History

selinux: dynamic class/perm discovery

Modify SELinux to dynamically discover class and permission values upon policy load, based on the dynamic object class/perm discovery logic from libselinux. A mapping is created between kernel-private class and permission indices used outside the security server and the policy values used within the security server. The mappings are only applied upon kernel-internal computations; similar mappings for the private indices of userspace object managers is handled on a per-object manager basis by the userspace AVC. The interfaces for compute_av and transition_sid are split for kernel vs. userspace; the userspace functions are distinguished by a _user suffix. The kernel-private class indices are no longer tied to the policy values and thus do not need to skip indices for userspace classes; thus the kernel class index values are compressed. The flask.h definitions were regenerated by deleting the userspace classes from refpolicy's definitions and then regenerating the headers. Going forward, we can just maintain the flask.h, av_permissions.h, and classmap.h definitions separately from policy as they are no longer tied to the policy values. The next patch introduces a utility to automate generation of flask.h and av_permissions.h from the classmap.h definitions. The older kernel class and permission string tables are removed and replaced by a single security class mapping table that is walked at policy load to generate the mapping. The old kernel class validation logic is completely replaced by the mapping logic. The handle unknown logic is reworked. reject_unknown=1 is handled when the mappings are computed at policy load time, similar to the old handling by the class validation logic. allow_unknown=1 is handled when computing and mapping decisions - if the permission was not able to be mapped (i.e. undefined, mapped to zero), then it is automatically added to the allowed vector. If the class was not able to be mapped (i.e. undefined, mapped to zero), then all permissions are allowed for it if allow_unknown=1. avc_audit leverages the new security class mapping table to lookup the class and permission names from the kernel-private indices. The mdp program is updated to use the new table when generating the class definitions and allow rules for a minimal boot policy for the kernel. It should be noted that this policy will not include any userspace classes, nor will its policy index values for the kernel classes correspond with the ones in refpolicy (they will instead match the kernel-private indices).

