[deliverable/linux.git] / security / selinux / ss / conditional.c

/* Authors: Karl MacMillan <kmacmillan@tresys.com>
 *	    Frank Mayer <mayerf@tresys.com>
 *
 * Copyright (C) 2003 - 2004 Tresys Technology, LLC
 *	This program is free software; you can redistribute it and/or modify
 *	it under the terms of the GNU General Public License as published by
 *	the Free Software Foundation, version 2.
 */

#include <linux/kernel.h>
#include <linux/errno.h>
#include <linux/string.h>
#include <linux/spinlock.h>
#include <linux/slab.h>

#include "security.h"
#include "conditional.h"

/*
 * cond_evaluate_expr evaluates a conditional expr
 * in reverse polish notation. It returns true (1), false (0),
 * or undefined (-1). Undefined occurs when the expression
 * exceeds the stack depth of COND_EXPR_MAXDEPTH.
 */
static int cond_evaluate_expr(struct policydb *p, struct cond_expr *expr)
{

	struct cond_expr *cur;
	int s[COND_EXPR_MAXDEPTH];
	int sp = -1;

	for (cur = expr; cur; cur = cur->next) {
		switch (cur->expr_type) {
		case COND_BOOL:
			if (sp == (COND_EXPR_MAXDEPTH - 1))
				return -1;
			sp++;
			s[sp] = p->bool_val_to_struct[cur->bool - 1]->state;
			break;
		case COND_NOT:
			if (sp < 0)
				return -1;
			s[sp] = !s[sp];
			break;
		case COND_OR:
			if (sp < 1)
				return -1;
			sp--;
			s[sp] |= s[sp + 1];
			break;
		case COND_AND:
			if (sp < 1)
				return -1;
			sp--;
			s[sp] &= s[sp + 1];
			break;
		case COND_XOR:
			if (sp < 1)
				return -1;
			sp--;
			s[sp] ^= s[sp + 1];
			break;
		case COND_EQ:
			if (sp < 1)
				return -1;
			sp--;
			s[sp] = (s[sp] == s[sp + 1]);
			break;
		case COND_NEQ:
			if (sp < 1)
				return -1;
			sp--;
			s[sp] = (s[sp] != s[sp + 1]);
			break;
		default:
			return -1;
		}
	}
	return s[0];
}

/*
 * evaluate_cond_node evaluates the conditional stored in
 * a struct cond_node and if the result is different than the
 * current state of the node it sets the rules in the true/false
 * list appropriately. If the result of the expression is undefined
 * all of the rules are disabled for safety.
 */
int evaluate_cond_node(struct policydb *p, struct cond_node *node)
{
	int new_state;
	struct cond_av_list *cur;

	new_state = cond_evaluate_expr(p, node->expr);
	if (new_state != node->cur_state) {
		node->cur_state = new_state;
		if (new_state == -1)
			printk(KERN_ERR "SELinux: expression result was undefined - disabling all rules.\n");
		/* turn the rules on or off */
		for (cur = node->true_list; cur; cur = cur->next) {
			if (new_state <= 0)
				cur->node->key.specified &= ~AVTAB_ENABLED;
			else
				cur->node->key.specified |= AVTAB_ENABLED;
		}

		for (cur = node->false_list; cur; cur = cur->next) {
			/* -1 or 1 */
			if (new_state)
				cur->node->key.specified &= ~AVTAB_ENABLED;
			else
				cur->node->key.specified |= AVTAB_ENABLED;
		}
	}
	return 0;
}

int cond_policydb_init(struct policydb *p)
{
	p->bool_val_to_struct = NULL;
	p->cond_list = NULL;
	if (avtab_init(&p->te_cond_avtab))
		return -1;

	return 0;
}

static void cond_av_list_destroy(struct cond_av_list *list)
{
	struct cond_av_list *cur, *next;
	for (cur = list; cur; cur = next) {
		next = cur->next;
		/* the avtab_ptr_t node is destroy by the avtab */
		kfree(cur);
	}
}

static void cond_node_destroy(struct cond_node *node)
{
	struct cond_expr *cur_expr, *next_expr;

	for (cur_expr = node->expr; cur_expr; cur_expr = next_expr) {
		next_expr = cur_expr->next;
		kfree(cur_expr);
	}
	cond_av_list_destroy(node->true_list);
	cond_av_list_destroy(node->false_list);
	kfree(node);
}

