[net-next-2.6.git] / security / selinux / ss / conditional.c

/* Authors: Karl MacMillan <kmacmillan@tresys.com>
 *	    Frank Mayer <mayerf@tresys.com>
 *
 * Copyright (C) 2003 - 2004 Tresys Technology, LLC
 *	This program is free software; you can redistribute it and/or modify
 *	it under the terms of the GNU General Public License as published by
 *	the Free Software Foundation, version 2.
 */

#include <linux/kernel.h>
#include <linux/errno.h>
#include <linux/string.h>
#include <linux/spinlock.h>
#include <linux/slab.h>

#include "security.h"
#include "conditional.h"

/*
 * cond_evaluate_expr evaluates a conditional expr
 * in reverse polish notation. It returns true (1), false (0),
 * or undefined (-1). Undefined occurs when the expression
 * exceeds the stack depth of COND_EXPR_MAXDEPTH.
 */
static int cond_evaluate_expr(struct policydb *p, struct cond_expr *expr)
{

	struct cond_expr *cur;
	int s[COND_EXPR_MAXDEPTH];
	int sp = -1;

	for (cur = expr; cur; cur = cur->next) {
		switch (cur->expr_type) {
		case COND_BOOL:
			if (sp == (COND_EXPR_MAXDEPTH - 1))
				return -1;
			sp++;
			s[sp] = p->bool_val_to_struct[cur->bool - 1]->state;
			break;
		case COND_NOT:
			if (sp < 0)
				return -1;
			s[sp] = !s[sp];
			break;
		case COND_OR:
			if (sp < 1)
				return -1;
			sp--;
			s[sp] |= s[sp + 1];
			break;
		case COND_AND:
			if (sp < 1)
				return -1;
			sp--;
			s[sp] &= s[sp + 1];
			break;
		case COND_XOR:
			if (sp < 1)
				return -1;
			sp--;
			s[sp] ^= s[sp + 1];
			break;
		case COND_EQ:
			if (sp < 1)
				return -1;
			sp--;
			s[sp] = (s[sp] == s[sp + 1]);
			break;
		case COND_NEQ:
			if (sp < 1)
				return -1;
			sp--;
			s[sp] = (s[sp] != s[sp + 1]);
			break;
		default:
			return -1;
		}
	}
	return s[0];
}

/*
 * evaluate_cond_node evaluates the conditional stored in
 * a struct cond_node and if the result is different than the
 * current state of the node it sets the rules in the true/false
 * list appropriately. If the result of the expression is undefined
 * all of the rules are disabled for safety.
 */
int evaluate_cond_node(struct policydb *p, struct cond_node *node)
{
	int new_state;
	struct cond_av_list *cur;

	new_state = cond_evaluate_expr(p, node->expr);
	if (new_state != node->cur_state) {
		node->cur_state = new_state;
		if (new_state == -1)
			printk(KERN_ERR "SELinux: expression result was undefined - disabling all rules.\n");
		/* turn the rules on or off */
		for (cur = node->true_list; cur; cur = cur->next) {
			if (new_state <= 0)
				cur->node->key.specified &= ~AVTAB_ENABLED;
			else
				cur->node->key.specified |= AVTAB_ENABLED;
		}

		for (cur = node->false_list; cur; cur = cur->next) {
			/* -1 or 1 */
			if (new_state)
				cur->node->key.specified &= ~AVTAB_ENABLED;
			else
				cur->node->key.specified |= AVTAB_ENABLED;
		}
	}
	return 0;
}

int cond_policydb_init(struct policydb *p)
{
	int rc;

	p->bool_val_to_struct = NULL;
	p->cond_list = NULL;

	rc = avtab_init(&p->te_cond_avtab);
	if (rc)
		return rc;

	return 0;
}

static void cond_av_list_destroy(struct cond_av_list *list)
{
	struct cond_av_list *cur, *next;
	for (cur = list; cur; cur = next) {
		next = cur->next;
		/* the avtab_ptr_t node is destroy by the avtab */
		kfree(cur);
	}
}

static void cond_node_destroy(struct cond_node *node)
{
	struct cond_expr *cur_expr, *next_expr;

	for (cur_expr = node->expr; cur_expr; cur_expr = next_expr) {
		next_expr = cur_expr->next;
		kfree(cur_expr);
	}
	cond_av_list_destroy(node->true_list);
	cond_av_list_destroy(node->false_list);
	kfree(node);
}

static void cond_list_destroy(struct cond_node *list)
{
	struct cond_node *next, *cur;

	if (list == NULL)
		return;

	for (cur = list; cur; cur = next) {
		next = cur->next;
		cond_node_destroy(cur);
	}
}

void cond_policydb_destroy(struct policydb *p)
{
	kfree(p->bool_val_to_struct);
	avtab_destroy(&p->te_cond_avtab);
	cond_list_destroy(p->cond_list);
}

int cond_init_bool_indexes(struct policydb *p)
{
	kfree(p->bool_val_to_struct);
	p->bool_val_to_struct = (struct cond_bool_datum **)
		kmalloc(p->p_bools.nprim * sizeof(struct cond_bool_datum *), GFP_KERNEL);
	if (!p->bool_val_to_struct)
		return -1;
	return 0;
}

int cond_destroy_bool(void *key, void *datum, void *p)
{
	kfree(key);
	kfree(datum);
	return 0;
}

int cond_index_bool(void *key, void *datum, void *datap)
{
	struct policydb *p;
	struct cond_bool_datum *booldatum;

