1 // SPDX-License-Identifier: GPL-2.0
3 * Implementation of the multi-level security (MLS) policy.
5 * Author : Stephen Smalley, <sds@tycho.nsa.gov>
8 * Updated: Trusted Computer Solutions, Inc. <dgoeddel@trustedcs.com>
10 * Support for enhanced MLS infrastructure.
12 * Copyright (C) 2004-2006 Trusted Computer Solutions, Inc.
15 * Updated: Hewlett-Packard <paul@paul-moore.com>
17 * Added support to import/export the MLS label from NetLabel
19 * (c) Copyright Hewlett-Packard Development Company, L.P., 2006
22 #include <linux/kernel.h>
23 #include <linux/slab.h>
24 #include <linux/string.h>
25 #include <linux/errno.h>
26 #include <net/netlabel.h>
33 * Return the length in bytes for the MLS fields of the
34 * security context string representation of `context'.
36 int mls_compute_context_len(struct policydb *p, struct context *context)
38 int i, l, len, head, prev;
41 struct ebitmap_node *node;
46 len = 1; /* for the beginning ":" */
47 for (l = 0; l < 2; l++) {
48 int index_sens = context->range.level[l].sens;
49 len += strlen(sym_name(p, SYM_LEVELS, index_sens - 1));
54 e = &context->range.level[l].cat;
55 ebitmap_for_each_positive_bit(e, node, i) {
57 /* one or more negative bits are skipped */
59 nm = sym_name(p, SYM_CATS, prev);
60 len += strlen(nm) + 1;
62 nm = sym_name(p, SYM_CATS, i);
63 len += strlen(nm) + 1;
69 nm = sym_name(p, SYM_CATS, prev);
70 len += strlen(nm) + 1;
73 if (mls_level_eq(&context->range.level[0],
74 &context->range.level[1]))
85 * Write the security context string representation of
86 * the MLS fields of `context' into the string `*scontext'.
87 * Update `*scontext' to point to the end of the MLS fields.
89 void mls_sid_to_context(struct policydb *p,
90 struct context *context,
96 struct ebitmap_node *node;
101 scontextp = *scontext;
106 for (l = 0; l < 2; l++) {
107 strcpy(scontextp, sym_name(p, SYM_LEVELS,
108 context->range.level[l].sens - 1));
109 scontextp += strlen(scontextp);
114 e = &context->range.level[l].cat;
115 ebitmap_for_each_positive_bit(e, node, i) {
117 /* one or more negative bits are skipped */
123 nm = sym_name(p, SYM_CATS, prev);
124 strcpy(scontextp, nm);
125 scontextp += strlen(nm);
131 nm = sym_name(p, SYM_CATS, i);
132 strcpy(scontextp, nm);
133 scontextp += strlen(nm);
144 nm = sym_name(p, SYM_CATS, prev);
145 strcpy(scontextp, nm);
146 scontextp += strlen(nm);
150 if (mls_level_eq(&context->range.level[0],
151 &context->range.level[1]))
158 *scontext = scontextp;
162 int mls_level_isvalid(struct policydb *p, struct mls_level *l)
164 struct level_datum *levdatum;
166 if (!l->sens || l->sens > p->p_levels.nprim)
168 levdatum = hashtab_search(p->p_levels.table,
169 sym_name(p, SYM_LEVELS, l->sens - 1));
174 * Return 1 iff all the bits set in l->cat are also be set in
175 * levdatum->level->cat and no bit in l->cat is larger than
178 return ebitmap_contains(&levdatum->level->cat, &l->cat,
182 int mls_range_isvalid(struct policydb *p, struct mls_range *r)
184 return (mls_level_isvalid(p, &r->level[0]) &&
185 mls_level_isvalid(p, &r->level[1]) &&
186 mls_level_dom(&r->level[1], &r->level[0]));
190 * Return 1 if the MLS fields in the security context
191 * structure `c' are valid. Return 0 otherwise.
193 int mls_context_isvalid(struct policydb *p, struct context *c)
195 struct user_datum *usrdatum;
200 if (!mls_range_isvalid(p, &c->range))
203 if (c->role == OBJECT_R_VAL)
207 * User must be authorized for the MLS range.
209 if (!c->user || c->user > p->p_users.nprim)
211 usrdatum = p->user_val_to_struct[c->user - 1];
212 if (!mls_range_contains(usrdatum->range, c->range))
213 return 0; /* user may not be associated with range */
219 * Set the MLS fields in the security context structure
220 * `context' based on the string representation in
221 * the string `*scontext'. Update `*scontext' to
222 * point to the end of the string representation of
225 * This function modifies the string in place, inserting
226 * NULL characters to terminate the MLS fields.
228 * If a def_sid is provided and no MLS field is present,
229 * copy the MLS field of the associated default context.
230 * Used for upgraded to MLS systems where objects may lack
233 * Policy read-lock must be held for sidtab lookup.
