RepoMirrors
/
selinux
mirror of https://github.com/SELinuxProject/selinux
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
selinux/checkpolicy/checkpolicy.c

1331 lines
30 KiB
C
Raw Blame History

/*
* Author : Stephen Smalley, <stephen.smalley.work@gmail.com>
*/
/*
* Updated: Trusted Computer Solutions, Inc. <dgoeddel@trustedcs.com>
*
* Support for enhanced MLS infrastructure.
*
* Updated: Karl MacMillan <kmacmillan@tresys.com>
*
* Added conditional policy language extensions
*
* Updated: James Morris <jmorris@intercode.com.au>
*
* Added IPv6 support.
*
* Updated: Joshua Brindle <jbrindle@tresys.com>
* Karl MacMillan <kmacmillan@tresys.com>
* Jason Tang <jtang@tresys.com>
*
* Policy Module support.
*
* Copyright (C) 2017 Mellanox Technologies Inc.
* Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
* Copyright (C) 2003 - 2005 Tresys Technology, LLC
* Copyright (C) 2003 Red Hat, Inc., James Morris <jmorris@redhat.com>
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation, version 2.
*/
/* FLASK */
/*
* checkpolicy
*
* Load and check a policy configuration.
*
* A policy configuration is created in a text format,
* and then compiled into a binary format for use by
* the security server. By default, checkpolicy reads
* the text format. If '-b' is specified, then checkpolicy
* reads the binary format instead.
*
* If '-o output_file' is specified, then checkpolicy
* writes the binary format version of the configuration
* to the specified output file.
*
* If '-d' is specified, then checkpolicy permits the user
* to interactively test the security server functions with
* the loaded policy configuration.
*
* If '-c' is specified, then the supplied parameter is used to
* determine which policy version to use for generating binary
* policy. This is for compatibility with older kernels. If any
* booleans or conditional rules are thrown away a warning is printed.
*/
#include <ctype.h>
#include <getopt.h>
#include <unistd.h>
#include <stdlib.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <sys/socket.h>
#include <netinet/in.h>
#ifndef IPPROTO_DCCP
#define IPPROTO_DCCP 33
#endif
#ifndef IPPROTO_SCTP
#define IPPROTO_SCTP 132
#endif
#include <arpa/inet.h>
#include <fcntl.h>
#include <stdio.h>
#include <errno.h>
#include <sys/mman.h>
#include <sepol/module_to_cil.h>
#include <sepol/kernel_to_cil.h>
#include <sepol/kernel_to_conf.h>
#include <sepol/policydb/policydb.h>
#include <sepol/policydb/services.h>
#include <sepol/policydb/conditional.h>
#include <sepol/policydb/hierarchy.h>
#include <sepol/policydb/expand.h>
#include <sepol/policydb/link.h>
#include "queue.h"
#include "parse_util.h"
static policydb_t policydb;
static sidtab_t sidtab;
extern policydb_t *policydbp;
extern int mlspol;
extern int werror;
static int handle_unknown = SEPOL_DENY_UNKNOWN;
static const char *txtfile = "policy.conf";
static const char *binfile = "policy";
static __attribute__((__noreturn__)) void usage(const char *progname)
{
printf
("usage: %s [-b[F]] [-C] [-d] [-U handle_unknown (allow,deny,reject)] [-M] "
"[-N] [-c policyvers (%d-%d)] [-o output_file|-] [-S] [-O] "
"[-t target_platform (selinux,xen)] [-E] [-V] [input_file]\n",
progname, POLICYDB_VERSION_MIN, POLICYDB_VERSION_MAX);
exit(1);
}
#define FGETS(out, size, in) \
do { \
if (fgets(out,size,in)==NULL) { \
fprintf(stderr, "fgets failed at line %d: %s\n", __LINE__, \
strerror(errno)); \
exit(1);\
} \
} while (0)
static int print_sid(sepol_security_id_t sid,
context_struct_t * context
__attribute__ ((unused)), void *data
__attribute__ ((unused)))
{
sepol_security_context_t scontext;
size_t scontext_len;
int rc;
rc = sepol_sid_to_context(sid, &scontext, &scontext_len);
if (rc)
printf("sid %d -> error %d\n", sid, rc);
else {
printf("sid %d -> scontext %s\n", sid, scontext);
free(scontext);
}
return 0;
}
struct val_to_name {
unsigned int val;
char *name;
};
static int find_perm(hashtab_key_t key, hashtab_datum_t datum, void *p)
{
struct val_to_name *v = p;
perm_datum_t *perdatum;
perdatum = (perm_datum_t *) datum;
if (v->val == perdatum->s.value) {
v->name = key;
return 1;
}
return 0;
}
#ifdef EQUIVTYPES
static int insert_type_rule(avtab_key_t * k, avtab_datum_t * d,
struct avtab_node *type_rules)
{
struct avtab_node *p, *c, *n;
for (p = type_rules, c = type_rules->next; c; p = c, c = c->next) {
/*
* Find the insertion point, keeping the list
* ordered by source type, then target type, then
* target class.
