| 2 | 2 |
* Author : Stephen Smalley, <sds@epoch.ncsc.mil>
|
| 3 | 3 |
*/
|
| 4 | 4 |
|
| 5 | |
/* Updated: David Caplan, <dac@tresys.com>
|
|
5 |
/*
|
|
6 |
* Updated: Trusted Computer Solutions, Inc. <dgoeddel@trustedcs.com>
|
|
7 |
*
|
|
8 |
* Support for enhanced MLS infrastructure.
|
|
9 |
*
|
|
10 |
* Updated: David Caplan, <dac@tresys.com>
|
| 6 | 11 |
*
|
| 7 | 12 |
* Added conditional policy language extensions
|
| 8 | 13 |
*
|
|
14 |
* Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
|
| 9 | 15 |
* Copyright (C) 2003 - 2004 Tresys Technology, LLC
|
| 10 | 16 |
* This program is free software; you can redistribute it and/or modify
|
| 11 | 17 |
* it under the terms of the GNU General Public License as published by
|
|
| 62 | 68 |
static int define_sens(void);
|
| 63 | 69 |
static int define_dominance(void);
|
| 64 | 70 |
static int define_category(void);
|
| 65 | |
static int define_level(void);
|
| 66 | |
static int define_common_base(void);
|
| 67 | |
static int define_av_base(void);
|
|
71 |
static int define_level(int range);
|
| 68 | 72 |
static int define_attrib(void);
|
| 69 | 73 |
static int define_typealias(void);
|
| 70 | 74 |
static int define_typeattribute(void);
|
|
| 75 | 79 |
static role_datum_t *merge_roles_dom(role_datum_t *r1,role_datum_t *r2);
|
| 76 | 80 |
static role_datum_t *define_role_dom(role_datum_t *r);
|
| 77 | 81 |
static int define_role_trans(void);
|
|
82 |
static int define_range_trans(void);
|
| 78 | 83 |
static int define_role_allow(void);
|
| 79 | 84 |
static int define_constraint(constraint_expr_t *expr);
|
|
85 |
static int define_validatetrans(constraint_expr_t *expr);
|
| 80 | 86 |
static int define_bool();
|
| 81 | 87 |
static int define_conditional(cond_expr_t *expr,cond_av_list_t *t_list, cond_av_list_t *f_list );
|
| 82 | 88 |
static cond_expr_t *define_cond_expr(uint32_t expr_type, void *arg1, void* arg2);
|
|
| 108 | 114 |
%type <ptr> cond_allow_def cond_auditallow_def cond_auditdeny_def cond_dontaudit_def
|
| 109 | 115 |
%type <ptr> cond_transition_def cond_te_avtab_def cond_rule_def
|
| 110 | 116 |
%type <ptr> role_def roles
|
| 111 | |
%type <valptr> cexpr cexpr_prim op roleop
|
|
117 |
%type <valptr> cexpr cexpr_prim op role_mls_op
|
| 112 | 118 |
%type <val> ipv4_addr_def number
|
| 113 | 119 |
|
| 114 | 120 |
%token PATH
|
|
| 116 | 122 |
%token COMMON
|
| 117 | 123 |
%token CLASS
|
| 118 | 124 |
%token CONSTRAIN
|
|
125 |
%token VALIDATETRANS
|
| 119 | 126 |
%token INHERITS
|
| 120 | 127 |
%token SID
|
| 121 | 128 |
%token ROLE
|
|
| 133 | 140 |
%token TYPE_MEMBER
|
| 134 | 141 |
%token TYPE_CHANGE
|
| 135 | 142 |
%token ROLE_TRANSITION
|
|
143 |
%token RANGE_TRANSITION
|
| 136 | 144 |
%token SENSITIVITY
|
| 137 | 145 |
%token DOMINANCE
|
| 138 | 146 |
%token DOM DOMBY INCOMP
|
| 139 | 147 |
%token CATEGORY
|
| 140 | 148 |
%token LEVEL
|
| 141 | |
%token RANGES
|
|
149 |
%token RANGE
|
|
150 |
%token MLSCONSTRAIN
|
|
151 |
%token MLSVALIDATETRANS
|
| 142 | 152 |
%token USER
|
| 143 | 153 |
%token NEVERALLOW
|
| 144 | 154 |
%token ALLOW
|
|
| 151 | 161 |
%token FSCON PORTCON NETIFCON NODECON
|
| 152 | 162 |
%token FSUSEXATTR FSUSETASK FSUSETRANS
|
| 153 | 163 |
%token GENFSCON
|
| 154 | |
%token U1 U2 R1 R2 T1 T2
|
|
164 |
%token U1 U2 U3 R1 R2 R3 T1 T2 T3 L1 L2 H1 H2
|
| 155 | 165 |
%token NOT AND OR XOR
|
| 156 | 166 |
%token CTRUE CFALSE
|
| 157 | 167 |
%token IDENTIFIER
|
|
| 210 | 220 |
opt_mls : mls
|
| 211 | 221 |
|
|
| 212 | 222 |
;
|
| 213 | |
mls : sensitivities dominance opt_categories levels base_perms
|
|
223 |
mls : sensitivities dominance opt_categories levels mlspolicy
|
| 214 | 224 |
;
|
| 215 | 225 |
sensitivities : sensitivity_def
|
| 216 | 226 |
| sensitivities sensitivity_def
|
|
| 241 | 251 |
levels : level_def
|
| 242 | 252 |
| levels level_def
|
| 243 | 253 |
;
|
| 244 | |
level_def : LEVEL identifier ':' id_comma_list ';'
|
| 245 | |
{if (define_level()) return -1;}
|
|
254 |
level_def : LEVEL identifier ':' identifier '.' identifier ';'
|
|
255 |
{if (define_level(1)) return -1;}
|
|
256 |
| LEVEL identifier ':' id_comma_list ';'
|
|
257 |
{if (define_level(0)) return -1;}
|
| 246 | 258 |
| LEVEL identifier ';'
|
| 247 | |
{if (define_level()) return -1;}
|
| 248 | |
;
|
| 249 | |
base_perms : opt_common_base av_base
|
| 250 | |
;
|
| 251 | |
opt_common_base : common_base
|
| 252 | |
|
|
| 253 | |
;
|
| 254 | |
common_base : common_base_def
|
| 255 | |
| common_base common_base_def
|
| 256 | |
;
|
| 257 | |
common_base_def : COMMON identifier '{' perm_base_list '}'
|
| 258 | |
{if (define_common_base()) return -1;}
|
| 259 | |
;
|
| 260 | |
av_base : av_base_def
|
| 261 | |
| av_base av_base_def
|
| 262 | |
;
|
| 263 | |
av_base_def : CLASS identifier '{' perm_base_list '}'
|
| 264 | |
{if (define_av_base()) return -1;}
|
| 265 | |
| CLASS identifier
|
| 266 | |
{if (define_av_base()) return -1;}
|
| 267 | |
;
|
| 268 | |
perm_base_list : perm_base
|
| 269 | |
| perm_base_list perm_base
|
| 270 | |
;
|
| 271 | |
perm_base : identifier ':' identifier
|
| 272 | |
{if (insert_separator(0)) return -1;}
|
| 273 | |
| identifier ':' '{' identifier_list '}'
|
| 274 | |
{if (insert_separator(0)) return -1;}
|
|
259 |
{if (define_level(0)) return -1;}
|
|
260 |
;
|
|
261 |
mlspolicy : mlspolicy_decl
|
|
262 |
| mlspolicy mlspolicy_decl
|
|
263 |
;
|
|
264 |
mlspolicy_decl : mlsconstraint_def
|
|
265 |
| mlsvalidatetrans_def
|
|
266 |
;
|
|
267 |
mlsconstraint_def : MLSCONSTRAIN names names cexpr ';'
|
|
268 |
{ if (define_constraint((constraint_expr_t*)$4)) return -1; }
|
|
269 |
;
|
|
270 |
mlsvalidatetrans_def : MLSVALIDATETRANS names cexpr ';'
|
|
271 |
{ if (define_validatetrans((constraint_expr_t*)$3)) return -1; }
|
| 275 | 272 |
;
|
| 276 | 273 |
te_rbac : te_rbac_decl
|
| 277 | 274 |
| te_rbac te_rbac_decl
|
|
| 291 | 288 |
| typeattribute_def
|
| 292 | 289 |
| bool_def
|
| 293 | 290 |
| transition_def
|
|
291 |
| range_trans_def
|
| 294 | 292 |
| te_avtab_def
|
| 295 | 293 |
| cond_stmt_def
|
| 296 | 294 |
;
|
|
| 411 | 409 |
| TYPE_CHANGE names names ':' names identifier ';'
|
| 412 | 410 |
{if (define_compute_type(AVTAB_CHANGE)) return -1;}
|
| 413 | 411 |
;
|
|
412 |
range_trans_def : RANGE_TRANSITION names names mls_range_def ';'
|
|
413 |
{ if (define_range_trans()) return -1; }
|
|
414 |
;
|
| 414 | 415 |
te_avtab_def : allow_def
|
| 415 | 416 |
| auditallow_def
|
| 416 | 417 |
| auditdeny_def
|
|
| 456 | 457 |
opt_constraints : constraints
|
| 457 | 458 |
|
|
| 458 | 459 |
;
|
| 459 | |
constraints : constraint_def
|
| 460 | |
| constraints constraint_def
|
|
460 |
constraints : constraint_decl
|
|
461 |
| constraints constraint_decl
|
|
462 |
;
|
|
463 |
constraint_decl : constraint_def
|
|
464 |
| validatetrans_def
|
| 461 | 465 |
;
|
| 462 | 466 |
constraint_def : CONSTRAIN names names cexpr ';'
|
| 463 | 467 |