236 int mls_context_to_sid(struct policydb *pol,
239 struct context *context,
245 char *scontextp, *p, *rngptr;
246 struct level_datum *levdatum;
247 struct cat_datum *catdatum, *rngdatum;
250 if (!pol->mls_enabled) {
251 if (def_sid != SECSID_NULL && oldc)
252 *scontext += strlen(*scontext) + 1;
257 * No MLS component to the security context, try and map to
258 * default if provided.
261 struct context *defcon;
263 if (def_sid == SECSID_NULL)
266 defcon = sidtab_search(s, def_sid);
270 rc = mls_context_cpy(context, defcon);
274 /* Extract low sensitivity. */
275 scontextp = p = *scontext;
276 while (*p && *p != ':' && *p != '-')
283 for (l = 0; l < 2; l++) {
284 levdatum = hashtab_search(pol->p_levels.table, scontextp);
290 context->range.level[l].sens = levdatum->level->sens;
293 /* Extract category set. */
296 while (*p && *p != ',' && *p != '-')
302 /* Separate into range if exists */
303 rngptr = strchr(scontextp, '.');
304 if (rngptr != NULL) {
309 catdatum = hashtab_search(pol->p_cats.table,
316 rc = ebitmap_set_bit(&context->range.level[l].cat,
317 catdatum->value - 1, 1);
321 /* If range, set all categories in range */
325 rngdatum = hashtab_search(pol->p_cats.table, rngptr);
331 if (catdatum->value >= rngdatum->value) {
336 for (i = catdatum->value; i < rngdatum->value; i++) {
337 rc = ebitmap_set_bit(&context->range.level[l].cat, i, 1);
348 /* Extract high sensitivity. */
350 while (*p && *p != ':')
361 context->range.level[1].sens = context->range.level[0].sens;
362 rc = ebitmap_cpy(&context->range.level[1].cat,
363 &context->range.level[0].cat);
374 * Set the MLS fields in the security context structure
375 * `context' based on the string representation in
376 * the string `str'. This function will allocate temporary memory with the
377 * given constraints of gfp_mask.
379 int mls_from_string(struct policydb *p, char *str, struct context *context,
382 char *tmpstr, *freestr;
388 /* we need freestr because mls_context_to_sid will change
389 the value of tmpstr */
390 tmpstr = freestr = kstrdup(str, gfp_mask);
394 rc = mls_context_to_sid(p, ':', &tmpstr, context,
403 * Copies the MLS range `range' into `context'.
405 int mls_range_set(struct context *context,
406 struct mls_range *range)
410 /* Copy the MLS range into the context */
411 for (l = 0; l < 2; l++) {
412 context->range.level[l].sens = range->level[l].sens;
413 rc = ebitmap_cpy(&context->range.level[l].cat,
414 &range->level[l].cat);
422 int mls_setup_user_range(struct policydb *p,
423 struct context *fromcon, struct user_datum *user,
424 struct context *usercon)
426 if (p->mls_enabled) {
427 struct mls_level *fromcon_sen = &(fromcon->range.level[0]);
428 struct mls_level *fromcon_clr = &(fromcon->range.level[1]);
429 struct mls_level *user_low = &(user->range.level[0]);
430 struct mls_level *user_clr = &(user->range.level[1]);
431 struct mls_level *user_def = &(user->dfltlevel);
432 struct mls_level *usercon_sen = &(usercon->range.level[0]);
433 struct mls_level *usercon_clr = &(usercon->range.level[1]);
435 /* Honor the user's default level if we can */
436 if (mls_level_between(user_def, fromcon_sen, fromcon_clr))
437 *usercon_sen = *user_def;
438 else if (mls_level_between(fromcon_sen, user_def, user_clr))
439 *usercon_sen = *fromcon_sen;
440 else if (mls_level_between(fromcon_clr, user_low, user_def))
441 *usercon_sen = *user_low;
445 /* Lower the clearance of available contexts
446 if the clearance of "fromcon" is lower than
447 that of the user's default clearance (but
448 only if the "fromcon" clearance dominates
449 the user's computed sensitivity level) */
450 if (mls_level_dom(user_clr, fromcon_clr))
451 *usercon_clr = *fromcon_clr;
452 else if (mls_level_dom(fromcon_clr, user_clr))
453 *usercon_clr = *user_clr;
462 * Convert the MLS fields in the security context
463 * structure `c' from the values specified in the
464 * policy `oldp' to the values specified in the policy `newp'.