*/
if (k->source_type < c->key.source_type)
break;
if (k->source_type == c->key.source_type &&
k->target_type < c->key.target_type)
break;
if (k->source_type == c->key.source_type &&
k->target_type == c->key.target_type &&
k->target_class < c->key.target_class)
break;
}
/* Insert the rule */
n = malloc(sizeof(struct avtab_node));
if (!n) {
fprintf(stderr, "out of memory\n");
exit(1);
}
n->key = *k;
n->datum = *d;
n->next = p->next;
p->next = n;
return 0;
}
static int create_type_rules(avtab_key_t * k, avtab_datum_t * d, void *args)
{
struct avtab_node *type_rules = args;
if (d->specified & AVTAB_ALLOWED) {
/*
* Insert the rule into the lists for both
* the source type and the target type.
*/
if (insert_type_rule(k, d, &type_rules[k->source_type - 1]))
return -1;
if (insert_type_rule(k, d, &type_rules[k->target_type - 1]))
return -1;
}
return 0;
}
static void free_type_rules(struct avtab_node *l)
{
struct avtab_node *tmp;
while (l) {
tmp = l;
l = l->next;
free(tmp);
}
}
static int identify_equiv_types(void)
{
struct avtab_node *type_rules, *l1, *l2;
int i, j;
/*
* Create a list of access vector rules for each type
* from the access vector table.
*/
type_rules = malloc(sizeof(struct avtab_node) * policydb.p_types.nprim);
if (!type_rules) {
fprintf(stderr, "out of memory\n");
exit(1);
}
memset(type_rules, 0,
sizeof(struct avtab_node) * policydb.p_types.nprim);
if (avtab_map(&policydb.te_avtab, create_type_rules, type_rules))
exit(1);
/*
* Compare the type lists and identify equivalent types.
*/
for (i = 0; i < policydb.p_types.nprim - 1; i++) {
if (!type_rules[i].next)
continue;
for (j = i + 1; j < policydb.p_types.nprim; j++) {
for (l1 = type_rules[i].next, l2 = type_rules[j].next;
l1 && l2; l1 = l1->next, l2 = l2->next) {
if (l2->key.source_type == (j + 1)) {
if (l1->key.source_type != (i + 1))
break;
} else {
if (l1->key.source_type !=
l2->key.source_type)
break;
}
if (l2->key.target_type == (j + 1)) {
if (l1->key.target_type != (i + 1))
break;
} else {
if (l1->key.target_type !=
l2->key.target_type)
break;
}
if (l1->key.target_class != l2->key.target_class
|| l1->datum.allowed != l2->datum.allowed)
break;
}
if (l1 || l2)
continue;
free_type_rules(type_rules[j].next);
type_rules[j].next = NULL;
printf("Types %s and %s are equivalent.\n",
policydb.p_type_val_to_name[i],
policydb.p_type_val_to_name[j]);
}
free_type_rules(type_rules[i].next);
type_rules[i].next = NULL;
}
free(type_rules);
return 0;
}
#endif
static int display_bools(void)
{
uint32_t i;
for (i = 0; i < policydbp->p_bools.nprim; i++) {
printf("%s : %d\n", policydbp->p_bool_val_to_name[i],
policydbp->bool_val_to_struct[i]->state);
}
return 0;
}
static void display_expr(const cond_expr_t * exp)
{
const cond_expr_t *cur;
for (cur = exp; cur != NULL; cur = cur->next) {
switch (cur->expr_type) {
case COND_BOOL:
printf("%s ",
policydbp->p_bool_val_to_name[cur->boolean - 1]);
break;
case COND_NOT:
printf("! ");
break;
case COND_OR:
printf("|| ");
break;
case COND_AND:
printf("&& ");
break;
case COND_XOR:
printf("^ ");
break;
case COND_EQ:
printf("== ");
break;
case COND_NEQ:
printf("!= ");
break;
default:
printf("error!");
break;
}
}
}
static int display_cond_expressions(void)
{
const cond_node_t *cur;
for (cur = policydbp->cond_list; cur != NULL; cur = cur->next) {
printf("expression: ");
display_expr(cur->expr);