	booldatum = datum;
	p = datap;

	if (!booldatum->value || booldatum->value > p->p_bools.nprim)
		return -EINVAL;

	p->p_bool_val_to_name[booldatum->value - 1] = key;
	p->bool_val_to_struct[booldatum->value - 1] = booldatum;

	return 0;
}

static int bool_isvalid(struct cond_bool_datum *b)
{
	if (!(b->state == 0 || b->state == 1))
		return 0;
	return 1;
}

int cond_read_bool(struct policydb *p, struct hashtab *h, void *fp)
{
	char *key = NULL;
	struct cond_bool_datum *booldatum;
	__le32 buf[3];
	u32 len;
	int rc;

	booldatum = kzalloc(sizeof(struct cond_bool_datum), GFP_KERNEL);
	if (!booldatum)
		return -ENOMEM;

	rc = next_entry(buf, fp, sizeof buf);
	if (rc)
		goto err;

	booldatum->value = le32_to_cpu(buf[0]);
	booldatum->state = le32_to_cpu(buf[1]);

	rc = -EINVAL;
	if (!bool_isvalid(booldatum))
		goto err;

	len = le32_to_cpu(buf[2]);

	rc = -ENOMEM;
	key = kmalloc(len + 1, GFP_KERNEL);
	if (!key)
		goto err;
	rc = next_entry(key, fp, len);
	if (rc)
		goto err;
	key[len] = '\0';
	rc = hashtab_insert(h, key, booldatum);
	if (rc)
		goto err;

	return 0;
err:
	cond_destroy_bool(key, booldatum, NULL);
	return rc;
}

struct cond_insertf_data {
	struct policydb *p;
	struct cond_av_list *other;
	struct cond_av_list *head;
	struct cond_av_list *tail;
};

static int cond_insertf(struct avtab *a, struct avtab_key *k, struct avtab_datum *d, void *ptr)
{
	struct cond_insertf_data *data = ptr;
	struct policydb *p = data->p;
	struct cond_av_list *other = data->other, *list, *cur;
	struct avtab_node *node_ptr;
	u8 found;
	int rc = -EINVAL;

	/*
	 * For type rules we have to make certain there aren't any
	 * conflicting rules by searching the te_avtab and the
	 * cond_te_avtab.
	 */
	if (k->specified & AVTAB_TYPE) {
		if (avtab_search(&p->te_avtab, k)) {
			printk(KERN_ERR "SELinux: type rule already exists outside of a conditional.\n");
			goto err;
		}
		/*
		 * If we are reading the false list other will be a pointer to
		 * the true list. We can have duplicate entries if there is only
		 * 1 other entry and it is in our true list.
		 *
		 * If we are reading the true list (other == NULL) there shouldn't
		 * be any other entries.
		 */
		if (other) {
			node_ptr = avtab_search_node(&p->te_cond_avtab, k);
			if (node_ptr) {
				if (avtab_search_node_next(node_ptr, k->specified)) {
					printk(KERN_ERR "SELinux: too many conflicting type rules.\n");
					goto err;
				}
				found = 0;
				for (cur = other; cur; cur = cur->next) {
					if (cur->node == node_ptr) {
						found = 1;
						break;
					}
				}
				if (!found) {
					printk(KERN_ERR "SELinux: conflicting type rules.\n");
					goto err;
				}
			}
		} else {
			if (avtab_search(&p->te_cond_avtab, k)) {
				printk(KERN_ERR "SELinux: conflicting type rules when adding type rule for true.\n");
				goto err;
			}
		}
	}

	node_ptr = avtab_insert_nonunique(&p->te_cond_avtab, k, d);
	if (!node_ptr) {
		printk(KERN_ERR "SELinux: could not insert rule.\n");
		rc = -ENOMEM;
		goto err;
	}

	list = kzalloc(sizeof(struct cond_av_list), GFP_KERNEL);
	if (!list) {
		rc = -ENOMEM;
		goto err;
	}

	list->node = node_ptr;
	if (!data->head)
		data->head = list;
	else
		data->tail->next = list;
	data->tail = list;
	return 0;

err:
	cond_av_list_destroy(data->head);
	data->head = NULL;
	return rc;
}

static int cond_read_av_list(struct policydb *p, void *fp, struct cond_av_list **ret_list, struct cond_av_list *other)
{
	int i, rc;
	__le32 buf[1];
	u32 len;
	struct cond_insertf_data data;

	*ret_list = NULL;

	len = 0;
	rc = next_entry(buf, fp, sizeof(u32));
	if (rc)
		return rc;

	len = le32_to_cpu(buf[0]);
	if (len == 0)
		return 0;

	data.p = p;
	data.other = other;
	data.head = NULL;
	data.tail = NULL;
	for (i = 0; i < len; i++) {
		rc = avtab_read_item(&p->te_cond_avtab, fp, p, cond_insertf,
				     &data);
		if (rc)
			return rc;
	}

	*ret_list = data.head;
	return 0;
}

static int expr_isvalid(struct policydb *p, struct cond_expr *expr)
{
	if (expr->expr_type <= 0 || expr->expr_type > COND_LAST) {
		printk(KERN_ERR "SELinux: conditional expressions uses unknown operator.\n");
		return 0;
	}

	if (expr->bool > p->p_bools.nprim) {
		printk(KERN_ERR "SELinux: conditional expressions uses unknown bool.\n");
		return 0;
	}
	return 1;
}

static int cond_read_node(struct policydb *p, struct cond_node *node, void *fp)
{
	__le32 buf[2];
	u32 len, i;
	int rc;
	struct cond_expr *expr = NULL, *last = NULL;

	rc = next_entry(buf, fp, sizeof(u32));
	if (rc)
		return rc;

	node->cur_state = le32_to_cpu(buf[0]);

	len = 0;
	rc = next_entry(buf, fp, sizeof(u32));
	if (rc)
		return rc;

