?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
Linux 3.11-rc3
[cris-mirror.git] / security / selinux / hooks.c
blobc956390a9136b75a7fb8ed17ded49c69310b31cf
1 /*
2 * NSA Security-Enhanced Linux (SELinux) security module
3 *
4 * This file contains the SELinux hook function implementations.
5 *
6 * Authors: Stephen Smalley, <sds@epoch.ncsc.mil>
7 * Chris Vance, <cvance@nai.com>
8 * Wayne Salamon, <wsalamon@nai.com>
9 * James Morris <jmorris@redhat.com>
10 *
11 * Copyright (C) 2001,2002 Networks Associates Technology, Inc.
12 * Copyright (C) 2003-2008 Red Hat, Inc., James Morris <jmorris@redhat.com>
13 * Eric Paris <eparis@redhat.com>
14 * Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
15 * <dgoeddel@trustedcs.com>
16 * Copyright (C) 2006, 2007, 2009 Hewlett-Packard Development Company, L.P.
17 * Paul Moore <paul@paul-moore.com>
18 * Copyright (C) 2007 Hitachi Software Engineering Co., Ltd.
19 * Yuichi Nakamura <ynakam@hitachisoft.jp>
20 *
21 * This program is free software; you can redistribute it and/or modify
22 * it under the terms of the GNU General Public License version 2,
23 * as published by the Free Software Foundation.
24 */
25
26 #include <linux/init.h>
27 #include <linux/kd.h>
28 #include <linux/kernel.h>
29 #include <linux/tracehook.h>
30 #include <linux/errno.h>
31 #include <linux/sched.h>
32 #include <linux/security.h>
33 #include <linux/xattr.h>
34 #include <linux/capability.h>
35 #include <linux/unistd.h>
36 #include <linux/mm.h>
37 #include <linux/mman.h>
38 #include <linux/slab.h>
39 #include <linux/pagemap.h>
40 #include <linux/proc_fs.h>
41 #include <linux/swap.h>
42 #include <linux/spinlock.h>
43 #include <linux/syscalls.h>
44 #include <linux/dcache.h>
45 #include <linux/file.h>
46 #include <linux/fdtable.h>
47 #include <linux/namei.h>
48 #include <linux/mount.h>
49 #include <linux/netfilter_ipv4.h>
50 #include <linux/netfilter_ipv6.h>
51 #include <linux/tty.h>
52 #include <net/icmp.h>
53 #include <net/ip.h> /* for local_port_range[] */
54 #include <net/sock.h>
55 #include <net/tcp.h> /* struct or_callable used in sock_rcv_skb */
56 #include <net/net_namespace.h>
57 #include <net/netlabel.h>
58 #include <linux/uaccess.h>
59 #include <asm/ioctls.h>
60 #include <linux/atomic.h>
61 #include <linux/bitops.h>
62 #include <linux/interrupt.h>
63 #include <linux/netdevice.h> /* for network interface checks */
64 #include <net/netlink.h>
65 #include <linux/tcp.h>
66 #include <linux/udp.h>
67 #include <linux/dccp.h>
68 #include <linux/quota.h>
69 #include <linux/un.h> /* for Unix socket types */
70 #include <net/af_unix.h> /* for Unix socket types */
71 #include <linux/parser.h>
72 #include <linux/nfs_mount.h>
73 #include <net/ipv6.h>
74 #include <linux/hugetlb.h>
75 #include <linux/personality.h>
76 #include <linux/audit.h>
77 #include <linux/string.h>
78 #include <linux/selinux.h>
79 #include <linux/mutex.h>
80 #include <linux/posix-timers.h>
81 #include <linux/syslog.h>
82 #include <linux/user_namespace.h>
83 #include <linux/export.h>
84 #include <linux/security.h>
85 #include <linux/msg.h>
86 #include <linux/shm.h>
87
88 #include "avc.h"
89 #include "objsec.h"
90 #include "netif.h"
91 #include "netnode.h"
92 #include "netport.h"
93 #include "xfrm.h"
94 #include "netlabel.h"
95 #include "audit.h"
96 #include "avc_ss.h"
97
98 #define NUM_SEL_MNT_OPTS 5
99
100 extern struct security_operations *security_ops;
101
102 /* SECMARK reference count */
103 static atomic_t selinux_secmark_refcount = ATOMIC_INIT(0);
104
105 #ifdef CONFIG_SECURITY_SELINUX_DEVELOP
106 int selinux_enforcing;
107
108 static int __init enforcing_setup(char *str)
109 {
110 unsigned long enforcing;
111 if (!strict_strtoul(str, 0, &enforcing))
112 selinux_enforcing = enforcing ? 1 : 0;
113 return 1;
114 }
115 __setup("enforcing=", enforcing_setup);
116 #endif
117
118 #ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
119 int selinux_enabled = CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE;
120
121 static int __init selinux_enabled_setup(char *str)
122 {
123 unsigned long enabled;
124 if (!strict_strtoul(str, 0, &enabled))
125 selinux_enabled = enabled ? 1 : 0;
126 return 1;
127 }
128 __setup("selinux=", selinux_enabled_setup);
129 #else
130 int selinux_enabled = 1;
131 #endif
132
133 static struct kmem_cache *sel_inode_cache;
134
135 /**
136 * selinux_secmark_enabled - Check to see if SECMARK is currently enabled
137 *
138 * Description:
139 * This function checks the SECMARK reference counter to see if any SECMARK
140 * targets are currently configured, if the reference counter is greater than
141 * zero SECMARK is considered to be enabled. Returns true (1) if SECMARK is
142 * enabled, false (0) if SECMARK is disabled.
143 *
144 */
145 static int selinux_secmark_enabled(void)
146 {
147 return (atomic_read(&selinux_secmark_refcount) > 0);
148 }
149
150 /*
151 * initialise the security for the init task
152 */
153 static void cred_init_security(void)
154 {
155 struct cred *cred = (struct cred *) current->real_cred;
156 struct task_security_struct *tsec;
157
158 tsec = kzalloc(sizeof(struct task_security_struct), GFP_KERNEL);
159 if (!tsec)
160 panic("SELinux: Failed to initialize initial task.\n");
161
162 tsec->osid = tsec->sid = SECINITSID_KERNEL;
163 cred->security = tsec;
164 }
165
166 /*
167 * get the security ID of a set of credentials
168 */
169 static inline u32 cred_sid(const struct cred *cred)
170 {
171 const struct task_security_struct *tsec;
172
173 tsec = cred->security;
174 return tsec->sid;
175 }
176
177 /*
178 * get the objective security ID of a task
179 */
180 static inline u32 task_sid(const struct task_struct *task)
181 {
182 u32 sid;
183
184 rcu_read_lock();
185 sid = cred_sid(__task_cred(task));
186 rcu_read_unlock();
187 return sid;
188 }
189
190 /*
191 * get the subjective security ID of the current task
192 */
193 static inline u32 current_sid(void)
194 {
195 const struct task_security_struct *tsec = current_security();
196
197 return tsec->sid;
198 }
199
200 /* Allocate and free functions for each kind of security blob. */
201
202 static int inode_alloc_security(struct inode *inode)
203 {
204 struct inode_security_struct *isec;
205 u32 sid = current_sid();
206
207 isec = kmem_cache_zalloc(sel_inode_cache, GFP_NOFS);
208 if (!isec)
209 return -ENOMEM;
210
211 mutex_init(&isec->lock);
212 INIT_LIST_HEAD(&isec->list);
213 isec->inode = inode;
214 isec->sid = SECINITSID_UNLABELED;
215 isec->sclass = SECCLASS_FILE;
216 isec->task_sid = sid;
217 inode->i_security = isec;
218
219 return 0;
220 }
221
222 static void inode_free_security(struct inode *inode)
223 {
224 struct inode_security_struct *isec = inode->i_security;
225 struct superblock_security_struct *sbsec = inode->i_sb->s_security;
226
227 spin_lock(&sbsec->isec_lock);
228 if (!list_empty(&isec->list))
229 list_del_init(&isec->list);
230 spin_unlock(&sbsec->isec_lock);
231
232 inode->i_security = NULL;
233 kmem_cache_free(sel_inode_cache, isec);
234 }
235
236 static int file_alloc_security(struct file *file)
237 {
238 struct file_security_struct *fsec;
239 u32 sid = current_sid();
240
241 fsec = kzalloc(sizeof(struct file_security_struct), GFP_KERNEL);
242 if (!fsec)
243 return -ENOMEM;
244
245 fsec->sid = sid;
246 fsec->fown_sid = sid;
247 file->f_security = fsec;
248
249 return 0;
250 }
251
252 static void file_free_security(struct file *file)
253 {
254 struct file_security_struct *fsec = file->f_security;
255 file->f_security = NULL;
256 kfree(fsec);
257 }
258
259 static int superblock_alloc_security(struct super_block *sb)
260 {
261 struct superblock_security_struct *sbsec;
262
263 sbsec = kzalloc(sizeof(struct superblock_security_struct), GFP_KERNEL);
264 if (!sbsec)
265 return -ENOMEM;
266
267 mutex_init(&sbsec->lock);
268 INIT_LIST_HEAD(&sbsec->isec_head);
269 spin_lock_init(&sbsec->isec_lock);
270 sbsec->sb = sb;
271 sbsec->sid = SECINITSID_UNLABELED;
272 sbsec->def_sid = SECINITSID_FILE;
273 sbsec->mntpoint_sid = SECINITSID_UNLABELED;
274 sb->s_security = sbsec;
275
276 return 0;
277 }
278
279 static void superblock_free_security(struct super_block *sb)
280 {
281 struct superblock_security_struct *sbsec = sb->s_security;
282 sb->s_security = NULL;
283 kfree(sbsec);
284 }
285
286 /* The file system's label must be initialized prior to use. */
287
288 static const char *labeling_behaviors[7] = {
289 "uses xattr",
290 "uses transition SIDs",
291 "uses task SIDs",
292 "uses genfs_contexts",
293 "not configured for labeling",
294 "uses mountpoint labeling",
295 "uses native labeling",
296 };
297
298 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
299
300 static inline int inode_doinit(struct inode *inode)
301 {
302 return inode_doinit_with_dentry(inode, NULL);
303 }
304
305 enum {
306 Opt_error = -1,
307 Opt_context = 1,
308 Opt_fscontext = 2,
309 Opt_defcontext = 3,
310 Opt_rootcontext = 4,
311 Opt_labelsupport = 5,
312 };
313
314 static const match_table_t tokens = {
315 {Opt_context, CONTEXT_STR "%s"},
316 {Opt_fscontext, FSCONTEXT_STR "%s"},
317 {Opt_defcontext, DEFCONTEXT_STR "%s"},
318 {Opt_rootcontext, ROOTCONTEXT_STR "%s"},
319 {Opt_labelsupport, LABELSUPP_STR},
320 {Opt_error, NULL},
321 };
322
323 #define SEL_MOUNT_FAIL_MSG "SELinux: duplicate or incompatible mount options\n"
324
325 static int may_context_mount_sb_relabel(u32 sid,
326 struct superblock_security_struct *sbsec,
327 const struct cred *cred)
328 {
329 const struct task_security_struct *tsec = cred->security;
330 int rc;
331
332 rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
333 FILESYSTEM__RELABELFROM, NULL);
334 if (rc)
335 return rc;
336
337 rc = avc_has_perm(tsec->sid, sid, SECCLASS_FILESYSTEM,
338 FILESYSTEM__RELABELTO, NULL);
339 return rc;
340 }
341
342 static int may_context_mount_inode_relabel(u32 sid,
343 struct superblock_security_struct *sbsec,
344 const struct cred *cred)
345 {
346 const struct task_security_struct *tsec = cred->security;
347 int rc;
348 rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
349 FILESYSTEM__RELABELFROM, NULL);
350 if (rc)
351 return rc;
352
353 rc = avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM,
354 FILESYSTEM__ASSOCIATE, NULL);
355 return rc;
356 }
357
358 static int sb_finish_set_opts(struct super_block *sb)
359 {
360 struct superblock_security_struct *sbsec = sb->s_security;
361 struct dentry *root = sb->s_root;
362 struct inode *root_inode = root->d_inode;
363 int rc = 0;
364
365 if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
366 /* Make sure that the xattr handler exists and that no
367 error other than -ENODATA is returned by getxattr on
368 the root directory. -ENODATA is ok, as this may be
369 the first boot of the SELinux kernel before we have
370 assigned xattr values to the filesystem. */
371 if (!root_inode->i_op->getxattr) {
372 printk(KERN_WARNING "SELinux: (dev %s, type %s) has no "
373 "xattr support\n", sb->s_id, sb->s_type->name);
374 rc = -EOPNOTSUPP;
375 goto out;
376 }
377 rc = root_inode->i_op->getxattr(root, XATTR_NAME_SELINUX, NULL, 0);
378 if (rc < 0 && rc != -ENODATA) {
379 if (rc == -EOPNOTSUPP)
380 printk(KERN_WARNING "SELinux: (dev %s, type "
381 "%s) has no security xattr handler\n",
382 sb->s_id, sb->s_type->name);
383 else
384 printk(KERN_WARNING "SELinux: (dev %s, type "
385 "%s) getxattr errno %d\n", sb->s_id,
386 sb->s_type->name, -rc);
387 goto out;
388 }
389 }
390
391 sbsec->flags |= (SE_SBINITIALIZED | SE_SBLABELSUPP);
392
393 if (sbsec->behavior > ARRAY_SIZE(labeling_behaviors))
394 printk(KERN_ERR "SELinux: initialized (dev %s, type %s), unknown behavior\n",
395 sb->s_id, sb->s_type->name);
396 else
397 printk(KERN_DEBUG "SELinux: initialized (dev %s, type %s), %s\n",
398 sb->s_id, sb->s_type->name,
399 labeling_behaviors[sbsec->behavior-1]);
400
401 if (sbsec->behavior == SECURITY_FS_USE_GENFS ||
402 sbsec->behavior == SECURITY_FS_USE_MNTPOINT ||
403 sbsec->behavior == SECURITY_FS_USE_NONE ||
404 sbsec->behavior > ARRAY_SIZE(labeling_behaviors))
405 sbsec->flags &= ~SE_SBLABELSUPP;
406
407 /* Special handling for sysfs. Is genfs but also has setxattr handler*/
408 if (strncmp(sb->s_type->name, "sysfs", sizeof("sysfs")) == 0)
409 sbsec->flags |= SE_SBLABELSUPP;
410
411 /* Initialize the root inode. */
412 rc = inode_doinit_with_dentry(root_inode, root);
413
414 /* Initialize any other inodes associated with the superblock, e.g.
415 inodes created prior to initial policy load or inodes created
416 during get_sb by a pseudo filesystem that directly
417 populates itself. */
418 spin_lock(&sbsec->isec_lock);
419 next_inode:
420 if (!list_empty(&sbsec->isec_head)) {
421 struct inode_security_struct *isec =
422 list_entry(sbsec->isec_head.next,
423 struct inode_security_struct, list);
424 struct inode *inode = isec->inode;
425 spin_unlock(&sbsec->isec_lock);
426 inode = igrab(inode);
427 if (inode) {
428 if (!IS_PRIVATE(inode))
429 inode_doinit(inode);
430 iput(inode);
431 }
432 spin_lock(&sbsec->isec_lock);
433 list_del_init(&isec->list);
434 goto next_inode;
435 }
436 spin_unlock(&sbsec->isec_lock);
437 out:
438 return rc;
439 }
440
441 /*
442 * This function should allow an FS to ask what it's mount security
443 * options were so it can use those later for submounts, displaying
444 * mount options, or whatever.
445 */
446 static int selinux_get_mnt_opts(const struct super_block *sb,
447 struct security_mnt_opts *opts)
448 {
449 int rc = 0, i;
450 struct superblock_security_struct *sbsec = sb->s_security;
451 char *context = NULL;
452 u32 len;
453 char tmp;
454
455 security_init_mnt_opts(opts);
456
457 if (!(sbsec->flags & SE_SBINITIALIZED))
458 return -EINVAL;
459
460 if (!ss_initialized)
461 return -EINVAL;
462
463 tmp = sbsec->flags & SE_MNTMASK;
464 /* count the number of mount options for this sb */
465 for (i = 0; i < 8; i++) {
466 if (tmp & 0x01)
467 opts->num_mnt_opts++;
468 tmp >>= 1;
469 }
470 /* Check if the Label support flag is set */
471 if (sbsec->flags & SE_SBLABELSUPP)
472 opts->num_mnt_opts++;
473
474 opts->mnt_opts = kcalloc(opts->num_mnt_opts, sizeof(char *), GFP_ATOMIC);
475 if (!opts->mnt_opts) {
476 rc = -ENOMEM;
477 goto out_free;
478 }
479
480 opts->mnt_opts_flags = kcalloc(opts->num_mnt_opts, sizeof(int), GFP_ATOMIC);
481 if (!opts->mnt_opts_flags) {
482 rc = -ENOMEM;
483 goto out_free;
484 }
485
486 i = 0;
487 if (sbsec->flags & FSCONTEXT_MNT) {
488 rc = security_sid_to_context(sbsec->sid, &context, &len);
489 if (rc)
490 goto out_free;
491 opts->mnt_opts[i] = context;
492 opts->mnt_opts_flags[i++] = FSCONTEXT_MNT;
493 }
494 if (sbsec->flags & CONTEXT_MNT) {
495 rc = security_sid_to_context(sbsec->mntpoint_sid, &context, &len);
496 if (rc)
497 goto out_free;
498 opts->mnt_opts[i] = context;
499 opts->mnt_opts_flags[i++] = CONTEXT_MNT;
500 }
501 if (sbsec->flags & DEFCONTEXT_MNT) {
502 rc = security_sid_to_context(sbsec->def_sid, &context, &len);
503 if (rc)
504 goto out_free;
505 opts->mnt_opts[i] = context;
506 opts->mnt_opts_flags[i++] = DEFCONTEXT_MNT;
507 }
508 if (sbsec->flags & ROOTCONTEXT_MNT) {
509 struct inode *root = sbsec->sb->s_root->d_inode;
510 struct inode_security_struct *isec = root->i_security;
511
512 rc = security_sid_to_context(isec->sid, &context, &len);
513 if (rc)
514 goto out_free;
515 opts->mnt_opts[i] = context;
516 opts->mnt_opts_flags[i++] = ROOTCONTEXT_MNT;
517 }
518 if (sbsec->flags & SE_SBLABELSUPP) {
519 opts->mnt_opts[i] = NULL;
520 opts->mnt_opts_flags[i++] = SE_SBLABELSUPP;
521 }
522
523 BUG_ON(i != opts->num_mnt_opts);
524
525 return 0;
526
527 out_free:
528 security_free_mnt_opts(opts);
529 return rc;
530 }
531
532 static int bad_option(struct superblock_security_struct *sbsec, char flag,
533 u32 old_sid, u32 new_sid)
534 {
535 char mnt_flags = sbsec->flags & SE_MNTMASK;
536
537 /* check if the old mount command had the same options */
538 if (sbsec->flags & SE_SBINITIALIZED)
539 if (!(sbsec->flags & flag) ||
540 (old_sid != new_sid))
541 return 1;
542
543 /* check if we were passed the same options twice,
544 * aka someone passed context=a,context=b
545 */
546 if (!(sbsec->flags & SE_SBINITIALIZED))
547 if (mnt_flags & flag)
548 return 1;
549 return 0;
550 }
551
552 /*
553 * Allow filesystems with binary mount data to explicitly set mount point
554 * labeling information.
555 */
556 static int selinux_set_mnt_opts(struct super_block *sb,
557 struct security_mnt_opts *opts,
558 unsigned long kern_flags,
559 unsigned long *set_kern_flags)
560 {
561 const struct cred *cred = current_cred();
562 int rc = 0, i;
563 struct superblock_security_struct *sbsec = sb->s_security;
564 const char *name = sb->s_type->name;
565 struct inode *inode = sbsec->sb->s_root->d_inode;
566 struct inode_security_struct *root_isec = inode->i_security;
567 u32 fscontext_sid = 0, context_sid = 0, rootcontext_sid = 0;
568 u32 defcontext_sid = 0;
569 char **mount_options = opts->mnt_opts;
570 int *flags = opts->mnt_opts_flags;
571 int num_opts = opts->num_mnt_opts;
572
573 mutex_lock(&sbsec->lock);
574
575 if (!ss_initialized) {
576 if (!num_opts) {
577 /* Defer initialization until selinux_complete_init,
578 after the initial policy is loaded and the security
579 server is ready to handle calls. */
580 goto out;
581 }
582 rc = -EINVAL;
583 printk(KERN_WARNING "SELinux: Unable to set superblock options "
584 "before the security server is initialized\n");
585 goto out;
586 }
587 if (kern_flags && !set_kern_flags) {
588 /* Specifying internal flags without providing a place to
589 * place the results is not allowed */
590 rc = -EINVAL;
591 goto out;
592 }
593
594 /*
595 * Binary mount data FS will come through this function twice. Once
596 * from an explicit call and once from the generic calls from the vfs.
597 * Since the generic VFS calls will not contain any security mount data
598 * we need to skip the double mount verification.
599 *
600 * This does open a hole in which we will not notice if the first
601 * mount using this sb set explict options and a second mount using
602 * this sb does not set any security options. (The first options
603 * will be used for both mounts)
604 */
605 if ((sbsec->flags & SE_SBINITIALIZED) && (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
606 && (num_opts == 0))
607 goto out;
608
609 /*
610 * parse the mount options, check if they are valid sids.
611 * also check if someone is trying to mount the same sb more
612 * than once with different security options.
613 */
614 for (i = 0; i < num_opts; i++) {
615 u32 sid;
616
617 if (flags[i] == SE_SBLABELSUPP)
618 continue;
619 rc = security_context_to_sid(mount_options[i],
620 strlen(mount_options[i]), &sid);
621 if (rc) {
622 printk(KERN_WARNING "SELinux: security_context_to_sid"
623 "(%s) failed for (dev %s, type %s) errno=%d\n",
624 mount_options[i], sb->s_id, name, rc);
625 goto out;
626 }
627 switch (flags[i]) {
628 case FSCONTEXT_MNT:
629 fscontext_sid = sid;
630
631 if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid,
632 fscontext_sid))
633 goto out_double_mount;
634
635 sbsec->flags |= FSCONTEXT_MNT;
636 break;
637 case CONTEXT_MNT:
638 context_sid = sid;
639
640 if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid,
641 context_sid))
642 goto out_double_mount;
643
644 sbsec->flags |= CONTEXT_MNT;
645 break;
646 case ROOTCONTEXT_MNT:
647 rootcontext_sid = sid;
648
649 if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid,
650 rootcontext_sid))
651 goto out_double_mount;
652
653 sbsec->flags |= ROOTCONTEXT_MNT;
654
655 break;
656 case DEFCONTEXT_MNT:
657 defcontext_sid = sid;
658
659 if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid,
660 defcontext_sid))
661 goto out_double_mount;
662
663 sbsec->flags |= DEFCONTEXT_MNT;
664
665 break;
666 default:
667 rc = -EINVAL;
668 goto out;
669 }
670 }
671
672 if (sbsec->flags & SE_SBINITIALIZED) {
673 /* previously mounted with options, but not on this attempt? */
674 if ((sbsec->flags & SE_MNTMASK) && !num_opts)
675 goto out_double_mount;
676 rc = 0;
677 goto out;
678 }
679
680 if (strcmp(sb->s_type->name, "proc") == 0)
681 sbsec->flags |= SE_SBPROC;
682
683 if (!sbsec->behavior) {
684 /*
685 * Determine the labeling behavior to use for this
686 * filesystem type.
687 */
688 rc = security_fs_use((sbsec->flags & SE_SBPROC) ?
689 "proc" : sb->s_type->name,
690 &sbsec->behavior, &sbsec->sid);
691 if (rc) {
692 printk(KERN_WARNING
693 "%s: security_fs_use(%s) returned %d\n",
694 __func__, sb->s_type->name, rc);
695 goto out;
696 }
697 }
698 /* sets the context of the superblock for the fs being mounted. */
699 if (fscontext_sid) {
700 rc = may_context_mount_sb_relabel(fscontext_sid, sbsec, cred);
701 if (rc)
702 goto out;
703
704 sbsec->sid = fscontext_sid;
705 }
706
707 /*
708 * Switch to using mount point labeling behavior.
709 * sets the label used on all file below the mountpoint, and will set
710 * the superblock context if not already set.
