mdp.c 4.3 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149
  1. /*
  2. *
  3. * mdp - make dummy policy
  4. *
  5. * When pointed at a kernel tree, builds a dummy policy for that kernel
  6. * with exactly one type with full rights to itself.
  7. *
  8. * This program is free software; you can redistribute it and/or modify
  9. * it under the terms of the GNU General Public License as published by
  10. * the Free Software Foundation; either version 2 of the License, or
  11. * (at your option) any later version.
  12. *
  13. * This program is distributed in the hope that it will be useful,
  14. * but WITHOUT ANY WARRANTY; without even the implied warranty of
  15. * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  16. * GNU General Public License for more details.
  17. *
  18. * You should have received a copy of the GNU General Public License
  19. * along with this program; if not, write to the Free Software
  20. * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
  21. *
  22. * Copyright (C) IBM Corporation, 2006
  23. *
  24. * Authors: Serge E. Hallyn <serue@us.ibm.com>
  25. */
  26. #include <stdio.h>
  27. #include <stdlib.h>
  28. #include <unistd.h>
  29. #include <string.h>
  30. static void usage(char *name)
  31. {
  32. printf("usage: %s [-m] policy_file context_file\n", name);
  33. exit(1);
  34. }
  35. /* Class/perm mapping support */
  36. struct security_class_mapping {
  37. const char *name;
  38. const char *perms[sizeof(unsigned) * 8 + 1];
  39. };
  40. #include "classmap.h"
  41. #include "initial_sid_to_string.h"
  42. int main(int argc, char *argv[])
  43. {
  44. int i, j, mls = 0;
  45. int initial_sid_to_string_len;
  46. char **arg, *polout, *ctxout;
  47. FILE *fout;
  48. if (argc < 3)
  49. usage(argv[0]);
  50. arg = argv+1;
  51. if (argc==4 && strcmp(argv[1], "-m") == 0) {
  52. mls = 1;
  53. arg++;
  54. }
  55. polout = *arg++;
  56. ctxout = *arg;
  57. fout = fopen(polout, "w");
  58. if (!fout) {
  59. printf("Could not open %s for writing\n", polout);
  60. usage(argv[0]);
  61. }
  62. /* print out the classes */
  63. for (i = 0; secclass_map[i].name; i++)
  64. fprintf(fout, "class %s\n", secclass_map[i].name);
  65. fprintf(fout, "\n");
  66. initial_sid_to_string_len = sizeof(initial_sid_to_string) / sizeof (char *);
  67. /* print out the sids */
  68. for (i = 1; i < initial_sid_to_string_len; i++)
  69. fprintf(fout, "sid %s\n", initial_sid_to_string[i]);
  70. fprintf(fout, "\n");
  71. /* print out the class permissions */
  72. for (i = 0; secclass_map[i].name; i++) {
  73. struct security_class_mapping *map = &secclass_map[i];
  74. fprintf(fout, "class %s\n", map->name);
  75. fprintf(fout, "{\n");
  76. for (j = 0; map->perms[j]; j++)
  77. fprintf(fout, "\t%s\n", map->perms[j]);
  78. fprintf(fout, "}\n\n");
  79. }
  80. fprintf(fout, "\n");
  81. /* NOW PRINT OUT MLS STUFF */
  82. if (mls) {
  83. printf("MLS not yet implemented\n");
  84. exit(1);
  85. }
  86. /* types, roles, and allows */
  87. fprintf(fout, "type base_t;\n");
  88. fprintf(fout, "role base_r;\n");
  89. fprintf(fout, "role base_r types { base_t };\n");
  90. for (i = 0; secclass_map[i].name; i++)
  91. fprintf(fout, "allow base_t base_t:%s *;\n",
  92. secclass_map[i].name);
  93. fprintf(fout, "user user_u roles { base_r };\n");
  94. fprintf(fout, "\n");
  95. /* default sids */
  96. for (i = 1; i < initial_sid_to_string_len; i++)
  97. fprintf(fout, "sid %s user_u:base_r:base_t\n", initial_sid_to_string[i]);
  98. fprintf(fout, "\n");
  99. fprintf(fout, "fs_use_xattr ext2 user_u:base_r:base_t;\n");
  100. fprintf(fout, "fs_use_xattr ext3 user_u:base_r:base_t;\n");
  101. fprintf(fout, "fs_use_xattr ext4 user_u:base_r:base_t;\n");
  102. fprintf(fout, "fs_use_xattr jfs user_u:base_r:base_t;\n");
  103. fprintf(fout, "fs_use_xattr xfs user_u:base_r:base_t;\n");
  104. fprintf(fout, "fs_use_xattr reiserfs user_u:base_r:base_t;\n");
  105. fprintf(fout, "fs_use_xattr jffs2 user_u:base_r:base_t;\n");
  106. fprintf(fout, "fs_use_xattr gfs2 user_u:base_r:base_t;\n");
  107. fprintf(fout, "fs_use_xattr lustre user_u:base_r:base_t;\n");
  108. fprintf(fout, "fs_use_task eventpollfs user_u:base_r:base_t;\n");
  109. fprintf(fout, "fs_use_task pipefs user_u:base_r:base_t;\n");
  110. fprintf(fout, "fs_use_task sockfs user_u:base_r:base_t;\n");
  111. fprintf(fout, "fs_use_trans mqueue user_u:base_r:base_t;\n");
  112. fprintf(fout, "fs_use_trans devpts user_u:base_r:base_t;\n");
  113. fprintf(fout, "fs_use_trans hugetlbfs user_u:base_r:base_t;\n");
  114. fprintf(fout, "fs_use_trans tmpfs user_u:base_r:base_t;\n");
  115. fprintf(fout, "fs_use_trans shm user_u:base_r:base_t;\n");
  116. fprintf(fout, "genfscon proc / user_u:base_r:base_t\n");
  117. fclose(fout);
  118. fout = fopen(ctxout, "w");
  119. if (!fout) {
  120. printf("Wrote policy, but cannot open %s for writing\n", ctxout);
  121. usage(argv[0]);
  122. }
  123. fprintf(fout, "/ user_u:base_r:base_t\n");
  124. fprintf(fout, "/.* user_u:base_r:base_t\n");
  125. fclose(fout);
  126. return 0;
  127. }