static void cond_list_destroy(struct cond_node *list)
{
	struct cond_node *next, *cur;

	if (list == NULL)
		return;

	for (cur = list; cur; cur = next) {
		next = cur->next;
		cond_node_destroy(cur);
	}
}

void cond_policydb_destroy(struct policydb *p)
{
	kfree(p->bool_val_to_struct);
	avtab_destroy(&p->te_cond_avtab);
	cond_list_destroy(p->cond_list);
}

int cond_init_bool_indexes(struct policydb *p)
{
	kfree(p->bool_val_to_struct);
	p->bool_val_to_struct = (struct cond_bool_datum **)
		kmalloc(p->p_bools.nprim * sizeof(struct cond_bool_datum *), GFP_KERNEL);
	if (!p->bool_val_to_struct)
		return -1;
	return 0;
}

int cond_destroy_bool(void *key, void *datum, void *p)
{
	kfree(key);
	kfree(datum);
	return 0;
}

int cond_index_bool(void *key, void *datum, void *datap)
{
	struct policydb *p;
	struct cond_bool_datum *booldatum;

	booldatum = datum;
	p = datap;

	if (!booldatum->value || booldatum->value > p->p_bools.nprim)
		return -EINVAL;

	p->p_bool_val_to_name[booldatum->value - 1] = key;
	p->bool_val_to_struct[booldatum->value - 1] = booldatum;

	return 0;
}

static int bool_isvalid(struct cond_bool_datum *b)
{
	if (!(b->state == 0 || b->state == 1))
		return 0;
	return 1;
}

int cond_read_bool(struct policydb *p, struct hashtab *h, void *fp)
{
	char *key = NULL;
	struct cond_bool_datum *booldatum;
	__le32 buf[3];
	u32 len;
	int rc;

	booldatum = kzalloc(sizeof(struct cond_bool_datum), GFP_KERNEL);
	if (!booldatum)
		return -1;

	rc = next_entry(buf, fp, sizeof buf);
	if (rc < 0)
		goto err;

	booldatum->value = le32_to_cpu(buf[0]);
	booldatum->state = le32_to_cpu(buf[1]);

	if (!bool_isvalid(booldatum))
		goto err;

	len = le32_to_cpu(buf[2]);

	key = kmalloc(len + 1, GFP_KERNEL);
	if (!key)
		goto err;
	rc = next_entry(key, fp, len);
	if (rc < 0)
		goto err;
	key[len] = '\0';
	if (hashtab_insert(h, key, booldatum))
		goto err;

	return 0;
err:
	cond_destroy_bool(key, booldatum, NULL);
	return -1;
}

struct cond_insertf_data {
	struct policydb *p;
	struct cond_av_list *other;
	struct cond_av_list *head;
	struct cond_av_list *tail;
};

static int cond_insertf(struct avtab *a, struct avtab_key *k, struct avtab_datum *d, void *ptr)
{
	struct cond_insertf_data *data = ptr;
	struct policydb *p = data->p;
	struct cond_av_list *other = data->other, *list, *cur;
	struct avtab_node *node_ptr;
	u8 found;


	/*
	 * For type rules we have to make certain there aren't any
	 * conflicting rules by searching the te_avtab and the
	 * cond_te_avtab.
	 */
	if (k->specified & AVTAB_TYPE) {
		if (avtab_search(&p->te_avtab, k)) {
			printk(KERN_ERR "SELinux: type rule already exists outside of a conditional.\n");
			goto err;
		}
		/*
		 * If we are reading the false list other will be a pointer to
		 * the true list. We can have duplicate entries if there is only
		 * 1 other entry and it is in our true list.
		 *
		 * If we are reading the true list (other == NULL) there shouldn't
		 * be any other entries.
		 */
		if (other) {
			node_ptr = avtab_search_node(&p->te_cond_avtab, k);
			if (node_ptr) {
				if (avtab_search_node_next(node_ptr, k->specified)) {
					printk(KERN_ERR "SELinux: too many conflicting type rules.\n");
					goto err;
				}
				found = 0;
				for (cur = other; cur; cur = cur->next) {
					if (cur->node == node_ptr) {
						found = 1;
						break;
					}
				}
				if (!found) {
					printk(KERN_ERR "SELinux: conflicting type rules.\n");
					goto err;
				}
			}
		} else {
			if (avtab_search(&p->te_cond_avtab, k)) {
				printk(KERN_ERR "SELinux: conflicting type rules when adding type rule for true.\n");
				goto err;
			}
		}
	}

