/* Copyright 2009 Sun Microsystems, Inc.  All rights reserved.

 *

 * Permission is hereby granted, free of charge, to any person obtaining a

 * copy of this software and associated documentation files (the

 * "Software"), to deal in the Software without restriction, including

 * without limitation the rights to use, copy, modify, merge, publish,

 * distribute, and/or sell copies of the Software, and to permit persons

 * to whom the Software is furnished to do so, provided that the above

 * copyright notice(s) and this permission notice appear in all copies of

 * the Software and that both the above copyright notice(s) and this

 * permission notice appear in supporting documentation.

 *

 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS

 * OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF

 * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT

 * OF THIRD PARTY RIGHTS. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR

 * HOLDERS INCLUDED IN THIS NOTICE BE LIABLE FOR ANY CLAIM, OR ANY SPECIAL

 * INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES WHATSOEVER RESULTING

 * FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT,

 * NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION

 * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.

 *

 * Except as contained in this notice, the name of a copyright holder

 * shall not be used in advertising or otherwise to promote the sale, use

 * or other dealings in this Software without prior written authorization

 * of the copyright holder.

 */

#ifdef HAVE_DIX_CONFIG_H

#include <dix-config.h>

#endif

#include <X11/X.h>

#define		NEED_REPLIES

#define		NEED_EVENTS

#include <stdio.h>

#include <sys/types.h>

#include <unistd.h>

#include "auditwrite.h"

#include <bsm/audit_kevents.h>

#include <bsm/audit_uevents.h>

#include <X11/Xproto.h>

#include "dix.h"

#include "misc.h"

#include "scrnintstr.h"

#include "os.h"

#include "regionstr.h"

#include "validate.h"

#include "windowstr.h"

#include "propertyst.h"

#include "input.h"

#include "inputstr.h"

#include "resource.h"

#include "colormapst.h"

#include "cursorstr.h"

#include "dixstruct.h"

#include "selection.h"

#include "gcstruct.h"

#include "servermd.h"

#include <syslog.h>

#include "extnsionst.h"

#include "registry.h"

#ifdef PANORAMIX

#include "../Xext/panoramiXsrv.h"

#endif

#include "tsol.h"

#include "tsolinfo.h"

#include "tsolpolicy.h"

static priv_set_t *pset_win_mac_read = NULL;

static priv_set_t *pset_win_mac_write = NULL;

static priv_set_t *pset_win_dac_read = NULL;

static priv_set_t *pset_win_dac_write = NULL;

static priv_set_t *pset_win_config = NULL;

static priv_set_t *pset_win_devices = NULL;

static priv_set_t *pset_win_fontpath = NULL;

static priv_set_t *pset_win_colormap = NULL;

static priv_set_t *pset_win_upgrade_sl = NULL;

static priv_set_t *pset_win_downgrade_sl = NULL;

static priv_set_t *pset_win_selection = NULL;

#define SAMECLIENT(client, xid) ((client)->index == CLIENT_ID(xid))

static int access_xid(xresource_t res, xmethod_t method, void *resource,

		      void *subject, xpolicy_t policy_flags, void *misc,

		      RESTYPE res_type, priv_set_t *which_priv);

static int check_priv(xresource_t res, xmethod_t method, void *resource,

		      void *subject, xpolicy_t policy_flags, void *misc,

		      priv_set_t *priv);

/* Unless NO_TSOL_DEBUG_MESSAGES is defined, admins will be able to enable

   debugging messages at runtime via Xorg -logverbose */

#ifndef NO_TSOL_DEBUG_MESSAGES

static char *xsltos(bslabel_t *sl);

static void XTsolErr(const char *err_type, CARD8 *protocol,

	     bslabel_t *osl, uid_t ouid, pid_t opid, const char *opname,

	     bslabel_t *ssl, uid_t suid, pid_t spid, const char *spname,

	     const char *method, int isstring, const void *xid);

#define XTSOLERR_GEN(err_type, protocol, o, s, method, xid, isstring) \

                 (void) XTsolErr(err_type, (CARD8 *) (protocol), \

				 (o)->sl, (o)->uid, (o)->pid, NULL, \

				 (s)->sl, (s)->uid, (s)->pid, (s)->pname, \

				 method, isstring, xid)

