selinux: default_range glblub implementation

A policy developer can now specify glblub as a default_range default and
the computed transition will be the intersection of the mls range of
the two contexts.

The glb (greatest lower bound) lub (lowest upper bound) of a range is calculated
as the greater of the low sensitivities and the lower of the high sensitivities
and the and of each category bitmap.

This can be used by MLS solution developers to compute a context that satisfies,
for example, the range of a network interface and the range of a user logging in.

Some examples are:

User Permitted Range | Network Device Label | Computed Label
---------------------|----------------------|----------------
s0-s1:c0.c12         | s0                   | s0
s0-s1:c0.c12         | s0-s1:c0.c1023       | s0-s1:c0.c12
s0-s4:c0.c512        | s1-s1:c0.c1023       | s1-s1:c0.c512
s0-s15:c0,c2         | s4-s6:c0.c128        | s4-s6:c0,c2
s0-s4                | s2-s6                | s2-s4
s0-s4                | s5-s8                | INVALID
s5-s8                | s0-s4                | INVALID

Signed-off-by: Joshua Brindle <joshua.brindle@crunchydata.com>
[PM: subject lines and checkpatch.pl fixes]
Signed-off-by: Paul Moore <paul@paul-moore.com>

diff --git a/security/selinux/include/security.h b/security/selinux/include/security.h
index 111121281c4750dce8223bfedb4d7a5762da34ab..ae840634e3c7da3901f81bea23e4c48251cbf0e3 100644 (file)
--- a/security/selinux/include/security.h
+++ b/security/selinux/include/security.h
@@ -40,10 +40,11 @@
 #define POLICYDB_VERSION_CONSTRAINT_NAMES      29
 #define POLICYDB_VERSION_XPERMS_IOCTL  30
 #define POLICYDB_VERSION_INFINIBAND            31
+#define POLICYDB_VERSION_GLBLUB                32
 
 /* Range of policy versions we understand*/
 #define POLICYDB_VERSION_MIN   POLICYDB_VERSION_BASE
-#define POLICYDB_VERSION_MAX   POLICYDB_VERSION_INFINIBAND
+#define POLICYDB_VERSION_MAX   POLICYDB_VERSION_GLBLUB
 
 /* Mask for just the mount related flags */
 #define SE_MNTMASK     0x0f

diff --git a/security/selinux/ss/context.h b/security/selinux/ss/context.h
index 2260c44a568cc4f85bd866491ba2598fa3dd9b49..513e67f48878008e8d8a6880b4d3e6a67c21af7a 100644 (file)
--- a/security/selinux/ss/context.h
+++ b/security/selinux/ss/context.h
@@ -95,6 +95,38 @@ out:
        return rc;
 }
 
+
+static inline int mls_context_glblub(struct context *dst,
+                                    struct context *c1, struct context *c2)
+{
+       struct mls_range *dr = &dst->range, *r1 = &c1->range, *r2 = &c2->range;
+       int rc = 0;
+
+       if (r1->level[1].sens < r2->level[0].sens ||
+           r2->level[1].sens < r1->level[0].sens)
+               /* These ranges have no common sensitivities */
+               return -EINVAL;
+
+       /* Take the greatest of the low */
+       dr->level[0].sens = max(r1->level[0].sens, r2->level[0].sens);
+
+       /* Take the least of the high */
+       dr->level[1].sens = min(r1->level[1].sens, r2->level[1].sens);
+
+       rc = ebitmap_and(&dr->level[0].cat,
+                        &r1->level[0].cat, &r2->level[0].cat);
+       if (rc)
+               goto out;
+
+       rc = ebitmap_and(&dr->level[1].cat,
+                        &r1->level[1].cat, &r2->level[1].cat);
+       if (rc)
+               goto out;
+
+out:
+       return rc;
+}
+
 static inline int mls_context_cmp(struct context *c1, struct context *c2)
 {
        return ((c1->range.level[0].sens == c2->range.level[0].sens) &&

diff --git a/security/selinux/ss/ebitmap.c b/security/selinux/ss/ebitmap.c
index 09929fc5ab47ae72dc30ce2c2f5689432cc9a40b..c8c3663111e273d05d7ab05e1aa5f57222f6c4b8 100644 (file)
--- a/security/selinux/ss/ebitmap.c
+++ b/security/selinux/ss/ebitmap.c
@@ -77,6 +77,24 @@ int ebitmap_cpy(struct ebitmap *dst, struct ebitmap *src)
        return 0;
 }
 
