/* Save the old policydb and SID table to free later. */	memcpy(&oldpolicydb, &policydb, sizeof policydb);	sidtab_set(&oldsidtab, &sidtab);	/* Install the new policydb and SID table. */	POLICY_WRLOCK;	memcpy(&policydb, &newpolicydb, sizeof policydb);	sidtab_set(&sidtab, &newsidtab);	seqno = ++latest_granting;	policydb_loaded_version = policydb.policyvers;	POLICY_WRUNLOCK;	LOAD_UNLOCK;	/* Free the old policydb and SID table. */	policydb_destroy(&oldpolicydb);	sidtab_destroy(&oldsidtab);	avc_ss_reset(seqno);	selnl_notify_policyload(seqno);	return 0;err:	LOAD_UNLOCK;	sidtab_destroy(&newsidtab);	policydb_destroy(&newpolicydb);	return rc;}/** * security_port_sid - Obtain the SID for a port. * @domain: communication domain aka address family * @type: socket type * @protocol: protocol number * @port: port number * @out_sid: security identifier */int security_port_sid(u16 domain,		      u16 type,		      u8 protocol,		      u16 port,		      u32 *out_sid){	struct ocontext *c;	int rc = 0;	POLICY_RDLOCK;	c = policydb.ocontexts[OCON_PORT];	while (c) {		if (c->u.port.protocol == protocol &&		    c->u.port.low_port <= port &&		    c->u.port.high_port >= port)			break;		c = c->next;	}	if (c) {		if (!c->sid[0]) {			rc = sidtab_context_to_sid(&sidtab,						   &c->context[0],						   &c->sid[0]);			if (rc)				goto out;		}		*out_sid = c->sid[0];	} else {		*out_sid = SECINITSID_PORT;	}out:	POLICY_RDUNLOCK;	return rc;}/** * security_netif_sid - Obtain the SID for a network interface. * @name: interface name * @if_sid: interface SID * @msg_sid: default SID for received packets */int security_netif_sid(char *name,		       u32 *if_sid,		       u32 *msg_sid){	int rc = 0;	struct ocontext *c;	POLICY_RDLOCK;	c = policydb.ocontexts[OCON_NETIF];	while (c) {		if (strcmp(name, c->u.name) == 0)			break;		c = c->next;	}	if (c) {		if (!c->sid[0] || !c->sid[1]) {			rc = sidtab_context_to_sid(&sidtab,						  &c->context[0],						  &c->sid[0]);			if (rc)				goto out;			rc = sidtab_context_to_sid(&sidtab,						   &c->context[1],						   &c->sid[1]);			if (rc)				goto out;		}		*if_sid = c->sid[0];		*msg_sid = c->sid[1];	} else {		*if_sid = SECINITSID_NETIF;		*msg_sid = SECINITSID_NETMSG;	}out:	POLICY_RDUNLOCK;	return rc;}static int match_ipv6_addrmask(u32 *input, u32 *addr, u32 *mask){	int i, fail = 0;	for(i = 0; i < 4; i++)		if(addr[i] != (input[i] & mask[i])) {			fail = 1;			break;		}	return !fail;}/** * security_node_sid - Obtain the SID for a node (host). * @domain: communication domain aka address family * @addrp: address * @addrlen: address length in bytes * @out_sid: security identifier */int security_node_sid(u16 domain,		      void *addrp,		      u32 addrlen,		      u32 *out_sid){	int rc = 0;	struct ocontext *c;	POLICY_RDLOCK;	switch (domain) {	case AF_INET: {		u32 addr;		if (addrlen != sizeof(u32)) {			rc = -EINVAL;			goto out;		}		addr = *((u32 *)addrp);		c = policydb.ocontexts[OCON_NODE];		while (c) {			if (c->u.node.addr == (addr & c->u.node.mask))				break;			c = c->next;		}		break;	}	case AF_INET6:		if (addrlen != sizeof(u64) * 2) {			rc = -EINVAL;			goto out;		}		c = policydb.ocontexts[OCON_NODE6];		while (c) {			if (match_ipv6_addrmask(addrp, c->u.node6.addr,						c->u.node6.mask))				break;			c = c->next;		}		break;	default:		*out_sid = SECINITSID_NODE;		