Commit 42345b68 authored by Joshua Brindle's avatar Joshua Brindle Committed by Paul Moore
Browse files

selinux: default_range glblub implementation 



A policy developer can now specify glblub as a default_range default and
the computed transition will be the intersection of the mls range of
the two contexts.

The glb (greatest lower bound) lub (lowest upper bound) of a range is calculated
as the greater of the low sensitivities and the lower of the high sensitivities
and the and of each category bitmap.

This can be used by MLS solution developers to compute a context that satisfies,
for example, the range of a network interface and the range of a user logging in.

Some examples are:

User Permitted Range | Network Device Label | Computed Label
---------------------|----------------------|----------------
s0-s1:c0.c12         | s0                   | s0
s0-s1:c0.c12         | s0-s1:c0.c1023       | s0-s1:c0.c12
s0-s4:c0.c512        | s1-s1:c0.c1023       | s1-s1:c0.c512
s0-s15:c0,c2         | s4-s6:c0.c128        | s4-s6:c0,c2
s0-s4                | s2-s6                | s2-s4
s0-s4                | s5-s8                | INVALID
s5-s8                | s0-s4                | INVALID

Signed-off-by: default avatarJoshua Brindle <joshua.brindle@crunchydata.com>
[PM: subject lines and checkpatch.pl fixes]
Signed-off-by: default avatarPaul Moore <paul@paul-moore.com>
parent 3e3e24b4

security/selinux/include/security.h

+2 −1
Original line number Diff line number Diff line
@@ -40,10 +40,11 @@ 
#define POLICYDB_VERSION_CONSTRAINT_NAMES	29

#define POLICYDB_VERSION_XPERMS_IOCTL	30

#define POLICYDB_VERSION_INFINIBAND		31

#define POLICYDB_VERSION_GLBLUB		32



/* Range of policy versions we understand*/

#define POLICYDB_VERSION_MIN   POLICYDB_VERSION_BASE

#define POLICYDB_VERSION_MAX   POLICYDB_VERSION_INFINIBAND

#define POLICYDB_VERSION_MAX   POLICYDB_VERSION_GLBLUB



/* Mask for just the mount related flags */

#define SE_MNTMASK	0x0f

security/selinux/ss/context.h

+32 −0
Original line number Diff line number Diff line
@@ -95,6 +95,38 @@ out: 
	return rc;

}





static inline int mls_context_glblub(struct context *dst,

				     struct context *c1, struct context *c2)

{

	struct mls_range *dr = &dst->range, *r1 = &c1->range, *r2 = &c2->range;

	int rc = 0;



	if (r1->level[1].sens < r2->level[0].sens ||

	    r2->level[1].sens < r1->level[0].sens)

		/* These ranges have no common sensitivities */

		return -EINVAL;



	/* Take the greatest of the low */

	dr->level[0].sens = max(r1->level[0].sens, r2->level[0].sens);



	/* Take the least of the high */

	dr->level[1].sens = min(r1->level[1].sens, r2->level[1].sens);



	rc = ebitmap_and(&dr->level[0].cat,

			 &r1->level[0].cat, &r2->level[0].cat);

	if (rc)

		goto out;



	rc = ebitmap_and(&dr->level[1].cat,

			 &r1->level[1].cat, &r2->level[1].cat);

	if (rc)

		goto out;



out:

	return rc;

}



static inline int mls_context_cmp(struct context *c1, struct context *c2)

{

	return ((c1->range.level[0].sens == c2->range.level[0].sens) &&

security/selinux/ss/ebitmap.c

+18 −0
Original line number Diff line number Diff line
@@ -77,6 +77,24 @@ int ebitmap_cpy(struct ebitmap *dst, struct ebitmap *src) 
	return 0;

}



int ebitmap_and(struct ebitmap *dst, struct ebitmap *e1, struct ebitmap *e2)

{

	struct ebitmap_node *n;

	int bit, rc;



	ebitmap_init(dst);



	ebitmap_for_each_positive_bit(e1, n, bit) {

		if (ebitmap_get_bit(e2, bit)) {

			rc = ebitmap_set_bit(dst, bit, 1);

			if (rc < 0)

				return rc;

		}

	}

	return 0;

}





#ifdef CONFIG_NETLABEL

/**

 * ebitmap_netlbl_export - Export an ebitmap into a NetLabel category bitmap

security/selinux/ss/ebitmap.h

+1 −0
Original line number Diff line number Diff line
@@ -124,6 +124,7 @@ static inline void ebitmap_node_clr_bit(struct ebitmap_node *n, 


int ebitmap_cmp(struct ebitmap *e1, struct ebitmap *e2);

int ebitmap_cpy(struct ebitmap *dst, struct ebitmap *src);

int ebitmap_and(struct ebitmap *dst, struct ebitmap *e1, struct ebitmap *e2);

int ebitmap_contains(struct ebitmap *e1, struct ebitmap *e2, u32 last_e2bit);

int ebitmap_get_bit(struct ebitmap *e, unsigned long bit);

int ebitmap_set_bit(struct ebitmap *e, unsigned long bit, int value);

security/selinux/ss/mls.c

+3 −0
Original line number Diff line number Diff line
@@ -529,6 +529,9 @@ int mls_compute_sid(struct policydb *p, 
			return mls_context_cpy_high(newcontext, tcontext);

		case DEFAULT_TARGET_LOW_HIGH:

			return mls_context_cpy(newcontext, tcontext);

		case DEFAULT_GLBLUB:

			return mls_context_glblub(newcontext,

						  scontext, tcontext);

		}



		/* Fallthrough */

CRA Git | Maintained and supported by SUSTech CRA and CCSE