path: root/src/mcscolor.c

#include <unistd.h>
#include <fcntl.h>
#include <stdlib.h>
#include <stdint.h>
#include <string.h>
#include <stdio.h>
#include <stdio_ext.h>
#include <ctype.h>
#include <alloca.h>
#include <fnmatch.h>
#include <syslog.h>
#include <selinux/flask.h>
#include <selinux/av_permissions.h>
#include <selinux/selinux.h>
#include <selinux/context.h>
#include "mcstrans.h"

/* Define data structures */
typedef struct secolor {
	uint32_t fg;
	uint32_t bg;
} secolor_t;

typedef struct setab {
	char *pattern;
	secolor_t color;
	struct setab *next;
} setab_t;

#define COLOR_USER	0
#define COLOR_ROLE	1
#define COLOR_TYPE	2
#define COLOR_RANGE	3
#define N_COLOR		4

static char *rules[] = { "user", "role", "type", "range" };

static setab_t *clist[N_COLOR];
static setab_t *cend[N_COLOR];

void finish_context_colors(void) {
	setab_t *cur, *next;
	unsigned i;

	for (i = 0; i < N_COLOR; i++) {
		cur = clist[i];
		while(cur) {
			next = cur->next;
			free(cur->pattern);
			free(cur);
			cur = next;
		}
		clist[i] = cend[i] = NULL;
	}
}

static void print_colors(void) {
	setab_t *ptr;
	unsigned i;

	for (i = 0; i < N_COLOR; i++) {
		ptr = clist[i];
		while (ptr) {
			printf("%s %s->(fg:%x, bg:%x)\n", rules[i],
			       ptr->pattern, ptr->color.fg, ptr->color.bg);
			ptr = ptr->next;
		}
	}
}

static int check_dominance(const char *pattern, const char *raw) {
	security_context_t ctx;
	context_t con;
	unsigned int bit = CONTEXT__CONTAINS;
	struct av_decision avd;
	int rc = -1;

	con = context_new(raw);
	if (!con)
		return -1;
	if (context_range_set(con, pattern))
		goto out;
	ctx = context_str(con);
	if (!ctx)
		goto out;

	rc = security_compute_av_raw(ctx, raw, SECCLASS_CONTEXT, bit, &avd);
	if (rc)
		goto out;

	rc = (bit & avd.allowed) != bit;
out:
	context_free(con);
	return rc;
}

static const secolor_t *find_color(int idx, const char *component,
				   const char *raw) {
	setab_t *ptr = clist[idx];

	if (raw)
	    while (ptr) {
		if (idx == COLOR_RANGE) {
		    if (check_dominance(ptr->pattern, raw) == 0)
			return &ptr->color;
		} else {
		    if (fnmatch(ptr->pattern, component, 0) == 0)
			return &ptr->color;
		}
		ptr = ptr->next;
	    }

	return NULL;
}

static int add_secolor(int idx, char *pattern, uint32_t fg, uint32_t bg) {
	setab_t *cptr;

	cptr = calloc(1, sizeof(setab_t));
	if (!cptr) return -1;

	cptr->pattern = strdup(pattern);
	if (!cptr->pattern) {
		free(cptr);
		return -1;
	}

	cptr->color.fg = fg & 0xffffff;
	cptr->color.bg = bg & 0xffffff;

	if (cend[idx]) {
		cend[idx]->next = cptr;
		cend[idx] = cptr;
	} else {
		clist[idx] = cptr;
		cend[idx] = cptr;
	}
	return 0;
}

/* Process line from color file.
   May modify the data pointed to by the buffer paremeter */
static int process_color(char *buffer, int line) {
	char rule[10], pat[256];
	uint32_t i, fg, bg;
	int ret;

	while(isspace(*buffer))
		buffer++;
	if(buffer[0] == '#' || buffer[0] == '\0') return 0;

	ret = sscanf(buffer, "%8s %255s = %x %x", rule, pat, &fg, &bg);
	if (ret == 4)
		for (i = 0; i < N_COLOR; i++)
			if (!strcmp(rule, rules[i]))
				return add_secolor(i, pat, fg, bg);

	syslog(LOG_WARNING, "Line %d of secolors file is invalid.", line);
	return 0;
}

/* Read in color file.
 */
int init_colors(void) {
	FILE *cfg = NULL;
	size_t size = 0;
	char *buffer = NULL;
	int line = 0;

	cfg = fopen("/etc/selinux/refpolicy/secolor.conf", "r");
	if (!cfg) return 1;

	__fsetlocking(cfg, FSETLOCKING_BYCALLER);
	while (getline(&buffer, &size, cfg) > 0) {
		if( process_color(buffer, ++line) < 0 ) break;
	}
	free(buffer);

	fclose(cfg);
	return 0;
}

static const unsigned precedence[N_COLOR][N_COLOR - 1] = {
	{ COLOR_ROLE, COLOR_TYPE, COLOR_RANGE },
	{ COLOR_USER, COLOR_TYPE, COLOR_RANGE },
	{ COLOR_USER, COLOR_ROLE, COLOR_RANGE },
	{ COLOR_USER, COLOR_ROLE, COLOR_TYPE },
};

static const secolor_t default_color = { 0x000000, 0xffffff };

static int parse_components(context_t con, char **components) {
	components[COLOR_USER] = (char *)context_user_get(con);
	components[COLOR_ROLE] = (char *)context_role_get(con);
	components[COLOR_TYPE] = (char *)context_type_get(con);
	components[COLOR_RANGE] = (char *)context_range_get(con);

	return 0;
}

static void free_components(context_t con, char **components) {
	context_free(con);
}

/* Look up colors.
 */
int raw_color(const security_context_t raw, char **color_str) {
	context_t con;
	uint32_t i, j, mask = 0;
	const secolor_t *items[N_COLOR];
	char *result, *components[N_COLOR];
	char buf[20];
	int rc = -1;

	/* parse context and allocate memory */
	con = context_new(raw);
	if (!con)
		return -1;
	if (parse_components(con, components) < 0)
		goto out;

	result = malloc(N_COLOR * sizeof(buf));
	if (!result)
		goto out;
	result[0] = '\0';

	/* find colors for which we have a match */
	for (i = 0; i < N_COLOR; i++) {
		items[i] = find_color(i, components[i], raw);
		if (items[i])
			mask |= (1 << i);
	}
	if (mask == 0) {
		items[0] = &default_color;
		mask = 1;
	}

	/* propagate colors according to the precedence rules */
	for (i = 0; i < N_COLOR; i++)
		if (!(mask & (1 << i)))
			for (j = 0; j < N_COLOR - 1; j++)
				if (mask & (1 << precedence[i][j])) {
					items[i] = items[precedence[i][j]];
					break;
				}

	/* print results into a big long string */
	for (i = 0; i < N_COLOR; i++) {
		snprintf(buf, sizeof(buf), "#%06x #%06x ",
			 items[i]->fg, items[i]->bg);
		strncat(result, buf, sizeof(buf));
	}

	*color_str = result;
	rc = 0;
out:
	free_components(con, components);
	return rc;
}