711 */
712 if (kern_flags & SECURITY_LSM_NATIVE_LABELS && !context_sid) {
713 sbsec->behavior = SECURITY_FS_USE_NATIVE;
714 *set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
715 }
716
717 if (context_sid) {
718 if (!fscontext_sid) {
719 rc = may_context_mount_sb_relabel(context_sid, sbsec,
720 cred);
721 if (rc)
722 goto out;
723 sbsec->sid = context_sid;
724 } else {
725 rc = may_context_mount_inode_relabel(context_sid, sbsec,
726 cred);
727 if (rc)
728 goto out;
729 }
730 if (!rootcontext_sid)
731 rootcontext_sid = context_sid;
732
733 sbsec->mntpoint_sid = context_sid;
734 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
735 }
736
737 if (rootcontext_sid) {
738 rc = may_context_mount_inode_relabel(rootcontext_sid, sbsec,
739 cred);
740 if (rc)
741 goto out;
742
743 root_isec->sid = rootcontext_sid;
744 root_isec->initialized = 1;
745 }
746
747 if (defcontext_sid) {
748 if (sbsec->behavior != SECURITY_FS_USE_XATTR &&
749 sbsec->behavior != SECURITY_FS_USE_NATIVE) {
750 rc = -EINVAL;
751 printk(KERN_WARNING "SELinux: defcontext option is "
752 "invalid for this filesystem type\n");
753 goto out;
754 }
755
756 if (defcontext_sid != sbsec->def_sid) {
757 rc = may_context_mount_inode_relabel(defcontext_sid,
758 sbsec, cred);
759 if (rc)
760 goto out;
761 }
762
763 sbsec->def_sid = defcontext_sid;
764 }
765
766 rc = sb_finish_set_opts(sb);
767 out:
768 mutex_unlock(&sbsec->lock);
769 return rc;
770 out_double_mount:
771 rc = -EINVAL;
772 printk(KERN_WARNING "SELinux: mount invalid. Same superblock, different "
773 "security settings for (dev %s, type %s)\n", sb->s_id, name);
774 goto out;
775 }
776
777 static int selinux_cmp_sb_context(const struct super_block *oldsb,
778 const struct super_block *newsb)
779 {
780 struct superblock_security_struct *old = oldsb->s_security;
781 struct superblock_security_struct *new = newsb->s_security;
782 char oldflags = old->flags & SE_MNTMASK;
783 char newflags = new->flags & SE_MNTMASK;
784
785 if (oldflags != newflags)
786 goto mismatch;
787 if ((oldflags & FSCONTEXT_MNT) && old->sid != new->sid)
788 goto mismatch;
789 if ((oldflags & CONTEXT_MNT) && old->mntpoint_sid != new->mntpoint_sid)
790 goto mismatch;
791 if ((oldflags & DEFCONTEXT_MNT) && old->def_sid != new->def_sid)
792 goto mismatch;
793 if (oldflags & ROOTCONTEXT_MNT) {
794 struct inode_security_struct *oldroot = oldsb->s_root->d_inode->i_security;
795 struct inode_security_struct *newroot = newsb->s_root->d_inode->i_security;
796 if (oldroot->sid != newroot->sid)
797 goto mismatch;
798 }
799 return 0;
800 mismatch:
801 printk(KERN_WARNING "SELinux: mount invalid. Same superblock, "
802 "different security settings for (dev %s, "
803 "type %s)\n", newsb->s_id, newsb->s_type->name);
804 return -EBUSY;
805 }
806
807 static int selinux_sb_clone_mnt_opts(const struct super_block *oldsb,
808 struct super_block *newsb)
809 {
810 const struct superblock_security_struct *oldsbsec = oldsb->s_security;
811 struct superblock_security_struct *newsbsec = newsb->s_security;
812
813 int set_fscontext = (oldsbsec->flags & FSCONTEXT_MNT);
814 int set_context = (oldsbsec->flags & CONTEXT_MNT);
815 int set_rootcontext = (oldsbsec->flags & ROOTCONTEXT_MNT);
816
817 /*
818 * if the parent was able to be mounted it clearly had no special lsm
819 * mount options. thus we can safely deal with this superblock later
820 */
821 if (!ss_initialized)
822 return 0;
823
824 /* how can we clone if the old one wasn't set up?? */
825 BUG_ON(!(oldsbsec->flags & SE_SBINITIALIZED));
826
827 /* if fs is reusing a sb, make sure that the contexts match */
828 if (newsbsec->flags & SE_SBINITIALIZED)
829 return selinux_cmp_sb_context(oldsb, newsb);
830
831 mutex_lock(&newsbsec->lock);
832
833 newsbsec->flags = oldsbsec->flags;
834
835 newsbsec->sid = oldsbsec->sid;
836 newsbsec->def_sid = oldsbsec->def_sid;
837 newsbsec->behavior = oldsbsec->behavior;
838
839 if (set_context) {
840 u32 sid = oldsbsec->mntpoint_sid;
841
842 if (!set_fscontext)
843 newsbsec->sid = sid;
844 if (!set_rootcontext) {
845 struct inode *newinode = newsb->s_root->d_inode;
846 struct inode_security_struct *newisec = newinode->i_security;
847 newisec->sid = sid;
848 }
849 newsbsec->mntpoint_sid = sid;
850 }
851 if (set_rootcontext) {
852 const struct inode *oldinode = oldsb->s_root->d_inode;
853 const struct inode_security_struct *oldisec = oldinode->i_security;
854 struct inode *newinode = newsb->s_root->d_inode;
855 struct inode_security_struct *newisec = newinode->i_security;
856
857 newisec->sid = oldisec->sid;
858 }
859
860 sb_finish_set_opts(newsb);
861 mutex_unlock(&newsbsec->lock);
862 return 0;
863 }
864
865 static int selinux_parse_opts_str(char *options,
866 struct security_mnt_opts *opts)
867 {
868 char *p;
869 char *context = NULL, *defcontext = NULL;
870 char *fscontext = NULL, *rootcontext = NULL;
871 int rc, num_mnt_opts = 0;
872
873 opts->num_mnt_opts = 0;
874
875 /* Standard string-based options. */
876 while ((p = strsep(&options, "|")) != NULL) {
877 int token;
878 substring_t args[MAX_OPT_ARGS];
879
880 if (!*p)
881 continue;
882
883 token = match_token(p, tokens, args);
884
885 switch (token) {
886 case Opt_context:
887 if (context || defcontext) {
888 rc = -EINVAL;
889 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
890 goto out_err;
891 }
892 context = match_strdup(&args[0]);
893 if (!context) {
894 rc = -ENOMEM;
895 goto out_err;
896 }
897 break;
898
899 case Opt_fscontext:
900 if (fscontext) {
901 rc = -EINVAL;
902 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
903 goto out_err;
904 }
905 fscontext = match_strdup(&args[0]);
906 if (!fscontext) {
907 rc = -ENOMEM;
908 goto out_err;
909 }
910 break;
911
912 case Opt_rootcontext:
913 if (rootcontext) {
914 rc = -EINVAL;
915 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
916 goto out_err;
917 }
918 rootcontext = match_strdup(&args[0]);
919 if (!rootcontext) {
920 rc = -ENOMEM;
921 goto out_err;
922 }
923 break;
924
925 case Opt_defcontext:
926 if (context || defcontext) {
927 rc = -EINVAL;
928 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
929 goto out_err;
930 }
931 defcontext = match_strdup(&args[0]);
932 if (!defcontext) {
933 rc = -ENOMEM;
934 goto out_err;
935 }
936 break;
937 case Opt_labelsupport:
938 break;
939 default:
940 rc = -EINVAL;
941 printk(KERN_WARNING "SELinux: unknown mount option\n");
942 goto out_err;
943
944 }
945 }
946
947 rc = -ENOMEM;
948 opts->mnt_opts = kcalloc(NUM_SEL_MNT_OPTS, sizeof(char *), GFP_ATOMIC);
949 if (!opts->mnt_opts)
950 goto out_err;
951
952 opts->mnt_opts_flags = kcalloc(NUM_SEL_MNT_OPTS, sizeof(int), GFP_ATOMIC);
953 if (!opts->mnt_opts_flags) {
954 kfree(opts->mnt_opts);
955 goto out_err;
956 }
957
958 if (fscontext) {
959 opts->mnt_opts[num_mnt_opts] = fscontext;
960 opts->mnt_opts_flags[num_mnt_opts++] = FSCONTEXT_MNT;
961 }
962 if (context) {
963 opts->mnt_opts[num_mnt_opts] = context;
964 opts->mnt_opts_flags[num_mnt_opts++] = CONTEXT_MNT;
965 }
966 if (rootcontext) {
967 opts->mnt_opts[num_mnt_opts] = rootcontext;
968 opts->mnt_opts_flags[num_mnt_opts++] = ROOTCONTEXT_MNT;
969 }
970 if (defcontext) {
971 opts->mnt_opts[num_mnt_opts] = defcontext;
972 opts->mnt_opts_flags[num_mnt_opts++] = DEFCONTEXT_MNT;
973 }
974
975 opts->num_mnt_opts = num_mnt_opts;
976 return 0;
977
978 out_err:
979 kfree(context);
980 kfree(defcontext);
981 kfree(fscontext);
982 kfree(rootcontext);
983 return rc;
984 }
985 /*
986 * string mount options parsing and call set the sbsec
987 */
988 static int superblock_doinit(struct super_block *sb, void *data)
989 {
990 int rc = 0;
991 char *options = data;
992 struct security_mnt_opts opts;
993
994 security_init_mnt_opts(&opts);
995
996 if (!data)
997 goto out;
998
999 BUG_ON(sb->s_type->fs_flags & FS_BINARY_MOUNTDATA);
1000
1001 rc = selinux_parse_opts_str(options, &opts);
1002 if (rc)
1003 goto out_err;
1004
1005 out:
1006 rc = selinux_set_mnt_opts(sb, &opts, 0, NULL);
1007
1008 out_err:
1009 security_free_mnt_opts(&opts);
1010 return rc;
1011 }
1012
1013 static void selinux_write_opts(struct seq_file *m,
1014 struct security_mnt_opts *opts)
1015 {
1016 int i;
1017 char *prefix;
1018
1019 for (i = 0; i < opts->num_mnt_opts; i++) {
1020 char *has_comma;
1021
1022 if (opts->mnt_opts[i])
1023 has_comma = strchr(opts->mnt_opts[i], ',');
1024 else
1025 has_comma = NULL;
1026
1027 switch (opts->mnt_opts_flags[i]) {
1028 case CONTEXT_MNT:
1029 prefix = CONTEXT_STR;
1030 break;
1031 case FSCONTEXT_MNT:
1032 prefix = FSCONTEXT_STR;
1033 break;
1034 case ROOTCONTEXT_MNT:
1035 prefix = ROOTCONTEXT_STR;
1036 break;
1037 case DEFCONTEXT_MNT:
1038 prefix = DEFCONTEXT_STR;
1039 break;
1040 case SE_SBLABELSUPP:
1041 seq_putc(m, ',');
1042 seq_puts(m, LABELSUPP_STR);
1043 continue;
1044 default:
1045 BUG();
1046 return;
1047 };
1048 /* we need a comma before each option */
1049 seq_putc(m, ',');
1050 seq_puts(m, prefix);
1051 if (has_comma)
1052 seq_putc(m, '\"');
1053 seq_puts(m, opts->mnt_opts[i]);
1054 if (has_comma)
1055 seq_putc(m, '\"');
1056 }
1057 }
1058
1059 static int selinux_sb_show_options(struct seq_file *m, struct super_block *sb)
1060 {
1061 struct security_mnt_opts opts;
1062 int rc;
1063
1064 rc = selinux_get_mnt_opts(sb, &opts);
1065 if (rc) {
1066 /* before policy load we may get EINVAL, don't show anything */
1067 if (rc == -EINVAL)
1068 rc = 0;
1069 return rc;
1070 }
1071
1072 selinux_write_opts(m, &opts);
1073
1074 security_free_mnt_opts(&opts);
1075
1076 return rc;
1077 }
1078
1079 static inline u16 inode_mode_to_security_class(umode_t mode)
1080 {
1081 switch (mode & S_IFMT) {
1082 case S_IFSOCK:
1083 return SECCLASS_SOCK_FILE;
1084 case S_IFLNK:
1085 return SECCLASS_LNK_FILE;
1086 case S_IFREG:
1087 return SECCLASS_FILE;
1088 case S_IFBLK:
1089 return SECCLASS_BLK_FILE;
1090 case S_IFDIR:
1091 return SECCLASS_DIR;
1092 case S_IFCHR:
1093 return SECCLASS_CHR_FILE;
1094 case S_IFIFO:
1095 return SECCLASS_FIFO_FILE;
1096
1097 }
1098
1099 return SECCLASS_FILE;
1100 }
1101
1102 static inline int default_protocol_stream(int protocol)
1103 {
1104 return (protocol == IPPROTO_IP || protocol == IPPROTO_TCP);
1105 }
1106
1107 static inline int default_protocol_dgram(int protocol)
1108 {
1109 return (protocol == IPPROTO_IP || protocol == IPPROTO_UDP);
1110 }
1111
1112 static inline u16 socket_type_to_security_class(int family, int type, int protocol)
1113 {
1114 switch (family) {
1115 case PF_UNIX:
1116 switch (type) {
1117 case SOCK_STREAM:
1118 case SOCK_SEQPACKET:
1119 return SECCLASS_UNIX_STREAM_SOCKET;
1120 case SOCK_DGRAM:
1121 return SECCLASS_UNIX_DGRAM_SOCKET;
1122 }
1123 break;
1124 case PF_INET:
1125 case PF_INET6:
1126 switch (type) {
1127 case SOCK_STREAM:
1128 if (default_protocol_stream(protocol))
1129 return SECCLASS_TCP_SOCKET;
1130 else
1131 return SECCLASS_RAWIP_SOCKET;
1132 case SOCK_DGRAM:
1133 if (default_protocol_dgram(protocol))
1134 return SECCLASS_UDP_SOCKET;
1135 else
1136 return SECCLASS_RAWIP_SOCKET;
1137 case SOCK_DCCP:
1138 return SECCLASS_DCCP_SOCKET;
1139 default:
1140 return SECCLASS_RAWIP_SOCKET;
1141 }
1142 break;
1143 case PF_NETLINK:
1144 switch (protocol) {
1145 case NETLINK_ROUTE:
1146 return SECCLASS_NETLINK_ROUTE_SOCKET;
1147 case NETLINK_FIREWALL:
1148 return SECCLASS_NETLINK_FIREWALL_SOCKET;
1149 case NETLINK_SOCK_DIAG:
1150 return SECCLASS_NETLINK_TCPDIAG_SOCKET;
1151 case NETLINK_NFLOG:
1152 return SECCLASS_NETLINK_NFLOG_SOCKET;
1153 case NETLINK_XFRM:
1154 return SECCLASS_NETLINK_XFRM_SOCKET;
1155 case NETLINK_SELINUX:
1156 return SECCLASS_NETLINK_SELINUX_SOCKET;
1157 case NETLINK_AUDIT:
1158 return SECCLASS_NETLINK_AUDIT_SOCKET;
1159 case NETLINK_IP6_FW:
1160 return SECCLASS_NETLINK_IP6FW_SOCKET;
1161 case NETLINK_DNRTMSG:
1162 return SECCLASS_NETLINK_DNRT_SOCKET;
1163 case NETLINK_KOBJECT_UEVENT:
1164 return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET;
1165 default:
1166 return SECCLASS_NETLINK_SOCKET;
1167 }
1168 case PF_PACKET:
1169 return SECCLASS_PACKET_SOCKET;
1170 case PF_KEY:
1171 return SECCLASS_KEY_SOCKET;
1172 case PF_APPLETALK:
1173 return SECCLASS_APPLETALK_SOCKET;
1174 }
1175
1176 return SECCLASS_SOCKET;
1177 }
1178
1179 #ifdef CONFIG_PROC_FS
1180 static int selinux_proc_get_sid(struct dentry *dentry,
1181 u16 tclass,
1182 u32 *sid)
1183 {
1184 int rc;
1185 char *buffer, *path;
1186
1187 buffer = (char *)__get_free_page(GFP_KERNEL);
1188 if (!buffer)
1189 return -ENOMEM;
1190
1191 path = dentry_path_raw(dentry, buffer, PAGE_SIZE);
1192 if (IS_ERR(path))
1193 rc = PTR_ERR(path);
1194 else {
1195 /* each process gets a /proc/PID/ entry. Strip off the
1196 * PID part to get a valid selinux labeling.
1197 * e.g. /proc/1/net/rpc/nfs -> /net/rpc/nfs */
1198 while (path[1] >= '0' && path[1] <= '9') {
1199 path[1] = '/';
1200 path++;
1201 }
1202 rc = security_genfs_sid("proc", path, tclass, sid);
1203 }
1204 free_page((unsigned long)buffer);
1205 return rc;
1206 }
1207 #else
1208 static int selinux_proc_get_sid(struct dentry *dentry,
1209 u16 tclass,
1210 u32 *sid)
1211 {
1212 return -EINVAL;
1213 }
1214 #endif
1215
1216 /* The inode's security attributes must be initialized before first use. */
1217 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
1218 {
1219 struct superblock_security_struct *sbsec = NULL;
1220 struct inode_security_struct *isec = inode->i_security;
1221 u32 sid;
1222 struct dentry *dentry;
1223 #define INITCONTEXTLEN 255
1224 char *context = NULL;
1225 unsigned len = 0;
1226 int rc = 0;
1227
1228 if (isec->initialized)
1229 goto out;
1230
1231 mutex_lock(&isec->lock);
1232 if (isec->initialized)
1233 goto out_unlock;
1234
1235 sbsec = inode->i_sb->s_security;
1236 if (!(sbsec->flags & SE_SBINITIALIZED)) {
1237 /* Defer initialization until selinux_complete_init,
1238 after the initial policy is loaded and the security
1239 server is ready to handle calls. */
1240 spin_lock(&sbsec->isec_lock);
1241 if (list_empty(&isec->list))
1242 list_add(&isec->list, &sbsec->isec_head);
1243 spin_unlock(&sbsec->isec_lock);
1244 goto out_unlock;
1245 }
1246
1247 switch (sbsec->behavior) {
1248 case SECURITY_FS_USE_NATIVE:
1249 break;
1250 case SECURITY_FS_USE_XATTR:
1251 if (!inode->i_op->getxattr) {
1252 isec->sid = sbsec->def_sid;
1253 break;
1254 }
1255
1256 /* Need a dentry, since the xattr API requires one.
1257 Life would be simpler if we could just pass the inode. */
1258 if (opt_dentry) {
1259 /* Called from d_instantiate or d_splice_alias. */
1260 dentry = dget(opt_dentry);
1261 } else {
1262 /* Called from selinux_complete_init, try to find a dentry. */
1263 dentry = d_find_alias(inode);
1264 }
1265 if (!dentry) {
1266 /*
1267 * this is can be hit on boot when a file is accessed
1268 * before the policy is loaded. When we load policy we
1269 * may find inodes that have no dentry on the
1270 * sbsec->isec_head list. No reason to complain as these
1271 * will get fixed up the next time we go through
1272 * inode_doinit with a dentry, before these inodes could
1273 * be used again by userspace.
1274 */
1275 goto out_unlock;
1276 }
1277
1278 len = INITCONTEXTLEN;
1279 context = kmalloc(len+1, GFP_NOFS);
1280 if (!context) {
1281 rc = -ENOMEM;
1282 dput(dentry);
1283 goto out_unlock;
1284 }
1285 context[len] = '\0';
1286 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
1287 context, len);
1288 if (rc == -ERANGE) {
1289 kfree(context);
1290
1291 /* Need a larger buffer. Query for the right size. */
1292 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
1293 NULL, 0);
1294 if (rc < 0) {
1295 dput(dentry);
1296 goto out_unlock;
1297 }
1298 len = rc;
1299 context = kmalloc(len+1, GFP_NOFS);
1300 if (!context) {
1301 rc = -ENOMEM;
1302 dput(dentry);
1303 goto out_unlock;
1304 }
1305 context[len] = '\0';
1306 rc = inode->i_op->getxattr(dentry,
1307 XATTR_NAME_SELINUX,
1308 context, len);
1309 }
1310 dput(dentry);
1311 if (rc < 0) {
1312 if (rc != -ENODATA) {
1313 printk(KERN_WARNING "SELinux: %s: getxattr returned "
1314 "%d for dev=%s ino=%ld\n", __func__,
1315 -rc, inode->i_sb->s_id, inode->i_ino);
1316 kfree(context);
1317 goto out_unlock;
1318 }
1319 /* Map ENODATA to the default file SID */
1320 sid = sbsec->def_sid;
1321 rc = 0;
1322 } else {
1323 rc = security_context_to_sid_default(context, rc, &sid,
1324 sbsec->def_sid,
1325 GFP_NOFS);
1326 if (rc) {
1327 char *dev = inode->i_sb->s_id;
1328 unsigned long ino = inode->i_ino;
1329
1330 if (rc == -EINVAL) {
1331 if (printk_ratelimit())
1332 printk(KERN_NOTICE "SELinux: inode=%lu on dev=%s was found to have an invalid "
1333 "context=%s. This indicates you may need to relabel the inode or the "
1334 "filesystem in question.\n", ino, dev, context);
1335 } else {
1336 printk(KERN_WARNING "SELinux: %s: context_to_sid(%s) "
1337 "returned %d for dev=%s ino=%ld\n",
1338 __func__, context, -rc, dev, ino);
1339 }
1340 kfree(context);
1341 /* Leave with the unlabeled SID */
1342 rc = 0;
1343 break;
1344 }
1345 }
1346 kfree(context);
1347 isec->sid = sid;
1348 break;
1349 case SECURITY_FS_USE_TASK:
1350 isec->sid = isec->task_sid;
1351 break;
1352 case SECURITY_FS_USE_TRANS:
1353 /* Default to the fs SID. */
1354 isec->sid = sbsec->sid;
1355
1356 /* Try to obtain a transition SID. */
1357 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1358 rc = security_transition_sid(isec->task_sid, sbsec->sid,
1359 isec->sclass, NULL, &sid);
1360 if (rc)
1361 goto out_unlock;
1362 isec->sid = sid;
1363 break;
1364 case SECURITY_FS_USE_MNTPOINT:
1365 isec->sid = sbsec->mntpoint_sid;
1366 break;
1367 default:
1368 /* Default to the fs superblock SID. */
1369 isec->sid = sbsec->sid;
1370
1371 if ((sbsec->flags & SE_SBPROC) && !S_ISLNK(inode->i_mode)) {
1372 if (opt_dentry) {
1373 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1374 rc = selinux_proc_get_sid(opt_dentry,
1375 isec->sclass,
1376 &sid);
1377 if (rc)
1378 goto out_unlock;
1379 isec->sid = sid;
1380 }
1381 }
1382 break;
1383 }
1384
1385 isec->initialized = 1;
1386
1387 out_unlock:
1388 mutex_unlock(&isec->lock);
1389 out:
1390 if (isec->sclass == SECCLASS_FILE)
1391 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1392 return rc;
1393 }
1394
1395 /* Convert a Linux signal to an access vector. */
1396 static inline u32 signal_to_av(int sig)
1397 {
1398 u32 perm = 0;
1399
1400 switch (sig) {
1401 case SIGCHLD:
1402 /* Commonly granted from child to parent. */
1403 perm = PROCESS__SIGCHLD;
1404 break;
1405 case SIGKILL:
1406 /* Cannot be caught or ignored */
1407 perm = PROCESS__SIGKILL;
1408 break;
1409 case SIGSTOP:
1410 /* Cannot be caught or ignored */
1411 perm = PROCESS__SIGSTOP;
1412 break;
1413 default:
1414 /* All other signals. */
1415 perm = PROCESS__SIGNAL;
1416 break;
1417 }
1418
1419 return perm;
1420 }
1421
1422 /*
1423 * Check permission between a pair of credentials
1424 * fork check, ptrace check, etc.
1425 */
1426 static int cred_has_perm(const struct cred *actor,
1427 const struct cred *target,
1428 u32 perms)
1429 {
1430 u32 asid = cred_sid(actor), tsid = cred_sid(target);
1431
1432 return avc_has_perm(asid, tsid, SECCLASS_PROCESS, perms, NULL);
1433 }
1434
1435 /*
1436 * Check permission between a pair of tasks, e.g. signal checks,
1437 * fork check, ptrace check, etc.
1438 * tsk1 is the actor and tsk2 is the target
1439 * - this uses the default subjective creds of tsk1
1440 */
1441 static int task_has_perm(const struct task_struct *tsk1,
1442 const struct task_struct *tsk2,
1443 u32 perms)
1444 {
1445 const struct task_security_struct *__tsec1, *__tsec2;
1446 u32 sid1, sid2;
1447
1448 rcu_read_lock();
1449 __tsec1 = __task_cred(tsk1)->security; sid1 = __tsec1->sid;
1450 __tsec2 = __task_cred(tsk2)->security; sid2 = __tsec2->sid;
1451 rcu_read_unlock();
1452 return avc_has_perm(sid1, sid2, SECCLASS_PROCESS, perms, NULL);
1453 }
1454
1455 /*
1456 * Check permission between current and another task, e.g. signal checks,
1457 * fork check, ptrace check, etc.
1458 * current is the actor and tsk2 is the target
1459 * - this uses current's subjective creds
1460 */
1461 static int current_has_perm(const struct task_struct *tsk,
1462 u32 perms)
1463 {
1464 u32 sid, tsid;
1465
1466 sid = current_sid();
1467 tsid = task_sid(tsk);
1468 return avc_has_perm(sid, tsid, SECCLASS_PROCESS, perms, NULL);
1469 }
1470
1471 #if CAP_LAST_CAP > 63
1472 #error Fix SELinux to handle capabilities > 63.
1473 #endif
1474
1475 /* Check whether a task is allowed to use a capability. */
1476 static int cred_has_capability(const struct cred *cred,
1477 int cap, int audit)
1478 {
1479 struct common_audit_data ad;
1480 struct av_decision avd;
1481 u16 sclass;
1482 u32 sid = cred_sid(cred);
1483 u32 av = CAP_TO_MASK(cap);
1484 int rc;
1485
1486 ad.type = LSM_AUDIT_DATA_CAP;
1487 ad.u.cap = cap;
1488
1489 switch (CAP_TO_INDEX(cap)) {
1490 case 0:
1491 sclass = SECCLASS_CAPABILITY;
1492 break;
1493 case 1:
1494 sclass = SECCLASS_CAPABILITY2;
1495 break;
1496 default:
1497 printk(KERN_ERR
1498 "SELinux: out of range capability %d\n", cap);
1499 BUG();
1500 return -EINVAL;
1501 }
1502
1503 rc = avc_has_perm_noaudit(sid, sid, sclass, av, 0, &avd);
1504 if (audit == SECURITY_CAP_AUDIT) {
1505 int rc2 = avc_audit(sid, sid, sclass, av, &avd, rc, &ad, 0);
1506 if (rc2)
1507 return rc2;
1508 }
1509 return rc;
1510 }
1511
1512 /* Check whether a task is allowed to use a system operation. */
1513 static int task_has_system(struct task_struct *tsk,
1514 u32 perms)
1515 {
1516 u32 sid = task_sid(tsk);
1517
1518 return avc_has_perm(sid, SECINITSID_KERNEL,
1519 SECCLASS_SYSTEM, perms, NULL);
1520 }
1521
1522 /* Check whether a task has a particular permission to an inode.
