1 files changed, 97 insertions, 125 deletions

diff --git a/security/selinux/ss/services.c b/security/selinux/ss/services.c
index 12e414394530..dd44126c8d14 100644
--- a/security/selinux/ss/services.c
+++ b/security/selinux/ss/services.c
@@ -71,7 +71,7 @@
 #include "audit.h"
 
 /* Policy capability names */
-char *selinux_policycap_names[__POLICYDB_CAPABILITY_MAX] = {
+const char *selinux_policycap_names[__POLICYDB_CAPABILITY_MAX] = {
         "network_peer_controls",
         "open_perms",
         "extended_socket_class",
@@ -776,7 +776,7 @@ static int security_compute_validatetrans(struct selinux_state *state,
         read_lock(&state->ss->policy_rwlock);
 
         policydb = &state->ss->policydb;
-        sidtab = &state->ss->sidtab;
+        sidtab = state->ss->sidtab;
 
         if (!user)
                 tclass = unmap_class(&state->ss->map, orig_tclass);
@@ -876,7 +876,7 @@ int security_bounded_transition(struct selinux_state *state,
         read_lock(&state->ss->policy_rwlock);
 
         policydb = &state->ss->policydb;
-        sidtab = &state->ss->sidtab;
+        sidtab = state->ss->sidtab;
 
         rc = -EINVAL;
         old_context = sidtab_search(sidtab, old_sid);
@@ -1034,7 +1034,7 @@ void security_compute_xperms_decision(struct selinux_state *state,
                 goto allow;
 
         policydb = &state->ss->policydb;
-        sidtab = &state->ss->sidtab;
+        sidtab = state->ss->sidtab;
 
         scontext = sidtab_search(sidtab, ssid);
         if (!scontext) {
@@ -1123,7 +1123,7 @@ void security_compute_av(struct selinux_state *state,
                 goto allow;
 
         policydb = &state->ss->policydb;
-        sidtab = &state->ss->sidtab;
+        sidtab = state->ss->sidtab;
 
         scontext = sidtab_search(sidtab, ssid);
         if (!scontext) {
@@ -1177,7 +1177,7 @@ void security_compute_av_user(struct selinux_state *state,
                 goto allow;
 
         policydb = &state->ss->policydb;
-        sidtab = &state->ss->sidtab;
+        sidtab = state->ss->sidtab;
 
         scontext = sidtab_search(sidtab, ssid);
         if (!scontext) {
@@ -1315,7 +1315,7 @@ static int security_sid_to_context_core(struct selinux_state *state,
         }
         read_lock(&state->ss->policy_rwlock);
         policydb = &state->ss->policydb;
-        sidtab = &state->ss->sidtab;
+        sidtab = state->ss->sidtab;
         if (force)
                 context = sidtab_search_force(sidtab, sid);
         else
@@ -1483,7 +1483,7 @@ static int security_context_to_sid_core(struct selinux_state *state,
         }
         read_lock(&state->ss->policy_rwlock);
         policydb = &state->ss->policydb;
-        sidtab = &state->ss->sidtab;
+        sidtab = state->ss->sidtab;
         rc = string_to_context_struct(policydb, sidtab, scontext2,
                                       &context, def_sid);
         if (rc == -EINVAL && force) {
@@ -1668,7 +1668,7 @@ static int security_compute_sid(struct selinux_state *state,
         }
 
         policydb = &state->ss->policydb;
-        sidtab = &state->ss->sidtab;
+        sidtab = state->ss->sidtab;
 
         scontext = sidtab_search(sidtab, ssid);
         if (!scontext) {
@@ -1880,19 +1880,6 @@ int security_change_sid(struct selinux_state *state,
                                     out_sid, false);
 }
 
-/* Clone the SID into the new SID table. */
-static int clone_sid(u32 sid,
-                     struct context *context,
-                     void *arg)
-{
-        struct sidtab *s = arg;
-
-        if (sid > SECINITSID_NUM)
-                return sidtab_insert(s, sid, context);
-        else
-                return 0;
-}
-
 static inline int convert_context_handle_invalid_context(
         struct selinux_state *state,
         struct context *context)
@@ -1920,101 +1907,84 @@ struct convert_context_args {
 