#else  /* NO_TSOL_DEBUG_MESSAGES */

#define XTSOLERR_GEN(err_type, protocol, o, s, method, xid, isstring)  /**/

#endif /* NO_TSOL_DEBUG_MESSAGES */

#define XTSOLERR(err_type, protocol, o, s, method, xid) \

	XTSOLERR_GEN(err_type, protocol, o, s, method, &(xid), 0);

#define SXTSOLERR(err_type, protocol, o, s, method, xid) \

	XTSOLERR_GEN(err_type, protocol, o, s, method, xid, 1);

int object_float(TsolInfoPtr, WindowPtr);

static void

set_audit_flags(TsolInfoPtr tsolinfo)

{

    if (tsolinfo->flags & TSOL_AUDITEVENT)

        tsolinfo->flags &= ~TSOL_AUDITEVENT;

    if (!(tsolinfo->flags & TSOL_DOXAUDIT))

        tsolinfo->flags |= TSOL_DOXAUDIT;

}

static void

unset_audit_flags(TsolInfoPtr tsolinfo)

{

    if (tsolinfo->flags & TSOL_AUDITEVENT)

        tsolinfo->flags &= ~TSOL_AUDITEVENT;

    if (tsolinfo->flags & TSOL_DOXAUDIT)

        tsolinfo->flags &= ~TSOL_DOXAUDIT;

}

/*

 * return 1 for success and 0 for failure

 * this routine contains the privd debugging for the system

 * as well as auditing the success or failure of use of priv.

 * Priv debugging will be done later TBD

 */

static int

xpriv_policy(priv_set_t *set, priv_set_t *priv, xresource_t res,

			 xmethod_t method, void *subject, Bool do_audit)

{

	static int logopened = FALSE;

	int	status = 0;

	int audit_status = 0;

	ClientPtr client = subject;

	TsolInfoPtr tsolinfo = GetClientTsolInfo(client);

	if (priv_issubset(priv, set))

	{

		status = 1;

		audit_status = 1;

	}

	else

	{

		audit_status = 0;

		if (!logopened)

		{

			/* LOG_USER doesn't work */

			openlog("xsun", 0, LOG_LOCAL0);

			logopened = TRUE;

		}

		/* if priv debugging is on, allow this priv to succeed */

		if (tsolinfo->priv_debug)

		{

#ifndef NO_TSOL_DEBUG_MESSAGES

		    LogMessageVerb(X_INFO, TSOL_MSG_ACCESS_TRACE,

				   TSOL_LOG_PREFIX"%s: Allowed priv %ld\n",

				   tsolinfo->pname, (long) priv);

#endif /* !NO_TSOL_DEBUG_MESSAGES */

			syslog(LOG_DEBUG|LOG_LOCAL0,

                   "DEBUG: %s pid %ld lacking privilege %d to %d %d",

                   "xclient", tsolinfo->pid, priv, method, res);

			status = 1;

            audit_status = 1;

		}

	}

	if (do_audit)

		auditwrite(AW_USEOFPRIV, audit_status, priv, AW_APPEND, AW_END);

	return (status);

}	/* xpriv_policy */

/*

 * The read/modify window policy are for window attributes & not

 * for window contents. read/modify pixel handle the contents policy

 */

/*

 * read_window

 */

static int

read_window(xresource_t res, xmethod_t method, void *resource,

			void *subject, xpolicy_t policy_flags, void *misc)

{

	int ret_stat = PASSED;

	Bool do_audit = FALSE;

	int	err_code = BadWindow;

	WindowPtr pWin = resource;

	ClientPtr client = subject;

	ClientPtr ownerclient;

	TsolInfoPtr tsolinfo = GetClientTsolInfo(client);

	TsolInfoPtr tsolownerinfo;	/*client who owns the window */

	TsolResPtr tsolres = TsolWindowPriv(pWin);

	ownerclient = clients[CLIENT_ID(pWin->drawable.id)];

	tsolownerinfo = GetClientTsolInfo(ownerclient);

	/*

	 * Anyone can read RootWindow attributes

	 */

	if (WindowIsRoot(pWin))

	{

		return (PASSED);

	}

	/* optimization based on client id */

	if (SAMECLIENT(client, pWin->drawable.id))

	{

		return PASSED;