{ if (define_constraint((constraint_expr_t*)$4)) return -1; }
|
|
468 |
;
|
|
469 |
validatetrans_def : VALIDATETRANS names cexpr ';'
|
|
470 |
{ if (define_validatetrans((constraint_expr_t*)$3)) return -1; }
|
| 464 | 471 |
;
|
| 465 | 472 |
cexpr : '(' cexpr ')'
|
| 466 | 473 |
{ $$ = $2; }
|
|
| 479 | 486 |
cexpr_prim : U1 op U2
|
| 480 | 487 |
{ $$ = define_cexpr(CEXPR_ATTR, CEXPR_USER, $2);
|
| 481 | 488 |
if ($$ == 0) return -1; }
|
| 482 | |
| R1 roleop R2
|
|
489 |
| R1 role_mls_op R2
|
| 483 | 490 |
{ $$ = define_cexpr(CEXPR_ATTR, CEXPR_ROLE, $2);
|
| 484 | 491 |
if ($$ == 0) return -1; }
|
| 485 | 492 |
| T1 op T2
|
|
| 491 | 498 |
| U2 op { if (insert_separator(1)) return -1; } user_names_push
|
| 492 | 499 |
{ $$ = define_cexpr(CEXPR_NAMES, (CEXPR_USER | CEXPR_TARGET), $2);
|
| 493 | 500 |
if ($$ == 0) return -1; }
|
|
501 |
| U3 op { if (insert_separator(1)) return -1; } user_names_push
|
|
502 |
{ $$ = define_cexpr(CEXPR_NAMES, (CEXPR_USER | CEXPR_XTARGET), $2);
|
|
503 |
if ($$ == 0) return -1; }
|
| 494 | 504 |
| R1 op { if (insert_separator(1)) return -1; } names_push
|
| 495 | 505 |
{ $$ = define_cexpr(CEXPR_NAMES, CEXPR_ROLE, $2);
|
| 496 | 506 |
if ($$ == 0) return -1; }
|
| 497 | 507 |
| R2 op { if (insert_separator(1)) return -1; } names_push
|
| 498 | 508 |
{ $$ = define_cexpr(CEXPR_NAMES, (CEXPR_ROLE | CEXPR_TARGET), $2);
|
| 499 | 509 |
if ($$ == 0) return -1; }
|
|
510 |
| R3 op { if (insert_separator(1)) return -1; } names_push
|
|
511 |
{ $$ = define_cexpr(CEXPR_NAMES, (CEXPR_ROLE | CEXPR_XTARGET), $2);
|
|
512 |
if ($$ == 0) return -1; }
|
| 500 | 513 |
| T1 op { if (insert_separator(1)) return -1; } names_push
|
| 501 | 514 |
{ $$ = define_cexpr(CEXPR_NAMES, CEXPR_TYPE, $2);
|
| 502 | 515 |
if ($$ == 0) return -1; }
|
| 503 | 516 |
| T2 op { if (insert_separator(1)) return -1; } names_push
|
| 504 | 517 |
{ $$ = define_cexpr(CEXPR_NAMES, (CEXPR_TYPE | CEXPR_TARGET), $2);
|
|
518 |
if ($$ == 0) return -1; }
|
|
519 |
| T3 op { if (insert_separator(1)) return -1; } names_push
|
|
520 |
{ $$ = define_cexpr(CEXPR_NAMES, (CEXPR_TYPE | CEXPR_XTARGET), $2);
|
| 505 | 521 |
if ($$ == 0) return -1; }
|
| 506 | 522 |
| SAMEUSER
|
| 507 | 523 |
{ $$ = define_cexpr(CEXPR_ATTR, CEXPR_USER, CEXPR_EQ);
|
|
| 512 | 528 |
| TARGET ROLE { if (insert_separator(1)) return -1; } names_push
|
| 513 | 529 |
{ $$ = define_cexpr(CEXPR_NAMES, (CEXPR_ROLE | CEXPR_TARGET), CEXPR_EQ);
|
| 514 | 530 |
if ($$ == 0) return -1; }
|
| 515 | |
| ROLE roleop
|
|
531 |
| ROLE role_mls_op
|
| 516 | 532 |
{ $$ = define_cexpr(CEXPR_ATTR, CEXPR_ROLE, $2);
|
| 517 | 533 |
if ($$ == 0) return -1; }
|
| 518 | 534 |
| SOURCE TYPE { if (insert_separator(1)) return -1; } names_push
|
|
| 521 | 537 |
| TARGET TYPE { if (insert_separator(1)) return -1; } names_push
|
| 522 | 538 |
{ $$ = define_cexpr(CEXPR_NAMES, (CEXPR_TYPE | CEXPR_TARGET), CEXPR_EQ);
|
| 523 | 539 |
if ($$ == 0) return -1; }
|
|
540 |
| L1 role_mls_op L2
|
|
541 |
{ $$ = define_cexpr(CEXPR_ATTR, CEXPR_L1L2, $2);
|
|
542 |
if ($$ == 0) return -1; }
|
|
543 |
| L1 role_mls_op H2
|
|
544 |
{ $$ = define_cexpr(CEXPR_ATTR, CEXPR_L1H2, $2);
|
|
545 |
if ($$ == 0) return -1; }
|
|
546 |
| H1 role_mls_op L2
|
|
547 |
{ $$ = define_cexpr(CEXPR_ATTR, CEXPR_H1L2, $2);
|
|
548 |
if ($$ == 0) return -1; }
|
|
549 |
| H1 role_mls_op H2
|
|
550 |
{ $$ = define_cexpr(CEXPR_ATTR, CEXPR_H1H2, $2);
|
|
551 |
if ($$ == 0) return -1; }
|
|
552 |
| L1 role_mls_op H1
|
|
553 |
{ $$ = define_cexpr(CEXPR_ATTR, CEXPR_L1H1, $2);
|
|
554 |
if ($$ == 0) return -1; }
|
|
555 |
| L2 role_mls_op H2
|
|
556 |
{ $$ = define_cexpr(CEXPR_ATTR, CEXPR_L2H2, $2);
|
|
557 |
if ($$ == 0) return -1; }
|
| 524 | 558 |
;
|
| 525 | 559 |
op : EQUALS
|
| 526 | 560 |
{ $$ = CEXPR_EQ; }
|
| 527 | 561 |
| NOTEQUAL
|
| 528 | 562 |
{ $$ = CEXPR_NEQ; }
|
| 529 | 563 |
;
|
| 530 | |
roleop : op
|
|
564 |
role_mls_op : op
|
| 531 | 565 |
{ $$ = $1; }
|
| 532 | 566 |
| DOM
|
| 533 | 567 |
{ $$ = CEXPR_DOM; }
|
|
| 542 | 576 |
user_id : identifier
|
| 543 | 577 |
| user_identifier
|
| 544 | 578 |
;
|
| 545 | |
user_def : USER user_id ROLES names opt_user_ranges ';'
|
|
579 |
user_def : USER user_id ROLES names opt_mls_user ';'
|
| 546 | 580 |
{if (define_user()) return -1;}
|
| 547 | 581 |
;
|
| 548 | |
opt_user_ranges : RANGES user_ranges
|
|
582 |
opt_mls_user : LEVEL mls_level_def RANGE mls_range_def
|
| 549 | 583 |
|
|
| 550 | |
;
|
| 551 | |
user_ranges : mls_range_def
|
| 552 | |
| '{' user_range_def_list '}'
|
| 553 | |
;
|
| 554 | |
user_range_def_list : mls_range_def
|
| 555 | |
| user_range_def_list mls_range_def
|
| 556 | 584 |
;
|
| 557 | 585 |
initial_sid_contexts : initial_sid_context_def
|
| 558 | 586 |
| initial_sid_contexts initial_sid_context_def
|
|
| 647 | 675 |
| mls_level_def
|
| 648 | 676 |
{if (insert_separator(0)) return -1;}
|
| 649 | 677 |
;
|
| 650 | |
mls_level_def : identifier ':' id_comma_list
|
|
678 |
mls_level_def : identifier ':' cat_comma_list
|
| 651 | 679 |
{if (insert_separator(0)) return -1;}
|
| 652 | 680 |
| identifier
|
| 653 | 681 |
{if (insert_separator(0)) return -1;}
|
| 654 | 682 |
;
|
|
683 |
cat_comma_list : cat_range
|
|
684 |
| cat_comma_list ',' cat_range
|
|
685 |
;
|
|
686 |
cat_range : identifier
|
|
687 |
| identifier '.' identifier
|
|
688 |
{ if (insert_id("MLS_CAT_RANGE",0)) return -1; }
|
|
689 |
;
|
| 655 | 690 |
id_comma_list : identifier
|
| 656 | 691 |
| id_comma_list ',' identifier
|
| 657 | 692 |
;
|
|
| 926 | 961 |
memset(perdatum, 0, sizeof(perm_datum_t));
|
| 927 | 962 |
perdatum->value = ++comdatum->permissions.nprim;
|
| 928 | 963 |
|
| 929 | |
#ifdef CONFIG_SECURITY_SELINUX_MLS
|
| 930 | |
/*
|
| 931 | |
* By default, we set all four base permissions on this
|
| 932 | |
* permission. This means that if base_permissions is not
|
| 933 | |
* explicitly defined for this permission, then this
|
| 934 | |
* permission will only be granted in the equivalent case.
|
| 935 | |
*/
|
| 936 | |
perdatum->base_perms = MLS_BASE_READ | MLS_BASE_WRITE |
|
| 937 | |
MLS_BASE_READBY | MLS_BASE_WRITEBY;
|
| 938 | |
#endif
|
| 939 | |
|
| 940 | |
if (perdatum->value >= (sizeof(access_vector_t) * 8)) {
|
|
964 |
if (perdatum->value > (sizeof(access_vector_t) * 8)) {
|
| 941 | 965 |
yyerror("too many permissions to fit in an access vector");
|
| 942 | 966 |
goto bad_perm;
|
| 943 | 967 |
}
|
|
| 1044 | 1068 |
memset(perdatum, 0, sizeof(perm_datum_t));
|
| 1045 | 1069 |
perdatum->value = ++cladatum->permissions.nprim;
|
| 1046 | 1070 |
|
| 1047 | |
#ifdef CONFIG_SECURITY_SELINUX_MLS
|
| 1048 | |
/*
|
| 1049 | |
* By default, we set all four base permissions on this
|
| 1050 | |
* permission. This means that if base_permissions is not
|
| 1051 | |
* explicitly defined for this permission, then this
|
| 1052 | |
* permission will only be granted in the equivalent case.