 /*
  * Convert the values in the security context
- * structure `c' from the values specified
+ * structure `oldc' from the values specified
  * in the policy `p->oldp' to the values specified
- * in the policy `p->newp'.  Verify that the
- * context is valid under the new policy.
+ * in the policy `p->newp', storing the new context
+ * in `newc'.  Verify that the context is valid
+ * under the new policy.
  */
-static int convert_context(u32 key,
-                           struct context *c,
-                           void *p)
+static int convert_context(struct context *oldc, struct context *newc, void *p)
 {
         struct convert_context_args *args;
-        struct context oldc;
         struct ocontext *oc;
-        struct mls_range *range;
         struct role_datum *role;
         struct type_datum *typdatum;
         struct user_datum *usrdatum;
         char *s;
         u32 len;
-        int rc = 0;
-
-        if (key <= SECINITSID_NUM)
-                goto out;
+        int rc;
 
         args = p;
 
-        if (c->str) {
-                struct context ctx;
-
-                rc = -ENOMEM;
-                s = kstrdup(c->str, GFP_KERNEL);
+        if (oldc->str) {
+                s = kstrdup(oldc->str, GFP_KERNEL);
                 if (!s)
-                        goto out;
+                        return -ENOMEM;
 
                 rc = string_to_context_struct(args->newp, NULL, s,
-                                              &ctx, SECSID_NULL);
-                kfree(s);
-                if (!rc) {
-                        pr_info("SELinux:  Context %s became valid (mapped).\n",
-                               c->str);
-                        /* Replace string with mapped representation. */
-                        kfree(c->str);
-                        memcpy(c, &ctx, sizeof(*c));
-                        goto out;
-                } else if (rc == -EINVAL) {
+                                              newc, SECSID_NULL);
+                if (rc == -EINVAL) {
                         /* Retain string representation for later mapping. */
-                        rc = 0;
-                        goto out;
-                } else {
+                        context_init(newc);
+                        newc->str = s;
+                        newc->len = oldc->len;
+                        return 0;
+                }
+                kfree(s);
+                if (rc) {
                         /* Other error condition, e.g. ENOMEM. */
                         pr_err("SELinux:   Unable to map context %s, rc = %d.\n",
-                               c->str, -rc);
-                        goto out;
+                               oldc->str, -rc);
+                        return rc;
                 }
+                pr_info("SELinux:  Context %s became valid (mapped).\n",
+                        oldc->str);
+                return 0;
         }
 
-        rc = context_cpy(&oldc, c);
-        if (rc)
-                goto out;
+        context_init(newc);
 
         /* Convert the user. */
         rc = -EINVAL;
         usrdatum = hashtab_search(args->newp->p_users.table,
-                                  sym_name(args->oldp, SYM_USERS, c->user - 1));
+                                  sym_name(args->oldp,
+                                           SYM_USERS, oldc->user - 1));
         if (!usrdatum)
                 goto bad;
-        c->user = usrdatum->value;
+        newc->user = usrdatum->value;
 
         /* Convert the role. */
         rc = -EINVAL;
         role = hashtab_search(args->newp->p_roles.table,
-                              sym_name(args->oldp, SYM_ROLES, c->role - 1));
+                              sym_name(args->oldp, SYM_ROLES, oldc->role - 1));
         if (!role)
                 goto bad;
-        c->role = role->value;
+        newc->role = role->value;
 
         /* Convert the type. */
         rc = -EINVAL;
         typdatum = hashtab_search(args->newp->p_types.table,
-                                  sym_name(args->oldp, SYM_TYPES, c->type - 1));
+                                  sym_name(args->oldp,
+                                           SYM_TYPES, oldc->type - 1));
         if (!typdatum)
                 goto bad;
-        c->type = typdatum->value;
+        newc->type = typdatum->value;
 