printf("current state: %d\n", cur->cur_state);
}
return 0;
}
static int change_bool(const char *name, int state)
{
cond_bool_datum_t *boolean;
boolean = hashtab_search(policydbp->p_bools.table, name);
if (boolean == NULL) {
printf("Could not find bool %s\n", name);
return -1;
}
boolean->state = state;
evaluate_conds(policydbp);
return 0;
}
static int check_level(hashtab_key_t key, hashtab_datum_t datum, void *arg __attribute__ ((unused)))
{
level_datum_t *levdatum = (level_datum_t *) datum;
if (!levdatum->isalias && levdatum->notdefined) {
fprintf(stderr, "Error: sensitivity %s was not used in a level definition!\n",
key);
return -1;
}
return 0;
}
int main(int argc, char **argv)
{
policydb_t parse_policy;
sepol_security_class_t tclass;
sepol_security_id_t ssid, tsid, *sids, oldsid, newsid, tasksid;
sepol_security_context_t scontext;
struct sepol_av_decision avd;
class_datum_t *cladatum;
const char *file = txtfile;
char ans[80 + 1], *path, *fstype;
const char *outfile = NULL;
size_t scontext_len, pathlen;
unsigned int i;
unsigned int protocol, port;
unsigned int binary = 0, debug = 0, sort = 0, cil = 0, conf = 0, optimize = 0, disable_neverallow = 0;
struct val_to_name v;
int ret, ch, fd, target = SEPOL_TARGET_SELINUX;
unsigned int policyvers = 0;
unsigned int nel, uret;
struct stat sb;
void *map;
FILE *outfp = NULL;
char *name;
int state;
int show_version = 0;
char *reason_buf = NULL;
unsigned int reason;
int flags;
struct policy_file pf;
const struct option long_options[] = {
{"output", required_argument, NULL, 'o'},
{"target", required_argument, NULL, 't'},
{"binary", no_argument, NULL, 'b'},
{"debug", no_argument, NULL, 'd'},
{"version", no_argument, NULL, 'V'},
{"handle-unknown", required_argument, NULL, 'U'},
{"mls", no_argument, NULL, 'M'},
{"disable-neverallow", no_argument, NULL, 'N'},
{"cil", no_argument, NULL, 'C'},
{"conf",no_argument, NULL, 'F'},
{"sort", no_argument, NULL, 'S'},
{"optimize", no_argument, NULL, 'O'},
{"werror", no_argument, NULL, 'E'},
{"help", no_argument, NULL, 'h'},
{NULL, 0, NULL, 0}
};
while ((ch = getopt_long(argc, argv, "o:t:dbU:MNCFSVc:OEh", long_options, NULL)) != -1) {
switch (ch) {
case 'o':
outfile = optarg;
break;
case 't':
if (!strcasecmp(optarg, "Xen"))
target = SEPOL_TARGET_XEN;
else if (!strcasecmp(optarg, "SELinux"))
target = SEPOL_TARGET_SELINUX;
else{
fprintf(stderr, "%s: Unknown target platform:"
"%s\n", argv[0], optarg);
exit(1);
}
break;
case 'b':
binary = 1;
file = binfile;
break;
case 'd':
debug = 1;
break;
case 'V':
show_version = 1;
break;
case 'U':
if (!strcasecmp(optarg, "deny")) {
handle_unknown = DENY_UNKNOWN;
break;
}
if (!strcasecmp(optarg, "allow")) {
handle_unknown = ALLOW_UNKNOWN;
break;
}
if (!strcasecmp(optarg, "reject")) {
handle_unknown = REJECT_UNKNOWN;
break;
}
usage(argv[0]);
case 'S':
sort = 1;
break;
case 'O':
optimize = 1;
break;
case 'M':
mlspol = 1;
break;
case 'N':
disable_neverallow = 1;
break;
case 'C':
cil = 1;
break;
case 'F':
conf = 1;
break;
case 'c':{
long int n;
errno = 0;
n = strtol(optarg, NULL, 10);
if (errno) {
fprintf(stderr,
"Invalid policyvers specified: %s\n",
optarg);
usage(argv[0]);
exit(1);
}
if (n < POLICYDB_VERSION_MIN
|| n > POLICYDB_VERSION_MAX) {
fprintf(stderr,
"policyvers value %ld not in range %d-%d\n",
n, POLICYDB_VERSION_MIN,
POLICYDB_VERSION_MAX);
usage(argv[0]);
exit(1);