|
| 1053 | |
*/
|
| 1054 | |
perdatum->base_perms = MLS_BASE_READ | MLS_BASE_WRITE |
|
| 1055 | |
MLS_BASE_READBY | MLS_BASE_WRITEBY;
|
| 1056 | |
/* actual value set in define_av_base */
|
| 1057 | |
#endif
|
| 1058 | |
|
| 1059 | |
if (perdatum->value >= (sizeof(access_vector_t) * 8)) {
|
|
1071 |
if (perdatum->value > (sizeof(access_vector_t) * 8)) {
|
| 1060 | 1072 |
yyerror("too many permissions to fit in an access vector");
|
| 1061 | 1073 |
goto bad;
|
| 1062 | 1074 |
}
|
|
| 1102 | 1114 |
|
| 1103 | 1115 |
static int define_sens(void)
|
| 1104 | 1116 |
{
|
| 1105 | |
#ifdef CONFIG_SECURITY_SELINUX_MLS
|
| 1106 | 1117 |
char *id;
|
| 1107 | 1118 |
mls_level_t *level = 0;
|
| 1108 | 1119 |
level_datum_t *datum = 0, *aliasdatum = 0;
|
| 1109 | 1120 |
int ret;
|
| 1110 | 1121 |
|
|
1122 |
if (!mlspol) {
|
|
1123 |
yyerror("sensitivity definition in non-MLS configuration");
|
|
1124 |
return -1;
|
|
1125 |
}
|
| 1111 | 1126 |
|
| 1112 | 1127 |
if (pass == 2) {
|
| 1113 | 1128 |
while ((id = queue_remove(id_queue)))
|
|
| 1194 | 1209 |
if (aliasdatum)
|
| 1195 | 1210 |
free(aliasdatum);
|
| 1196 | 1211 |
return -1;
|
| 1197 | |
#else
|
| 1198 | |
yyerror("sensitivity definition in non-MLS configuration");
|
| 1199 | |
return -1;
|
| 1200 | |
#endif
|
| 1201 | 1212 |
}
|
| 1202 | 1213 |
|
| 1203 | 1214 |
static int define_dominance(void)
|
| 1204 | 1215 |
{
|
| 1205 | |
#ifdef CONFIG_SECURITY_SELINUX_MLS
|
| 1206 | 1216 |
level_datum_t *datum;
|
| 1207 | 1217 |
int order;
|
| 1208 | 1218 |
char *id;
|
|
1219 |
|
|
1220 |
if (!mlspol) {
|
|
1221 |
yyerror("dominance definition in non-MLS configuration");
|
|
1222 |
return -1;
|
|
1223 |
}
|
| 1209 | 1224 |
|
| 1210 | 1225 |
if (pass == 2) {
|
| 1211 | 1226 |
while ((id = queue_remove(id_queue)))
|
|
| 1240 | 1255 |
return -1;
|
| 1241 | 1256 |
}
|
| 1242 | 1257 |
return 0;
|
| 1243 | |
#else
|
| 1244 | |
yyerror("dominance definition in non-MLS configuration");
|
| 1245 | |
return -1;
|
| 1246 | |
#endif
|
| 1247 | 1258 |
}
|
| 1248 | 1259 |
|
| 1249 | 1260 |
static int define_category(void)
|
| 1250 | 1261 |
{
|
| 1251 | |
#ifdef CONFIG_SECURITY_SELINUX_MLS
|
| 1252 | 1262 |
char *id;
|
| 1253 | 1263 |
cat_datum_t *datum = 0, *aliasdatum = 0;
|
| 1254 | 1264 |
int ret;
|
|
1265 |
|
|
1266 |
if (!mlspol) {
|
|
1267 |
yyerror("category definition in non-MLS configuration");
|
|
1268 |
return -1;
|
|
1269 |
}
|
| 1255 | 1270 |
|
| 1256 | 1271 |
if (pass == 2) {
|
| 1257 | 1272 |
while ((id = queue_remove(id_queue)))
|
|
| 1326 | 1341 |
if (aliasdatum)
|
| 1327 | 1342 |
free(aliasdatum);
|
| 1328 | 1343 |
return -1;
|
| 1329 | |
#else
|
| 1330 | |
yyerror("category definition in non-MLS configuration");
|
| 1331 | |
return -1;
|
| 1332 | |
#endif
|
| 1333 | |
}
|
| 1334 | |
|
| 1335 | |
|
| 1336 | |
static int define_level(void)
|
| 1337 | |
{
|
| 1338 | |
#ifdef CONFIG_SECURITY_SELINUX_MLS
|
| 1339 | |
int n;
|
|
1344 |
}
|
|
1345 |
|
|
1346 |
|
|
1347 |
static int define_level(int range)
|
|
1348 |
{
|
|
1349 |
int i;
|
| 1340 | 1350 |
char *id, *levid;
|
| 1341 | 1351 |
level_datum_t *levdatum;
|
| 1342 | |
cat_datum_t *catdatum;
|
| 1343 | |
|
|
1352 |
cat_datum_t *catdatum = NULL;
|
|
1353 |
cat_datum_t *catdatum_r = NULL;
|
|
1354 |
|
|
1355 |
if (!mlspol) {
|
|
1356 |
yyerror("level definition in non-MLS configuration");
|
|
1357 |
return -1;
|
|
1358 |
}
|
| 1344 | 1359 |
|
| 1345 | 1360 |
if (pass == 2) {
|
| 1346 | 1361 |
while ((id = queue_remove(id_queue)))
|
|
| 1368 | 1383 |
return -1;
|
| 1369 | 1384 |
}
|
| 1370 | 1385 |
levid = id;
|
| 1371 | |
n = 1;
|
|
1386 |
|
| 1372 | 1387 |
while ((id = queue_remove(id_queue))) {
|
| 1373 | |
catdatum = (cat_datum_t *) hashtab_search(policydbp->p_cats.table,
|
| 1374 | |
(hashtab_key_t) id);
|
|
1388 |
catdatum =(cat_datum_t *)hashtab_search(policydbp->p_cats.table,
|
|
1389 |
(hashtab_key_t) id);
|
| 1375 | 1390 |
if (!catdatum) {
|
| 1376 | 1391 |
sprintf(errormsg, "unknown category %s used in level definition", id);
|
| 1377 | 1392 |
yyerror(errormsg);
|
|
| 1387 | 1402 |
/* no need to keep category name */
|
| 1388 | 1403 |
free(id);
|
| 1389 | 1404 |
|
| 1390 | |
n = n * 2;
|
|
1405 |
if (range)
|
|
1406 |
break;
|
|
1407 |
}
|
|
1408 |
|
|
1409 |
if (range)
|
|
1410 |
{
|
|
1411 |
id = queue_remove(id_queue);
|
|
1412 |
catdatum_r =(cat_datum_t *)hashtab_search(
|
|
1413 |
policydbp->p_cats.table,
|
|
1414 |
(hashtab_key_t) id);
|
|
1415 |
if (!catdatum_r) {
|
|
1416 |
sprintf(errormsg,
|
|
1417 |
"unknown category %s used in level definition",
|
|
1418 |
id);
|
|
1419 |
yyerror(errormsg);
|
|
1420 |
free(levid);
|
|
1421 |
free(id);
|
|
1422 |
return -1;
|
|
1423 |
}
|
|
1424 |
if (catdatum_r->value < catdatum->value)
|
|
1425 |
{
|
|
1426 |
yyerror("category range is negative");
|
|
1427 |
free(levid);
|
|
1428 |
free(id);
|
|
1429 |
return -1;
|
|
1430 |
}
|
|
1431 |
|
|
1432 |
for (i = catdatum->value; i < catdatum_r->value; i++)
|
|
1433 |
{
|
|
1434 |
if (ebitmap_set_bit(&levdatum->level->cat, i, TRUE)) {
|
|
1435 |
yyerror("out of memory");
|
|
1436 |
free(id);
|
|
1437 |
free(levid);
|
|
1438 |
return -1;
|
|
1439 |
}
|
|
1440 |
}
|
| 1391 | 1441 |
}
|
| 1392 | 1442 |
|
| 1393 | 1443 |
free(levid);
|
| 1394 | 1444 |
|
| 1395 | |
policydbp->nlevels += n;
|
| 1396 | |
|
| 1397 | 1445 |
return 0;
|
| 1398 | |
#else
|
| 1399 | |
yyerror("level definition in non-MLS configuration");
|
| 1400 | |
return -1;
|
| 1401 | |
#endif
|
| 1402 | |
}
|
| 1403 | |
|
| 1404 | |
|
| 1405 | |
static int define_common_base(void)
|
| 1406 | |
{
|
| 1407 | |
#ifdef CONFIG_SECURITY_SELINUX_MLS
|
| 1408 | |
char *id, *perm, *base;
|
| 1409 | |
common_datum_t *comdatum;
|
| 1410 | |
perm_datum_t *perdatum;
|
| 1411 | |
|
| 1412 | |
|
| 1413 | |
if (pass == 2) {
|
| 1414 | |
id = queue_remove(id_queue); free(id);
|
| 1415 | |
while ((id = queue_remove(id_queue))) {
|
| 1416 | |
free(id);
|
| 1417 | |
while ((id = queue_remove(id_queue))) {
|
| 1418 | |
free(id);
|
| 1419 | |
}
|
| 1420 | |
}
|
| 1421 | |
return 0;
|
| 1422 | |
}
|
| 1423 | |
|
| 1424 | |
id = (char *) queue_remove(id_queue);
|
| 1425 | |
if (!id) {
|
| 1426 | |
yyerror("no common name for common base definition?");
|
| 1427 | |
return -1;
|
| 1428 | |
}
|
| 1429 | |
comdatum = (common_datum_t *) hashtab_search(policydbp->p_commons.table,
|
| 1430 | |
(hashtab_key_t) id);
|
| 1431 | |
if (!comdatum) {
|
| 1432 | |
sprintf(errormsg, "common %s is not defined", id);
|
| 1433 | |
yyerror(errormsg);
|
| 1434 | |
free(id);
|
| 1435 | |
return -1;
|
| 1436 | |
}
|
| 1437 | |
while ((perm = queue_remove(id_queue))) {
|
| 1438 | |
perdatum = (perm_datum_t *) hashtab_search(comdatum->permissions.table,
|
| 1439 | |
(hashtab_key_t) perm);
|
| 1440 | |
if (!perdatum) {
|
| 1441 | |
sprintf(errormsg, "permission %s is not defined for common %s", perm, id);
|
| 1442 | |
yyerror(errormsg);
|
| 1443 | |
free(id);
|
| 1444 | |
free(perm);
|
| 1445 | |
return -1;
|
| 1446 | |
}
|
| 1447 | |
|
| 1448 | |
/*
|
| 1449 | |
* An explicit definition of base_permissions for this
|
| 1450 | |
* permission. Reset the value to zero.