1523 The 'adp' parameter is optional and allows other audit
1524 data to be passed (e.g. the dentry). */
1525 static int inode_has_perm(const struct cred *cred,
1526 struct inode *inode,
1527 u32 perms,
1528 struct common_audit_data *adp,
1529 unsigned flags)
1530 {
1531 struct inode_security_struct *isec;
1532 u32 sid;
1533
1534 validate_creds(cred);
1535
1536 if (unlikely(IS_PRIVATE(inode)))
1537 return 0;
1538
1539 sid = cred_sid(cred);
1540 isec = inode->i_security;
1541
1542 return avc_has_perm_flags(sid, isec->sid, isec->sclass, perms, adp, flags);
1543 }
1544
1545 /* Same as inode_has_perm, but pass explicit audit data containing
1546 the dentry to help the auditing code to more easily generate the
1547 pathname if needed. */
1548 static inline int dentry_has_perm(const struct cred *cred,
1549 struct dentry *dentry,
1550 u32 av)
1551 {
1552 struct inode *inode = dentry->d_inode;
1553 struct common_audit_data ad;
1554
1555 ad.type = LSM_AUDIT_DATA_DENTRY;
1556 ad.u.dentry = dentry;
1557 return inode_has_perm(cred, inode, av, &ad, 0);
1558 }
1559
1560 /* Same as inode_has_perm, but pass explicit audit data containing
1561 the path to help the auditing code to more easily generate the
1562 pathname if needed. */
1563 static inline int path_has_perm(const struct cred *cred,
1564 struct path *path,
1565 u32 av)
1566 {
1567 struct inode *inode = path->dentry->d_inode;
1568 struct common_audit_data ad;
1569
1570 ad.type = LSM_AUDIT_DATA_PATH;
1571 ad.u.path = *path;
1572 return inode_has_perm(cred, inode, av, &ad, 0);
1573 }
1574
1575 /* Same as path_has_perm, but uses the inode from the file struct. */
1576 static inline int file_path_has_perm(const struct cred *cred,
1577 struct file *file,
1578 u32 av)
1579 {
1580 struct common_audit_data ad;
1581
1582 ad.type = LSM_AUDIT_DATA_PATH;
1583 ad.u.path = file->f_path;
1584 return inode_has_perm(cred, file_inode(file), av, &ad, 0);
1585 }
1586
1587 /* Check whether a task can use an open file descriptor to
1588 access an inode in a given way. Check access to the
1589 descriptor itself, and then use dentry_has_perm to
1590 check a particular permission to the file.
1591 Access to the descriptor is implicitly granted if it
1592 has the same SID as the process. If av is zero, then
1593 access to the file is not checked, e.g. for cases
1594 where only the descriptor is affected like seek. */
1595 static int file_has_perm(const struct cred *cred,
1596 struct file *file,
1597 u32 av)
1598 {
1599 struct file_security_struct *fsec = file->f_security;
1600 struct inode *inode = file_inode(file);
1601 struct common_audit_data ad;
1602 u32 sid = cred_sid(cred);
1603 int rc;
1604
1605 ad.type = LSM_AUDIT_DATA_PATH;
1606 ad.u.path = file->f_path;
1607
1608 if (sid != fsec->sid) {
1609 rc = avc_has_perm(sid, fsec->sid,
1610 SECCLASS_FD,
1611 FD__USE,
1612 &ad);
1613 if (rc)
1614 goto out;
1615 }
1616
1617 /* av is zero if only checking access to the descriptor. */
1618 rc = 0;
1619 if (av)
1620 rc = inode_has_perm(cred, inode, av, &ad, 0);
1621
1622 out:
1623 return rc;
1624 }
1625
1626 /* Check whether a task can create a file. */
1627 static int may_create(struct inode *dir,
1628 struct dentry *dentry,
1629 u16 tclass)
1630 {
1631 const struct task_security_struct *tsec = current_security();
1632 struct inode_security_struct *dsec;
1633 struct superblock_security_struct *sbsec;
1634 u32 sid, newsid;
1635 struct common_audit_data ad;
1636 int rc;
1637
1638 dsec = dir->i_security;
1639 sbsec = dir->i_sb->s_security;
1640
1641 sid = tsec->sid;
1642 newsid = tsec->create_sid;
1643
1644 ad.type = LSM_AUDIT_DATA_DENTRY;
1645 ad.u.dentry = dentry;
1646
1647 rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR,
1648 DIR__ADD_NAME | DIR__SEARCH,
1649 &ad);
1650 if (rc)
1651 return rc;
1652
1653 if (!newsid || !(sbsec->flags & SE_SBLABELSUPP)) {
1654 rc = security_transition_sid(sid, dsec->sid, tclass,
1655 &dentry->d_name, &newsid);
1656 if (rc)
1657 return rc;
1658 }
1659
1660 rc = avc_has_perm(sid, newsid, tclass, FILE__CREATE, &ad);
1661 if (rc)
1662 return rc;
1663
1664 return avc_has_perm(newsid, sbsec->sid,
1665 SECCLASS_FILESYSTEM,
1666 FILESYSTEM__ASSOCIATE, &ad);
1667 }
1668
1669 /* Check whether a task can create a key. */
1670 static int may_create_key(u32 ksid,
1671 struct task_struct *ctx)
1672 {
1673 u32 sid = task_sid(ctx);
1674
1675 return avc_has_perm(sid, ksid, SECCLASS_KEY, KEY__CREATE, NULL);
1676 }
1677
1678 #define MAY_LINK 0
1679 #define MAY_UNLINK 1
1680 #define MAY_RMDIR 2
1681
1682 /* Check whether a task can link, unlink, or rmdir a file/directory. */
1683 static int may_link(struct inode *dir,
1684 struct dentry *dentry,
1685 int kind)
1686
1687 {
1688 struct inode_security_struct *dsec, *isec;
1689 struct common_audit_data ad;
1690 u32 sid = current_sid();
1691 u32 av;
1692 int rc;
1693
1694 dsec = dir->i_security;
1695 isec = dentry->d_inode->i_security;
1696
1697 ad.type = LSM_AUDIT_DATA_DENTRY;
1698 ad.u.dentry = dentry;
1699
1700 av = DIR__SEARCH;
1701 av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
1702 rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR, av, &ad);
1703 if (rc)
1704 return rc;
1705
1706 switch (kind) {
1707 case MAY_LINK:
1708 av = FILE__LINK;
1709 break;
1710 case MAY_UNLINK:
1711 av = FILE__UNLINK;
1712 break;
1713 case MAY_RMDIR:
1714 av = DIR__RMDIR;
1715 break;
1716 default:
1717 printk(KERN_WARNING "SELinux: %s: unrecognized kind %d\n",
1718 __func__, kind);
1719 return 0;
1720 }
1721
1722 rc = avc_has_perm(sid, isec->sid, isec->sclass, av, &ad);
1723 return rc;
1724 }
1725
1726 static inline int may_rename(struct inode *old_dir,
1727 struct dentry *old_dentry,
1728 struct inode *new_dir,
1729 struct dentry *new_dentry)
1730 {
1731 struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
1732 struct common_audit_data ad;
1733 u32 sid = current_sid();
1734 u32 av;
1735 int old_is_dir, new_is_dir;
1736 int rc;
1737
1738 old_dsec = old_dir->i_security;
1739 old_isec = old_dentry->d_inode->i_security;
1740 old_is_dir = S_ISDIR(old_dentry->d_inode->i_mode);
1741 new_dsec = new_dir->i_security;
1742
1743 ad.type = LSM_AUDIT_DATA_DENTRY;
1744
1745 ad.u.dentry = old_dentry;
1746 rc = avc_has_perm(sid, old_dsec->sid, SECCLASS_DIR,
1747 DIR__REMOVE_NAME | DIR__SEARCH, &ad);
1748 if (rc)
1749 return rc;
1750 rc = avc_has_perm(sid, old_isec->sid,
1751 old_isec->sclass, FILE__RENAME, &ad);
1752 if (rc)
1753 return rc;
1754 if (old_is_dir && new_dir != old_dir) {
1755 rc = avc_has_perm(sid, old_isec->sid,
1756 old_isec->sclass, DIR__REPARENT, &ad);
1757 if (rc)
1758 return rc;
1759 }
1760
1761 ad.u.dentry = new_dentry;
1762 av = DIR__ADD_NAME | DIR__SEARCH;
1763 if (new_dentry->d_inode)
1764 av |= DIR__REMOVE_NAME;
1765 rc = avc_has_perm(sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
1766 if (rc)
1767 return rc;
1768 if (new_dentry->d_inode) {
1769 new_isec = new_dentry->d_inode->i_security;
1770 new_is_dir = S_ISDIR(new_dentry->d_inode->i_mode);
1771 rc = avc_has_perm(sid, new_isec->sid,
1772 new_isec->sclass,
1773 (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
1774 if (rc)
1775 return rc;
1776 }
1777
1778 return 0;
1779 }
1780
1781 /* Check whether a task can perform a filesystem operation. */
1782 static int superblock_has_perm(const struct cred *cred,
1783 struct super_block *sb,
1784 u32 perms,
1785 struct common_audit_data *ad)
1786 {
1787 struct superblock_security_struct *sbsec;
1788 u32 sid = cred_sid(cred);
1789
1790 sbsec = sb->s_security;
1791 return avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM, perms, ad);
1792 }
1793
1794 /* Convert a Linux mode and permission mask to an access vector. */
1795 static inline u32 file_mask_to_av(int mode, int mask)
1796 {
1797 u32 av = 0;
1798
1799 if (!S_ISDIR(mode)) {
1800 if (mask & MAY_EXEC)
1801 av |= FILE__EXECUTE;
1802 if (mask & MAY_READ)
1803 av |= FILE__READ;
1804
1805 if (mask & MAY_APPEND)
1806 av |= FILE__APPEND;
1807 else if (mask & MAY_WRITE)
1808 av |= FILE__WRITE;
1809
1810 } else {
1811 if (mask & MAY_EXEC)
1812 av |= DIR__SEARCH;
1813 if (mask & MAY_WRITE)
1814 av |= DIR__WRITE;
1815 if (mask & MAY_READ)
1816 av |= DIR__READ;
1817 }
1818
1819 return av;
1820 }
1821
1822 /* Convert a Linux file to an access vector. */
1823 static inline u32 file_to_av(struct file *file)
1824 {
1825 u32 av = 0;
1826
1827 if (file->f_mode & FMODE_READ)
1828 av |= FILE__READ;
1829 if (file->f_mode & FMODE_WRITE) {
1830 if (file->f_flags & O_APPEND)
1831 av |= FILE__APPEND;
1832 else
1833 av |= FILE__WRITE;
1834 }
1835 if (!av) {
1836 /*
1837 * Special file opened with flags 3 for ioctl-only use.
1838 */
1839 av = FILE__IOCTL;
1840 }
1841
1842 return av;
1843 }
1844
1845 /*
1846 * Convert a file to an access vector and include the correct open
1847 * open permission.
1848 */
1849 static inline u32 open_file_to_av(struct file *file)
1850 {
1851 u32 av = file_to_av(file);
1852
1853 if (selinux_policycap_openperm)
1854 av |= FILE__OPEN;
1855
1856 return av;
1857 }
1858
1859 /* Hook functions begin here. */
1860
1861 static int selinux_ptrace_access_check(struct task_struct *child,
1862 unsigned int mode)
1863 {
1864 int rc;
1865
1866 rc = cap_ptrace_access_check(child, mode);
1867 if (rc)
1868 return rc;
1869
1870 if (mode & PTRACE_MODE_READ) {
1871 u32 sid = current_sid();
1872 u32 csid = task_sid(child);
1873 return avc_has_perm(sid, csid, SECCLASS_FILE, FILE__READ, NULL);
1874 }
1875
1876 return current_has_perm(child, PROCESS__PTRACE);
1877 }
1878
1879 static int selinux_ptrace_traceme(struct task_struct *parent)
1880 {
1881 int rc;
1882
1883 rc = cap_ptrace_traceme(parent);
1884 if (rc)
1885 return rc;
1886
1887 return task_has_perm(parent, current, PROCESS__PTRACE);
1888 }
1889
1890 static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
1891 kernel_cap_t *inheritable, kernel_cap_t *permitted)
1892 {
1893 int error;
1894
1895 error = current_has_perm(target, PROCESS__GETCAP);
1896 if (error)
1897 return error;
1898
1899 return cap_capget(target, effective, inheritable, permitted);
1900 }
1901
1902 static int selinux_capset(struct cred *new, const struct cred *old,
1903 const kernel_cap_t *effective,
1904 const kernel_cap_t *inheritable,
1905 const kernel_cap_t *permitted)
1906 {
1907 int error;
1908
1909 error = cap_capset(new, old,
1910 effective, inheritable, permitted);
1911 if (error)
1912 return error;
1913
1914 return cred_has_perm(old, new, PROCESS__SETCAP);
1915 }
1916
1917 /*
1918 * (This comment used to live with the selinux_task_setuid hook,
1919 * which was removed).
1920 *
1921 * Since setuid only affects the current process, and since the SELinux
1922 * controls are not based on the Linux identity attributes, SELinux does not
1923 * need to control this operation. However, SELinux does control the use of
1924 * the CAP_SETUID and CAP_SETGID capabilities using the capable hook.
1925 */
1926
1927 static int selinux_capable(const struct cred *cred, struct user_namespace *ns,
1928 int cap, int audit)
1929 {
1930 int rc;
1931
1932 rc = cap_capable(cred, ns, cap, audit);
1933 if (rc)
1934 return rc;
1935
1936 return cred_has_capability(cred, cap, audit);
1937 }
1938
1939 static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
1940 {
1941 const struct cred *cred = current_cred();
1942 int rc = 0;
1943
1944 if (!sb)
1945 return 0;
1946
1947 switch (cmds) {
1948 case Q_SYNC:
1949 case Q_QUOTAON:
1950 case Q_QUOTAOFF:
1951 case Q_SETINFO:
1952 case Q_SETQUOTA:
1953 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAMOD, NULL);
1954 break;
1955 case Q_GETFMT:
1956 case Q_GETINFO:
1957 case Q_GETQUOTA:
1958 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAGET, NULL);
1959 break;
1960 default:
1961 rc = 0; /* let the kernel handle invalid cmds */
1962 break;
1963 }
1964 return rc;
1965 }
1966
1967 static int selinux_quota_on(struct dentry *dentry)
1968 {
1969 const struct cred *cred = current_cred();
1970
1971 return dentry_has_perm(cred, dentry, FILE__QUOTAON);
1972 }
1973
1974 static int selinux_syslog(int type)
1975 {
1976 int rc;
1977
1978 switch (type) {
1979 case SYSLOG_ACTION_READ_ALL: /* Read last kernel messages */
1980 case SYSLOG_ACTION_SIZE_BUFFER: /* Return size of the log buffer */
1981 rc = task_has_system(current, SYSTEM__SYSLOG_READ);
1982 break;
1983 case SYSLOG_ACTION_CONSOLE_OFF: /* Disable logging to console */
1984 case SYSLOG_ACTION_CONSOLE_ON: /* Enable logging to console */
1985 /* Set level of messages printed to console */
1986 case SYSLOG_ACTION_CONSOLE_LEVEL:
1987 rc = task_has_system(current, SYSTEM__SYSLOG_CONSOLE);
1988 break;
1989 case SYSLOG_ACTION_CLOSE: /* Close log */
1990 case SYSLOG_ACTION_OPEN: /* Open log */
1991 case SYSLOG_ACTION_READ: /* Read from log */
1992 case SYSLOG_ACTION_READ_CLEAR: /* Read/clear last kernel messages */
1993 case SYSLOG_ACTION_CLEAR: /* Clear ring buffer */
1994 default:
1995 rc = task_has_system(current, SYSTEM__SYSLOG_MOD);
1996 break;
1997 }
1998 return rc;
1999 }
2000
2001 /*
2002 * Check that a process has enough memory to allocate a new virtual
2003 * mapping. 0 means there is enough memory for the allocation to
2004 * succeed and -ENOMEM implies there is not.
2005 *
2006 * Do not audit the selinux permission check, as this is applied to all
2007 * processes that allocate mappings.
2008 */
2009 static int selinux_vm_enough_memory(struct mm_struct *mm, long pages)
2010 {
2011 int rc, cap_sys_admin = 0;
2012
2013 rc = selinux_capable(current_cred(), &init_user_ns, CAP_SYS_ADMIN,
2014 SECURITY_CAP_NOAUDIT);
2015 if (rc == 0)
2016 cap_sys_admin = 1;
2017
2018 return __vm_enough_memory(mm, pages, cap_sys_admin);
2019 }
2020
2021 /* binprm security operations */
2022
2023 static int selinux_bprm_set_creds(struct linux_binprm *bprm)
2024 {
2025 const struct task_security_struct *old_tsec;
2026 struct task_security_struct *new_tsec;
2027 struct inode_security_struct *isec;
2028 struct common_audit_data ad;
2029 struct inode *inode = file_inode(bprm->file);
2030 int rc;
2031
2032 rc = cap_bprm_set_creds(bprm);
2033 if (rc)
2034 return rc;
2035
2036 /* SELinux context only depends on initial program or script and not
2037 * the script interpreter */
2038 if (bprm->cred_prepared)
2039 return 0;
2040
2041 old_tsec = current_security();
2042 new_tsec = bprm->cred->security;
2043 isec = inode->i_security;
2044
2045 /* Default to the current task SID. */
2046 new_tsec->sid = old_tsec->sid;
2047 new_tsec->osid = old_tsec->sid;
2048
2049 /* Reset fs, key, and sock SIDs on execve. */
2050 new_tsec->create_sid = 0;
2051 new_tsec->keycreate_sid = 0;
2052 new_tsec->sockcreate_sid = 0;
2053
2054 if (old_tsec->exec_sid) {
2055 new_tsec->sid = old_tsec->exec_sid;
2056 /* Reset exec SID on execve. */
2057 new_tsec->exec_sid = 0;
2058
2059 /*
2060 * Minimize confusion: if no_new_privs and a transition is
2061 * explicitly requested, then fail the exec.
2062 */
2063 if (bprm->unsafe & LSM_UNSAFE_NO_NEW_PRIVS)
2064 return -EPERM;
2065 } else {
2066 /* Check for a default transition on this program. */
2067 rc = security_transition_sid(old_tsec->sid, isec->sid,
2068 SECCLASS_PROCESS, NULL,
2069 &new_tsec->sid);
2070 if (rc)
2071 return rc;
2072 }
2073
2074 ad.type = LSM_AUDIT_DATA_PATH;
2075 ad.u.path = bprm->file->f_path;
2076
2077 if ((bprm->file->f_path.mnt->mnt_flags & MNT_NOSUID) ||
2078 (bprm->unsafe & LSM_UNSAFE_NO_NEW_PRIVS))
2079 new_tsec->sid = old_tsec->sid;
2080
2081 if (new_tsec->sid == old_tsec->sid) {
2082 rc = avc_has_perm(old_tsec->sid, isec->sid,
2083 SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
2084 if (rc)
2085 return rc;
2086 } else {
2087 /* Check permissions for the transition. */
2088 rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2089 SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
2090 if (rc)
2091 return rc;
2092
2093 rc = avc_has_perm(new_tsec->sid, isec->sid,
2094 SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
2095 if (rc)
2096 return rc;
2097
2098 /* Check for shared state */
2099 if (bprm->unsafe & LSM_UNSAFE_SHARE) {
2100 rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2101 SECCLASS_PROCESS, PROCESS__SHARE,
2102 NULL);
2103 if (rc)
2104 return -EPERM;
2105 }
2106
2107 /* Make sure that anyone attempting to ptrace over a task that
2108 * changes its SID has the appropriate permit */
2109 if (bprm->unsafe &
2110 (LSM_UNSAFE_PTRACE | LSM_UNSAFE_PTRACE_CAP)) {
2111 struct task_struct *tracer;
2112 struct task_security_struct *sec;
2113 u32 ptsid = 0;
2114
2115 rcu_read_lock();
2116 tracer = ptrace_parent(current);
2117 if (likely(tracer != NULL)) {
2118 sec = __task_cred(tracer)->security;
2119 ptsid = sec->sid;
2120 }
2121 rcu_read_unlock();
2122
2123 if (ptsid != 0) {
2124 rc = avc_has_perm(ptsid, new_tsec->sid,
2125 SECCLASS_PROCESS,
2126 PROCESS__PTRACE, NULL);
2127 if (rc)
2128 return -EPERM;
2129 }
2130 }
2131
2132 /* Clear any possibly unsafe personality bits on exec: */
2133 bprm->per_clear |= PER_CLEAR_ON_SETID;
2134 }
2135
2136 return 0;
2137 }
2138
2139 static int selinux_bprm_secureexec(struct linux_binprm *bprm)
2140 {
2141 const struct task_security_struct *tsec = current_security();
2142 u32 sid, osid;
2143 int atsecure = 0;
2144
2145 sid = tsec->sid;
2146 osid = tsec->osid;
2147
2148 if (osid != sid) {
2149 /* Enable secure mode for SIDs transitions unless
2150 the noatsecure permission is granted between
2151 the two SIDs, i.e. ahp returns 0. */
2152 atsecure = avc_has_perm(osid, sid,
2153 SECCLASS_PROCESS,
2154 PROCESS__NOATSECURE, NULL);
2155 }
2156
2157 return (atsecure || cap_bprm_secureexec(bprm));
2158 }
2159
2160 static int match_file(const void *p, struct file *file, unsigned fd)
2161 {
2162 return file_has_perm(p, file, file_to_av(file)) ? fd + 1 : 0;
2163 }
2164
2165 /* Derived from fs/exec.c:flush_old_files. */
2166 static inline void flush_unauthorized_files(const struct cred *cred,
2167 struct files_struct *files)
2168 {
2169 struct file *file, *devnull = NULL;
2170 struct tty_struct *tty;
2171 int drop_tty = 0;
2172 unsigned n;
2173
2174 tty = get_current_tty();
2175 if (tty) {
2176 spin_lock(&tty_files_lock);
2177 if (!list_empty(&tty->tty_files)) {
2178 struct tty_file_private *file_priv;
2179
2180 /* Revalidate access to controlling tty.
2181 Use file_path_has_perm on the tty path directly
2182 rather than using file_has_perm, as this particular
2183 open file may belong to another process and we are
2184 only interested in the inode-based check here. */
2185 file_priv = list_first_entry(&tty->tty_files,
2186 struct tty_file_private, list);
2187 file = file_priv->file;
2188 if (file_path_has_perm(cred, file, FILE__READ | FILE__WRITE))
2189 drop_tty = 1;
2190 }
2191 spin_unlock(&tty_files_lock);
2192 tty_kref_put(tty);
2193 }
2194 /* Reset controlling tty. */
2195 if (drop_tty)
2196 no_tty();
2197
2198 /* Revalidate access to inherited open files. */
2199 n = iterate_fd(files, 0, match_file, cred);
2200 if (!n) /* none found? */
2201 return;
2202
2203 devnull = dentry_open(&selinux_null, O_RDWR, cred);
2204 if (IS_ERR(devnull))
2205 devnull = NULL;
2206 /* replace all the matching ones with this */
2207 do {
2208 replace_fd(n - 1, devnull, 0);
2209 } while ((n = iterate_fd(files, n, match_file, cred)) != 0);
2210 if (devnull)
2211 fput(devnull);
2212 }
2213
2214 /*
2215 * Prepare a process for imminent new credential changes due to exec
2216 */
2217 static void selinux_bprm_committing_creds(struct linux_binprm *bprm)
2218 {
2219 struct task_security_struct *new_tsec;
2220 struct rlimit *rlim, *initrlim;
2221 int rc, i;
2222
2223 new_tsec = bprm->cred->security;
2224 if (new_tsec->sid == new_tsec->osid)
2225 return;
2226
2227 /* Close files for which the new task SID is not authorized. */
2228 flush_unauthorized_files(bprm->cred, current->files);
2229
2230 /* Always clear parent death signal on SID transitions. */
2231 current->pdeath_signal = 0;
2232
2233 /* Check whether the new SID can inherit resource limits from the old
2234 * SID. If not, reset all soft limits to the lower of the current
2235 * task's hard limit and the init task's soft limit.
2236 *
2237 * Note that the setting of hard limits (even to lower them) can be
2238 * controlled by the setrlimit check. The inclusion of the init task's
2239 * soft limit into the computation is to avoid resetting soft limits
2240 * higher than the default soft limit for cases where the default is
2241 * lower than the hard limit, e.g. RLIMIT_CORE or RLIMIT_STACK.
2242 */
2243 rc = avc_has_perm(new_tsec->osid, new_tsec->sid, SECCLASS_PROCESS,
2244 PROCESS__RLIMITINH, NULL);
2245 if (rc) {
2246 /* protect against do_prlimit() */
2247 task_lock(current);
2248 for (i = 0; i < RLIM_NLIMITS; i++) {
2249 rlim = current->signal->rlim + i;
2250 initrlim = init_task.signal->rlim + i;
2251 rlim->rlim_cur = min(rlim->rlim_max, initrlim->rlim_cur);
2252 }
2253 task_unlock(current);
2254 update_rlimit_cpu(current, rlimit(RLIMIT_CPU));
2255 }
2256 }
2257
2258 /*
2259 * Clean up the process immediately after the installation of new credentials
2260 * due to exec
2261 */
2262 static void selinux_bprm_committed_creds(struct linux_binprm *bprm)
2263 {
2264 const struct task_security_struct *tsec = current_security();
2265 struct itimerval itimer;
2266 u32 osid, sid;
2267 int rc, i;
2268
2269 osid = tsec->osid;
2270 sid = tsec->sid;
2271
2272 if (sid == osid)
2273 return;
2274
2275 /* Check whether the new SID can inherit signal state from the old SID.