	node_ptr = avtab_insert_nonunique(&p->te_cond_avtab, k, d);
	if (!node_ptr) {
		printk(KERN_ERR "SELinux: could not insert rule.\n");
		goto err;
	}

	list = kzalloc(sizeof(struct cond_av_list), GFP_KERNEL);
	if (!list)
		goto err;

	list->node = node_ptr;
	if (!data->head)
		data->head = list;
	else
		data->tail->next = list;
	data->tail = list;
	return 0;

err:
	cond_av_list_destroy(data->head);
	data->head = NULL;
	return -1;
}

static int cond_read_av_list(struct policydb *p, void *fp, struct cond_av_list **ret_list, struct cond_av_list *other)
{
	int i, rc;
	__le32 buf[1];
	u32 len;
	struct cond_insertf_data data;

	*ret_list = NULL;

	len = 0;
	rc = next_entry(buf, fp, sizeof(u32));
	if (rc < 0)
		return -1;

	len = le32_to_cpu(buf[0]);
	if (len == 0)
		return 0;

	data.p = p;
	data.other = other;
	data.head = NULL;
	data.tail = NULL;
	for (i = 0; i < len; i++) {
		rc = avtab_read_item(&p->te_cond_avtab, fp, p, cond_insertf,
				     &data);
		if (rc)
			return rc;

	}

	*ret_list = data.head;
	return 0;
}

static int expr_isvalid(struct policydb *p, struct cond_expr *expr)
{
	if (expr->expr_type <= 0 || expr->expr_type > COND_LAST) {
		printk(KERN_ERR "SELinux: conditional expressions uses unknown operator.\n");
		return 0;
	}

	if (expr->bool > p->p_bools.nprim) {
		printk(KERN_ERR "SELinux: conditional expressions uses unknown bool.\n");
		return 0;
	}
	return 1;
}

static int cond_read_node(struct policydb *p, struct cond_node *node, void *fp)
{
	__le32 buf[2];
	u32 len, i;
	int rc;
	struct cond_expr *expr = NULL, *last = NULL;

	rc = next_entry(buf, fp, sizeof(u32));
	if (rc < 0)
		return -1;

	node->cur_state = le32_to_cpu(buf[0]);

	len = 0;
	rc = next_entry(buf, fp, sizeof(u32));
	if (rc < 0)
		return -1;

	/* expr */
	len = le32_to_cpu(buf[0]);

	for (i = 0; i < len; i++) {
		rc = next_entry(buf, fp, sizeof(u32) * 2);
		if (rc < 0)
			goto err;

		expr = kzalloc(sizeof(struct cond_expr), GFP_KERNEL);
		if (!expr)
			goto err;

		expr->expr_type = le32_to_cpu(buf[0]);
		expr->bool = le32_to_cpu(buf[1]);

		if (!expr_isvalid(p, expr)) {
			kfree(expr);
			goto err;
		}

		if (i == 0)
			node->expr = expr;
		else
			last->next = expr;
		last = expr;
	}

	if (cond_read_av_list(p, fp, &node->true_list, NULL) != 0)
		goto err;
	if (cond_read_av_list(p, fp, &node->false_list, node->true_list) != 0)
		goto err;
	return 0;
err:
	cond_node_destroy(node);
	return -1;
}

int cond_read_list(struct policydb *p, void *fp)
{
	struct cond_node *node, *last = NULL;
	__le32 buf[1];
	u32 i, len;
	int rc;

	rc = next_entry(buf, fp, sizeof buf);
	if (rc)
		return rc;

	len = le32_to_cpu(buf[0]);

	rc = avtab_alloc(&(p->te_cond_avtab), p->te_avtab.nel);
	if (rc)
		goto err;

	for (i = 0; i < len; i++) {
		rc = -ENOMEM;
		node = kzalloc(sizeof(struct cond_node), GFP_KERNEL);
		if (!node)
			goto err;

		rc = cond_read_node(p, node, fp);
		if (rc)
			goto err;

		if (i == 0)
			p->cond_list = node;
		else
			last->next = node;
		last = node;
	}
	return 0;
err:
	cond_list_destroy(p->cond_list);
	p->cond_list = NULL;
	return rc;
}