+int ebitmap_and(struct ebitmap *dst, struct ebitmap *e1, struct ebitmap *e2)
+{
+       struct ebitmap_node *n;
+       int bit, rc;
+
+       ebitmap_init(dst);
+
+       ebitmap_for_each_positive_bit(e1, n, bit) {
+               if (ebitmap_get_bit(e2, bit)) {
+                       rc = ebitmap_set_bit(dst, bit, 1);
+                       if (rc < 0)
+                               return rc;
+               }
+       }
+       return 0;
+}
+
+
 #ifdef CONFIG_NETLABEL
 /**
  * ebitmap_netlbl_export - Export an ebitmap into a NetLabel category bitmap

diff --git a/security/selinux/ss/ebitmap.h b/security/selinux/ss/ebitmap.h
index 6aa7cf6a21979a4fa751d917e3656f2fdd28e41d..9a23b81b88327dca4ade72fb4d1fc1189903bb32 100644 (file)
--- a/security/selinux/ss/ebitmap.h
+++ b/security/selinux/ss/ebitmap.h
@@ -124,6 +124,7 @@ static inline void ebitmap_node_clr_bit(struct ebitmap_node *n,
 
 int ebitmap_cmp(struct ebitmap *e1, struct ebitmap *e2);
 int ebitmap_cpy(struct ebitmap *dst, struct ebitmap *src);
+int ebitmap_and(struct ebitmap *dst, struct ebitmap *e1, struct ebitmap *e2);
 int ebitmap_contains(struct ebitmap *e1, struct ebitmap *e2, u32 last_e2bit);
 int ebitmap_get_bit(struct ebitmap *e, unsigned long bit);
 int ebitmap_set_bit(struct ebitmap *e, unsigned long bit, int value);

diff --git a/security/selinux/ss/mls.c b/security/selinux/ss/mls.c
index 5e05f5b902d74eeebb8defdc5eea3a36543f0bc6..ec5e3d1da9ace26653f9dea94ffa15654800d300 100644 (file)
--- a/security/selinux/ss/mls.c
+++ b/security/selinux/ss/mls.c
@@ -529,6 +529,9 @@ int mls_compute_sid(struct policydb *p,
                        return mls_context_cpy_high(newcontext, tcontext);
                case DEFAULT_TARGET_LOW_HIGH:
                        return mls_context_cpy(newcontext, tcontext);
+               case DEFAULT_GLBLUB:
+                       return mls_context_glblub(newcontext,
+                                                 scontext, tcontext);
                }
 
                /* Fallthrough */

diff --git a/security/selinux/ss/policydb.c b/security/selinux/ss/policydb.c
index 1260f5fb766e0f7d3f5a1b3ae1de9e32ae4a7cac..e20624a68f5d2f7b017fb6c6a2252d5310839b30 100644 (file)
--- a/security/selinux/ss/policydb.c
+++ b/security/selinux/ss/policydb.c
@@ -160,6 +160,11 @@ static struct policydb_compat_info policydb_compat[] = {
                .sym_num        = SYM_NUM,
                .ocon_num       = OCON_NUM,
        },
+       {
+               .version        = POLICYDB_VERSION_GLBLUB,
+               .sym_num        = SYM_NUM,
+               .ocon_num       = OCON_NUM,
+       },
 };
 
 static struct policydb_compat_info *policydb_lookup_compat(int version)

diff --git a/security/selinux/ss/policydb.h b/security/selinux/ss/policydb.h
index 162d0e79b85b369d39418d80a196215ce85a106a..bc56b14e22166fde69031d187d6151643e6e1f9e 100644 (file)
--- a/security/selinux/ss/policydb.h
+++ b/security/selinux/ss/policydb.h
@@ -69,6 +69,7 @@ struct class_datum {
 #define DEFAULT_TARGET_LOW     4
 #define DEFAULT_TARGET_HIGH    5
 #define DEFAULT_TARGET_LOW_HIGH        6
+#define DEFAULT_GLBLUB         7
        char default_range;
 };