         /* Convert the MLS fields if dealing with MLS policies */
         if (args->oldp->mls_enabled && args->newp->mls_enabled) {
-                rc = mls_convert_context(args->oldp, args->newp, c);
+                rc = mls_convert_context(args->oldp, args->newp, oldc, newc);
                 if (rc)
                         goto bad;
-        } else if (args->oldp->mls_enabled && !args->newp->mls_enabled) {
-                /*
-                 * Switching between MLS and non-MLS policy:
-                 * free any storage used by the MLS fields in the
-                 * context for all existing entries in the sidtab.
-                 */
-                mls_context_destroy(c);
         } else if (!args->oldp->mls_enabled && args->newp->mls_enabled) {
                 /*
                  * Switching between non-MLS and MLS policy:
@@ -2032,38 +2002,30 @@ static int convert_context(u32 key,
                                 " the initial SIDs list\n");
                         goto bad;
                 }
-                range = &oc->context[0].range;
-                rc = mls_range_set(c, range);
+                rc = mls_range_set(newc, &oc->context[0].range);
                 if (rc)
                         goto bad;
         }
 
         /* Check the validity of the new context. */
-        if (!policydb_context_isvalid(args->newp, c)) {
-                rc = convert_context_handle_invalid_context(args->state,
-                                                            &oldc);
+        if (!policydb_context_isvalid(args->newp, newc)) {
+                rc = convert_context_handle_invalid_context(args->state, oldc);
                 if (rc)
                         goto bad;
         }
 
-        context_destroy(&oldc);
-
-        rc = 0;
-out:
-        return rc;
+        return 0;
 bad:
         /* Map old representation to string and save it. */
-        rc = context_struct_to_string(args->oldp, &oldc, &s, &len);
+        rc = context_struct_to_string(args->oldp, oldc, &s, &len);
         if (rc)
                 return rc;
-        context_destroy(&oldc);
-        context_destroy(c);
-        c->str = s;
-        c->len = len;
+        context_destroy(newc);
+        newc->str = s;
+        newc->len = len;
         pr_info("SELinux:  Context %s became invalid (unmapped).\n",
-               c->str);
-        rc = 0;
-        goto out;
+                newc->str);
+        return 0;
 }
 
 static void security_load_policycaps(struct selinux_state *state)
@@ -2103,11 +2065,11 @@ static int security_preserve_bools(struct selinux_state *state,
 int security_load_policy(struct selinux_state *state, void *data, size_t len)
 {
         struct policydb *policydb;
-        struct sidtab *sidtab;
+        struct sidtab *oldsidtab, *newsidtab;
         struct policydb *oldpolicydb, *newpolicydb;
-        struct sidtab oldsidtab, newsidtab;
         struct selinux_mapping *oldmapping;
         struct selinux_map newmap;
+        struct sidtab_convert_params convert_params;
         struct convert_context_args args;
         u32 seqno;
         int rc = 0;
@@ -2121,27 +2083,37 @@ int security_load_policy(struct selinux_state *state, void *data, size_t len)
         newpolicydb = oldpolicydb + 1;
 
         policydb = &state->ss->policydb;
-        sidtab = &state->ss->sidtab;
+
+        newsidtab = kmalloc(sizeof(*newsidtab), GFP_KERNEL);
+        if (!newsidtab) {
+                rc = -ENOMEM;
+                goto out;
+        }
 
         if (!state->initialized) {
                 rc = policydb_read(policydb, fp);
-                if (rc)
+                if (rc) {
+                        kfree(newsidtab);
                         goto out;
+                }
 
                 policydb->len = len;
                 rc = selinux_set_mapping(policydb, secclass_map,
                                          &state->ss->map);
                 if (rc) {
+                        kfree(newsidtab);
                         policydb_destroy(policydb);
                         goto out;
                 }
 
-                rc = policydb_load_isids(policydb, sidtab);
+                rc = policydb_load_isids(policydb, newsidtab);
                 if (rc) {
+                        kfree(newsidtab);
                         policydb_destroy(policydb);
                         goto out;
                 }
 
+                state->ss->sidtab = newsidtab;
                 security_load_policycaps(state);
                 state->initialized = 1;
                 seqno = ++state->ss->latest_granting;
@@ -2154,13 +2126,11 @@ int security_load_policy(struct selinux_state *state, void *data, size_t len)
                 goto out;
         }
 