/* Determine whether additional permissions are granted by the conditional
 * av table, and if so, add them to the result
 */
void cond_compute_av(struct avtab *ctab, struct avtab_key *key, struct av_decision *avd)
{
	struct avtab_node *node;

	if (!ctab || !key || !avd)
		return;

	for (node = avtab_search_node(ctab, key); node;
				node = avtab_search_node_next(node, key->specified)) {
		if ((u16)(AVTAB_ALLOWED|AVTAB_ENABLED) ==
		    (node->key.specified & (AVTAB_ALLOWED|AVTAB_ENABLED)))
			avd->allowed |= node->datum.data;
		if ((u16)(AVTAB_AUDITDENY|AVTAB_ENABLED) ==
		    (node->key.specified & (AVTAB_AUDITDENY|AVTAB_ENABLED)))
			/* Since a '0' in an auditdeny mask represents a
			 * permission we do NOT want to audit (dontaudit), we use
			 * the '&' operand to ensure that all '0's in the mask
			 * are retained (much unlike the allow and auditallow cases).
			 */
			avd->auditdeny &= node->datum.data;
		if ((u16)(AVTAB_AUDITALLOW|AVTAB_ENABLED) ==
		    (node->key.specified & (AVTAB_AUDITALLOW|AVTAB_ENABLED)))
			avd->auditallow |= node->datum.data;
	}
	return;
}
Commit	Line	Data
1da177e4	1	/* Authors: Karl MacMillan <kmacmillan@tresys.com>
7c2b240e	2	* Frank Mayer <mayerf@tresys.com>
1da177e4 LT	3	*
	4	* Copyright (C) 2003 - 2004 Tresys Technology, LLC
	5	* This program is free software; you can redistribute it and/or modify
7c2b240e	6	* it under the terms of the GNU General Public License as published by
1da177e4 LT	7	* the Free Software Foundation, version 2.
	8	*/
	9
	10	#include <linux/kernel.h>
	11	#include <linux/errno.h>
	12	#include <linux/string.h>
	13	#include <linux/spinlock.h>
1da177e4 LT	14	#include <linux/slab.h>
	15
	16	#include "security.h"
	17	#include "conditional.h"
	18
	19	/*
	20	* cond_evaluate_expr evaluates a conditional expr
	21	* in reverse polish notation. It returns true (1), false (0),
	22	* or undefined (-1). Undefined occurs when the expression
	23	* exceeds the stack depth of COND_EXPR_MAXDEPTH.
	24	*/
	25	static int cond_evaluate_expr(struct policydb p, struct cond_expr expr)
	26	{
	27
	28	struct cond_expr *cur;
	29	int s[COND_EXPR_MAXDEPTH];
	30	int sp = -1;
	31
dbc74c65	32	for (cur = expr; cur; cur = cur->next) {
1da177e4 LT	33	switch (cur->expr_type) {
	34	case COND_BOOL:
	35	if (sp == (COND_EXPR_MAXDEPTH - 1))
	36	return -1;
	37	sp++;
	38	s[sp] = p->bool_val_to_struct[cur->bool - 1]->state;
	39	break;
	40	case COND_NOT:
	41	if (sp < 0)
	42	return -1;
	43	s[sp] = !s[sp];
	44	break;
	45	case COND_OR:
	46	if (sp < 1)
	47	return -1;
	48	sp--;
	49	s[sp] \|= s[sp + 1];
	50	break;
	51	case COND_AND:
	52	if (sp < 1)
	53	return -1;
	54	sp--;
	55	s[sp] &= s[sp + 1];
	56	break;
	57	case COND_XOR:
	58	if (sp < 1)
	59	return -1;
	60	sp--;
	61	s[sp] ^= s[sp + 1];
	62	break;
	63	case COND_EQ:
	64	if (sp < 1)
	65	return -1;
	66	sp--;
	67	s[sp] = (s[sp] == s[sp + 1]);
	68	break;
	69	case COND_NEQ:
	70	if (sp < 1)
	71	return -1;
	72	sp--;
	73	s[sp] = (s[sp] != s[sp + 1]);
	74	break;
	75	default:
	76	return -1;
	77	}
	78	}
	79	return s[0];
	80	}
	81
	82	/*
	83	* evaluate_cond_node evaluates the conditional stored in