	/* expr */
	len = le32_to_cpu(buf[0]);

	for (i = 0; i < len; i++) {
		rc = next_entry(buf, fp, sizeof(u32) * 2);
		if (rc)
			goto err;

		rc = -ENOMEM;
		expr = kzalloc(sizeof(struct cond_expr), GFP_KERNEL);
		if (!expr)
			goto err;

		expr->expr_type = le32_to_cpu(buf[0]);
		expr->bool = le32_to_cpu(buf[1]);

		if (!expr_isvalid(p, expr)) {
			rc = -EINVAL;
			kfree(expr);
			goto err;
		}

		if (i == 0)
			node->expr = expr;
		else
			last->next = expr;
		last = expr;
	}

	rc = cond_read_av_list(p, fp, &node->true_list, NULL);
	if (rc)
		goto err;
	rc = cond_read_av_list(p, fp, &node->false_list, node->true_list);
	if (rc)
		goto err;
	return 0;
err:
	cond_node_destroy(node);
	return rc;
}

int cond_read_list(struct policydb *p, void *fp)
{
	struct cond_node *node, *last = NULL;
	__le32 buf[1];
	u32 i, len;
	int rc;

	rc = next_entry(buf, fp, sizeof buf);
	if (rc)
		return rc;

	len = le32_to_cpu(buf[0]);

	rc = avtab_alloc(&(p->te_cond_avtab), p->te_avtab.nel);
	if (rc)
		goto err;

	for (i = 0; i < len; i++) {
		rc = -ENOMEM;
		node = kzalloc(sizeof(struct cond_node), GFP_KERNEL);
		if (!node)
			goto err;

		rc = cond_read_node(p, node, fp);
		if (rc)
			goto err;

		if (i == 0)
			p->cond_list = node;
		else
			last->next = node;
		last = node;
	}
	return 0;
err:
	cond_list_destroy(p->cond_list);
	p->cond_list = NULL;
	return rc;
}

int cond_write_bool(void *vkey, void *datum, void *ptr)
{
	char *key = vkey;
	struct cond_bool_datum *booldatum = datum;
	struct policy_data *pd = ptr;
	void *fp = pd->fp;
	__le32 buf[3];
	u32 len;
	int rc;

	len = strlen(key);
	buf[0] = cpu_to_le32(booldatum->value);
	buf[1] = cpu_to_le32(booldatum->state);
	buf[2] = cpu_to_le32(len);
	rc = put_entry(buf, sizeof(u32), 3, fp);
	if (rc)
		return rc;
	rc = put_entry(key, 1, len, fp);
	if (rc)
		return rc;
	return 0;
}

/*
 * cond_write_cond_av_list doesn't write out the av_list nodes.
 * Instead it writes out the key/value pairs from the avtab. This
 * is necessary because there is no way to uniquely identifying rules
 * in the avtab so it is not possible to associate individual rules
 * in the avtab with a conditional without saving them as part of
 * the conditional. This means that the avtab with the conditional
 * rules will not be saved but will be rebuilt on policy load.
 */
static int cond_write_av_list(struct policydb *p,
			      struct cond_av_list *list, struct policy_file *fp)
{
	__le32 buf[1];
	struct cond_av_list *cur_list;
	u32 len;
	int rc;

	len = 0;
	for (cur_list = list; cur_list != NULL; cur_list = cur_list->next)
		len++;

	buf[0] = cpu_to_le32(len);
	rc = put_entry(buf, sizeof(u32), 1, fp);
	if (rc)
		return rc;

	if (len == 0)
		return 0;

	for (cur_list = list; cur_list != NULL; cur_list = cur_list->next) {
		rc = avtab_write_item(p, cur_list->node, fp);
		if (rc)
			return rc;
	}

	return 0;
}

int cond_write_node(struct policydb *p, struct cond_node *node,
		    struct policy_file *fp)
{
	struct cond_expr *cur_expr;
	__le32 buf[2];
	int rc;
	u32 len = 0;

	buf[0] = cpu_to_le32(node->cur_state);
	rc = put_entry(buf, sizeof(u32), 1, fp);
	if (rc)
		return rc;

	for (cur_expr = node->expr; cur_expr != NULL; cur_expr = cur_expr->next)
		len++;

	buf[0] = cpu_to_le32(len);
	rc = put_entry(buf, sizeof(u32), 1, fp);
	if (rc)
		return rc;

	for (cur_expr = node->expr; cur_expr != NULL; cur_expr = cur_expr->next) {
		buf[0] = cpu_to_le32(cur_expr->expr_type);
		buf[1] = cpu_to_le32(cur_expr->bool);
		rc = put_entry(buf, sizeof(u32), 2, fp);
		if (rc)
			return rc;
	}

	rc = cond_write_av_list(p, node->true_list, fp);
	if (rc)
		return rc;
	rc = cond_write_av_list(p, node->false_list, fp);
	if (rc)
		return rc;

	return 0;
}

int cond_write_list(struct policydb *p, struct cond_node *list, void *fp)
{
	struct cond_node *cur;
	u32 len;
	__le32 buf[1];
	int rc;

