nagai/kernel
3
0
Fork 0
forked from mirrors/linux
Code Pull requests Activity

selinux: use separate table for initial SID lookup

Browse source 
This moves handling of initial SIDs into a separate table. Note that the
SIDs stored in the main table are now shifted by SECINITSID_NUM and
converted to/from the actual SIDs transparently by helper functions.

This change doesn't make much sense on its own, but it simplifies
further sidtab overhaul in a succeeding patch.

Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
Reviewed-by: Stephen Smalley <sds@tycho.nsa.gov>
[PM: fixed some checkpatch warnings on line length, whitespace]
Signed-off-by: Paul Moore <paul@paul-moore.com>
This commit is contained in:
Ondrej Mosnacek 2018-11-30 16:24:07 +01:00 committed by Paul Moore
parent 89f5bebcf0
commit 24ed7fdae6
5 changed files with 174 additions and 111 deletions
repo.diff.show_diff_stats Download patch file Download diff file Expand all files Collapse all files

10
security/selinux/ss/policydb.c
View file

@ -909,13 +909,21 @@ int policydb_load_isids(struct policydb *p, struct sidtab *s)
if (!c->context[0].user) { if (!c->context[0].user) {
pr_err("SELinux: SID %s was never defined.\n", pr_err("SELinux: SID %s was never defined.\n",
c->u.name); c->u.name);
sidtab_destroy(s);
goto out;
}
if (c->sid[0] == SECSID_NULL || c->sid[0] > SECINITSID_NUM) {
pr_err("SELinux: Initial SID %s out of range.\n",
c->u.name);
sidtab_destroy(s);
goto out; goto out;
} }
rc = sidtab_insert(s, c->sid[0], &c->context[0]); rc = sidtab_set_initial(s, c->sid[0], &c->context[0]);
if (rc) { if (rc) {
pr_err("SELinux: unable to load initial SID %s.\n", pr_err("SELinux: unable to load initial SID %s.\n",
c->u.name); c->u.name);
sidtab_destroy(s);
goto out; goto out;
} }
} }

88
security/selinux/ss/services.c
View file

@ -776,7 +776,7 @@ static int security_compute_validatetrans(struct selinux_state *state,
read_lock(&state->ss->policy_rwlock); read_lock(&state->ss->policy_rwlock);
policydb = &state->ss->policydb; policydb = &state->ss->policydb;
sidtab = &state->ss->sidtab; sidtab = state->ss->sidtab;
if (!user) if (!user)
tclass = unmap_class(&state->ss->map, orig_tclass); tclass = unmap_class(&state->ss->map, orig_tclass);
@ -876,7 +876,7 @@ int security_bounded_transition(struct selinux_state *state,
read_lock(&state->ss->policy_rwlock); read_lock(&state->ss->policy_rwlock);
policydb = &state->ss->policydb; policydb = &state->ss->policydb;
sidtab = &state->ss->sidtab; sidtab = state->ss->sidtab;
rc = -EINVAL; rc = -EINVAL;
old_context = sidtab_search(sidtab, old_sid); old_context = sidtab_search(sidtab, old_sid);
@ -1034,7 +1034,7 @@ void security_compute_xperms_decision(struct selinux_state *state,
goto allow; goto allow;
policydb = &state->ss->policydb; policydb = &state->ss->policydb;
sidtab = &state->ss->sidtab; sidtab = state->ss->sidtab;
scontext = sidtab_search(sidtab, ssid); scontext = sidtab_search(sidtab, ssid);
if (!scontext) { if (!scontext) {
@ -1123,7 +1123,7 @@ void security_compute_av(struct selinux_state *state,
goto allow; goto allow;
policydb = &state->ss->policydb; policydb = &state->ss->policydb;
