#ifndef _SELABEL_FILE_H_
#define _SELABEL_FILE_H_
#include <errno.h>
#include <pthread.h>
#include <string.h>
#include <sys/stat.h>
/*
* regex.h/c were introduced to hold all dependencies on the regular
* expression back-end when we started supporting PCRE2. regex.h defines a
* minimal interface required by libselinux, so that the remaining code
* can be agnostic about the underlying implementation.
*/
#include "regex.h"
#include "callbacks.h"
#include "label_internal.h"
#include "selinux_internal.h"
#define SELINUX_MAGIC_COMPILED_FCONTEXT 0xf97cff8a
/* Version specific changes */
#define SELINUX_COMPILED_FCONTEXT_NOPCRE_VERS 1
#define SELINUX_COMPILED_FCONTEXT_PCRE_VERS 2
#define SELINUX_COMPILED_FCONTEXT_MODE 3
#define SELINUX_COMPILED_FCONTEXT_PREFIX_LEN 4
#define SELINUX_COMPILED_FCONTEXT_REGEX_ARCH 5
#define SELINUX_COMPILED_FCONTEXT_MAX_VERS \
SELINUX_COMPILED_FCONTEXT_REGEX_ARCH
struct selabel_sub {
char *src;
int slen;
char *dst;
struct selabel_sub *next;
};
/* A file security context specification. */
struct spec {
struct selabel_lookup_rec lr; /* holds contexts for lookup result */
char *regex_str; /* regular expession string for diagnostics */
char *type_str; /* type string for diagnostic messages */
struct regex_data * regex; /* backend dependent regular expression data */
bool regex_compiled; /* bool to indicate if the regex is compiled */
pthread_mutex_t regex_lock; /* lock for lazy compilation of regex */
mode_t mode; /* mode format value */
int matches; /* number of matching pathnames */
int stem_id; /* indicates which stem-compression item */
char hasMetaChars; /* regular expression has meta-chars */
char from_mmap; /* this spec is from an mmap of the data */
size_t prefix_len; /* length of fixed path prefix */
};
/* A regular expression stem */
struct stem {
char *buf;
int len;
char from_mmap;
};
/* Where we map the file in during selabel_open() */
struct mmap_area {
void *addr; /* Start addr + len used to release memory at close */
size_t len;
void *next_addr; /* Incremented by next_entry() */
size_t next_len; /* Decremented by next_entry() */
struct mmap_area *next;
};
/* Our stored configuration */
struct saved_data {
/*
* The array of specifications, initially in the same order as in
* the specification file. Sorting occurs based on hasMetaChars.
*/
struct spec *spec_arr;
unsigned int nspec;
unsigned int alloc_specs;
/*
* The array of regular expression stems.
*/
struct stem *stem_arr;
int num_stems;
int alloc_stems;
struct mmap_area *mmap_areas;
/* substitution support */
struct selabel_sub *dist_subs;
struct selabel_sub *subs;
};
static inline mode_t string_to_mode(char *mode)
{
size_t len;
if (!mode)
return 0;
len = strlen(mode);
if (mode[0] != '-' || len != 2)
return -1;
switch (mode[1]) {
case 'b':
return S_IFBLK;
case 'c':
return S_IFCHR;
case 'd':
return S_IFDIR;
case 'p':
return S_IFIFO;
case 'l':
return S_IFLNK;
case 's':
return S_IFSOCK;
case '-':
return S_IFREG;
default:
return -1;
}
/* impossible to get here */
return 0;
}
static inline int grow_specs(struct saved_data *data)
{
struct spec *specs;
size_t new_specs, total_specs;
if (data->nspec < data->alloc_specs)
return 0;
new_specs = data->nspec + 16;
total_specs = data->nspec + new_specs;
specs = realloc(data->spec_arr, total_specs * sizeof(*specs));
if (!specs) {
perror("realloc");
return -1;
}
/* blank the new entries */
memset(&specs[data->nspec], 0, new_specs * sizeof(*specs));
data->spec_arr = specs;
data->alloc_specs = total_specs;
return 0;
}
/* Determine if the regular expression specification has any meta characters. */
static inline void spec_hasMetaChars(struct spec *spec)
{
char *c;
int len;
char *end;
c = spec->regex_str;
len = strlen(spec->regex_str);
end = c + len;
spec->hasMetaChars = 0;
spec->prefix_len = len;
/* Look at each character in the RE specification string for a
* meta character. Return when any meta character reached. */
while (c < end) {
switch (*c) {
case '.':
case '^':
case '$':
case '?':
case '*':
case '+':
case '|':
case '[':
case '(':
case '{':
spec->hasMetaChars = 1;
spec->prefix_len = c - spec->regex_str;
return;
case '\\': /* skip the next character */
c++;
break;
default:
break;
}
c++;
}
}
/* Move exact pathname specifications to the end. */
static inline int sort_specs(struct saved_data *data)
{
struct spec *spec_copy;
struct spec spec;
unsigned int i;
int front, back;
size_t len = sizeof(*spec_copy);
spec_copy = malloc(len * data->nspec);
if (!spec_copy)
return -1;
/* first move the exact pathnames to the back */
front = 0;
back = data->nspec - 1;
for (i = 0; i < data->nspec; i++) {
if (data->spec_arr[i].hasMetaChars)
memcpy(&spec_copy[front++], &data->spec_arr[i], len);
else
memcpy(&spec_copy[back--], &data->spec_arr[i], len);
}
/*
* now the exact pathnames are at the end, but they are in the reverse
* order. Since 'front' is now the first of the 'exact' we can run
* that part of the array switching the front and back element.
