selinux/mdp/mdp.c

0001 // SPDX-License-Identifier: GPL-2.0-or-later
0002 /*
0003  *
0004  * mdp - make dummy policy
0005  *
0006  * When pointed at a kernel tree, builds a dummy policy for that kernel
0007  * with exactly one type with full rights to itself.
0008  *
0009  * Copyright (C) IBM Corporation, 2006
0010  *
0011  * Authors: Serge E. Hallyn <serue@us.ibm.com>
0012  */
0013
0014
0015 /* NOTE: we really do want to use the kernel headers here */
0016 #define __EXPORTED_HEADERS__
0017
0018 #include <stdio.h>
0019 #include <stdlib.h>
0020 #include <unistd.h>
0021 #include <string.h>
0022 #include <linux/kconfig.h>
0023
0024 static void usage(char *name)
0025 {
0026     printf("usage: %s [-m] policy_file context_file\n", name);
0027     exit(1);
0028 }
0029
0030 /* Class/perm mapping support */
0031 struct security_class_mapping {
0032     const char *name;
0033     const char *perms[sizeof(unsigned) * 8 + 1];
0034 };
0035
0036 #include "classmap.h"
0037 #include "initial_sid_to_string.h"
0038 #include "policycap_names.h"
0039
0040 #define ARRAY_SIZE(arr) (sizeof(arr) / sizeof((arr)[0]))
0041
0042 int main(int argc, char *argv[])
0043 {
0044     int i, j, mls = 0;
0045     int initial_sid_to_string_len;
0046     char **arg, *polout, *ctxout;
0047
0048     FILE *fout;
0049
0050     if (argc < 3)
0051         usage(argv[0]);
0052     arg = argv+1;
0053     if (argc==4 && strcmp(argv[1], "-m") == 0) {
0054         mls = 1;
0055         arg++;
0056     }
0057     polout = *arg++;
0058     ctxout = *arg;
0059
0060     fout = fopen(polout, "w");
0061     if (!fout) {
0062         printf("Could not open %s for writing\n", polout);
0063         usage(argv[0]);
0064     }
0065
0066     /* print out the classes */
0067     for (i = 0; secclass_map[i].name; i++)
0068         fprintf(fout, "class %s\n", secclass_map[i].name);
0069     fprintf(fout, "\n");
0070
0071     initial_sid_to_string_len = sizeof(initial_sid_to_string) / sizeof (char *);
0072     /* print out the sids */
0073     for (i = 1; i < initial_sid_to_string_len; i++) {
0074         const char *name = initial_sid_to_string[i];
0075
0076         if (name)
0077             fprintf(fout, "sid %s\n", name);
0078         else
0079             fprintf(fout, "sid unused%d\n", i);
0080     }
0081     fprintf(fout, "\n");
0082
0083     /* print out the class permissions */
0084     for (i = 0; secclass_map[i].name; i++) {
0085         const struct security_class_mapping *map = &secclass_map[i];
0086         fprintf(fout, "class %s\n", map->name);
0087         fprintf(fout, "{\n");
0088         for (j = 0; map->perms[j]; j++)
0089             fprintf(fout, "\t%s\n", map->perms[j]);
0090         fprintf(fout, "}\n\n");
0091     }
0092     fprintf(fout, "\n");
0093
0094     /* print out mls declarations and constraints */
0095     if (mls) {
0096         fprintf(fout, "sensitivity s0;\n");
0097         fprintf(fout, "sensitivity s1;\n");
0098         fprintf(fout, "dominance { s0 s1 }\n");
0099         fprintf(fout, "category c0;\n");
0100         fprintf(fout, "category c1;\n");
0101         fprintf(fout, "level s0:c0.c1;\n");
0102         fprintf(fout, "level s1:c0.c1;\n");
0103 #define SYSTEMLOW "s0"
0104 #define SYSTEMHIGH "s1:c0.c1"
0105         for (i = 0; secclass_map[i].name; i++) {
0106             const struct security_class_mapping *map = &secclass_map[i];
0107
0108             fprintf(fout, "mlsconstrain %s {\n", map->name);
0109             for (j = 0; map->perms[j]; j++)
0110                 fprintf(fout, "\t%s\n", map->perms[j]);
0111             /*
0112              * This requires all subjects and objects to be
0113              * single-level (l2 eq h2), and that the subject
0114              * level dominate the object level (h1 dom h2)
0115              * in order to have any permissions to it.
0116              */
0117             fprintf(fout, "} (l2 eq h2 and h1 dom h2);\n\n");
0118         }
0119     }
0120
0121     /* enable all policy capabilities */
0122     for (i = 0; i < ARRAY_SIZE(selinux_policycap_names); i++)
0123         fprintf(fout, "policycap %s;\n", selinux_policycap_names[i]);
0124
0125     /* types, roles, and allows */
0126     fprintf(fout, "type base_t;\n");
0127     fprintf(fout, "role base_r;\n");
0128     fprintf(fout, "role base_r types { base_t };\n");
0129     for (i = 0; secclass_map[i].name; i++)
0130         fprintf(fout, "allow base_t base_t:%s *;\n",
0131             secclass_map[i].name);
0132     fprintf(fout, "user user_u roles { base_r }");
0133     if (mls)
0134         fprintf(fout, " level %s range %s - %s", SYSTEMLOW,
0135             SYSTEMLOW, SYSTEMHIGH);
0136     fprintf(fout, ";\n");
0137
0138 #define SUBJUSERROLETYPE "user_u:base_r:base_t"
0139 #define OBJUSERROLETYPE "user_u:object_r:base_t"
0140
0141     /* default sids */
0142     for (i = 1; i < initial_sid_to_string_len; i++) {
0143         const char *name = initial_sid_to_string[i];
0144
0145         if (name)
0146             fprintf(fout, "sid %s ", name);
0147         else
0148             fprintf(fout, "sid unused%d\n", i);
0149         fprintf(fout, SUBJUSERROLETYPE "%s\n",
0150             mls ? ":" SYSTEMLOW : "");
0151     }
0152     fprintf(fout, "\n");
0153
0154 #define FS_USE(behavior, fstype)                \
0155     fprintf(fout, "fs_use_%s %s " OBJUSERROLETYPE "%s;\n", \
0156         behavior, fstype, mls ? ":" SYSTEMLOW : "")
0157
0158     /*
0159      * Filesystems whose inode labels can be fetched via getxattr.