sidtab = &state->ss->sidtab; sidtab = state->ss->sidtab;
scontext = sidtab_search(sidtab, ssid); scontext = sidtab_search(sidtab, ssid);
if (!scontext) { if (!scontext) {
@ -1177,7 +1177,7 @@ void security_compute_av_user(struct selinux_state *state,
goto allow; goto allow;
policydb = &state->ss->policydb; policydb = &state->ss->policydb;
sidtab = &state->ss->sidtab; sidtab = state->ss->sidtab;
scontext = sidtab_search(sidtab, ssid); scontext = sidtab_search(sidtab, ssid);
if (!scontext) { if (!scontext) {
@ -1315,7 +1315,7 @@ static int security_sid_to_context_core(struct selinux_state *state,
} }
read_lock(&state->ss->policy_rwlock); read_lock(&state->ss->policy_rwlock);
policydb = &state->ss->policydb; policydb = &state->ss->policydb;
sidtab = &state->ss->sidtab; sidtab = state->ss->sidtab;
if (force) if (force)
context = sidtab_search_force(sidtab, sid); context = sidtab_search_force(sidtab, sid);
else else
@ -1483,7 +1483,7 @@ static int security_context_to_sid_core(struct selinux_state *state,
} }
read_lock(&state->ss->policy_rwlock); read_lock(&state->ss->policy_rwlock);
policydb = &state->ss->policydb; policydb = &state->ss->policydb;
sidtab = &state->ss->sidtab; sidtab = state->ss->sidtab;
rc = string_to_context_struct(policydb, sidtab, scontext2, rc = string_to_context_struct(policydb, sidtab, scontext2,
&context, def_sid); &context, def_sid);
if (rc == -EINVAL && force) { if (rc == -EINVAL && force) {
@ -1668,7 +1668,7 @@ static int security_compute_sid(struct selinux_state *state,
} }
policydb = &state->ss->policydb; policydb = &state->ss->policydb;
sidtab = &state->ss->sidtab; sidtab = state->ss->sidtab;
scontext = sidtab_search(sidtab, ssid); scontext = sidtab_search(sidtab, ssid);
if (!scontext) { if (!scontext) {
@ -1925,10 +1925,7 @@ static int convert_context(u32 key,
struct user_datum *usrdatum; struct user_datum *usrdatum;
char *s; char *s;
u32 len; u32 len;
int rc = 0; int rc;
if (key <= SECINITSID_NUM)
goto out;
args = p; args = p;
@ -2090,9 +2087,8 @@ static int security_preserve_bools(struct selinux_state *state,
int security_load_policy(struct selinux_state *state, void *data, size_t len) int security_load_policy(struct selinux_state *state, void *data, size_t len)
{ {
struct policydb *policydb; struct policydb *policydb;
struct sidtab *sidtab; struct sidtab *oldsidtab, *newsidtab;
struct policydb *oldpolicydb, *newpolicydb; struct policydb *oldpolicydb, *newpolicydb;
struct sidtab oldsidtab, newsidtab;
struct selinux_mapping *oldmapping; struct selinux_mapping *oldmapping;
struct selinux_map newmap; struct selinux_map newmap;
struct convert_context_args args; struct convert_context_args args;
@ -2108,27 +2104,37 @@ int security_load_policy(struct selinux_state *state, void *data, size_t len)
newpolicydb = oldpolicydb + 1; newpolicydb = oldpolicydb + 1;
policydb = &state->ss->policydb; policydb = &state->ss->policydb;
sidtab = &state->ss->sidtab;
newsidtab = kmalloc(sizeof(*newsidtab), GFP_KERNEL);
if (!newsidtab) {
rc = -ENOMEM;
goto out;
}
if (!state->initialized) { if (!state->initialized) {
rc = policydb_read(policydb, fp); rc = policydb_read(policydb, fp);
if (rc) if (rc) {
