*

 * Permission is hereby granted, free of charge, to any person obtaining a

 * copy of this software and associated documentation files (the

 * "Software"), to deal in the Software without restriction, including

 * without limitation the rights to use, copy, modify, merge, publish,

 * distribute, and/or sell copies of the Software, and to permit persons

 * to whom the Software is furnished to do so, provided that the above

 * copyright notice(s) and this permission notice appear in all copies of

 * the Software and that both the above copyright notice(s) and this

 * permission notice appear in supporting documentation.

 *

 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS

 * OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF

 * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT

 * OF THIRD PARTY RIGHTS. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR

 * HOLDERS INCLUDED IN THIS NOTICE BE LIABLE FOR ANY CLAIM, OR ANY SPECIAL

 * INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES WHATSOEVER RESULTING

 * FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT,

 * NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION

 * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.

 *

 * Except as contained in this notice, the name of a copyright holder

 * shall not be used in advertising or otherwise to promote the sale, use

 * or other dealings in this Software without prior written authorization

 * of the copyright holder.

 */ 

#define		NEED_REPLIES

#define		NEED_EVENTS

#include <stdio.h>

#include <sys/types.h>

#include <unistd.h>

#include <bsm/auditwrite.h>

#include <bsm/audit_kevents.h>

#include <bsm/audit_uevents.h>

#include "misc.h"

#include "scrnintstr.h"

#include "os.h"

#include "regionstr.h"

#include "validate.h"

#include "windowstr.h"

#include "propertyst.h"

#include "input.h"

#include "inputstr.h"

#include "resource.h"

#include "colormapst.h"

#include "cursorstr.h"

#include "dixstruct.h"

#include "selection.h"

#include "gcstruct.h"

#include "servermd.h"

#include <syslog.h>

#include "tsolinfo.h"

#include "tsolpolicy.h"

static priv_set_t *pset_win_mac_read = NULL;

static priv_set_t *pset_win_mac_write = NULL;

static priv_set_t *pset_win_dac_read = NULL;

static priv_set_t *pset_win_dac_write = NULL;

static priv_set_t *pset_win_config = NULL;

static priv_set_t *pset_win_devices = NULL;

static priv_set_t *pset_win_fontpath = NULL;

static priv_set_t *pset_win_colormap = NULL;

static priv_set_t *pset_win_upgrade_sl = NULL;

static priv_set_t *pset_win_downgrade_sl = NULL;

static priv_set_t *pset_win_selection = NULL;

extern TsolInfoPtr GetClientTsolInfo();

extern int tsolWindowPrivateIndex;

extern int tsolPixmapPrivateIndex;

extern WindowPtr TsolPointerWindow();

extern char *NameForAtom(Atom atom);

extern char *xsltos(bslabel_t *sl);

extern char *ProtoNames[];

extern InputInfo inputInfo;

extern unsigned long tsoldebug;  /* from tsolutils.c */

extern Bool priv_win_colormap;

extern Bool priv_win_config;

extern Bool priv_win_devices;

extern Bool priv_win_dga;

extern Bool priv_win_fontpath;

extern int tsolMultiLevel;

#define SAMECLIENT(client, xid) ((client)->index == CLIENT_ID(xid))

int access_xid(xresource_t res, xmethod_t method, void *resource,

		   void *subject, xpolicy_t policy_flags, void *misc, 

		   RESTYPE res_type, priv_set_t *which_priv);

int check_priv(xresource_t res, xmethod_t method, void *resource,

	void *subject, xpolicy_t policy_flags, void *misc, priv_set_t *priv);

#ifdef DEBUG

int	xtsol_debug = XTSOL_FAIL;	/* set it to 0 if no logging is required */

void XTsolErr(char *err_type, int protocol, bslabel_t *osl,

              uid_t ouid, pid_t opid, char *opname,

              bslabel_t *ssl, uid_t suid, pid_t spid,

              char *spname, char *method, int isstring, void *xid);

#define XTSOLERR(err_type, protocol, osl, ouid, opid, opname,\

                 ssl, suid, spid, spname, method, xid)\

                 (void) XTsolErr(err_type, protocol, osl, ouid, opid,\

                                 opname, ssl, suid, spid, spname, method,\

                                 0, (void *) xid)

#define SXTSOLERR(err_type, protocol, osl, ouid, opid, opname,\

                  ssl, suid, spid, spname, method, xid)\

                  (void) XTsolErr(err_type, protocol, osl, ouid, opid,\

                                  opname, ssl, suid, spid, spname,\

                                  method, 1, (void *) xid)