	84	* a struct cond_node and if the result is different than the
	85	* current state of the node it sets the rules in the true/false
	86	* list appropriately. If the result of the expression is undefined
	87	* all of the rules are disabled for safety.
	88	*/
	89	int evaluate_cond_node(struct policydb p, struct cond_node node)
	90	{
	91	int new_state;
7c2b240e	92	struct cond_av_list *cur;
1da177e4 LT	93
	94	new_state = cond_evaluate_expr(p, node->expr);
	95	if (new_state != node->cur_state) {
	96	node->cur_state = new_state;
	97	if (new_state == -1)
454d972c	98	printk(KERN_ERR "SELinux: expression result was undefined - disabling all rules.\n");
1da177e4	99	/* turn the rules on or off */
dbc74c65	100	for (cur = node->true_list; cur; cur = cur->next) {
7c2b240e	101	if (new_state <= 0)
782ebb99	102	cur->node->key.specified &= ~AVTAB_ENABLED;
7c2b240e	103	else
782ebb99	104	cur->node->key.specified \|= AVTAB_ENABLED;
1da177e4 LT	105	}
1da177e4 LT	106
dbc74c65	107	for (cur = node->false_list; cur; cur = cur->next) {
1da177e4	108	/* -1 or 1 */
7c2b240e	109	if (new_state)
782ebb99	110	cur->node->key.specified &= ~AVTAB_ENABLED;
7c2b240e	111	else
782ebb99	112	cur->node->key.specified \|= AVTAB_ENABLED;
1da177e4 LT	113	}
	114	}
	115	return 0;
	116	}
	117
	118	int cond_policydb_init(struct policydb *p)
	119	{
	120	p->bool_val_to_struct = NULL;
	121	p->cond_list = NULL;
	122	if (avtab_init(&p->te_cond_avtab))
	123	return -1;
	124
	125	return 0;
	126	}
	127
	128	static void cond_av_list_destroy(struct cond_av_list *list)
	129	{
	130	struct cond_av_list cur, next;
dbc74c65	131	for (cur = list; cur; cur = next) {
1da177e4 LT	132	next = cur->next;
	133	/* the avtab_ptr_t node is destroy by the avtab */
	134	kfree(cur);
	135	}
	136	}
	137
	138	static void cond_node_destroy(struct cond_node *node)
	139	{
	140	struct cond_expr cur_expr, next_expr;
	141
dbc74c65	142	for (cur_expr = node->expr; cur_expr; cur_expr = next_expr) {
1da177e4 LT	143	next_expr = cur_expr->next;
	144	kfree(cur_expr);
	145	}
	146	cond_av_list_destroy(node->true_list);
	147	cond_av_list_destroy(node->false_list);
	148	kfree(node);
	149	}
	150
	151	static void cond_list_destroy(struct cond_node *list)
	152	{
	153	struct cond_node next, cur;
	154
	155	if (list == NULL)
	156	return;
	157
dbc74c65	158	for (cur = list; cur; cur = next) {
1da177e4 LT	159	next = cur->next;
	160	cond_node_destroy(cur);
	161	}
	162	}
	163
	164	void cond_policydb_destroy(struct policydb *p)
	165	{
9a5f04bf	166	kfree(p->bool_val_to_struct);
1da177e4 LT	167	avtab_destroy(&p->te_cond_avtab);
	168	cond_list_destroy(p->cond_list);
	169	}
	170
	171	int cond_init_bool_indexes(struct policydb *p)
	172	{
9a5f04bf	173	kfree(p->bool_val_to_struct);
7c2b240e EP	174	p->bool_val_to_struct = (struct cond_bool_datum **)
7c2b240e EP	175	kmalloc(p->p_bools.nprim * sizeof(struct cond_bool_datum *), GFP_KERNEL);
1da177e4 LT	176	if (!p->bool_val_to_struct)
	177	return -1;
	178	return 0;
	179	}
	180
	181	int cond_destroy_bool(void key, void datum, void *p)
	182	{
9a5f04bf	183	kfree(key);
1da177e4 LT	184	kfree(datum);
	185	return 0;
	186	}
	187
	188	int cond_index_bool(void key, void datum, void *datap)