kfree(newsidtab);
goto out; goto out;
}
policydb->len = len; policydb->len = len;
rc = selinux_set_mapping(policydb, secclass_map, rc = selinux_set_mapping(policydb, secclass_map,
&state->ss->map); &state->ss->map);
if (rc) { if (rc) {
kfree(newsidtab);
policydb_destroy(policydb); policydb_destroy(policydb);
goto out; goto out;
} }
rc = policydb_load_isids(policydb, sidtab); rc = policydb_load_isids(policydb, newsidtab);
if (rc) { if (rc) {
kfree(newsidtab);
policydb_destroy(policydb); policydb_destroy(policydb);
goto out; goto out;
} }
state->ss->sidtab = newsidtab;
security_load_policycaps(state); security_load_policycaps(state);
state->initialized = 1; state->initialized = 1;
seqno = ++state->ss->latest_granting; seqno = ++state->ss->latest_granting;
@ -2141,13 +2147,17 @@ int security_load_policy(struct selinux_state *state, void *data, size_t len)
goto out; goto out;
} }
oldsidtab = state->ss->sidtab;
#if 0 #if 0
sidtab_hash_eval(sidtab, "sids"); sidtab_hash_eval(oldsidtab, "sids");
#endif #endif
rc = policydb_read(newpolicydb, fp); rc = policydb_read(newpolicydb, fp);
if (rc) if (rc) {
kfree(newsidtab);
goto out; goto out;
}
newpolicydb->len = len; newpolicydb->len = len;
/* If switching between different policy types, log MLS status */ /* If switching between different policy types, log MLS status */
@ -2156,10 +2166,11 @@ int security_load_policy(struct selinux_state *state, void *data, size_t len)
else if (!policydb->mls_enabled && newpolicydb->mls_enabled) else if (!policydb->mls_enabled && newpolicydb->mls_enabled)
pr_info("SELinux: Enabling MLS support...\n"); pr_info("SELinux: Enabling MLS support...\n");
rc = policydb_load_isids(newpolicydb, &newsidtab); rc = policydb_load_isids(newpolicydb, newsidtab);
if (rc) { if (rc) {
pr_err("SELinux: unable to load the initial SIDs\n"); pr_err("SELinux: unable to load the initial SIDs\n");
policydb_destroy(newpolicydb); policydb_destroy(newpolicydb);
kfree(newsidtab);
goto out; goto out;
} }
@ -2180,7 +2191,7 @@ int security_load_policy(struct selinux_state *state, void *data, size_t len)
args.state = state; args.state = state;
args.oldp = policydb; args.oldp = policydb;
args.newp = newpolicydb; args.newp = newpolicydb;
rc = sidtab_convert(sidtab, &newsidtab, convert_context, &args); rc = sidtab_convert(oldsidtab, newsidtab, convert_context, &args);
if (rc) { if (rc) {
pr_err("SELinux: unable to convert the internal" pr_err("SELinux: unable to convert the internal"
" representation of contexts in the new SID" " representation of contexts in the new SID"
@ -2190,12 +2201,11 @@ int security_load_policy(struct selinux_state *state, void *data, size_t len)
/* Save the old policydb and SID table to free later. */ /* Save the old policydb and SID table to free later. */
memcpy(oldpolicydb, policydb, sizeof(*policydb)); memcpy(oldpolicydb, policydb, sizeof(*policydb));
sidtab_set(&oldsidtab, sidtab);
/* Install the new policydb and SID table. */ /* Install the new policydb and SID table. */
write_lock_irq(&state->ss->policy_rwlock); write_lock_irq(&state->ss->policy_rwlock);
memcpy(policydb, newpolicydb, sizeof(*policydb)); memcpy(policydb, newpolicydb, sizeof(*policydb));
