context_struct_to_string(context, &s, &len);        printk(KERN_ERR "security:  context %s is invalid\n", s);        xfree(s);    }    return rc;}struct convert_context_args {    struct policydb *oldp;    struct policydb *newp;};/* * Convert the values in the security context * structure `c' from the values specified * in the policy `p->oldp' to the values specified * in the policy `p->newp'.  Verify that the * context is valid under the new policy. */static int convert_context(u32 key, struct context *c, void *p){    struct convert_context_args *args;    struct context oldc;    struct role_datum *role;    struct type_datum *typdatum;    struct user_datum *usrdatum;    char *s;    u32 len;    int rc;    args = p;    rc = context_cpy(&oldc, c);    if ( rc )        goto out;    rc = -EINVAL;    /* Convert the user. */    usrdatum = hashtab_search(args->newp->p_users.table,                              args->oldp->p_user_val_to_name[c->user - 1]);    if ( !usrdatum )        goto bad;    c->user = usrdatum->value;    /* Convert the role. */    role = hashtab_search(args->newp->p_roles.table,                          args->oldp->p_role_val_to_name[c->role - 1]);    if ( !role )        goto bad;    c->role = role->value;    /* Convert the type. */    typdatum = hashtab_search(args->newp->p_types.table,                              args->oldp->p_type_val_to_name[c->type - 1]);    if ( !typdatum )        goto bad;    c->type = typdatum->value;    rc = mls_convert_context(args->oldp, args->newp, c);    if ( rc )        goto bad;    /* Check the validity of the new context. */    if ( !policydb_context_isvalid(args->newp, c) )    {        rc = convert_context_handle_invalid_context(&oldc);        if ( rc )            goto bad;    }    context_destroy(&oldc);out:    return rc;bad:    context_struct_to_string(&oldc, &s, &len);    context_destroy(&oldc);    printk(KERN_ERR "security:  invalidating context %s\n", s);    xfree(s);    goto out;}extern void flask_complete_init(void);/** * security_load_policy - Load a security policy configuration. * @data: binary policy data * @len: length of data in bytes * * Load a new set of security policy configuration data, * validate it and convert the SID table as necessary. * This function will flush the access vector cache after * loading the new policy. */int security_load_policy(void *data, size_t len){    struct policydb oldpolicydb, newpolicydb;    struct sidtab oldsidtab, newsidtab;    struct convert_context_args args;    u32 seqno;    int rc = 0;    struct policy_file file = { data, len }, *fp = &file;    LOAD_LOCK;    if ( !ss_initialized )    {        if ( policydb_read(&policydb, fp) )        {            LOAD_UNLOCK;            return -EINVAL;        }        if ( policydb_load_isids(&policydb, &sidtab) )        {            LOAD_UNLOCK;            policydb_destroy(&policydb);            return -EINVAL;        }        policydb_loaded_version = policydb.policyvers;        ss_initialized = 1;        seqno = ++latest_granting;        LOAD_UNLOCK;        avc_ss_reset(seqno);        return 0;    }#if 0    sidtab_hash_eval(&sidtab, "sids");#endif    if ( policydb_read(&newpolicydb, fp) )    {        LOAD_UNLOCK;        return -EINVAL;    }    sidtab_init(&newsidtab);    /* Verify that the existing classes did not change. */    if ( hashtab_map(policydb.p_classes.table, validate_class, &newpolicydb) )    {        printk(KERN_ERR "security:  the definition of an existing "                                                            "class changed\n");        rc = -EINVAL;        goto err;    }    /* Clone the SID table. */    sidtab_shutdown(&sidtab);    if ( sidtab_map(&sidtab, clone_sid, &newsidtab) )    {        rc = -ENOMEM;        goto err;    }    /* Convert the internal representations of contexts       in the new SID table and remove invalid SIDs. */    args.oldp = &policydb;    args.newp = &newpolicydb;    sidtab_map_remove_on_error(&newsidtab, convert_context, &args);    /* Save the old policydb and SID table to free later. */    memcpy(&oldpolicydb, &policydb, sizeof policydb);    sidtab_set(&oldsidtab, &sidtab);    /* Install the new policydb and SID table. */    POLICY_WRLOCK;    memcpy(&policydb, &newpolicydb, sizeof policydb);    sidtab_set(&sidtab, &newsidtab);    seqno = ++latest_granting;    policydb_loaded_version = policydb.policyvers;    POLICY_WRUNLOCK;    LOAD_UNLOCK;    /* Free the old policydb and SID table. */    policydb_destroy(&oldpolicydb);    sidtab_destroy(&oldsidtab);    avc_ss_reset(seqno);    return 0;err:    LOAD_UNLOCK;    sidtab_destroy(&newsidtab);    policydb_destroy(&newpolicydb);    return rc;}/** * security_pirq_sid - Obtain the SID for a physical irq. * @pirq: physical irq * @out_sid: security identifier */int security_pirq_sid(int pirq, u32 *out_sid){    int rc = 0;    struct ocontext *c;    POLICY_RDLOCK;    c = policydb.ocontexts[OCON_PIRQ];        while ( c )    {        if ( c->u.pirq == pirq )            break;        c = c->next;    }    if ( c )    {        if ( !c->sid[0] )        {            rc = sidtab_context_to_sid(&sidtab, &c->context[0], &c->sid[0]);            if ( rc )                goto out;        }        *out_sid = c->sid[0];    }    else    {        *out_sid = SECINITSID_PIRQ;    }out:    POLICY_RDUNLOCK;    return rc;}/** * security_iomem_sid - Obtain the SID for a page of iomem. * @mfn: iomem mfn * @out_sid: security identifier */int security_iomem_sid(unsigned long mfn, u32 *out_sid){    struct ocontext *c;    int rc = 0;    POLICY_RDLOCK;    c = policydb.ocontexts[OCON_IOMEM];    while ( c )    {        if ( c->u.iomem == mfn )            break;        c = c->next;    }    if ( c )    {        if ( !c->sid[0] )        {            rc = sidtab_context_to_sid(&sidtab, &c->context[0], &c->sid[0]);            if ( rc )                goto out;        }        *out_sid = c->sid[0];    }    else    {        *out_sid = SECINITSID_IOMEM;    }out:    POLICY_RDUNLOCK;    return rc;}/** * security_ioport_sid - Obtain the SID for an ioport. * @ioport: ioport * @out_sid: security identifier */int security_ioport_sid(u32 ioport, u32 *out_sid){    struct ocontext *c;    int rc = 0;    POLICY_RDLOCK;    c = policydb.ocontexts[OCON_IOPORT];    while ( c )    {        if ( c->u.ioport == ioport )            break;        c = c->next;    }    if ( c )    {        if ( !c->sid[0] )        {            rc = sidtab_context_to_sid(&sidtab, &c->context[0], &c->sid[0]);            if ( rc )                goto out;        }        *out_sid = c->sid[0];    }    else    {        *out_sid = SECINITSID_IOPORT;    }out:    POLICY_RDUNLOCK;    return rc;}#define SIDS_NEL 25/** * security_get_user_sids - Obtain reachable SIDs for a user. * @fromsid: starting SID * @username: username * @sids: array of reachable SIDs for user * @nel: number of elements in @sids * * Generate the set of SIDs for legal security contexts * for a given user that can be reached by @fromsid. * Set *@sids to point to a dynamically allocated * array containing the set of SIDs.  Set *@nel to the * number of elements in the array. */int security_get_user_sids(u32 fromsid, char *username, u32 **sids, u32 *nel){    struct context *fromcon, usercon;    u32 *mysids, *mysids2, sid;    u32 mynel = 0, maxnel = SIDS_NEL;    struct user_datum *user;    struct role_datum *role;    struct av_decision avd;    struct ebitmap_node *rnode, *tnode;    int rc = 0, i, j;    if ( !ss_initialized )    {        *sids = NULL;        *nel = 0;        goto out;    }    POLICY_RDLOCK;    fromcon = sidtab_search(&sidtab, fromsid);    if ( !fromcon )    {        rc = -EINVAL;        goto out_unlock;    }    user = hashtab_search(policydb.p_users.table, username);    if ( !user )    {        rc = -EINVAL;        goto out_unlock;    }    usercon.user = user->value;    mysids = xmalloc_array(u32, maxnel);    if ( !mysids )    {        rc = -ENOMEM;        