	189	{
	190	struct policydb *p;
	191	struct cond_bool_datum *booldatum;
	192
	193	booldatum = datum;
	194	p = datap;
	195
	196	if (!booldatum->value \|\| booldatum->value > p->p_bools.nprim)
	197	return -EINVAL;
	198
	199	p->p_bool_val_to_name[booldatum->value - 1] = key;
7c2b240e	200	p->bool_val_to_struct[booldatum->value - 1] = booldatum;
1da177e4 LT	201
	202	return 0;
	203	}
	204
	205	static int bool_isvalid(struct cond_bool_datum *b)
	206	{
	207	if (!(b->state == 0 \|\| b->state == 1))
	208	return 0;
	209	return 1;
	210	}
	211
	212	int cond_read_bool(struct policydb p, struct hashtab h, void *fp)
	213	{
	214	char *key = NULL;
	215	struct cond_bool_datum *booldatum;
b5bf6c55 AD	216	__le32 buf[3];
b5bf6c55 AD	217	u32 len;
1da177e4 LT	218	int rc;
1da177e4 LT	219
89d155ef	220	booldatum = kzalloc(sizeof(struct cond_bool_datum), GFP_KERNEL);
1da177e4 LT	221	if (!booldatum)
1da177e4 LT	222	return -1;
1da177e4 LT	223
	224	rc = next_entry(buf, fp, sizeof buf);
	225	if (rc < 0)
	226	goto err;
	227
	228	booldatum->value = le32_to_cpu(buf[0]);
	229	booldatum->state = le32_to_cpu(buf[1]);
	230
	231	if (!bool_isvalid(booldatum))
	232	goto err;
	233
	234	len = le32_to_cpu(buf[2]);
	235
	236	key = kmalloc(len + 1, GFP_KERNEL);
	237	if (!key)
	238	goto err;
	239	rc = next_entry(key, fp, len);
	240	if (rc < 0)
	241	goto err;
df4ea865	242	key[len] = '\0';
1da177e4 LT	243	if (hashtab_insert(h, key, booldatum))
	244	goto err;
	245
	246	return 0;
	247	err:
	248	cond_destroy_bool(key, booldatum, NULL);
	249	return -1;
	250	}
	251
7c2b240e	252	struct cond_insertf_data {
782ebb99 SS	253	struct policydb *p;
	254	struct cond_av_list *other;
	255	struct cond_av_list *head;
	256	struct cond_av_list *tail;
	257	};
	258
	259	static int cond_insertf(struct avtab a, struct avtab_key k, struct avtab_datum d, void ptr)
	260	{
	261	struct cond_insertf_data *data = ptr;
	262	struct policydb *p = data->p;
	263	struct cond_av_list other = data->other, list, *cur;
1da177e4	264	struct avtab_node *node_ptr;
1da177e4 LT	265	u8 found;
1da177e4 LT	266
1da177e4	267
782ebb99 SS	268	/*
	269	* For type rules we have to make certain there aren't any
	270	* conflicting rules by searching the te_avtab and the
	271	* cond_te_avtab.
	272	*/
	273	if (k->specified & AVTAB_TYPE) {
	274	if (avtab_search(&p->te_avtab, k)) {
744ba35e	275	printk(KERN_ERR "SELinux: type rule already exists outside of a conditional.\n");
1da177e4	276	goto err;
782ebb99	277	}
1da177e4	278	/*
782ebb99 SS	279	* If we are reading the false list other will be a pointer to
	280	* the true list. We can have duplicate entries if there is only
	281	* 1 other entry and it is in our true list.
	282	*
	283	* If we are reading the true list (other == NULL) there shouldn't
	284	* be any other entries.
1da177e4	285	*/
782ebb99 SS	286	if (other) {
	287	node_ptr = avtab_search_node(&p->te_cond_avtab, k);
	288	if (node_ptr) {
	289	if (avtab_search_node_next(node_ptr, k->specified)) {
744ba35e	290	printk(KERN_ERR "SELinux: too many conflicting type rules.\n");
782ebb99 SS	291	goto err;
	292	}
	293	found = 0;
