1 /*
2 * Copyright 2011 Tresys Technology, LLC. All rights reserved.
3 *
4 * Redistribution and use in source and binary forms, with or without
5 * modification, are permitted provided that the following conditions are met:
6 *
7 * 1. Redistributions of source code must retain the above copyright notice,
8 * this list of conditions and the following disclaimer.
9 *
10 * 2. Redistributions in binary form must reproduce the above copyright notice,
11 * this list of conditions and the following disclaimer in the documentation
12 * and/or other materials provided with the distribution.
13 *
14 * THIS SOFTWARE IS PROVIDED BY TRESYS TECHNOLOGY, LLC ``AS IS'' AND ANY EXPRESS
15 * OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
16 * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO
17 * EVENT SHALL TRESYS TECHNOLOGY, LLC OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT,
18 * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
19 * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
20 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
21 * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE
22 * OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF
23 * ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
24 *
25 * The views and conclusions contained in the software and documentation are those
26 * of the authors and should not be interpreted as representing official policies,
27 * either expressed or implied, of Tresys Technology, LLC.
28 */
29
30 #include <stdlib.h>
31 #include <stdio.h>
32 #include <stdint.h>
33 #include <string.h>
34 #include <getopt.h>
35 #include <sys/stat.h>
36
37 #ifdef ANDROID
38 #include <cil/cil.h>
39 #else
40 #include <sepol/cil/cil.h>
41 #endif
42 #include <sepol/policydb.h>
43
usage(const char * prog)44 static __attribute__((__noreturn__)) void usage(const char *prog)
45 {
46 printf("Usage: %s [OPTION]... FILE...\n", prog);
47 printf("\n");
48 printf("Options:\n");
49 printf(" -o, --output=<file> write binary policy to <file>\n");
50 printf(" (default: policy.<version>)\n");
51 printf(" -f, --filecontext=<file> write file contexts to <file>\n");
52 printf(" (default: file_contexts)\n");
53 printf(" -t, --target=<type> specify target architecture. may be selinux or\n");
54 printf(" xen. (default: selinux)\n");
55 printf(" -M, --mls true|false build an mls policy. Must be true or false.\n");
56 printf(" This will override the (mls boolean) statement\n");
57 printf(" if present in the policy\n");
58 printf(" -c, --policyvers=<version> build a binary policy with a given <version>\n");
59 printf(" (default: %i)\n", POLICYDB_VERSION_MAX);
60 printf(" -U, --handle-unknown=<action> how to handle unknown classes or permissions.\n");
61 printf(" may be deny, allow, or reject. (default: deny)\n");
62 printf(" This will override the (handleunknown action)\n");
63 printf(" statement if present in the policy\n");
64 printf(" -D, --disable-dontaudit do not add dontaudit rules to the binary policy\n");
65 printf(" -P, --preserve-tunables treat tunables as booleans\n");
66 printf(" -Q, --qualified-names Allow names containing dots (qualified names).\n");
67 printf(" Blocks, blockinherits, blockabstracts, and\n");
68 printf(" in-statements will not be allowed.\n");
69 printf(" -m, --multiple-decls allow some statements to be re-declared\n");
70 printf(" -N, --disable-neverallow do not check neverallow rules\n");
71 printf(" -G, --expand-generated Expand and remove auto-generated attributes\n");
72 printf(" -X, --expand-size <SIZE> Expand type attributes with fewer than <SIZE>\n");
73 printf(" members.\n");
74 printf(" -O, --optimize optimize final policy\n");
75 printf(" -v, --verbose increment verbosity level\n");
76 printf(" -h, --help display usage information\n");
77 exit(1);
78 }
79
main(int argc,char * argv[])80 int main(int argc, char *argv[])
81 {
82 int rc = SEPOL_ERR;
83 sepol_policydb_t *pdb = NULL;
84 struct sepol_policy_file *pf = NULL;
85 FILE *binary = NULL;
86 FILE *file_contexts;
87 FILE *file = NULL;
88 char *buffer = NULL;
89 struct stat filedata;
90 uint32_t file_size;
91 char *output = NULL;
