selinux/ss/policydb.h

0001 /* SPDX-License-Identifier: GPL-2.0-only */
0002 /*
0003  * A policy database (policydb) specifies the
0004  * configuration data for the security policy.
0005  *
0006  * Author : Stephen Smalley, <sds@tycho.nsa.gov>
0007  */
0008
0009 /*
0010  * Updated: Trusted Computer Solutions, Inc. <dgoeddel@trustedcs.com>
0011  *
0012  *  Support for enhanced MLS infrastructure.
0013  *
0014  * Updated: Frank Mayer <mayerf@tresys.com> and Karl MacMillan <kmacmillan@tresys.com>
0015  *
0016  *  Added conditional policy language extensions
0017  *
0018  * Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
0019  * Copyright (C) 2003 - 2004 Tresys Technology, LLC
0020  */
0021
0022 #ifndef _SS_POLICYDB_H_
0023 #define _SS_POLICYDB_H_
0024
0025 #include "symtab.h"
0026 #include "avtab.h"
0027 #include "sidtab.h"
0028 #include "ebitmap.h"
0029 #include "mls_types.h"
0030 #include "context.h"
0031 #include "constraint.h"
0032
0033 /*
0034  * A datum type is defined for each kind of symbol
0035  * in the configuration data:  individual permissions,
0036  * common prefixes for access vectors, classes,
0037  * users, roles, types, sensitivities, categories, etc.
0038  */
0039
0040 /* Permission attributes */
0041 struct perm_datum {
0042     u32 value;      /* permission bit + 1 */
0043 };
0044
0045 /* Attributes of a common prefix for access vectors */
0046 struct common_datum {
0047     u32 value;          /* internal common value */
0048     struct symtab permissions;  /* common permissions */
0049 };
0050
0051 /* Class attributes */
0052 struct class_datum {
0053     u32 value;          /* class value */
0054     char *comkey;           /* common name */
0055     struct common_datum *comdatum;  /* common datum */
0056     struct symtab permissions;  /* class-specific permission symbol table */
0057     struct constraint_node *constraints;    /* constraints on class permissions */
0058     struct constraint_node *validatetrans;  /* special transition rules */
0059 /* Options how a new object user, role, and type should be decided */
0060 #define DEFAULT_SOURCE         1
0061 #define DEFAULT_TARGET         2
0062     char default_user;
0063     char default_role;
0064     char default_type;
0065 /* Options how a new object range should be decided */
0066 #define DEFAULT_SOURCE_LOW     1
0067 #define DEFAULT_SOURCE_HIGH    2
0068 #define DEFAULT_SOURCE_LOW_HIGH        3
0069 #define DEFAULT_TARGET_LOW     4
0070 #define DEFAULT_TARGET_HIGH    5
0071 #define DEFAULT_TARGET_LOW_HIGH        6
0072 #define DEFAULT_GLBLUB      7
0073     char default_range;
0074 };
0075
0076 /* Role attributes */
0077 struct role_datum {
0078     u32 value;          /* internal role value */
0079     u32 bounds;         /* boundary of role */
0080     struct ebitmap dominates;   /* set of roles dominated by this role */
0081     struct ebitmap types;       /* set of authorized types for role */
0082 };
0083
0084 struct role_trans_key {
0085     u32 role;       /* current role */
0086     u32 type;       /* program executable type, or new object type */
0087     u32 tclass;     /* process class, or new object class */
0088 };
0089
0090 struct role_trans_datum {
0091     u32 new_role;       /* new role */
0092 };
0093
0094 struct filename_trans_key {
0095     u32 ttype;      /* parent dir context */
0096     u16 tclass;     /* class of new object */
0097     const char *name;   /* last path component */
0098 };
0099
0100 struct filename_trans_datum {
0101     struct ebitmap stypes;  /* bitmap of source types for this otype */
0102     u32 otype;      /* resulting type of new object */
0103     struct filename_trans_datum *next;  /* record for next otype*/
0104 };
0105
0106 struct role_allow {
0107     u32 role;       /* current role */
0108     u32 new_role;       /* new role */
0109     struct role_allow *next;
0110 };
0111
0112 /* Type attributes */
0113 struct type_datum {
0114     u32 value;      /* internal type value */
0115     u32 bounds;     /* boundary of type */
0116     unsigned char primary;  /* primary name? */
0117     unsigned char attribute;/* attribute ?*/
0118 };
0119
0120 /* User attributes */
0121 struct user_datum {
0122     u32 value;          /* internal user value */
0123     u32 bounds;         /* bounds of user */
0124     struct ebitmap roles;       /* set of authorized roles for user */
0125     struct mls_range range;     /* MLS range (min - max) for user */
0126     struct mls_level dfltlevel; /* default login MLS level for user */
0127 };
0128
0129
0130 /* Sensitivity attributes */
0131 struct level_datum {
0132     struct mls_level *level;    /* sensitivity and associated categories */
0133     unsigned char isalias;  /* is this sensitivity an alias for another? */
0134 };
0135
0136 /* Category attributes */
0137 struct cat_datum {
0138     u32 value;      /* internal category bit + 1 */
0139     unsigned char isalias;  /* is this category an alias for another? */
0140 };
0141
0142 struct range_trans {
0143     u32 source_type;
0144     u32 target_type;
0145     u32 target_class;
0146 };
0147
0148 /* Boolean data type */
0149 struct cond_bool_datum {
0150     __u32 value;        /* internal type value */
0151     int state;
0152 };
0153
0154 struct cond_node;
0155
0156 /*
0157  * type set preserves data needed to determine constraint info from
0158  * policy source. This is not used by the kernel policy but allows
0159  * utilities such as audit2allow to determine constraint denials.