	len = 0;
	for (cur = list; cur != NULL; cur = cur->next)
		len++;
	buf[0] = cpu_to_le32(len);
	rc = put_entry(buf, sizeof(u32), 1, fp);
	if (rc)
		return rc;

	for (cur = list; cur != NULL; cur = cur->next) {
		rc = cond_write_node(p, cur, fp);
		if (rc)
			return rc;
	}

	return 0;
}
/* Determine whether additional permissions are granted by the conditional
 * av table, and if so, add them to the result
 */
void cond_compute_av(struct avtab *ctab, struct avtab_key *key, struct av_decision *avd)
{
	struct avtab_node *node;

	if (!ctab || !key || !avd)
		return;

	for (node = avtab_search_node(ctab, key); node;
				node = avtab_search_node_next(node, key->specified)) {
		if ((u16)(AVTAB_ALLOWED|AVTAB_ENABLED) ==
		    (node->key.specified & (AVTAB_ALLOWED|AVTAB_ENABLED)))
			avd->allowed |= node->datum.data;
		if ((u16)(AVTAB_AUDITDENY|AVTAB_ENABLED) ==
		    (node->key.specified & (AVTAB_AUDITDENY|AVTAB_ENABLED)))
			/* Since a '0' in an auditdeny mask represents a
			 * permission we do NOT want to audit (dontaudit), we use
			 * the '&' operand to ensure that all '0's in the mask
			 * are retained (much unlike the allow and auditallow cases).
			 */
			avd->auditdeny &= node->datum.data;
		if ((u16)(AVTAB_AUDITALLOW|AVTAB_ENABLED) ==
		    (node->key.specified & (AVTAB_AUDITALLOW|AVTAB_ENABLED)))
			avd->auditallow |= node->datum.data;
	}
	return;
}
Commit	Line	Data
1da177e4	1	/* Authors: Karl MacMillan <kmacmillan@tresys.com>
7c2b240e	2	* Frank Mayer <mayerf@tresys.com>
1da177e4 LT	3	*
	4	* Copyright (C) 2003 - 2004 Tresys Technology, LLC
	5	* This program is free software; you can redistribute it and/or modify
7c2b240e	6	* it under the terms of the GNU General Public License as published by
1da177e4 LT	7	* the Free Software Foundation, version 2.
	8	*/
	9
	10	#include <linux/kernel.h>
	11	#include <linux/errno.h>
	12	#include <linux/string.h>
	13	#include <linux/spinlock.h>
1da177e4 LT	14	#include <linux/slab.h>
	15
	16	#include "security.h"
	17	#include "conditional.h"
	18
	19	/*
	20	* cond_evaluate_expr evaluates a conditional expr
	21	* in reverse polish notation. It returns true (1), false (0),
	22	* or undefined (-1). Undefined occurs when the expression
	23	* exceeds the stack depth of COND_EXPR_MAXDEPTH.
	24	*/
	25	static int cond_evaluate_expr(struct policydb p, struct cond_expr expr)
	26	{
	27
	28	struct cond_expr *cur;
	29	int s[COND_EXPR_MAXDEPTH];
	30	int sp = -1;
	31
dbc74c65	32	for (cur = expr; cur; cur = cur->next) {
1da177e4 LT	33	switch (cur->expr_type) {
	34	case COND_BOOL:
	35	if (sp == (COND_EXPR_MAXDEPTH - 1))
	36	return -1;
	37	sp++;
	38	s[sp] = p->bool_val_to_struct[cur->bool - 1]->state;
	39	break;
	40	case COND_NOT:
	41	if (sp < 0)
	42	return -1;
	43	s[sp] = !s[sp];
	44	break;
	45	case COND_OR:
	46	if (sp < 1)
	47	return -1;
	48	sp--;
	49	s[sp] \|= s[sp + 1];
	50	break;
	51	case COND_AND:
	52	if (sp < 1)
	53	return -1;
	54	sp--;
	55	s[sp] &= s[sp + 1];
	56	break;
	57	case COND_XOR:
	58	if (sp < 1)
	59	return -1;
	60	sp--;
	61	s[sp] ^= s[sp + 1];
	62	break;
	63	case COND_EQ:
	64	if (sp < 1)
	65	return -1;
	66	sp--;
	67	s[sp] = (s[sp] == s[sp + 1]);
	68	break;
	69	case COND_NEQ:
	70	if (sp < 1)
	71	return -1;
	72	sp--;
	73	s[sp] = (s[sp] != s[sp + 1]);
	74	break;
	75	default:
	76	return -1;
	77	}
	78	}
	79	return s[0];
	80	}
	81
	82	/*
	83	* evaluate_cond_node evaluates the conditional stored in
	84	* a struct cond_node and if the result is different than the
	85	* current state of the node it sets the rules in the true/false
	86	* list appropriately. If the result of the expression is undefined
	87	* all of the rules are disabled for safety.
	88	*/
	89	int evaluate_cond_node(struct policydb p, struct cond_node node)
	90	{
	91	int new_state;
7c2b240e	92	struct cond_av_list *cur;
1da177e4 LT	93
	94	new_state = cond_evaluate_expr(p, node->expr);
	95	if (new_state != node->cur_state) {
	96	node->cur_state = new_state;
	97	if (new_state == -1)
