/scripts/selinux/mdp/mdp.c

http://github.com/mirrors/linux · C · 253 lines · 182 code · 27 blank · 44 comment · 16 complexity · 69d9d280fbba555dcd39ecf27e13ca7d MD5 · raw file

  1. // SPDX-License-Identifier: GPL-2.0-or-later
  2. /*
  3. *
  4. * mdp - make dummy policy
  5. *
  6. * When pointed at a kernel tree, builds a dummy policy for that kernel
  7. * with exactly one type with full rights to itself.
  8. *
  9. * Copyright (C) IBM Corporation, 2006
  10. *
  11. * Authors: Serge E. Hallyn <serue@us.ibm.com>
  12. */
  13. /* NOTE: we really do want to use the kernel headers here */
  14. #define __EXPORTED_HEADERS__
  15. #include <stdio.h>
  16. #include <stdlib.h>
  17. #include <unistd.h>
  18. #include <string.h>
  19. #include <linux/kconfig.h>
  20. static void usage(char *name)
  21. {
  22. printf("usage: %s [-m] policy_file context_file\n", name);
  23. exit(1);
  24. }
  25. /* Class/perm mapping support */
  26. struct security_class_mapping {
  27. const char *name;
  28. const char *perms[sizeof(unsigned) * 8 + 1];
  29. };
  30. #include "classmap.h"
  31. #include "initial_sid_to_string.h"
  32. int main(int argc, char *argv[])
  33. {
  34. int i, j, mls = 0;
  35. int initial_sid_to_string_len;
  36. char **arg, *polout, *ctxout;
  37. FILE *fout;
  38. if (argc < 3)
  39. usage(argv[0]);
  40. arg = argv+1;
  41. if (argc==4 && strcmp(argv[1], "-m") == 0) {
  42. mls = 1;
  43. arg++;
  44. }
  45. polout = *arg++;
  46. ctxout = *arg;
  47. fout = fopen(polout, "w");
  48. if (!fout) {
  49. printf("Could not open %s for writing\n", polout);
  50. usage(argv[0]);
  51. }
  52. /* print out the classes */
  53. for (i = 0; secclass_map[i].name; i++)
  54. fprintf(fout, "class %s\n", secclass_map[i].name);
  55. fprintf(fout, "\n");
  56. initial_sid_to_string_len = sizeof(initial_sid_to_string) / sizeof (char *);
  57. /* print out the sids */
  58. for (i = 1; i < initial_sid_to_string_len; i++)
  59. fprintf(fout, "sid %s\n", initial_sid_to_string[i]);
  60. fprintf(fout, "\n");
  61. /* print out the class permissions */
  62. for (i = 0; secclass_map[i].name; i++) {
  63. struct security_class_mapping *map = &secclass_map[i];
  64. fprintf(fout, "class %s\n", map->name);
  65. fprintf(fout, "{\n");
  66. for (j = 0; map->perms[j]; j++)
  67. fprintf(fout, "\t%s\n", map->perms[j]);
  68. fprintf(fout, "}\n\n");
  69. }
  70. fprintf(fout, "\n");
  71. /* print out mls declarations and constraints */
  72. if (mls) {
  73. fprintf(fout, "sensitivity s0;\n");
  74. fprintf(fout, "sensitivity s1;\n");
  75. fprintf(fout, "dominance { s0 s1 }\n");
  76. fprintf(fout, "category c0;\n");
  77. fprintf(fout, "category c1;\n");
  78. fprintf(fout, "level s0:c0.c1;\n");
  79. fprintf(fout, "level s1:c0.c1;\n");
  80. #define SYSTEMLOW "s0"
  81. #define SYSTEMHIGH "s1:c0.c1"
  82. for (i = 0; secclass_map[i].name; i++) {
  83. struct security_class_mapping *map = &secclass_map[i];
  84. fprintf(fout, "mlsconstrain %s {\n", map->name);
  85. for (j = 0; map->perms[j]; j++)
  86. fprintf(fout, "\t%s\n", map->perms[j]);
  87. /*
  88. * This requires all subjects and objects to be
  89. * single-level (l2 eq h2), and that the subject
  90. * level dominate the object level (h1 dom h2)
  91. * in order to have any permissions to it.
  92. */
  93. fprintf(fout, "} (l2 eq h2 and h1 dom h2);\n\n");
  94. }
  95. }
  96. /* types, roles, and allows */
  97. fprintf(fout, "type base_t;\n");
  98. fprintf(fout, "role base_r;\n");
  99. fprintf(fout, "role base_r types { base_t };\n");
  100. for (i = 0; secclass_map[i].name; i++)
  101. fprintf(fout, "allow base_t base_t:%s *;\n",
  102. secclass_map[i].name);
  103. fprintf(fout, "user user_u roles { base_r }");
  104. if (mls)
  105. fprintf(fout, " level %s range %s - %s", SYSTEMLOW,
  106. SYSTEMLOW, SYSTEMHIGH);
  107. fprintf(fout, ";\n");
  108. #define SUBJUSERROLETYPE "user_u:base_r:base_t"
  109. #define OBJUSERROLETYPE "user_u:object_r:base_t"
  110. /* default sids */
  111. for (i = 1; i < initial_sid_to_string_len; i++)
  112. fprintf(fout, "sid %s " SUBJUSERROLETYPE "%s\n",
  113. initial_sid_to_string[i], mls ? ":" SYSTEMLOW : "");
  114. fprintf(fout, "\n");
  115. #define FS_USE(behavior, fstype) \
  116. fprintf(fout, "fs_use_%s %s " OBJUSERROLETYPE "%s;\n", \
  117. behavior, fstype, mls ? ":" SYSTEMLOW : "")
  118. /*
  119. * Filesystems whose inode labels can be fetched via getxattr.