}
policyvers = n;
break;
}
case 'E':
werror = 1;
break;
case 'h':
default:
usage(argv[0]);
}
}
if (show_version) {
printf("%d (compatibility range %d-%d)\n",
policyvers ? policyvers : POLICYDB_VERSION_MAX ,
POLICYDB_VERSION_MAX, POLICYDB_VERSION_MIN);
exit(0);
}
if (optind != argc) {
file = argv[optind++];
if (optind != argc)
usage(argv[0]);
}
/* Set policydb and sidtab used by libsepol service functions
to my structures, so that I can directly populate and
manipulate them. */
sepol_set_policydb(&policydb);
sepol_set_sidtab(&sidtab);
if (cil && conf) {
fprintf(stderr, "Can't convert to CIL and policy.conf at the same time\n");
exit(1);
}
if (binary) {
fd = open(file, O_RDONLY);
if (fd < 0) {
fprintf(stderr, "Can't open '%s': %s\n",
file, strerror(errno));
exit(1);
}
if (fstat(fd, &sb) < 0) {
fprintf(stderr, "Can't stat '%s': %s\n",
file, strerror(errno));
exit(1);
}
map =
mmap(NULL, sb.st_size, PROT_READ | PROT_WRITE, MAP_PRIVATE,
fd, 0);
if (map == MAP_FAILED) {
fprintf(stderr, "Can't map '%s': %s\n",
file, strerror(errno));
exit(1);
}
policy_file_init(&pf);
pf.type = PF_USE_MEMORY;
pf.data = map;
pf.len = sb.st_size;
if (policydb_init(&policydb)) {
fprintf(stderr, "%s: policydb_init: Out of memory!\n",
argv[0]);
exit(1);
}
ret = policydb_read(&policydb, &pf, 1);
if (ret) {
fprintf(stderr,
"%s: error(s) encountered while parsing configuration\n",
argv[0]);
exit(1);
}
policydbp = &policydb;
/* Check Policy Consistency */
if (policydbp->mls) {
if (!mlspol) {
fprintf(stderr, "%s: MLS policy, but non-MLS"
" is specified\n", argv[0]);
exit(1);
}
} else {
if (mlspol) {
fprintf(stderr, "%s: non-MLS policy, but MLS"
" is specified\n", argv[0]);
exit(1);
}
}
if (policydbp->policyvers <= POLICYDB_VERSION_PERMISSIVE) {
if (policyvers > policydbp->policyvers) {
fprintf(stderr, "Binary policies with version <= %u cannot be upgraded\n", POLICYDB_VERSION_PERMISSIVE);
} else if (policyvers) {
policydbp->policyvers = policyvers;
}
} else {
policydbp->policyvers = policyvers ? policyvers : POLICYDB_VERSION_MAX;
}
} else {
if (conf) {
fprintf(stderr, "Can only generate policy.conf from binary policy\n");
exit(1);
}
if (policydb_init(&parse_policy))
exit(1);
/* We build this as a base policy first since that is all the parser understands */
parse_policy.policy_type = POLICY_BASE;
policydb_set_target_platform(&parse_policy, target);
/* Let sepol know if we are dealing with MLS support */
parse_policy.mls = mlspol;
parse_policy.handle_unknown = handle_unknown;
parse_policy.policyvers = policyvers ? policyvers : POLICYDB_VERSION_MAX;
policydbp = &parse_policy;
if (read_source_policy(policydbp, file, "checkpolicy") < 0)
exit(1);
if (hashtab_map(policydbp->p_levels.table, check_level, NULL))
exit(1);
/* Linking takes care of optional avrule blocks */
if (link_modules(NULL, policydbp, NULL, 0, 0)) {
fprintf(stderr, "Error while resolving optionals\n");
exit(1);
}
if (!cil) {
if (policydb_init(&policydb)) {
fprintf(stderr, "%s: policydb_init failed\n", argv[0]);
exit(1);
}
if (expand_module(NULL, policydbp, &policydb, /*verbose=*/0, !disable_neverallow)) {
fprintf(stderr, "Error while expanding policy\n");
exit(1);
}
policydb.policyvers = policyvers ? policyvers : POLICYDB_VERSION_MAX;
policydb_destroy(policydbp);
policydbp = &policydb;
}
}
if (policydb_load_isids(&policydb, &sidtab))
exit(1);