2276 * If not, clear itimers to avoid subsequent signal generation and
2277 * flush and unblock signals.
2278 *
2279 * This must occur _after_ the task SID has been updated so that any
2280 * kill done after the flush will be checked against the new SID.
2281 */
2282 rc = avc_has_perm(osid, sid, SECCLASS_PROCESS, PROCESS__SIGINH, NULL);
2283 if (rc) {
2284 memset(&itimer, 0, sizeof itimer);
2285 for (i = 0; i < 3; i++)
2286 do_setitimer(i, &itimer, NULL);
2287 spin_lock_irq(&current->sighand->siglock);
2288 if (!(current->signal->flags & SIGNAL_GROUP_EXIT)) {
2289 __flush_signals(current);
2290 flush_signal_handlers(current, 1);
2291 sigemptyset(&current->blocked);
2292 }
2293 spin_unlock_irq(&current->sighand->siglock);
2294 }
2295
2296 /* Wake up the parent if it is waiting so that it can recheck
2297 * wait permission to the new task SID. */
2298 read_lock(&tasklist_lock);
2299 __wake_up_parent(current, current->real_parent);
2300 read_unlock(&tasklist_lock);
2301 }
2302
2303 /* superblock security operations */
2304
2305 static int selinux_sb_alloc_security(struct super_block *sb)
2306 {
2307 return superblock_alloc_security(sb);
2308 }
2309
2310 static void selinux_sb_free_security(struct super_block *sb)
2311 {
2312 superblock_free_security(sb);
2313 }
2314
2315 static inline int match_prefix(char *prefix, int plen, char *option, int olen)
2316 {
2317 if (plen > olen)
2318 return 0;
2319
2320 return !memcmp(prefix, option, plen);
2321 }
2322
2323 static inline int selinux_option(char *option, int len)
2324 {
2325 return (match_prefix(CONTEXT_STR, sizeof(CONTEXT_STR)-1, option, len) ||
2326 match_prefix(FSCONTEXT_STR, sizeof(FSCONTEXT_STR)-1, option, len) ||
2327 match_prefix(DEFCONTEXT_STR, sizeof(DEFCONTEXT_STR)-1, option, len) ||
2328 match_prefix(ROOTCONTEXT_STR, sizeof(ROOTCONTEXT_STR)-1, option, len) ||
2329 match_prefix(LABELSUPP_STR, sizeof(LABELSUPP_STR)-1, option, len));
2330 }
2331
2332 static inline void take_option(char **to, char *from, int *first, int len)
2333 {
2334 if (!*first) {
2335 **to = ',';
2336 *to += 1;
2337 } else
2338 *first = 0;
2339 memcpy(*to, from, len);
2340 *to += len;
2341 }
2342
2343 static inline void take_selinux_option(char **to, char *from, int *first,
2344 int len)
2345 {
2346 int current_size = 0;
2347
2348 if (!*first) {
2349 **to = '|';
2350 *to += 1;
2351 } else
2352 *first = 0;
2353
2354 while (current_size < len) {
2355 if (*from != '"') {
2356 **to = *from;
2357 *to += 1;
2358 }
2359 from += 1;
2360 current_size += 1;
2361 }
2362 }
2363
2364 static int selinux_sb_copy_data(char *orig, char *copy)
2365 {
2366 int fnosec, fsec, rc = 0;
2367 char *in_save, *in_curr, *in_end;
2368 char *sec_curr, *nosec_save, *nosec;
2369 int open_quote = 0;
2370
2371 in_curr = orig;
2372 sec_curr = copy;
2373
2374 nosec = (char *)get_zeroed_page(GFP_KERNEL);
2375 if (!nosec) {
2376 rc = -ENOMEM;
2377 goto out;
2378 }
2379
2380 nosec_save = nosec;
2381 fnosec = fsec = 1;
2382 in_save = in_end = orig;
2383
2384 do {
2385 if (*in_end == '"')
2386 open_quote = !open_quote;
2387 if ((*in_end == ',' && open_quote == 0) ||
2388 *in_end == '\0') {
2389 int len = in_end - in_curr;
2390
2391 if (selinux_option(in_curr, len))
2392 take_selinux_option(&sec_curr, in_curr, &fsec, len);
2393 else
2394 take_option(&nosec, in_curr, &fnosec, len);
2395
2396 in_curr = in_end + 1;
2397 }
2398 } while (*in_end++);
2399
2400 strcpy(in_save, nosec_save);
2401 free_page((unsigned long)nosec_save);
2402 out:
2403 return rc;
2404 }
2405
2406 static int selinux_sb_remount(struct super_block *sb, void *data)
2407 {
2408 int rc, i, *flags;
2409 struct security_mnt_opts opts;
2410 char *secdata, **mount_options;
2411 struct superblock_security_struct *sbsec = sb->s_security;
2412
2413 if (!(sbsec->flags & SE_SBINITIALIZED))
2414 return 0;
2415
2416 if (!data)
2417 return 0;
2418
2419 if (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
2420 return 0;
2421
2422 security_init_mnt_opts(&opts);
2423 secdata = alloc_secdata();
2424 if (!secdata)
2425 return -ENOMEM;
2426 rc = selinux_sb_copy_data(data, secdata);
2427 if (rc)
2428 goto out_free_secdata;
2429
2430 rc = selinux_parse_opts_str(secdata, &opts);
2431 if (rc)
2432 goto out_free_secdata;
2433
2434 mount_options = opts.mnt_opts;
2435 flags = opts.mnt_opts_flags;
2436
2437 for (i = 0; i < opts.num_mnt_opts; i++) {
2438 u32 sid;
2439 size_t len;
2440
2441 if (flags[i] == SE_SBLABELSUPP)
2442 continue;
2443 len = strlen(mount_options[i]);
2444 rc = security_context_to_sid(mount_options[i], len, &sid);
2445 if (rc) {
2446 printk(KERN_WARNING "SELinux: security_context_to_sid"
2447 "(%s) failed for (dev %s, type %s) errno=%d\n",
2448 mount_options[i], sb->s_id, sb->s_type->name, rc);
2449 goto out_free_opts;
2450 }
2451 rc = -EINVAL;
2452 switch (flags[i]) {
2453 case FSCONTEXT_MNT:
2454 if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid, sid))
2455 goto out_bad_option;
2456 break;
2457 case CONTEXT_MNT:
2458 if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid, sid))
2459 goto out_bad_option;
2460 break;
2461 case ROOTCONTEXT_MNT: {
2462 struct inode_security_struct *root_isec;
2463 root_isec = sb->s_root->d_inode->i_security;
2464
2465 if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid, sid))
2466 goto out_bad_option;
2467 break;
2468 }
2469 case DEFCONTEXT_MNT:
2470 if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid, sid))
2471 goto out_bad_option;
2472 break;
2473 default:
2474 goto out_free_opts;
2475 }
2476 }
2477
2478 rc = 0;
2479 out_free_opts:
2480 security_free_mnt_opts(&opts);
2481 out_free_secdata:
2482 free_secdata(secdata);
2483 return rc;
2484 out_bad_option:
2485 printk(KERN_WARNING "SELinux: unable to change security options "
2486 "during remount (dev %s, type=%s)\n", sb->s_id,
2487 sb->s_type->name);
2488 goto out_free_opts;
2489 }
2490
2491 static int selinux_sb_kern_mount(struct super_block *sb, int flags, void *data)
2492 {
2493 const struct cred *cred = current_cred();
2494 struct common_audit_data ad;
2495 int rc;
2496
2497 rc = superblock_doinit(sb, data);
2498 if (rc)
2499 return rc;
2500
2501 /* Allow all mounts performed by the kernel */
2502 if (flags & MS_KERNMOUNT)
2503 return 0;
2504
2505 ad.type = LSM_AUDIT_DATA_DENTRY;
2506 ad.u.dentry = sb->s_root;
2507 return superblock_has_perm(cred, sb, FILESYSTEM__MOUNT, &ad);
2508 }
2509
2510 static int selinux_sb_statfs(struct dentry *dentry)
2511 {
2512 const struct cred *cred = current_cred();
2513 struct common_audit_data ad;
2514
2515 ad.type = LSM_AUDIT_DATA_DENTRY;
2516 ad.u.dentry = dentry->d_sb->s_root;
2517 return superblock_has_perm(cred, dentry->d_sb, FILESYSTEM__GETATTR, &ad);
2518 }
2519
2520 static int selinux_mount(const char *dev_name,
2521 struct path *path,
2522 const char *type,
2523 unsigned long flags,
2524 void *data)
2525 {
2526 const struct cred *cred = current_cred();
2527
2528 if (flags & MS_REMOUNT)
2529 return superblock_has_perm(cred, path->dentry->d_sb,
2530 FILESYSTEM__REMOUNT, NULL);
2531 else
2532 return path_has_perm(cred, path, FILE__MOUNTON);
2533 }
2534
2535 static int selinux_umount(struct vfsmount *mnt, int flags)
2536 {
2537 const struct cred *cred = current_cred();
2538
2539 return superblock_has_perm(cred, mnt->mnt_sb,
2540 FILESYSTEM__UNMOUNT, NULL);
2541 }
2542
2543 /* inode security operations */
2544
2545 static int selinux_inode_alloc_security(struct inode *inode)
2546 {
2547 return inode_alloc_security(inode);
2548 }
2549
2550 static void selinux_inode_free_security(struct inode *inode)
2551 {
2552 inode_free_security(inode);
2553 }
2554
2555 static int selinux_dentry_init_security(struct dentry *dentry, int mode,
2556 struct qstr *name, void **ctx,
2557 u32 *ctxlen)
2558 {
2559 const struct cred *cred = current_cred();
2560 struct task_security_struct *tsec;
2561 struct inode_security_struct *dsec;
2562 struct superblock_security_struct *sbsec;
2563 struct inode *dir = dentry->d_parent->d_inode;
2564 u32 newsid;
2565 int rc;
2566
2567 tsec = cred->security;
2568 dsec = dir->i_security;
2569 sbsec = dir->i_sb->s_security;
2570
2571 if (tsec->create_sid && sbsec->behavior != SECURITY_FS_USE_MNTPOINT) {
2572 newsid = tsec->create_sid;
2573 } else {
2574 rc = security_transition_sid(tsec->sid, dsec->sid,
2575 inode_mode_to_security_class(mode),
2576 name,
2577 &newsid);
2578 if (rc) {
2579 printk(KERN_WARNING
2580 "%s: security_transition_sid failed, rc=%d\n",
2581 __func__, -rc);
2582 return rc;
2583 }
2584 }
2585
2586 return security_sid_to_context(newsid, (char **)ctx, ctxlen);
2587 }
2588
2589 static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
2590 const struct qstr *qstr, char **name,
2591 void **value, size_t *len)
2592 {
2593 const struct task_security_struct *tsec = current_security();
2594 struct inode_security_struct *dsec;
2595 struct superblock_security_struct *sbsec;
2596 u32 sid, newsid, clen;
2597 int rc;
2598 char *namep = NULL, *context;
2599
2600 dsec = dir->i_security;
2601 sbsec = dir->i_sb->s_security;
2602
2603 sid = tsec->sid;
2604 newsid = tsec->create_sid;
2605
2606 if ((sbsec->flags & SE_SBINITIALIZED) &&
2607 (sbsec->behavior == SECURITY_FS_USE_MNTPOINT))
2608 newsid = sbsec->mntpoint_sid;
2609 else if (!newsid || !(sbsec->flags & SE_SBLABELSUPP)) {
2610 rc = security_transition_sid(sid, dsec->sid,
2611 inode_mode_to_security_class(inode->i_mode),
2612 qstr, &newsid);
2613 if (rc) {
2614 printk(KERN_WARNING "%s: "
2615 "security_transition_sid failed, rc=%d (dev=%s "
2616 "ino=%ld)\n",
2617 __func__,
2618 -rc, inode->i_sb->s_id, inode->i_ino);
2619 return rc;
2620 }
2621 }
2622
2623 /* Possibly defer initialization to selinux_complete_init. */
2624 if (sbsec->flags & SE_SBINITIALIZED) {
2625 struct inode_security_struct *isec = inode->i_security;
2626 isec->sclass = inode_mode_to_security_class(inode->i_mode);
2627 isec->sid = newsid;
2628 isec->initialized = 1;
2629 }
2630
2631 if (!ss_initialized || !(sbsec->flags & SE_SBLABELSUPP))
2632 return -EOPNOTSUPP;
2633
2634 if (name) {
2635 namep = kstrdup(XATTR_SELINUX_SUFFIX, GFP_NOFS);
2636 if (!namep)
2637 return -ENOMEM;
2638 *name = namep;
2639 }
2640
2641 if (value && len) {
2642 rc = security_sid_to_context_force(newsid, &context, &clen);
2643 if (rc) {
2644 kfree(namep);
2645 return rc;
2646 }
2647 *value = context;
2648 *len = clen;
2649 }
2650
2651 return 0;
2652 }
2653
2654 static int selinux_inode_create(struct inode *dir, struct dentry *dentry, umode_t mode)
2655 {
2656 return may_create(dir, dentry, SECCLASS_FILE);
2657 }
2658
2659 static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
2660 {
2661 return may_link(dir, old_dentry, MAY_LINK);
2662 }
2663
2664 static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
2665 {
2666 return may_link(dir, dentry, MAY_UNLINK);
2667 }
2668
2669 static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
2670 {
2671 return may_create(dir, dentry, SECCLASS_LNK_FILE);
2672 }
2673
2674 static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, umode_t mask)
2675 {
2676 return may_create(dir, dentry, SECCLASS_DIR);
2677 }
2678
2679 static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
2680 {
2681 return may_link(dir, dentry, MAY_RMDIR);
2682 }
2683
2684 static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, dev_t dev)
2685 {
2686 return may_create(dir, dentry, inode_mode_to_security_class(mode));
2687 }
2688
2689 static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
2690 struct inode *new_inode, struct dentry *new_dentry)
2691 {
2692 return may_rename(old_inode, old_dentry, new_inode, new_dentry);
2693 }
2694
2695 static int selinux_inode_readlink(struct dentry *dentry)
2696 {
2697 const struct cred *cred = current_cred();
2698
2699 return dentry_has_perm(cred, dentry, FILE__READ);
2700 }
2701
2702 static int selinux_inode_follow_link(struct dentry *dentry, struct nameidata *nameidata)
2703 {
2704 const struct cred *cred = current_cred();
2705
2706 return dentry_has_perm(cred, dentry, FILE__READ);
2707 }
2708
2709 static noinline int audit_inode_permission(struct inode *inode,
2710 u32 perms, u32 audited, u32 denied,
2711 unsigned flags)
2712 {
2713 struct common_audit_data ad;
2714 struct inode_security_struct *isec = inode->i_security;
2715 int rc;
2716
2717 ad.type = LSM_AUDIT_DATA_INODE;
2718 ad.u.inode = inode;
2719
2720 rc = slow_avc_audit(current_sid(), isec->sid, isec->sclass, perms,
2721 audited, denied, &ad, flags);
2722 if (rc)
2723 return rc;
2724 return 0;
2725 }
2726
2727 static int selinux_inode_permission(struct inode *inode, int mask)
2728 {
2729 const struct cred *cred = current_cred();
2730 u32 perms;
2731 bool from_access;
2732 unsigned flags = mask & MAY_NOT_BLOCK;
2733 struct inode_security_struct *isec;
2734 u32 sid;
2735 struct av_decision avd;
2736 int rc, rc2;
2737 u32 audited, denied;
2738
2739 from_access = mask & MAY_ACCESS;
2740 mask &= (MAY_READ|MAY_WRITE|MAY_EXEC|MAY_APPEND);
2741
2742 /* No permission to check. Existence test. */
2743 if (!mask)
2744 return 0;
2745
2746 validate_creds(cred);
2747
2748 if (unlikely(IS_PRIVATE(inode)))
2749 return 0;
2750
2751 perms = file_mask_to_av(inode->i_mode, mask);
2752
2753 sid = cred_sid(cred);
2754 isec = inode->i_security;
2755
2756 rc = avc_has_perm_noaudit(sid, isec->sid, isec->sclass, perms, 0, &avd);
2757 audited = avc_audit_required(perms, &avd, rc,
2758 from_access ? FILE__AUDIT_ACCESS : 0,
2759 &denied);
2760 if (likely(!audited))
2761 return rc;
2762
2763 rc2 = audit_inode_permission(inode, perms, audited, denied, flags);
2764 if (rc2)
2765 return rc2;
2766 return rc;
2767 }
2768
2769 static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
2770 {
2771 const struct cred *cred = current_cred();
2772 unsigned int ia_valid = iattr->ia_valid;
2773 __u32 av = FILE__WRITE;
2774
2775 /* ATTR_FORCE is just used for ATTR_KILL_S[UG]ID. */
2776 if (ia_valid & ATTR_FORCE) {
2777 ia_valid &= ~(ATTR_KILL_SUID | ATTR_KILL_SGID | ATTR_MODE |
2778 ATTR_FORCE);
2779 if (!ia_valid)
2780 return 0;
2781 }
2782
2783 if (ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
2784 ATTR_ATIME_SET | ATTR_MTIME_SET | ATTR_TIMES_SET))
2785 return dentry_has_perm(cred, dentry, FILE__SETATTR);
2786
2787 if (selinux_policycap_openperm && (ia_valid & ATTR_SIZE))
2788 av |= FILE__OPEN;
2789
2790 return dentry_has_perm(cred, dentry, av);
2791 }
2792
2793 static int selinux_inode_getattr(struct vfsmount *mnt, struct dentry *dentry)
2794 {
2795 const struct cred *cred = current_cred();
2796 struct path path;
2797
2798 path.dentry = dentry;
2799 path.mnt = mnt;
2800
2801 return path_has_perm(cred, &path, FILE__GETATTR);
2802 }
2803
2804 static int selinux_inode_setotherxattr(struct dentry *dentry, const char *name)
2805 {
2806 const struct cred *cred = current_cred();
2807
2808 if (!strncmp(name, XATTR_SECURITY_PREFIX,
2809 sizeof XATTR_SECURITY_PREFIX - 1)) {
2810 if (!strcmp(name, XATTR_NAME_CAPS)) {
2811 if (!capable(CAP_SETFCAP))
2812 return -EPERM;
2813 } else if (!capable(CAP_SYS_ADMIN)) {
2814 /* A different attribute in the security namespace.
2815 Restrict to administrator. */
2816 return -EPERM;
2817 }
2818 }
2819
2820 /* Not an attribute we recognize, so just check the
2821 ordinary setattr permission. */
2822 return dentry_has_perm(cred, dentry, FILE__SETATTR);
2823 }
2824
2825 static int selinux_inode_setxattr(struct dentry *dentry, const char *name,
2826 const void *value, size_t size, int flags)
2827 {
2828 struct inode *inode = dentry->d_inode;
2829 struct inode_security_struct *isec = inode->i_security;
2830 struct superblock_security_struct *sbsec;
2831 struct common_audit_data ad;
2832 u32 newsid, sid = current_sid();
2833 int rc = 0;
2834
2835 if (strcmp(name, XATTR_NAME_SELINUX))
2836 return selinux_inode_setotherxattr(dentry, name);
2837
2838 sbsec = inode->i_sb->s_security;
2839 if (!(sbsec->flags & SE_SBLABELSUPP))
2840 return -EOPNOTSUPP;
2841
2842 if (!inode_owner_or_capable(inode))
2843 return -EPERM;
2844
2845 ad.type = LSM_AUDIT_DATA_DENTRY;
2846 ad.u.dentry = dentry;
2847
2848 rc = avc_has_perm(sid, isec->sid, isec->sclass,
2849 FILE__RELABELFROM, &ad);
2850 if (rc)
2851 return rc;
2852
2853 rc = security_context_to_sid(value, size, &newsid);
2854 if (rc == -EINVAL) {
2855 if (!capable(CAP_MAC_ADMIN)) {
2856 struct audit_buffer *ab;
2857 size_t audit_size;
2858 const char *str;
2859
2860 /* We strip a nul only if it is at the end, otherwise the
2861 * context contains a nul and we should audit that */
2862 if (value) {
2863 str = value;
2864 if (str[size - 1] == '\0')
2865 audit_size = size - 1;
2866 else
2867 audit_size = size;
2868 } else {
2869 str = "";
2870 audit_size = 0;
2871 }
2872 ab = audit_log_start(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR);
2873 audit_log_format(ab, "op=setxattr invalid_context=");
2874 audit_log_n_untrustedstring(ab, value, audit_size);
2875 audit_log_end(ab);
2876
2877 return rc;
2878 }
2879 rc = security_context_to_sid_force(value, size, &newsid);
2880 }
2881 if (rc)
2882 return rc;
2883
2884 rc = avc_has_perm(sid, newsid, isec->sclass,
2885 FILE__RELABELTO, &ad);
2886 if (rc)
2887 return rc;
2888
2889 rc = security_validate_transition(isec->sid, newsid, sid,
2890 isec->sclass);
2891 if (rc)
2892 return rc;
2893
2894 return avc_has_perm(newsid,
2895 sbsec->sid,
2896 SECCLASS_FILESYSTEM,
2897 FILESYSTEM__ASSOCIATE,
2898 &ad);
2899 }
2900
2901 static void selinux_inode_post_setxattr(struct dentry *dentry, const char *name,
2902 const void *value, size_t size,
2903 int flags)
2904 {
2905 struct inode *inode = dentry->d_inode;
2906 struct inode_security_struct *isec = inode->i_security;
2907 u32 newsid;
2908 int rc;
2909
2910 if (strcmp(name, XATTR_NAME_SELINUX)) {
2911 /* Not an attribute we recognize, so nothing to do. */
2912 return;
2913 }
2914
2915 rc = security_context_to_sid_force(value, size, &newsid);
2916 if (rc) {
2917 printk(KERN_ERR "SELinux: unable to map context to SID"
2918 "for (%s, %lu), rc=%d\n",
2919 inode->i_sb->s_id, inode->i_ino, -rc);
2920 return;
2921 }
2922
2923 isec->sclass = inode_mode_to_security_class(inode->i_mode);
2924 isec->sid = newsid;
2925 isec->initialized = 1;
2926
2927 return;
2928 }
2929
2930 static int selinux_inode_getxattr(struct dentry *dentry, const char *name)
2931 {
2932 const struct cred *cred = current_cred();
2933
2934 return dentry_has_perm(cred, dentry, FILE__GETATTR);
2935 }
2936
2937 static int selinux_inode_listxattr(struct dentry *dentry)
2938 {
2939 const struct cred *cred = current_cred();
2940
2941 return dentry_has_perm(cred, dentry, FILE__GETATTR);
2942 }
2943
2944 static int selinux_inode_removexattr(struct dentry *dentry, const char *name)
2945 {
2946 if (strcmp(name, XATTR_NAME_SELINUX))
2947 return selinux_inode_setotherxattr(dentry, name);
2948
2949 /* No one is allowed to remove a SELinux security label.
2950 You can change the label, but all data must be labeled. */
2951 return -EACCES;
2952 }
2953
2954 /*
2955 * Copy the inode security context value to the user.
2956 *
2957 * Permission check is handled by selinux_inode_getxattr hook.
2958 */
2959 static int selinux_inode_getsecurity(const struct inode *inode, const char *name, void **buffer, bool alloc)
2960 {
2961 u32 size;
2962 int error;
2963 char *context = NULL;
2964 struct inode_security_struct *isec = inode->i_security;
2965
2966 if (strcmp(name, XATTR_SELINUX_SUFFIX))
2967 return -EOPNOTSUPP;
2968
2969 /*
2970 * If the caller has CAP_MAC_ADMIN, then get the raw context
2971 * value even if it is not defined by current policy; otherwise,
2972 * use the in-core value under current policy.
2973 * Use the non-auditing forms of the permission checks since
2974 * getxattr may be called by unprivileged processes commonly
2975 * and lack of permission just means that we fall back to the
2976 * in-core context value, not a denial.