sidtab_set(sidtab, &newsidtab); state->ss->sidtab = newsidtab;
security_load_policycaps(state); security_load_policycaps(state);
oldmapping = state->ss->map.mapping; oldmapping = state->ss->map.mapping;
state->ss->map.mapping = newmap.mapping; state->ss->map.mapping = newmap.mapping;
@ -2205,7 +2215,8 @@ int security_load_policy(struct selinux_state *state, void *data, size_t len)
/* Free the old policydb and SID table. */ /* Free the old policydb and SID table. */
policydb_destroy(oldpolicydb); policydb_destroy(oldpolicydb);
sidtab_destroy(&oldsidtab); sidtab_destroy(oldsidtab);
kfree(oldsidtab);
kfree(oldmapping); kfree(oldmapping);
avc_ss_reset(state->avc, seqno); avc_ss_reset(state->avc, seqno);
@ -2219,7 +2230,8 @@ int security_load_policy(struct selinux_state *state, void *data, size_t len)
err: err:
kfree(newmap.mapping); kfree(newmap.mapping);
sidtab_destroy(&newsidtab); sidtab_destroy(newsidtab);
kfree(newsidtab);
policydb_destroy(newpolicydb); policydb_destroy(newpolicydb);
out: out:
@ -2256,7 +2268,7 @@ int security_port_sid(struct selinux_state *state,
read_lock(&state->ss->policy_rwlock); read_lock(&state->ss->policy_rwlock);
policydb = &state->ss->policydb; policydb = &state->ss->policydb;
sidtab = &state->ss->sidtab; sidtab = state->ss->sidtab;
c = policydb->ocontexts[OCON_PORT]; c = policydb->ocontexts[OCON_PORT];
while (c) { while (c) {
@ -2302,7 +2314,7 @@ int security_ib_pkey_sid(struct selinux_state *state,
read_lock(&state->ss->policy_rwlock); read_lock(&state->ss->policy_rwlock);
policydb = &state->ss->policydb; policydb = &state->ss->policydb;
sidtab = &state->ss->sidtab; sidtab = state->ss->sidtab;
c = policydb->ocontexts[OCON_IBPKEY]; c = policydb->ocontexts[OCON_IBPKEY];
while (c) { while (c) {
@ -2348,7 +2360,7 @@ int security_ib_endport_sid(struct selinux_state *state,
read_lock(&state->ss->policy_rwlock); read_lock(&state->ss->policy_rwlock);
policydb = &state->ss->policydb; policydb = &state->ss->policydb;
sidtab = &state->ss->sidtab; sidtab = state->ss->sidtab;
c = policydb->ocontexts[OCON_IBENDPORT]; c = policydb->ocontexts[OCON_IBENDPORT];
while (c) { while (c) {
@ -2394,7 +2406,7 @@ int security_netif_sid(struct selinux_state *state,
read_lock(&state->ss->policy_rwlock); read_lock(&state->ss->policy_rwlock);
policydb = &state->ss->policydb; policydb = &state->ss->policydb;
sidtab = &state->ss->sidtab; sidtab = state->ss->sidtab;
c = policydb->ocontexts[OCON_NETIF]; c = policydb->ocontexts[OCON_NETIF];
while (c) { while (c) {
@ -2459,7 +2471,7 @@ int security_node_sid(struct selinux_state *state,
read_lock(&state->ss->policy_rwlock); read_lock(&state->ss->policy_rwlock);
policydb = &state->ss->policydb; policydb = &state->ss->policydb;
sidtab = &state->ss->sidtab; sidtab = state->ss->sidtab;
switch (domain) { switch (domain) {
case AF_INET: { case AF_INET: {
@ -2559,7 +2571,7 @@ int security_get_user_sids(struct selinux_state *state,
read_lock(&state->ss->policy_rwlock); read_lock(&state->ss->policy_rwlock);
policydb = &state->ss->policydb; policydb = &state->ss->policydb;
sidtab = &state->ss->sidtab; sidtab = state->ss->sidtab;
