Commit | Line | Data |
---|---|---|
93c06cbb SH |
1 | /* |
2 | * | |
3 | * mdp - make dummy policy | |
4 | * | |
5 | * When pointed at a kernel tree, builds a dummy policy for that kernel | |
6 | * with exactly one type with full rights to itself. | |
7 | * | |
8 | * This program is free software; you can redistribute it and/or modify | |
9 | * it under the terms of the GNU General Public License as published by | |
10 | * the Free Software Foundation; either version 2 of the License, or | |
11 | * (at your option) any later version. | |
12 | * | |
13 | * This program is distributed in the hope that it will be useful, | |
14 | * but WITHOUT ANY WARRANTY; without even the implied warranty of | |
15 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the | |
16 | * GNU General Public License for more details. | |
17 | * | |
18 | * You should have received a copy of the GNU General Public License | |
19 | * along with this program; if not, write to the Free Software | |
20 | * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. | |
21 | * | |
22 | * Copyright (C) IBM Corporation, 2006 | |
23 | * | |
24 | * Authors: Serge E. Hallyn <serue@us.ibm.com> | |
25 | */ | |
26 | ||
27 | #include <stdio.h> | |
28 | #include <stdlib.h> | |
29 | #include <unistd.h> | |
30 | #include <string.h> | |
31 | ||
5c725138 | 32 | static void usage(char *name) |
93c06cbb SH |
33 | { |
34 | printf("usage: %s [-m] policy_file context_file\n", name); | |
35 | exit(1); | |
36 | } | |
37 | ||
c6d3aaa4 SS |
38 | /* Class/perm mapping support */ |
39 | struct security_class_mapping { | |
40 | const char *name; | |
41 | const char *perms[sizeof(unsigned) * 8 + 1]; | |
93c06cbb | 42 | }; |
93c06cbb | 43 | |
c6d3aaa4 | 44 | #include "classmap.h" |
93c06cbb SH |
45 | #include "initial_sid_to_string.h" |
46 | ||
93c06cbb SH |
47 | int main(int argc, char *argv[]) |
48 | { | |
49 | int i, j, mls = 0; | |
c6d3aaa4 | 50 | int initial_sid_to_string_len; |
93c06cbb | 51 | char **arg, *polout, *ctxout; |
c6d3aaa4 | 52 | |
93c06cbb SH |
53 | FILE *fout; |
54 | ||
55 | if (argc < 3) | |
56 | usage(argv[0]); | |
57 | arg = argv+1; | |
58 | if (argc==4 && strcmp(argv[1], "-m") == 0) { | |
59 | mls = 1; | |
60 | arg++; | |
61 | } | |
62 | polout = *arg++; | |
63 | ctxout = *arg; | |
64 | ||
65 | fout = fopen(polout, "w"); | |
66 | if (!fout) { | |
67 | printf("Could not open %s for writing\n", polout); | |
68 | usage(argv[0]); | |
69 | } | |
70 | ||
93c06cbb | 71 | /* print out the classes */ |
c6d3aaa4 SS |
72 | for (i = 0; secclass_map[i].name; i++) |
73 | fprintf(fout, "class %s\n", secclass_map[i].name); | |
93c06cbb SH |
74 | fprintf(fout, "\n"); |
75 | ||
76 | initial_sid_to_string_len = sizeof(initial_sid_to_string) / sizeof (char *); | |
77 | /* print out the sids */ | |
c6d3aaa4 | 78 | for (i = 1; i < initial_sid_to_string_len; i++) |
93c06cbb SH |
79 | fprintf(fout, "sid %s\n", initial_sid_to_string[i]); |
80 | fprintf(fout, "\n"); | |
81 | ||
93c06cbb | 82 | /* print out the class permissions */ |
c6d3aaa4 SS |
