services.c

xen 3.2.2 源码

        context_struct_to_string(context, &s, &len);
        printk(KERN_ERR "security:  context %s is invalid\n", s);
        xfree(s);
    }
    return rc;
}

struct convert_context_args {
    struct policydb *oldp;
    struct policydb *newp;
};

/*
 * Convert the values in the security context
 * structure `c' from the values specified
 * in the policy `p->oldp' to the values specified
 * in the policy `p->newp'.  Verify that the
 * context is valid under the new policy.
 */
static int convert_context(u32 key, struct context *c, void *p)
{
    struct convert_context_args *args;
    struct context oldc;
    struct role_datum *role;
    struct type_datum *typdatum;
    struct user_datum *usrdatum;
    char *s;
    u32 len;
    int rc;

    args = p;

    rc = context_cpy(&oldc, c);
    if ( rc )
        goto out;

    rc = -EINVAL;

    /* Convert the user. */
    usrdatum = hashtab_search(args->newp->p_users.table,
                              args->oldp->p_user_val_to_name[c->user - 1]);
    if ( !usrdatum )
        goto bad;

    c->user = usrdatum->value;

    /* Convert the role. */
    role = hashtab_search(args->newp->p_roles.table,
                          args->oldp->p_role_val_to_name[c->role - 1]);
    if ( !role )
        goto bad;

    c->role = role->value;

    /* Convert the type. */
    typdatum = hashtab_search(args->newp->p_types.table,
                              args->oldp->p_type_val_to_name[c->type - 1]);
    if ( !typdatum )
        goto bad;

    c->type = typdatum->value;

    rc = mls_convert_context(args->oldp, args->newp, c);
    if ( rc )
        goto bad;

    /* Check the validity of the new context. */
    if ( !policydb_context_isvalid(args->newp, c) )
    {
        rc = convert_context_handle_invalid_context(&oldc);
        if ( rc )
            goto bad;
    }

    context_destroy(&oldc);
out:
    return rc;
bad:
    context_struct_to_string(&oldc, &s, &len);
    context_destroy(&oldc);
    printk(KERN_ERR "security:  invalidating context %s\n", s);
    xfree(s);
    goto out;
}

extern void flask_complete_init(void);

/**
 * security_load_policy - Load a security policy configuration.
 * @data: binary policy data
 * @len: length of data in bytes
 *
 * Load a new set of security policy configuration data,
 * validate it and convert the SID table as necessary.
 * This function will flush the access vector cache after
 * loading the new policy.
 */
int security_load_policy(void *data, size_t len)
{
    struct policydb oldpolicydb, newpolicydb;
    struct sidtab oldsidtab, newsidtab;
    struct convert_context_args args;
    u32 seqno;
    int rc = 0;
    struct policy_file file = { data, len }, *fp = &file;

    LOAD_LOCK;

    if ( !ss_initialized )
    {
        if ( policydb_read(&policydb, fp) )
        {
            LOAD_UNLOCK;
            return -EINVAL;
        }
        if ( policydb_load_isids(&policydb, &sidtab) )
        {
            LOAD_UNLOCK;
            policydb_destroy(&policydb);
            return -EINVAL;
        }
        policydb_loaded_version = policydb.policyvers;
        ss_initialized = 1;
        seqno = ++latest_granting;
        LOAD_UNLOCK;
        avc_ss_reset(seqno);
        return 0;
    }

#if 0
    sidtab_hash_eval(&sidtab, "sids");
#endif

    if ( policydb_read(&newpolicydb, fp) )
    {
        LOAD_UNLOCK;
        return -EINVAL;
    }

    sidtab_init(&newsidtab);

    /* Verify that the existing classes did not change. */
    if ( hashtab_map(policydb.p_classes.table, validate_class, &newpolicydb) )
    {
        printk(KERN_ERR "security:  the definition of an existing "
                                                            "class changed\n");
        rc = -EINVAL;
        goto err;
    }

    /* Clone the SID table. */
    sidtab_shutdown(&sidtab);
    if ( sidtab_map(&sidtab, clone_sid, &newsidtab) )
    {
        rc = -ENOMEM;
        goto err;
    }

    /* Convert the internal representations of contexts
       in the new SID table and remove invalid SIDs. */
    args.oldp = &policydb;
    args.newp = &newpolicydb;
    sidtab_map_remove_on_error(&newsidtab, convert_context, &args);

    /* Save the old policydb and SID table to free later. */
    memcpy(&oldpolicydb, &policydb, sizeof policydb);
    sidtab_set(&oldsidtab, &sidtab);

