1/* 2 * Copyright 2011 Tresys Technology, LLC. All rights reserved. 3 * 4 * Redistribution and use in source and binary forms, with or without 5 * modification, are permitted provided that the following conditions are met: 6 * 7 * 1. Redistributions of source code must retain the above copyright notice, 8 * this list of conditions and the following disclaimer. 9 * 10 * 2. Redistributions in binary form must reproduce the above copyright notice, 11 * this list of conditions and the following disclaimer in the documentation 12 * and/or other materials provided with the distribution. 13 * 14 * THIS SOFTWARE IS PROVIDED BY TRESYS TECHNOLOGY, LLC ``AS IS'' AND ANY EXPRESS 15 * OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF 16 * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO 17 * EVENT SHALL TRESYS TECHNOLOGY, LLC OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, 18 * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, 19 * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 20 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF 21 * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE 22 * OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF 23 * ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 24 * 25 * The views and conclusions contained in the software and documentation are those 26 * of the authors and should not be interpreted as representing official policies, 27 * either expressed or implied, of Tresys Technology, LLC. 28 */ 29 30#include <stdlib.h> 31#include <stdio.h> 32#include <stdint.h> 33#include <string.h> 34#include <getopt.h> 35#include <sys/stat.h> 36 37#ifdef ANDROID 38#include <cil/cil.h> 39#else 40#include <cil/cil.h> 41#endif 42#include <sepol/policydb.h> 43 44static __attribute__((__noreturn__)) void usage(const char *prog) 45{ 46 printf("Usage: %s [OPTION]... FILE...\n", prog); 47 printf("\n"); 48 printf("Options:\n"); 49 printf(" -o, --output=<file> write binary policy to <file>\n"); 50 printf(" (default: policy.<version>)\n"); 51 printf(" -f, --filecontext=<file> write file contexts to <file>\n"); 52 printf(" (default: file_contexts)\n"); 53 printf(" -t, --target=<type> specify target architecture. may be selinux or\n"); 54 printf(" xen. (default: selinux)\n"); 55 printf(" -M, --mls true|false build an mls policy. Must be true or false.\n"); 56 printf(" This will override the (mls boolean) statement\n"); 57 printf(" if present in the policy\n"); 58 printf(" -c, --policyvers=<version> build a binary policy with a given <version>\n"); 59 printf(" (default: %i)\n", POLICYDB_VERSION_MAX); 60 printf(" -U, --handle-unknown=<action> how to handle unknown classes or permissions.\n"); 61 printf(" may be deny, allow, or reject. (default: deny)\n"); 62 printf(" This will override the (handleunknown action)\n"); 63 printf(" statement if present in the policy\n"); 64 printf(" -D, --disable-dontaudit do not add dontaudit rules to the binary policy\n"); 65 printf(" -P, --preserve-tunables treat tunables as booleans\n"); 66 printf(" -Q, --qualified-names Allow names containing dots (qualified names).\n"); 67 printf(" Blocks, blockinherits, blockabstracts, and\n"); 68 printf(" in-statements will not be allowed.\n"); 69 printf(" -m, --multiple-decls allow some statements to be re-declared\n"); 70 printf(" -N, --disable-neverallow do not check neverallow rules\n"); 71 printf(" -G, --expand-generated Expand and remove auto-generated attributes\n"); 72 printf(" -X, --expand-size <SIZE> Expand type attributes with fewer than <SIZE>\n"); 73 printf(" members.