|
| 1451 | |
*/
|
| 1452 | |
perdatum->base_perms = 0;
|
| 1453 | |
|
| 1454 | |
while ((base = queue_remove(id_queue))) {
|
| 1455 | |
if (!strcmp(base, "read"))
|
| 1456 | |
perdatum->base_perms |= MLS_BASE_READ;
|
| 1457 | |
else if (!strcmp(base, "write"))
|
| 1458 | |
perdatum->base_perms |= MLS_BASE_WRITE;
|
| 1459 | |
else if (!strcmp(base, "readby"))
|
| 1460 | |
perdatum->base_perms |= MLS_BASE_READBY;
|
| 1461 | |
else if (!strcmp(base, "writeby"))
|
| 1462 | |
perdatum->base_perms |= MLS_BASE_WRITEBY;
|
| 1463 | |
else if (strcmp(base, "none")) {
|
| 1464 | |
sprintf(errormsg, "base permission %s is not defined", base);
|
| 1465 | |
yyerror(errormsg);
|
| 1466 | |
free(base);
|
| 1467 | |
return -1;
|
| 1468 | |
}
|
| 1469 | |
free(base);
|
| 1470 | |
}
|
| 1471 | |
|
| 1472 | |
free(perm);
|
| 1473 | |
}
|
| 1474 | |
|
| 1475 | |
free(id);
|
| 1476 | |
|
| 1477 | |
return 0;
|
| 1478 | |
#else
|
| 1479 | |
yyerror("MLS base permission definition in non-MLS configuration");
|
| 1480 | |
return -1;
|
| 1481 | |
#endif
|
| 1482 | |
}
|
| 1483 | |
|
| 1484 | |
|
| 1485 | |
#ifdef CONFIG_SECURITY_SELINUX_MLS
|
| 1486 | |
static int common_base_set(hashtab_key_t key, hashtab_datum_t datum, void *p)
|
| 1487 | |
{
|
| 1488 | |
perm_datum_t *perdatum;
|
| 1489 | |
class_datum_t *cladatum;
|
| 1490 | |
|
| 1491 | |
perdatum = (perm_datum_t *) datum;
|
| 1492 | |
cladatum = (class_datum_t *) p;
|
| 1493 | |
|
| 1494 | |
if (perdatum->base_perms & MLS_BASE_READ)
|
| 1495 | |
cladatum->mlsperms.read |= (1 << (perdatum->value - 1));
|
| 1496 | |
|
| 1497 | |
if (perdatum->base_perms & MLS_BASE_WRITE)
|
| 1498 | |
cladatum->mlsperms.write |= (1 << (perdatum->value - 1));
|
| 1499 | |
|
| 1500 | |
if (perdatum->base_perms & MLS_BASE_READBY)
|
| 1501 | |
cladatum->mlsperms.readby |= (1 << (perdatum->value - 1));
|
| 1502 | |
|
| 1503 | |
if (perdatum->base_perms & MLS_BASE_WRITEBY)
|
| 1504 | |
cladatum->mlsperms.writeby |= (1 << (perdatum->value - 1));
|
| 1505 | |
|
| 1506 | |
return 0;
|
| 1507 | |
}
|
| 1508 | |
#endif
|
| 1509 | |
|
| 1510 | |
static int define_av_base(void)
|
| 1511 | |
{
|
| 1512 | |
#ifdef CONFIG_SECURITY_SELINUX_MLS
|
| 1513 | |
char *id, *base;
|
| 1514 | |
class_datum_t *cladatum;
|
| 1515 | |
perm_datum_t *perdatum;
|
| 1516 | |
|
| 1517 | |
if (pass == 2) {
|
| 1518 | |
id = queue_remove(id_queue); free(id);
|
| 1519 | |
while ((id = queue_remove(id_queue))) {
|
| 1520 | |
free(id);
|
| 1521 | |
while ((id = queue_remove(id_queue))) {
|
| 1522 | |
free(id);
|
| 1523 | |
}
|
| 1524 | |
}
|
| 1525 | |
return 0;
|
| 1526 | |
}
|
| 1527 | |
|
| 1528 | |
id = (char *) queue_remove(id_queue);
|
| 1529 | |
if (!id) {
|
| 1530 | |
yyerror("no tclass name for av base definition?");
|
| 1531 | |
return -1;
|
| 1532 | |
}
|
| 1533 | |
cladatum = (class_datum_t *) hashtab_search(policydbp->p_classes.table,
|
| 1534 | |
(hashtab_key_t) id);
|
| 1535 | |
if (!cladatum) {
|
| 1536 | |
sprintf(errormsg, "class %s is not defined", id);
|
| 1537 | |
yyerror(errormsg);
|
| 1538 | |
free(id);
|
| 1539 | |
return -1;
|
| 1540 | |
}
|
| 1541 | |
free(id);
|
| 1542 | |
|
| 1543 | |
/*
|
| 1544 | |
* Determine which common permissions should be included in each MLS
|
| 1545 | |
* vector for this access vector definition.
|
| 1546 | |
*/
|
| 1547 | |
if (cladatum->comdatum)
|
| 1548 | |
hashtab_map(cladatum->comdatum->permissions.table, common_base_set, cladatum);
|
| 1549 | |
|
| 1550 | |
while ((id = queue_remove(id_queue))) {
|
| 1551 | |
perdatum = (perm_datum_t *) hashtab_search(cladatum->permissions.table,
|
| 1552 | |
(hashtab_key_t) id);
|
| 1553 | |
if (!perdatum) {
|
| 1554 | |
sprintf(errormsg, "permission %s is not defined", id);
|
| 1555 | |
yyerror(errormsg);
|
| 1556 | |
free(id);
|
| 1557 | |
return -1;
|
| 1558 | |
}
|
| 1559 | |
/*
|
| 1560 | |
* An explicit definition of base_permissions for this
|
| 1561 | |
* permission. Reset the value to zero.
|
| 1562 | |
*/
|
| 1563 | |
perdatum->base_perms = 0;
|
| 1564 | |
|
| 1565 | |
while ((base = queue_remove(id_queue))) {
|
| 1566 | |
if (!strcmp(base, "read")) {
|
| 1567 | |
perdatum->base_perms |= MLS_BASE_READ;
|
| 1568 | |
} else if (!strcmp(base, "write")) {
|
| 1569 | |
perdatum->base_perms |= MLS_BASE_WRITE;
|
| 1570 | |
} else if (!strcmp(base, "readby")) {
|
| 1571 | |
perdatum->base_perms |= MLS_BASE_READBY;
|
| 1572 | |
} else if (!strcmp(base, "writeby")) {
|
| 1573 | |
perdatum->base_perms |= MLS_BASE_WRITEBY;
|
| 1574 | |
} else if (strcmp(base, "none")) {
|
| 1575 | |
sprintf(errormsg, "base permission %s is not defined", base);
|
| 1576 | |
yyerror(errormsg);
|
| 1577 | |
free(base);
|
| 1578 | |
continue;
|
| 1579 | |
}
|
| 1580 | |
free(base);
|
| 1581 | |
}
|
| 1582 | |
|
| 1583 | |
free(id);
|
| 1584 | |
}
|
| 1585 | |
|
| 1586 | |
/* Set MLS base permission masks */
|
| 1587 | |
hashtab_map(cladatum->permissions.table, common_base_set, cladatum);
|
| 1588 | |
|
| 1589 | |
return 0;
|
| 1590 | |
#else
|
| 1591 | |
yyerror("MLS base permission definition in non-MLS configuration");
|
| 1592 | |
return -1;
|
| 1593 | |
#endif
|
| 1594 | 1446 |
}
|
| 1595 | 1447 |
|
| 1596 | 1448 |
static int define_attrib(void)
|
|
| 1690 | 1542 |
return 0;
|
| 1691 | 1543 |
}
|
| 1692 | 1544 |
|
| 1693 | |
#ifdef CONFIG_SECURITY_SELINUX_MLS
|
| 1694 | |
static int handle_mls_attributes(char *id, unsigned int value)
|
| 1695 | |
{
|
| 1696 | |
if (!strcmp(id, "mlstrustedreader")) {
|
| 1697 | |
if (ebitmap_set_bit(&policydbp->trustedreaders, value, TRUE)) {
|
| 1698 | |
return -1;
|
| 1699 | |
}
|
| 1700 | |
} else if (!strcmp(id, "mlstrustedwriter")) {
|
| 1701 | |
if (ebitmap_set_bit(&policydbp->trustedwriters, value, TRUE)) {
|
| 1702 | |
return -1;
|
| 1703 | |
}
|
| 1704 | |
} else if (!strcmp(id, "mlstrustedobject")) {
|
| 1705 | |
if (ebitmap_set_bit(&policydbp->trustedobjects, value, TRUE)) {
|
| 1706 | |
return -1;
|
| 1707 | |
}
|
| 1708 | |
}
|
| 1709 | |
return 0;
|
| 1710 | |
}
|
| 1711 | |
#else /* CONFIG_SECURITY_SELINUX_MLS */
|
| 1712 | |
#define handle_mls_attributes(id, value) 0
|
| 1713 | |
#endif /* CONFIG_SECURITY_SELINUX_MLS */
|
| 1714 | |
|
| 1715 | 1545 |
static int define_typeattribute(void)
|
| 1716 | 1546 |
{
|
| 1717 | 1547 |
char *id;
|
|
| 1738 | 1568 |
}
|
| 1739 | 1569 |
|
| 1740 | 1570 |
while ((id = queue_remove(id_queue))) {
|
| 1741 | |
if (handle_mls_attributes(id, (t->value - 1))) {
|
| 1742 | |
yyerror("out of memory");
|
| 1743 | |
free(id);
|
| 1744 | |
return -1;
|
| 1745 | |
}
|
| 1746 | 1571 |
attr = hashtab_search(policydbp->p_types.table, id);
|
| 1747 | 1572 |
if (!attr) {
|
| 1748 | 1573 |
sprintf(errormsg, "attribute %s is not declared", id);
|
|
| 1851 | 1676 |
}
|
| 1852 | 1677 |
|
| 1853 | 1678 |
while ((id = queue_remove(id_queue))) {
|
| 1854 | |
if (handle_mls_attributes(id, (datum->value - 1))) {
|
