blob: a6e0c04a38c857e89cd59fdd208c8c15d27b5ae6 [file] [log] [blame]
/* Authors: Joshua Brindle <jbrindle@tresys.com>
*
* Assertion checker for avtab entries, taken from
* checkpolicy.c by Stephen Smalley <sds@tycho.nsa.gov>
*
* Copyright (C) 2005 Tresys Technology, LLC
*
* This library is free software; you can redistribute it and/or
* modify it under the terms of the GNU Lesser General Public
* License as published by the Free Software Foundation; either
* version 2.1 of the License, or (at your option) any later version.
*
* This library is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
* Lesser General Public License for more details.
*
* You should have received a copy of the GNU Lesser General Public
* License along with this library; if not, write to the Free Software
* Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA
*/
#include <sepol/policydb/avtab.h>
#include <sepol/policydb/policydb.h>
#include <sepol/policydb/expand.h>
#include <sepol/policydb/util.h>
#include "debug.h"
static int check_assertion_helper(sepol_handle_t * handle,
policydb_t * p,
avtab_t * te_avtab, avtab_t * te_cond_avtab,
unsigned int stype, unsigned int ttype,
class_perm_node_t * perm, unsigned long line)
{
avtab_key_t avkey;
avtab_ptr_t node;
class_perm_node_t *curperm;
for (curperm = perm; curperm != NULL; curperm = curperm->next) {
avkey.source_type = stype + 1;
avkey.target_type = ttype + 1;
avkey.target_class = curperm->class;
avkey.specified = AVTAB_ALLOWED;
for (node = avtab_search_node(te_avtab, &avkey);
node != NULL;
node = avtab_search_node_next(node, avkey.specified)) {
if (node->datum.data & curperm->data)
goto err;
}
for (node = avtab_search_node(te_cond_avtab, &avkey);
node != NULL;
node = avtab_search_node_next(node, avkey.specified)) {
if (node->datum.data & curperm->data)
goto err;
}
}
return 0;
err:
if (line) {
ERR(handle, "neverallow on line %lu violated by allow %s %s:%s {%s };",
line, p->p_type_val_to_name[stype],
p->p_type_val_to_name[ttype],
p->p_class_val_to_name[curperm->class - 1],
sepol_av_to_string(p, curperm->class,
node->datum.data & curperm->data));
} else {
ERR(handle, "neverallow violated by allow %s %s:%s {%s };",
p->p_type_val_to_name[stype],
p->p_type_val_to_name[ttype],
p->p_class_val_to_name[curperm->class - 1],
sepol_av_to_string(p, curperm->class,
node->datum.data & curperm->data));
}
return -1;
}
int check_assertions(sepol_handle_t * handle, policydb_t * p,
avrule_t * avrules)
{
avrule_t *a;
avtab_t te_avtab, te_cond_avtab;
ebitmap_node_t *snode, *tnode;
unsigned int i, j;
int rc;
if (!avrules) {
/* Since assertions are stored in avrules, if it is NULL
there won't be any to check. This also prevents an invalid
free if the avtabs are never initialized */
return 0;
}
if (avrules) {
if (avtab_init(&te_avtab))
goto oom;
if (avtab_init(&te_cond_avtab)) {
avtab_destroy(&te_avtab);
goto oom;
}
if (expand_avtab(p, &p->te_avtab, &te_avtab) ||
expand_avtab(p, &p->te_cond_avtab, &te_cond_avtab)) {
avtab_destroy(&te_avtab);
avtab_destroy(&te_cond_avtab);
goto oom;
}
}
for (a = avrules; a != NULL; a = a->next) {
ebitmap_t *stypes = &a->stypes.types;
ebitmap_t *ttypes = &a->ttypes.types;
if (!(a->specified & AVRULE_NEVERALLOW))
continue;
ebitmap_for_each_bit(stypes, snode, i) {
if (!ebitmap_node_get_bit(snode, i))
continue;
if (a->flags & RULE_SELF) {
if (check_assertion_helper
(handle, p, &te_avtab, &te_cond_avtab, i, i,
a->perms, a->line)) {
rc = -1;
goto out;
}
}
ebitmap_for_each_bit(ttypes, tnode, j) {
if (!ebitmap_node_get_bit(tnode, j))
continue;
if (check_assertion_helper
(handle, p, &te_avtab, &te_cond_avtab, i, j,
a->perms, a->line)) {
rc = -1;
goto out;
}
}
}
}
rc = 0;
out:
avtab_destroy(&te_avtab);
avtab_destroy(&te_cond_avtab);
return rc;
oom:
ERR(handle, "Out of memory - unable to check neverallows");
return -1;
}