context_init(&usercon); context_init(&usercon);
@ -2661,7 +2673,7 @@ static inline int __security_genfs_sid(struct selinux_state *state,
u32 *sid) u32 *sid)
{ {
struct policydb *policydb = &state->ss->policydb; struct policydb *policydb = &state->ss->policydb;
struct sidtab *sidtab = &state->ss->sidtab; struct sidtab *sidtab = state->ss->sidtab;
int len; int len;
u16 sclass; u16 sclass;
struct genfs *genfs; struct genfs *genfs;
@ -2747,7 +2759,7 @@ int security_fs_use(struct selinux_state *state, struct super_block *sb)
read_lock(&state->ss->policy_rwlock); read_lock(&state->ss->policy_rwlock);
policydb = &state->ss->policydb; policydb = &state->ss->policydb;
sidtab = &state->ss->sidtab; sidtab = state->ss->sidtab;
c = policydb->ocontexts[OCON_FSUSE]; c = policydb->ocontexts[OCON_FSUSE];
while (c) { while (c) {
@ -2953,7 +2965,7 @@ int security_sid_mls_copy(struct selinux_state *state,
u32 sid, u32 mls_sid, u32 *new_sid) u32 sid, u32 mls_sid, u32 *new_sid)
{ {
struct policydb *policydb = &state->ss->policydb; struct policydb *policydb = &state->ss->policydb;
struct sidtab *sidtab = &state->ss->sidtab; struct sidtab *sidtab = state->ss->sidtab;
struct context *context1; struct context *context1;
struct context *context2; struct context *context2;
struct context newcon; struct context newcon;
@ -3044,7 +3056,7 @@ int security_net_peersid_resolve(struct selinux_state *state,
u32 *peer_sid) u32 *peer_sid)
{ {
struct policydb *policydb = &state->ss->policydb; struct policydb *policydb = &state->ss->policydb;
struct sidtab *sidtab = &state->ss->sidtab; struct sidtab *sidtab = state->ss->sidtab;
int rc; int rc;
struct context *nlbl_ctx; struct context *nlbl_ctx;
struct context *xfrm_ctx; struct context *xfrm_ctx;
@ -3405,7 +3417,7 @@ int selinux_audit_rule_match(u32 sid, u32 field, u32 op, void *vrule,
goto out; goto out;
} }
ctxt = sidtab_search(&state->ss->sidtab, sid); ctxt = sidtab_search(state->ss->sidtab, sid);
if (unlikely(!ctxt)) { if (unlikely(!ctxt)) {
WARN_ONCE(1, "selinux_audit_rule_match: unrecognized SID %d\n", WARN_ONCE(1, "selinux_audit_rule_match: unrecognized SID %d\n",
sid); sid);
@ -3568,7 +3580,7 @@ int security_netlbl_secattr_to_sid(struct selinux_state *state,
u32 *sid) u32 *sid)
{ {
struct policydb *policydb = &state->ss->policydb; struct policydb *policydb = &state->ss->policydb;
struct sidtab *sidtab = &state->ss->sidtab; struct sidtab *sidtab = state->ss->sidtab;
int rc; int rc;
struct context *ctx; struct context *ctx;
struct context ctx_new; struct context ctx_new;
@ -3646,7 +3658,7 @@ int security_netlbl_sid_to_secattr(struct selinux_state *state,
read_lock(&state->ss->policy_rwlock); read_lock(&state->ss->policy_rwlock);
rc = -ENOENT; rc = -ENOENT;
ctx = sidtab_search(&state->ss->sidtab, sid); ctx = sidtab_search(state->ss->sidtab, sid);
if (ctx == NULL) if (ctx == NULL)
goto out; goto out;

2
security/selinux/ss/services.h
View file

@ -24,7 +24,7 @@ struct selinux_map {
}; };
struct selinux_ss { struct selinux_ss {
struct sidtab sidtab; struct sidtab *sidtab;
struct policydb policydb; struct policydb policydb;
rwlock_t policy_rwlock; rwlock_t policy_rwlock;
u32 latest_granting; u32 latest_granting;

