selinux: change the handling of unknown classes

If allow_unknown==deny, SELinux treats an undefined kernel security
class as an error condition rather than as a typical permission denial
and thus does not allow permissions on undefined classes even when in
permissive mode.  Change the SELinux logic so that this case is handled
as a typical permission denial, subject to the usual permissive mode and
permissive domain handling.

Also drop the 'requested' argument from security_compute_av() and
helpers as it is a legacy of the original security server interface and
is unused.

Changes:
- Handle permissive domains consistently by moving up the test for a
permissive domain.
- Make security_compute_av_user() consistent with security_compute_av();
the only difference now is that security_compute_av() performs mapping
between the kernel-private class and permission indices and the policy
values.  In the userspace case, this mapping is handled by libselinux.
- Moved avd_init inside the policy lock.

Based in part on a patch by Paul Moore <paul.moore@hp.com>.

Reported-by: Andrew Worsley <amworsley@gmail.com>
Signed-off-by:  Stephen D. Smalley <sds@tycho.nsa.gov>
Reviewed-by: Paul Moore <paul.moore@hp.com>
Signed-off-by: James Morris <jmorris@namei.org>

4 files changed, 88 insertions, 120 deletions

diff --git a/security/selinux/avc.c b/security/selinux/avc.c
index f2dde268165a..3ee9b6a8beb6 100644
--- a/security/selinux/avc.c
+++ b/security/selinux/avc.c
@@ -746,9 +746,7 @@ int avc_has_perm_noaudit(u32 ssid, u32 tsid,
                 else
                         avd = &avd_entry;
 
-                rc = security_compute_av(ssid, tsid, tclass, requested, avd);
-                if (rc)
-                        goto out;
+                security_compute_av(ssid, tsid, tclass, avd);
                 rcu_read_lock();
                 node = avc_insert(ssid, tsid, tclass, avd);
         } else {
@@ -770,7 +768,6 @@ int avc_has_perm_noaudit(u32 ssid, u32 tsid,
         }
 
         rcu_read_unlock();
-out:
         return rc;
 }
 
diff --git a/security/selinux/include/security.h b/security/selinux/include/security.h
index 2553266ad793..022cf067aa3f 100644
--- a/security/selinux/include/security.h
+++ b/security/selinux/include/security.h
@@ -96,13 +96,11 @@ struct av_decision {
 /* definitions of av_decision.flags */
 #define AVD_FLAGS_PERMISSIVE    0x0001
 
-int security_compute_av(u32 ssid, u32 tsid,
-                        u16 tclass, u32 requested,
-                        struct av_decision *avd);
+void security_compute_av(u32 ssid, u32 tsid,
+                         u16 tclass, struct av_decision *avd);
 
-int security_compute_av_user(u32 ssid, u32 tsid,
-                             u16 tclass, u32 requested,
-                             struct av_decision *avd);
+void security_compute_av_user(u32 ssid, u32 tsid,
+                             u16 tclass, struct av_decision *avd);
 
 int security_transition_sid(u32 ssid, u32 tsid,
                             u16 tclass, u32 *out_sid);
diff --git a/security/selinux/selinuxfs.c b/security/selinux/selinuxfs.c
index fab36fdf2769..b7bb0f5ec07c 100644
--- a/security/selinux/selinuxfs.c
+++ b/security/selinux/selinuxfs.c
@@ -494,7 +494,6 @@ static ssize_t sel_write_access(struct file *file, char *buf, size_t size)
         char *scon, *tcon;
         u32 ssid, tsid;
         u16 tclass;
-        u32 req;
         struct av_decision avd;
         ssize_t length;
 
@@ -512,7 +511,7 @@ static ssize_t sel_write_access(struct file *file, char *buf, size_t size)
                 goto out;
 
         length = -EINVAL;
-        if (sscanf(buf, "%s %s %hu %x", scon, tcon, &tclass, &req) != 4)
+        if (sscanf(buf, "%s %s %hu", scon, tcon, &tclass) != 3)
                 goto out2;
 
         length = security_context_to_sid(scon, strlen(scon)+1, &ssid);
@@ -522,9 +521,7 @@ static ssize_t sel_write_access(struct file *file, char *buf, size_t size)
         if (length < 0)
                 goto out2;
 
-        length = security_compute_av_user(ssid, tsid, tclass, req, &avd);
-        if (length < 0)
-                goto out2;
+        security_compute_av_user(ssid, tsid, tclass, &avd);
 
         length = scnprintf(buf, SIMPLE_TRANSACTION_LIMIT,
                           "%x %x %x %x %u %x",
diff --git a/security/selinux/ss/services.c b/security/selinux/ss/services.c
index 07ddc81d7b57..9ec24169ccd7 100644
--- a/security/selinux/ss/services.c
+++ b/security/selinux/ss/services.c
@@ -87,11 +87,10 @@ static u32 latest_granting;
 static int context_struct_to_string(struct context *context, char **scontext,
                                     u32 *scontext_len);
 
-static int context_struct_compute_av(struct context *scontext,
-                                     struct context *tcontext,
-                                     u16 tclass,
-                                     u32 requested,
-                                     struct av_decision *avd);
+static void context_struct_compute_av(struct context *scontext,
+                                      struct context *tcontext,
+                                      u16 tclass,
+                                      struct av_decision *avd);
 
 struct selinux_mapping {
         u16 value; /* policy value */
@@ -196,23 +195,6 @@ static u16 unmap_class(u16 tclass)
         return tclass;
 }
 
-static u32 unmap_perm(u16 tclass, u32 tperm)
-{
-        if (tclass < current_mapping_size) {
-                unsigned i;
-                u32 kperm = 0;
-
-                for (i = 0; i < current_mapping[tclass].num_perms; i++)
-                        if (tperm & (1<<i)) {
-                                kperm |= current_mapping[tclass].perms[i];
-                                tperm &= ~(1<<i);
-                        }
-                return kperm;
-        }
-
-        return tperm;
-}
-
 static void map_decision(u16 tclass, struct av_decision *avd,
                          int allow_unknown)
 {
@@ -532,7 +514,6 @@ out:
 static void type_attribute_bounds_av(struct context *scontext,
                                      struct context *tcontext,
                                      u16 tclass,
-                                     u32 requested,
                                      struct av_decision *avd)
 {
         struct context lo_scontext;
@@ -553,7 +534,6 @@ static void type_attribute_bounds_av(struct context *scontext,
                 context_struct_compute_av(&lo_scontext,
                                           tcontext,
                                           tclass,
-                                          requested,
                                           &lo_avd);
                 if ((lo_avd.allowed & avd->allowed) == avd->allowed)
                         return;         /* no masked permission */
@@ -569,7 +549,6 @@ static void type_attribute_bounds_av(struct context *scontext,
                 context_struct_compute_av(scontext,
                                           &lo_tcontext,
                                           tclass,
-                                          requested,
                                           &lo_avd);
                 if ((lo_avd.allowed & avd->allowed) == avd->allowed)
                         return;         /* no masked permission */
@@ -586,7 +565,6 @@ static void type_attribute_bounds_av(struct context *scontext,
                 context_struct_compute_av(&lo_scontext,
                                           &lo_tcontext,
                                           tclass,
-                                          requested,
                                           &lo_avd);
                 if ((lo_avd.allowed & avd->allowed) == avd->allowed)
                         return;         /* no masked permission */
@@ -607,11 +585,10 @@ static void type_attribute_bounds_av(struct context *scontext,
  * Compute access vectors based on a context structure pair for
  * the permissions in a particular class.
  */