#else  /* !DEBUG */

#define XTSOLERR(err_type, protocol, osl, ouid, opid, opname,\

                 ssl, suid, spid, spname, method, xid)

#define SXTSOLERR(err_type, protocol, osl, ouid, opid, opname,\

                  ssl, suid, spid, spname, method, xid)

#endif /* DEBUG */

int object_float(TsolInfoPtr, WindowPtr);

static void

set_audit_flags(TsolInfoPtr tsolinfo)

{

    if (tsolinfo->flags & TSOL_AUDITEVENT)

        tsolinfo->flags &= ~TSOL_AUDITEVENT;

    if (!(tsolinfo->flags & TSOL_DOXAUDIT))

        tsolinfo->flags |= TSOL_DOXAUDIT;

}

static void

unset_audit_flags(TsolInfoPtr tsolinfo)

{

    if (tsolinfo->flags & TSOL_AUDITEVENT)

        tsolinfo->flags &= ~TSOL_AUDITEVENT;

    if (tsolinfo->flags & TSOL_DOXAUDIT)

        tsolinfo->flags &= ~TSOL_DOXAUDIT;

}

/*

 * return 1 for success and 0 for failure

 * this routine contains the privd debugging for the system

 * as well as auditing the success or failure of use of priv.

 * Priv debugging will be done later TBD

 */

int

xpriv_policy(priv_set_t *set, priv_set_t *priv, xresource_t res,

			 xmethod_t method, void *subject, Bool do_audit)

{

	int	i;

	static int logopened = FALSE;

	int	status = 0;

	int audit_status = 0;

	ClientPtr client = subject;

	TsolInfoPtr tsolinfo = GetClientTsolInfo(client);

	if (priv_issubset(priv, set))

	{

		status = 1;

		audit_status = 1;

	}

	else

	{

		audit_status = 0;        

		if (!logopened)

		{

			/* LOG_USER doesn't work */

			openlog("xsun", 0, LOG_LOCAL0);

			logopened = TRUE;

		}

		/* if priv debugging is on, allow this priv to succeed */

		if (tsolinfo->priv_debug)

		{

#ifdef DEBUG

			ErrorF("%s:Allowed priv %ld\n", tsolinfo->pname, priv);

#endif /* DEBUG */

			syslog(LOG_DEBUG|LOG_LOCAL0, 

                   "DEBUG: %s pid %ld lacking privilege %d to %d %d",

                   "xclient", tsolinfo->pid, priv, method, res);

			status = 1;

            audit_status = 1;

		}

	}

	if (do_audit)

		auditwrite(AW_USEOFPRIV, audit_status, priv, AW_APPEND, AW_END);

	return (status);

}	/* xpriv_policy */

/*

 * The read/modify window policy are for window attributes & not

 * for window contents. read/modify pixel handle the contents policy

 */

/*

 * read_window

 */

int

read_window(xresource_t res, xmethod_t method, void *resource,

			void *subject, xpolicy_t policy_flags, void *misc)

{

	int ret_stat = PASSED;

	Bool do_audit = FALSE;

	int	err_code = BadWindow;

	WindowPtr pWin = resource;

	ClientPtr client = subject;

	ClientPtr ownerclient;

	TsolInfoPtr tsolinfo = GetClientTsolInfo(client);

	TsolInfoPtr tsolownerinfo;	/*client who owns the window */

	TsolResPtr tsolres =

		(TsolResPtr)(pWin->devPrivates[tsolWindowPrivateIndex].ptr);

	ownerclient = clients[CLIENT_ID(pWin->drawable.id)];

	tsolownerinfo = GetClientTsolInfo(ownerclient);

	/*

	 * Anyone can read RootWindow attributes

	 */

	if (WindowIsRoot(pWin))

	{

		return (PASSED);

	}

	/* optimization based on client id */

	if (SAMECLIENT(client, pWin->drawable.id))

	{

		return PASSED;

	}

	/*

	 * MAC Check

	*/

	if (policy_flags & TSOL_MAC)

	{

		if (!(blequal(tsolinfo->sl, tsolres->sl)))

		{

            if (tsolinfo->flags & TSOL_AUDITEVENT)

                do_audit = TRUE;

			if (xpriv_policy(tsolinfo->privs, pset_win_mac_read,

							 res, method, client, do_audit) ||

				(tsolownerinfo && HasWinSelection(tsolownerinfo))) 

			{

				ret_stat = PASSED;