2977 */
2978 error = selinux_capable(current_cred(), &init_user_ns, CAP_MAC_ADMIN,
2979 SECURITY_CAP_NOAUDIT);
2980 if (!error)
2981 error = security_sid_to_context_force(isec->sid, &context,
2982 &size);
2983 else
2984 error = security_sid_to_context(isec->sid, &context, &size);
2985 if (error)
2986 return error;
2987 error = size;
2988 if (alloc) {
2989 *buffer = context;
2990 goto out_nofree;
2991 }
2992 kfree(context);
2993 out_nofree:
2994 return error;
2995 }
2996
2997 static int selinux_inode_setsecurity(struct inode *inode, const char *name,
2998 const void *value, size_t size, int flags)
2999 {
3000 struct inode_security_struct *isec = inode->i_security;
3001 u32 newsid;
3002 int rc;
3003
3004 if (strcmp(name, XATTR_SELINUX_SUFFIX))
3005 return -EOPNOTSUPP;
3006
3007 if (!value || !size)
3008 return -EACCES;
3009
3010 rc = security_context_to_sid((void *)value, size, &newsid);
3011 if (rc)
3012 return rc;
3013
3014 isec->sclass = inode_mode_to_security_class(inode->i_mode);
3015 isec->sid = newsid;
3016 isec->initialized = 1;
3017 return 0;
3018 }
3019
3020 static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
3021 {
3022 const int len = sizeof(XATTR_NAME_SELINUX);
3023 if (buffer && len <= buffer_size)
3024 memcpy(buffer, XATTR_NAME_SELINUX, len);
3025 return len;
3026 }
3027
3028 static void selinux_inode_getsecid(const struct inode *inode, u32 *secid)
3029 {
3030 struct inode_security_struct *isec = inode->i_security;
3031 *secid = isec->sid;
3032 }
3033
3034 /* file security operations */
3035
3036 static int selinux_revalidate_file_permission(struct file *file, int mask)
3037 {
3038 const struct cred *cred = current_cred();
3039 struct inode *inode = file_inode(file);
3040
3041 /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
3042 if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
3043 mask |= MAY_APPEND;
3044
3045 return file_has_perm(cred, file,
3046 file_mask_to_av(inode->i_mode, mask));
3047 }
3048
3049 static int selinux_file_permission(struct file *file, int mask)
3050 {
3051 struct inode *inode = file_inode(file);
3052 struct file_security_struct *fsec = file->f_security;
3053 struct inode_security_struct *isec = inode->i_security;
3054 u32 sid = current_sid();
3055
3056 if (!mask)
3057 /* No permission to check. Existence test. */
3058 return 0;
3059
3060 if (sid == fsec->sid && fsec->isid == isec->sid &&
3061 fsec->pseqno == avc_policy_seqno())
3062 /* No change since file_open check. */
3063 return 0;
3064
3065 return selinux_revalidate_file_permission(file, mask);
3066 }
3067
3068 static int selinux_file_alloc_security(struct file *file)
3069 {
3070 return file_alloc_security(file);
3071 }
3072
3073 static void selinux_file_free_security(struct file *file)
3074 {
3075 file_free_security(file);
3076 }
3077
3078 static int selinux_file_ioctl(struct file *file, unsigned int cmd,
3079 unsigned long arg)
3080 {
3081 const struct cred *cred = current_cred();
3082 int error = 0;
3083
3084 switch (cmd) {
3085 case FIONREAD:
3086 /* fall through */
3087 case FIBMAP:
3088 /* fall through */
3089 case FIGETBSZ:
3090 /* fall through */
3091 case FS_IOC_GETFLAGS:
3092 /* fall through */
3093 case FS_IOC_GETVERSION:
3094 error = file_has_perm(cred, file, FILE__GETATTR);
3095 break;
3096
3097 case FS_IOC_SETFLAGS:
3098 /* fall through */
3099 case FS_IOC_SETVERSION:
3100 error = file_has_perm(cred, file, FILE__SETATTR);
3101 break;
3102
3103 /* sys_ioctl() checks */
3104 case FIONBIO:
3105 /* fall through */
3106 case FIOASYNC:
3107 error = file_has_perm(cred, file, 0);
3108 break;
3109
3110 case KDSKBENT:
3111 case KDSKBSENT:
3112 error = cred_has_capability(cred, CAP_SYS_TTY_CONFIG,
3113 SECURITY_CAP_AUDIT);
3114 break;
3115
3116 /* default case assumes that the command will go
3117 * to the file's ioctl() function.
3118 */
3119 default:
3120 error = file_has_perm(cred, file, FILE__IOCTL);
3121 }
3122 return error;
3123 }
3124
3125 static int default_noexec;
3126
3127 static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
3128 {
3129 const struct cred *cred = current_cred();
3130 int rc = 0;
3131
3132 if (default_noexec &&
3133 (prot & PROT_EXEC) && (!file || (!shared && (prot & PROT_WRITE)))) {
3134 /*
3135 * We are making executable an anonymous mapping or a
3136 * private file mapping that will also be writable.
3137 * This has an additional check.
3138 */
3139 rc = cred_has_perm(cred, cred, PROCESS__EXECMEM);
3140 if (rc)
3141 goto error;
3142 }
3143
3144 if (file) {
3145 /* read access is always possible with a mapping */
3146 u32 av = FILE__READ;
3147
3148 /* write access only matters if the mapping is shared */
3149 if (shared && (prot & PROT_WRITE))
3150 av |= FILE__WRITE;
3151
3152 if (prot & PROT_EXEC)
3153 av |= FILE__EXECUTE;
3154
3155 return file_has_perm(cred, file, av);
3156 }
3157
3158 error:
3159 return rc;
3160 }
3161
3162 static int selinux_mmap_addr(unsigned long addr)
3163 {
3164 int rc = 0;
3165 u32 sid = current_sid();
3166
3167 /*
3168 * notice that we are intentionally putting the SELinux check before
3169 * the secondary cap_file_mmap check. This is such a likely attempt
3170 * at bad behaviour/exploit that we always want to get the AVC, even
3171 * if DAC would have also denied the operation.
3172 */
3173 if (addr < CONFIG_LSM_MMAP_MIN_ADDR) {
3174 rc = avc_has_perm(sid, sid, SECCLASS_MEMPROTECT,
3175 MEMPROTECT__MMAP_ZERO, NULL);
3176 if (rc)
3177 return rc;
3178 }
3179
3180 /* do DAC check on address space usage */
3181 return cap_mmap_addr(addr);
3182 }
3183
3184 static int selinux_mmap_file(struct file *file, unsigned long reqprot,
3185 unsigned long prot, unsigned long flags)
3186 {
3187 if (selinux_checkreqprot)
3188 prot = reqprot;
3189
3190 return file_map_prot_check(file, prot,
3191 (flags & MAP_TYPE) == MAP_SHARED);
3192 }
3193
3194 static int selinux_file_mprotect(struct vm_area_struct *vma,
3195 unsigned long reqprot,
3196 unsigned long prot)
3197 {
3198 const struct cred *cred = current_cred();
3199
3200 if (selinux_checkreqprot)
3201 prot = reqprot;
3202
3203 if (default_noexec &&
3204 (prot & PROT_EXEC) && !(vma->vm_flags & VM_EXEC)) {
3205 int rc = 0;
3206 if (vma->vm_start >= vma->vm_mm->start_brk &&
3207 vma->vm_end <= vma->vm_mm->brk) {
3208 rc = cred_has_perm(cred, cred, PROCESS__EXECHEAP);
3209 } else if (!vma->vm_file &&
3210 vma->vm_start <= vma->vm_mm->start_stack &&
3211 vma->vm_end >= vma->vm_mm->start_stack) {
3212 rc = current_has_perm(current, PROCESS__EXECSTACK);
3213 } else if (vma->vm_file && vma->anon_vma) {
3214 /*
3215 * We are making executable a file mapping that has
3216 * had some COW done. Since pages might have been
3217 * written, check ability to execute the possibly
3218 * modified content. This typically should only
3219 * occur for text relocations.
3220 */
3221 rc = file_has_perm(cred, vma->vm_file, FILE__EXECMOD);
3222 }
3223 if (rc)
3224 return rc;
3225 }
3226
3227 return file_map_prot_check(vma->vm_file, prot, vma->vm_flags&VM_SHARED);
3228 }
3229
3230 static int selinux_file_lock(struct file *file, unsigned int cmd)
3231 {
3232 const struct cred *cred = current_cred();
3233
3234 return file_has_perm(cred, file, FILE__LOCK);
3235 }
3236
3237 static int selinux_file_fcntl(struct file *file, unsigned int cmd,
3238 unsigned long arg)
3239 {
3240 const struct cred *cred = current_cred();
3241 int err = 0;
3242
3243 switch (cmd) {
3244 case F_SETFL:
3245 if ((file->f_flags & O_APPEND) && !(arg & O_APPEND)) {
3246 err = file_has_perm(cred, file, FILE__WRITE);
3247 break;
3248 }
3249 /* fall through */
3250 case F_SETOWN:
3251 case F_SETSIG:
3252 case F_GETFL:
3253 case F_GETOWN:
3254 case F_GETSIG:
3255 case F_GETOWNER_UIDS:
3256 /* Just check FD__USE permission */
3257 err = file_has_perm(cred, file, 0);
3258 break;
3259 case F_GETLK:
3260 case F_SETLK:
3261 case F_SETLKW:
3262 #if BITS_PER_LONG == 32
3263 case F_GETLK64:
3264 case F_SETLK64:
3265 case F_SETLKW64:
3266 #endif
3267 err = file_has_perm(cred, file, FILE__LOCK);
3268 break;
3269 }
3270
3271 return err;
3272 }
3273
3274 static int selinux_file_set_fowner(struct file *file)
3275 {
3276 struct file_security_struct *fsec;
3277
3278 fsec = file->f_security;
3279 fsec->fown_sid = current_sid();
3280
3281 return 0;
3282 }
3283
3284 static int selinux_file_send_sigiotask(struct task_struct *tsk,
3285 struct fown_struct *fown, int signum)
3286 {
3287 struct file *file;
3288 u32 sid = task_sid(tsk);
3289 u32 perm;
3290 struct file_security_struct *fsec;
3291
3292 /* struct fown_struct is never outside the context of a struct file */
3293 file = container_of(fown, struct file, f_owner);
3294
3295 fsec = file->f_security;
3296
3297 if (!signum)
3298 perm = signal_to_av(SIGIO); /* as per send_sigio_to_task */
3299 else
3300 perm = signal_to_av(signum);
3301
3302 return avc_has_perm(fsec->fown_sid, sid,
3303 SECCLASS_PROCESS, perm, NULL);
3304 }
3305
3306 static int selinux_file_receive(struct file *file)
3307 {
3308 const struct cred *cred = current_cred();
3309
3310 return file_has_perm(cred, file, file_to_av(file));
3311 }
3312
3313 static int selinux_file_open(struct file *file, const struct cred *cred)
3314 {
3315 struct file_security_struct *fsec;
3316 struct inode_security_struct *isec;
3317
3318 fsec = file->f_security;
3319 isec = file_inode(file)->i_security;
3320 /*
3321 * Save inode label and policy sequence number
3322 * at open-time so that selinux_file_permission
3323 * can determine whether revalidation is necessary.
3324 * Task label is already saved in the file security
3325 * struct as its SID.
3326 */
3327 fsec->isid = isec->sid;
3328 fsec->pseqno = avc_policy_seqno();
3329 /*
3330 * Since the inode label or policy seqno may have changed
3331 * between the selinux_inode_permission check and the saving
3332 * of state above, recheck that access is still permitted.
3333 * Otherwise, access might never be revalidated against the
3334 * new inode label or new policy.
3335 * This check is not redundant - do not remove.
3336 */
3337 return file_path_has_perm(cred, file, open_file_to_av(file));
3338 }
3339
3340 /* task security operations */
3341
3342 static int selinux_task_create(unsigned long clone_flags)
3343 {
3344 return current_has_perm(current, PROCESS__FORK);
3345 }
3346
3347 /*
3348 * allocate the SELinux part of blank credentials
3349 */
3350 static int selinux_cred_alloc_blank(struct cred *cred, gfp_t gfp)
3351 {
3352 struct task_security_struct *tsec;
3353
3354 tsec = kzalloc(sizeof(struct task_security_struct), gfp);
3355 if (!tsec)
3356 return -ENOMEM;
3357
3358 cred->security = tsec;
3359 return 0;
3360 }
3361
3362 /*
3363 * detach and free the LSM part of a set of credentials
3364 */
3365 static void selinux_cred_free(struct cred *cred)
3366 {
3367 struct task_security_struct *tsec = cred->security;
3368
3369 /*
3370 * cred->security == NULL if security_cred_alloc_blank() or
3371 * security_prepare_creds() returned an error.
3372 */
3373 BUG_ON(cred->security && (unsigned long) cred->security < PAGE_SIZE);
3374 cred->security = (void *) 0x7UL;
3375 kfree(tsec);
3376 }
3377
3378 /*
3379 * prepare a new set of credentials for modification
3380 */
3381 static int selinux_cred_prepare(struct cred *new, const struct cred *old,
3382 gfp_t gfp)
3383 {
3384 const struct task_security_struct *old_tsec;
3385 struct task_security_struct *tsec;
3386
3387 old_tsec = old->security;
3388
3389 tsec = kmemdup(old_tsec, sizeof(struct task_security_struct), gfp);
3390 if (!tsec)
3391 return -ENOMEM;
3392
3393 new->security = tsec;
3394 return 0;
3395 }
3396
3397 /*
3398 * transfer the SELinux data to a blank set of creds
3399 */
3400 static void selinux_cred_transfer(struct cred *new, const struct cred *old)
3401 {
3402 const struct task_security_struct *old_tsec = old->security;
3403 struct task_security_struct *tsec = new->security;
3404
3405 *tsec = *old_tsec;
3406 }
3407
3408 /*
3409 * set the security data for a kernel service
3410 * - all the creation contexts are set to unlabelled
3411 */
3412 static int selinux_kernel_act_as(struct cred *new, u32 secid)
3413 {
3414 struct task_security_struct *tsec = new->security;
3415 u32 sid = current_sid();
3416 int ret;
3417
3418 ret = avc_has_perm(sid, secid,
3419 SECCLASS_KERNEL_SERVICE,
3420 KERNEL_SERVICE__USE_AS_OVERRIDE,
3421 NULL);
3422 if (ret == 0) {
3423 tsec->sid = secid;
3424 tsec->create_sid = 0;
3425 tsec->keycreate_sid = 0;
3426 tsec->sockcreate_sid = 0;
3427 }
3428 return ret;
3429 }
3430
3431 /*
3432 * set the file creation context in a security record to the same as the
3433 * objective context of the specified inode
3434 */
3435 static int selinux_kernel_create_files_as(struct cred *new, struct inode *inode)
3436 {
3437 struct inode_security_struct *isec = inode->i_security;
3438 struct task_security_struct *tsec = new->security;
3439 u32 sid = current_sid();
3440 int ret;
3441
3442 ret = avc_has_perm(sid, isec->sid,
3443 SECCLASS_KERNEL_SERVICE,
3444 KERNEL_SERVICE__CREATE_FILES_AS,
3445 NULL);
3446
3447 if (ret == 0)
3448 tsec->create_sid = isec->sid;
3449 return ret;
3450 }
3451
3452 static int selinux_kernel_module_request(char *kmod_name)
3453 {
3454 u32 sid;
3455 struct common_audit_data ad;
3456
3457 sid = task_sid(current);
3458
3459 ad.type = LSM_AUDIT_DATA_KMOD;
3460 ad.u.kmod_name = kmod_name;
3461
3462 return avc_has_perm(sid, SECINITSID_KERNEL, SECCLASS_SYSTEM,
3463 SYSTEM__MODULE_REQUEST, &ad);
3464 }
3465
3466 static int selinux_task_setpgid(struct task_struct *p, pid_t pgid)
3467 {
3468 return current_has_perm(p, PROCESS__SETPGID);
3469 }
3470
3471 static int selinux_task_getpgid(struct task_struct *p)
3472 {
3473 return current_has_perm(p, PROCESS__GETPGID);
3474 }
3475
3476 static int selinux_task_getsid(struct task_struct *p)
3477 {
3478 return current_has_perm(p, PROCESS__GETSESSION);
3479 }
3480
3481 static void selinux_task_getsecid(struct task_struct *p, u32 *secid)
3482 {
3483 *secid = task_sid(p);
3484 }
3485
3486 static int selinux_task_setnice(struct task_struct *p, int nice)
3487 {
3488 int rc;
3489
3490 rc = cap_task_setnice(p, nice);
3491 if (rc)
3492 return rc;
3493
3494 return current_has_perm(p, PROCESS__SETSCHED);
3495 }
3496
3497 static int selinux_task_setioprio(struct task_struct *p, int ioprio)
3498 {
3499 int rc;
3500
3501 rc = cap_task_setioprio(p, ioprio);
3502 if (rc)
3503 return rc;
3504
3505 return current_has_perm(p, PROCESS__SETSCHED);
3506 }
3507
3508 static int selinux_task_getioprio(struct task_struct *p)
3509 {
3510 return current_has_perm(p, PROCESS__GETSCHED);
3511 }
3512
3513 static int selinux_task_setrlimit(struct task_struct *p, unsigned int resource,
3514 struct rlimit *new_rlim)
3515 {
3516 struct rlimit *old_rlim = p->signal->rlim + resource;
3517
3518 /* Control the ability to change the hard limit (whether
3519 lowering or raising it), so that the hard limit can
3520 later be used as a safe reset point for the soft limit
3521 upon context transitions. See selinux_bprm_committing_creds. */
3522 if (old_rlim->rlim_max != new_rlim->rlim_max)
3523 return current_has_perm(p, PROCESS__SETRLIMIT);
3524
3525 return 0;
3526 }
3527
3528 static int selinux_task_setscheduler(struct task_struct *p)
3529 {
3530 int rc;
3531
3532 rc = cap_task_setscheduler(p);
3533 if (rc)
3534 return rc;
3535
3536 return current_has_perm(p, PROCESS__SETSCHED);
3537 }
3538
3539 static int selinux_task_getscheduler(struct task_struct *p)
3540 {
3541 return current_has_perm(p, PROCESS__GETSCHED);
3542 }
3543
3544 static int selinux_task_movememory(struct task_struct *p)
3545 {
3546 return current_has_perm(p, PROCESS__SETSCHED);
3547 }
3548
3549 static int selinux_task_kill(struct task_struct *p, struct siginfo *info,
3550 int sig, u32 secid)
3551 {
3552 u32 perm;
3553 int rc;
3554
3555 if (!sig)
3556 perm = PROCESS__SIGNULL; /* null signal; existence test */
3557 else
3558 perm = signal_to_av(sig);
3559 if (secid)
3560 rc = avc_has_perm(secid, task_sid(p),
3561 SECCLASS_PROCESS, perm, NULL);
3562 else
3563 rc = current_has_perm(p, perm);
3564 return rc;
3565 }
3566
3567 static int selinux_task_wait(struct task_struct *p)
3568 {
3569 return task_has_perm(p, current, PROCESS__SIGCHLD);
3570 }
3571
3572 static void selinux_task_to_inode(struct task_struct *p,
3573 struct inode *inode)
3574 {
3575 struct inode_security_struct *isec = inode->i_security;
3576 u32 sid = task_sid(p);
3577
3578 isec->sid = sid;
3579 isec->initialized = 1;
3580 }
3581
3582 /* Returns error only if unable to parse addresses */
3583 static int selinux_parse_skb_ipv4(struct sk_buff *skb,
3584 struct common_audit_data *ad, u8 *proto)
3585 {
3586 int offset, ihlen, ret = -EINVAL;
3587 struct iphdr _iph, *ih;
3588
3589 offset = skb_network_offset(skb);
3590 ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
3591 if (ih == NULL)
3592 goto out;
3593
3594 ihlen = ih->ihl * 4;
3595 if (ihlen < sizeof(_iph))
3596 goto out;
3597
3598 ad->u.net->v4info.saddr = ih->saddr;
3599 ad->u.net->v4info.daddr = ih->daddr;
3600 ret = 0;
3601
3602 if (proto)
3603 *proto = ih->protocol;
3604
3605 switch (ih->protocol) {
3606 case IPPROTO_TCP: {
3607 struct tcphdr _tcph, *th;
3608
3609 if (ntohs(ih->frag_off) & IP_OFFSET)
3610 break;
3611
3612 offset += ihlen;
3613 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
3614 if (th == NULL)
3615 break;
3616
3617 ad->u.net->sport = th->source;
3618 ad->u.net->dport = th->dest;
3619 break;
3620 }
3621
3622 case IPPROTO_UDP: {
3623 struct udphdr _udph, *uh;
3624
3625 if (ntohs(ih->frag_off) & IP_OFFSET)
3626 break;
3627
3628 offset += ihlen;
3629 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
3630 if (uh == NULL)
3631 break;
3632
3633 ad->u.net->sport = uh->source;
3634 ad->u.net->dport = uh->dest;
3635 break;
3636 }
3637
3638 case IPPROTO_DCCP: {
3639 struct dccp_hdr _dccph, *dh;
3640
3641 if (ntohs(ih->frag_off) & IP_OFFSET)
3642 break;
3643
3644 offset += ihlen;
3645 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3646 if (dh == NULL)
3647 break;
3648
3649 ad->u.net->sport = dh->dccph_sport;
3650 ad->u.net->dport = dh->dccph_dport;
3651 break;
3652 }
3653
3654 default:
3655 break;
3656 }
3657 out:
3658 return ret;
3659 }
3660
3661 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3662
3663 /* Returns error only if unable to parse addresses */
3664 static int selinux_parse_skb_ipv6(struct sk_buff *skb,
3665 struct common_audit_data *ad, u8 *proto)
3666 {
3667 u8 nexthdr;
3668 int ret = -EINVAL, offset;
3669 struct ipv6hdr _ipv6h, *ip6;
3670 __be16 frag_off;
3671
3672 offset = skb_network_offset(skb);
3673 ip6 = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h);
3674 if (ip6 == NULL)
3675 goto out;
3676
3677 ad->u.net->v6info.saddr = ip6->saddr;
3678 ad->u.net->v6info.daddr = ip6->daddr;
3679 ret = 0;
3680
3681 nexthdr = ip6->nexthdr;
3682 offset += sizeof(_ipv6h);
3683 offset = ipv6_skip_exthdr(skb, offset, &nexthdr, &frag_off);
3684 if (offset < 0)
3685 goto out;
3686
3687 if (proto)
3688 *proto = nexthdr;
3689
3690 switch (nexthdr) {
3691 case IPPROTO_TCP: {
3692 struct tcphdr _tcph, *th;
3693
3694 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
3695 if (th == NULL)
3696 break;
3697
3698 ad->u.net->sport = th->source;
3699 ad->u.net->dport = th->dest;
3700 break;
3701 }
3702
3703 case IPPROTO_UDP: {
3704 struct udphdr _udph, *uh;
3705
3706 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
3707 if (uh == NULL)
3708 break;
3709
3710 ad->u.net->sport = uh->source;
3711 ad->u.net->dport = uh->dest;
3712 break;
3713 }
3714
3715 case IPPROTO_DCCP: {
3716 struct dccp_hdr _dccph, *dh;
3717
3718 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3719 if (dh == NULL)
3720 break;
3721
3722 ad->u.net->sport = dh->dccph_sport;
3723 ad->u.net->dport = dh->dccph_dport;
3724 break;
3725 }
3726
3727 /* includes fragments */
3728 default:
3729 break;
3730 }
3731 out:
3732 return ret;
3733 }
3734
3735 #endif /* IPV6 */
3736
3737 static int selinux_parse_skb(struct sk_buff *skb, struct common_audit_data *ad,
3738 char **_addrp, int src, u8 *proto)
3739 {
3740 char *addrp;
3741 int ret;
3742
3743 switch (ad->u.net->family) {
3744 case PF_INET:
3745 ret = selinux_parse_skb_ipv4(skb, ad, proto);
3746 if (ret)
3747 goto parse_error;
3748 addrp = (char *)(src ? &ad->u.net->v4info.saddr :
3749 &ad->u.net->v4info.daddr);
3750 goto okay;
3751
3752 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3753 case PF_INET6:
3754 ret = selinux_parse_skb_ipv6(skb, ad, proto);
3755 if (ret)
3756 goto parse_error;
3757 addrp = (char *)(src ? &ad->u.net->v6info.saddr :
3758 &ad->u.net->v6info.daddr);
3759 goto okay;
3760 #endif /* IPV6 */
3761 default:
3762 addrp = NULL;
3763 goto okay;
3764 }
3765
3766 parse_error:
3767 printk(KERN_WARNING
3768 "SELinux: failure in selinux_parse_skb(),"
3769 " unable to parse packet\n");
3770 return ret;
3771
3772 okay:
3773 if (_addrp)
3774 *_addrp = addrp;
3775 return 0;
3776 }
3777
3778 /**
3779 * selinux_skb_peerlbl_sid - Determine the peer label of a packet
3780 * @skb: the packet
3781 * @family: protocol family
3782 * @sid: the packet's peer label SID
3783 *
3784 * Description:
3785 * Check the various different forms of network peer labeling and determine
3786 * the peer label/SID for the packet; most of the magic actually occurs in
3787 * the security server function security_net_peersid_cmp(). The function
3788 * returns zero if the value in @sid is valid (although it may be SECSID_NULL)
3789 * or -EACCES if @sid is invalid due to inconsistencies with the different
3790 * peer labels.
