]);
 424
 425         p->cond_list = kcalloc(len, sizeof(*p->cond_list), GFP_KERNEL);
 426         if (!p->cond_list)
 427                 return -ENOMEM;
 428
 429         rc = avtab_alloc(&(p->te_cond_avtab), p->te_avtab.nel);
 430         if (rc)
 431                 goto err;
 432
 433         p->cond_list_len = len;
 434
 435         for (i = 0; i < len; i++) {
 436                 rc = cond_read_node(p, &p->cond_list[i], fp);
 437                 if (rc)
 438                         goto err;
 439         }
 440         return 0;
 441 err:
 442         cond_list_destroy(p);
 443         p->cond_list = NULL;
 444         return rc;
 445 }
 446
 447 int cond_write_bool(void *vkey, void *datum, void *ptr)
 448 {
 449         char *key = vkey;
 450         struct cond_bool_datum *booldatum = datum;
 451         struct policy_data *pd = ptr;
 452         void *fp = pd->fp;
 453         __le32 buf[3];
 454         u32 len;
 455         int rc;
 456
 457         len = strlen(key);
 458         buf[0] = cpu_to_le32(booldatum->value);
 459         buf[1] = cpu_to_le32(booldatum->state);
 460         buf[2] = cpu_to_le32(len);
 461         rc = put_entry(buf, sizeof(u32), 3, fp);
 462         if (rc)
 463                 return rc;
 464         rc = put_entry(key, 1, len, fp);
 465         if (rc)
 466                 return rc;
 467         return 0;
 468 }
 469
 470 /*
 471  * cond_write_cond_av_list doesn't write out the av_list nodes.
 472  * Instead it writes out the key/value pairs from the avtab. This
 473  * is necessary because there is no way to uniquely identifying rules
 474  * in the avtab so it is not possible to associate individual rules
 475  * in the avtab with a conditional without saving them as part of
 476  * the conditional. This means that the avtab with the conditional
 477  * rules will not be saved but will be rebuilt on policy load.
 478  */
 479 static int cond_write_av_list(struct policydb *p,
 480                               struct cond_av_list *list, struct policy_file *fp)
 481 {
 482         __le32 buf[1];
 483         u32 i;
 484         int rc;
 485
 486         buf[0] = cpu_to_le32(list->len);
 487         rc = put_entry(buf, sizeof(u32), 1, fp);
 488         if (rc)
 489                 return rc;
 490
 491         for (i = 0; i < list->len; i++) {
 492                 rc = avtab_write_item(p, list->nodes[i], fp);
 493                 if (rc)
 494                         return rc;
 495         }
 496
 497         return 0;
 498 }
 499
 500 static int cond_write_node(struct policydb *p, struct cond_node *node,
 501                     struct policy_file *fp)
 502 {
 503         __le32 buf[2];
 504         int rc;
 505         u32 i;
 506
 507         buf[0] = cpu_to_le32(node->cur_state);
 508         rc = put_entry(buf, sizeof(u32), 1, fp);
 509         if (rc)
 510                 return rc;
 511
 512         buf[0] = cpu_to_le32(node->expr.len);
 513         rc = put_entry(buf, sizeof(u32), 1, fp);
 514         if (rc)
 515                 return rc;
 516
 517         for (i = 0; i < node->expr.len; i++) {
 518                 buf[0] = cpu_to_le32(node->expr.nodes[i].expr_type);
 519                 buf[1] = cpu_to_le32(node->expr.nodes[i].bool);
 520                 rc = put_entry(buf, sizeof(u32), 2, fp);
 521                 if (rc)
 522                         return rc;
 523         }
 524
 525         rc = cond_write_av_list(p, &node->true_list, fp);
 526         if (rc)
 527                 return rc;
 528         rc = cond_write_av_list(p, &node->false_list, fp);
 529         if (rc)
 530                 return rc;
 531
 532         return 0;
 533 }
 534
 535 int cond_write_list(struct policydb *p, void *fp)
 536 {
 537         u32 i;
 538         __le32 buf[1];
 539         int rc;
 540
 541         buf[0] = cpu_to_le32(p->cond_list_len);
 542         rc = put_entry(buf, sizeof(u32), 1, fp);
 543         if (rc)
 544                 return rc;
 545
 546         for (i = 0; i < p->cond_list_len; i++) {
 547                 rc = cond_write_node(p, &p->cond_list[i], fp);
 548                 if (rc)
 549                         return rc;
 550         }
 551
 552         return 0;
 553 }
 554
 555 void cond_compute_xperms(struct avtab *ctab, struct avtab_key *key,
 556                 struct extended_perms_decision *xpermd)
 557 {
 558         struct avtab_node *node;
 559
 560         if (!ctab || !key || !xpermd)
 561                 return;
 562
 563         for (node = avtab_search_node(ctab, key); node;
 564                         node = avtab_search_node_next(node, key->specified)) {
 565                 if (node->key.specified & AVTAB_ENABLED)
 566                         services_compute_xperms_decision(xpermd, node);
 567         }
 568         return;
 569
 570 }
 571 /* Determine whether additional permissions are granted by the conditional
 572  * av table, and if so, add them to the result
 573  */
 574 void cond_compute_av(struct avtab *ctab, struct avtab_key *key,
 575                 struct av_decision *avd, struct extended_perms *xperms)
 576 {
 577         struct avtab_node *node;
 578
 579         if (!ctab || !key || !avd)
 580                 return;
 581
 582         for (node = avtab_search_node(ctab, key); node;
 583                                 node = avtab_search_node_next(node, key->specified)) {
 584                 if ((u16)(AVTAB_ALLOWED|AVTAB_ENABLED) ==
 585                     (node->key.specified & (AVTAB_ALLOWED|AVTAB_ENABLED)))
 586                         avd->allowed |= node->datum.u.data;
 587                 if ((u16)(AVTAB_AUDITDENY|AVTAB_ENABLED) ==
 588                     (node->key.specified & (AVTAB_AUDITDENY|AVTAB_ENABLED)))
 589                         /* Since a '0' in an auditdeny mask represents a
 590                          * permission we do NOT want to audit (dontaudit), we use
 591                          * the '&' operand to ensure that all '0's in the mask
 592                          * are retained (much unlike the allow and auditallow cases).
 593                          */
 594                         avd->auditdeny &= node->datum.u.data;
 595                 if ((u16)(AVTAB_AUDITALLOW|AVTAB_ENABLED) ==
 596                     (node->key.specified & (AVTAB_AUDITALLOW|AVTAB_ENABLED)))
 597                         avd->auditallow |= node->datum.u.data;
 598                 if (xperms && (node->key.specified & AVTAB_ENABLED) &&
 599                                 (node->key.specified & AVTAB_XPERMS))
 600                         services_compute_xperms_drivers(xperms, node);
 601         }
 602 }