?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
MOXA linux-2.6.x / linux-2.6.9-uc0 from sdlinux-moxaart.tgz
[linux-2.6.9-moxart.git] / security / selinux / hooks.c
blobf844e402b53c2f76f64a90fb7831cb7bb96b03a3
1 /*
2 * NSA Security-Enhanced Linux (SELinux) security module
3 *
4 * This file contains the SELinux hook function implementations.
5 *
6 * Authors: Stephen Smalley, <sds@epoch.ncsc.mil>
7 * Chris Vance, <cvance@nai.com>
8 * Wayne Salamon, <wsalamon@nai.com>
9 * James Morris <jmorris@redhat.com>
10 *
11 * Copyright (C) 2001,2002 Networks Associates Technology, Inc.
12 * Copyright (C) 2003 Red Hat, Inc., James Morris <jmorris@redhat.com>
13 *
14 * This program is free software; you can redistribute it and/or modify
15 * it under the terms of the GNU General Public License version 2,
16 * as published by the Free Software Foundation.
17 */
18
19 #include <linux/config.h>
20 #include <linux/module.h>
21 #include <linux/init.h>
22 #include <linux/kernel.h>
23 #include <linux/ptrace.h>
24 #include <linux/errno.h>
25 #include <linux/sched.h>
26 #include <linux/security.h>
27 #include <linux/xattr.h>
28 #include <linux/capability.h>
29 #include <linux/unistd.h>
30 #include <linux/mm.h>
31 #include <linux/mman.h>
32 #include <linux/slab.h>
33 #include <linux/pagemap.h>
34 #include <linux/swap.h>
35 #include <linux/smp_lock.h>
36 #include <linux/spinlock.h>
37 #include <linux/syscalls.h>
38 #include <linux/file.h>
39 #include <linux/namei.h>
40 #include <linux/mount.h>
41 #include <linux/ext2_fs.h>
42 #include <linux/proc_fs.h>
43 #include <linux/kd.h>
44 #include <linux/netfilter_ipv4.h>
45 #include <linux/netfilter_ipv6.h>
46 #include <linux/tty.h>
47 #include <net/icmp.h>
48 #include <net/ip.h> /* for sysctl_local_port_range[] */
49 #include <net/tcp.h> /* struct or_callable used in sock_rcv_skb */
50 #include <asm/uaccess.h>
51 #include <asm/semaphore.h>
52 #include <asm/ioctls.h>
53 #include <linux/bitops.h>
54 #include <linux/interrupt.h>
55 #include <linux/netdevice.h> /* for network interface checks */
56 #include <linux/netlink.h>
57 #include <linux/tcp.h>
58 #include <linux/udp.h>
59 #include <linux/quota.h>
60 #include <linux/un.h> /* for Unix socket types */
61 #include <net/af_unix.h> /* for Unix socket types */
62 #include <linux/parser.h>
63 #include <linux/nfs_mount.h>
64 #include <net/ipv6.h>
65 #include <linux/hugetlb.h>
66 #include <linux/personality.h>
67
68 #include "avc.h"
69 #include "objsec.h"
70 #include "netif.h"
71
72 #define XATTR_SELINUX_SUFFIX "selinux"
73 #define XATTR_NAME_SELINUX XATTR_SECURITY_PREFIX XATTR_SELINUX_SUFFIX
74
75 extern int policydb_loaded_version;
76 extern int selinux_nlmsg_lookup(u16 sclass, u16 nlmsg_type, u32 *perm);
77
78 #ifdef CONFIG_SECURITY_SELINUX_DEVELOP
79 int selinux_enforcing = 0;
80
81 static int __init enforcing_setup(char *str)
82 {
83 selinux_enforcing = simple_strtol(str,NULL,0);
84 return 1;
85 }
86 __setup("enforcing=", enforcing_setup);
87 #endif
88
89 #ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
90 int selinux_enabled = CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE;
91
92 static int __init selinux_enabled_setup(char *str)
93 {
94 selinux_enabled = simple_strtol(str, NULL, 0);
95 return 1;
96 }
97 __setup("selinux=", selinux_enabled_setup);
98 #endif
99
100 /* Original (dummy) security module. */
101 static struct security_operations *original_ops = NULL;
102
103 /* Minimal support for a secondary security module,
104 just to allow the use of the dummy or capability modules.