454d972c	98	printk(KERN_ERR "SELinux: expression result was undefined - disabling all rules.\n");
1da177e4	99	/* turn the rules on or off */
dbc74c65	100	for (cur = node->true_list; cur; cur = cur->next) {
7c2b240e	101	if (new_state <= 0)
782ebb99	102	cur->node->key.specified &= ~AVTAB_ENABLED;
7c2b240e	103	else
782ebb99	104	cur->node->key.specified \|= AVTAB_ENABLED;
1da177e4 LT	105	}
1da177e4 LT	106
dbc74c65	107	for (cur = node->false_list; cur; cur = cur->next) {
1da177e4	108	/* -1 or 1 */
7c2b240e	109	if (new_state)
782ebb99	110	cur->node->key.specified &= ~AVTAB_ENABLED;
7c2b240e	111	else
782ebb99	112	cur->node->key.specified \|= AVTAB_ENABLED;
1da177e4 LT	113	}
	114	}
	115	return 0;
	116	}
	117
	118	int cond_policydb_init(struct policydb *p)
	119	{
38184c52 DC	120	int rc;
38184c52 DC	121
1da177e4 LT	122	p->bool_val_to_struct = NULL;
1da177e4 LT	123	p->cond_list = NULL;
38184c52 DC	124
	125	rc = avtab_init(&p->te_cond_avtab);
	126	if (rc)
	127	return rc;
1da177e4 LT	128
	129	return 0;
	130	}
	131
	132	static void cond_av_list_destroy(struct cond_av_list *list)
	133	{
	134	struct cond_av_list cur, next;
dbc74c65	135	for (cur = list; cur; cur = next) {
1da177e4 LT	136	next = cur->next;
	137	/* the avtab_ptr_t node is destroy by the avtab */
	138	kfree(cur);
	139	}
	140	}
	141
	142	static void cond_node_destroy(struct cond_node *node)
	143	{
	144	struct cond_expr cur_expr, next_expr;
	145
dbc74c65	146	for (cur_expr = node->expr; cur_expr; cur_expr = next_expr) {
1da177e4 LT	147	next_expr = cur_expr->next;
	148	kfree(cur_expr);
	149	}
	150	cond_av_list_destroy(node->true_list);
	151	cond_av_list_destroy(node->false_list);
	152	kfree(node);
	153	}
	154
	155	static void cond_list_destroy(struct cond_node *list)
	156	{
	157	struct cond_node next, cur;
	158
	159	if (list == NULL)
	160	return;
	161
dbc74c65	162	for (cur = list; cur; cur = next) {
1da177e4 LT	163	next = cur->next;
	164	cond_node_destroy(cur);
	165	}
	166	}
	167
	168	void cond_policydb_destroy(struct policydb *p)
	169	{
9a5f04bf	170	kfree(p->bool_val_to_struct);
1da177e4 LT	171	avtab_destroy(&p->te_cond_avtab);
	172	cond_list_destroy(p->cond_list);
	173	}
	174
	175	int cond_init_bool_indexes(struct policydb *p)
	176	{
9a5f04bf	177	kfree(p->bool_val_to_struct);
7c2b240e EP	178	p->bool_val_to_struct = (struct cond_bool_datum **)
7c2b240e EP	179	kmalloc(p->p_bools.nprim * sizeof(struct cond_bool_datum *), GFP_KERNEL);
1da177e4 LT	180	if (!p->bool_val_to_struct)
	181	return -1;
	182	return 0;
	183	}
	184
	185	int cond_destroy_bool(void key, void datum, void *p)
	186	{
9a5f04bf	187	kfree(key);
1da177e4 LT	188	kfree(datum);
	189	return 0;
	190	}
	191
	192	int cond_index_bool(void key, void datum, void *datap)
	193	{
	194	struct policydb *p;
	195	struct cond_bool_datum *booldatum;
	196
	197	booldatum = datum;
	198	p = datap;
	199
	200	if (!booldatum->value \|\| booldatum->value > p->p_bools.nprim)
	201	return -EINVAL;
	202
	203	p->p_bool_val_to_name[booldatum->value - 1] = key;
7c2b240e	204	p->bool_val_to_struct[booldatum->value - 1] = booldatum;
1da177e4 LT	205
	206	return 0;
	207	}
	208
	209	static int bool_isvalid(struct cond_bool_datum *b)
	210	{
	211	if (!(b->state == 0 \|\| b->state == 1))
	212	return 0;
	213	return 1;
	214	}
	215
	216	int cond_read_bool(struct policydb p, struct hashtab h, void *fp)
	217	{
	218	char *key = NULL;
	219	struct cond_bool_datum *booldatum;
b5bf6c55 AD	220	__le32 buf[3];
b5bf6c55 AD	221	u32 len;
1da177e4 LT	222	int rc;
1da177e4 LT	223
89d155ef	224	booldatum = kzalloc(sizeof(struct cond_bool_datum), GFP_KERNEL);
1da177e4	225	if (!booldatum)
338437f6	226	return -ENOMEM;
1da177e4 LT	227
1da177e4 LT	228	rc = next_entry(buf, fp, sizeof buf);
338437f6	229	if (rc)
1da177e4 LT	230	goto err;
	231
	232	booldatum->value = le32_to_cpu(buf[0]);
	233	booldatum->state = le32_to_cpu(buf[1]);
	234
338437f6	235	rc = -EINVAL;
1da177e4 LT	236	if (!bool_isvalid(booldatum))
	237	goto err;
	238
	239	len = le32_to_cpu(buf[2]);
