6 files changed, 109 insertions, 8 deletions

diff --git a/security/selinux/include/security.h b/security/selinux/include/security.h
index d871e8ad2103..ba53400195c0 100644
--- a/security/selinux/include/security.h
+++ b/security/selinux/include/security.h
@@ -31,13 +31,14 @@
 #define POLICYDB_VERSION_BOUNDARY       24
 #define POLICYDB_VERSION_FILENAME_TRANS 25
 #define POLICYDB_VERSION_ROLETRANS      26
+#define POLICYDB_VERSION_NEW_OBJECT_DEFAULTS    27
 
 /* Range of policy versions we understand*/
 #define POLICYDB_VERSION_MIN   POLICYDB_VERSION_BASE
 #ifdef CONFIG_SECURITY_SELINUX_POLICYDB_VERSION_MAX
 #define POLICYDB_VERSION_MAX    CONFIG_SECURITY_SELINUX_POLICYDB_VERSION_MAX_VALUE
 #else
-#define POLICYDB_VERSION_MAX    POLICYDB_VERSION_ROLETRANS
+#define POLICYDB_VERSION_MAX    POLICYDB_VERSION_NEW_OBJECT_DEFAULTS
 #endif
 
 /* Mask for just the mount related flags */
diff --git a/security/selinux/ss/context.h b/security/selinux/ss/context.h
index 45e8fb0515f8..212e3479a0d9 100644
--- a/security/selinux/ss/context.h
+++ b/security/selinux/ss/context.h
@@ -74,6 +74,26 @@ out:
         return rc;
 }
 
+/*
+ * Sets both levels in the MLS range of 'dst' to the high level of 'src'.
+ */
+static inline int mls_context_cpy_high(struct context *dst, struct context *src)
+{
+        int rc;
+
+        dst->range.level[0].sens = src->range.level[1].sens;
+        rc = ebitmap_cpy(&dst->range.level[0].cat, &src->range.level[1].cat);
+        if (rc)
+                goto out;
+
+        dst->range.level[1].sens = src->range.level[1].sens;
+        rc = ebitmap_cpy(&dst->range.level[1].cat, &src->range.level[1].cat);
+        if (rc)
+                ebitmap_destroy(&dst->range.level[0].cat);
+out:
+        return rc;
+}
+
 static inline int mls_context_cmp(struct context *c1, struct context *c2)
 {
         return ((c1->range.level[0].sens == c2->range.level[0].sens) &&
diff --git a/security/selinux/ss/mls.c b/security/selinux/ss/mls.c
index fbf9c5816c71..40de8d3f208e 100644
--- a/security/selinux/ss/mls.c
+++ b/security/selinux/ss/mls.c
@@ -517,6 +517,8 @@ int mls_compute_sid(struct context *scontext,
 {
         struct range_trans rtr;
         struct mls_range *r;
+        struct class_datum *cladatum;
+        int default_range = 0;
 
         if (!policydb.mls_enabled)
                 return 0;
@@ -530,6 +532,28 @@ int mls_compute_sid(struct context *scontext,
                 r = hashtab_search(policydb.range_tr, &rtr);
                 if (r)
                         return mls_range_set(newcontext, r);
+
+                if (tclass && tclass <= policydb.p_classes.nprim) {
+                        cladatum = policydb.class_val_to_struct[tclass - 1];
+                        if (cladatum)
+                                default_range = cladatum->default_range;
+                }
+
+                switch (default_range) {
+                case DEFAULT_SOURCE_LOW:
+                        return mls_context_cpy_low(newcontext, scontext);
+                case DEFAULT_SOURCE_HIGH:
+                        return mls_context_cpy_high(newcontext, scontext);
+                case DEFAULT_SOURCE_LOW_HIGH:
+                        return mls_context_cpy(newcontext, scontext);
+                case DEFAULT_TARGET_LOW:
+                        return mls_context_cpy_low(newcontext, tcontext);
+                case DEFAULT_TARGET_HIGH:
+                        return mls_context_cpy_high(newcontext, tcontext);
+                case DEFAULT_TARGET_LOW_HIGH:
+                        return mls_context_cpy(newcontext, tcontext);
+                }
+
                 /* Fallthrough */
         case AVTAB_CHANGE:
                 if ((tclass == policydb.process_class) || (sock == true))
diff --git a/security/selinux/ss/policydb.c b/security/selinux/ss/policydb.c
index a7f61d52f05c..2bb9c2fd5f1a 100644
--- a/security/selinux/ss/policydb.c
+++ b/security/selinux/ss/policydb.c
@@ -133,6 +133,11 @@ static struct policydb_compat_info policydb_compat[] = {
                 .sym_num        = SYM_NUM,
                 .ocon_num       = OCON_NUM,
         },
+        {
+                .version        = POLICYDB_VERSION_NEW_OBJECT_DEFAULTS,
+                .sym_num        = SYM_NUM,
+                .ocon_num       = OCON_NUM,
+        },
 };
 
 static struct policydb_compat_info *policydb_lookup_compat(int version)
@@ -1306,6 +1311,16 @@ static int class_read(struct policydb *p, struct hashtab *h, void *fp)
                         goto bad;
         }
 