if (optimize && policydbp->policy_type == POLICY_KERN) {
ret = policydb_optimize(policydbp);
if (ret) {
fprintf(stderr, "%s: error optimizing policy\n", argv[0]);
exit(1);
}
}
if (outfile) {
if (!strcmp(outfile, "-")) {
outfp = stdout;
outfile = "<STDOUT>";
} else {
outfp = fopen(outfile, "w");
if (!outfp) {
perror(outfile);
exit(1);
}
}
if (!cil) {
if (!conf) {
policydb.policy_type = POLICY_KERN;
policy_file_init(&pf);
pf.type = PF_USE_STDIO;
pf.fp = outfp;
if (sort) {
ret = policydb_sort_ocontexts(&policydb);
if (ret) {
fprintf(stderr, "%s: error sorting ocontexts\n",
argv[0]);
exit(1);
}
}
ret = policydb_write(&policydb, &pf);
} else {
ret = sepol_kernel_policydb_to_conf(outfp, policydbp);
}
if (ret) {
fprintf(stderr, "%s: error writing %s\n",
argv[0], outfile);
exit(1);
}
} else {
if (binary) {
ret = sepol_kernel_policydb_to_cil(outfp, policydbp);
} else {
ret = sepol_module_policydb_to_cil(outfp, policydbp, 1);
}
if (ret) {
fprintf(stderr, "%s: error writing %s\n", argv[0], outfile);
exit(1);
}
}
if (outfp != stdout) {
if(fclose(outfp)) {
fprintf(stderr, "%s: error closing %s: %s\n", argv[0], outfile, strerror(errno));
exit(1);
}
}
} else if (cil) {
fprintf(stderr, "%s: No file to write CIL was specified\n", argv[0]);
exit(1);
}
if (!debug) {
policydb_destroy(&policydb);
sepol_sidtab_destroy(&sidtab);
exit(0);
}
menu:
printf("\nSelect an option:\n");
printf("0) Call compute_access_vector\n");
printf("1) Call sid_to_context\n");
printf("2) Call context_to_sid\n");
printf("3) Call transition_sid\n");
printf("4) Call member_sid\n");
printf("5) Call change_sid\n");
printf("6) Call list_sids\n");
printf("7) Call load_policy\n");
printf("8) Call fs_sid\n");
printf("9) Call port_sid\n");
printf("a) Call netif_sid\n");
printf("b) Call node_sid\n");
printf("c) Call fs_use\n");
printf("d) Call genfs_sid\n");
printf("e) Call get_user_sids\n");
printf("f) display conditional bools\n");
printf("g) display conditional expressions\n");
printf("h) change a boolean value\n");
printf("i) display constraint expressions\n");
printf("j) display validatetrans expressions\n");
printf("k) Call ibpkey_sid\n");
printf("l) Call ibendport_sid\n");
#ifdef EQUIVTYPES
printf("z) Show equivalent types\n");
#endif
printf("m) Show menu again\n");
printf("q) Exit\n");
while (1) {
printf("\nChoose: ");
FGETS(ans, sizeof(ans), stdin);
switch (ans[0]) {
case '0':
printf("source sid? ");
FGETS(ans, sizeof(ans), stdin);
ssid = atoi(ans);
printf("target sid? ");
FGETS(ans, sizeof(ans), stdin);
tsid = atoi(ans);
printf("target class? ");
FGETS(ans, sizeof(ans), stdin);
if (isdigit(ans[0])) {
tclass = atoi(ans);
if (!tclass
|| tclass > policydb.p_classes.nprim) {
printf("\nNo such class.\n");
break;
}
cladatum =
policydb.class_val_to_struct[tclass - 1];
} else {
ans[strlen(ans) - 1] = 0;
cladatum =
(class_datum_t *) hashtab_search(policydb.
p_classes.
table,
ans);
if (!cladatum) {
printf("\nNo such class\n");
break;
}
tclass = cladatum->s.value;
}
if (!cladatum->comdatum && !cladatum->permissions.nprim) {
printf
("\nNo access vector definition for that class\n");
break;
}
ret = sepol_compute_av(ssid, tsid, tclass, 0, &avd);
switch (ret) {
case 0:
printf("\nallowed {");
for (i = 1; i <= sizeof(avd.allowed) * 8; i++) {
if (avd.allowed & (UINT32_C(1) << (i - 1))) {
v.val = i;
ret =
hashtab_map(cladatum->
permissions.