\n"); 74 printf(" -O, --optimize optimize final policy\n"); 75 printf(" -v, --verbose increment verbosity level\n"); 76 printf(" -h, --help display usage information\n"); 77 exit(1); 78} 79 80int main(int argc, char *argv[]) 81{ 82 int rc = SEPOL_ERR; 83 sepol_policydb_t *pdb = NULL; 84 struct sepol_policy_file *pf = NULL; 85 FILE *binary = NULL; 86 FILE *file_contexts; 87 FILE *file = NULL; 88 char *buffer = NULL; 89 struct stat filedata; 90 uint32_t file_size; 91 char *output = NULL; 92 char *filecontexts = NULL; 93 struct cil_db *db = NULL; 94 int target = SEPOL_TARGET_SELINUX; 95 int mls = -1; 96 int disable_dontaudit = 0; 97 int multiple_decls = 0; 98 int disable_neverallow = 0; 99 int preserve_tunables = 0; 100 int qualified_names = 0; 101 int handle_unknown = -1; 102 int policyvers = POLICYDB_VERSION_MAX; 103 int attrs_expand_generated = 0; 104 int attrs_expand_size = -1; 105 int optimize = 0; 106 int opt_char; 107 int opt_index = 0; 108 char *fc_buf = NULL; 109 size_t fc_size; 110 enum cil_log_level log_level = CIL_ERR; 111 static struct option long_opts[] = { 112 {"help", no_argument, 0, 'h'}, 113 {"verbose", no_argument, 0, 'v'}, 114 {"target", required_argument, 0, 't'}, 115 {"mls", required_argument, 0, 'M'}, 116 {"policyversion", required_argument, 0, 'c'}, 117 {"handle-unknown", required_argument, 0, 'U'}, 118 {"disable-dontaudit", no_argument, 0, 'D'}, 119 {"multiple-decls", no_argument, 0, 'm'}, 120 {"disable-neverallow", no_argument, 0, 'N'}, 121 {"preserve-tunables", no_argument, 0, 'P'}, 122 {"qualified-names", no_argument, 0, 'Q'}, 123 {"output", required_argument, 0, 'o'}, 124 {"filecontexts", required_argument, 0, 'f'}, 125 {"expand-generated", no_argument, 0, 'G'}, 126 {"expand-size", required_argument, 0, 'X'}, 127 {"optimize", no_argument, 0, 'O'}, 128 {0, 0, 0, 0} 129 }; 130 int i; 131 132 while (1) { 133 opt_char = getopt_long(argc, argv, "o:f:U:hvt:M:PQDmNOc:GX:n", long_opts, &opt_index); 134 if (opt_char == -1) { 135 break; 136 } 137 switch (opt_char) { 138 case 'v': 139 log_level++; 140 break; 141 case 't': 142 if (!strcmp(optarg, "selinux")) { 143 target = SEPOL_TARGET_SELINUX; 144 } else if (!strcmp(optarg, "xen")) { 145 target = SEPOL_TARGET_XEN; 146 } else { 147 fprintf(stderr, "Unknown target: %s\n", optarg); 148 usage(argv[0]); 149 } 150 break; 151 case 'M': 152 if (!strcasecmp(optarg, "true") || !strcasecmp(optarg, "1")) { 153 mls = 1; 154 } else if (!strcasecmp(optarg, "false") || !strcasecmp(optarg, "0")) { 155 mls = 0; 156 } else { 157 usage(argv[0]); 158 } 159 break; 160 case 'c': { 161 char *endptr = NULL; 162 errno = 0; 163 policyvers = strtol(optarg, &endptr, 10); 164 if (errno != 0 || endptr == optarg || *endptr != '\0') { 165 fprintf(stderr, "Bad policy version: %s\n", optarg); 166 usage(argv[0]); 167 } 168 if (policyvers > POLICYDB_VERSION_MAX || policyvers < POLICYDB_VERSION_MIN) { 169 fprintf(stderr, "Policy version must be between %d and %d\n", 170 POLICYDB_VERSION_MIN, POLICYDB_VERSION_MAX); 171 usage(argv[0]); 172 } 173 break; 174 } 175 case 'U': 176 if (!strcasecmp(optarg, "deny")) { 177 handle_unknown = SEPOL_DENY_UNKNOWN; 178 } else if (!strcasecmp(optarg, "allow")) { 179 handle_unknown = SEPOL_ALLOW_UNKNOWN; 180 } else if (!strcasecmp(optarg, "reject")) { 181 handle_unknown = SEPOL_REJECT_UNKNOWN; 182 } else { 183 usage(argv[0]); 184 } 185 break; 186 case 'D': 187 disable_dontaudit = 1; 188 break; 189 case 'm': 190 multiple_decls = 1; 191 break; 192 case 'N': 193 disable_neverallow = 1; 194 break; 195 case 'P': 196 preserve_tunables = 1; 197 break; 198 case 'Q': 199 qualified_names = 1; 200 break; 201 case 'o': 202 free(output); 203 output = strdup(optarg); 204 break; 205 case 'f': 206 free(filecontexts); 207 filecontexts = strdup(optarg); 208 break; 209 case 'G': 210 attrs_expand_generated = 1; 211 break; 212 case 'X': { 213 char *endptr = NULL; 214 errno = 0; 215 attrs_expand_size = strtol(optarg, &endptr, 10); 216 if (errno != 0 || endptr == optarg || *endptr != '\0') { 217 fprintf(stderr, "Bad attribute expand size: %s\n", optarg); 218 usage(argv[0]); 219 } 220 221 if (attrs_expand_size < 0) { 222 fprintf(stderr, "Attribute expand size must be > 0\n"); 223 usage(argv[0]); 224 } 225 break; 226 } 227 case 'O': 228 optimize = 1; 229 break; 230 case 'h': 231 usage(argv[0]); 232 case '?': 233 break; 234 default: 235 fprintf(stderr, "Unsupported option: %s\n", optarg); 236 usage(argv[0]); 237 } 238 } 239 if (optind >= argc) { 240 fprintf(stderr, "No cil files specified\n"); 241 usage(argv[0]); 242 } 243 244 cil_set_log_level(log_level); 