-#if 0
-        sidtab_hash_eval(sidtab, "sids");
-#endif
-
         rc = policydb_read(newpolicydb, fp);
-        if (rc)
+        if (rc) {
+                kfree(newsidtab);
                 goto out;
+        }
 
         newpolicydb->len = len;
         /* If switching between different policy types, log MLS status */
@@ -2169,10 +2139,11 @@ int security_load_policy(struct selinux_state *state, void *data, size_t len)
         else if (!policydb->mls_enabled && newpolicydb->mls_enabled)
                 pr_info("SELinux: Enabling MLS support...\n");
 
-        rc = policydb_load_isids(newpolicydb, &newsidtab);
+        rc = policydb_load_isids(newpolicydb, newsidtab);
         if (rc) {
                 pr_err("SELinux:  unable to load the initial SIDs\n");
                 policydb_destroy(newpolicydb);
+                kfree(newsidtab);
                 goto out;
         }
 
@@ -2186,12 +2157,7 @@ int security_load_policy(struct selinux_state *state, void *data, size_t len)
                 goto err;
         }
 
-        /* Clone the SID table. */
-        sidtab_shutdown(sidtab);
-
-        rc = sidtab_map(sidtab, clone_sid, &newsidtab);
-        if (rc)
-                goto err;
+        oldsidtab = state->ss->sidtab;
 
         /*
          * Convert the internal representations of contexts
@@ -2200,7 +2166,12 @@ int security_load_policy(struct selinux_state *state, void *data, size_t len)
         args.state = state;
         args.oldp = policydb;
         args.newp = newpolicydb;
-        rc = sidtab_map(&newsidtab, convert_context, &args);
+
+        convert_params.func = convert_context;
+        convert_params.args = &args;
+        convert_params.target = newsidtab;
+
+        rc = sidtab_convert(oldsidtab, &convert_params);
         if (rc) {
                 pr_err("SELinux:  unable to convert the internal"
                         " representation of contexts in the new SID"
@@ -2210,12 +2181,11 @@ int security_load_policy(struct selinux_state *state, void *data, size_t len)
 
         /* Save the old policydb and SID table to free later. */
         memcpy(oldpolicydb, policydb, sizeof(*policydb));
-        sidtab_set(&oldsidtab, sidtab);
 
         /* Install the new policydb and SID table. */
         write_lock_irq(&state->ss->policy_rwlock);
         memcpy(policydb, newpolicydb, sizeof(*policydb));
-        sidtab_set(sidtab, &newsidtab);
+        state->ss->sidtab = newsidtab;
         security_load_policycaps(state);
         oldmapping = state->ss->map.mapping;
         state->ss->map.mapping = newmap.mapping;
@@ -2225,7 +2195,8 @@ int security_load_policy(struct selinux_state *state, void *data, size_t len)
 
         /* Free the old policydb and SID table. */
         policydb_destroy(oldpolicydb);
-        sidtab_destroy(&oldsidtab);
+        sidtab_destroy(oldsidtab);
+        kfree(oldsidtab);
         kfree(oldmapping);
 
         avc_ss_reset(state->avc, seqno);
@@ -2239,7 +2210,8 @@ int security_load_policy(struct selinux_state *state, void *data, size_t len)
 
 err:
         kfree(newmap.mapping);
-        sidtab_destroy(&newsidtab);
+        sidtab_destroy(newsidtab);
+        kfree(newsidtab);
         policydb_destroy(newpolicydb);
 
 out:
@@ -2276,7 +2248,7 @@ int security_port_sid(struct selinux_state *state,
         read_lock(&state->ss->policy_rwlock);
 
         policydb = &state->ss->policydb;
-        sidtab = &state->ss->sidtab;
+        sidtab = state->ss->sidtab;
 
         c = policydb->ocontexts[OCON_PORT];
         while (c) {
@@ -2322,7 +2294,7 @@ int security_ib_pkey_sid(struct selinux_state *state,
         read_lock(&state->ss->policy_rwlock);
 
         policydb = &state->ss->policydb;
-        sidtab = &state->ss->sidtab;
+        sidtab = state->ss->sidtab;
 
         c = policydb->ocontexts[OCON_IBPKEY];
         while (c) {
@@ -2368,7 +2340,7 @@ int security_ib_endport_sid(struct selinux_state *state,
         read_lock(&state->ss->policy_rwlock);
 