105 The owlsm module can alternatively be used as a secondary
106 module as long as CONFIG_OWLSM_FD is not enabled. */
107 static struct security_operations *secondary_ops = NULL;
108
109 /* Lists of inode and superblock security structures initialized
110 before the policy was loaded. */
111 static LIST_HEAD(superblock_security_head);
112 static spinlock_t sb_security_lock = SPIN_LOCK_UNLOCKED;
113
114 /* Allocate and free functions for each kind of security blob. */
115
116 static int task_alloc_security(struct task_struct *task)
117 {
118 struct task_security_struct *tsec;
119
120 tsec = kmalloc(sizeof(struct task_security_struct), GFP_KERNEL);
121 if (!tsec)
122 return -ENOMEM;
123
124 memset(tsec, 0, sizeof(struct task_security_struct));
125 tsec->magic = SELINUX_MAGIC;
126 tsec->task = task;
127 tsec->osid = tsec->sid = tsec->ptrace_sid = SECINITSID_UNLABELED;
128 task->security = tsec;
129
130 return 0;
131 }
132
133 static void task_free_security(struct task_struct *task)
134 {
135 struct task_security_struct *tsec = task->security;
136
137 if (!tsec || tsec->magic != SELINUX_MAGIC)
138 return;
139
140 task->security = NULL;
141 kfree(tsec);
142 }
143
144 static int inode_alloc_security(struct inode *inode)
145 {
146 struct task_security_struct *tsec = current->security;
147 struct inode_security_struct *isec;
148
149 isec = kmalloc(sizeof(struct inode_security_struct), GFP_KERNEL);
150 if (!isec)
151 return -ENOMEM;
152
153 memset(isec, 0, sizeof(struct inode_security_struct));
154 init_MUTEX(&isec->sem);
155 INIT_LIST_HEAD(&isec->list);
156 isec->magic = SELINUX_MAGIC;
157 isec->inode = inode;
158 isec->sid = SECINITSID_UNLABELED;
159 isec->sclass = SECCLASS_FILE;
160 if (tsec && tsec->magic == SELINUX_MAGIC)
161 isec->task_sid = tsec->sid;
162 else
163 isec->task_sid = SECINITSID_UNLABELED;
164 inode->i_security = isec;
165
166 return 0;
167 }
168
169 static void inode_free_security(struct inode *inode)
170 {
171 struct inode_security_struct *isec = inode->i_security;
172 struct superblock_security_struct *sbsec = inode->i_sb->s_security;
173
174 if (!isec || isec->magic != SELINUX_MAGIC)
175 return;
176
177 spin_lock(&sbsec->isec_lock);
178 if (!list_empty(&isec->list))
179 list_del_init(&isec->list);
180 spin_unlock(&sbsec->isec_lock);
181
182 inode->i_security = NULL;
183 kfree(isec);
184 }
185
186 static int file_alloc_security(struct file *file)
187 {
188 struct task_security_struct *tsec = current->security;
189 struct file_security_struct *fsec;
190
191 fsec = kmalloc(sizeof(struct file_security_struct), GFP_ATOMIC);
192 if (!fsec)
193 return -ENOMEM;
194
195 memset(fsec, 0, sizeof(struct file_security_struct));
196 fsec->magic = SELINUX_MAGIC;
197 fsec->file = file;
198 if (tsec && tsec->magic == SELINUX_MAGIC) {
199 fsec->sid = tsec->sid;
200 fsec->fown_sid = tsec->sid;
201 } else {
202 fsec->sid = SECINITSID_UNLABELED;
203 fsec->fown_sid = SECINITSID_UNLABELED;
204 }
205 file->f_security = fsec;
206
207 return 0;
208 }
209
210 static void file_free_security(struct file *file)
211 {
212 struct file_security_struct *fsec = file->f_security;
213
214 if (!fsec || fsec->magic != SELINUX_MAGIC)
215 return;
216
217 file->f_security = NULL;
