Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 8023976c authored by Harry Ciao's avatar Harry Ciao Committed by Eric Paris
Browse files

SELinux: Add class support to the role_trans structure 



If kernel policy version is >= 26, then the binary representation of
the role_trans structure supports specifying the class for the current
subject or the newly created object.

If kernel policy version is < 26, then the class field would be default
to the process class.

Signed-off-by: default avatarHarry Ciao <qingtao.cao@windriver.com>
Acked-by: default avatarStephen Smalley <sds@tycho.nsa.gov>
Signed-off-by: default avatarEric Paris <eparis@redhat.com>
parent fe3fa430

security/selinux/include/security.h

+2 −1
Original line number Diff line number Diff line
@@ -30,13 +30,14 @@ 
#define POLICYDB_VERSION_PERMISSIVE	23

#define POLICYDB_VERSION_BOUNDARY	24

#define POLICYDB_VERSION_FILENAME_TRANS	25

#define POLICYDB_VERSION_ROLETRANS	26



/* Range of policy versions we understand*/

#define POLICYDB_VERSION_MIN   POLICYDB_VERSION_BASE

#ifdef CONFIG_SECURITY_SELINUX_POLICYDB_VERSION_MAX

#define POLICYDB_VERSION_MAX	CONFIG_SECURITY_SELINUX_POLICYDB_VERSION_MAX_VALUE

#else

#define POLICYDB_VERSION_MAX	POLICYDB_VERSION_FILENAME_TRANS

#define POLICYDB_VERSION_MAX	POLICYDB_VERSION_ROLETRANS

#endif



/* Mask for just the mount related flags */

security/selinux/ss/policydb.c

+14 −0
Original line number Diff line number Diff line
@@ -128,6 +128,11 @@ static struct policydb_compat_info policydb_compat[] = { 
		.sym_num	= SYM_NUM,

		.ocon_num	= OCON_NUM,

	},

	{

		.version	= POLICYDB_VERSION_ROLETRANS,

		.sym_num	= SYM_NUM,

		.ocon_num	= OCON_NUM,

	},

};



static struct policydb_compat_info *policydb_lookup_compat(int version)
@@ -2302,8 +2307,17 @@ int policydb_read(struct policydb *p, void *fp) 
		tr->role = le32_to_cpu(buf[0]);

		tr->type = le32_to_cpu(buf[1]);

		tr->new_role = le32_to_cpu(buf[2]);

		if (p->policyvers >= POLICYDB_VERSION_ROLETRANS) {

			rc = next_entry(buf, fp, sizeof(u32));

			if (rc)

				goto bad;

			tr->tclass = le32_to_cpu(buf[0]);

		} else

			tr->tclass = p->process_class;



		if (!policydb_role_isvalid(p, tr->role) ||

		    !policydb_type_isvalid(p, tr->type) ||

		    !policydb_class_isvalid(p, tr->tclass) ||

		    !policydb_role_isvalid(p, tr->new_role))

			goto bad;

		ltr = tr;

security/selinux/ss/policydb.h

+2 −1
Original line number Diff line number Diff line
@@ -72,7 +72,8 @@ struct role_datum { 


struct role_trans {

	u32 role;		/* current role */

	u32 type;		/* program executable type */

	u32 type;		/* program executable type, or new object type */

	u32 tclass;		/* process class, or new object class */

	u32 new_role;		/* new role */

	struct role_trans *next;

};