goto out_unlock;    }    memset(mysids, 0, maxnel*sizeof(*mysids));    ebitmap_for_each_bit(&user->roles, rnode, i)    {        if ( !ebitmap_node_get_bit(rnode, i) )            continue;        role = policydb.role_val_to_struct[i];        usercon.role = i+1;        ebitmap_for_each_bit(&role->types, tnode, j) {            if ( !ebitmap_node_get_bit(tnode, j) )                continue;            usercon.type = j+1;            if ( mls_setup_user_range(fromcon, user, &usercon) )                continue;            rc = context_struct_compute_av(fromcon, &usercon,                               SECCLASS_DOMAIN,                               DOMAIN__TRANSITION,                               &avd);            if ( rc ||  !(avd.allowed & DOMAIN__TRANSITION) )                continue;            rc = sidtab_context_to_sid(&sidtab, &usercon, &sid);            if ( rc )            {                xfree(mysids);                goto out_unlock;            }            if ( mynel < maxnel )            {                mysids[mynel++] = sid;            }            else            {                maxnel += SIDS_NEL;                mysids2 = xmalloc_array(u32, maxnel);                if ( !mysids2 )                {                    rc = -ENOMEM;                    xfree(mysids);                    goto out_unlock;                }                memset(mysids2, 0, maxnel*sizeof(*mysids2));                memcpy(mysids2, mysids, mynel * sizeof(*mysids2));                xfree(mysids);                mysids = mysids2;                mysids[mynel++] = sid;            }        }    }    *sids = mysids;    *nel = mynel;out_unlock:    POLICY_RDUNLOCK;out:    return rc;}int security_get_bools(int *len, char ***names, int **values){    int i, rc = -ENOMEM;    POLICY_RDLOCK;    *names = NULL;    *values = NULL;    *len = policydb.p_bools.nprim;    if ( !*len )    {        rc = 0;        goto out;    }    *names = (char**)xmalloc_array(char*, *len);    if ( !*names )        goto err;    memset(*names, 0, sizeof(char*) * *len);    *values = (int*)xmalloc_array(int, *len);    if ( !*values )        goto err;    for ( i = 0; i < *len; i++ )    {        size_t name_len;        (*values)[i] = policydb.bool_val_to_struct[i]->state;        name_len = strlen(policydb.p_bool_val_to_name[i]) + 1;        (*names)[i] = (char*)xmalloc_array(char, name_len);        if ( !(*names)[i] )            goto err;        strlcpy((*names)[i], policydb.p_bool_val_to_name[i], name_len);        (*names)[i][name_len - 1] = 0;    }    rc = 0;out:    POLICY_RDUNLOCK;    return rc;err:    if ( *names )    {        for ( i = 0; i < *len; i++ )            xfree((*names)[i]);    }    xfree(*values);    goto out;}int security_set_bools(int len, int *values){    int i, rc = 0;    int lenp, seqno = 0;    struct cond_node *cur;    POLICY_WRLOCK;    lenp = policydb.p_bools.nprim;    if ( len != lenp )    {        rc = -EFAULT;        goto out;    }    printk(KERN_INFO "security: committed booleans { ");    for ( i = 0; i < len; i++ )    {        if ( values[i] )        {            policydb.bool_val_to_struct[i]->state = 1;        }        else        {            policydb.bool_val_to_struct[i]->state = 0;        }        if ( i != 0 )            printk(", ");        printk("%s:%d", policydb.p_bool_val_to_name[i],               policydb.bool_val_to_struct[i]->state);    }    printk(" }\n");    for ( cur = policydb.cond_list; cur != NULL; cur = cur->next )    {        rc = evaluate_cond_node(&policydb, cur);        if ( rc )            goto out;    }    seqno = ++latest_granting;out:    POLICY_WRUNLOCK;    if ( !rc )    {        avc_ss_reset(seqno);    }    return rc;}int security_get_bool_value(int bool){    int rc = 0;    int len;    POLICY_RDLOCK;    len = policydb.p_bools.nprim;    if ( bool >= len )    {        rc = -EFAULT;        goto out;    }    rc = policydb.bool_val_to_struct[bool]->state;out:    POLICY_RDUNLOCK;    return rc;}