3791 *
3792 */
3793 static int selinux_skb_peerlbl_sid(struct sk_buff *skb, u16 family, u32 *sid)
3794 {
3795 int err;
3796 u32 xfrm_sid;
3797 u32 nlbl_sid;
3798 u32 nlbl_type;
3799
3800 selinux_skb_xfrm_sid(skb, &xfrm_sid);
3801 selinux_netlbl_skbuff_getsid(skb, family, &nlbl_type, &nlbl_sid);
3802
3803 err = security_net_peersid_resolve(nlbl_sid, nlbl_type, xfrm_sid, sid);
3804 if (unlikely(err)) {
3805 printk(KERN_WARNING
3806 "SELinux: failure in selinux_skb_peerlbl_sid(),"
3807 " unable to determine packet's peer label\n");
3808 return -EACCES;
3809 }
3810
3811 return 0;
3812 }
3813
3814 /* socket security operations */
3815
3816 static int socket_sockcreate_sid(const struct task_security_struct *tsec,
3817 u16 secclass, u32 *socksid)
3818 {
3819 if (tsec->sockcreate_sid > SECSID_NULL) {
3820 *socksid = tsec->sockcreate_sid;
3821 return 0;
3822 }
3823
3824 return security_transition_sid(tsec->sid, tsec->sid, secclass, NULL,
3825 socksid);
3826 }
3827
3828 static int sock_has_perm(struct task_struct *task, struct sock *sk, u32 perms)
3829 {
3830 struct sk_security_struct *sksec = sk->sk_security;
3831 struct common_audit_data ad;
3832 struct lsm_network_audit net = {0,};
3833 u32 tsid = task_sid(task);
3834
3835 if (sksec->sid == SECINITSID_KERNEL)
3836 return 0;
3837
3838 ad.type = LSM_AUDIT_DATA_NET;
3839 ad.u.net = &net;
3840 ad.u.net->sk = sk;
3841
3842 return avc_has_perm(tsid, sksec->sid, sksec->sclass, perms, &ad);
3843 }
3844
3845 static int selinux_socket_create(int family, int type,
3846 int protocol, int kern)
3847 {
3848 const struct task_security_struct *tsec = current_security();
3849 u32 newsid;
3850 u16 secclass;
3851 int rc;
3852
3853 if (kern)
3854 return 0;
3855
3856 secclass = socket_type_to_security_class(family, type, protocol);
3857 rc = socket_sockcreate_sid(tsec, secclass, &newsid);
3858 if (rc)
3859 return rc;
3860
3861 return avc_has_perm(tsec->sid, newsid, secclass, SOCKET__CREATE, NULL);
3862 }
3863
3864 static int selinux_socket_post_create(struct socket *sock, int family,
3865 int type, int protocol, int kern)
3866 {
3867 const struct task_security_struct *tsec = current_security();
3868 struct inode_security_struct *isec = SOCK_INODE(sock)->i_security;
3869 struct sk_security_struct *sksec;
3870 int err = 0;
3871
3872 isec->sclass = socket_type_to_security_class(family, type, protocol);
3873
3874 if (kern)
3875 isec->sid = SECINITSID_KERNEL;
3876 else {
3877 err = socket_sockcreate_sid(tsec, isec->sclass, &(isec->sid));
3878 if (err)
3879 return err;
3880 }
3881
3882 isec->initialized = 1;
3883
3884 if (sock->sk) {
3885 sksec = sock->sk->sk_security;
3886 sksec->sid = isec->sid;
3887 sksec->sclass = isec->sclass;
3888 err = selinux_netlbl_socket_post_create(sock->sk, family);
3889 }
3890
3891 return err;
3892 }
3893
3894 /* Range of port numbers used to automatically bind.
3895 Need to determine whether we should perform a name_bind
3896 permission check between the socket and the port number. */
3897
3898 static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
3899 {
3900 struct sock *sk = sock->sk;
3901 u16 family;
3902 int err;
3903
3904 err = sock_has_perm(current, sk, SOCKET__BIND);
3905 if (err)
3906 goto out;
3907
3908 /*
3909 * If PF_INET or PF_INET6, check name_bind permission for the port.
3910 * Multiple address binding for SCTP is not supported yet: we just
3911 * check the first address now.
3912 */
3913 family = sk->sk_family;
3914 if (family == PF_INET || family == PF_INET6) {
3915 char *addrp;
3916 struct sk_security_struct *sksec = sk->sk_security;
3917 struct common_audit_data ad;
3918 struct lsm_network_audit net = {0,};
3919 struct sockaddr_in *addr4 = NULL;
3920 struct sockaddr_in6 *addr6 = NULL;
3921 unsigned short snum;
3922 u32 sid, node_perm;
3923
3924 if (family == PF_INET) {
3925 addr4 = (struct sockaddr_in *)address;
3926 snum = ntohs(addr4->sin_port);
3927 addrp = (char *)&addr4->sin_addr.s_addr;
3928 } else {
3929 addr6 = (struct sockaddr_in6 *)address;
3930 snum = ntohs(addr6->sin6_port);
3931 addrp = (char *)&addr6->sin6_addr.s6_addr;
3932 }
3933
3934 if (snum) {
3935 int low, high;
3936
3937 inet_get_local_port_range(&low, &high);
3938
3939 if (snum < max(PROT_SOCK, low) || snum > high) {
3940 err = sel_netport_sid(sk->sk_protocol,
3941 snum, &sid);
3942 if (err)
3943 goto out;
3944 ad.type = LSM_AUDIT_DATA_NET;
3945 ad.u.net = &net;
3946 ad.u.net->sport = htons(snum);
3947 ad.u.net->family = family;
3948 err = avc_has_perm(sksec->sid, sid,
3949 sksec->sclass,
3950 SOCKET__NAME_BIND, &ad);
3951 if (err)
3952 goto out;
3953 }
3954 }
3955
3956 switch (sksec->sclass) {
3957 case SECCLASS_TCP_SOCKET:
3958 node_perm = TCP_SOCKET__NODE_BIND;
3959 break;
3960
3961 case SECCLASS_UDP_SOCKET:
3962 node_perm = UDP_SOCKET__NODE_BIND;
3963 break;
3964
3965 case SECCLASS_DCCP_SOCKET:
3966 node_perm = DCCP_SOCKET__NODE_BIND;
3967 break;
3968
3969 default:
3970 node_perm = RAWIP_SOCKET__NODE_BIND;
3971 break;
3972 }
3973
3974 err = sel_netnode_sid(addrp, family, &sid);
3975 if (err)
3976 goto out;
3977
3978 ad.type = LSM_AUDIT_DATA_NET;
3979 ad.u.net = &net;
3980 ad.u.net->sport = htons(snum);
3981 ad.u.net->family = family;
3982
3983 if (family == PF_INET)
3984 ad.u.net->v4info.saddr = addr4->sin_addr.s_addr;
3985 else
3986 ad.u.net->v6info.saddr = addr6->sin6_addr;
3987
3988 err = avc_has_perm(sksec->sid, sid,
3989 sksec->sclass, node_perm, &ad);
3990 if (err)
3991 goto out;
3992 }
3993 out:
3994 return err;
3995 }
3996
3997 static int selinux_socket_connect(struct socket *sock, struct sockaddr *address, int addrlen)
3998 {
3999 struct sock *sk = sock->sk;
4000 struct sk_security_struct *sksec = sk->sk_security;
4001 int err;
4002
4003 err = sock_has_perm(current, sk, SOCKET__CONNECT);
4004 if (err)
4005 return err;
4006
4007 /*
4008 * If a TCP or DCCP socket, check name_connect permission for the port.
4009 */
4010 if (sksec->sclass == SECCLASS_TCP_SOCKET ||
4011 sksec->sclass == SECCLASS_DCCP_SOCKET) {
4012 struct common_audit_data ad;
4013 struct lsm_network_audit net = {0,};
4014 struct sockaddr_in *addr4 = NULL;
4015 struct sockaddr_in6 *addr6 = NULL;
4016 unsigned short snum;
4017 u32 sid, perm;
4018
4019 if (sk->sk_family == PF_INET) {
4020 addr4 = (struct sockaddr_in *)address;
4021 if (addrlen < sizeof(struct sockaddr_in))
4022 return -EINVAL;
4023 snum = ntohs(addr4->sin_port);
4024 } else {
4025 addr6 = (struct sockaddr_in6 *)address;
4026 if (addrlen < SIN6_LEN_RFC2133)
4027 return -EINVAL;
4028 snum = ntohs(addr6->sin6_port);
4029 }
4030
4031 err = sel_netport_sid(sk->sk_protocol, snum, &sid);
4032 if (err)
4033 goto out;
4034
4035 perm = (sksec->sclass == SECCLASS_TCP_SOCKET) ?
4036 TCP_SOCKET__NAME_CONNECT : DCCP_SOCKET__NAME_CONNECT;
4037
4038 ad.type = LSM_AUDIT_DATA_NET;
4039 ad.u.net = &net;
4040 ad.u.net->dport = htons(snum);
4041 ad.u.net->family = sk->sk_family;
4042 err = avc_has_perm(sksec->sid, sid, sksec->sclass, perm, &ad);
4043 if (err)
4044 goto out;
4045 }
4046
4047 err = selinux_netlbl_socket_connect(sk, address);
4048
4049 out:
4050 return err;
4051 }
4052
4053 static int selinux_socket_listen(struct socket *sock, int backlog)
4054 {
4055 return sock_has_perm(current, sock->sk, SOCKET__LISTEN);
4056 }
4057
4058 static int selinux_socket_accept(struct socket *sock, struct socket *newsock)
4059 {
4060 int err;
4061 struct inode_security_struct *isec;
4062 struct inode_security_struct *newisec;
4063
4064 err = sock_has_perm(current, sock->sk, SOCKET__ACCEPT);
4065 if (err)
4066 return err;
4067
4068 newisec = SOCK_INODE(newsock)->i_security;
4069
4070 isec = SOCK_INODE(sock)->i_security;
4071 newisec->sclass = isec->sclass;
4072 newisec->sid = isec->sid;
4073 newisec->initialized = 1;
4074
4075 return 0;
4076 }
4077
4078 static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg,
4079 int size)
4080 {
4081 return sock_has_perm(current, sock->sk, SOCKET__WRITE);
4082 }
4083
4084 static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg,
4085 int size, int flags)
4086 {
4087 return sock_has_perm(current, sock->sk, SOCKET__READ);
4088 }
4089
4090 static int selinux_socket_getsockname(struct socket *sock)
4091 {
4092 return sock_has_perm(current, sock->sk, SOCKET__GETATTR);
4093 }
4094
4095 static int selinux_socket_getpeername(struct socket *sock)
4096 {
4097 return sock_has_perm(current, sock->sk, SOCKET__GETATTR);
4098 }
4099
4100 static int selinux_socket_setsockopt(struct socket *sock, int level, int optname)
4101 {
4102 int err;
4103
4104 err = sock_has_perm(current, sock->sk, SOCKET__SETOPT);
4105 if (err)
4106 return err;
4107
4108 return selinux_netlbl_socket_setsockopt(sock, level, optname);
4109 }
4110
4111 static int selinux_socket_getsockopt(struct socket *sock, int level,
4112 int optname)
4113 {
4114 return sock_has_perm(current, sock->sk, SOCKET__GETOPT);
4115 }
4116
4117 static int selinux_socket_shutdown(struct socket *sock, int how)
4118 {
4119 return sock_has_perm(current, sock->sk, SOCKET__SHUTDOWN);
4120 }
4121
4122 static int selinux_socket_unix_stream_connect(struct sock *sock,
4123 struct sock *other,
4124 struct sock *newsk)
4125 {
4126 struct sk_security_struct *sksec_sock = sock->sk_security;
4127 struct sk_security_struct *sksec_other = other->sk_security;
4128 struct sk_security_struct *sksec_new = newsk->sk_security;
4129 struct common_audit_data ad;
4130 struct lsm_network_audit net = {0,};
4131 int err;
4132
4133 ad.type = LSM_AUDIT_DATA_NET;
4134 ad.u.net = &net;
4135 ad.u.net->sk = other;
4136
4137 err = avc_has_perm(sksec_sock->sid, sksec_other->sid,
4138 sksec_other->sclass,
4139 UNIX_STREAM_SOCKET__CONNECTTO, &ad);
4140 if (err)
4141 return err;
4142
4143 /* server child socket */
4144 sksec_new->peer_sid = sksec_sock->sid;
4145 err = security_sid_mls_copy(sksec_other->sid, sksec_sock->sid,
4146 &sksec_new->sid);
4147 if (err)
4148 return err;
4149
4150 /* connecting socket */
4151 sksec_sock->peer_sid = sksec_new->sid;
4152
4153 return 0;
4154 }
4155
4156 static int selinux_socket_unix_may_send(struct socket *sock,
4157 struct socket *other)
4158 {
4159 struct sk_security_struct *ssec = sock->sk->sk_security;
4160 struct sk_security_struct *osec = other->sk->sk_security;
4161 struct common_audit_data ad;
4162 struct lsm_network_audit net = {0,};
4163
4164 ad.type = LSM_AUDIT_DATA_NET;
4165 ad.u.net = &net;
4166 ad.u.net->sk = other->sk;
4167
4168 return avc_has_perm(ssec->sid, osec->sid, osec->sclass, SOCKET__SENDTO,
4169 &ad);
4170 }
4171
4172 static int selinux_inet_sys_rcv_skb(int ifindex, char *addrp, u16 family,
4173 u32 peer_sid,
4174 struct common_audit_data *ad)
4175 {
4176 int err;
4177 u32 if_sid;
4178 u32 node_sid;
4179
4180 err = sel_netif_sid(ifindex, &if_sid);
4181 if (err)
4182 return err;
4183 err = avc_has_perm(peer_sid, if_sid,
4184 SECCLASS_NETIF, NETIF__INGRESS, ad);
4185 if (err)
4186 return err;
4187
4188 err = sel_netnode_sid(addrp, family, &node_sid);
4189 if (err)
4190 return err;
4191 return avc_has_perm(peer_sid, node_sid,
4192 SECCLASS_NODE, NODE__RECVFROM, ad);
4193 }
4194
4195 static int selinux_sock_rcv_skb_compat(struct sock *sk, struct sk_buff *skb,
4196 u16 family)
4197 {
4198 int err = 0;
4199 struct sk_security_struct *sksec = sk->sk_security;
4200 u32 sk_sid = sksec->sid;
4201 struct common_audit_data ad;
4202 struct lsm_network_audit net = {0,};
4203 char *addrp;
4204
4205 ad.type = LSM_AUDIT_DATA_NET;
4206 ad.u.net = &net;
4207 ad.u.net->netif = skb->skb_iif;
4208 ad.u.net->family = family;
4209 err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4210 if (err)
4211 return err;
4212
4213 if (selinux_secmark_enabled()) {
4214 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4215 PACKET__RECV, &ad);
4216 if (err)
4217 return err;
4218 }
4219
4220 err = selinux_netlbl_sock_rcv_skb(sksec, skb, family, &ad);
4221 if (err)
4222 return err;
4223 err = selinux_xfrm_sock_rcv_skb(sksec->sid, skb, &ad);
4224
4225 return err;
4226 }
4227
4228 static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
4229 {
4230 int err;
4231 struct sk_security_struct *sksec = sk->sk_security;
4232 u16 family = sk->sk_family;
4233 u32 sk_sid = sksec->sid;
4234 struct common_audit_data ad;
4235 struct lsm_network_audit net = {0,};
4236 char *addrp;
4237 u8 secmark_active;
4238 u8 peerlbl_active;
4239
4240 if (family != PF_INET && family != PF_INET6)
4241 return 0;
4242
4243 /* Handle mapped IPv4 packets arriving via IPv6 sockets */
4244 if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4245 family = PF_INET;
4246
4247 /* If any sort of compatibility mode is enabled then handoff processing
4248 * to the selinux_sock_rcv_skb_compat() function to deal with the
4249 * special handling. We do this in an attempt to keep this function
4250 * as fast and as clean as possible. */
4251 if (!selinux_policycap_netpeer)
4252 return selinux_sock_rcv_skb_compat(sk, skb, family);
4253
4254 secmark_active = selinux_secmark_enabled();
4255 peerlbl_active = netlbl_enabled() || selinux_xfrm_enabled();
4256 if (!secmark_active && !peerlbl_active)
4257 return 0;
4258
4259 ad.type = LSM_AUDIT_DATA_NET;
4260 ad.u.net = &net;
4261 ad.u.net->netif = skb->skb_iif;
4262 ad.u.net->family = family;
4263 err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4264 if (err)
4265 return err;
4266
4267 if (peerlbl_active) {
4268 u32 peer_sid;
4269
4270 err = selinux_skb_peerlbl_sid(skb, family, &peer_sid);
4271 if (err)
4272 return err;
4273 err = selinux_inet_sys_rcv_skb(skb->skb_iif, addrp, family,
4274 peer_sid, &ad);
4275 if (err) {
4276 selinux_netlbl_err(skb, err, 0);
4277 return err;
4278 }
4279 err = avc_has_perm(sk_sid, peer_sid, SECCLASS_PEER,
4280 PEER__RECV, &ad);
4281 if (err)
4282 selinux_netlbl_err(skb, err, 0);
4283 }
4284
4285 if (secmark_active) {
4286 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4287 PACKET__RECV, &ad);
4288 if (err)
4289 return err;
4290 }
4291
4292 return err;
4293 }
4294
4295 static int selinux_socket_getpeersec_stream(struct socket *sock, char __user *optval,
4296 int __user *optlen, unsigned len)
4297 {
4298 int err = 0;
4299 char *scontext;
4300 u32 scontext_len;
4301 struct sk_security_struct *sksec = sock->sk->sk_security;
4302 u32 peer_sid = SECSID_NULL;
4303
4304 if (sksec->sclass == SECCLASS_UNIX_STREAM_SOCKET ||
4305 sksec->sclass == SECCLASS_TCP_SOCKET)
4306 peer_sid = sksec->peer_sid;
4307 if (peer_sid == SECSID_NULL)
4308 return -ENOPROTOOPT;
4309
4310 err = security_sid_to_context(peer_sid, &scontext, &scontext_len);
4311 if (err)
4312 return err;
4313
4314 if (scontext_len > len) {
4315 err = -ERANGE;
4316 goto out_len;
4317 }
4318
4319 if (copy_to_user(optval, scontext, scontext_len))
4320 err = -EFAULT;
4321
4322 out_len:
4323 if (put_user(scontext_len, optlen))
4324 err = -EFAULT;
4325 kfree(scontext);
4326 return err;
4327 }
4328
4329 static int selinux_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid)
4330 {
4331 u32 peer_secid = SECSID_NULL;
4332 u16 family;
4333
4334 if (skb && skb->protocol == htons(ETH_P_IP))
4335 family = PF_INET;
4336 else if (skb && skb->protocol == htons(ETH_P_IPV6))
4337 family = PF_INET6;
4338 else if (sock)
4339 family = sock->sk->sk_family;
4340 else
4341 goto out;
4342
4343 if (sock && family == PF_UNIX)
4344 selinux_inode_getsecid(SOCK_INODE(sock), &peer_secid);
4345 else if (skb)
4346 selinux_skb_peerlbl_sid(skb, family, &peer_secid);
4347
4348 out:
4349 *secid = peer_secid;
4350 if (peer_secid == SECSID_NULL)
4351 return -EINVAL;
4352 return 0;
4353 }
4354
4355 static int selinux_sk_alloc_security(struct sock *sk, int family, gfp_t priority)
4356 {
4357 struct sk_security_struct *sksec;
4358
4359 sksec = kzalloc(sizeof(*sksec), priority);
4360 if (!sksec)
4361 return -ENOMEM;
4362
4363 sksec->peer_sid = SECINITSID_UNLABELED;
4364 sksec->sid = SECINITSID_UNLABELED;
4365 selinux_netlbl_sk_security_reset(sksec);
4366 sk->sk_security = sksec;
4367
4368 return 0;
4369 }
4370
4371 static void selinux_sk_free_security(struct sock *sk)
4372 {
4373 struct sk_security_struct *sksec = sk->sk_security;
4374
4375 sk->sk_security = NULL;
4376 selinux_netlbl_sk_security_free(sksec);
4377 kfree(sksec);
4378 }
4379
4380 static void selinux_sk_clone_security(const struct sock *sk, struct sock *newsk)
4381 {
4382 struct sk_security_struct *sksec = sk->sk_security;
4383 struct sk_security_struct *newsksec = newsk->sk_security;
4384
4385 newsksec->sid = sksec->sid;
4386 newsksec->peer_sid = sksec->peer_sid;
4387 newsksec->sclass = sksec->sclass;
4388
4389 selinux_netlbl_sk_security_reset(newsksec);
4390 }
4391
4392 static void selinux_sk_getsecid(struct sock *sk, u32 *secid)
4393 {
4394 if (!sk)
4395 *secid = SECINITSID_ANY_SOCKET;
4396 else {
4397 struct sk_security_struct *sksec = sk->sk_security;
4398
4399 *secid = sksec->sid;
4400 }
4401 }
4402
4403 static void selinux_sock_graft(struct sock *sk, struct socket *parent)
4404 {
4405 struct inode_security_struct *isec = SOCK_INODE(parent)->i_security;
4406 struct sk_security_struct *sksec = sk->sk_security;
4407
4408 if (sk->sk_family == PF_INET || sk->sk_family == PF_INET6 ||
4409 sk->sk_family == PF_UNIX)
4410 isec->sid = sksec->sid;
4411 sksec->sclass = isec->sclass;
4412 }
4413
4414 static int selinux_inet_conn_request(struct sock *sk, struct sk_buff *skb,
4415 struct request_sock *req)
4416 {
4417 struct sk_security_struct *sksec = sk->sk_security;
4418 int err;
4419 u16 family = sk->sk_family;
4420 u32 newsid;
4421 u32 peersid;
4422
4423 /* handle mapped IPv4 packets arriving via IPv6 sockets */
4424 if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4425 family = PF_INET;
4426
4427 err = selinux_skb_peerlbl_sid(skb, family, &peersid);
4428 if (err)
4429 return err;
4430 if (peersid == SECSID_NULL) {
4431 req->secid = sksec->sid;
4432 req->peer_secid = SECSID_NULL;
4433 } else {
4434 err = security_sid_mls_copy(sksec->sid, peersid, &newsid);
4435 if (err)
4436 return err;
4437 req->secid = newsid;
4438 req->peer_secid = peersid;
4439 }
4440
4441 return selinux_netlbl_inet_conn_request(req, family);
4442 }
4443
4444 static void selinux_inet_csk_clone(struct sock *newsk,
4445 const struct request_sock *req)
4446 {
4447 struct sk_security_struct *newsksec = newsk->sk_security;
4448
4449 newsksec->sid = req->secid;
4450 newsksec->peer_sid = req->peer_secid;
4451 /* NOTE: Ideally, we should also get the isec->sid for the
4452 new socket in sync, but we don't have the isec available yet.
