Commit | Line | Data |
---|---|---|
93c06cbb SH |
1 | /* |
2 | * | |
3 | * mdp - make dummy policy | |
4 | * | |
5 | * When pointed at a kernel tree, builds a dummy policy for that kernel | |
6 | * with exactly one type with full rights to itself. | |
7 | * | |
8 | * This program is free software; you can redistribute it and/or modify | |
9 | * it under the terms of the GNU General Public License as published by | |
10 | * the Free Software Foundation; either version 2 of the License, or | |
11 | * (at your option) any later version. | |
12 | * | |
13 | * This program is distributed in the hope that it will be useful, | |
14 | * but WITHOUT ANY WARRANTY; without even the implied warranty of | |
15 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the | |
16 | * GNU General Public License for more details. | |
17 | * | |
18 | * You should have received a copy of the GNU General Public License | |
19 | * along with this program; if not, write to the Free Software | |
20 | * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. | |
21 | * | |
22 | * Copyright (C) IBM Corporation, 2006 | |
23 | * | |
24 | * Authors: Serge E. Hallyn <serue@us.ibm.com> | |
25 | */ | |
26 | ||
bfc5e3a6 PM |
27 | |
28 | /* NOTE: we really do want to use the kernel headers here */ | |
29 | #define __EXPORTED_HEADERS__ | |
30 | ||
93c06cbb SH |
31 | #include <stdio.h> |
32 | #include <stdlib.h> | |
33 | #include <unistd.h> | |
34 | #include <string.h> | |
c017c71c | 35 | #include <sys/socket.h> |
93c06cbb | 36 | |
5c725138 | 37 | static void usage(char *name) |
93c06cbb SH |
38 | { |
39 | printf("usage: %s [-m] policy_file context_file\n", name); | |
40 | exit(1); | |
41 | } | |
42 | ||
c6d3aaa4 SS |
43 | /* Class/perm mapping support */ |
44 | struct security_class_mapping { | |
45 | const char *name; | |
46 | const char *perms[sizeof(unsigned) * 8 + 1]; | |
93c06cbb | 47 | }; |
93c06cbb | 48 | |
c6d3aaa4 | 49 | #include "classmap.h" |
93c06cbb SH |
50 | #include "initial_sid_to_string.h" |
51 | ||
93c06cbb SH |
52 | int main(int argc, char *argv[]) |
53 | { | |
54 | int i, j, mls = 0; | |
c6d3aaa4 | 55 | int initial_sid_to_string_len; |
93c06cbb | 56 | char **arg, *polout, *ctxout; |
c6d3aaa4 | 57 | |
93c06cbb SH |
58 | FILE *fout; |
59 | ||
60 | if (argc < 3) | |
61 | usage(argv[0]); | |
62 | arg = argv+1; | |
63 | if (argc==4 && strcmp(argv[1], "-m") == 0) { | |
64 | mls = 1; | |
65 | arg++; | |
66 | } | |
67 | polout = *arg++; | |
68 | ctxout = *arg; | |
69 | ||
70 | fout = fopen(polout, "w"); | |
71 | if (!fout) { | |
72 | printf("Could not open %s for writing\n", polout); | |
73 | usage(argv[0]); | |
74 | } | |
75 | ||
93c06cbb | 76 | /* print out the classes */ |
c6d3aaa4 SS |
77 | for (i = 0; secclass_map[i].name; i++) |
78 | fprintf(fout, "class %s\n", secclass_map[i].name); | |
93c06cbb SH |
79 | fprintf(fout, "\n"); |
80 | ||
81 | initial_sid_to_string_len = sizeof(initial_sid_to_string) / sizeof (char *); | |
82 | /* print out the sids */ | |
c6d3aaa4 | 83 | for (i = 1; i < initial_sid_to_string_len; i++) |
93c06cbb SH |
84 | fprintf(fout, "sid %s\n", initial_sid_to_string[i]); |