table,
find_perm, &v);
if (!ret && cladatum->comdatum) {
ret =
hashtab_map
(cladatum->
comdatum->
permissions.table,
find_perm, &v);
}
if (ret)
printf(" %s", v.name);
}
}
printf(" }\n");
break;
case -EINVAL:
printf("\ninvalid sid\n");
break;
default:
printf("return code 0x%x\n", ret);
}
break;
case '1':
printf("sid? ");
FGETS(ans, sizeof(ans), stdin);
ssid = atoi(ans);
ret = sepol_sid_to_context(ssid,
&scontext, &scontext_len);
switch (ret) {
case 0:
printf("\nscontext %s\n", scontext);
free(scontext);
break;
case -EINVAL:
printf("\ninvalid sid\n");
break;
case -ENOMEM:
printf("\nout of memory\n");
break;
default:
printf("return code 0x%x\n", ret);
}
break;
case '2':
printf("scontext? ");
FGETS(ans, sizeof(ans), stdin);
scontext_len = strlen(ans);
ans[scontext_len - 1] = 0;
ret = sepol_context_to_sid(ans, scontext_len, &ssid);
switch (ret) {
case 0:
printf("\nsid %d\n", ssid);
break;
case -EINVAL:
printf("\ninvalid context\n");
break;
case -ENOMEM:
printf("\nout of memory\n");
break;
default:
printf("return code 0x%x\n", ret);
}
break;
case '3':
case '4':
case '5':
ch = ans[0];
printf("source sid? ");
FGETS(ans, sizeof(ans), stdin);
ssid = atoi(ans);
printf("target sid? ");
FGETS(ans, sizeof(ans), stdin);
tsid = atoi(ans);
printf("object class? ");
FGETS(ans, sizeof(ans), stdin);
if (isdigit(ans[0])) {
tclass = atoi(ans);
if (!tclass
|| tclass > policydb.p_classes.nprim) {
printf("\nNo such class.\n");
break;
}
} else {
ans[strlen(ans) - 1] = 0;
cladatum =
(class_datum_t *) hashtab_search(policydb.
p_classes.
table,
ans);
if (!cladatum) {
printf("\nNo such class\n");
break;
}
tclass = cladatum->s.value;
}
if (ch == '3')
ret =
sepol_transition_sid(ssid, tsid, tclass,
&ssid);
else if (ch == '4')
ret =
sepol_member_sid(ssid, tsid, tclass, &ssid);
else
ret =
sepol_change_sid(ssid, tsid, tclass, &ssid);
switch (ret) {
case 0:
printf("\nsid %d\n", ssid);
break;
case -EINVAL:
printf("\ninvalid sid\n");
break;
case -ENOMEM:
printf("\nout of memory\n");
break;
default:
printf("return code 0x%x\n", ret);
}
break;
case '6':
sepol_sidtab_map(&sidtab, print_sid, 0);
break;
case '7':
printf("pathname? ");
FGETS(ans, sizeof(ans), stdin);
pathlen = strlen(ans);
ans[pathlen - 1] = 0;
fd = open(ans, O_RDONLY);
if (fd < 0) {
fprintf(stderr, "Can't open '%s': %s\n",
ans, strerror(errno));
break;
}
if (fstat(fd, &sb) < 0) {
fprintf(stderr, "Can't stat '%s': %s\n",
ans, strerror(errno));
break;
}
map =
mmap(NULL, sb.st_size, PROT_READ | PROT_WRITE,
MAP_PRIVATE, fd, 0);
if (map == MAP_FAILED) {
fprintf(stderr, "Can't map '%s': %s\n",
ans, strerror(errno));
break;
}
ret = sepol_load_policy(map, sb.st_size);
switch (ret) {
case 0:
printf("\nsuccess\n");
break;
case -EINVAL:
printf("\ninvalid policy\n");
break;
case -ENOMEM:
printf("\nout of memory\n");
break;
default:
printf("return code 0x%x\n", ret);
}
break;
case '8':
printf("fs kdevname? ");
FGETS(ans, sizeof(ans), stdin);
ans[strlen(ans) - 1] = 0;
ret = sepol_fs_sid(ans, &ssid, &tsid);
if (ret) {
printf("unknown fs kdevname\n");
} else {
printf("fs_sid %d default_file_sid %d\n", ssid, tsid);
}
break;
case '9':
printf("protocol? ");
FGETS(ans, sizeof(ans), stdin);
ans[strlen(ans) - 1] = 0;
if (!strcmp(ans, "tcp") || !strcmp(ans, "TCP"))
protocol = IPPROTO_TCP;
else if (!strcmp(ans, "udp") || !strcmp(ans, "UDP"))
protocol = IPPROTO_UDP;
else if (!strcmp(ans, "dccp") || !strcmp(ans, "DCCP"))
protocol = IPPROTO_DCCP;
else if (!strcmp(ans, "sctp") || !strcmp(ans, "SCTP"))
protocol = IPPROTO_SCTP;
else {
printf("unknown protocol\n");
break;
}
printf("port? ");
FGETS(ans, sizeof(ans), stdin);
port = atoi(ans);
sepol_port_sid(0, 0, protocol, port, &ssid);
printf("sid %d\n", ssid);
break;
case 'a':
printf("netif name? ");
FGETS(ans, sizeof(ans), stdin);
ans[strlen(ans) - 1] = 0;
ret = sepol_netif_sid(ans, &ssid, &tsid);
if (ret) {
printf("unknown name\n");
} else {
printf("if_sid %d default_msg_sid %d\n", ssid, tsid);
}
break;
case 'b':{
char *p;
int family, len;
struct in_addr addr4;
struct in6_addr addr6;
printf("protocol family? ");
FGETS(ans, sizeof(ans), stdin);
ans[strlen(ans) - 1] = 0;
if (!strcasecmp(ans, "ipv4"))
family = AF_INET;
else if (!strcasecmp(ans, "ipv6"))
family = AF_INET6;
else {
printf("unknown protocol family\n");
break;
}
printf("node address? ");
FGETS(ans, sizeof(ans), stdin);
ans[strlen(ans) - 1] = 0;
if (family == AF_INET) {
p = (char *)&addr4;
len = sizeof(addr4);
} else {
p = (char *)&addr6;
len = sizeof(addr6);
}
if (inet_pton(family, ans, p) < 1) {
printf("error parsing address\n");
break;
}
sepol_node_sid(family, p, len, &ssid);
printf("sid %d\n", ssid);
break;
}
case 'c':
printf("fstype? ");
FGETS(ans, sizeof(ans), stdin);
ans[strlen(ans) - 1] = 0;
sepol_fs_use(ans, &uret, &ssid);
switch (uret) {
case SECURITY_FS_USE_XATTR:
printf("use xattr\n");
break;
case SECURITY_FS_USE_TRANS:
printf("use transition SIDs\n");
break;
case SECURITY_FS_USE_TASK:
printf("use task SIDs\n");
break;
case SECURITY_FS_USE_GENFS:
printf("use genfs\n");
break;
case SECURITY_FS_USE_NONE:
printf("no labeling support\n");
break;
}
printf("sid %d\n", ssid);
break;
case 'd':
printf("fstype? ");
FGETS(ans, sizeof(ans), stdin);
ans[strlen(ans) - 1] = 0;
fstype = strdup(ans);
printf("path? ");
FGETS(ans, sizeof(ans), stdin);
ans[strlen(ans) - 1] = 0;
path = strdup(ans);
printf("object class? ");
FGETS(ans, sizeof(ans), stdin);
if (isdigit(ans[0])) {
tclass = atoi(ans);
if (!tclass
|| tclass > policydb.p_classes.nprim) {
printf("\nNo such class.\n");
break;
}
} else {
ans[strlen(ans) - 1] = 0;
cladatum =
(class_datum_t *) hashtab_search(policydb.
p_classes.