| 1855 | |
yyerror("out of memory");
|
| 1856 | |
free(id);
|
| 1857 | |
return -1;
|
| 1858 | |
}
|
| 1859 | 1679 |
attr = hashtab_search(policydbp->p_types.table, id);
|
| 1860 | 1680 |
if (!attr) {
|
| 1861 | 1681 |
sprintf(errormsg, "attribute %s is not declared", id);
|
|
| 3374 | 3194 |
break;
|
| 3375 | 3195 |
case CEXPR_ATTR:
|
| 3376 | 3196 |
case CEXPR_NAMES:
|
|
3197 |
if (e->attr & CEXPR_XTARGET) {
|
|
3198 |
yyerror("illegal constraint expression");
|
|
3199 |
return -1; /* only for validatetrans rules */
|
|
3200 |
}
|
| 3377 | 3201 |
if (depth == (CEXPR_MAXDEPTH-1)) {
|
| 3378 | 3202 |
yyerror("constraint expression is too deep");
|
| 3379 | 3203 |
return -1;
|
|
| 3453 | 3277 |
|
| 3454 | 3278 |
return 0;
|
| 3455 | 3279 |
}
|
|
3280 |
|
|
3281 |
static int define_validatetrans(constraint_expr_t *expr)
|
|
3282 |
{
|
|
3283 |
struct constraint_node *node;
|
|
3284 |
char *id;
|
|
3285 |
class_datum_t *cladatum;
|
|
3286 |
ebitmap_t classmap;
|
|
3287 |
constraint_expr_t *e;
|
|
3288 |
int depth;
|
|
3289 |
|
|
3290 |
if (pass == 1) {
|
|
3291 |
while ((id = queue_remove(id_queue)))
|
|
3292 |
free(id);
|
|
3293 |
return 0;
|
|
3294 |
}
|
|
3295 |
|
|
3296 |
depth = -1;
|
|
3297 |
for (e = expr; e; e = e->next) {
|
|
3298 |
switch (e->expr_type) {
|
|
3299 |
case CEXPR_NOT:
|
|
3300 |
if (depth < 0) {
|
|
3301 |
yyerror("illegal validatetrans expression");
|
|
3302 |
return -1;
|
|
3303 |
}
|
|
3304 |
break;
|
|
3305 |
case CEXPR_AND:
|
|
3306 |
case CEXPR_OR:
|
|
3307 |
if (depth < 1) {
|
|
3308 |
yyerror("illegal validatetrans expression");
|
|
3309 |
return -1;
|
|
3310 |
}
|
|
3311 |
depth--;
|
|
3312 |
break;
|
|
3313 |
case CEXPR_ATTR:
|
|
3314 |
case CEXPR_NAMES:
|
|
3315 |
if (depth == (CEXPR_MAXDEPTH - 1)) {
|
|
3316 |
yyerror("validatetrans expression is too deep");
|
|
3317 |
return -1;
|
|
3318 |
}
|
|
3319 |
depth++;
|
|
3320 |
break;
|
|
3321 |
default:
|
|
3322 |
yyerror("illegal validatetrans expression");
|
|
3323 |
return -1;
|
|
3324 |
}
|
|
3325 |
}
|
|
3326 |
if (depth != 0) {
|
|
3327 |
yyerror("illegal validatetrans expression");
|
|
3328 |
return -1;
|
|
3329 |
}
|
|
3330 |
|
|
3331 |
ebitmap_init(&classmap);
|
|
3332 |
while ((id = queue_remove(id_queue))) {
|
|
3333 |
cladatum = (class_datum_t *)hashtab_search(policydbp->p_classes.table, (hashtab_key_t)id);
|
|
3334 |
if (!cladatum) {
|
|
3335 |
sprintf(errormsg, "class %s is not defined", id);
|
|
3336 |
ebitmap_destroy(&classmap);
|
|
3337 |
yyerror(errormsg);
|
|
3338 |
free(id);
|
|
3339 |
return -1;
|
|
3340 |
}
|
|
3341 |
if (ebitmap_set_bit(&classmap, (cladatum->value - 1), TRUE)) {
|
|
3342 |
yyerror("out of memory");
|
|
3343 |
ebitmap_destroy(&classmap);
|
|
3344 |
free(id);
|
|
3345 |
return -1;
|
|
3346 |
}
|
|
3347 |
|
|
3348 |
node = malloc(sizeof(struct constraint_node));
|
|
3349 |
if (!node) {
|
|
3350 |
yyerror("out of memory");
|
|
3351 |
return -1;
|
|
3352 |
}
|
|
3353 |
memset(node, 0, sizeof(constraint_node_t));
|
|
3354 |
node->expr = expr;
|
|
3355 |
node->permissions = 0;
|
|
3356 |
|
|
3357 |
node->next = cladatum->validatetrans;
|
|
3358 |
cladatum->validatetrans = node;
|
|
3359 |
|
|
3360 |
free(id);
|
|
3361 |
}
|
|
3362 |
|
|
3363 |
ebitmap_destroy(&classmap);
|
|
3364 |
|
|
3365 |
return 0;
|
|
3366 |
}
|
|
3367 |
|
| 3456 | 3368 |
|
| 3457 | 3369 |
static uintptr_t
|
| 3458 | 3370 |
define_cexpr(uint32_t expr_type, uintptr_t arg1, uintptr_t arg2)
|
|
| 3965 | 3877 |
char *id;
|
| 3966 | 3878 |
user_datum_t *usrdatum;
|
| 3967 | 3879 |
int ret;
|
| 3968 | |
#ifdef CONFIG_SECURITY_SELINUX_MLS
|
| 3969 | |
mls_range_list_t *rnode;
|
| 3970 | 3880 |
level_datum_t *levdatum;
|
| 3971 | |
cat_datum_t *catdatum;
|
| 3972 | |
int relation, l;
|
|
3881 |
cat_datum_t *catdatum = NULL;
|
|
3882 |
cat_datum_t *catdatum_r = NULL;
|
|
3883 |
int l, i;
|
| 3973 | 3884 |
char *levid;
|
| 3974 | |
#endif
|
| 3975 | 3885 |
|
| 3976 | 3886 |
if (pass == 1) {
|
| 3977 | 3887 |
while ((id = queue_remove(id_queue)))
|
| 3978 | 3888 |
free(id);
|
| 3979 | |
#ifdef CONFIG_SECURITY_SELINUX_MLS
|
| 3980 | |
while ((id = queue_remove(id_queue))) {
|
| 3981 | |
free(id);
|
|
3889 |
if (mlspol) {
|
|
3890 |
while ((id = queue_remove(id_queue)))
|
|
3891 |
free(id);
|
|
3892 |
id = queue_remove(id_queue); free(id);
|
| 3982 | 3893 |
for (l = 0; l < 2; l++) {
|
| 3983 | 3894 |
while ((id = queue_remove(id_queue))) {
|
| 3984 | 3895 |
free(id);
|
| 3985 | 3896 |
}
|
| 3986 | |
}
|
| 3987 | |
}
|
| 3988 | |
#endif
|
|
3897 |
id = queue_remove(id_queue);
|
|
3898 |
if (!id)
|
|
3899 |
break;
|
|
3900 |
free(id);
|
|
3901 |
}
|
|
3902 |
}
|
| 3989 | 3903 |
return 0;
|
| 3990 | 3904 |
}
|
| 3991 | 3905 |
|
|
| 4022 | 3936 |
continue;
|
| 4023 | 3937 |
}
|
| 4024 | 3938 |
|
| 4025 | |
#ifdef CONFIG_SECURITY_SELINUX_MLS
|
| 4026 | |
id = queue_remove(id_queue);
|
| 4027 | |
if (!id) {
|
| 4028 | |
rnode = (mls_range_list_t *) malloc(sizeof(mls_range_list_t));
|
| 4029 | |
if (!rnode) {
|
| 4030 | |
yyerror("out of memory");
|
| 4031 | |
free(id);
|
|
3939 |
if (mlspol) {
|
|
3940 |
id = queue_remove(id_queue);
|
|
3941 |
if (!id) {
|
|
3942 |
yyerror("no default level specified for user");
|
| 4032 | 3943 |
return -1;
|
| 4033 | 3944 |
}
|
| 4034 | |
memset(rnode, 0, sizeof(mls_range_list_t));
|
| 4035 | |
levdatum = (level_datum_t *) hashtab_search(policydbp->p_levels.table,
|
| 4036 | |
(hashtab_key_t) "unclassified");
|
|
3945 |
|
|
3946 |
levdatum = (level_datum_t *)
|
|
3947 |
hashtab_search(policydbp->p_levels.table,
|
|
3948 |
(hashtab_key_t) id);
|
| 4037 | 3949 |
if (!levdatum) {
|
| 4038 | |
yyerror("no range for user");
|
|
3950 |
sprintf(errormsg, "unknown sensitivity %s used in user"
|
|
3951 |
" level definition", id);
|
|
3952 |
yyerror(errormsg);
|
|
3953 |
free(id);
|
| 4039 | 3954 |
return -1;
|
| 4040 | 3955 |
}
|
| 4041 | |
rnode->range.level[0].sens = levdatum->level->sens;
|
| 4042 | |
rnode->range.level[1].sens = levdatum->level->sens;
|
| 4043 | |
rnode->next = usrdatum->ranges;
|
| 4044 | |
usrdatum->ranges = rnode;
|
| 4045 | |
goto skip_mls;
|
| 4046 | |
}
|
| 4047 | |
do {
|
| 4048 | |
rnode = (mls_range_list_t *) malloc(sizeof(mls_range_list_t));
|
| 4049 | |
if (!rnode) {
|
| 4050 | |
yyerror("out of memory");
|
| 4051 | |
free(id);
|
| 4052 | |
return -1;
|
| 4053 | |
}
|
| 4054 | |
memset(rnode, 0, sizeof(mls_range_list_t));
|
|
3956 |
|
|
3957 |
usrdatum->dfltlevel.sens = levdatum->level->sens;
|
|
3958 |
ebitmap_init(&usrdatum->dfltlevel.cat);
|
|
3959 |
|
|
3960 |
levid = id;
|
|
3961 |
|
|
3962 |
while ((id = queue_remove(id_queue))) {
|
|
3963 |
/* Check for ranged entry */
|
|
3964 |
if (strcmp(id, "MLS_CAT_RANGE") == 0) {
|
|
3965 |
free(id);
|
|
3966 |
if (catdatum_r->value >= catdatum->value) {
|
|
3967 |
yyerror("category range is negative");
|
|
3968 |
free(levid);
|
|
3969 |
return -1;
|
|
3970 |
}
|
|