218 kfree(fsec);
219 }
220
221 static int superblock_alloc_security(struct super_block *sb)
222 {
223 struct superblock_security_struct *sbsec;
224
225 sbsec = kmalloc(sizeof(struct superblock_security_struct), GFP_KERNEL);
226 if (!sbsec)
227 return -ENOMEM;
228
229 memset(sbsec, 0, sizeof(struct superblock_security_struct));
230 init_MUTEX(&sbsec->sem);
231 INIT_LIST_HEAD(&sbsec->list);
232 INIT_LIST_HEAD(&sbsec->isec_head);
233 spin_lock_init(&sbsec->isec_lock);
234 sbsec->magic = SELINUX_MAGIC;
235 sbsec->sb = sb;
236 sbsec->sid = SECINITSID_UNLABELED;
237 sbsec->def_sid = SECINITSID_FILE;
238 sb->s_security = sbsec;
239
240 return 0;
241 }
242
243 static void superblock_free_security(struct super_block *sb)
244 {
245 struct superblock_security_struct *sbsec = sb->s_security;
246
247 if (!sbsec || sbsec->magic != SELINUX_MAGIC)
248 return;
249
250 spin_lock(&sb_security_lock);
251 if (!list_empty(&sbsec->list))
252 list_del_init(&sbsec->list);
253 spin_unlock(&sb_security_lock);
254
255 sb->s_security = NULL;
256 kfree(sbsec);
257 }
258
259 #ifdef CONFIG_SECURITY_NETWORK
260 static int sk_alloc_security(struct sock *sk, int family, int priority)
261 {
262 struct sk_security_struct *ssec;
263
264 if (family != PF_UNIX)
265 return 0;
266
267 ssec = kmalloc(sizeof(*ssec), priority);
268 if (!ssec)
269 return -ENOMEM;
270
271 memset(ssec, 0, sizeof(*ssec));
272 ssec->magic = SELINUX_MAGIC;
273 ssec->sk = sk;
274 ssec->peer_sid = SECINITSID_UNLABELED;
275 sk->sk_security = ssec;
276
277 return 0;
278 }
279
280 static void sk_free_security(struct sock *sk)
281 {
282 struct sk_security_struct *ssec = sk->sk_security;
283
284 if (sk->sk_family != PF_UNIX || ssec->magic != SELINUX_MAGIC)
285 return;
286
287 sk->sk_security = NULL;
288 kfree(ssec);
289 }
290 #endif /* CONFIG_SECURITY_NETWORK */
291
292 /* The security server must be initialized before
293 any labeling or access decisions can be provided. */
294 extern int ss_initialized;
295
296 /* The file system's label must be initialized prior to use. */
297
298 static char *labeling_behaviors[6] = {
299 "uses xattr",
300 "uses transition SIDs",
301 "uses task SIDs",
302 "uses genfs_contexts",
303 "not configured for labeling",
304 "uses mountpoint labeling",
305 };
306
307 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
308
309 static inline int inode_doinit(struct inode *inode)
310 {
311 return inode_doinit_with_dentry(inode, NULL);
312 }
313
314 enum {
315 Opt_context = 1,
316 Opt_fscontext = 2,
317 Opt_defcontext = 4,
318 };
319
320 static match_table_t tokens = {
321 {Opt_context, "context=%s"},
322 {Opt_fscontext, "fscontext=%s"},
323 {Opt_defcontext, "defcontext=%s"},
324 };
325
326 #define SEL_MOUNT_FAIL_MSG "SELinux: duplicate or incompatible mount options\n"
327
328 static int try_context_mount(struct super_block *sb, void *data)
329 {
330 char *context = NULL, *defcontext = NULL;
331 const char *name;
332 u32 sid;
333 int alloc = 0, rc = 0, seen = 0;
334 struct task_security_struct *tsec = current->security;
335 struct superblock_security_struct *sbsec = sb->s_security;
336
337 if (!data)
338 goto out;
339
340 name = sb->s_type->name;
341
342 if (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA) {