	240
338437f6	241	rc = -ENOMEM;
1da177e4 LT	242	key = kmalloc(len + 1, GFP_KERNEL);
	243	if (!key)
	244	goto err;
	245	rc = next_entry(key, fp, len);
338437f6	246	if (rc)
1da177e4	247	goto err;
df4ea865	248	key[len] = '\0';
338437f6 DC	249	rc = hashtab_insert(h, key, booldatum);
338437f6 DC	250	if (rc)
1da177e4 LT	251	goto err;
	252
	253	return 0;
	254	err:
	255	cond_destroy_bool(key, booldatum, NULL);
338437f6	256	return rc;
1da177e4 LT	257	}
1da177e4 LT	258
7c2b240e	259	struct cond_insertf_data {
782ebb99 SS	260	struct policydb *p;
	261	struct cond_av_list *other;
	262	struct cond_av_list *head;
	263	struct cond_av_list *tail;
	264	};
	265
	266	static int cond_insertf(struct avtab a, struct avtab_key k, struct avtab_datum d, void ptr)
	267	{
	268	struct cond_insertf_data *data = ptr;
	269	struct policydb *p = data->p;
	270	struct cond_av_list other = data->other, list, *cur;
1da177e4	271	struct avtab_node *node_ptr;
1da177e4	272	u8 found;
9d623b17	273	int rc = -EINVAL;
1da177e4	274
782ebb99 SS	275	/*
	276	* For type rules we have to make certain there aren't any
	277	* conflicting rules by searching the te_avtab and the
	278	* cond_te_avtab.
	279	*/
	280	if (k->specified & AVTAB_TYPE) {
	281	if (avtab_search(&p->te_avtab, k)) {
744ba35e	282	printk(KERN_ERR "SELinux: type rule already exists outside of a conditional.\n");
1da177e4	283	goto err;
782ebb99	284	}
1da177e4	285	/*
782ebb99 SS	286	* If we are reading the false list other will be a pointer to
	287	* the true list. We can have duplicate entries if there is only
	288	* 1 other entry and it is in our true list.
	289	*
	290	* If we are reading the true list (other == NULL) there shouldn't
	291	* be any other entries.
1da177e4	292	*/
782ebb99 SS	293	if (other) {
	294	node_ptr = avtab_search_node(&p->te_cond_avtab, k);
	295	if (node_ptr) {
	296	if (avtab_search_node_next(node_ptr, k->specified)) {
744ba35e	297	printk(KERN_ERR "SELinux: too many conflicting type rules.\n");
782ebb99 SS	298	goto err;
	299	}
	300	found = 0;
dbc74c65	301	for (cur = other; cur; cur = cur->next) {
782ebb99 SS	302	if (cur->node == node_ptr) {
	303	found = 1;
	304	break;
1da177e4 LT	305	}
1da177e4 LT	306	}
782ebb99	307	if (!found) {
744ba35e	308	printk(KERN_ERR "SELinux: conflicting type rules.\n");
1da177e4 LT	309	goto err;
	310	}
	311	}
782ebb99 SS	312	} else {
782ebb99 SS	313	if (avtab_search(&p->te_cond_avtab, k)) {
744ba35e	314	printk(KERN_ERR "SELinux: conflicting type rules when adding type rule for true.\n");
782ebb99 SS	315	goto err;
782ebb99 SS	316	}
1da177e4	317	}
782ebb99	318	}
1da177e4	319
782ebb99 SS	320	node_ptr = avtab_insert_nonunique(&p->te_cond_avtab, k, d);
782ebb99 SS	321	if (!node_ptr) {
744ba35e	322	printk(KERN_ERR "SELinux: could not insert rule.\n");
9d623b17	323	rc = -ENOMEM;
782ebb99	324	goto err;
1da177e4 LT	325	}
1da177e4 LT	326
89d155ef	327	list = kzalloc(sizeof(struct cond_av_list), GFP_KERNEL);
9d623b17 DC	328	if (!list) {
9d623b17 DC	329	rc = -ENOMEM;
782ebb99	330	goto err;
9d623b17	331	}
782ebb99 SS	332
	333	list->node = node_ptr;
	334	if (!data->head)
	335	data->head = list;
	336	else
	337	data->tail->next = list;
	338	data->tail = list;
1da177e4	339	return 0;
782ebb99	340
1da177e4	341	err:
782ebb99 SS	342	cond_av_list_destroy(data->head);
782ebb99 SS	343	data->head = NULL;
9d623b17	344	return rc;
1da177e4 LT	345	}
1da177e4 LT	346
782ebb99 SS	347	static int cond_read_av_list(struct policydb p, void fp, struct cond_av_list *ret_list, struct cond_av_list other)
	348	{
	349	int i, rc;
b5bf6c55 AD	350	__le32 buf[1];
b5bf6c55 AD	351	u32 len;
782ebb99 SS	352	struct cond_insertf_data data;
	353
	354	*ret_list = NULL;
	355
	356	len = 0;
	357	rc = next_entry(buf, fp, sizeof(u32));
9d623b17 DC	358	if (rc)
9d623b17 DC	359	return rc;
782ebb99 SS	360
782ebb99 SS	361	len = le32_to_cpu(buf[0]);
7c2b240e	362	if (len == 0)
782ebb99	363	return 0;
782ebb99 SS	364
	365	data.p = p;
	366	data.other = other;
	367	data.head = NULL;