3971 |
|
|
3972 |
for (i=catdatum_r->value;
|
|
3973 |
i<catdatum->value-1; i++) {
|
|
3974 |
if (!ebitmap_get_bit(&levdatum->level->cat, i)) {
|
|
3975 |
sprintf(errormsg, "category value=%d cannot be associated with level %s", i+1, levid);
|
|
3976 |
yyerror(errormsg);
|
|
3977 |
continue;
|
|
3978 |
}
|
|
3979 |
if (ebitmap_set_bit(&usrdatum->dfltlevel.cat, i, TRUE)) {
|
|
3980 |
yyerror("out of memory");
|
|
3981 |
free(levid);
|
|
3982 |
return -1;
|
|
3983 |
}
|
|
3984 |
}
|
|
3985 |
continue;
|
|
3986 |
}
|
|
3987 |
/* Save previous entry */
|
|
3988 |
catdatum_r = catdatum;
|
|
3989 |
|
|
3990 |
catdatum = (cat_datum_t *)
|
|
3991 |
hashtab_search(policydbp->p_cats.table,
|
|
3992 |
(hashtab_key_t) id);
|
|
3993 |
if (!catdatum) {
|
|
3994 |
sprintf(errormsg, "unknown category %s used in user range definition", id);
|
|
3995 |
yyerror(errormsg);
|
|
3996 |
free(id);
|
|
3997 |
continue;
|
|
3998 |
}
|
|
3999 |
if (!ebitmap_get_bit(&levdatum->level->cat, catdatum->value - 1)) {
|
|
4000 |
sprintf(errormsg, "category %s cannot be associated with level %s", id, levid);
|
|
4001 |
yyerror(errormsg);
|
|
4002 |
free(id);
|
|
4003 |
continue;
|
|
4004 |
}
|
|
4005 |
if (ebitmap_set_bit(&usrdatum->dfltlevel.cat, catdatum->value - 1, TRUE)) {
|
|
4006 |
yyerror("out of memory");
|
|
4007 |
free(id);
|
|
4008 |
free(levid);
|
|
4009 |
ebitmap_destroy(&usrdatum->dfltlevel.cat);
|
|
4010 |
return -1;
|
|
4011 |
}
|
|
4012 |
free(id);
|
|
4013 |
}
|
|
4014 |
|
|
4015 |
free(levid);
|
|
4016 |
|
|
4017 |
id = queue_remove(id_queue);
|
| 4055 | 4018 |
|
| 4056 | 4019 |
for (l = 0; l < 2; l++) {
|
| 4057 | |
levdatum = (level_datum_t *) hashtab_search(policydbp->p_levels.table,
|
|
4020 |
levdatum = (level_datum_t *)
|
|
4021 |
hashtab_search(policydbp->p_levels.table,
|
| 4058 | 4022 |
(hashtab_key_t) id);
|
| 4059 | 4023 |
if (!levdatum) {
|
| 4060 | 4024 |
sprintf(errormsg, "unknown sensitivity %s used in user range definition", id);
|
| 4061 | 4025 |
yyerror(errormsg);
|
| 4062 | |
free(rnode);
|
| 4063 | 4026 |
free(id);
|
| 4064 | 4027 |
continue;
|
| 4065 | 4028 |
}
|
| 4066 | |
rnode->range.level[l].sens = levdatum->level->sens;
|
| 4067 | |
ebitmap_init(&rnode->range.level[l].cat);
|
|
4029 |
usrdatum->range.level[l].sens = levdatum->level->sens;
|
|
4030 |
ebitmap_init(&usrdatum->range.level[l].cat);
|
| 4068 | 4031 |
|
| 4069 | 4032 |
levid = id;
|
| 4070 | 4033 |
|
| 4071 | 4034 |
while ((id = queue_remove(id_queue))) {
|
| 4072 | |
catdatum = (cat_datum_t *) hashtab_search(policydbp->p_cats.table,
|
| 4073 | |
(hashtab_key_t) id);
|
|
4035 |
/* Check for ranged entry */
|
|
4036 |
if (strcmp(id, "MLS_CAT_RANGE") == 0) {
|
|
4037 |
free(id);
|
|
4038 |
if (catdatum_r->value >= catdatum->value) {
|
|
4039 |
yyerror("category range is negative");
|
|
4040 |
free(levid);
|
|
4041 |
return -1;
|
|
4042 |
}
|
|
4043 |
|
|
4044 |
for (i=catdatum_r->value; i<catdatum->value-1; i++) {
|
|
4045 |
if (!ebitmap_get_bit(&levdatum->level->cat, i)) {
|
|
4046 |
sprintf(errormsg, "category value=%d cannot be associated with level %s", i+1, levid);
|
|
4047 |
yyerror(errormsg);
|
|
4048 |
continue;
|
|
4049 |
}
|
|
4050 |
if (ebitmap_set_bit(&usrdatum->range.level[l].cat, i, TRUE)) {
|
|
4051 |
yyerror("out of memory");
|
|
4052 |
free(levid);
|
|
4053 |
return -1;
|
|
4054 |
}
|
|
4055 |
}
|
|
4056 |
continue;
|
|
4057 |
}
|
|
4058 |
/* Save previous entry */
|
|
4059 |
catdatum_r = catdatum;
|
|
4060 |
|
|
4061 |
catdatum = (cat_datum_t *)
|
|
4062 |
hashtab_search(policydbp->p_cats.table,
|
|
4063 |
(hashtab_key_t) id);
|
| 4074 | 4064 |
if (!catdatum) {
|
| 4075 | 4065 |
sprintf(errormsg, "unknown category %s used in user range definition", id);
|
| 4076 | 4066 |
yyerror(errormsg);
|
| 4077 | 4067 |
free(id);
|
| 4078 | 4068 |
continue;
|
| 4079 | 4069 |
}
|
| 4080 | |
if (!(ebitmap_get_bit(&levdatum->level->cat, catdatum->value - 1))) {
|
| 4081 | |
sprintf(errormsg, "category %s cannot be associated with level %s", id, levid);
|
|
4070 |
if (!ebitmap_get_bit(&levdatum->level->cat,
|
|
4071 |
catdatum->value - 1)) {
|
|
4072 |
sprintf(errormsg,"category %s cannot be associated with level %s", id, levid);
|
| 4082 | 4073 |
yyerror(errormsg);
|
| 4083 | 4074 |
free(id);
|
| 4084 | 4075 |
continue;
|
| 4085 | 4076 |
}
|
| 4086 | |
if (ebitmap_set_bit(&rnode->range.level[l].cat, catdatum->value - 1, TRUE)) {
|
|
4077 |
if (ebitmap_set_bit(&usrdatum->range.level[l].cat, catdatum->value - 1, TRUE)) {
|
| 4087 | 4078 |
yyerror("out of memory");
|
| 4088 | 4079 |
free(id);
|
| 4089 | 4080 |
free(levid);
|
| 4090 | |
ebitmap_destroy(&rnode->range.level[l].cat);
|
| 4091 | |
free(rnode);
|
|
4081 |
ebitmap_destroy(&usrdatum->dfltlevel.cat);
|
|
4082 |
ebitmap_destroy(&usrdatum->range.level[l].cat);
|
| 4092 | 4083 |
return -1;
|
| 4093 | 4084 |
}
|
| 4094 | 4085 |
|
|
| 4109 | 4100 |
}
|
| 4110 | 4101 |
|
| 4111 | 4102 |
if (l == 0) {
|
| 4112 | |
rnode->range.level[1].sens = rnode->range.level[0].sens;
|
| 4113 | |
if (ebitmap_cpy(&rnode->range.level[1].cat, &rnode->range.level[0].cat)) {
|
|
4103 |
usrdatum->range.level[1].sens =
|
|
4104 |
usrdatum->range.level[0].sens;
|
|
4105 |
if (ebitmap_cpy(&usrdatum->range.level[1].cat,
|
|
4106 |
&usrdatum->range.level[0].cat)) {
|
| 4114 | 4107 |
yyerror("out of memory");
|
| 4115 | |
free(id);
|
| 4116 | |
ebitmap_destroy(&rnode->range.level[0].cat);
|
| 4117 | |
free(rnode);
|
| 4118 | |
return -1;
|
| 4119 | |
}
|
| 4120 | |
}
|
| 4121 | |
relation = mls_level_relation(rnode->range.level[1], rnode->range.level[0]);
|
| 4122 | |
if (!(relation & (MLS_RELATION_DOM | MLS_RELATION_EQ))) {
|
| 4123 | |
/* high does not dominate low */
|
| 4124 | |
yyerror("high does not dominate low");
|
| 4125 | |
ebitmap_destroy(&rnode->range.level[0].cat);
|
| 4126 | |
ebitmap_destroy(&rnode->range.level[1].cat);
|
| 4127 | |
free(rnode);
|
| 4128 | |
return -1;
|
| 4129 | |
}
|
| 4130 | |
rnode->next = usrdatum->ranges;
|
| 4131 | |
usrdatum->ranges = rnode;
|
| 4132 | |
} while ((id = queue_remove(id_queue)));
|
| 4133 | |
skip_mls:
|
| 4134 | |
#endif
|
| 4135 | |
|
|
4108 |
goto out;
|
|
4109 |
}
|
|
4110 |
}
|
|
4111 |
if (!mls_level_dom(&usrdatum->range.level[1],
|
|
4112 |
&usrdatum->range.level[0])) {
|
|
4113 |
yyerror("high level does not dominate low level");
|
|
4114 |
goto out;
|
|
4115 |
}
|
|
4116 |
if (!mls_level_between(&usrdatum->dfltlevel,
|
|
4117 |
&usrdatum->range.level[0],
|
|
4118 |
&usrdatum->range.level[1])) {
|
|
4119 |
yyerror("default level not within user range");
|
|
4120 |
goto out;
|
|
4121 |
}
|
|
4122 |
}
|
| 4136 | 4123 |
return 0;
|
|
4124 |
|
|
4125 |
out:
|
|
4126 |
ebitmap_destroy(&usrdatum->dfltlevel.cat);
|
|
4127 |
ebitmap_destroy(&usrdatum->range.level[0].cat);
|
|
4128 |
ebitmap_destroy(&usrdatum->range.level[1].cat);
|
|
4129 |
return -1;
|
| 4137 | 4130 |
}
|