    /* Install the new policydb and SID table. */
    POLICY_WRLOCK;
    memcpy(&policydb, &newpolicydb, sizeof policydb);
    sidtab_set(&sidtab, &newsidtab);
    seqno = ++latest_granting;
    policydb_loaded_version = policydb.policyvers;
    POLICY_WRUNLOCK;
    LOAD_UNLOCK;

    /* Free the old policydb and SID table. */
    policydb_destroy(&oldpolicydb);
    sidtab_destroy(&oldsidtab);

    avc_ss_reset(seqno);

    return 0;

err:
    LOAD_UNLOCK;
    sidtab_destroy(&newsidtab);
    policydb_destroy(&newpolicydb);
    return rc;

}

/**
 * security_pirq_sid - Obtain the SID for a physical irq.
 * @pirq: physical irq
 * @out_sid: security identifier
 */
int security_pirq_sid(int pirq, u32 *out_sid)
{
    int rc = 0;
    struct ocontext *c;

    POLICY_RDLOCK;

    c = policydb.ocontexts[OCON_PIRQ];
    
    while ( c )
    {
        if ( c->u.pirq == pirq )
            break;
        c = c->next;
    }

    if ( c )
    {
        if ( !c->sid[0] )
        {
            rc = sidtab_context_to_sid(&sidtab, &c->context[0], &c->sid[0]);
            if ( rc )
                goto out;
        }
        *out_sid = c->sid[0];
    }
    else
    {
        *out_sid = SECINITSID_PIRQ;
    }

out:
    POLICY_RDUNLOCK;
    return rc;
}

/**
 * security_iomem_sid - Obtain the SID for a page of iomem.
 * @mfn: iomem mfn
 * @out_sid: security identifier
 */
int security_iomem_sid(unsigned long mfn, u32 *out_sid)
{
    struct ocontext *c;
    int rc = 0;

    POLICY_RDLOCK;

    c = policydb.ocontexts[OCON_IOMEM];
    while ( c )
    {
        if ( c->u.iomem == mfn )
            break;
        c = c->next;
    }

    if ( c )
    {
        if ( !c->sid[0] )
        {
            rc = sidtab_context_to_sid(&sidtab, &c->context[0], &c->sid[0]);
            if ( rc )
                goto out;
        }
        *out_sid = c->sid[0];
    }
    else
    {
        *out_sid = SECINITSID_IOMEM;
    }

out:
    POLICY_RDUNLOCK;
    return rc;
}

/**
 * security_ioport_sid - Obtain the SID for an ioport.
 * @ioport: ioport
 * @out_sid: security identifier
 */
int security_ioport_sid(u32 ioport, u32 *out_sid)
{
    struct ocontext *c;
    int rc = 0;

    POLICY_RDLOCK;

    c = policydb.ocontexts[OCON_IOPORT];
    while ( c )
    {
        if ( c->u.ioport == ioport )
            break;
        c = c->next;
    }

    if ( c )
    {
        if ( !c->sid[0] )
        {
            rc = sidtab_context_to_sid(&sidtab, &c->context[0], &c->sid[0]);
            if ( rc )
                goto out;
        }
        *out_sid = c->sid[0];
    }
    else
    {
        *out_sid = SECINITSID_IOPORT;
    }

out:
    POLICY_RDUNLOCK;
    return rc;
}

#define SIDS_NEL 25

/**
 * security_get_user_sids - Obtain reachable SIDs for a user.
 * @fromsid: starting SID
 * @username: username
 * @sids: array of reachable SIDs for user
 * @nel: number of elements in @sids
 *
 * Generate the set of SIDs for legal security contexts
 * for a given user that can be reached by @fromsid.
 * Set *@sids to point to a dynamically allocated
 * array containing the set of SIDs.  Set *@nel to the
 * number of elements in the array.
 */

int security_get_user_sids(u32 fromsid, char *username, u32 **sids, u32 *nel)
{
    struct context *fromcon, usercon;
    u32 *mysids, *mysids2, sid;
    u32 mynel = 0, maxnel = SIDS_NEL;
    struct user_datum *user;
    struct role_datum *role;
    struct av_decision avd;
    struct ebitmap_node *rnode, *tnode;
    int rc = 0, i, j;

    if ( !ss_initialized )
    {
        *sids = NULL;
        *nel = 0;
        goto out;
    }