172
security/selinux/ss/sidtab.c
View file

@ -22,16 +22,24 @@ int sidtab_init(struct sidtab *s)
s->htable = kmalloc_array(SIDTAB_SIZE, sizeof(*s->htable), GFP_ATOMIC); s->htable = kmalloc_array(SIDTAB_SIZE, sizeof(*s->htable), GFP_ATOMIC);
if (!s->htable) if (!s->htable)
return -ENOMEM; return -ENOMEM;
for (i = 0; i < SECINITSID_NUM; i++)
s->isids[i].set = 0;
for (i = 0; i < SIDTAB_SIZE; i++) for (i = 0; i < SIDTAB_SIZE; i++)
s->htable[i] = NULL; s->htable[i] = NULL;
for (i = 0; i < SIDTAB_CACHE_LEN; i++)
s->cache[i] = NULL;
s->nel = 0; s->nel = 0;
s->next_sid = 1; s->next_sid = 0;
s->shutdown = 0; s->shutdown = 0;
spin_lock_init(&s->lock); spin_lock_init(&s->lock);
return 0; return 0;
} }
int sidtab_insert(struct sidtab *s, u32 sid, struct context *context) static int sidtab_insert(struct sidtab *s, u32 sid, struct context *context)
{ {
int hvalue; int hvalue;
struct sidtab_node *prev, *cur, *newnode; struct sidtab_node *prev, *cur, *newnode;
@ -76,34 +84,62 @@ int sidtab_insert(struct sidtab *s, u32 sid, struct context *context)
return 0; return 0;
} }
static struct context *sidtab_search_core(struct sidtab *s, u32 sid, int force) int sidtab_set_initial(struct sidtab *s, u32 sid, struct context *context)
{
struct sidtab_isid_entry *entry;
int rc;
if (sid == 0 || sid > SECINITSID_NUM)
return -EINVAL;
entry = &s->isids[sid - 1];
rc = context_cpy(&entry->context, context);
if (rc)
return rc;
entry->set = 1;
return 0;
}
static struct context *sidtab_lookup(struct sidtab *s, u32 sid)
{ {
int hvalue; int hvalue;
struct sidtab_node *cur; struct sidtab_node *cur;
hvalue = SIDTAB_HASH(sid);
cur = s->htable[hvalue];
while (cur && sid > cur->sid)
cur = cur->next;
if (!cur || sid != cur->sid)
return NULL;
return &cur->context;
}
static struct context *sidtab_lookup_initial(struct sidtab *s, u32 sid)
{
return s->isids[sid - 1].set ? &s->isids[sid - 1].context : NULL;
}
static struct context *sidtab_search_core(struct sidtab *s, u32 sid, int force)
{
struct context *context;
if (!s) if (!s)
return NULL; return NULL;
hvalue = SIDTAB_HASH(sid); if (sid != 0) {
cur = s->htable[hvalue]; if (sid > SECINITSID_NUM)
while (cur && sid > cur->sid) context = sidtab_lookup(s, sid - (SECINITSID_NUM + 1));
cur = cur->next; else
context = sidtab_lookup_initial(s, sid);
if (force && cur && sid == cur->sid && cur->context.len) if (context && (!context->len || force))
return &cur->context; return context;
if (!cur || sid != cur->sid || cur->context.len) {
/* Remap invalid SIDs to the unlabeled SID. */
sid = SECINITSID_UNLABELED;
hvalue = SIDTAB_HASH(sid);
cur = s->htable[hvalue];
while (cur && sid > cur->sid)
cur = cur->next;
if (!cur || sid != cur->sid)
return NULL;
} }
return &cur->context; return sidtab_lookup_initial(s, SECINITSID_UNLABELED);
} }
struct context *sidtab_search(struct sidtab *s, u32 sid) struct context *sidtab_search(struct sidtab *s, u32 sid)
@ -145,11 +181,7 @@ static int sidtab_map(struct sidtab *s,
static int clone_sid(u32 sid, struct context *context, void *arg) static int clone_sid(u32 sid, struct context *context, void *arg)
{ {
struct sidtab *s = arg; struct sidtab *s = arg;