92 char *filecontexts = NULL;
93 struct cil_db *db = NULL;
94 int target = SEPOL_TARGET_SELINUX;
95 int mls = -1;
96 int disable_dontaudit = 0;
97 int multiple_decls = 0;
98 int disable_neverallow = 0;
99 int preserve_tunables = 0;
100 int qualified_names = 0;
101 int handle_unknown = -1;
102 int policyvers = POLICYDB_VERSION_MAX;
103 int attrs_expand_generated = 0;
104 int attrs_expand_size = -1;
105 int optimize = 0;
106 int opt_char;
107 int opt_index = 0;
108 char *fc_buf = NULL;
109 size_t fc_size;
110 enum cil_log_level log_level = CIL_ERR;
111 static struct option long_opts[] = {
112 {"help", no_argument, 0, 'h'},
113 {"verbose", no_argument, 0, 'v'},
114 {"target", required_argument, 0, 't'},
115 {"mls", required_argument, 0, 'M'},
116 {"policyversion", required_argument, 0, 'c'},
117 {"handle-unknown", required_argument, 0, 'U'},
118 {"disable-dontaudit", no_argument, 0, 'D'},
119 {"multiple-decls", no_argument, 0, 'm'},
120 {"disable-neverallow", no_argument, 0, 'N'},
121 {"preserve-tunables", no_argument, 0, 'P'},
122 {"qualified-names", no_argument, 0, 'Q'},
123 {"output", required_argument, 0, 'o'},
124 {"filecontexts", required_argument, 0, 'f'},
125 {"expand-generated", no_argument, 0, 'G'},
126 {"expand-size", required_argument, 0, 'X'},
127 {"optimize", no_argument, 0, 'O'},
128 {0, 0, 0, 0}
129 };
130 int i;
131
132 while (1) {
133 opt_char = getopt_long(argc, argv, "o:f:U:hvt:M:PQDmNOc:GX:n", long_opts, &opt_index);
134 if (opt_char == -1) {
135 break;
136 }
137 switch (opt_char) {
138 case 'v':
139 log_level++;
140 break;
141 case 't':
142 if (!strcmp(optarg, "selinux")) {
143 target = SEPOL_TARGET_SELINUX;
144 } else if (!strcmp(optarg, "xen")) {
145 target = SEPOL_TARGET_XEN;
146 } else {
147 fprintf(stderr, "Unknown target: %s\n", optarg);
148 usage(argv[0]);
149 }
150 break;
151 case 'M':
152 if (!strcasecmp(optarg, "true") || !strcasecmp(optarg, "1")) {
153 mls = 1;
154 } else if (!strcasecmp(optarg, "false") || !strcasecmp(optarg, "0")) {
155 mls = 0;
156 } else {
157 usage(argv[0]);
158 }
159 break;
160 case 'c': {
161 char *endptr = NULL;
162 errno = 0;
163 policyvers = strtol(optarg, &endptr, 10);
164 if (errno != 0 || endptr == optarg || *endptr != '\0') {
165 fprintf(stderr, "Bad policy version: %s\n", optarg);
166 usage(argv[0]);
167 }
168 if (policyvers > POLICYDB_VERSION_MAX || policyvers < POLICYDB_VERSION_MIN) {
169 fprintf(stderr, "Policy version must be between %d and %d\n",
170 POLICYDB_VERSION_MIN, POLICYDB_VERSION_MAX);
171 usage(argv[0]);
172 }
173 break;
174 }
175 case 'U':
176 if (!strcasecmp(optarg, "deny")) {
177 handle_unknown = SEPOL_DENY_UNKNOWN;
178 } else if (!strcasecmp(optarg, "allow")) {
179 handle_unknown = SEPOL_ALLOW_UNKNOWN;
180 } else if (!strcasecmp(optarg, "reject")) {
181 handle_unknown = SEPOL_REJECT_UNKNOWN;
182 } else {
183 usage(argv[0]);
184 }
185 break;
186 case 'D':
187 disable_dontaudit = 1;
188 break;
189 case 'm':
190 multiple_decls = 1;
191 break;
192 case 'N':
193 disable_neverallow = 1;
194 break;
195 case 'P':
196 preserve_tunables = 1;
197 break;
198 case 'Q':
199 qualified_names = 1;
200 break;
201 case 'o':
202 free(output);
203 output = strdup(optarg);
204 break;
205 case 'f':
206 free(filecontexts);
207 filecontexts = strdup(optarg);
208 break;
209 case 'G':
210 attrs_expand_generated = 1;
211 break;
212 case 'X': {
213 char *endptr = NULL;
214 errno = 0;
215 attrs_expand_size = strtol(optarg, &endptr, 10);
216 if (errno != 0 || endptr == optarg || *endptr != '\0') {
217 fprintf(stderr, "Bad attribute expand size: %s\n", optarg);
218 usage(argv[0]);
219 }
220
221 if (attrs_expand_size < 0) {
222 fprintf(stderr, "Attribute expand size must be > 0\n");
223 usage(argv[0]);
224 }
225 break;
226 }
227 case 'O':
228 optimize = 1;
229 break;
230 case 'h':
231 usage(argv[0]);
232 case '?':
233 break;
234 default:
235 fprintf(stderr, "Unsupported option: %s\n", optarg);
236 usage(argv[0]);
237 }
238 }
239 if (optind >= argc) {
240 fprintf(stderr, "No cil files specified\n");
241 usage(argv[0]);
242 }
243
244 cil_set_log_level(log_level);
245
246 cil_db_init(&db);