	}

	/*

	 * MAC Check

	*/

	if (policy_flags & TSOL_MAC)

	{

		if (!(blequal(tsolinfo->sl, tsolres->sl)))

		{

            if (tsolinfo->flags & TSOL_AUDITEVENT)

                do_audit = TRUE;

			if (xpriv_policy(tsolinfo->privs, pset_win_mac_read,

							 res, method, client, do_audit) ||

				(tsolownerinfo && HasWinSelection(tsolownerinfo)))

			{

				ret_stat = PASSED;

			}

			else

			{

				XTSOLERR("mac", misc, tsolres, tsolinfo,

					 "read window", pWin->drawable.id);

				ret_stat = err_code;

			}

		}

	}

	/*

	 * DAC Check

	 */

	if ((ret_stat == PASSED) && policy_flags & TSOL_DAC)

	{

		/* uid == DEF_UID means public window, shared read */

		if (!(XTSOLTrusted(pWin) ||

			tsolres->uid == DEF_UID ||

			tsolinfo->uid == tsolres->uid))

		{

            if (tsolinfo->flags & TSOL_AUDITEVENT)

                do_audit = TRUE;

			if (xpriv_policy(tsolinfo->privs, pset_win_dac_read,

							 res, method, client, do_audit))

			{

				ret_stat = PASSED;

			}

			else

			{

				XTSOLERR("dac", misc, tsolres, tsolinfo,

					 "read window", pWin->drawable.id);

				ret_stat = err_code;

			}

		}

	}

	if (do_audit)

    {

        set_audit_flags(tsolinfo);

		auditwrite(AW_XWINDOW, pWin->drawable.id, tsolres->uid,

				   AW_APPEND, AW_END);

    }

	return (ret_stat);

}	/* read_window */

/*

 * modify_window

 */

static int

modify_window(xresource_t res, xmethod_t method, void *resource,

			  void *subject, xpolicy_t policy_flags, void *misc)

{

	int ret_stat = PASSED;

	Bool do_audit = FALSE;

	int	err_code = BadWindow;

	WindowPtr pWin = resource;

	ClientPtr client = subject;

	TsolInfoPtr tsolinfo = GetClientTsolInfo(client);

	TsolResPtr tsolres = TsolWindowPriv(pWin);

	/* optimization based on client id */

	if (SAMECLIENT(client, pWin->drawable.id))

	{

		return PASSED;

	}

	/*

	 * Trusted Path Windows require Trusted Path attrib

	 */

	if (XTSOLTrusted(pWin) && !HasTrustedPath(tsolinfo))

	{

		XTSOLERR("tp",  misc, tsolres, tsolinfo,

			 "modify window", pWin->drawable.id);

		ret_stat = err_code;

	}

	/*

	 * MAC Check

	 */

	if ((ret_stat == PASSED) && policy_flags & TSOL_MAC)

	{

		if (!blequal(tsolinfo->sl, tsolres->sl))

		{

            if (tsolinfo->flags & TSOL_AUDITEVENT)

                do_audit = TRUE;

			if (xpriv_policy(tsolinfo->privs, pset_win_mac_write,

							 res, method, client, do_audit))

			{

				ret_stat = PASSED;

			}

			else

			{

				XTSOLERR("mac",  misc, tsolres, tsolinfo,

					 "modify window", pWin->drawable.id);

				ret_stat = err_code;

			}

		}

	}

	/*

	 * DAC Check

	 */

	if ((ret_stat == PASSED) && policy_flags & TSOL_DAC)

	{

		if (tsolinfo->uid != tsolres->uid)

		{

            if (tsolinfo->flags & TSOL_AUDITEVENT)

                do_audit = TRUE;

			if (xpriv_policy(tsolinfo->privs, pset_win_dac_write,

							 res, method, client, do_audit))

			{

				ret_stat = PASSED;

			}

			else

			{

				XTSOLERR("dac",  misc, tsolres, tsolinfo,

					 "modify window", pWin->drawable.id);

				ret_stat = err_code;

			}

		}

	}

	if (do_audit)

        {

            set_audit_flags(tsolinfo);

		auditwrite(AW_XWINDOW, pWin->drawable.id, tsolres->uid,

				   AW_APPEND, AW_END);

        }

	return (ret_stat);