    POLICY_RDLOCK;

    fromcon = sidtab_search(&sidtab, fromsid);
    if ( !fromcon )
    {
        rc = -EINVAL;
        goto out_unlock;
    }

    user = hashtab_search(policydb.p_users.table, username);
    if ( !user )
    {
        rc = -EINVAL;
        goto out_unlock;
    }
    usercon.user = user->value;

    mysids = xmalloc_array(u32, maxnel);
    if ( !mysids )
    {
        rc = -ENOMEM;
        goto out_unlock;
    }
    memset(mysids, 0, maxnel*sizeof(*mysids));

    ebitmap_for_each_bit(&user->roles, rnode, i)
    {
        if ( !ebitmap_node_get_bit(rnode, i) )
            continue;
        role = policydb.role_val_to_struct[i];
        usercon.role = i+1;
        ebitmap_for_each_bit(&role->types, tnode, j) {
            if ( !ebitmap_node_get_bit(tnode, j) )
                continue;
            usercon.type = j+1;

            if ( mls_setup_user_range(fromcon, user, &usercon) )
                continue;

            rc = context_struct_compute_av(fromcon, &usercon,
                               SECCLASS_DOMAIN,
                               DOMAIN__TRANSITION,
                               &avd);
            if ( rc ||  !(avd.allowed & DOMAIN__TRANSITION) )
                continue;
            rc = sidtab_context_to_sid(&sidtab, &usercon, &sid);
            if ( rc )
            {
                xfree(mysids);
                goto out_unlock;
            }
            if ( mynel < maxnel )
            {
                mysids[mynel++] = sid;
            }
            else
            {
                maxnel += SIDS_NEL;
                mysids2 = xmalloc_array(u32, maxnel);
                if ( !mysids2 )
                {
                    rc = -ENOMEM;
                    xfree(mysids);
                    goto out_unlock;
                }
                memset(mysids2, 0, maxnel*sizeof(*mysids2));
                memcpy(mysids2, mysids, mynel * sizeof(*mysids2));
                xfree(mysids);
                mysids = mysids2;
                mysids[mynel++] = sid;
            }
        }
    }

    *sids = mysids;
    *nel = mynel;

out_unlock:
    POLICY_RDUNLOCK;
out:
    return rc;
}

int security_get_bools(int *len, char ***names, int **values)
{
    int i, rc = -ENOMEM;

    POLICY_RDLOCK;
    *names = NULL;
    *values = NULL;

    *len = policydb.p_bools.nprim;
    if ( !*len )
    {
        rc = 0;
        goto out;
    }

    *names = (char**)xmalloc_array(char*, *len);
    if ( !*names )
        goto err;
    memset(*names, 0, sizeof(char*) * *len);

    *values = (int*)xmalloc_array(int, *len);
    if ( !*values )
        goto err;

    for ( i = 0; i < *len; i++ )
    {
        size_t name_len;
        (*values)[i] = policydb.bool_val_to_struct[i]->state;
        name_len = strlen(policydb.p_bool_val_to_name[i]) + 1;
        (*names)[i] = (char*)xmalloc_array(char, name_len);
        if ( !(*names)[i] )
            goto err;
        strlcpy((*names)[i], policydb.p_bool_val_to_name[i], name_len);
        (*names)[i][name_len - 1] = 0;
    }
    rc = 0;
out:
    POLICY_RDUNLOCK;
    return rc;
err:
    if ( *names )
    {
        for ( i = 0; i < *len; i++ )
            xfree((*names)[i]);
    }
    xfree(*values);
    goto out;
}


int security_set_bools(int len, int *values)
{
    int i, rc = 0;
    int lenp, seqno = 0;
    struct cond_node *cur;

    POLICY_WRLOCK;

    lenp = policydb.p_bools.nprim;
    if ( len != lenp )
    {
        rc = -EFAULT;
        goto out;
    }

    printk(KERN_INFO "security: committed booleans { ");
    for ( i = 0; i < len; i++ )
    {
        if ( values[i] )
        {
            policydb.bool_val_to_struct[i]->state = 1;
        }
        else
        {
            policydb.bool_val_to_struct[i]->state = 0;
        }
        if ( i != 0 )
            printk(", ");
        printk("%s:%d", policydb.p_bool_val_to_name[i],
               policydb.bool_val_to_struct[i]->state);
    }
    printk(" }\n");

    for ( cur = policydb.cond_list; cur != NULL; cur = cur->next )
    {
        rc = evaluate_cond_node(&policydb, cur);
        if ( rc )
            goto out;
    }

    seqno = ++latest_granting;

out:
    POLICY_WRUNLOCK;
    if ( !rc )
    {
        avc_ss_reset(seqno);
    }
    return rc;
}

int security_get_bool_value(int bool)
{
    int rc = 0;
    int len;

    POLICY_RDLOCK;

    len = policydb.p_bools.nprim;
    if ( bool >= len )
    {
        rc = -EFAULT;
        goto out;
    }

    rc = policydb.bool_val_to_struct[bool]->state;
out:
    POLICY_RDUNLOCK;
    return rc;
}