4453 So we will wait until sock_graft to do it, by which
4454 time it will have been created and available. */
4455
4456 /* We don't need to take any sort of lock here as we are the only
4457 * thread with access to newsksec */
4458 selinux_netlbl_inet_csk_clone(newsk, req->rsk_ops->family);
4459 }
4460
4461 static void selinux_inet_conn_established(struct sock *sk, struct sk_buff *skb)
4462 {
4463 u16 family = sk->sk_family;
4464 struct sk_security_struct *sksec = sk->sk_security;
4465
4466 /* handle mapped IPv4 packets arriving via IPv6 sockets */
4467 if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4468 family = PF_INET;
4469
4470 selinux_skb_peerlbl_sid(skb, family, &sksec->peer_sid);
4471 }
4472
4473 static void selinux_skb_owned_by(struct sk_buff *skb, struct sock *sk)
4474 {
4475 skb_set_owner_w(skb, sk);
4476 }
4477
4478 static int selinux_secmark_relabel_packet(u32 sid)
4479 {
4480 const struct task_security_struct *__tsec;
4481 u32 tsid;
4482
4483 __tsec = current_security();
4484 tsid = __tsec->sid;
4485
4486 return avc_has_perm(tsid, sid, SECCLASS_PACKET, PACKET__RELABELTO, NULL);
4487 }
4488
4489 static void selinux_secmark_refcount_inc(void)
4490 {
4491 atomic_inc(&selinux_secmark_refcount);
4492 }
4493
4494 static void selinux_secmark_refcount_dec(void)
4495 {
4496 atomic_dec(&selinux_secmark_refcount);
4497 }
4498
4499 static void selinux_req_classify_flow(const struct request_sock *req,
4500 struct flowi *fl)
4501 {
4502 fl->flowi_secid = req->secid;
4503 }
4504
4505 static int selinux_tun_dev_alloc_security(void **security)
4506 {
4507 struct tun_security_struct *tunsec;
4508
4509 tunsec = kzalloc(sizeof(*tunsec), GFP_KERNEL);
4510 if (!tunsec)
4511 return -ENOMEM;
4512 tunsec->sid = current_sid();
4513
4514 *security = tunsec;
4515 return 0;
4516 }
4517
4518 static void selinux_tun_dev_free_security(void *security)
4519 {
4520 kfree(security);
4521 }
4522
4523 static int selinux_tun_dev_create(void)
4524 {
4525 u32 sid = current_sid();
4526
4527 /* we aren't taking into account the "sockcreate" SID since the socket
4528 * that is being created here is not a socket in the traditional sense,
4529 * instead it is a private sock, accessible only to the kernel, and
4530 * representing a wide range of network traffic spanning multiple
4531 * connections unlike traditional sockets - check the TUN driver to
4532 * get a better understanding of why this socket is special */
4533
4534 return avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET, TUN_SOCKET__CREATE,
4535 NULL);
4536 }
4537
4538 static int selinux_tun_dev_attach_queue(void *security)
4539 {
4540 struct tun_security_struct *tunsec = security;
4541
4542 return avc_has_perm(current_sid(), tunsec->sid, SECCLASS_TUN_SOCKET,
4543 TUN_SOCKET__ATTACH_QUEUE, NULL);
4544 }
4545
4546 static int selinux_tun_dev_attach(struct sock *sk, void *security)
4547 {
4548 struct tun_security_struct *tunsec = security;
4549 struct sk_security_struct *sksec = sk->sk_security;
4550
4551 /* we don't currently perform any NetLabel based labeling here and it
4552 * isn't clear that we would want to do so anyway; while we could apply
4553 * labeling without the support of the TUN user the resulting labeled
4554 * traffic from the other end of the connection would almost certainly
4555 * cause confusion to the TUN user that had no idea network labeling
4556 * protocols were being used */
4557
4558 sksec->sid = tunsec->sid;
4559 sksec->sclass = SECCLASS_TUN_SOCKET;
4560
4561 return 0;
4562 }
4563
4564 static int selinux_tun_dev_open(void *security)
4565 {
4566 struct tun_security_struct *tunsec = security;
4567 u32 sid = current_sid();
4568 int err;
4569
4570 err = avc_has_perm(sid, tunsec->sid, SECCLASS_TUN_SOCKET,
4571 TUN_SOCKET__RELABELFROM, NULL);
4572 if (err)
4573 return err;
4574 err = avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET,
4575 TUN_SOCKET__RELABELTO, NULL);
4576 if (err)
4577 return err;
4578 tunsec->sid = sid;
4579
4580 return 0;
4581 }
4582
4583 static int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
4584 {
4585 int err = 0;
4586 u32 perm;
4587 struct nlmsghdr *nlh;
4588 struct sk_security_struct *sksec = sk->sk_security;
4589
4590 if (skb->len < NLMSG_HDRLEN) {
4591 err = -EINVAL;
4592 goto out;
4593 }
4594 nlh = nlmsg_hdr(skb);
4595
4596 err = selinux_nlmsg_lookup(sksec->sclass, nlh->nlmsg_type, &perm);
4597 if (err) {
4598 if (err == -EINVAL) {
4599 audit_log(current->audit_context, GFP_KERNEL, AUDIT_SELINUX_ERR,
4600 "SELinux: unrecognized netlink message"
4601 " type=%hu for sclass=%hu\n",
4602 nlh->nlmsg_type, sksec->sclass);
4603 if (!selinux_enforcing || security_get_allow_unknown())
4604 err = 0;
4605 }
4606
4607 /* Ignore */
4608 if (err == -ENOENT)
4609 err = 0;
4610 goto out;
4611 }
4612
4613 err = sock_has_perm(current, sk, perm);
4614 out:
4615 return err;
4616 }
4617
4618 #ifdef CONFIG_NETFILTER
4619
4620 static unsigned int selinux_ip_forward(struct sk_buff *skb, int ifindex,
4621 u16 family)
4622 {
4623 int err;
4624 char *addrp;
4625 u32 peer_sid;
4626 struct common_audit_data ad;
4627 struct lsm_network_audit net = {0,};
4628 u8 secmark_active;
4629 u8 netlbl_active;
4630 u8 peerlbl_active;
4631
4632 if (!selinux_policycap_netpeer)
4633 return NF_ACCEPT;
4634
4635 secmark_active = selinux_secmark_enabled();
4636 netlbl_active = netlbl_enabled();
4637 peerlbl_active = netlbl_active || selinux_xfrm_enabled();
4638 if (!secmark_active && !peerlbl_active)
4639 return NF_ACCEPT;
4640
4641 if (selinux_skb_peerlbl_sid(skb, family, &peer_sid) != 0)
4642 return NF_DROP;
4643
4644 ad.type = LSM_AUDIT_DATA_NET;
4645 ad.u.net = &net;
4646 ad.u.net->netif = ifindex;
4647 ad.u.net->family = family;
4648 if (selinux_parse_skb(skb, &ad, &addrp, 1, NULL) != 0)
4649 return NF_DROP;
4650
4651 if (peerlbl_active) {
4652 err = selinux_inet_sys_rcv_skb(ifindex, addrp, family,
4653 peer_sid, &ad);
4654 if (err) {
4655 selinux_netlbl_err(skb, err, 1);
4656 return NF_DROP;
4657 }
4658 }
4659
4660 if (secmark_active)
4661 if (avc_has_perm(peer_sid, skb->secmark,
4662 SECCLASS_PACKET, PACKET__FORWARD_IN, &ad))
4663 return NF_DROP;
4664
4665 if (netlbl_active)
4666 /* we do this in the FORWARD path and not the POST_ROUTING
4667 * path because we want to make sure we apply the necessary
4668 * labeling before IPsec is applied so we can leverage AH
4669 * protection */
4670 if (selinux_netlbl_skbuff_setsid(skb, family, peer_sid) != 0)
4671 return NF_DROP;
4672
4673 return NF_ACCEPT;
4674 }
4675
4676 static unsigned int selinux_ipv4_forward(unsigned int hooknum,
4677 struct sk_buff *skb,
4678 const struct net_device *in,
4679 const struct net_device *out,
4680 int (*okfn)(struct sk_buff *))
4681 {
4682 return selinux_ip_forward(skb, in->ifindex, PF_INET);
4683 }
4684
4685 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4686 static unsigned int selinux_ipv6_forward(unsigned int hooknum,
4687 struct sk_buff *skb,
4688 const struct net_device *in,
4689 const struct net_device *out,
4690 int (*okfn)(struct sk_buff *))
4691 {
4692 return selinux_ip_forward(skb, in->ifindex, PF_INET6);
4693 }
4694 #endif /* IPV6 */
4695
4696 static unsigned int selinux_ip_output(struct sk_buff *skb,
4697 u16 family)
4698 {
4699 u32 sid;
4700
4701 if (!netlbl_enabled())
4702 return NF_ACCEPT;
4703
4704 /* we do this in the LOCAL_OUT path and not the POST_ROUTING path
4705 * because we want to make sure we apply the necessary labeling
4706 * before IPsec is applied so we can leverage AH protection */
4707 if (skb->sk) {
4708 struct sk_security_struct *sksec = skb->sk->sk_security;
4709 sid = sksec->sid;
4710 } else
4711 sid = SECINITSID_KERNEL;
4712 if (selinux_netlbl_skbuff_setsid(skb, family, sid) != 0)
4713 return NF_DROP;
4714
4715 return NF_ACCEPT;
4716 }
4717
4718 static unsigned int selinux_ipv4_output(unsigned int hooknum,
4719 struct sk_buff *skb,
4720 const struct net_device *in,
4721 const struct net_device *out,
4722 int (*okfn)(struct sk_buff *))
4723 {
4724 return selinux_ip_output(skb, PF_INET);
4725 }
4726
4727 static unsigned int selinux_ip_postroute_compat(struct sk_buff *skb,
4728 int ifindex,
4729 u16 family)
4730 {
4731 struct sock *sk = skb->sk;
4732 struct sk_security_struct *sksec;
4733 struct common_audit_data ad;
4734 struct lsm_network_audit net = {0,};
4735 char *addrp;
4736 u8 proto;
4737
4738 if (sk == NULL)
4739 return NF_ACCEPT;
4740 sksec = sk->sk_security;
4741
4742 ad.type = LSM_AUDIT_DATA_NET;
4743 ad.u.net = &net;
4744 ad.u.net->netif = ifindex;
4745 ad.u.net->family = family;
4746 if (selinux_parse_skb(skb, &ad, &addrp, 0, &proto))
4747 return NF_DROP;
4748
4749 if (selinux_secmark_enabled())
4750 if (avc_has_perm(sksec->sid, skb->secmark,
4751 SECCLASS_PACKET, PACKET__SEND, &ad))
4752 return NF_DROP_ERR(-ECONNREFUSED);
4753
4754 if (selinux_xfrm_postroute_last(sksec->sid, skb, &ad, proto))
4755 return NF_DROP_ERR(-ECONNREFUSED);
4756
4757 return NF_ACCEPT;
4758 }
4759
4760 static unsigned int selinux_ip_postroute(struct sk_buff *skb, int ifindex,
4761 u16 family)
4762 {
4763 u32 secmark_perm;
4764 u32 peer_sid;
4765 struct sock *sk;
4766 struct common_audit_data ad;
4767 struct lsm_network_audit net = {0,};
4768 char *addrp;
4769 u8 secmark_active;
4770 u8 peerlbl_active;
4771
4772 /* If any sort of compatibility mode is enabled then handoff processing
4773 * to the selinux_ip_postroute_compat() function to deal with the
4774 * special handling. We do this in an attempt to keep this function
4775 * as fast and as clean as possible. */
4776 if (!selinux_policycap_netpeer)
4777 return selinux_ip_postroute_compat(skb, ifindex, family);
4778 #ifdef CONFIG_XFRM
4779 /* If skb->dst->xfrm is non-NULL then the packet is undergoing an IPsec
4780 * packet transformation so allow the packet to pass without any checks
4781 * since we'll have another chance to perform access control checks
4782 * when the packet is on it's final way out.
4783 * NOTE: there appear to be some IPv6 multicast cases where skb->dst
4784 * is NULL, in this case go ahead and apply access control. */
4785 if (skb_dst(skb) != NULL && skb_dst(skb)->xfrm != NULL)
4786 return NF_ACCEPT;
4787 #endif
4788 secmark_active = selinux_secmark_enabled();
4789 peerlbl_active = netlbl_enabled() || selinux_xfrm_enabled();
4790 if (!secmark_active && !peerlbl_active)
4791 return NF_ACCEPT;
4792
4793 /* if the packet is being forwarded then get the peer label from the
4794 * packet itself; otherwise check to see if it is from a local
4795 * application or the kernel, if from an application get the peer label
4796 * from the sending socket, otherwise use the kernel's sid */
4797 sk = skb->sk;
4798 if (sk == NULL) {
4799 if (skb->skb_iif) {
4800 secmark_perm = PACKET__FORWARD_OUT;
4801 if (selinux_skb_peerlbl_sid(skb, family, &peer_sid))
4802 return NF_DROP;
4803 } else {
4804 secmark_perm = PACKET__SEND;
4805 peer_sid = SECINITSID_KERNEL;
4806 }
4807 } else {
4808 struct sk_security_struct *sksec = sk->sk_security;
4809 peer_sid = sksec->sid;
4810 secmark_perm = PACKET__SEND;
4811 }
4812
4813 ad.type = LSM_AUDIT_DATA_NET;
4814 ad.u.net = &net;
4815 ad.u.net->netif = ifindex;
4816 ad.u.net->family = family;
4817 if (selinux_parse_skb(skb, &ad, &addrp, 0, NULL))
4818 return NF_DROP;
4819
4820 if (secmark_active)
4821 if (avc_has_perm(peer_sid, skb->secmark,
4822 SECCLASS_PACKET, secmark_perm, &ad))
4823 return NF_DROP_ERR(-ECONNREFUSED);
4824
4825 if (peerlbl_active) {
4826 u32 if_sid;
4827 u32 node_sid;
4828
4829 if (sel_netif_sid(ifindex, &if_sid))
4830 return NF_DROP;
4831 if (avc_has_perm(peer_sid, if_sid,
4832 SECCLASS_NETIF, NETIF__EGRESS, &ad))
4833 return NF_DROP_ERR(-ECONNREFUSED);
4834
4835 if (sel_netnode_sid(addrp, family, &node_sid))
4836 return NF_DROP;
4837 if (avc_has_perm(peer_sid, node_sid,
4838 SECCLASS_NODE, NODE__SENDTO, &ad))
4839 return NF_DROP_ERR(-ECONNREFUSED);
4840 }
4841
4842 return NF_ACCEPT;
4843 }
4844
4845 static unsigned int selinux_ipv4_postroute(unsigned int hooknum,
4846 struct sk_buff *skb,
4847 const struct net_device *in,
4848 const struct net_device *out,
4849 int (*okfn)(struct sk_buff *))
4850 {
4851 return selinux_ip_postroute(skb, out->ifindex, PF_INET);
4852 }
4853
4854 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4855 static unsigned int selinux_ipv6_postroute(unsigned int hooknum,
4856 struct sk_buff *skb,
4857 const struct net_device *in,
4858 const struct net_device *out,
4859 int (*okfn)(struct sk_buff *))
4860 {
4861 return selinux_ip_postroute(skb, out->ifindex, PF_INET6);
4862 }
4863 #endif /* IPV6 */
4864
4865 #endif /* CONFIG_NETFILTER */
4866
4867 static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb)
4868 {
4869 int err;
4870
4871 err = cap_netlink_send(sk, skb);
4872 if (err)
4873 return err;
4874
4875 return selinux_nlmsg_perm(sk, skb);
4876 }
4877
4878 static int ipc_alloc_security(struct task_struct *task,
4879 struct kern_ipc_perm *perm,
4880 u16 sclass)
4881 {
4882 struct ipc_security_struct *isec;
4883 u32 sid;
4884
4885 isec = kzalloc(sizeof(struct ipc_security_struct), GFP_KERNEL);
4886 if (!isec)
4887 return -ENOMEM;
4888
4889 sid = task_sid(task);
4890 isec->sclass = sclass;
4891 isec->sid = sid;
4892 perm->security = isec;
4893
4894 return 0;
4895 }
4896
4897 static void ipc_free_security(struct kern_ipc_perm *perm)
4898 {
4899 struct ipc_security_struct *isec = perm->security;
4900 perm->security = NULL;
4901 kfree(isec);
4902 }
4903
4904 static int msg_msg_alloc_security(struct msg_msg *msg)
4905 {
4906 struct msg_security_struct *msec;
4907
4908 msec = kzalloc(sizeof(struct msg_security_struct), GFP_KERNEL);
4909 if (!msec)
4910 return -ENOMEM;
4911
4912 msec->sid = SECINITSID_UNLABELED;
4913 msg->security = msec;
4914
4915 return 0;
4916 }
4917
4918 static void msg_msg_free_security(struct msg_msg *msg)
4919 {
4920 struct msg_security_struct *msec = msg->security;
4921
4922 msg->security = NULL;
4923 kfree(msec);
4924 }
4925
4926 static int ipc_has_perm(struct kern_ipc_perm *ipc_perms,
4927 u32 perms)
4928 {
4929 struct ipc_security_struct *isec;
4930 struct common_audit_data ad;
4931 u32 sid = current_sid();
4932
4933 isec = ipc_perms->security;
4934
4935 ad.type = LSM_AUDIT_DATA_IPC;
4936 ad.u.ipc_id = ipc_perms->key;
4937
4938 return avc_has_perm(sid, isec->sid, isec->sclass, perms, &ad);
4939 }
4940
4941 static int selinux_msg_msg_alloc_security(struct msg_msg *msg)
4942 {
4943 return msg_msg_alloc_security(msg);
4944 }
4945
4946 static void selinux_msg_msg_free_security(struct msg_msg *msg)
4947 {
4948 msg_msg_free_security(msg);
4949 }
4950
4951 /* message queue security operations */
4952 static int selinux_msg_queue_alloc_security(struct msg_queue *msq)
4953 {
4954 struct ipc_security_struct *isec;
4955 struct common_audit_data ad;
4956 u32 sid = current_sid();
4957 int rc;
4958
4959 rc = ipc_alloc_security(current, &msq->q_perm, SECCLASS_MSGQ);
4960 if (rc)
4961 return rc;
4962
4963 isec = msq->q_perm.security;
4964
4965 ad.type = LSM_AUDIT_DATA_IPC;
4966 ad.u.ipc_id = msq->q_perm.key;
4967
4968 rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
4969 MSGQ__CREATE, &ad);
4970 if (rc) {
4971 ipc_free_security(&msq->q_perm);
4972 return rc;
4973 }
4974 return 0;
4975 }
4976
4977 static void selinux_msg_queue_free_security(struct msg_queue *msq)
4978 {
4979 ipc_free_security(&msq->q_perm);
4980 }
4981
4982 static int selinux_msg_queue_associate(struct msg_queue *msq, int msqflg)
4983 {
4984 struct ipc_security_struct *isec;
4985 struct common_audit_data ad;
4986 u32 sid = current_sid();
4987
4988 isec = msq->q_perm.security;
4989
4990 ad.type = LSM_AUDIT_DATA_IPC;
4991 ad.u.ipc_id = msq->q_perm.key;
4992
4993 return avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
4994 MSGQ__ASSOCIATE, &ad);
4995 }
4996
4997 static int selinux_msg_queue_msgctl(struct msg_queue *msq, int cmd)
4998 {
4999 int err;
5000 int perms;
5001
5002 switch (cmd) {
5003 case IPC_INFO:
5004 case MSG_INFO:
5005 /* No specific object, just general system-wide information. */
5006 return task_has_system(current, SYSTEM__IPC_INFO);
5007 case IPC_STAT:
5008 case MSG_STAT:
5009 perms = MSGQ__GETATTR | MSGQ__ASSOCIATE;
5010 break;
5011 case IPC_SET:
5012 perms = MSGQ__SETATTR;
5013 break;
5014 case IPC_RMID:
5015 perms = MSGQ__DESTROY;
5016 break;
5017 default:
5018 return 0;
5019 }
5020
5021 err = ipc_has_perm(&msq->q_perm, perms);
5022 return err;
5023 }
5024
5025 static int selinux_msg_queue_msgsnd(struct msg_queue *msq, struct msg_msg *msg, int msqflg)
5026 {
5027 struct ipc_security_struct *isec;
5028 struct msg_security_struct *msec;
5029 struct common_audit_data ad;
5030 u32 sid = current_sid();
5031 int rc;
5032
5033 isec = msq->q_perm.security;
5034 msec = msg->security;
5035
5036 /*
5037 * First time through, need to assign label to the message
5038 */
5039 if (msec->sid == SECINITSID_UNLABELED) {
5040 /*
5041 * Compute new sid based on current process and
5042 * message queue this message will be stored in
5043 */
5044 rc = security_transition_sid(sid, isec->sid, SECCLASS_MSG,
5045 NULL, &msec->sid);
5046 if (rc)
5047 return rc;
5048 }
5049
5050 ad.type = LSM_AUDIT_DATA_IPC;
5051 ad.u.ipc_id = msq->q_perm.key;
5052
5053 /* Can this process write to the queue? */
5054 rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
5055 MSGQ__WRITE, &ad);
5056 if (!rc)
5057 /* Can this process send the message */
5058 rc = avc_has_perm(sid, msec->sid, SECCLASS_MSG,
5059 MSG__SEND, &ad);
5060 if (!rc)
5061 /* Can the message be put in the queue? */
5062 rc = avc_has_perm(msec->sid, isec->sid, SECCLASS_MSGQ,
5063 MSGQ__ENQUEUE, &ad);
5064
5065 return rc;
5066 }
5067
5068 static int selinux_msg_queue_msgrcv(struct msg_queue *msq, struct msg_msg *msg,
5069 struct task_struct *target,
5070 long type, int mode)
5071 {
5072 struct ipc_security_struct *isec;
5073 struct msg_security_struct *msec;
5074 struct common_audit_data ad;
5075 u32 sid = task_sid(target);
5076 int rc;
5077
5078 isec = msq->q_perm.security;
5079 msec = msg->security;
5080
5081 ad.type = LSM_AUDIT_DATA_IPC;
5082 ad.u.ipc_id = msq->q_perm.key;
5083
5084 rc = avc_has_perm(sid, isec->sid,
5085 SECCLASS_MSGQ, MSGQ__READ, &ad);
5086 if (!rc)
5087 rc = avc_has_perm(sid, msec->sid,
5088 SECCLASS_MSG, MSG__RECEIVE, &ad);
5089 return rc;
5090 }
5091
5092 /* Shared Memory security operations */
5093 static int selinux_shm_alloc_security(struct shmid_kernel *shp)
5094 {
5095 struct ipc_security_struct *isec;
5096 struct common_audit_data ad;
5097 u32 sid = current_sid();
5098 int rc;
5099
5100 rc = ipc_alloc_security(current, &shp->shm_perm, SECCLASS_SHM);
5101 if (rc)
5102 return rc;
5103
5104 isec = shp->shm_perm.security;
5105
5106 ad.type = LSM_AUDIT_DATA_IPC;
5107 ad.u.ipc_id = shp->shm_perm.key;
5108
5109 rc = avc_has_perm(sid, isec->sid, SECCLASS_SHM,
5110 SHM__CREATE, &ad);
5111 if (rc) {
5112 ipc_free_security(&shp->shm_perm);
5113 return rc;
5114 }
5115 return 0;
5116 }
5117
5118 static void selinux_shm_free_security(struct shmid_kernel *shp)
5119 {
5120 ipc_free_security(&shp->shm_perm);
5121 }
5122
5123 static int selinux_shm_associate(struct shmid_kernel *shp, int shmflg)
5124 {
5125 struct ipc_security_struct *isec;
5126 struct common_audit_data ad;
5127 u32 sid = current_sid();
5128
5129 isec = shp->shm_perm.security;
5130
5131 ad.type = LSM_AUDIT_DATA_IPC;
5132 ad.u.ipc_id = shp->shm_perm.key;
5133
5134 return avc_has_perm(sid, isec->sid, SECCLASS_SHM,
5135 SHM__ASSOCIATE, &ad);
5136 }
5137
5138 /* Note, at this point, shp is locked down */
5139 static int selinux_shm_shmctl(struct shmid_kernel *shp, int cmd)
5140 {
5141 int perms;
5142 int err;
5143
5144 switch (cmd) {
5145 case IPC_INFO:
5146 case SHM_INFO:
5147 /* No specific object, just general system-wide information. */
5148 return task_has_system(current, SYSTEM__IPC_INFO);
5149 case IPC_STAT:
5150 case SHM_STAT:
5151 perms = SHM__GETATTR | SHM__ASSOCIATE;
5152 break;
5153 case IPC_SET:
5154 perms = SHM__SETATTR;
5155 break;
5156 case SHM_LOCK:
5157 case SHM_UNLOCK:
5158 perms = SHM__LOCK;
5159 break;
5160 case IPC_RMID:
5161 perms = SHM__DESTROY;
5162 break;
5163 default:
5164 return 0;
5165 }
5166
5167 err = ipc_has_perm(&shp->shm_perm, perms);
5168 return err;
5169 }
5170
5171 static int selinux_shm_shmat(struct shmid_kernel *shp,
5172 char __user *shmaddr, int shmflg)
5173 {
5174 u32 perms;
5175
5176 if (shmflg & SHM_RDONLY)
5177 perms = SHM__READ;
5178 else
5179 perms = SHM__READ | SHM__WRITE;
5180
5181 return ipc_has_perm(&shp->shm_perm, perms);
5182 }
5183
5184 /* Semaphore security operations */
5185 static int selinux_sem_alloc_security(struct sem_array *sma)
5186 {
5187 struct ipc_security_struct *isec;
5188 struct common_audit_data ad;
5189 u32 sid = current_sid();
5190 int rc;
5191
5192 rc = ipc_alloc_security(current, &sma->sem_perm, SECCLASS_SEM);
5193 if (rc)
5194 return rc;
5195
5196 isec = sma->sem_perm.security;
5197
5198 ad.type = LSM_AUDIT_DATA_IPC;
5199 ad.u.ipc_id = sma->sem_perm.key;
5200
5201 rc = avc_has_perm(sid, isec->sid, SECCLASS_SEM,
5202 SEM__CREATE, &ad);
5203 if (rc) {
5204 ipc_free_security(&sma->sem_perm);
5205 return rc;
5206 }
5207 return 0;
5208 }
5209
5210 static void selinux_sem_free_security(struct sem_array *sma)
5211 {
5212 ipc_free_security(&sma->sem_perm);
5213 }
5214
5215 static int selinux_sem_associate(struct sem_array *sma, int semflg)
5216 {
5217 struct ipc_security_struct *isec;
5218 struct common_audit_data ad;
5219 u32 sid = current_sid();
5220
5221 isec = sma->sem_perm.security;
5222
5223 ad.type = LSM_AUDIT_DATA_IPC;
5224 ad.u.ipc_id = sma->sem_perm.key;
5225
5226 return avc_has_perm(sid, isec->sid, SECCLASS_SEM,
5227 SEM__ASSOCIATE, &ad);
5228 }
5229
5230 /* Note, at this point, sma is locked down */
5231 static int selinux_sem_semctl(struct sem_array *sma, int cmd)
5232 {
5233 int err;
5234 u32 perms;
5235
5236 switch (cmd) {
5237 case IPC_INFO:
5238 case SEM_INFO:
5239 /* No specific object, just general system-wide information. */
5240 return task_has_system(current, SYSTEM__IPC_INFO);
5241 case GETPID:
5242 case GETNCNT:
5243 case GETZCNT:
5244 perms = SEM__GETATTR;
5245 break;
5246 case GETVAL:
5247 case GETALL:
5248 perms = SEM__READ;
5249 break;
5250 case SETVAL:
5251 case SETALL:
5252 perms = SEM__WRITE;
5253 break;
5254 case IPC_RMID:
5255 perms = SEM__DESTROY;
5256 break;
5257 case IPC_SET:
5258 perms = SEM__SETATTR;
5259 break;
5260 case IPC_STAT:
5261 case SEM_STAT:
5262 perms = SEM__GETATTR | SEM__ASSOCIATE;
5263 break;
5264 default:
5265 return 0;
5266 }
5267
5268 err = ipc_has_perm(&sma->sem_perm, perms);
5269 return err;
5270 }
5271
5272 static int selinux_sem_semop(struct sem_array *sma,
5273 struct sembuf *sops, unsigned nsops, int alter)
5274 {
5275 u32 perms;
5276
5277 if (alter)
5278 perms = SEM__READ | SEM__WRITE;
5279 else
5280 perms = SEM__READ;
5281
5282 return ipc_has_perm(&sma->sem_perm, perms);
5283 }
5284
5285 static int selinux_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
5286 {
5287 u32 av = 0;
5288
5289 av = 0;
5290 if (flag & S_IRUGO)
5291 av |= IPC__UNIX_READ;
5292 if (flag & S_IWUGO)
5293 av |= IPC__UNIX_WRITE;
5294
5295 if (av == 0)
5296 return 0;
5297
5298 return ipc_has_perm(ipcp, av);
5299 }
5300
5301 static void selinux_ipc_getsecid(struct kern_ipc_perm *ipcp, u32 *secid)
5302 {
5303 struct ipc_security_struct *isec = ipcp->security;
5304 *secid = isec->sid;
5305 }
5306
5307 static void selinux_d_instantiate(struct dentry *dentry, struct inode *inode)
5308 {
5309 if (inode)
5310 inode_doinit_with_dentry(inode, dentry);
5311 }
5312
5313 static int selinux_getprocattr(struct task_struct *p,
5314 char *name, char **value)
5315 {
5316 const struct task_security_struct *__tsec;
5317 u32 sid;
5318 int error;
5319 unsigned len;
5320
5321 if (current != p) {
5322 error = current_has_perm(p, PROCESS__GETATTR);
5323 if (error)
5324 return error;
5325 }
5326
5327 rcu_read_lock();
5328 __tsec = __task_cred(p)->security;
5329
5330 if (!strcmp(name, "current"))
5331 sid = __tsec->sid;
5332 else if (!strcmp(name, "prev"))
5333 sid = __tsec->osid;
5334 else if (!strcmp(name, "exec"))
5335 sid = __tsec->exec_sid;
5336 else if (!strcmp(name, "fscreate"))
5337 sid = __tsec->create_sid;
5338 else if (!strcmp(name, "keycreate"))
5339 sid = __tsec->keycreate_sid;
5340 else if (!strcmp(name, "sockcreate"))
5341 sid = __tsec->sockcreate_sid;
5342 else
5343 goto invalid;
5344 rcu_read_unlock();
5345
5346 if (!sid)
5347 return 0;
5348
5349 error = security_sid_to_context(sid, value, &len);
5350 if (error)
5351 return error;
5352 return len;
5353
5354 invalid:
5355 rcu_read_unlock();
5356 return -EINVAL;
5357 }
5358
5359 static int selinux_setprocattr(struct task_struct *p,
5360 char *name, void *value, size_t size)
5361 {
5362 struct task_security_struct *tsec;
5363 struct task_struct *tracer;
5364 struct cred *new;
5365 u32 sid = 0, ptsid;
5366 int error;
5367 char *str = value;
5368
5369 if (current != p) {
5370 /* SELinux only allows a process to change its own
5371 security attributes. */
5372 return -EACCES;
5373 }
5374
5375 /*
5376 * Basic control over ability to set these attributes at all.