	368	data.tail = NULL;
	369	for (i = 0; i < len; i++) {
45e5421e SS	370	rc = avtab_read_item(&p->te_cond_avtab, fp, p, cond_insertf,
45e5421e SS	371	&data);
782ebb99 SS	372	if (rc)
782ebb99 SS	373	return rc;
782ebb99 SS	374	}
	375
	376	*ret_list = data.head;
	377	return 0;
	378	}
	379
1da177e4 LT	380	static int expr_isvalid(struct policydb p, struct cond_expr expr)
	381	{
	382	if (expr->expr_type <= 0 \|\| expr->expr_type > COND_LAST) {
744ba35e	383	printk(KERN_ERR "SELinux: conditional expressions uses unknown operator.\n");
1da177e4 LT	384	return 0;
	385	}
	386
	387	if (expr->bool > p->p_bools.nprim) {
744ba35e	388	printk(KERN_ERR "SELinux: conditional expressions uses unknown bool.\n");
1da177e4 LT	389	return 0;
	390	}
	391	return 1;
	392	}
	393
	394	static int cond_read_node(struct policydb p, struct cond_node node, void *fp)
	395	{
b5bf6c55 AD	396	__le32 buf[2];
b5bf6c55 AD	397	u32 len, i;
1da177e4 LT	398	int rc;
	399	struct cond_expr expr = NULL, last = NULL;
	400
	401	rc = next_entry(buf, fp, sizeof(u32));
fc5c126e DC	402	if (rc)
fc5c126e DC	403	return rc;
1da177e4 LT	404
	405	node->cur_state = le32_to_cpu(buf[0]);
	406
	407	len = 0;
	408	rc = next_entry(buf, fp, sizeof(u32));
fc5c126e DC	409	if (rc)
fc5c126e DC	410	return rc;
1da177e4 LT	411
	412	/* expr */
	413	len = le32_to_cpu(buf[0]);
	414
7c2b240e	415	for (i = 0; i < len; i++) {
1da177e4	416	rc = next_entry(buf, fp, sizeof(u32) * 2);
fc5c126e	417	if (rc)
1da177e4 LT	418	goto err;
1da177e4 LT	419
fc5c126e	420	rc = -ENOMEM;
89d155ef	421	expr = kzalloc(sizeof(struct cond_expr), GFP_KERNEL);
7c2b240e	422	if (!expr)
1da177e4	423	goto err;
1da177e4 LT	424
	425	expr->expr_type = le32_to_cpu(buf[0]);
	426	expr->bool = le32_to_cpu(buf[1]);
	427
	428	if (!expr_isvalid(p, expr)) {
fc5c126e	429	rc = -EINVAL;
1da177e4 LT	430	kfree(expr);
	431	goto err;
	432	}
	433
7c2b240e	434	if (i == 0)
1da177e4	435	node->expr = expr;
7c2b240e	436	else
1da177e4	437	last->next = expr;
1da177e4 LT	438	last = expr;
	439	}
	440
fc5c126e DC	441	rc = cond_read_av_list(p, fp, &node->true_list, NULL);
fc5c126e DC	442	if (rc)
1da177e4	443	goto err;
fc5c126e DC	444	rc = cond_read_av_list(p, fp, &node->false_list, node->true_list);
fc5c126e DC	445	if (rc)
1da177e4 LT	446	goto err;
	447	return 0;
	448	err:
	449	cond_node_destroy(node);
fc5c126e	450	return rc;
1da177e4 LT	451	}
	452
	453	int cond_read_list(struct policydb p, void fp)
	454	{
	455	struct cond_node node, last = NULL;
b5bf6c55 AD	456	__le32 buf[1];
b5bf6c55 AD	457	u32 i, len;
1da177e4 LT	458	int rc;
	459
	460	rc = next_entry(buf, fp, sizeof buf);
5241c107 DC	461	if (rc)
5241c107 DC	462	return rc;
1da177e4 LT	463
	464	len = le32_to_cpu(buf[0]);
	465
3232c110 YN	466	rc = avtab_alloc(&(p->te_cond_avtab), p->te_avtab.nel);
	467	if (rc)
	468	goto err;
	469
1da177e4	470	for (i = 0; i < len; i++) {
5241c107	471	rc = -ENOMEM;
89d155ef	472	node = kzalloc(sizeof(struct cond_node), GFP_KERNEL);
1da177e4 LT	473	if (!node)
1da177e4 LT	474	goto err;
1da177e4	475
5241c107 DC	476	rc = cond_read_node(p, node, fp);
5241c107 DC	477	if (rc)
1da177e4 LT	478	goto err;
1da177e4 LT	479
7c2b240e	480	if (i == 0)
1da177e4	481	p->cond_list = node;
7c2b240e	482	else
1da177e4	483	last->next = node;
1da177e4 LT	484	last = node;
	485	}
	486	return 0;
	487	err:
	488	cond_list_destroy(p->cond_list);
782ebb99	489	p->cond_list = NULL;
5241c107	490	return rc;
1da177e4 LT	491	}
1da177e4 LT	492
cee74f47 EP	493	int cond_write_bool(void vkey, void datum, void *ptr)
	494	{
	495	char *key = vkey;
	496	struct cond_bool_datum *booldatum = datum;
	497	struct policy_data *pd = ptr;
	498	void *fp = pd->fp;
	499	__le32 buf[3];
	500	u32 len;
	501	int rc;
	502
	503	len = strlen(key);
	504	buf[0] = cpu_to_le32(booldatum->value);
	505	buf[1] = cpu_to_le32(booldatum->state);
	506	buf[2] = cpu_to_le32(len);
	507	rc = put_entry(buf, sizeof(u32), 3, fp);
	508	if (rc)
	509	return rc;
	510	rc = put_entry(key, 1, len, fp);
	511	if (rc)
	512	return rc;
	513	return 0;