table,
ans);
if (!cladatum) {
printf("\nNo such class\n");
break;
}
tclass = cladatum->s.value;
}
sepol_genfs_sid(fstype, path, tclass, &ssid);
printf("sid %d\n", ssid);
free(fstype);
free(path);
break;
case 'e':
printf("from SID? ");
FGETS(ans, sizeof(ans), stdin);
ans[strlen(ans) - 1] = 0;
ssid = atoi(ans);
printf("username? ");
FGETS(ans, sizeof(ans), stdin);
ans[strlen(ans) - 1] = 0;
ret = sepol_get_user_sids(ssid, ans, &sids, &nel);
switch (ret) {
case 0:
if (!nel)
printf("\nnone\n");
for (i = 0; i < nel; i++)
print_sid(sids[i], NULL, NULL);
free(sids);
break;
case -ENOMEM:
printf("\nout of memory\n");
break;
case -EINVAL:
printf("\ninvalid argument\n");
break;
default:
printf("\nerror\n");
break;
}
break;
case 'f':
display_bools();
break;
case 'g':
display_cond_expressions();
break;
case 'h':
printf("name? ");
FGETS(ans, sizeof(ans), stdin);
ans[strlen(ans) - 1] = 0;
name = strdup(ans);
if (name == NULL) {
fprintf(stderr, "couldn't strdup string.\n");
break;
}
printf("state? ");
FGETS(ans, sizeof(ans), stdin);
ans[strlen(ans) - 1] = 0;
if (atoi(ans))
state = 1;
else
state = 0;
change_bool(name, state);
free(name);
break;
case 'i':
printf("source sid? ");
FGETS(ans, sizeof(ans), stdin);
ssid = atoi(ans);
printf("target sid? ");
FGETS(ans, sizeof(ans), stdin);
tsid = atoi(ans);
printf("target class? ");
FGETS(ans, sizeof(ans), stdin);
if (isdigit(ans[0])) {
tclass = atoi(ans);
if (!tclass
|| tclass > policydb.p_classes.nprim) {
printf("\nNo such class.\n");
break;
}
} else {
ans[strlen(ans) - 1] = 0;
cladatum =
(class_datum_t *) hashtab_search(policydb.
p_classes.
table,
ans);
if (!cladatum) {
printf("\nNo such class\n");
break;
}
tclass = cladatum->s.value;
}
flags = SHOW_GRANTED;
if (sepol_compute_av_reason_buffer(ssid, tsid,
tclass, 0, &avd, &reason,
&reason_buf, flags)) {
printf("\nconstraint error\n");
break;
}
if (reason_buf) {
printf("\nConstraint expressions:\n%s",
reason_buf);
free(reason_buf);
} else {
printf("\nNo constraints found.\n");
}
break;
case 'j':
printf("old sid? ");
FGETS(ans, sizeof(ans), stdin);
oldsid = atoi(ans);
printf("new sid? ");
FGETS(ans, sizeof(ans), stdin);
newsid = atoi(ans);
printf("task sid? ");
FGETS(ans, sizeof(ans), stdin);
tasksid = atoi(ans);
printf("target class? ");
FGETS(ans, sizeof(ans), stdin);
if (isdigit(ans[0])) {
tclass = atoi(ans);
if (!tclass
|| tclass > policydb.p_classes.nprim) {
printf("\nNo such class.\n");
break;
}
} else {
ans[strlen(ans) - 1] = 0;
cladatum =
(class_datum_t *) hashtab_search(policydb.
p_classes.
table,
ans);
if (!cladatum) {
printf("\nNo such class\n");
break;
}
tclass = cladatum->s.value;
}
flags = SHOW_GRANTED;
if (sepol_validate_transition_reason_buffer(oldsid,
newsid, tasksid, tclass,
&reason_buf, flags)) {
printf("\nvalidatetrans error\n");
break;
}
if (reason_buf) {
printf("\nValidatetrans expressions:\n%s",
reason_buf);
free(reason_buf);
} else {
printf(
"\nNo validatetrans expressions found.\n");
}
break;
case 'k':
{
char *p;
struct in6_addr addr6;
uint64_t subnet_prefix;
unsigned int pkey;
printf("subnet prefix? ");
FGETS(ans, sizeof(ans), stdin);
ans[strlen(ans) - 1] = 0;
p = (char *)&addr6;
if (inet_pton(AF_INET6, ans, p) < 1) {
printf("error parsing subnet prefix\n");
break;
}
memcpy(&subnet_prefix, p, sizeof(subnet_prefix));
printf("pkey? ");
FGETS(ans, sizeof(ans), stdin);
pkey = atoi(ans);
sepol_ibpkey_sid(subnet_prefix, pkey, &ssid);
printf("sid %d\n", ssid);
}
break;
case 'l':
printf("device name (eg. mlx4_0)? ");
FGETS(ans, sizeof(ans), stdin);
ans[strlen(ans) - 1] = 0;
name = strdup(ans);
if (!name) {
fprintf(stderr, "couldn't strdup string.\n");
break;
}
printf("port? ");
FGETS(ans, sizeof(ans), stdin);
port = atoi(ans);
sepol_ibendport_sid(name, port, &ssid);
printf("sid %d\n", ssid);
free(name);
break;
#ifdef EQUIVTYPES
case 'z':
identify_equiv_types();
break;
#endif
case 'm':
goto menu;
case 'q':
exit(0);
break;
default:
printf("\nUnknown option %s.\n", ans);
}
}
return 0;
}
/* FLASK */
Reference in New Issue View Git Blame Copy Permalink