0160  */
0161 struct type_set {
0162     struct ebitmap types;
0163     struct ebitmap negset;
0164     u32 flags;
0165 };
0166
0167 /*
0168  * The configuration data includes security contexts for
0169  * initial SIDs, unlabeled file systems, TCP and UDP port numbers,
0170  * network interfaces, and nodes.  This structure stores the
0171  * relevant data for one such entry.  Entries of the same kind
0172  * (e.g. all initial SIDs) are linked together into a list.
0173  */
0174 struct ocontext {
0175     union {
0176         char *name; /* name of initial SID, fs, netif, fstype, path */
0177         struct {
0178             u8 protocol;
0179             u16 low_port;
0180             u16 high_port;
0181         } port;     /* TCP or UDP port information */
0182         struct {
0183             u32 addr;
0184             u32 mask;
0185         } node;     /* node information */
0186         struct {
0187             u32 addr[4];
0188             u32 mask[4];
0189         } node6;        /* IPv6 node information */
0190         struct {
0191             u64 subnet_prefix;
0192             u16 low_pkey;
0193             u16 high_pkey;
0194         } ibpkey;
0195         struct {
0196             char *dev_name;
0197             u8 port;
0198         } ibendport;
0199     } u;
0200     union {
0201         u32 sclass;  /* security class for genfs */
0202         u32 behavior;  /* labeling behavior for fs_use */
0203     } v;
0204     struct context context[2];  /* security context(s) */
0205     u32 sid[2]; /* SID(s) */
0206     struct ocontext *next;
0207 };
0208
0209 struct genfs {
0210     char *fstype;
0211     struct ocontext *head;
0212     struct genfs *next;
0213 };
0214
0215 /* symbol table array indices */
0216 #define SYM_COMMONS 0
0217 #define SYM_CLASSES 1
0218 #define SYM_ROLES   2
0219 #define SYM_TYPES   3
0220 #define SYM_USERS   4
0221 #define SYM_BOOLS   5
0222 #define SYM_LEVELS  6
0223 #define SYM_CATS    7
0224 #define SYM_NUM     8
0225
0226 /* object context array indices */
0227 #define OCON_ISID   0 /* initial SIDs */
0228 #define OCON_FS     1 /* unlabeled file systems */
0229 #define OCON_PORT   2 /* TCP and UDP port numbers */
0230 #define OCON_NETIF  3 /* network interfaces */
0231 #define OCON_NODE   4 /* nodes */
0232 #define OCON_FSUSE  5 /* fs_use */
0233 #define OCON_NODE6  6 /* IPv6 nodes */
0234 #define OCON_IBPKEY 7 /* Infiniband PKeys */
0235 #define OCON_IBENDPORT  8 /* Infiniband end ports */
0236 #define OCON_NUM    9
0237
0238 /* The policy database */
0239 struct policydb {
0240     int mls_enabled;
0241
0242     /* symbol tables */
0243     struct symtab symtab[SYM_NUM];
0244 #define p_commons symtab[SYM_COMMONS]
0245 #define p_classes symtab[SYM_CLASSES]
0246 #define p_roles symtab[SYM_ROLES]
0247 #define p_types symtab[SYM_TYPES]
0248 #define p_users symtab[SYM_USERS]
0249 #define p_bools symtab[SYM_BOOLS]
0250 #define p_levels symtab[SYM_LEVELS]
0251 #define p_cats symtab[SYM_CATS]
0252
0253     /* symbol names indexed by (value - 1) */
0254     char        **sym_val_to_name[SYM_NUM];
0255
0256     /* class, role, and user attributes indexed by (value - 1) */
0257     struct class_datum **class_val_to_struct;
0258     struct role_datum **role_val_to_struct;
0259     struct user_datum **user_val_to_struct;
0260     struct type_datum **type_val_to_struct;
0261
0262     /* type enforcement access vectors and transitions */
0263     struct avtab te_avtab;
0264
0265     /* role transitions */
0266     struct hashtab role_tr;
0267
0268     /* file transitions with the last path component */
0269     /* quickly exclude lookups when parent ttype has no rules */
0270     struct ebitmap filename_trans_ttypes;
0271     /* actual set of filename_trans rules */
0272     struct hashtab filename_trans;
0273     /* only used if policyvers < POLICYDB_VERSION_COMP_FTRANS */
0274     u32 compat_filename_trans_count;