if (sid > SECINITSID_NUM)
return sidtab_insert(s, sid, context); return sidtab_insert(s, sid, context);
else
return 0;
} }
int sidtab_convert(struct sidtab *s, struct sidtab *news, int sidtab_convert(struct sidtab *s, struct sidtab *news,
@ -183,8 +215,8 @@ static void sidtab_update_cache(struct sidtab *s, struct sidtab_node *n, int loc
s->cache[0] = n; s->cache[0] = n;
} }
static inline u32 sidtab_search_context(struct sidtab *s, static inline int sidtab_search_context(struct sidtab *s,
struct context *context) struct context *context, u32 *sid)
{ {
int i; int i;
struct sidtab_node *cur; struct sidtab_node *cur;
@ -194,15 +226,17 @@ static inline u32 sidtab_search_context(struct sidtab *s,
while (cur) { while (cur) {
if (context_cmp(&cur->context, context)) { if (context_cmp(&cur->context, context)) {
sidtab_update_cache(s, cur, SIDTAB_CACHE_LEN - 1); sidtab_update_cache(s, cur, SIDTAB_CACHE_LEN - 1);
return cur->sid; *sid = cur->sid;
return 0;
} }
cur = cur->next; cur = cur->next;
} }
} }
return 0; return -ENOENT;
} }
static inline u32 sidtab_search_cache(struct sidtab *s, struct context *context) static inline int sidtab_search_cache(struct sidtab *s, struct context *context,
u32 *sid)
{ {
int i; int i;
struct sidtab_node *node; struct sidtab_node *node;
@ -210,54 +244,69 @@ static inline u32 sidtab_search_cache(struct sidtab *s, struct context *context)
for (i = 0; i < SIDTAB_CACHE_LEN; i++) { for (i = 0; i < SIDTAB_CACHE_LEN; i++) {
node = s->cache[i]; node = s->cache[i];
if (unlikely(!node)) if (unlikely(!node))
return 0; return -ENOENT;
if (context_cmp(&node->context, context)) { if (context_cmp(&node->context, context)) {
sidtab_update_cache(s, node, i); sidtab_update_cache(s, node, i);
return node->sid; *sid = node->sid;
}
}
return 0; return 0;
}
}
return -ENOENT;
} }
int sidtab_context_to_sid(struct sidtab *s, static int sidtab_reverse_lookup(struct sidtab *s, struct context *context,
struct context *context, u32 *sid)
u32 *out_sid)
{ {
u32 sid; int ret;
int ret = 0;
unsigned long flags; unsigned long flags;
*out_sid = SECSID_NULL; ret = sidtab_search_cache(s, context, sid);
if (ret)
sid = sidtab_search_cache(s, context); ret = sidtab_search_context(s, context, sid);
if (!sid) if (ret) {
sid = sidtab_search_context(s, context);
if (!sid) {
spin_lock_irqsave(&s->lock, flags); spin_lock_irqsave(&s->lock, flags);
/* Rescan now that we hold the lock. */ /* Rescan now that we hold the lock. */
sid = sidtab_search_context(s, context); ret = sidtab_search_context(s, context, sid);
if (sid) if (!ret)
goto unlock_out; goto unlock_out;
/* No SID exists for the context. Allocate a new one. */ /* No SID exists for the context. Allocate a new one. */
if (s->next_sid == UINT_MAX || s->shutdown) { if (s->next_sid == (UINT_MAX - SECINITSID_NUM - 1) ||
s->shutdown) {
ret = -ENOMEM; ret = -ENOMEM;
goto unlock_out; goto unlock_out;
} }
sid = s->next_sid++; *sid = s->next_sid++;
if (context->len) if (context->len)
pr_info("SELinux: Context %s is not valid (left unmapped).\n", pr_info("SELinux: Context %s is not valid (left unmapped).\n",
context->str); context->str);
ret = sidtab_insert(s, sid, context); ret = sidtab_insert(s, *sid, context);