| 4138 | 4131 |
|
| 4139 | 4132 |
|
|
| 4143 | 4136 |
role_datum_t *role;
|
| 4144 | 4137 |
type_datum_t *typdatum;
|
| 4145 | 4138 |
user_datum_t *usrdatum;
|
| 4146 | |
#ifdef CONFIG_SECURITY_SELINUX_MLS
|
| 4147 | 4139 |
char *levid;
|
| 4148 | 4140 |
level_datum_t *levdatum;
|
| 4149 | |
cat_datum_t *catdatum;
|
| 4150 | |
int l;
|
| 4151 | |
#endif
|
|
4141 |
cat_datum_t *catdatum = NULL;
|
|
4142 |
cat_datum_t *catdatum_r = NULL;
|
|
4143 |
int l, i;
|
| 4152 | 4144 |
|
| 4153 | 4145 |
if (pass == 1) {
|
| 4154 | 4146 |
id = queue_remove(id_queue); free(id); /* user */
|
| 4155 | 4147 |
id = queue_remove(id_queue); free(id); /* role */
|
| 4156 | 4148 |
id = queue_remove(id_queue); free(id); /* type */
|
| 4157 | |
#ifdef CONFIG_SECURITY_SELINUX_MLS
|
| 4158 | |
id = queue_remove(id_queue); free(id);
|
| 4159 | |
for (l = 0; l < 2; l++) {
|
| 4160 | |
while ((id = queue_remove(id_queue))) {
|
| 4161 | |
free(id);
|
| 4162 | |
}
|
| 4163 | |
}
|
| 4164 | |
#endif
|
|
4149 |
if (mlspol) {
|
|
4150 |
id = queue_remove(id_queue); free(id);
|
|
4151 |
for (l = 0; l < 2; l++) {
|
|
4152 |
while ((id = queue_remove(id_queue))) {
|
|
4153 |
free(id);
|
|
4154 |
}
|
|
4155 |
id = queue_remove(id_queue);
|
|
4156 |
if (!id)
|
|
4157 |
break;
|
|
4158 |
free(id);
|
|
4159 |
}
|
|
4160 |
}
|
| 4165 | 4161 |
return 0;
|
| 4166 | 4162 |
}
|
| 4167 | 4163 |
|
|
| 4225 | 4221 |
/* no need to keep the type name */
|
| 4226 | 4222 |
free(id);
|
| 4227 | 4223 |
|
| 4228 | |
#ifdef CONFIG_SECURITY_SELINUX_MLS
|
| 4229 | |
/* extract the low sensitivity */
|
| 4230 | |
id = (char *) queue_head(id_queue);
|
| 4231 | |
if (!id || strcmp(id, "system_u") == 0 /* hack */) {
|
| 4232 | |
/* No MLS component to the security context. Try
|
| 4233 | |
to use a default 'unclassified' value. */
|
| 4234 | |
levdatum = (level_datum_t *) hashtab_search(policydbp->p_levels.table,
|
| 4235 | |
(hashtab_key_t) "unclassified");
|
| 4236 | |
if (!levdatum) {
|
| 4237 | |
yyerror("no sensitivity name for sid context definition?");
|
|
4224 |
if (mlspol) {
|
|
4225 |
/* extract the low sensitivity */
|
|
4226 |
id = (char *) queue_head(id_queue);
|
|
4227 |
if (!id) {
|
|
4228 |
yyerror("no sensitivity name for sid context"
|
|
4229 |
" definition?");
|
| 4238 | 4230 |
return -1;
|
| 4239 | 4231 |
}
|
| 4240 | |
c->range.level[0].sens = levdatum->level->sens;
|
| 4241 | |
c->range.level[1].sens = levdatum->level->sens;
|
| 4242 | |
goto skip_mls;
|
| 4243 | |
}
|
| 4244 | |
|
| 4245 | |
id = (char *) queue_remove(id_queue);
|
| 4246 | |
for (l = 0; l < 2; l++) {
|
| 4247 | |
levdatum = (level_datum_t *) hashtab_search(policydbp->p_levels.table,
|
|
4232 |
|
|
4233 |
id = (char *) queue_remove(id_queue);
|
|
4234 |
for (l = 0; l < 2; l++) {
|
|
4235 |
levdatum = (level_datum_t *)
|
|
4236 |
hashtab_search(policydbp->p_levels.table,
|
| 4248 | 4237 |
(hashtab_key_t) id);
|
| 4249 | |
if (!levdatum) {
|
| 4250 | |
sprintf(errormsg, "Sensitivity %s is not defined", id);
|
| 4251 | |
yyerror(errormsg);
|
| 4252 | |
free(id);
|
| 4253 | |
return -1;
|
| 4254 | |
}
|
| 4255 | |
c->range.level[l].sens = levdatum->level->sens;
|
| 4256 | |
|
| 4257 | |
/* extract low category set */
|
| 4258 | |
levid = id;
|
| 4259 | |
while ((id = queue_remove(id_queue))) {
|
| 4260 | |
catdatum = (cat_datum_t *) hashtab_search(policydbp->p_cats.table,
|
| 4261 | |
(hashtab_key_t) id);
|
| 4262 | |
if (!catdatum) {
|
| 4263 | |
sprintf(errormsg, "unknown category %s used in initial sid context", id);
|
|
4238 |
if (!levdatum) {
|
|
4239 |
sprintf(errormsg, "Sensitivity %s is not "
|
|
4240 |
"defined", id);
|
| 4264 | 4241 |
yyerror(errormsg);
|
| 4265 | |
free(levid);
|
| 4266 | 4242 |
free(id);
|
|
4243 |
return -1;
|
|
4244 |
}
|
|
4245 |
c->range.level[l].sens = levdatum->level->sens;
|
|
4246 |
|
|
4247 |
/* extract low category set */
|
|
4248 |
levid = id;
|
|
4249 |
while ((id = queue_remove(id_queue))) {
|
|
4250 |
/* Check for ranged entry */
|
|
4251 |
if (strcmp(id, "MLS_CAT_RANGE") == 0) {
|
|
4252 |
free(id);
|
|
4253 |
if (catdatum_r->value >=
|
|
4254 |
catdatum->value)
|
|
4255 |
{
|
|
4256 |
yyerror("category range is negative");
|
|
4257 |
free(levid);
|
|
4258 |
return -1;
|
|
4259 |
}
|
|
4260 |
|
|
4261 |
for (i = catdatum_r->value;
|
|
4262 |
i < catdatum->value-1; i++) {
|
|
4263 |
if (ebitmap_set_bit(&c->range.level[l].cat, i, TRUE)) {
|
|
4264 |
yyerror("out of memory");
|
|
4265 |
free(levid);
|
|
4266 |
return -1;
|
|
4267 |
}
|
|
4268 |
}
|
|
4269 |
continue;
|
|
4270 |
}
|
|
4271 |
/* Save previous entry */
|
|
4272 |
catdatum_r = catdatum;
|
|
4273 |
|
|
4274 |
catdatum = (cat_datum_t *)
|
|
4275 |
hashtab_search(policydbp->p_cats.table,
|
|
4276 |
(hashtab_key_t) id);
|
|
4277 |
if (!catdatum) {
|
|
4278 |
sprintf(errormsg, "unknown category %s used in initial sid context", id);
|
|
4279 |
yyerror(errormsg);
|
|
4280 |
free(levid);
|
|
4281 |
free(id);
|
|
4282 |
goto bad;
|
|
4283 |
}
|
|
4284 |
if (ebitmap_set_bit(&c->range.level[l].cat,
|
|
4285 |
catdatum->value - 1, TRUE)) {
|
|
4286 |
yyerror("out of memory");
|
|
4287 |
free(levid);
|
|
4288 |
free(id);
|
|
4289 |
goto bad;
|
|
4290 |
}
|
|
4291 |
/* no need to keep category name */
|
|
4292 |
free(id);
|
|
4293 |
}
|
|
4294 |
|
|
4295 |
/* no need to keep the sensitivity name */
|
|
4296 |
free(levid);
|
|
4297 |
|
|
4298 |
/* extract high sensitivity */
|
|
4299 |
id = (char *) queue_remove(id_queue);
|
|
4300 |
if (!id)
|
|
4301 |
break;
|
|
4302 |
}
|
|
4303 |
|
|
4304 |
if (l == 0) {
|
|
4305 |
c->range.level[1].sens = c->range.level[0].sens;
|
|
4306 |
if (ebitmap_cpy(&c->range.level[1].cat,
|
|
4307 |
&c->range.level[0].cat)) {
|
|
4308 |
|
|
4309 |
yyerror("out of memory");
|
| 4267 | 4310 |
goto bad;
|
| 4268 | 4311 |
}
|
| 4269 | |
if (ebitmap_set_bit(&c->range.level[l].cat,
|
| 4270 | |
catdatum->value - 1, TRUE)) {
|
| 4271 | |
yyerror("out of memory");
|
| 4272 | |
free(levid);
|
| 4273 | |
free(id);
|
| 4274 | |
goto bad;
|
| 4275 | |
}
|
| 4276 | |
/* no need to keep category name */
|
| 4277 | |
free(id);
|
| 4278 | |
}
|
| 4279 | |
|
| 4280 | |
/* no need to keep the sensitivity name */
|
| 4281 | |
free(levid);
|
| 4282 | |
|
| 4283 | |
/* extract high sensitivity */
|
| 4284 | |
id = (char *) queue_remove(id_queue);
|
| 4285 | |
if (!id)
|
| 4286 | |
break;
|
| 4287 | |
}
|
| 4288 | |
|
| 4289 | |
if (l == 0) {
|
| 4290 | |
c->range.level[1].sens = c->range.level[0].sens;
|
| 4291 | |
if (ebitmap_cpy(&c->range.level[1].cat, &c->range.level[0].cat)) {
|
| 4292 | |
|
| 4293 | |
yyerror("out of memory");
|
| 4294 | |
goto bad;
|
| 4295 | |
}
|
| 4296 | |
}
|
| 4297 | |
skip_mls:
|
| 4298 | |
#endif
|
|
4312 |
}
|
|
4313 |
}
|
| 4299 | 4314 |
|
| 4300 | 4315 |
if (!policydb_context_isvalid(policydbp, c)) {
|
| 4301 | 4316 |
yyerror("invalid security context");
|
|
| 4552 | 4567 |
|