Stephen Smalley committed 17 years ago

Commit c6d3aaa1 parent 23acb9816 files · +583 −867Browse files

Showing the changes to scripts (1 of 16 files). Show all

Unified · Split

scripts/selinux/mdp/mdp.c+28−123
@@ -29,86 +29,27 @@ · 28 unmodified lines
2929 #include <unistd.h>
3030 #include <string.h>
3131
32−#include "flask.h"
33−
3432 static void usage(char *name)
3533 {
3634 printf("usage: %s [-m] policy_file context_file\n", name);
3735 exit(1);
3836 }
3937
40−static void find_common_name(char *cname, char *dest, int len)
41−{
42− char *start, *end;
43−
44− start = strchr(cname, '_')+1;
45− end = strchr(start, '_');
46− if (!start || !end || start-cname > len || end-start > len) {
47− printf("Error with commons defines\n");
48− exit(1);
49− }
50− strncpy(dest, start, end-start);
51− dest[end-start] = '\0';
52−}
53−
54−#define S_(x) x,
55−static char *classlist[] = {
56−#include "class_to_string.h"
57− NULL
38+/* Class/perm mapping support */
39+struct security_class_mapping {
40+ const char *name;
41+ const char *perms[sizeof(unsigned) * 8 + 1];
5842 };
59−#undef S_
6043
44+#include "classmap.h"
6145 #include "initial_sid_to_string.h"
6246
63−#define TB_(x) char *x[] = {
64−#define TE_(x) NULL };
65−#define S_(x) x,
66−#include "common_perm_to_string.h"
67−#undef TB_
68−#undef TE_
69−#undef S_
70−
71−struct common {
72− char *cname;
73− char **perms;
74−};
75−struct common common[] = {
76−#define TB_(x) { #x, x },
77−#define S_(x)
78−#define TE_(x)
79−#include "common_perm_to_string.h"
80−#undef TB_
81−#undef TE_
82−#undef S_
83−};
84−
85−#define S_(x, y, z) {x, #y},
86−struct av_inherit {
87− int class;
88− char *common;
89−};
90−struct av_inherit av_inherit[] = {
91−#include "av_inherit.h"
92−};
93−#undef S_
94−
95−#include "av_permissions.h"
96−#define S_(x, y, z) {x, y, z},
97−struct av_perms {
98− int class;
99− int perm_i;
100− char *perm_s;
101−};
102−struct av_perms av_perms[] = {
103−#include "av_perm_to_string.h"
104−};
105−#undef S_
106−
10747 int main(int argc, char *argv[])
10848 {
10949 int i, j, mls = 0;
50+ int initial_sid_to_string_len;
11051 char **arg, *polout, *ctxout;
111− int classlist_len, initial_sid_to_string_len;
52+
11253 FILE *fout;
11354
11455 if (argc < 3)
@@ -127,64 +68,25 @@ int main(int argc, char *argv[]) · 12 unmodified lines
12768 usage(argv[0]);
12869 }
12970
130− classlist_len = sizeof(classlist) / sizeof(char *);
13171 /* print out the classes */
132− for (i=1; i < classlist_len; i++) {
133− if(classlist[i])
134− fprintf(fout, "class %s\n", classlist[i]);
135− else
136− fprintf(fout, "class user%d\n", i);
137− }
72+ for (i = 0; secclass_map[i].name; i++)
73+ fprintf(fout, "class %s\n", secclass_map[i].name);
13874 fprintf(fout, "\n");
13975
14076 initial_sid_to_string_len = sizeof(initial_sid_to_string) / sizeof (char *);
14177 /* print out the sids */
142− for (i=1; i < initial_sid_to_string_len; i++)
78+ for (i = 1; i < initial_sid_to_string_len; i++)
14379 fprintf(fout, "sid %s\n", initial_sid_to_string[i]);
14480 fprintf(fout, "\n");
14581
146− /* print out the commons */
147− for (i=0; i< sizeof(common)/sizeof(struct common); i++) {
148− char cname[101];
149− find_common_name(common[i].cname, cname, 100);
150− cname[100] = '\0';
151− fprintf(fout, "common %s\n{\n", cname);
152− for (j=0; common[i].perms[j]; j++)
153− fprintf(fout, "\t%s\n", common[i].perms[j]);
154− fprintf(fout, "}\n\n");
155− }
156− fprintf(fout, "\n");
157−
15882 /* print out the class permissions */
159− for (i=1; i < classlist_len; i++) {
160− if (classlist[i]) {
161− int firstperm = -1, numperms = 0;
162−
163− fprintf(fout, "class %s\n", classlist[i]);
164− /* does it inherit from a common? */
165− for (j=0; j < sizeof(av_inherit)/sizeof(struct av_inherit); j++)
166− if (av_inherit[j].class == i)
167− fprintf(fout, "inherits %s\n", av_inherit[j].common);
168−
169− for (j=0; j < sizeof(av_perms)/sizeof(struct av_perms); j++) {
170− if (av_perms[j].class == i) {
171− if (firstperm == -1)
172− firstperm = j;
173− numperms++;
174− }
175− }
176− if (!numperms) {
177− fprintf(fout, "\n");
178− continue;
179− }
180−
181− fprintf(fout, "{\n");
182− /* print out the av_perms */
183− for (j=0; j < numperms; j++) {
184− fprintf(fout, "\t%s\n", av_perms[firstperm+j].perm_s);
185− }
186− fprintf(fout, "}\n\n");
187− }
83+ for (i = 0; secclass_map[i].name; i++) {
84+ struct security_class_mapping *map = &secclass_map[i];
85+ fprintf(fout, "class %s\n", map->name);
86+ fprintf(fout, "{\n");
87+ for (j = 0; map->perms[j]; j++)
88+ fprintf(fout, "\t%s\n", map->perms[j]);
89+ fprintf(fout, "}\n\n");
18890 }
18991 fprintf(fout, "\n");
19092
@@ -197,31 +99,34 @@ int main(int argc, char *argv[]) · 6 unmodified lines
19799 /* types, roles, and allows */
198100 fprintf(fout, "type base_t;\n");
199101 fprintf(fout, "role base_r types { base_t };\n");
200− for (i=1; i < classlist_len; i++) {
201− if (classlist[i])
202− fprintf(fout, "allow base_t base_t:%s *;\n", classlist[i]);
203− else
204− fprintf(fout, "allow base_t base_t:user%d *;\n", i);
205− }
102+ for (i = 0; secclass_map[i].name; i++)
103+ fprintf(fout, "allow base_t base_t:%s *;\n",
104+ secclass_map[i].name);
206105 fprintf(fout, "user user_u roles { base_r };\n");
207106 fprintf(fout, "\n");
208107
209108 /* default sids */
210− for (i=1; i < initial_sid_to_string_len; i++)
109+ for (i = 1; i < initial_sid_to_string_len; i++)
211110 fprintf(fout, "sid %s user_u:base_r:base_t\n", initial_sid_to_string[i]);
212111 fprintf(fout, "\n");
213112
214−
215113 fprintf(fout, "fs_use_xattr ext2 user_u:base_r:base_t;\n");
216114 fprintf(fout, "fs_use_xattr ext3 user_u:base_r:base_t;\n");
115+ fprintf(fout, "fs_use_xattr ext4 user_u:base_r:base_t;\n");
217116 fprintf(fout, "fs_use_xattr jfs user_u:base_r:base_t;\n");
218117 fprintf(fout, "fs_use_xattr xfs user_u:base_r:base_t;\n");
219118 fprintf(fout, "fs_use_xattr reiserfs user_u:base_r:base_t;\n");
119+ fprintf(fout, "fs_use_xattr jffs2 user_u:base_r:base_t;\n");
120+ fprintf(fout, "fs_use_xattr gfs2 user_u:base_r:base_t;\n");
121+ fprintf(fout, "fs_use_xattr lustre user_u:base_r:base_t;\n");
220122
123+ fprintf(fout, "fs_use_task eventpollfs user_u:base_r:base_t;\n");
221124 fprintf(fout, "fs_use_task pipefs user_u:base_r:base_t;\n");
222125 fprintf(fout, "fs_use_task sockfs user_u:base_r:base_t;\n");
223126
127+ fprintf(fout, "fs_use_trans mqueue user_u:base_r:base_t;\n");
224128 fprintf(fout, "fs_use_trans devpts user_u:base_r:base_t;\n");
129+ fprintf(fout, "fs_use_trans hugetlbfs user_u:base_r:base_t;\n");
225130 fprintf(fout, "fs_use_trans tmpfs user_u:base_r:base_t;\n");
226131 fprintf(fout, "fs_use_trans shm user_u:base_r:base_t;\n");
227132