+        if (p->policyvers >= POLICYDB_VERSION_NEW_OBJECT_DEFAULTS) {
+                rc = next_entry(buf, fp, sizeof(u32) * 3);
+                if (rc)
+                        goto bad;
+
+                cladatum->default_user = le32_to_cpu(buf[0]);
+                cladatum->default_role = le32_to_cpu(buf[1]);
+                cladatum->default_range = le32_to_cpu(buf[2]);
+        }
+
         rc = hashtab_insert(h, key, cladatum);
         if (rc)
                 goto bad;
@@ -2832,6 +2847,16 @@ static int class_write(void *vkey, void *datum, void *ptr)
         if (rc)
                 return rc;
 
+        if (p->policyvers >= POLICYDB_VERSION_NEW_OBJECT_DEFAULTS) {
+                buf[0] = cpu_to_le32(cladatum->default_user);
+                buf[1] = cpu_to_le32(cladatum->default_role);
+                buf[2] = cpu_to_le32(cladatum->default_range);
+
+                rc = put_entry(buf, sizeof(uint32_t), 3, fp);
+                if (rc)
+                        return rc;
+        }
+
         return 0;
 }
 
diff --git a/security/selinux/ss/policydb.h b/security/selinux/ss/policydb.h
index b846c0387180..a949f1ad43bb 100644
--- a/security/selinux/ss/policydb.h
+++ b/security/selinux/ss/policydb.h
@@ -60,6 +60,19 @@ struct class_datum {
         struct symtab permissions;      /* class-specific permission symbol table */
         struct constraint_node *constraints;    /* constraints on class permissions */
         struct constraint_node *validatetrans;  /* special transition rules */
+        /* Options how a new object user and role should be decided */
+#define DEFAULT_SOURCE         1
+#define DEFAULT_TARGET         2
+        char default_user;
+        char default_role;
+/* Options how a new object range should be decided */
+#define DEFAULT_SOURCE_LOW     1
+#define DEFAULT_SOURCE_HIGH    2
+#define DEFAULT_SOURCE_LOW_HIGH        3
+#define DEFAULT_TARGET_LOW     4
+#define DEFAULT_TARGET_HIGH    5
+#define DEFAULT_TARGET_LOW_HIGH        6
+        char default_range;
 };
 
 /* Role attributes */
diff --git a/security/selinux/ss/services.c b/security/selinux/ss/services.c
index 185f849a26f6..2ea108c2c048 100644
--- a/security/selinux/ss/services.c
+++ b/security/selinux/ss/services.c
@@ -1389,6 +1389,7 @@ static int security_compute_sid(u32 ssid,
                                 u32 *out_sid,
                                 bool kern)
 {
+        struct class_datum *cladatum = NULL;
         struct context *scontext = NULL, *tcontext = NULL, newcontext;
         struct role_trans *roletr = NULL;
         struct avtab_key avkey;
@@ -1437,12 +1438,20 @@ static int security_compute_sid(u32 ssid,
                 goto out_unlock;
         }
 
+        if (tclass && tclass <= policydb.p_classes.nprim)
+                cladatum = policydb.class_val_to_struct[tclass - 1];
+
         /* Set the user identity. */
         switch (specified) {
         case AVTAB_TRANSITION:
         case AVTAB_CHANGE:
-                /* Use the process user identity. */
-                newcontext.user = scontext->user;
+                if (cladatum && cladatum->default_user == DEFAULT_TARGET) {
+                        newcontext.user = tcontext->user;
+                } else {
+                        /* notice this gets both DEFAULT_SOURCE and unset */
+                        /* Use the process user identity. */
+                        newcontext.user = scontext->user;
+                }
                 break;
         case AVTAB_MEMBER:
                 /* Use the related object owner. */
@@ -1450,14 +1459,23 @@ static int security_compute_sid(u32 ssid,
                 break;
         }
 
-        /* Set the role and type to default values. */
-        if ((tclass == policydb.process_class) || (sock == true)) {
-                /* Use the current role and type of process. */
+        /* Set the role to default values. */
+        if (cladatum && cladatum->default_role == DEFAULT_SOURCE) {
                 newcontext.role = scontext->role;
+        } else if (cladatum && cladatum->default_role == DEFAULT_TARGET) {
+                newcontext.role = tcontext->role;
+        } else {
+                if ((tclass == policydb.process_class) || (sock == true))
+                        newcontext.role = scontext->role;
+                else
+                        newcontext.role = OBJECT_R_VAL;
+        }
+
+        /* Set the type to default values. */
+        if ((tclass == policydb.process_class) || (sock == true)) {
+                /* Use the type of process. */
                 newcontext.type = scontext->type;
         } else {
-                /* Use the well-defined object role. */
-                newcontext.role = OBJECT_R_VAL;
                 /* Use the type of the related object. */
                 newcontext.type = tcontext->type;
         }