0275
0276     /* bools indexed by (value - 1) */
0277     struct cond_bool_datum **bool_val_to_struct;
0278     /* type enforcement conditional access vectors and transitions */
0279     struct avtab te_cond_avtab;
0280     /* array indexing te_cond_avtab by conditional */
0281     struct cond_node *cond_list;
0282     u32 cond_list_len;
0283
0284     /* role allows */
0285     struct role_allow *role_allow;
0286
0287     /* security contexts of initial SIDs, unlabeled file systems,
0288        TCP or UDP port numbers, network interfaces and nodes */
0289     struct ocontext *ocontexts[OCON_NUM];
0290
0291     /* security contexts for files in filesystems that cannot support
0292        a persistent label mapping or use another
0293        fixed labeling behavior. */
0294     struct genfs *genfs;
0295
0296     /* range transitions table (range_trans_key -> mls_range) */
0297     struct hashtab range_tr;
0298
0299     /* type -> attribute reverse mapping */
0300     struct ebitmap *type_attr_map_array;
0301
0302     struct ebitmap policycaps;
0303
0304     struct ebitmap permissive_map;
0305
0306     /* length of this policy when it was loaded */
0307     size_t len;
0308
0309     unsigned int policyvers;
0310
0311     unsigned int reject_unknown : 1;
0312     unsigned int allow_unknown : 1;
0313
0314     u16 process_class;
0315     u32 process_trans_perms;
0316 } __randomize_layout;
0317
0318 extern void policydb_destroy(struct policydb *p);
0319 extern int policydb_load_isids(struct policydb *p, struct sidtab *s);
0320 extern int policydb_context_isvalid(struct policydb *p, struct context *c);
0321 extern int policydb_class_isvalid(struct policydb *p, unsigned int class);
0322 extern int policydb_type_isvalid(struct policydb *p, unsigned int type);
0323 extern int policydb_role_isvalid(struct policydb *p, unsigned int role);
0324 extern int policydb_read(struct policydb *p, void *fp);
0325 extern int policydb_write(struct policydb *p, void *fp);
0326
0327 extern struct filename_trans_datum *policydb_filenametr_search(
0328     struct policydb *p, struct filename_trans_key *key);
0329
0330 extern struct mls_range *policydb_rangetr_search(
0331     struct policydb *p, struct range_trans *key);
0332
0333 extern struct role_trans_datum *policydb_roletr_search(
0334     struct policydb *p, struct role_trans_key *key);
0335
0336 #define POLICYDB_CONFIG_MLS    1
0337
0338 /* the config flags related to unknown classes/perms are bits 2 and 3 */
0339 #define REJECT_UNKNOWN  0x00000002
0340 #define ALLOW_UNKNOWN   0x00000004
0341
0342 #define OBJECT_R "object_r"
0343 #define OBJECT_R_VAL 1
0344
0345 #define POLICYDB_MAGIC SELINUX_MAGIC
0346 #define POLICYDB_STRING "SE Linux"
0347
0348 struct policy_file {
0349     char *data;
0350     size_t len;
0351 };
0352
0353 struct policy_data {
0354     struct policydb *p;
0355     void *fp;
0356 };
0357
0358 static inline int next_entry(void *buf, struct policy_file *fp, size_t bytes)
0359 {
0360     if (bytes > fp->len)
0361         return -EINVAL;
0362
0363     memcpy(buf, fp->data, bytes);
0364     fp->data += bytes;
0365     fp->len -= bytes;
0366     return 0;
0367 }
0368
0369 static inline int put_entry(const void *buf, size_t bytes, int num, struct policy_file *fp)
0370 {
0371     size_t len = bytes * num;
0372
0373     if (len > fp->len)
0374         return -EINVAL;
0375     memcpy(fp->data, buf, len);
0376     fp->data += len;
0377     fp->len -= len;
0378
0379     return 0;
0380 }
0381
0382 static inline char *sym_name(struct policydb *p, unsigned int sym_num, unsigned int element_nr)
0383 {
0384     return p->sym_val_to_name[sym_num][element_nr];
0385 }
0386
0387 extern u16 string_to_security_class(struct policydb *p, const char *name);
0388 extern u32 string_to_av_perm(struct policydb *p, u16 tclass, const char *name);
0389
0390 #endif  /* _SS_POLICYDB_H_ */
0391