*/
back = data->nspec - 1;
while (front < back) {
/* save the front */
memcpy(&spec, &spec_copy[front], len);
/* move the back to the front */
memcpy(&spec_copy[front], &spec_copy[back], len);
/* put the old front in the back */
memcpy(&spec_copy[back], &spec, len);
front++;
back--;
}
free(data->spec_arr);
data->spec_arr = spec_copy;
return 0;
}
/* Return the length of the text that can be considered the stem, returns 0
* if there is no identifiable stem */
static inline int get_stem_from_spec(const char *const buf)
{
const char *tmp = strchr(buf + 1, '/');
const char *ind;
if (!tmp)
return 0;
for (ind = buf; ind < tmp; ind++) {
if (strchr(".^$?*+|[({", (int)*ind))
return 0;
}
return tmp - buf;
}
/*
* return the stemid given a string and a length
*/
static inline int find_stem(struct saved_data *data, const char *buf,
int stem_len)
{
int i;
for (i = 0; i < data->num_stems; i++) {
if (stem_len == data->stem_arr[i].len &&
!strncmp(buf, data->stem_arr[i].buf, stem_len))
return i;
}
return -1;
}
/* returns the index of the new stored object */
static inline int store_stem(struct saved_data *data, char *buf, int stem_len)
{
int num = data->num_stems;
if (data->alloc_stems == num) {
struct stem *tmp_arr;
int alloc_stems = data->alloc_stems * 2 + 16;
tmp_arr = realloc(data->stem_arr,
sizeof(*tmp_arr) * alloc_stems);
if (!tmp_arr) {
free(buf);
return -1;
}
data->alloc_stems = alloc_stems;
data->stem_arr = tmp_arr;
}
data->stem_arr[num].len = stem_len;
data->stem_arr[num].buf = buf;
data->stem_arr[num].from_mmap = 0;
data->num_stems++;
return num;
}
/* find the stem of a file spec, returns the index into stem_arr for a new
* or existing stem, (or -1 if there is no possible stem - IE for a file in
* the root directory or a regex that is too complex for us). */
static inline int find_stem_from_spec(struct saved_data *data, const char *buf)
{
int stem_len = get_stem_from_spec(buf);
int stemid;
char *stem;
if (!stem_len)
return -1;
stemid = find_stem(data, buf, stem_len);
if (stemid >= 0)
return stemid;
/* not found, allocate a new one */
stem = strndup(buf, stem_len);
if (!stem)
return -1;
return store_stem(data, stem, stem_len);
}
/* This will always check for buffer over-runs and either read the next entry
* if buf != NULL or skip over the entry (as these areas are mapped in the
* current buffer). */
static inline int next_entry(void *buf, struct mmap_area *fp, size_t bytes)
{
if (bytes > fp->next_len)
return -1;
if (buf)
memcpy(buf, fp->next_addr, bytes);
fp->next_addr = (char *)fp->next_addr + bytes;
fp->next_len -= bytes;
return 0;
}
static inline int compile_regex(struct spec *spec, const char **errbuf)
{
char *reg_buf, *anchored_regex, *cp;
struct regex_error_data error_data;
static char regex_error_format_buffer[256];
size_t len;
int rc;
bool regex_compiled;
/* We really want pthread_once() here, but since its
* init_routine does not take a parameter, it's not possible
* to use, so we generate the same effect with atomics and a
* mutex */
#ifdef __ATOMIC_RELAXED
regex_compiled =
__atomic_load_n(&spec->regex_compiled, __ATOMIC_ACQUIRE);
#else
/* GCC <4.7 */
__sync_synchronize();
regex_compiled = spec->regex_compiled;
#endif
if (regex_compiled) {
return 0; /* already done */
}
__pthread_mutex_lock(&spec->regex_lock);
/* Check if another thread compiled the regex while we waited
* on the mutex */
#ifdef __ATOMIC_RELAXED
regex_compiled =
__atomic_load_n(&spec->regex_compiled, __ATOMIC_ACQUIRE);
#else
/* GCC <4.7 */