0160      */
0161 #ifdef CONFIG_EXT2_FS_SECURITY
0162     FS_USE("xattr", "ext2");
0163 #endif
0164 #ifdef CONFIG_EXT4_FS_SECURITY
0165 #ifdef CONFIG_EXT4_USE_FOR_EXT2
0166     FS_USE("xattr", "ext2");
0167 #endif
0168     FS_USE("xattr", "ext3");
0169     FS_USE("xattr", "ext4");
0170 #endif
0171 #ifdef CONFIG_JFS_SECURITY
0172     FS_USE("xattr", "jfs");
0173 #endif
0174 #ifdef CONFIG_REISERFS_FS_SECURITY
0175     FS_USE("xattr", "reiserfs");
0176 #endif
0177 #ifdef CONFIG_JFFS2_FS_SECURITY
0178     FS_USE("xattr", "jffs2");
0179 #endif
0180 #ifdef CONFIG_XFS_FS
0181     FS_USE("xattr", "xfs");
0182 #endif
0183 #ifdef CONFIG_GFS2_FS
0184     FS_USE("xattr", "gfs2");
0185 #endif
0186 #ifdef CONFIG_BTRFS_FS
0187     FS_USE("xattr", "btrfs");
0188 #endif
0189 #ifdef CONFIG_F2FS_FS_SECURITY
0190     FS_USE("xattr", "f2fs");
0191 #endif
0192 #ifdef CONFIG_OCFS2_FS
0193     FS_USE("xattr", "ocsfs2");
0194 #endif
0195 #ifdef CONFIG_OVERLAY_FS
0196     FS_USE("xattr", "overlay");
0197 #endif
0198 #ifdef CONFIG_SQUASHFS_XATTR
0199     FS_USE("xattr", "squashfs");
0200 #endif
0201
0202     /*
0203      * Filesystems whose inodes are labeled from allocating task.
0204      */
0205     FS_USE("task", "pipefs");
0206     FS_USE("task", "sockfs");
0207
0208     /*
0209      * Filesystems whose inode labels are computed from both
0210      * the allocating task and the superblock label.
0211      */
0212 #ifdef CONFIG_UNIX98_PTYS
0213     FS_USE("trans", "devpts");
0214 #endif
0215 #ifdef CONFIG_HUGETLBFS
0216     FS_USE("trans", "hugetlbfs");
0217 #endif
0218 #ifdef CONFIG_TMPFS
0219     FS_USE("trans", "tmpfs");
0220 #endif
0221 #ifdef CONFIG_DEVTMPFS
0222     FS_USE("trans", "devtmpfs");
0223 #endif
0224 #ifdef CONFIG_POSIX_MQUEUE
0225     FS_USE("trans", "mqueue");
0226 #endif
0227
0228 #define GENFSCON(fstype, prefix)                 \
0229     fprintf(fout, "genfscon %s %s " OBJUSERROLETYPE "%s\n", \
0230         fstype, prefix, mls ? ":" SYSTEMLOW : "")
0231
0232     /*
0233      * Filesystems whose inodes are labeled from path prefix match
0234      * relative to the filesystem root.  Depending on the filesystem,
0235      * only a single label for all inodes may be supported.  Here
0236      * we list the filesystem types for which per-file labeling is
0237      * supported using genfscon; any other filesystem type can also
0238      * be added by only with a single entry for all of its inodes.
0239      */
0240 #ifdef CONFIG_PROC_FS
0241     GENFSCON("proc", "/");
0242 #endif
0243 #ifdef CONFIG_SECURITY_SELINUX
0244     GENFSCON("selinuxfs", "/");
0245 #endif
0246 #ifdef CONFIG_SYSFS
0247     GENFSCON("sysfs", "/");
0248 #endif
0249 #ifdef CONFIG_DEBUG_FS
0250     GENFSCON("debugfs", "/");
0251 #endif
0252 #ifdef CONFIG_TRACING
0253     GENFSCON("tracefs", "/");
0254 #endif
0255 #ifdef CONFIG_PSTORE
0256     GENFSCON("pstore", "/");
0257 #endif
0258     GENFSCON("cgroup", "/");
0259     GENFSCON("cgroup2", "/");
0260
0261     fclose(fout);
0262
0263     fout = fopen(ctxout, "w");
0264     if (!fout) {
0265         printf("Wrote policy, but cannot open %s for writing\n", ctxout);
0266         usage(argv[0]);
0267     }
0268     fprintf(fout, "/ " OBJUSERROLETYPE "%s\n", mls ? ":" SYSTEMLOW : "");
0269     fprintf(fout, "/.* " OBJUSERROLETYPE "%s\n", mls ? ":" SYSTEMLOW : "");
0270     fclose(fout);
0271
0272     return 0;
0273 }