85 | fprintf(fout, "\n"); | |
86 | ||
93c06cbb | 87 | /* print out the class permissions */ |
c6d3aaa4 SS |
88 | for (i = 0; secclass_map[i].name; i++) { |
89 | struct security_class_mapping *map = &secclass_map[i]; | |
90 | fprintf(fout, "class %s\n", map->name); | |
91 | fprintf(fout, "{\n"); | |
92 | for (j = 0; map->perms[j]; j++) | |
93 | fprintf(fout, "\t%s\n", map->perms[j]); | |
94 | fprintf(fout, "}\n\n"); | |
93c06cbb SH |
95 | } |
96 | fprintf(fout, "\n"); | |
97 | ||
98 | /* NOW PRINT OUT MLS STUFF */ | |
99 | if (mls) { | |
100 | printf("MLS not yet implemented\n"); | |
101 | exit(1); | |
102 | } | |
103 | ||
104 | /* types, roles, and allows */ | |
105 | fprintf(fout, "type base_t;\n"); | |
fda4d578 | 106 | fprintf(fout, "role base_r;\n"); |
93c06cbb | 107 | fprintf(fout, "role base_r types { base_t };\n"); |
c6d3aaa4 SS |
108 | for (i = 0; secclass_map[i].name; i++) |
109 | fprintf(fout, "allow base_t base_t:%s *;\n", | |
110 | secclass_map[i].name); | |
93c06cbb SH |
111 | fprintf(fout, "user user_u roles { base_r };\n"); |
112 | fprintf(fout, "\n"); | |
113 | ||
114 | /* default sids */ | |
c6d3aaa4 | 115 | for (i = 1; i < initial_sid_to_string_len; i++) |
93c06cbb SH |
116 | fprintf(fout, "sid %s user_u:base_r:base_t\n", initial_sid_to_string[i]); |
117 | fprintf(fout, "\n"); | |
118 | ||
93c06cbb SH |
119 | fprintf(fout, "fs_use_xattr ext2 user_u:base_r:base_t;\n"); |
120 | fprintf(fout, "fs_use_xattr ext3 user_u:base_r:base_t;\n"); | |
c6d3aaa4 | 121 | fprintf(fout, "fs_use_xattr ext4 user_u:base_r:base_t;\n"); |
93c06cbb SH |
122 | fprintf(fout, "fs_use_xattr jfs user_u:base_r:base_t;\n"); |
123 | fprintf(fout, "fs_use_xattr xfs user_u:base_r:base_t;\n"); | |
124 | fprintf(fout, "fs_use_xattr reiserfs user_u:base_r:base_t;\n"); | |
c6d3aaa4 SS |
125 | fprintf(fout, "fs_use_xattr jffs2 user_u:base_r:base_t;\n"); |
126 | fprintf(fout, "fs_use_xattr gfs2 user_u:base_r:base_t;\n"); | |
127 | fprintf(fout, "fs_use_xattr lustre user_u:base_r:base_t;\n"); | |
93c06cbb | 128 | |
c6d3aaa4 | 129 | fprintf(fout, "fs_use_task eventpollfs user_u:base_r:base_t;\n"); |
93c06cbb SH |
130 | fprintf(fout, "fs_use_task pipefs user_u:base_r:base_t;\n"); |
131 | fprintf(fout, "fs_use_task sockfs user_u:base_r:base_t;\n"); | |
132 | ||
c6d3aaa4 | 133 | fprintf(fout, "fs_use_trans mqueue user_u:base_r:base_t;\n"); |
93c06cbb | 134 | fprintf(fout, "fs_use_trans devpts user_u:base_r:base_t;\n"); |
c6d3aaa4 | 135 | fprintf(fout, "fs_use_trans hugetlbfs user_u:base_r:base_t;\n"); |
93c06cbb SH |
136 | fprintf(fout, "fs_use_trans tmpfs user_u:base_r:base_t;\n"); |
137 | fprintf(fout, "fs_use_trans shm user_u:base_r:base_t;\n"); | |
138 | ||
139 | fprintf(fout, "genfscon proc / user_u:base_r:base_t\n"); | |
140 | ||
141 | fclose(fout); | |
142 | ||
143 | fout = fopen(ctxout, "w"); | |
144 | if (!fout) { | |
145 | printf("Wrote policy, but cannot open %s for writing\n", ctxout); | |
146 | usage(argv[0]); | |
147 | } | |
148 | fprintf(fout, "/ user_u:base_r:base_t\n"); | |
149 | fprintf(fout, "/.* user_u:base_r:base_t\n"); | |
150 | fclose(fout); | |
151 | ||
152 | return 0; | |
153 | } |