goto out;	}	if (c) {		if (!c->sid[0]) {			rc = sidtab_context_to_sid(&sidtab,						   &c->context[0],						   &c->sid[0]);			if (rc)				goto out;		}		*out_sid = c->sid[0];	} else {		*out_sid = SECINITSID_NODE;	}out:	POLICY_RDUNLOCK;	return rc;}#define SIDS_NEL 25/** * security_get_user_sids - Obtain reachable SIDs for a user. * @fromsid: starting SID * @username: username * @sids: array of reachable SIDs for user * @nel: number of elements in @sids * * Generate the set of SIDs for legal security contexts * for a given user that can be reached by @fromsid. * Set *@sids to point to a dynamically allocated * array containing the set of SIDs.  Set *@nel to the * number of elements in the array. */int security_get_user_sids(u32 fromsid,	                   char *username,			   u32 **sids,			   u32 *nel){	struct context *fromcon, usercon;	u32 *mysids, *mysids2, sid;	u32 mynel = 0, maxnel = SIDS_NEL;	struct user_datum *user;	struct role_datum *role;	struct av_decision avd;	int rc = 0, i, j;	if (!ss_initialized) {		*sids = NULL;		*nel = 0;		goto out;	}	POLICY_RDLOCK;	fromcon = sidtab_search(&sidtab, fromsid);	if (!fromcon) {		rc = -EINVAL;		goto out_unlock;	}	user = hashtab_search(policydb.p_users.table, username);	if (!user) {		rc = -EINVAL;		goto out_unlock;	}	usercon.user = user->value;	mysids = kmalloc(maxnel*sizeof(*mysids), GFP_ATOMIC);	if (!mysids) {		rc = -ENOMEM;		goto out_unlock;	}	memset(mysids, 0, maxnel*sizeof(*mysids));	for (i = ebitmap_startbit(&user->roles); i < ebitmap_length(&user->roles); i++) {		if (!ebitmap_get_bit(&user->roles, i))			continue;		role = policydb.role_val_to_struct[i];		usercon.role = i+1;		for (j = ebitmap_startbit(&role->types); j < ebitmap_length(&role->types); j++) {			if (!ebitmap_get_bit(&role->types, j))				continue;			usercon.type = j+1;			mls_for_user_ranges(user,usercon) {				rc = context_struct_compute_av(fromcon, &usercon,							       SECCLASS_PROCESS,							       PROCESS__TRANSITION,							       &avd);				if (rc ||  !(avd.allowed & PROCESS__TRANSITION))					continue;				rc = sidtab_context_to_sid(&sidtab, &usercon, &sid);				if (rc) {					kfree(mysids);					goto out_unlock;				}				if (mynel < maxnel) {					mysids[mynel++] = sid;				} else {					maxnel += SIDS_NEL;					mysids2 = kmalloc(maxnel*sizeof(*mysids2), GFP_ATOMIC);					if (!mysids2) {						rc = -ENOMEM;						kfree(mysids);						goto out_unlock;					}					memset(mysids2, 0, maxnel*sizeof(*mysids2));					memcpy(mysids2, mysids, mynel * sizeof(*mysids2));					kfree(mysids);					mysids = mysids2;					mysids[mynel++] = sid;				}			}			mls_end_user_ranges;		}	}	*sids = mysids;	*nel = mynel;out_unlock:	POLICY_RDUNLOCK;out:	return rc;}/** * security_genfs_sid - Obtain a SID for a file in a filesystem * @fstype: filesystem type * @path: path from root of mount * @sclass: file security class * @sid: SID for path * * Obtain a SID to use for a file in a filesystem that * cannot support xattr or use a fixed labeling behavior like * transition SIDs or task SIDs. */int security_genfs_sid(const char *fstype,	               char *path,		       u16 sclass,		       u32 *sid){	int len;	struct genfs *genfs;	struct ocontext *c;	int rc = 0, cmp = 0;	POLICY_RDLOCK;	for (genfs = policydb.genfs; genfs; genfs = genfs->next) {		cmp = strcmp(fstype, genfs->fstype);		if (cmp <= 0)			break;	}	if (!genfs || cmp) {		*sid = SECINITSID_UNLABELED;		rc = -ENOENT;		goto out;	}	for (c = genfs->head; c; c = c->next) {		len = strlen(c->u.name);		if ((!c->v.sclass || sclass == c->v.sclass) &&		    (strncmp(c->u.name, path, len) == 0))			break;	}	if (!c) {		*sid = SECINITSID_UNLABELED;		rc = -ENOENT;		goto out;	}	if (!c->sid[0]) {		rc = sidtab_context_to_sid(&sidtab,					   &c->context[0],					   &c->sid[0]);		if (rc)			goto out;	}	*sid = c->sid[0];out:	POLICY_RDUNLOCK;	return rc;}/** * security_fs_use - Determine how to handle labeling for a filesystem. * @fstype: filesystem type * @behavior: labeling behavior * @sid: SID for filesystem (superblock) */int security_fs_use(	const char *fstype,	unsigned int *behavior,	u32 *sid){	int rc = 0;	struct ocontext *c;	POLICY_RDLOCK;	c = policydb.ocontexts[OCON_FSUSE];	while (c) {		if (strcmp(fstype, c->u.name) == 0)			break;		c = c->next;	}	if (c) {		*behavior = c->v.behavior;		if (!c->sid[0]) {			rc = sidtab_context_to_sid(&sidtab,						   &c->context[0],						   &c->sid[0]);			if (rc)				goto out;		}		*sid = c->sid[0];	} else {		rc = security_genfs_sid(fstype, "/", SECCLASS_DIR, sid);		if (rc) {			*behavior = SECURITY_FS_USE_NONE;			rc = 0;		} else {			*behavior = SECURITY_FS_USE_GENFS;		}	}out:	POLICY_RDUNLOCK;	return rc;}int security_get_bools(int *len, char ***names, int **values){	int i, rc = -ENOMEM;	POLICY_RDLOCK;	*names = NULL;	*values = NULL;	*len = policydb.p_bools.nprim;	if (!*len) {		rc = 0;		goto out;	}	*names = (char**)kmalloc(sizeof(char*) * *len, GFP_ATOMIC);	if (!*names)		goto err;	memset(*names, 0, sizeof(char*) * *len);	*values = (int*)kmalloc(sizeof(int) * *len, GFP_ATOMIC);	if (!*values)		goto err;	for (i = 0; i < *len; i++) {		size_t name_len;		(*values)[i] = policydb.bool_val_to_struct[i]->state;		name_len = strlen(policydb.p_bool_val_to_name[i]) + 1;		(*names)[i] = (char*)kmalloc(sizeof(char) * name_len, GFP_ATOMIC);		if (!(*names)[i])			goto err;		strncpy((*names)[i], policydb.p_bool_val_to_name[i], name_len);		(*names)[i][name_len - 1] = 0;	}	rc = 0;out:	POLICY_RDUNLOCK;	return rc;err:	if (*names) {		for (i = 0; i < *len; i++)			if ((*names)[i])				kfree((*names)[i]);	}	if (*values)		kfree(*values);	goto out;}int security_set_bools(int len, int *values){	int i, rc = 0;	int lenp, seqno = 0;	struct cond_node *cur;	POLICY_WRLOCK;	lenp = policydb.p_bools.nprim;	if (len != lenp) {		rc = -EFAULT;		goto out;	}	printk(KERN_INFO "security: committed booleans { ");	for (i = 0; i < len; i++) {		if (values[i]) {			policydb.bool_val_to_struct[i]->state = 1;		} else {			policydb.bool_val_to_struct[i]->state = 0;		}		if (i != 0)			printk(", ");		printk("%s:%d", policydb.p_bool_val_to_name[i],		       policydb.bool_val_to_struct[i]->state);	}	printk(" }\n");	for (cur = policydb.cond_list; cur != NULL; cur = cur->next) {		rc = evaluate_cond_node(&policydb, cur);		if (rc)			goto out;	}	seqno = ++latest_granting;out:	POLICY_WRUNLOCK;	if (!rc) {		avc_ss_reset(seqno);		selnl_notify_policyload(seqno);	}	return rc;}int security_get_bool_value(int bool){	int rc = 0;	int len;	POLICY_RDLOCK;	len = policydb.p_bools.nprim;	if (bool >= len) {		rc = -EFAULT;		goto out;	}	rc = policydb.bool_val_to_struct[bool]->state;out:	POLICY_RDUNLOCK;	return rc;}