247 cil_set_disable_dontaudit(db, disable_dontaudit);
248 cil_set_multiple_decls(db, multiple_decls);
249 cil_set_disable_neverallow(db, disable_neverallow);
250 cil_set_preserve_tunables(db, preserve_tunables);
251 cil_set_qualified_names(db, qualified_names);
252 if (handle_unknown != -1) {
253 rc = cil_set_handle_unknown(db, handle_unknown);
254 if (rc != SEPOL_OK) {
255 goto exit;
256 }
257 }
258
259 cil_set_mls(db, mls);
260 cil_set_target_platform(db, target);
261 cil_set_policy_version(db, policyvers);
262 cil_set_attrs_expand_generated(db, attrs_expand_generated);
263 if (attrs_expand_size >= 0) {
264 cil_set_attrs_expand_size(db, (unsigned)attrs_expand_size);
265 }
266
267 for (i = optind; i < argc; i++) {
268 file = fopen(argv[i], "r");
269 if (!file) {
270 fprintf(stderr, "Could not open file: %s\n", argv[i]);
271 rc = SEPOL_ERR;
272 goto exit;
273 }
274 rc = stat(argv[i], &filedata);
275 if (rc == -1) {
276 fprintf(stderr, "Could not stat file: %s\n", argv[i]);
277 rc = SEPOL_ERR;
278 goto exit;
279 }
280 file_size = filedata.st_size;
281
282 if (!file_size) {
283 fclose(file);
284 file = NULL;
285 continue;
286 }
287
288 buffer = malloc(file_size);
289 if (!buffer) {
290 fprintf(stderr, "Out of memory\n");
291 rc = SEPOL_ERR;
292 goto exit;
293 }
294
295 rc = fread(buffer, file_size, 1, file);
296 if (rc != 1) {
297 fprintf(stderr, "Failure reading file: %s\n", argv[i]);
298 rc = SEPOL_ERR;
299 goto exit;
300 }
301 fclose(file);
302 file = NULL;
303
304 rc = cil_add_file(db, argv[i], buffer, file_size);
305 if (rc != SEPOL_OK) {
306 fprintf(stderr, "Failure adding %s\n", argv[i]);
307 goto exit;
308 }
309
310 free(buffer);
311 buffer = NULL;
312 }
313
314 rc = cil_compile(db);
315 if (rc != SEPOL_OK) {
316 fprintf(stderr, "Failed to compile cildb: %d\n", rc);
317 goto exit;
318 }
319
320 rc = cil_build_policydb(db, &pdb);
321 if (rc != SEPOL_OK) {
322 fprintf(stderr, "Failed to build policydb\n");
323 goto exit;
324 }
325
326 if (optimize) {
327 rc = sepol_policydb_optimize(pdb);
328 if (rc != SEPOL_OK) {
329 fprintf(stderr, "Failed to optimize policydb\n");
330 goto exit;
331 }
332 }
333
334 if (output == NULL) {
335 int size = snprintf(NULL, 0, "policy.%d", policyvers);
336 output = malloc((size + 1) * sizeof(char));
337 if (output == NULL) {
338 fprintf(stderr, "Failed to create output filename\n");
339 rc = SEPOL_ERR;
340 goto exit;
341 }
342 if (snprintf(output, size + 1, "policy.%d", policyvers) != size) {
343 fprintf(stderr, "Failed to create output filename\n");
344 rc = SEPOL_ERR;
345 goto exit;
346 }
347 }
348
349 binary = fopen(output, "w");
350 if (binary == NULL) {
351 fprintf(stderr, "Failure opening binary file for writing\n");
352 rc = SEPOL_ERR;
353 goto exit;
354 }
355
356 rc = sepol_policy_file_create(&pf);
357 if (rc != 0) {
358 fprintf(stderr, "Failed to create policy file: %d\n", rc);
359 goto exit;
360 }
361
362 sepol_policy_file_set_fp(pf, binary);
363
364 rc = sepol_policydb_write(pdb, pf);
365 if (rc != 0) {
366 fprintf(stderr, "Failed to write binary policy: %d\n", rc);
367 goto exit;
368 }
369
370 fclose(binary);
371 binary = NULL;
372
373 rc = cil_filecons_to_string(db, &fc_buf, &fc_size);
374 if (rc != SEPOL_OK) {
375 fprintf(stderr, "Failed to get file context data\n");
376 goto exit;
377 }
378
379 if (filecontexts == NULL) {
380 file_contexts = fopen("file_contexts", "w+");
381 } else {
382 file_contexts = fopen(filecontexts, "w+");
383 }
384
385 if (file_contexts == NULL) {
386 fprintf(stderr, "Failed to open file_contexts file\n");
387 rc = SEPOL_ERR;
388 goto exit;
389 }
390
391 if (fwrite(fc_buf, sizeof(char), fc_size, file_contexts) != fc_size) {
392 fprintf(stderr, "Failed to write file_contexts file\n");
393 rc = SEPOL_ERR;
394 goto exit;
395 }
396
397 fclose(file_contexts);
398 file_contexts = NULL;
399
400 rc = SEPOL_OK;
401
402 exit:
403 if (binary != NULL) {
404 fclose(binary);
405 }
406 if (file != NULL) {
407 fclose(file);
408 }
409 free(buffer);
410 free(output);
411 free(filecontexts);
412 cil_db_destroy(&db);
413 sepol_policydb_free(pdb);
414 sepol_policy_file_free(pf);
415 free(fc_buf);
416 return rc;
417 }
418