245 246 cil_db_init(&db); 247 cil_set_disable_dontaudit(db, disable_dontaudit); 248 cil_set_multiple_decls(db, multiple_decls); 249 cil_set_disable_neverallow(db, disable_neverallow); 250 cil_set_preserve_tunables(db, preserve_tunables); 251 cil_set_qualified_names(db, qualified_names); 252 if (handle_unknown != -1) { 253 rc = cil_set_handle_unknown(db, handle_unknown); 254 if (rc != SEPOL_OK) { 255 goto exit; 256 } 257 } 258 259 cil_set_mls(db, mls); 260 cil_set_target_platform(db, target); 261 cil_set_policy_version(db, policyvers); 262 cil_set_attrs_expand_generated(db, attrs_expand_generated); 263 if (attrs_expand_size >= 0) { 264 cil_set_attrs_expand_size(db, (unsigned)attrs_expand_size); 265 } 266 267 for (i = optind; i < argc; i++) { 268 file = fopen(argv[i], "r"); 269 if (!file) { 270 fprintf(stderr, "Could not open file: %s\n", argv[i]); 271 rc = SEPOL_ERR; 272 goto exit; 273 } 274 rc = stat(argv[i], &filedata); 275 if (rc == -1) { 276 fprintf(stderr, "Could not stat file: %s\n", argv[i]); 277 rc = SEPOL_ERR; 278 goto exit; 279 } 280 file_size = filedata.st_size; 281 282 if (!file_size) { 283 fclose(file); 284 file = NULL; 285 continue; 286 } 287 288 buffer = malloc(file_size); 289 rc = fread(buffer, file_size, 1, file); 290 if (rc != 1) { 291 fprintf(stderr, "Failure reading file: %s\n", argv[i]); 292 rc = SEPOL_ERR; 293 goto exit; 294 } 295 fclose(file); 296 file = NULL; 297 298 rc = cil_add_file(db, argv[i], buffer, file_size); 299 if (rc != SEPOL_OK) { 300 fprintf(stderr, "Failure adding %s\n", argv[i]); 301 goto exit; 302 } 303 304 free(buffer); 305 buffer = NULL; 306 } 307 308 rc = cil_compile(db); 309 if (rc != SEPOL_OK) { 310 fprintf(stderr, "Failed to compile cildb: %d\n", rc); 311 goto exit; 312 } 313 314 rc = cil_build_policydb(db, &pdb); 315 if (rc != SEPOL_OK) { 316 fprintf(stderr, "Failed to build policydb\n"); 317 goto exit; 318 } 319 320 if (optimize) { 321 rc = sepol_policydb_optimize(pdb); 322 if (rc != SEPOL_OK) { 323 fprintf(stderr, "Failed to optimize policydb\n"); 324 goto exit; 325 } 326 } 327 328 if (output == NULL) { 329 int size = snprintf(NULL, 0, "policy.%d", policyvers); 330 output = malloc((size + 1) * sizeof(char)); 331 if (output == NULL) { 332 fprintf(stderr, "Failed to create output filename\n"); 333 rc = SEPOL_ERR; 334 goto exit; 335 } 336 if (snprintf(output, size + 1, "policy.%d", policyvers) != size) { 337 fprintf(stderr, "Failed to create output filename\n"); 338 rc = SEPOL_ERR; 339 goto exit; 340 } 341 } 342 343 binary = fopen(output, "w"); 344 if (binary == NULL) { 345 fprintf(stderr, "Failure opening binary file for writing\n"); 346 rc = SEPOL_ERR; 347 goto exit; 348 } 349 350 rc = sepol_policy_file_create(&pf); 351 if (rc != 0) { 352 fprintf(stderr, "Failed to create policy file: %d\n", rc); 353 goto exit; 354 } 355 356 sepol_policy_file_set_fp(pf, binary); 357 358 rc = sepol_policydb_write(pdb, pf); 359 if (rc != 0) { 360 fprintf(stderr, "Failed to write binary policy: %d\n", rc); 361 goto exit; 362 } 363 364 fclose(binary); 365 binary = NULL; 366 367 rc = cil_filecons_to_string(db, &fc_buf, &fc_size); 368 if (rc != SEPOL_OK) { 369 fprintf(stderr, "Failed to get file context data\n"); 370 goto exit; 371 } 372 373 if (filecontexts == NULL) { 374 file_contexts = fopen("file_contexts", "w+"); 375 } else { 376 file_contexts = fopen(filecontexts, "w+"); 377 } 378 379 if (file_contexts == NULL) { 380 fprintf(stderr, "Failed to open file_contexts file\n"); 381 rc = SEPOL_ERR; 382 goto exit; 383 } 384 385 if (fwrite(fc_buf, sizeof(char), fc_size, file_contexts) != fc_size) { 386 fprintf(stderr, "Failed to write file_contexts file\n"); 387 rc = SEPOL_ERR; 388 goto exit; 389 } 390 391 fclose(file_contexts); 392 file_contexts = NULL; 393 394 rc = SEPOL_OK; 395 396exit: 397 if (binary != NULL) { 398 fclose(binary); 399 } 400 if (file != NULL) { 401 fclose(file); 402 } 403 free(buffer); 404 free(output); 405 free(filecontexts); 406 cil_db_destroy(&db); 407 sepol_policydb_free(pdb); 408 sepol_policy_file_free(pf); 409 free(fc_buf); 410 return rc; 411} 412