if (ret) if (ret)
s->next_sid--; s->next_sid--;
unlock_out: unlock_out:
spin_unlock_irqrestore(&s->lock, flags); spin_unlock_irqrestore(&s->lock, flags);
} }
if (ret)
return ret; return ret;
}
*out_sid = sid; int sidtab_context_to_sid(struct sidtab *s, struct context *context, u32 *sid)
{
int rc;
u32 i;
for (i = 0; i < SECINITSID_NUM; i++) {
struct sidtab_isid_entry *entry = &s->isids[i];
if (entry->set && context_cmp(context, &entry->context)) {
*sid = i + 1;
return 0;
}
}
rc = sidtab_reverse_lookup(s, context, sid);
if (rc)
return rc;
*sid += SECINITSID_NUM + 1;
return 0; return 0;
} }
@ -296,6 +345,10 @@ void sidtab_destroy(struct sidtab *s)
if (!s) if (!s)
return; return;
for (i = 0; i < SECINITSID_NUM; i++)
if (s->isids[i].set)
context_destroy(&s->isids[i].context);
for (i = 0; i < SIDTAB_SIZE; i++) { for (i = 0; i < SIDTAB_SIZE; i++) {
cur = s->htable[i]; cur = s->htable[i];
while (cur) { while (cur) {
@ -311,18 +364,3 @@ void sidtab_destroy(struct sidtab *s)
s->nel = 0; s->nel = 0;
s->next_sid = 1; s->next_sid = 1;
} }
void sidtab_set(struct sidtab *dst, struct sidtab *src)
{
unsigned long flags;
int i;
spin_lock_irqsave(&src->lock, flags);
dst->htable = src->htable;
dst->nel = src->nel;
dst->next_sid = src->next_sid;
dst->shutdown = 0;
for (i = 0; i < SIDTAB_CACHE_LEN; i++)
dst->cache[i] = NULL;
spin_unlock_irqrestore(&src->lock, flags);
}

15
security/selinux/ss/sidtab.h
View file

@ -22,6 +22,11 @@ struct sidtab_node {
#define SIDTAB_SIZE SIDTAB_HASH_BUCKETS #define SIDTAB_SIZE SIDTAB_HASH_BUCKETS
struct sidtab_isid_entry {
int set;
struct context context;
};
struct sidtab { struct sidtab {
struct sidtab_node **htable; struct sidtab_node **htable;
unsigned int nel; /* number of elements */ unsigned int nel; /* number of elements */
@ -30,10 +35,13 @@ struct sidtab {
#define SIDTAB_CACHE_LEN 3 #define SIDTAB_CACHE_LEN 3
struct sidtab_node *cache[SIDTAB_CACHE_LEN]; struct sidtab_node *cache[SIDTAB_CACHE_LEN];
spinlock_t lock; spinlock_t lock;
/* index == SID - 1 (no entry for SECSID_NULL) */
struct sidtab_isid_entry isids[SECINITSID_NUM];
}; };
int sidtab_init(struct sidtab *s); int sidtab_init(struct sidtab *s);
int sidtab_insert(struct sidtab *s, u32 sid, struct context *context); int sidtab_set_initial(struct sidtab *s, u32 sid, struct context *context);
struct context *sidtab_search(struct sidtab *s, u32 sid); struct context *sidtab_search(struct sidtab *s, u32 sid);
struct context *sidtab_search_force(struct sidtab *s, u32 sid); struct context *sidtab_search_force(struct sidtab *s, u32 sid);
@ -43,13 +51,10 @@ int sidtab_convert(struct sidtab *s, struct sidtab *news,
void *args), void *args),
void *args); void *args);
int sidtab_context_to_sid(struct sidtab *s, int sidtab_context_to_sid(struct sidtab *s, struct context *context, u32 *sid);
struct context *context,
u32 *sid);
void sidtab_hash_eval(struct sidtab *h, char *tag); void sidtab_hash_eval(struct sidtab *h, char *tag);
void sidtab_destroy(struct sidtab *s); void sidtab_destroy(struct sidtab *s);
void sidtab_set(struct sidtab *dst, struct sidtab *src);
#endif /* _SS_SIDTAB_H_ */ #endif /* _SS_SIDTAB_H_ */