			}

			else

			{

			    XTSOLERR("mac", (int) misc, tsolres->sl,

						 tsolres->uid, tsolres->pid, tsolres->pname,

						 tsolinfo->sl, tsolinfo->uid, tsolinfo->pid,

						 tsolinfo->pname, "read window", pWin->drawable.id);

				ret_stat = err_code;

			}

		}

	}

	/*

	 * DAC Check

	 */

	if ((ret_stat == PASSED) && policy_flags & TSOL_DAC)

	{

		/* uid == DEF_UID means public window, shared read */

		if (!(XTSOLTrusted(pWin) ||

			tsolres->uid == DEF_UID ||

			tsolinfo->uid == tsolres->uid))

		{

            if (tsolinfo->flags & TSOL_AUDITEVENT)

                do_audit = TRUE;

			if (xpriv_policy(tsolinfo->privs, pset_win_dac_read,

							 res, method, client, do_audit))

			{

				ret_stat = PASSED;

			}

			else

			{

				XTSOLERR("dac", (int) misc, tsolres->sl,

						 tsolres->uid, tsolres->pid, tsolres->pname,

						 tsolinfo->sl, tsolinfo->uid, tsolinfo->pid,

						 tsolinfo->pname, "read window", pWin->drawable.id);

				ret_stat = err_code;

			}

		}

	}

	if (do_audit)

    {

        set_audit_flags(tsolinfo);

		auditwrite(AW_XWINDOW, pWin->drawable.id, tsolres->uid,

				   AW_APPEND, AW_END);

    }

	return (ret_stat);

}	/* read_window */

/*

 * modify_window

 */

int

modify_window(xresource_t res, xmethod_t method, void *resource,

			  void *subject, xpolicy_t policy_flags, void *misc)

{

	int ret_stat = PASSED;

	Bool do_audit = FALSE;

	int	err_code = BadWindow;

	WindowPtr pWin = resource;

	ClientPtr client = subject;

	TsolInfoPtr tsolinfo = GetClientTsolInfo(client);

	TsolResPtr tsolres =

		(TsolResPtr)(pWin->devPrivates[tsolWindowPrivateIndex].ptr);

	/* optimization based on client id */

	if (SAMECLIENT(client, pWin->drawable.id))

	{

		return PASSED;

	}

	/*

	 * Trusted Path Windows require Trusted Path attrib

	 */

	if (XTSOLTrusted(pWin) && !HasTrustedPath(tsolinfo))

    {

        XTSOLERR("tp", (int) misc, tsolres->sl,

                 tsolres->uid, tsolres->pid, tsolres->pname,

                 tsolinfo->sl, tsolinfo->uid, tsolinfo->pid,

                 tsolinfo->pname, "modify window", pWin->drawable.id);

        ret_stat = err_code;

	}    

	/*

	 * MAC Check

	 */

	if ((ret_stat == PASSED) && policy_flags & TSOL_MAC)

	{

		if (!blequal(tsolinfo->sl, tsolres->sl))

		{

            if (tsolinfo->flags & TSOL_AUDITEVENT)

                do_audit = TRUE;

			if (xpriv_policy(tsolinfo->privs, pset_win_mac_write,

							 res, method, client, do_audit))

			{

				ret_stat = PASSED;

			}

			else

			{

				XTSOLERR("mac", (int) misc, tsolres->sl,

						 tsolres->uid, tsolres->pid, tsolres->pname,

						 tsolinfo->sl, tsolinfo->uid, tsolinfo->pid,

						 tsolinfo->pname, "modify window", pWin->drawable.id);

				ret_stat = err_code;

			}

		}

	}

	/*

	 * DAC Check

	 */

	if ((ret_stat == PASSED) && policy_flags & TSOL_DAC)

	{

		if (tsolinfo->uid != tsolres->uid)

		{

            if (tsolinfo->flags & TSOL_AUDITEVENT)

                do_audit = TRUE;

			if (xpriv_policy(tsolinfo->privs, pset_win_dac_write,

							 res, method, client, do_audit))

			{

				ret_stat = PASSED;

			}

			else

			{

				XTSOLERR("dac", (int) misc, tsolres->sl,

						 tsolres->uid, tsolres->pid, tsolres->pname,

						 tsolinfo->sl, tsolinfo->uid, tsolinfo->pid,

						 tsolinfo->pname, "modify window", pWin->drawable.id);

				ret_stat = err_code;

			}

		}

	}

	if (do_audit)

        {

            set_audit_flags(tsolinfo);

		auditwrite(AW_XWINDOW, pWin->drawable.id, tsolres->uid,

				   AW_APPEND, AW_END);

        }

	return (ret_stat);