  120. */
  121. #ifdef CONFIG_EXT2_FS_SECURITY
  122. FS_USE("xattr", "ext2");
  123. #endif
  124. #ifdef CONFIG_EXT4_FS_SECURITY
  125. #ifdef CONFIG_EXT4_USE_FOR_EXT2
  126. FS_USE("xattr", "ext2");
  127. #endif
  128. FS_USE("xattr", "ext3");
  129. FS_USE("xattr", "ext4");
  130. #endif
  131. #ifdef CONFIG_JFS_SECURITY
  132. FS_USE("xattr", "jfs");
  133. #endif
  134. #ifdef CONFIG_REISERFS_FS_SECURITY
  135. FS_USE("xattr", "reiserfs");
  136. #endif
  137. #ifdef CONFIG_JFFS2_FS_SECURITY
  138. FS_USE("xattr", "jffs2");
  139. #endif
  140. #ifdef CONFIG_XFS_FS
  141. FS_USE("xattr", "xfs");
  142. #endif
  143. #ifdef CONFIG_GFS2_FS
  144. FS_USE("xattr", "gfs2");
  145. #endif
  146. #ifdef CONFIG_BTRFS_FS
  147. FS_USE("xattr", "btrfs");
  148. #endif
  149. #ifdef CONFIG_F2FS_FS_SECURITY
  150. FS_USE("xattr", "f2fs");
  151. #endif
  152. #ifdef CONFIG_OCFS2_FS
  153. FS_USE("xattr", "ocsfs2");
  154. #endif
  155. #ifdef CONFIG_OVERLAY_FS
  156. FS_USE("xattr", "overlay");
  157. #endif
  158. #ifdef CONFIG_SQUASHFS_XATTR
  159. FS_USE("xattr", "squashfs");
  160. #endif
  161. /*
  162. * Filesystems whose inodes are labeled from allocating task.
  163. */
  164. FS_USE("task", "pipefs");
  165. FS_USE("task", "sockfs");
  166. /*
  167. * Filesystems whose inode labels are computed from both
  168. * the allocating task and the superblock label.
  169. */
  170. #ifdef CONFIG_UNIX98_PTYS
  171. FS_USE("trans", "devpts");
  172. #endif
  173. #ifdef CONFIG_HUGETLBFS
  174. FS_USE("trans", "hugetlbfs");
  175. #endif
  176. #ifdef CONFIG_TMPFS
  177. FS_USE("trans", "tmpfs");
  178. #endif
  179. #ifdef CONFIG_DEVTMPFS
  180. FS_USE("trans", "devtmpfs");
  181. #endif
  182. #ifdef CONFIG_POSIX_MQUEUE
  183. FS_USE("trans", "mqueue");
  184. #endif
  185. #define GENFSCON(fstype, prefix) \
  186. fprintf(fout, "genfscon %s %s " OBJUSERROLETYPE "%s\n", \
  187. fstype, prefix, mls ? ":" SYSTEMLOW : "")
  188. /*
  189. * Filesystems whose inodes are labeled from path prefix match
  190. * relative to the filesystem root. Depending on the filesystem,
  191. * only a single label for all inodes may be supported. Here
  192. * we list the filesystem types for which per-file labeling is
  193. * supported using genfscon; any other filesystem type can also
  194. * be added by only with a single entry for all of its inodes.
  195. */
  196. #ifdef CONFIG_PROC_FS
  197. GENFSCON("proc", "/");
  198. #endif
  199. #ifdef CONFIG_SECURITY_SELINUX
  200. GENFSCON("selinuxfs", "/");
  201. #endif
  202. #ifdef CONFIG_SYSFS
  203. GENFSCON("sysfs", "/");
  204. #endif
  205. #ifdef CONFIG_DEBUG_FS
  206. GENFSCON("debugfs", "/");
  207. #endif
  208. #ifdef CONFIG_TRACING
  209. GENFSCON("tracefs", "/");
  210. #endif
  211. #ifdef CONFIG_PSTORE
  212. GENFSCON("pstore", "/");
  213. #endif
  214. GENFSCON("cgroup", "/");
  215. GENFSCON("cgroup2", "/");
  216. fclose(fout);
  217. fout = fopen(ctxout, "w");
  218. if (!fout) {
  219. printf("Wrote policy, but cannot open %s for writing\n", ctxout);
  220. usage(argv[0]);
  221. }
  222. fprintf(fout, "/ " OBJUSERROLETYPE "%s\n", mls ? ":" SYSTEMLOW : "");
  223. fprintf(fout, "/.* " OBJUSERROLETYPE "%s\n", mls ? ":" SYSTEMLOW : "");
  224. fclose(fout);
  225. return 0;
  226. }