__sync_synchronize();
regex_compiled = spec->regex_compiled;
#endif
if (regex_compiled) {
__pthread_mutex_unlock(&spec->regex_lock);
return 0;
}
reg_buf = spec->regex_str;
/* Anchor the regular expression. */
len = strlen(reg_buf);
cp = anchored_regex = malloc(len + 3);
if (!anchored_regex) {
if (errbuf)
*errbuf = "out of memory";
__pthread_mutex_unlock(&spec->regex_lock);
return -1;
}
/* Create ^...$ regexp. */
*cp++ = '^';
memcpy(cp, reg_buf, len);
cp += len;
*cp++ = '$';
*cp = '\0';
/* Compile the regular expression. */
rc = regex_prepare_data(&spec->regex, anchored_regex, &error_data);
free(anchored_regex);
if (rc < 0) {
if (errbuf) {
regex_format_error(&error_data,
regex_error_format_buffer,
sizeof(regex_error_format_buffer));
*errbuf = ®ex_error_format_buffer[0];
}
__pthread_mutex_unlock(&spec->regex_lock);
return -1;
}
/* Done. */
#ifdef __ATOMIC_RELAXED
__atomic_store_n(&spec->regex_compiled, true, __ATOMIC_RELEASE);
#else
/* GCC <4.7 */
spec->regex_compiled = true;
__sync_synchronize();
#endif
__pthread_mutex_unlock(&spec->regex_lock);
return 0;
}
/* This service is used by label_file.c process_file() and
* utils/sefcontext_compile.c */
static inline int process_line(struct selabel_handle *rec,
const char *path, const char *prefix,
char *line_buf, unsigned lineno)
{
int items, len, rc;
char *regex = NULL, *type = NULL, *context = NULL;
struct saved_data *data = (struct saved_data *)rec->data;
struct spec *spec_arr;
unsigned int nspec = data->nspec;
const char *errbuf = NULL;
items = read_spec_entries(line_buf, &errbuf, 3, ®ex, &type, &context);
if (items < 0) {
rc = errno;
selinux_log(SELINUX_ERROR,
"%s: line %u error due to: %s\n", path,
lineno, errbuf ?: strerror(errno));
errno = rc;
return -1;
}
if (items == 0)
return items;
if (items < 2) {
COMPAT_LOG(SELINUX_ERROR,
"%s: line %u is missing fields\n", path,
lineno);
if (items == 1)
free(regex);
errno = EINVAL;
return -1;
} else if (items == 2) {
/* The type field is optional. */
context = type;
type = 0;
}
len = get_stem_from_spec(regex);
if (len && prefix && strncmp(prefix, regex, len)) {
/* Stem of regex does not match requested prefix, discard. */
free(regex);
free(type);
free(context);
return 0;
}
rc = grow_specs(data);
if (rc)
return rc;
spec_arr = data->spec_arr;
/* process and store the specification in spec. */
spec_arr[nspec].stem_id = find_stem_from_spec(data, regex);
spec_arr[nspec].regex_str = regex;
__pthread_mutex_init(&spec_arr[nspec].regex_lock, NULL);
spec_arr[nspec].regex_compiled = false;
spec_arr[nspec].type_str = type;
spec_arr[nspec].mode = 0;
spec_arr[nspec].lr.ctx_raw = context;
spec_arr[nspec].lr.lineno = lineno;
/*
* bump data->nspecs to cause closef() to cover it in its free
* but do not bump nspec since it's used below.
*/
data->nspec++;
if (rec->validating
&& compile_regex(&spec_arr[nspec], &errbuf)) {
COMPAT_LOG(SELINUX_ERROR,
"%s: line %u has invalid regex %s: %s\n",
path, lineno, regex, errbuf);
errno = EINVAL;
return -1;
}
if (type) {
mode_t mode = string_to_mode(type);
if (mode == (mode_t)-1) {
COMPAT_LOG(SELINUX_ERROR,
"%s: line %u has invalid file type %s\n",
path, lineno, type);
errno = EINVAL;
return -1;
}
spec_arr[nspec].mode = mode;
}
/* Determine if specification has
* any meta characters in the RE */
spec_hasMetaChars(&spec_arr[nspec]);
if (strcmp(context, "<<none>>") && rec->validating)
return compat_validate(rec, &spec_arr[nspec].lr, path, lineno);
return 0;
}
#endif /* _SELABEL_FILE_H_ */