}	/* modify_window */

/*

 * create_window

 */

static int

create_window(xresource_t res, xmethod_t method, void *resource,

			  void *subject, xpolicy_t policy_flags, void *misc)

{

	int ret_stat = PASSED;

	Bool do_audit = FALSE;

	int	err_code = BadWindow;

	WindowPtr pWin = resource;	/* parent window */

	ClientPtr client = subject;

	TsolInfoPtr tsolinfo = GetClientTsolInfo(client);

	TsolResPtr  tsolres = TsolWindowPriv(pWin);

	/*

	 * Anyone can create a child of root window

	 */

	if (WindowIsRoot(pWin))

	{

		return (PASSED);

	}

	/*

	 * Trusted Path Windows required Trusted Path attrib

	 */

	if (XTSOLTrusted(pWin))

	{

		if (!HasTrustedPath(tsolinfo))

		{

		/*	XTSOLERR("tp",  misc, tsolres, tsolinfo,

				"create window", pWin->drawable.id); */

			return (err_code);

		}

	}

	/*

	 * MAC Check

	*/

	if (policy_flags & TSOL_MAC)

	{

		if (!blequal(tsolinfo->sl, tsolres->sl))

		{

			if (!SAMECLIENT(client, pWin->parent->drawable.id) &&

                (tsolinfo->flags & TSOL_AUDITEVENT))

            {

				do_audit = TRUE;

            }

			if (xpriv_policy(tsolinfo->privs, pset_win_mac_write,

							 res, method, client, do_audit))

			{

				ret_stat = PASSED;

			}

			else

			{

				XTSOLERR("mac",  misc, tsolres, tsolinfo,

					 "create window", pWin->drawable.id);

				ret_stat = err_code;

			}

		}

	}

	/*

	 * DAC Check

	 */

	if ((ret_stat == PASSED) && policy_flags & TSOL_DAC)

	{

		if (tsolinfo->uid != tsolres->uid)

		{

			if (!SAMECLIENT(client, pWin->parent->drawable.id) &&

                (tsolinfo->flags & TSOL_AUDITEVENT))

            {

				do_audit = TRUE;

            }

			if (xpriv_policy(tsolinfo->privs, pset_win_dac_write,

							 res, method, client, do_audit))

			{

				ret_stat = PASSED;

			}

			else

			{

				XTSOLERR("dac",  misc, tsolres, tsolinfo,

					 "create window", pWin->drawable.id);

				ret_stat = err_code;

			}

		}

	}

	if (do_audit)

    {

        set_audit_flags(tsolinfo);

		auditwrite(AW_XWINDOW, pWin->drawable.id, tsolres->uid,

				   AW_SLABEL, tsolres->sl,

				   AW_APPEND, AW_END);

    }

	return (ret_stat);

}	/* create_window */

/*

 * destroy_window

 */

static int

destroy_window(xresource_t res, xmethod_t method, void *resource,

			   void *subject, xpolicy_t policy_flags, void *misc)

{

	int ret_stat = PASSED;

	Bool do_audit = FALSE;

	int	err_code = BadWindow;

	WindowPtr pWin = resource;

	ClientPtr client = subject;

	TsolInfoPtr tsolinfo = GetClientTsolInfo(client);

	TsolResPtr  tsolres = TsolWindowPriv(pWin);

	/*

	 * Trusted Path Windows required Trusted Path attrib

	 */

	if (XTSOLTrusted(pWin))

	{

		if (!HasTrustedPath(tsolinfo))

		{

			XTSOLERR("tp",  misc, tsolres, tsolinfo,

				 "destroy window", pWin->drawable.id);

			return (err_code);

		}

	}

	/*

	 * MAC Check

	 */

	if (policy_flags & TSOL_MAC)

	{

		if (!blequal(tsolinfo->sl, tsolres->sl))

		{

            if (tsolinfo->flags & TSOL_AUDITEVENT)

                do_audit = TRUE;

			if (xpriv_policy(tsolinfo->privs, pset_win_mac_write,

							 res, method, client, do_audit))

			{

				ret_stat = PASSED;

			}

			else

			{

				XTSOLERR("mac",  misc, tsolres, tsolinfo,

					 "destroy window", pWin->drawable.id);

				ret_stat = err_code;

			}

		}

	}

	/*