	514	}
	515
	516	/*
	517	* cond_write_cond_av_list doesn't write out the av_list nodes.
	518	* Instead it writes out the key/value pairs from the avtab. This
	519	* is necessary because there is no way to uniquely identifying rules
	520	* in the avtab so it is not possible to associate individual rules
	521	* in the avtab with a conditional without saving them as part of
	522	* the conditional. This means that the avtab with the conditional
	523	* rules will not be saved but will be rebuilt on policy load.
	524	*/
	525	static int cond_write_av_list(struct policydb *p,
	526	struct cond_av_list list, struct policy_file fp)
	527	{
	528	__le32 buf[1];
	529	struct cond_av_list *cur_list;
	530	u32 len;
	531	int rc;
	532
	533	len = 0;
	534	for (cur_list = list; cur_list != NULL; cur_list = cur_list->next)
	535	len++;
	536
	537	buf[0] = cpu_to_le32(len);
	538	rc = put_entry(buf, sizeof(u32), 1, fp);
	539	if (rc)
	540	return rc;
	541
	542	if (len == 0)
	543	return 0;
	544
	545	for (cur_list = list; cur_list != NULL; cur_list = cur_list->next) {
	546	rc = avtab_write_item(p, cur_list->node, fp);
	547	if (rc)
	548	return rc;
	549	}
	550
	551	return 0;
	552	}
	553
	554	int cond_write_node(struct policydb p, struct cond_node node,
	555	struct policy_file *fp)
	556	{
557	struct cond_expr *cur_expr;
558	__le32 buf[2];
559	int rc;
560	u32 len = 0;
561
562	buf[0] = cpu_to_le32(node->cur_state);
563	rc = put_entry(buf, sizeof(u32), 1, fp);
564	if (rc)
565	return rc;
566
567	for (cur_expr = node->expr; cur_expr != NULL; cur_expr = cur_expr->next)
568	len++;
569
570	buf[0] = cpu_to_le32(len);
571	rc = put_entry(buf, sizeof(u32), 1, fp);
572	if (rc)
573	return rc;
574
575	for (cur_expr = node->expr; cur_expr != NULL; cur_expr = cur_expr->next) {
576	buf[0] = cpu_to_le32(cur_expr->expr_type);
577	buf[1] = cpu_to_le32(cur_expr->bool);
578	rc = put_entry(buf, sizeof(u32), 2, fp);
579	if (rc)
580	return rc;
581	}
582
583	rc = cond_write_av_list(p, node->true_list, fp);
584	if (rc)
585	return rc;
586	rc = cond_write_av_list(p, node->false_list, fp);
587	if (rc)
588	return rc;
589
590	return 0;
591	}
592
593	int cond_write_list(struct policydb p, struct cond_node list, void *fp)
594	{
595	struct cond_node *cur;
596	u32 len;
597	__le32 buf[1];
598	int rc;
599
600	len = 0;
601	for (cur = list; cur != NULL; cur = cur->next)
602	len++;
603	buf[0] = cpu_to_le32(len);
604	rc = put_entry(buf, sizeof(u32), 1, fp);
605	if (rc)
606	return rc;
607
608	for (cur = list; cur != NULL; cur = cur->next) {
609	rc = cond_write_node(p, cur, fp);
610	if (rc)
611	return rc;
612	}
613
614	return 0;
615	}
1da177e4 LT	616	/* Determine whether additional permissions are granted by the conditional
	617	* av table, and if so, add them to the result
	618	*/
	619	void cond_compute_av(struct avtab ctab, struct avtab_key key, struct av_decision *avd)
	620	{
	621	struct avtab_node *node;
	622
7c2b240e	623	if (!ctab \|\| !key \|\| !avd)
1da177e4 LT	624	return;
1da177e4 LT	625
dbc74c65	626	for (node = avtab_search_node(ctab, key); node;
782ebb99	627	node = avtab_search_node_next(node, key->specified)) {
7c2b240e EP	628	if ((u16)(AVTAB_ALLOWED\|AVTAB_ENABLED) ==
7c2b240e EP	629	(node->key.specified & (AVTAB_ALLOWED\|AVTAB_ENABLED)))
782ebb99	630	avd->allowed \|= node->datum.data;
7c2b240e EP	631	if ((u16)(AVTAB_AUDITDENY\|AVTAB_ENABLED) ==
7c2b240e EP	632	(node->key.specified & (AVTAB_AUDITDENY\|AVTAB_ENABLED)))
1da177e4 LT	633	/* Since a '0' in an auditdeny mask represents a
	634	* permission we do NOT want to audit (dontaudit), we use
	635	* the '&' operand to ensure that all '0's in the mask
	636	* are retained (much unlike the allow and auditallow cases).
	637	*/
782ebb99	638	avd->auditdeny &= node->datum.data;
7c2b240e EP	639	if ((u16)(AVTAB_AUDITALLOW\|AVTAB_ENABLED) ==
7c2b240e EP	640	(node->key.specified & (AVTAB_AUDITALLOW\|AVTAB_ENABLED)))
782ebb99	641	avd->auditallow \|= node->datum.data;
1da177e4 LT	642	}
	643	return;
	644	}