466 int mls_convert_context(struct policydb *oldp,
467 struct policydb *newp,
470 struct level_datum *levdatum;
471 struct cat_datum *catdatum;
472 struct ebitmap bitmap;
473 struct ebitmap_node *node;
476 if (!oldp->mls_enabled || !newp->mls_enabled)
479 for (l = 0; l < 2; l++) {
480 levdatum = hashtab_search(newp->p_levels.table,
481 sym_name(oldp, SYM_LEVELS,
482 c->range.level[l].sens - 1));
486 c->range.level[l].sens = levdatum->level->sens;
488 ebitmap_init(&bitmap);
489 ebitmap_for_each_positive_bit(&c->range.level[l].cat, node, i) {
492 catdatum = hashtab_search(newp->p_cats.table,
493 sym_name(oldp, SYM_CATS, i));
496 rc = ebitmap_set_bit(&bitmap, catdatum->value - 1, 1);
502 ebitmap_destroy(&c->range.level[l].cat);
503 c->range.level[l].cat = bitmap;
509 int mls_compute_sid(struct policydb *p,
510 struct context *scontext,
511 struct context *tcontext,
514 struct context *newcontext,
517 struct range_trans rtr;
519 struct class_datum *cladatum;
520 int default_range = 0;
526 case AVTAB_TRANSITION:
527 /* Look for a range transition rule. */
528 rtr.source_type = scontext->type;
529 rtr.target_type = tcontext->type;
530 rtr.target_class = tclass;
531 r = hashtab_search(p->range_tr, &rtr);
533 return mls_range_set(newcontext, r);
535 if (tclass && tclass <= p->p_classes.nprim) {
536 cladatum = p->class_val_to_struct[tclass - 1];
538 default_range = cladatum->default_range;
541 switch (default_range) {
542 case DEFAULT_SOURCE_LOW:
543 return mls_context_cpy_low(newcontext, scontext);
544 case DEFAULT_SOURCE_HIGH:
545 return mls_context_cpy_high(newcontext, scontext);
546 case DEFAULT_SOURCE_LOW_HIGH:
547 return mls_context_cpy(newcontext, scontext);
548 case DEFAULT_TARGET_LOW:
549 return mls_context_cpy_low(newcontext, tcontext);
550 case DEFAULT_TARGET_HIGH:
551 return mls_context_cpy_high(newcontext, tcontext);
552 case DEFAULT_TARGET_LOW_HIGH:
553 return mls_context_cpy(newcontext, tcontext);
558 if ((tclass == p->process_class) || (sock == true))
559 /* Use the process MLS attributes. */
560 return mls_context_cpy(newcontext, scontext);
562 /* Use the process effective MLS attributes. */
563 return mls_context_cpy_low(newcontext, scontext);
565 /* Use the process effective MLS attributes. */
566 return mls_context_cpy_low(newcontext, scontext);
573 #ifdef CONFIG_NETLABEL
575 * mls_export_netlbl_lvl - Export the MLS sensitivity levels to NetLabel
576 * @context: the security context
577 * @secattr: the NetLabel security attributes
580 * Given the security context copy the low MLS sensitivity level into the
581 * NetLabel MLS sensitivity level field.
584 void mls_export_netlbl_lvl(struct policydb *p,
585 struct context *context,
586 struct netlbl_lsm_secattr *secattr)
591 secattr->attr.mls.lvl = context->range.level[0].sens - 1;
592 secattr->flags |= NETLBL_SECATTR_MLS_LVL;
596 * mls_import_netlbl_lvl - Import the NetLabel MLS sensitivity levels
597 * @context: the security context
598 * @secattr: the NetLabel security attributes
601 * Given the security context and the NetLabel security attributes, copy the
602 * NetLabel MLS sensitivity level into the context.
605 void mls_import_netlbl_lvl(struct policydb *p,
606 struct context *context,
607 struct netlbl_lsm_secattr *secattr)
612 context->range.level[0].sens = secattr->attr.mls.lvl + 1;
613 context->range.level[1].sens = context->range.level[0].sens;
617 * mls_export_netlbl_cat - Export the MLS categories to NetLabel
618 * @context: the security context
619 * @secattr: the NetLabel security attributes
622 * Given the security context copy the low MLS categories into the NetLabel
623 * MLS category field. Returns zero on success, negative values on failure.
626 int mls_export_netlbl_cat(struct policydb *p,
627 struct context *context,
628 struct netlbl_lsm_secattr *secattr)
635 rc = ebitmap_netlbl_export(&context->range.level[0].cat,
636 &secattr->attr.mls.cat);
637 if (rc == 0 && secattr->attr.mls.cat != NULL)
638 secattr->flags |= NETLBL_SECATTR_MLS_CAT;
644 * mls_import_netlbl_cat - Import the MLS categories from NetLabel
645 * @context: the security context
646 * @secattr: the NetLabel security attributes
649 * Copy the NetLabel security attributes into the SELinux context; since the
650 * NetLabel security attribute only contains a single MLS category use it for
651 * both the low and high categories of the context. Returns zero on success,
652 * negative values on failure.
655 int mls_import_netlbl_cat(struct policydb *p,
656 struct context *context,
657 struct netlbl_lsm_secattr *secattr)
664 rc = ebitmap_netlbl_import(&context->range.level[0].cat,
665 secattr->attr.mls.cat);
667 goto import_netlbl_cat_failure;
668 memcpy(&context->range.level[1].cat, &context->range.level[0].cat,
669 sizeof(context->range.level[0].cat));
673 import_netlbl_cat_failure:
674 ebitmap_destroy(&context->range.level[0].cat);
677 #endif /* CONFIG_NETLABEL */