}	/* modify_window */

/*

 * create_window

 */

int

create_window(xresource_t res, xmethod_t method, void *resource,

			  void *subject, xpolicy_t policy_flags, void *misc)

{

	int ret_stat = PASSED;

	Bool do_audit = FALSE;

	int	err_code = BadWindow;

	WindowPtr pWin = resource;	/* parent window */

	ClientPtr client = subject;

	TsolInfoPtr tsolinfo = GetClientTsolInfo(client);

	TsolResPtr  tsolres =

		(TsolResPtr)(pWin->devPrivates[tsolWindowPrivateIndex].ptr);

	/*

	 * Anyone can create a child of root window

	 */

	if (WindowIsRoot(pWin))

	{

		return (PASSED);

	}

	/*

	 * Trusted Path Windows required Trusted Path attrib

	 */

	if (XTSOLTrusted(pWin))

	{

		if (!HasTrustedPath(tsolinfo))

		{

			/*

			XTSOLERR("tp", (int) misc, tsolres->sl,

					 tsolres->uid, tsolres->pid, tsolres->pname,

					 tsolinfo->sl, tsolinfo->uid, tsolinfo->pid,

					 tsolinfo->pname, "create window", pWin->drawable.id); */

			return (err_code);

		}

	}

	/*

	 * MAC Check

	*/

	if (policy_flags & TSOL_MAC)

	{

		if (!blequal(tsolinfo->sl, tsolres->sl))

		{

			if (!SAMECLIENT(client, pWin->parent->drawable.id) &&

                (tsolinfo->flags & TSOL_AUDITEVENT))

            {

				do_audit = TRUE;

            }

			if (xpriv_policy(tsolinfo->privs, pset_win_mac_write,

							 res, method, client, do_audit))

			{

				ret_stat = PASSED;

			}

			else

			{

				XTSOLERR("mac", (int) misc, tsolres->sl,

						 tsolres->uid, tsolres->pid, tsolres->pname,

						 tsolinfo->sl, tsolinfo->uid, tsolinfo->pid,

						 tsolinfo->pname, "create window", pWin->drawable.id); 

				ret_stat = err_code;

			}

		}

	}

	/*

	 * DAC Check

	 */

	if ((ret_stat == PASSED) && policy_flags & TSOL_DAC)

	{

		if (tsolinfo->uid != tsolres->uid)

		{

			if (!SAMECLIENT(client, pWin->parent->drawable.id) &&

                (tsolinfo->flags & TSOL_AUDITEVENT))

            {

				do_audit = TRUE;

            }

			if (xpriv_policy(tsolinfo->privs, pset_win_dac_write,

							 res, method, client, do_audit))

			{

				ret_stat = PASSED;

			}

			else

			{

				XTSOLERR("dac", (int) misc, tsolres->sl,

						 tsolres->uid, tsolres->pid, tsolres->pname,

						 tsolinfo->sl, tsolinfo->uid, tsolinfo->pid,

						 tsolinfo->pname, "create window", pWin->drawable.id); 

				ret_stat = err_code;

			}

		}

	}

	if (do_audit)

    {

        set_audit_flags(tsolinfo);

		auditwrite(AW_XWINDOW, pWin->drawable.id, tsolres->uid,

				   AW_SLABEL, tsolres->sl,

				   AW_APPEND, AW_END);

    }

	return (ret_stat);

}	/* create_window */

/*

 * destroy_window

 */

int

destroy_window(xresource_t res, xmethod_t method, void *resource,

			   void *subject, xpolicy_t policy_flags, void *misc)

{

	int ret_stat = PASSED;

	Bool do_audit = FALSE;

	int	err_code = BadWindow;

	WindowPtr pWin = resource;

	ClientPtr client = subject;

	TsolInfoPtr tsolinfo = GetClientTsolInfo(client);

	TsolResPtr  tsolres =

		(TsolResPtr)(pWin->devPrivates[tsolWindowPrivateIndex].ptr);

	/*

	 * Trusted Path Windows required Trusted Path attrib

	 */

	if (XTSOLTrusted(pWin))

	{

		if (!HasTrustedPath(tsolinfo))

		{

			XTSOLERR("tp", (int) misc, tsolres->sl,

					 tsolres->uid, tsolres->pid, tsolres->pname,

					 tsolinfo->sl, tsolinfo->uid, tsolinfo->pid,

					 tsolinfo->pname, "destroy window", pWin->drawable.id);

			return (err_code);

		}

	}

	/*

	 * MAC Check

	 */

	if (policy_flags & TSOL_MAC)