5377 * current == p, but we'll pass them separately in case the
5378 * above restriction is ever removed.
5379 */
5380 if (!strcmp(name, "exec"))
5381 error = current_has_perm(p, PROCESS__SETEXEC);
5382 else if (!strcmp(name, "fscreate"))
5383 error = current_has_perm(p, PROCESS__SETFSCREATE);
5384 else if (!strcmp(name, "keycreate"))
5385 error = current_has_perm(p, PROCESS__SETKEYCREATE);
5386 else if (!strcmp(name, "sockcreate"))
5387 error = current_has_perm(p, PROCESS__SETSOCKCREATE);
5388 else if (!strcmp(name, "current"))
5389 error = current_has_perm(p, PROCESS__SETCURRENT);
5390 else
5391 error = -EINVAL;
5392 if (error)
5393 return error;
5394
5395 /* Obtain a SID for the context, if one was specified. */
5396 if (size && str[1] && str[1] != '\n') {
5397 if (str[size-1] == '\n') {
5398 str[size-1] = 0;
5399 size--;
5400 }
5401 error = security_context_to_sid(value, size, &sid);
5402 if (error == -EINVAL && !strcmp(name, "fscreate")) {
5403 if (!capable(CAP_MAC_ADMIN)) {
5404 struct audit_buffer *ab;
5405 size_t audit_size;
5406
5407 /* We strip a nul only if it is at the end, otherwise the
5408 * context contains a nul and we should audit that */
5409 if (str[size - 1] == '\0')
5410 audit_size = size - 1;
5411 else
5412 audit_size = size;
5413 ab = audit_log_start(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR);
5414 audit_log_format(ab, "op=fscreate invalid_context=");
5415 audit_log_n_untrustedstring(ab, value, audit_size);
5416 audit_log_end(ab);
5417
5418 return error;
5419 }
5420 error = security_context_to_sid_force(value, size,
5421 &sid);
5422 }
5423 if (error)
5424 return error;
5425 }
5426
5427 new = prepare_creds();
5428 if (!new)
5429 return -ENOMEM;
5430
5431 /* Permission checking based on the specified context is
5432 performed during the actual operation (execve,
5433 open/mkdir/...), when we know the full context of the
5434 operation. See selinux_bprm_set_creds for the execve
5435 checks and may_create for the file creation checks. The
5436 operation will then fail if the context is not permitted. */
5437 tsec = new->security;
5438 if (!strcmp(name, "exec")) {
5439 tsec->exec_sid = sid;
5440 } else if (!strcmp(name, "fscreate")) {
5441 tsec->create_sid = sid;
5442 } else if (!strcmp(name, "keycreate")) {
5443 error = may_create_key(sid, p);
5444 if (error)
5445 goto abort_change;
5446 tsec->keycreate_sid = sid;
5447 } else if (!strcmp(name, "sockcreate")) {
5448 tsec->sockcreate_sid = sid;
5449 } else if (!strcmp(name, "current")) {
5450 error = -EINVAL;
5451 if (sid == 0)
5452 goto abort_change;
5453
5454 /* Only allow single threaded processes to change context */
5455 error = -EPERM;
5456 if (!current_is_single_threaded()) {
5457 error = security_bounded_transition(tsec->sid, sid);
5458 if (error)
5459 goto abort_change;
5460 }
5461
5462 /* Check permissions for the transition. */
5463 error = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
5464 PROCESS__DYNTRANSITION, NULL);
5465 if (error)
5466 goto abort_change;
5467
5468 /* Check for ptracing, and update the task SID if ok.
5469 Otherwise, leave SID unchanged and fail. */
5470 ptsid = 0;
5471 task_lock(p);
5472 tracer = ptrace_parent(p);
5473 if (tracer)
5474 ptsid = task_sid(tracer);
5475 task_unlock(p);
5476
5477 if (tracer) {
5478 error = avc_has_perm(ptsid, sid, SECCLASS_PROCESS,
5479 PROCESS__PTRACE, NULL);
5480 if (error)
5481 goto abort_change;
5482 }
5483
5484 tsec->sid = sid;
5485 } else {
5486 error = -EINVAL;
5487 goto abort_change;
5488 }
5489
5490 commit_creds(new);
5491 return size;
5492
5493 abort_change:
5494 abort_creds(new);
5495 return error;
5496 }
5497
5498 static int selinux_ismaclabel(const char *name)
5499 {
5500 return (strcmp(name, XATTR_SELINUX_SUFFIX) == 0);
5501 }
5502
5503 static int selinux_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
5504 {
5505 return security_sid_to_context(secid, secdata, seclen);
5506 }
5507
5508 static int selinux_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid)
5509 {
5510 return security_context_to_sid(secdata, seclen, secid);
5511 }
5512
5513 static void selinux_release_secctx(char *secdata, u32 seclen)
5514 {
5515 kfree(secdata);
5516 }
5517
5518 /*
5519 * called with inode->i_mutex locked
5520 */
5521 static int selinux_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen)
5522 {
5523 return selinux_inode_setsecurity(inode, XATTR_SELINUX_SUFFIX, ctx, ctxlen, 0);
5524 }
5525
5526 /*
5527 * called with inode->i_mutex locked
5528 */
5529 static int selinux_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen)
5530 {
5531 return __vfs_setxattr_noperm(dentry, XATTR_NAME_SELINUX, ctx, ctxlen, 0);
5532 }
5533
5534 static int selinux_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen)
5535 {
5536 int len = 0;
5537 len = selinux_inode_getsecurity(inode, XATTR_SELINUX_SUFFIX,
5538 ctx, true);
5539 if (len < 0)
5540 return len;
5541 *ctxlen = len;
5542 return 0;
5543 }
5544 #ifdef CONFIG_KEYS
5545
5546 static int selinux_key_alloc(struct key *k, const struct cred *cred,
5547 unsigned long flags)
5548 {
5549 const struct task_security_struct *tsec;
5550 struct key_security_struct *ksec;
5551
5552 ksec = kzalloc(sizeof(struct key_security_struct), GFP_KERNEL);
5553 if (!ksec)
5554 return -ENOMEM;
5555
5556 tsec = cred->security;
5557 if (tsec->keycreate_sid)
5558 ksec->sid = tsec->keycreate_sid;
5559 else
5560 ksec->sid = tsec->sid;
5561
5562 k->security = ksec;
5563 return 0;
5564 }
5565
5566 static void selinux_key_free(struct key *k)
5567 {
5568 struct key_security_struct *ksec = k->security;
5569
5570 k->security = NULL;
5571 kfree(ksec);
5572 }
5573
5574 static int selinux_key_permission(key_ref_t key_ref,
5575 const struct cred *cred,
5576 key_perm_t perm)
5577 {
5578 struct key *key;
5579 struct key_security_struct *ksec;
5580 u32 sid;
5581
5582 /* if no specific permissions are requested, we skip the
5583 permission check. No serious, additional covert channels
5584 appear to be created. */
5585 if (perm == 0)
5586 return 0;
5587
5588 sid = cred_sid(cred);
5589
5590 key = key_ref_to_ptr(key_ref);
5591 ksec = key->security;
5592
5593 return avc_has_perm(sid, ksec->sid, SECCLASS_KEY, perm, NULL);
5594 }
5595
5596 static int selinux_key_getsecurity(struct key *key, char **_buffer)
5597 {
5598 struct key_security_struct *ksec = key->security;
5599 char *context = NULL;
5600 unsigned len;
5601 int rc;
5602
5603 rc = security_sid_to_context(ksec->sid, &context, &len);
5604 if (!rc)
5605 rc = len;
5606 *_buffer = context;
5607 return rc;
5608 }
5609
5610 #endif
5611
5612 static struct security_operations selinux_ops = {
5613 .name = "selinux",
5614
5615 .ptrace_access_check = selinux_ptrace_access_check,
5616 .ptrace_traceme = selinux_ptrace_traceme,
5617 .capget = selinux_capget,
5618 .capset = selinux_capset,
5619 .capable = selinux_capable,
5620 .quotactl = selinux_quotactl,
5621 .quota_on = selinux_quota_on,
5622 .syslog = selinux_syslog,
5623 .vm_enough_memory = selinux_vm_enough_memory,
5624
5625 .netlink_send = selinux_netlink_send,
5626
5627 .bprm_set_creds = selinux_bprm_set_creds,
5628 .bprm_committing_creds = selinux_bprm_committing_creds,
5629 .bprm_committed_creds = selinux_bprm_committed_creds,
5630 .bprm_secureexec = selinux_bprm_secureexec,
5631
5632 .sb_alloc_security = selinux_sb_alloc_security,
5633 .sb_free_security = selinux_sb_free_security,
5634 .sb_copy_data = selinux_sb_copy_data,
5635 .sb_remount = selinux_sb_remount,
5636 .sb_kern_mount = selinux_sb_kern_mount,
5637 .sb_show_options = selinux_sb_show_options,
5638 .sb_statfs = selinux_sb_statfs,
5639 .sb_mount = selinux_mount,
5640 .sb_umount = selinux_umount,
5641 .sb_set_mnt_opts = selinux_set_mnt_opts,
5642 .sb_clone_mnt_opts = selinux_sb_clone_mnt_opts,
5643 .sb_parse_opts_str = selinux_parse_opts_str,
5644
5645 .dentry_init_security = selinux_dentry_init_security,
5646
5647 .inode_alloc_security = selinux_inode_alloc_security,
5648 .inode_free_security = selinux_inode_free_security,
5649 .inode_init_security = selinux_inode_init_security,
5650 .inode_create = selinux_inode_create,
5651 .inode_link = selinux_inode_link,
5652 .inode_unlink = selinux_inode_unlink,
5653 .inode_symlink = selinux_inode_symlink,
5654 .inode_mkdir = selinux_inode_mkdir,
5655 .inode_rmdir = selinux_inode_rmdir,
5656 .inode_mknod = selinux_inode_mknod,
5657 .inode_rename = selinux_inode_rename,
5658 .inode_readlink = selinux_inode_readlink,
5659 .inode_follow_link = selinux_inode_follow_link,
5660 .inode_permission = selinux_inode_permission,
5661 .inode_setattr = selinux_inode_setattr,
5662 .inode_getattr = selinux_inode_getattr,
5663 .inode_setxattr = selinux_inode_setxattr,
5664 .inode_post_setxattr = selinux_inode_post_setxattr,
5665 .inode_getxattr = selinux_inode_getxattr,
5666 .inode_listxattr = selinux_inode_listxattr,
5667 .inode_removexattr = selinux_inode_removexattr,
5668 .inode_getsecurity = selinux_inode_getsecurity,
5669 .inode_setsecurity = selinux_inode_setsecurity,
5670 .inode_listsecurity = selinux_inode_listsecurity,
5671 .inode_getsecid = selinux_inode_getsecid,
5672
5673 .file_permission = selinux_file_permission,
5674 .file_alloc_security = selinux_file_alloc_security,
5675 .file_free_security = selinux_file_free_security,
5676 .file_ioctl = selinux_file_ioctl,
5677 .mmap_file = selinux_mmap_file,
5678 .mmap_addr = selinux_mmap_addr,
5679 .file_mprotect = selinux_file_mprotect,
5680 .file_lock = selinux_file_lock,
5681 .file_fcntl = selinux_file_fcntl,
5682 .file_set_fowner = selinux_file_set_fowner,
5683 .file_send_sigiotask = selinux_file_send_sigiotask,
5684 .file_receive = selinux_file_receive,
5685
5686 .file_open = selinux_file_open,
5687
5688 .task_create = selinux_task_create,
5689 .cred_alloc_blank = selinux_cred_alloc_blank,
5690 .cred_free = selinux_cred_free,
5691 .cred_prepare = selinux_cred_prepare,
5692 .cred_transfer = selinux_cred_transfer,
5693 .kernel_act_as = selinux_kernel_act_as,
5694 .kernel_create_files_as = selinux_kernel_create_files_as,
5695 .kernel_module_request = selinux_kernel_module_request,
5696 .task_setpgid = selinux_task_setpgid,
5697 .task_getpgid = selinux_task_getpgid,
5698 .task_getsid = selinux_task_getsid,
5699 .task_getsecid = selinux_task_getsecid,
5700 .task_setnice = selinux_task_setnice,
5701 .task_setioprio = selinux_task_setioprio,
5702 .task_getioprio = selinux_task_getioprio,
5703 .task_setrlimit = selinux_task_setrlimit,
5704 .task_setscheduler = selinux_task_setscheduler,
5705 .task_getscheduler = selinux_task_getscheduler,
5706 .task_movememory = selinux_task_movememory,
5707 .task_kill = selinux_task_kill,
5708 .task_wait = selinux_task_wait,
5709 .task_to_inode = selinux_task_to_inode,
5710
5711 .ipc_permission = selinux_ipc_permission,
5712 .ipc_getsecid = selinux_ipc_getsecid,
5713
5714 .msg_msg_alloc_security = selinux_msg_msg_alloc_security,
5715 .msg_msg_free_security = selinux_msg_msg_free_security,
5716
5717 .msg_queue_alloc_security = selinux_msg_queue_alloc_security,
5718 .msg_queue_free_security = selinux_msg_queue_free_security,
5719 .msg_queue_associate = selinux_msg_queue_associate,
5720 .msg_queue_msgctl = selinux_msg_queue_msgctl,
5721 .msg_queue_msgsnd = selinux_msg_queue_msgsnd,
5722 .msg_queue_msgrcv = selinux_msg_queue_msgrcv,
5723
5724 .shm_alloc_security = selinux_shm_alloc_security,
5725 .shm_free_security = selinux_shm_free_security,
5726 .shm_associate = selinux_shm_associate,
5727 .shm_shmctl = selinux_shm_shmctl,
5728 .shm_shmat = selinux_shm_shmat,
5729
5730 .sem_alloc_security = selinux_sem_alloc_security,
5731 .sem_free_security = selinux_sem_free_security,
5732 .sem_associate = selinux_sem_associate,
5733 .sem_semctl = selinux_sem_semctl,
5734 .sem_semop = selinux_sem_semop,
5735
5736 .d_instantiate = selinux_d_instantiate,
5737
5738 .getprocattr = selinux_getprocattr,
5739 .setprocattr = selinux_setprocattr,
5740
5741 .ismaclabel = selinux_ismaclabel,
5742 .secid_to_secctx = selinux_secid_to_secctx,
5743 .secctx_to_secid = selinux_secctx_to_secid,
5744 .release_secctx = selinux_release_secctx,
5745 .inode_notifysecctx = selinux_inode_notifysecctx,
5746 .inode_setsecctx = selinux_inode_setsecctx,
5747 .inode_getsecctx = selinux_inode_getsecctx,
5748
5749 .unix_stream_connect = selinux_socket_unix_stream_connect,
5750 .unix_may_send = selinux_socket_unix_may_send,
5751
5752 .socket_create = selinux_socket_create,
5753 .socket_post_create = selinux_socket_post_create,
5754 .socket_bind = selinux_socket_bind,
5755 .socket_connect = selinux_socket_connect,
5756 .socket_listen = selinux_socket_listen,
5757 .socket_accept = selinux_socket_accept,
5758 .socket_sendmsg = selinux_socket_sendmsg,
5759 .socket_recvmsg = selinux_socket_recvmsg,
5760 .socket_getsockname = selinux_socket_getsockname,
5761 .socket_getpeername = selinux_socket_getpeername,
5762 .socket_getsockopt = selinux_socket_getsockopt,
5763 .socket_setsockopt = selinux_socket_setsockopt,
5764 .socket_shutdown = selinux_socket_shutdown,
5765 .socket_sock_rcv_skb = selinux_socket_sock_rcv_skb,
5766 .socket_getpeersec_stream = selinux_socket_getpeersec_stream,
5767 .socket_getpeersec_dgram = selinux_socket_getpeersec_dgram,
5768 .sk_alloc_security = selinux_sk_alloc_security,
5769 .sk_free_security = selinux_sk_free_security,
5770 .sk_clone_security = selinux_sk_clone_security,
5771 .sk_getsecid = selinux_sk_getsecid,
5772 .sock_graft = selinux_sock_graft,
5773 .inet_conn_request = selinux_inet_conn_request,
5774 .inet_csk_clone = selinux_inet_csk_clone,
5775 .inet_conn_established = selinux_inet_conn_established,
5776 .secmark_relabel_packet = selinux_secmark_relabel_packet,
5777 .secmark_refcount_inc = selinux_secmark_refcount_inc,
5778 .secmark_refcount_dec = selinux_secmark_refcount_dec,
5779 .req_classify_flow = selinux_req_classify_flow,
5780 .tun_dev_alloc_security = selinux_tun_dev_alloc_security,
5781 .tun_dev_free_security = selinux_tun_dev_free_security,
5782 .tun_dev_create = selinux_tun_dev_create,
5783 .tun_dev_attach_queue = selinux_tun_dev_attach_queue,
5784 .tun_dev_attach = selinux_tun_dev_attach,
5785 .tun_dev_open = selinux_tun_dev_open,
5786 .skb_owned_by = selinux_skb_owned_by,
5787
5788 #ifdef CONFIG_SECURITY_NETWORK_XFRM
5789 .xfrm_policy_alloc_security = selinux_xfrm_policy_alloc,
5790 .xfrm_policy_clone_security = selinux_xfrm_policy_clone,
5791 .xfrm_policy_free_security = selinux_xfrm_policy_free,
5792 .xfrm_policy_delete_security = selinux_xfrm_policy_delete,
5793 .xfrm_state_alloc_security = selinux_xfrm_state_alloc,
5794 .xfrm_state_free_security = selinux_xfrm_state_free,
5795 .xfrm_state_delete_security = selinux_xfrm_state_delete,
5796 .xfrm_policy_lookup = selinux_xfrm_policy_lookup,
5797 .xfrm_state_pol_flow_match = selinux_xfrm_state_pol_flow_match,
5798 .xfrm_decode_session = selinux_xfrm_decode_session,
5799 #endif
5800
5801 #ifdef CONFIG_KEYS
5802 .key_alloc = selinux_key_alloc,
5803 .key_free = selinux_key_free,
5804 .key_permission = selinux_key_permission,
5805 .key_getsecurity = selinux_key_getsecurity,
5806 #endif
5807
5808 #ifdef CONFIG_AUDIT
5809 .audit_rule_init = selinux_audit_rule_init,
5810 .audit_rule_known = selinux_audit_rule_known,
5811 .audit_rule_match = selinux_audit_rule_match,
5812 .audit_rule_free = selinux_audit_rule_free,
5813 #endif
5814 };
5815
5816 static __init int selinux_init(void)
5817 {
5818 if (!security_module_enable(&selinux_ops)) {
5819 selinux_enabled = 0;
5820 return 0;
5821 }
5822
5823 if (!selinux_enabled) {
5824 printk(KERN_INFO "SELinux: Disabled at boot.\n");
5825 return 0;
5826 }
5827
5828 printk(KERN_INFO "SELinux: Initializing.\n");
5829
5830 /* Set the security state for the initial task. */
5831 cred_init_security();
5832
5833 default_noexec = !(VM_DATA_DEFAULT_FLAGS & VM_EXEC);
5834
5835 sel_inode_cache = kmem_cache_create("selinux_inode_security",
5836 sizeof(struct inode_security_struct),
5837 0, SLAB_PANIC, NULL);
5838 avc_init();
5839
5840 if (register_security(&selinux_ops))
5841 panic("SELinux: Unable to register with kernel.\n");
5842
5843 if (selinux_enforcing)
5844 printk(KERN_DEBUG "SELinux: Starting in enforcing mode\n");
5845 else
5846 printk(KERN_DEBUG "SELinux: Starting in permissive mode\n");
5847
5848 return 0;
5849 }
5850
5851 static void delayed_superblock_init(struct super_block *sb, void *unused)
5852 {
5853 superblock_doinit(sb, NULL);
5854 }
5855
5856 void selinux_complete_init(void)
5857 {
5858 printk(KERN_DEBUG "SELinux: Completing initialization.\n");
5859
5860 /* Set up any superblocks initialized prior to the policy load. */
5861 printk(KERN_DEBUG "SELinux: Setting up existing superblocks.\n");
5862 iterate_supers(delayed_superblock_init, NULL);
5863 }
5864
5865 /* SELinux requires early initialization in order to label
5866 all processes and objects when they are created. */
5867 security_initcall(selinux_init);
5868
5869 #if defined(CONFIG_NETFILTER)
5870
5871 static struct nf_hook_ops selinux_ipv4_ops[] = {
5872 {
5873 .hook = selinux_ipv4_postroute,
5874 .owner = THIS_MODULE,
5875 .pf = NFPROTO_IPV4,
5876 .hooknum = NF_INET_POST_ROUTING,
5877 .priority = NF_IP_PRI_SELINUX_LAST,
5878 },
5879 {
5880 .hook = selinux_ipv4_forward,
5881 .owner = THIS_MODULE,
5882 .pf = NFPROTO_IPV4,
5883 .hooknum = NF_INET_FORWARD,
5884 .priority = NF_IP_PRI_SELINUX_FIRST,
5885 },
5886 {
5887 .hook = selinux_ipv4_output,
5888 .owner = THIS_MODULE,
5889 .pf = NFPROTO_IPV4,
5890 .hooknum = NF_INET_LOCAL_OUT,
5891 .priority = NF_IP_PRI_SELINUX_FIRST,
5892 }
5893 };
5894
5895 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5896
5897 static struct nf_hook_ops selinux_ipv6_ops[] = {
5898 {
5899 .hook = selinux_ipv6_postroute,
5900 .owner = THIS_MODULE,
5901 .pf = NFPROTO_IPV6,
5902 .hooknum = NF_INET_POST_ROUTING,
5903 .priority = NF_IP6_PRI_SELINUX_LAST,
5904 },
5905 {
5906 .hook = selinux_ipv6_forward,
5907 .owner = THIS_MODULE,
5908 .pf = NFPROTO_IPV6,
5909 .hooknum = NF_INET_FORWARD,
5910 .priority = NF_IP6_PRI_SELINUX_FIRST,
5911 }
5912 };
5913
5914 #endif /* IPV6 */
5915
5916 static int __init selinux_nf_ip_init(void)
5917 {
5918 int err = 0;
5919
5920 if (!selinux_enabled)
5921 goto out;
5922
5923 printk(KERN_DEBUG "SELinux: Registering netfilter hooks\n");
5924
5925 err = nf_register_hooks(selinux_ipv4_ops, ARRAY_SIZE(selinux_ipv4_ops));
5926 if (err)
5927 panic("SELinux: nf_register_hooks for IPv4: error %d\n", err);
5928
5929 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5930 err = nf_register_hooks(selinux_ipv6_ops, ARRAY_SIZE(selinux_ipv6_ops));
5931 if (err)
5932 panic("SELinux: nf_register_hooks for IPv6: error %d\n", err);
5933 #endif /* IPV6 */
5934
5935 out:
5936 return err;
5937 }
5938
5939 __initcall(selinux_nf_ip_init);
5940
5941 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
5942 static void selinux_nf_ip_exit(void)
5943 {
5944 printk(KERN_DEBUG "SELinux: Unregistering netfilter hooks\n");
5945
5946 nf_unregister_hooks(selinux_ipv4_ops, ARRAY_SIZE(selinux_ipv4_ops));
5947 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5948 nf_unregister_hooks(selinux_ipv6_ops, ARRAY_SIZE(selinux_ipv6_ops));
5949 #endif /* IPV6 */
5950 }
5951 #endif
5952
5953 #else /* CONFIG_NETFILTER */
5954
5955 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
5956 #define selinux_nf_ip_exit()
5957 #endif
5958
5959 #endif /* CONFIG_NETFILTER */
5960
5961 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
5962 static int selinux_disabled;
5963
5964 int selinux_disable(void)
5965 {
5966 if (ss_initialized) {
5967 /* Not permitted after initial policy load. */
5968 return -EINVAL;
5969 }
5970
5971 if (selinux_disabled) {
5972 /* Only do this once. */
5973 return -EINVAL;
5974 }
5975
5976 printk(KERN_INFO "SELinux: Disabled at runtime.\n");
5977
5978 selinux_disabled = 1;
5979 selinux_enabled = 0;
5980
5981 reset_security_ops();
5982
5983 /* Try to destroy the avc node cache */
5984 avc_disable();
5985
5986 /* Unregister netfilter hooks. */
5987 selinux_nf_ip_exit();
5988
5989 /* Unregister selinuxfs. */
5990 exit_sel_fs();
5991
5992 return 0;
5993 }
5994 #endif
CRIS linux kernel tree