         policydb = &state->ss->policydb;
-        sidtab = &state->ss->sidtab;
+        sidtab = state->ss->sidtab;
 
         c = policydb->ocontexts[OCON_IBENDPORT];
         while (c) {
@@ -2414,7 +2386,7 @@ int security_netif_sid(struct selinux_state *state,
         read_lock(&state->ss->policy_rwlock);
 
         policydb = &state->ss->policydb;
-        sidtab = &state->ss->sidtab;
+        sidtab = state->ss->sidtab;
 
         c = policydb->ocontexts[OCON_NETIF];
         while (c) {
@@ -2479,7 +2451,7 @@ int security_node_sid(struct selinux_state *state,
         read_lock(&state->ss->policy_rwlock);
 
         policydb = &state->ss->policydb;
-        sidtab = &state->ss->sidtab;
+        sidtab = state->ss->sidtab;
 
         switch (domain) {
         case AF_INET: {
@@ -2579,7 +2551,7 @@ int security_get_user_sids(struct selinux_state *state,
         read_lock(&state->ss->policy_rwlock);
 
         policydb = &state->ss->policydb;
-        sidtab = &state->ss->sidtab;
+        sidtab = state->ss->sidtab;
 
         context_init(&usercon);
 
@@ -2681,7 +2653,7 @@ static inline int __security_genfs_sid(struct selinux_state *state,
                                        u32 *sid)
 {
         struct policydb *policydb = &state->ss->policydb;
-        struct sidtab *sidtab = &state->ss->sidtab;
+        struct sidtab *sidtab = state->ss->sidtab;
         int len;
         u16 sclass;
         struct genfs *genfs;
@@ -2767,7 +2739,7 @@ int security_fs_use(struct selinux_state *state, struct super_block *sb)
         read_lock(&state->ss->policy_rwlock);
 
         policydb = &state->ss->policydb;
-        sidtab = &state->ss->sidtab;
+        sidtab = state->ss->sidtab;
 
         c = policydb->ocontexts[OCON_FSUSE];
         while (c) {
@@ -2973,7 +2945,7 @@ int security_sid_mls_copy(struct selinux_state *state,
                           u32 sid, u32 mls_sid, u32 *new_sid)
 {
         struct policydb *policydb = &state->ss->policydb;
-        struct sidtab *sidtab = &state->ss->sidtab;
+        struct sidtab *sidtab = state->ss->sidtab;
         struct context *context1;
         struct context *context2;
         struct context newcon;
@@ -3064,7 +3036,7 @@ int security_net_peersid_resolve(struct selinux_state *state,
                                  u32 *peer_sid)
 {
         struct policydb *policydb = &state->ss->policydb;
-        struct sidtab *sidtab = &state->ss->sidtab;
+        struct sidtab *sidtab = state->ss->sidtab;
         int rc;
         struct context *nlbl_ctx;
         struct context *xfrm_ctx;
@@ -3425,7 +3397,7 @@ int selinux_audit_rule_match(u32 sid, u32 field, u32 op, void *vrule,
                 goto out;
         }
 
-        ctxt = sidtab_search(&state->ss->sidtab, sid);
+        ctxt = sidtab_search(state->ss->sidtab, sid);
         if (unlikely(!ctxt)) {
                 WARN_ONCE(1, "selinux_audit_rule_match: unrecognized SID %d\n",
                           sid);
@@ -3588,7 +3560,7 @@ int security_netlbl_secattr_to_sid(struct selinux_state *state,
                                    u32 *sid)
 {
         struct policydb *policydb = &state->ss->policydb;
-        struct sidtab *sidtab = &state->ss->sidtab;
+        struct sidtab *sidtab = state->ss->sidtab;
         int rc;
         struct context *ctx;
         struct context ctx_new;
@@ -3666,7 +3638,7 @@ int security_netlbl_sid_to_secattr(struct selinux_state *state,
         read_lock(&state->ss->policy_rwlock);
 
         rc = -ENOENT;
-        ctx = sidtab_search(&state->ss->sidtab, sid);
+        ctx = sidtab_search(state->ss->sidtab, sid);
         if (ctx == NULL)
                 goto out;