dbc74c65	294	for (cur = other; cur; cur = cur->next) {
782ebb99 SS	295	if (cur->node == node_ptr) {
	296	found = 1;
	297	break;
1da177e4 LT	298	}
1da177e4 LT	299	}
782ebb99	300	if (!found) {
744ba35e	301	printk(KERN_ERR "SELinux: conflicting type rules.\n");
1da177e4 LT	302	goto err;
	303	}
	304	}
782ebb99 SS	305	} else {
782ebb99 SS	306	if (avtab_search(&p->te_cond_avtab, k)) {
744ba35e	307	printk(KERN_ERR "SELinux: conflicting type rules when adding type rule for true.\n");
782ebb99 SS	308	goto err;
782ebb99 SS	309	}
1da177e4	310	}
782ebb99	311	}
1da177e4	312
782ebb99 SS	313	node_ptr = avtab_insert_nonunique(&p->te_cond_avtab, k, d);
782ebb99 SS	314	if (!node_ptr) {
744ba35e	315	printk(KERN_ERR "SELinux: could not insert rule.\n");
782ebb99	316	goto err;
1da177e4 LT	317	}
1da177e4 LT	318
89d155ef	319	list = kzalloc(sizeof(struct cond_av_list), GFP_KERNEL);
782ebb99 SS	320	if (!list)
782ebb99 SS	321	goto err;
782ebb99 SS	322
	323	list->node = node_ptr;
	324	if (!data->head)
	325	data->head = list;
	326	else
	327	data->tail->next = list;
	328	data->tail = list;
1da177e4	329	return 0;
782ebb99	330
1da177e4	331	err:
782ebb99 SS	332	cond_av_list_destroy(data->head);
782ebb99 SS	333	data->head = NULL;
1da177e4 LT	334	return -1;
	335	}
	336
782ebb99 SS	337	static int cond_read_av_list(struct policydb p, void fp, struct cond_av_list *ret_list, struct cond_av_list other)
	338	{
	339	int i, rc;
b5bf6c55 AD	340	__le32 buf[1];
b5bf6c55 AD	341	u32 len;
782ebb99 SS	342	struct cond_insertf_data data;
	343
	344	*ret_list = NULL;
	345
	346	len = 0;
	347	rc = next_entry(buf, fp, sizeof(u32));
	348	if (rc < 0)
	349	return -1;
	350
	351	len = le32_to_cpu(buf[0]);
7c2b240e	352	if (len == 0)
782ebb99	353	return 0;
782ebb99 SS	354
	355	data.p = p;
	356	data.other = other;
	357	data.head = NULL;
	358	data.tail = NULL;
	359	for (i = 0; i < len; i++) {
45e5421e SS	360	rc = avtab_read_item(&p->te_cond_avtab, fp, p, cond_insertf,
45e5421e SS	361	&data);
782ebb99 SS	362	if (rc)
	363	return rc;
	364
	365	}
	366
	367	*ret_list = data.head;
	368	return 0;
	369	}
	370
1da177e4 LT	371	static int expr_isvalid(struct policydb p, struct cond_expr expr)
	372	{
	373	if (expr->expr_type <= 0 \|\| expr->expr_type > COND_LAST) {
744ba35e	374	printk(KERN_ERR "SELinux: conditional expressions uses unknown operator.\n");
1da177e4 LT	375	return 0;
	376	}
	377
	378	if (expr->bool > p->p_bools.nprim) {
744ba35e	379	printk(KERN_ERR "SELinux: conditional expressions uses unknown bool.\n");
1da177e4 LT	380	return 0;
	381	}
	382	return 1;
	383	}
	384
	385	static int cond_read_node(struct policydb p, struct cond_node node, void *fp)
	386	{
b5bf6c55 AD	387	__le32 buf[2];
b5bf6c55 AD	388	u32 len, i;
1da177e4 LT	389	int rc;
	390	struct cond_expr expr = NULL, last = NULL;
	391
	392	rc = next_entry(buf, fp, sizeof(u32));
	393	if (rc < 0)
	394	return -1;
	395
	396	node->cur_state = le32_to_cpu(buf[0]);
	397
	398	len = 0;
	399	rc = next_entry(buf, fp, sizeof(u32));
	400	if (rc < 0)
	401	return -1;
	402
	403	/* expr */
	404	len = le32_to_cpu(buf[0]);
	405
7c2b240e	406	for (i = 0; i < len; i++) {
1da177e4 LT	407	rc = next_entry(buf, fp, sizeof(u32) * 2);