| 4553 | 4568 |
if (pass == 1) {
|
| 4554 | 4569 |
parse_security_context(NULL);
|
|
4570 |
if (mlspol)
|
|
4571 |
free(queue_remove(id_queue));
|
| 4555 | 4572 |
return 0;
|
| 4556 | 4573 |
}
|
| 4557 | 4574 |
|
|
| 4573 | 4590 |
/* Create order of most specific to least retaining
|
| 4574 | 4591 |
the order specified in the configuration. */
|
| 4575 | 4592 |
head = policydbp->ocontexts[OCON_NODE];
|
| 4576 | |
for (l = NULL, c = head; c; l = c, c = c->next) {
|
|
4593 |
for (l = NULL, c = head; c; l = c, c = c->next) {
|
| 4577 | 4594 |
if (newc->u.node.mask > c->u.node.mask)
|
| 4578 | 4595 |
break;
|
| 4579 | 4596 |
}
|
|
| 4844 | 4861 |
return define_genfs_context_helper(queue_remove(id_queue), has_type);
|
| 4845 | 4862 |
}
|
| 4846 | 4863 |
|
|
4864 |
static int define_range_trans(void)
|
|
4865 |
{
|
|
4866 |
char *id;
|
|
4867 |
char *levid;
|
|
4868 |
level_datum_t *levdatum = 0;
|
|
4869 |
cat_datum_t *catdatum = NULL;
|
|
4870 |
cat_datum_t *catdatum_r = NULL;
|
|
4871 |
mls_range_t range;
|
|
4872 |
ebitmap_t doms, types, negset;
|
|
4873 |
range_trans_t *rt = 0;
|
|
4874 |
unsigned int i, j;
|
|
4875 |
int l, add = 1;
|
|
4876 |
|
|
4877 |
if (!mlspol) {
|
|
4878 |
yyerror("range_transition rule in non-MLS configuration");
|
|
4879 |
return -1;
|
|
4880 |
}
|
|
4881 |
|
|
4882 |
if (pass == 1) {
|
|
4883 |
while ((id = queue_remove(id_queue)))
|
|
4884 |
free(id);
|
|
4885 |
while ((id = queue_remove(id_queue)))
|
|
4886 |
free(id);
|
|
4887 |
id = queue_remove(id_queue); free(id);
|
|
4888 |
for (l = 0; l < 2; l++) {
|
|
4889 |
while ((id = queue_remove(id_queue))) {
|
|
4890 |
free(id);
|
|
4891 |
}
|
|
4892 |
id = queue_remove(id_queue);
|
|
4893 |
if (!id)
|
|
4894 |
break;
|
|
4895 |
free(id);
|
|
4896 |
}
|
|
4897 |
return 0;
|
|
4898 |
}
|
|
4899 |
|
|
4900 |
ebitmap_init(&doms);
|
|
4901 |
ebitmap_init(&types);
|
|
4902 |
|
|
4903 |
ebitmap_init(&negset);
|
|
4904 |
while ((id = queue_remove(id_queue))) {
|
|
4905 |
if (set_types(&doms, &negset, id, &add))
|
|
4906 |
return -1;
|
|
4907 |
}
|
|
4908 |
ebitmap_destroy(&negset);
|
|
4909 |
|
|
4910 |
ebitmap_init(&negset);
|
|
4911 |
while ((id = queue_remove(id_queue))) {
|
|
4912 |
if (set_types(&types, &negset, id, &add))
|
|
4913 |
return -1;
|
|
4914 |
}
|
|
4915 |
ebitmap_destroy(&negset);
|
|
4916 |
|
|
4917 |
id = (char *)queue_remove(id_queue);
|
|
4918 |
if (!id) {
|
|
4919 |
yyerror("no range in range_transition definition?");
|
|
4920 |
return -1;
|
|
4921 |
}
|
|
4922 |
for (l = 0; l < 2; l++) {
|
|
4923 |
levdatum = hashtab_search(policydbp->p_levels.table, id);
|
|
4924 |
if (!levdatum) {
|
|
4925 |
sprintf(errormsg, "unknown level %s used in range_transition definition", id);
|
|
4926 |
yyerror(errormsg);
|
|
4927 |
return -1;
|
|
4928 |
}
|
|
4929 |
range.level[l].sens = levdatum->level->sens;
|
|
4930 |
|
|
4931 |
levid = id;
|
|
4932 |
ebitmap_init(&range.level[l].cat);
|
|
4933 |
while ((id = queue_remove(id_queue))) {
|
|
4934 |
/* Check for ranged entry */
|
|
4935 |
if (strcmp(id, "MLS_CAT_RANGE") == 0) {
|
|
4936 |
free(id);
|
|
4937 |
if (catdatum_r->value >= catdatum->value) {
|
|
4938 |
yyerror("category range is negative");
|
|
4939 |
free(levid);
|
|
4940 |
return -1;
|
|
4941 |
}
|
|
4942 |
|
|
4943 |
for (i = catdatum_r->value; i < catdatum->value - 1; i++) {
|
|
4944 |
if (!ebitmap_get_bit(&levdatum->level->cat, i)) {
|
|
4945 |
sprintf(errormsg, "category value=%d cannot be associated with level %s", i+1, levid);
|
|
4946 |
yyerror(errormsg);
|
|
4947 |
continue;
|
|
4948 |
}
|
|
4949 |
if (ebitmap_set_bit(&range.level[l].cat, i, TRUE)) {
|
|
4950 |
yyerror("out of memory");
|
|
4951 |
free(levid);
|
|
4952 |
return -1;
|
|
4953 |
}
|
|
4954 |
}
|
|
4955 |
continue;
|
|
4956 |
}
|
|
4957 |
|
|
4958 |
/* Save previous entry */
|
|
4959 |
catdatum_r = catdatum;
|
|
4960 |
|
|
4961 |
catdatum = hashtab_search(policydbp->p_cats.table, id);
|
|
4962 |
if (!catdatum) {
|
|
4963 |
sprintf(errormsg, "unknown category %s used in range_transition definition", id);
|
|
4964 |
yyerror(errormsg);
|
|
4965 |
return -1;
|
|
4966 |
}
|
|
4967 |
if (!ebitmap_get_bit(&levdatum->level->cat, catdatum->value - 1)) {
|
|
4968 |
sprintf(errormsg, "category %s not allowed with specified sensitivity", id);
|
|
4969 |
yyerror(errormsg);
|
|
4970 |
return -1;
|
|
4971 |
}
|
|
4972 |
if (ebitmap_set_bit(&range.level[l].cat, catdatum->value - 1, TRUE)) {
|
|
4973 |
yyerror("out of memory");
|
|
4974 |
return -1;
|
|
4975 |
}
|
|
4976 |
free(id);
|
|
4977 |
}
|
|
4978 |
free(levid);
|
|
4979 |
|
|
4980 |
id = (char *)queue_remove(id_queue);
|
|
4981 |
if (!id)
|
|
4982 |
break;
|
|
4983 |
}
|
|
4984 |
if (l == 0) {
|
|
4985 |
range.level[1].sens = range.level[0].sens;
|
|
4986 |
if (ebitmap_cpy(&range.level[1].cat, &range.level[0].cat)) {
|
|
4987 |
yyerror("out of memory");
|
|
4988 |
return -1;
|
|
4989 |
}
|
|
4990 |
}
|
|
4991 |
|
|
4992 |
if (!mls_level_dom(&range.level[1], &range.level[0])) {
|
|
4993 |
yyerror("range_transition high level does not dominate low level");
|
|
4994 |
return -1;
|
|
4995 |
}
|
|
4996 |
|
|
4997 |
for (i = ebitmap_startbit(&doms); i < ebitmap_length(&doms); i++) {
|
|
4998 |
if (!ebitmap_get_bit(&doms, i))
|
|
4999 |
continue;
|
|
5000 |
for (j = ebitmap_startbit(&types); j < ebitmap_length(&types); j++) {
|
|
5001 |
if (!ebitmap_get_bit(&types, j))
|
|
5002 |
continue;
|
|
5003 |
|
|
5004 |
for (rt = policydbp->range_tr; rt; rt = rt->next) {
|
|
5005 |
if (rt->dom == (i + 1) && rt->type == (j + 1)) {
|
|
5006 |
sprintf(errormsg, "duplicate range_transition defined for (%s,%s)",
|
|
5007 |
type_val_to_name(i + 1), type_val_to_name(j + 1));
|
|
5008 |
yyerror(errormsg);
|
|
5009 |
return -1;
|
|
5010 |
}
|
|
5011 |
}
|
|
5012 |
|
|
5013 |
rt = malloc(sizeof(range_trans_t));
|
|
5014 |
if (!rt) {
|
|
5015 |
yyerror("out of memory");
|
|
5016 |
return -1;
|
|
5017 |
}
|
|
5018 |
memset(rt, 0, sizeof(range_trans_t));
|
|
5019 |
rt->dom = i + 1;
|
|
5020 |
rt->type = j + 1;
|
|
5021 |
rt->range.level[0].sens = range.level[0].sens;
|
|
5022 |
if (ebitmap_cpy(&rt->range.level[0].cat,
|
|
5023 |
&range.level[0].cat)) {
|
|
5024 |
yyerror("out of memory");
|
|
5025 |
free(rt);
|
|
5026 |
return -1;
|
|
5027 |
}
|
|
5028 |
rt->range.level[1].sens = range.level[1].sens;
|
|
5029 |
if (ebitmap_cpy(&rt->range.level[1].cat,
|
|
5030 |
&range.level[1].cat)) {
|
|
5031 |
yyerror("out of memory");
|
|
5032 |
free(rt);
|
|
5033 |
return -1;
|
|
5034 |
}
|
|
5035 |
rt->next = policydbp->range_tr;
|
|
5036 |
policydbp->range_tr = rt;
|
|
5037 |
}
|
|
5038 |
}
|
|
5039 |
|
|
5040 |
ebitmap_destroy(&doms);
|
|
5041 |
ebitmap_destroy(&types);
|
|
5042 |
ebitmap_destroy(&range.level[0].cat);
|
|
5043 |
ebitmap_destroy(&range.level[1].cat);
|
|
5044 |
return 0;
|
|
5045 |
}
|
|
5046 |
|
| 4847 | 5047 |
/* FLASK */
|
| 4848 | 5048 |
|
| 4849 | 5049 |
|