83 | for (i = 0; secclass_map[i].name; i++) { |
84 | struct security_class_mapping *map = &secclass_map[i]; | |
85 | fprintf(fout, "class %s\n", map->name); | |
86 | fprintf(fout, "{\n"); | |
87 | for (j = 0; map->perms[j]; j++) | |
88 | fprintf(fout, "\t%s\n", map->perms[j]); | |
89 | fprintf(fout, "}\n\n"); | |
93c06cbb SH |
90 | } |
91 | fprintf(fout, "\n"); | |
92 | ||
93 | /* NOW PRINT OUT MLS STUFF */ | |
94 | if (mls) { | |
95 | printf("MLS not yet implemented\n"); | |
96 | exit(1); | |
97 | } | |
98 | ||
99 | /* types, roles, and allows */ | |
100 | fprintf(fout, "type base_t;\n"); | |
fda4d578 | 101 | fprintf(fout, "role base_r;\n"); |
93c06cbb | 102 | fprintf(fout, "role base_r types { base_t };\n"); |
c6d3aaa4 SS |
103 | for (i = 0; secclass_map[i].name; i++) |
104 | fprintf(fout, "allow base_t base_t:%s *;\n", | |
105 | secclass_map[i].name); | |
93c06cbb SH |
106 | fprintf(fout, "user user_u roles { base_r };\n"); |
107 | fprintf(fout, "\n"); | |
108 | ||
109 | /* default sids */ | |
c6d3aaa4 | 110 | for (i = 1; i < initial_sid_to_string_len; i++) |
93c06cbb SH |
111 | fprintf(fout, "sid %s user_u:base_r:base_t\n", initial_sid_to_string[i]); |
112 | fprintf(fout, "\n"); | |
113 | ||
93c06cbb SH |
114 | fprintf(fout, "fs_use_xattr ext2 user_u:base_r:base_t;\n"); |
115 | fprintf(fout, "fs_use_xattr ext3 user_u:base_r:base_t;\n"); | |
c6d3aaa4 | 116 | fprintf(fout, "fs_use_xattr ext4 user_u:base_r:base_t;\n"); |
93c06cbb SH |
117 | fprintf(fout, "fs_use_xattr jfs user_u:base_r:base_t;\n"); |
118 | fprintf(fout, "fs_use_xattr xfs user_u:base_r:base_t;\n"); | |
119 | fprintf(fout, "fs_use_xattr reiserfs user_u:base_r:base_t;\n"); | |
c6d3aaa4 SS |
120 | fprintf(fout, "fs_use_xattr jffs2 user_u:base_r:base_t;\n"); |
121 | fprintf(fout, "fs_use_xattr gfs2 user_u:base_r:base_t;\n"); | |
122 | fprintf(fout, "fs_use_xattr lustre user_u:base_r:base_t;\n"); | |
93c06cbb | 123 | |
c6d3aaa4 | 124 | fprintf(fout, "fs_use_task eventpollfs user_u:base_r:base_t;\n"); |
93c06cbb SH |
125 | fprintf(fout, "fs_use_task pipefs user_u:base_r:base_t;\n"); |
126 | fprintf(fout, "fs_use_task sockfs user_u:base_r:base_t;\n"); | |
127 | ||
c6d3aaa4 | 128 | fprintf(fout, "fs_use_trans mqueue user_u:base_r:base_t;\n"); |
93c06cbb | 129 | fprintf(fout, "fs_use_trans devpts user_u:base_r:base_t;\n"); |
c6d3aaa4 | 130 | fprintf(fout, "fs_use_trans hugetlbfs user_u:base_r:base_t;\n"); |
93c06cbb SH |
131 | fprintf(fout, "fs_use_trans tmpfs user_u:base_r:base_t;\n"); |
132 | fprintf(fout, "fs_use_trans shm user_u:base_r:base_t;\n"); | |
133 | ||
134 | fprintf(fout, "genfscon proc / user_u:base_r:base_t\n"); | |
135 | ||
136 | fclose(fout); | |
137 | ||
138 | fout = fopen(ctxout, "w"); | |
139 | if (!fout) { | |
140 | printf("Wrote policy, but cannot open %s for writing\n", ctxout); | |
141 | usage(argv[0]); | |
142 | } | |
143 | fprintf(fout, "/ user_u:base_r:base_t\n"); | |
144 | fprintf(fout, "/.* user_u:base_r:base_t\n"); | |
145 | fclose(fout); | |
146 | ||
147 | return 0; | |
148 | } |