	408	if (rc < 0)
	409	goto err;
	410
89d155ef	411	expr = kzalloc(sizeof(struct cond_expr), GFP_KERNEL);
7c2b240e	412	if (!expr)
1da177e4	413	goto err;
1da177e4 LT	414
	415	expr->expr_type = le32_to_cpu(buf[0]);
	416	expr->bool = le32_to_cpu(buf[1]);
	417
	418	if (!expr_isvalid(p, expr)) {
	419	kfree(expr);
	420	goto err;
	421	}
	422
7c2b240e	423	if (i == 0)
1da177e4	424	node->expr = expr;
7c2b240e	425	else
1da177e4	426	last->next = expr;
1da177e4 LT	427	last = expr;
	428	}
	429
	430	if (cond_read_av_list(p, fp, &node->true_list, NULL) != 0)
	431	goto err;
	432	if (cond_read_av_list(p, fp, &node->false_list, node->true_list) != 0)
	433	goto err;
	434	return 0;
	435	err:
	436	cond_node_destroy(node);
	437	return -1;
	438	}
	439
	440	int cond_read_list(struct policydb p, void fp)
	441	{
	442	struct cond_node node, last = NULL;
b5bf6c55 AD	443	__le32 buf[1];
b5bf6c55 AD	444	u32 i, len;
1da177e4 LT	445	int rc;
	446
	447	rc = next_entry(buf, fp, sizeof buf);
5241c107 DC	448	if (rc)
5241c107 DC	449	return rc;
1da177e4 LT	450
	451	len = le32_to_cpu(buf[0]);
	452
3232c110 YN	453	rc = avtab_alloc(&(p->te_cond_avtab), p->te_avtab.nel);
	454	if (rc)
	455	goto err;
	456
1da177e4	457	for (i = 0; i < len; i++) {
5241c107	458	rc = -ENOMEM;
89d155ef	459	node = kzalloc(sizeof(struct cond_node), GFP_KERNEL);
1da177e4 LT	460	if (!node)
1da177e4 LT	461	goto err;
1da177e4	462
5241c107 DC	463	rc = cond_read_node(p, node, fp);
5241c107 DC	464	if (rc)
1da177e4 LT	465	goto err;
1da177e4 LT	466
7c2b240e	467	if (i == 0)
1da177e4	468	p->cond_list = node;
7c2b240e	469	else
1da177e4	470	last->next = node;
1da177e4 LT	471	last = node;
	472	}
	473	return 0;
	474	err:
	475	cond_list_destroy(p->cond_list);
782ebb99	476	p->cond_list = NULL;
5241c107	477	return rc;
1da177e4 LT	478	}
	479
	480	/* Determine whether additional permissions are granted by the conditional
	481	* av table, and if so, add them to the result
	482	*/
	483	void cond_compute_av(struct avtab ctab, struct avtab_key key, struct av_decision *avd)
	484	{
	485	struct avtab_node *node;
	486
7c2b240e	487	if (!ctab \|\| !key \|\| !avd)
1da177e4 LT	488	return;
1da177e4 LT	489
dbc74c65	490	for (node = avtab_search_node(ctab, key); node;
782ebb99	491	node = avtab_search_node_next(node, key->specified)) {
7c2b240e EP	492	if ((u16)(AVTAB_ALLOWED\|AVTAB_ENABLED) ==
7c2b240e EP	493	(node->key.specified & (AVTAB_ALLOWED\|AVTAB_ENABLED)))
782ebb99	494	avd->allowed \|= node->datum.data;
7c2b240e EP	495	if ((u16)(AVTAB_AUDITDENY\|AVTAB_ENABLED) ==
7c2b240e EP	496	(node->key.specified & (AVTAB_AUDITDENY\|AVTAB_ENABLED)))
1da177e4 LT	497	/* Since a '0' in an auditdeny mask represents a
	498	* permission we do NOT want to audit (dontaudit), we use
	499	* the '&' operand to ensure that all '0's in the mask
	500	* are retained (much unlike the allow and auditallow cases).
	501	*/
782ebb99	502	avd->auditdeny &= node->datum.data;
7c2b240e EP	503	if ((u16)(AVTAB_AUDITALLOW\|AVTAB_ENABLED) ==
7c2b240e EP	504	(node->key.specified & (AVTAB_AUDITALLOW\|AVTAB_ENABLED)))
782ebb99	505	avd->auditallow \|= node->datum.data;
1da177e4 LT	506	}
	507	return;
	508	}