343
344 /* NFS we understand. */
345 if (!strcmp(name, "nfs")) {
346 struct nfs_mount_data *d = data;
347
348 if (d->version < NFS_MOUNT_VERSION)
349 goto out;
350
351 if (d->context[0]) {
352 context = d->context;
353 seen |= Opt_context;
354 }
355 } else
356 goto out;
357
358 } else {
359 /* Standard string-based options. */
360 char *p, *options = data;
361
362 while ((p = strsep(&options, ",")) != NULL) {
363 int token;
364 substring_t args[MAX_OPT_ARGS];
365
366 if (!*p)
367 continue;
368
369 token = match_token(p, tokens, args);
370
371 switch (token) {
372 case Opt_context:
373 if (seen) {
374 rc = -EINVAL;
375 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
376 goto out_free;
377 }
378 context = match_strdup(&args[0]);
379 if (!context) {
380 rc = -ENOMEM;
381 goto out_free;
382 }
383 if (!alloc)
384 alloc = 1;
385 seen |= Opt_context;
386 break;
387
388 case Opt_fscontext:
389 if (sbsec->behavior != SECURITY_FS_USE_XATTR) {
390 rc = -EINVAL;
391 printk(KERN_WARNING "SELinux: "
392 "fscontext option is invalid for"
393 " this filesystem type\n");
394 goto out_free;
395 }
396 if (seen & (Opt_context|Opt_fscontext)) {
397 rc = -EINVAL;
398 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
399 goto out_free;
400 }
401 context = match_strdup(&args[0]);
402 if (!context) {
403 rc = -ENOMEM;
404 goto out_free;
405 }
406 if (!alloc)
407 alloc = 1;
408 seen |= Opt_fscontext;
409 break;
410
411 case Opt_defcontext:
412 if (sbsec->behavior != SECURITY_FS_USE_XATTR) {
413 rc = -EINVAL;
414 printk(KERN_WARNING "SELinux: "
415 "defcontext option is invalid "
416 "for this filesystem type\n");
417 goto out_free;
418 }
419 if (seen & (Opt_context|Opt_defcontext)) {
420 rc = -EINVAL;
421 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
422 goto out_free;
423 }
424 defcontext = match_strdup(&args[0]);
425 if (!defcontext) {
426 rc = -ENOMEM;
427 goto out_free;
428 }
429 if (!alloc)
430 alloc = 1;
431 seen |= Opt_defcontext;
432 break;
433
434 default:
435 rc = -EINVAL;
436 printk(KERN_WARNING "SELinux: unknown mount "
437 "option\n");
438 goto out_free;
439
440 }
441 }
442 }
443
444 if (!seen)
445 goto out;
446
447 if (context) {
448 rc = security_context_to_sid(context, strlen(context), &sid);
449 if (rc) {
450 printk(KERN_WARNING "SELinux: security_context_to_sid"
451 "(%s) failed for (dev %s, type %s) errno=%d\n",
452 context, sb->s_id, name, rc);
453 goto out_free;
454 }
455
456 rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
457 FILESYSTEM__RELABELFROM, NULL, NULL);
458 if (rc)
459 goto out_free;
460
461 rc = avc_has_perm(tsec->sid, sid, SECCLASS_FILESYSTEM,
462 FILESYSTEM__RELABELTO, NULL, NULL);
463 if (rc)
464 goto out_free;
465
466 sbsec->sid = sid;
467
468 if (seen & Opt_context)
469 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
470 }
471
472 if (defcontext) {
473 rc = security_context_to_sid(defcontext, strlen(defcontext), &sid);
474 if (rc) {
475 printk(KERN_WARNING "SELinux: security_context_to_sid"
476 "(%s) failed for (dev %s, type %s) errno=%d\n",
477 defcontext, sb->s_id, name, rc);
478 goto out_free;
479 }
480
481 if (sid == sbsec->def_sid)
482 goto out_free;
483
484 rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
485 FILESYSTEM__RELABELFROM, NULL, NULL);
486 if (rc)
487 goto out_free;
488
489 rc = avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM,
490 FILESYSTEM__ASSOCIATE, NULL, NULL);
491 if (rc)
492 goto out_free;
493
494 sbsec->def_sid = sid;
495 }
496
497 out_free:
498 if (alloc) {
499 kfree(context);
500 kfree(defcontext);
501 }
502 out:
503 return rc;
504 }
505
506 static int superblock_doinit(struct super_block *sb, void *data)
507 {
508 struct superblock_security_struct *sbsec = sb->s_security;
509 struct dentry *root = sb->s_root;
510 struct inode *inode = root->d_inode;
511 int rc = 0;
512
513 down(&sbsec->sem);
514 if (sbsec->initialized)
515 goto out;
516
517 if (!ss_initialized) {
518 /* Defer initialization until selinux_complete_init,
519 after the initial policy is loaded and the security
520 server is ready to handle calls. */
521 spin_lock(&sb_security_lock);
522 if (list_empty(&sbsec->list))
523 list_add(&sbsec->list, &superblock_security_head);
524 spin_unlock(&sb_security_lock);
525 goto out;
526 }
527
528 /* Determine the labeling behavior to use for this filesystem type. */
529 rc = security_fs_use(sb->s_type->name, &sbsec->behavior, &sbsec->sid);
530 if (rc) {
531 printk(KERN_WARNING "%s: security_fs_use(%s) returned %d\n",
532 __FUNCTION__, sb->s_type->name, rc);
533 goto out;
534 }
535
536 rc = try_context_mount(sb, data);
537 if (rc)
538 goto out;
539
540 if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
541 /* Make sure that the xattr handler exists and that no
542 error other than -ENODATA is returned by getxattr on
543 the root directory. -ENODATA is ok, as this may be
544 the first boot of the SELinux kernel before we have
545 assigned xattr values to the filesystem. */
546 if (!inode->i_op->getxattr) {
547 printk(KERN_WARNING "SELinux: (dev %s, type %s) has no "
548 "xattr support\n", sb->s_id, sb->s_type->name);
549 rc = -EOPNOTSUPP;
550 goto out;
551 }
552 rc = inode->i_op->getxattr(root, XATTR_NAME_SELINUX, NULL, 0);
553 if (rc < 0 && rc != -ENODATA) {
554 if (rc == -EOPNOTSUPP)
555 printk(KERN_WARNING "SELinux: (dev %s, type "
556 "%s) has no security xattr handler\n",
557 sb->s_id, sb->s_type->name);
558 else
559 printk(KERN_WARNING "SELinux: (dev %s, type "
560 "%s) getxattr errno %d\n", sb->s_id,
561 sb->s_type->name, -rc);
562 goto out;
563 }
564 }
565
566 if (strcmp(sb->s_type->name, "proc") == 0)
567 sbsec->proc = 1;
568
569 sbsec->initialized = 1;
570
571 if (sbsec->behavior > ARRAY_SIZE(labeling_behaviors)) {
572 printk(KERN_INFO "SELinux: initialized (dev %s, type %s), unknown behavior\n",
573 sb->s_id, sb->s_type->name);
574 }
575 else {
576 printk(KERN_INFO "SELinux: initialized (dev %s, type %s), %s\n",
577 sb->s_id, sb->s_type->name,
578 labeling_behaviors[sbsec->behavior-1]);
579 }
580
581 /* Initialize the root inode. */
582 rc = inode_doinit_with_dentry(sb->s_root->d_inode, sb->s_root);
583
584 /* Initialize any other inodes associated with the superblock, e.g.
585 inodes created prior to initial policy load or inodes created
586 during get_sb by a pseudo filesystem that directly
587 populates itself. */
588 spin_lock(&sbsec->isec_lock);
589 next_inode:
590 if (!list_empty(&sbsec->isec_head)) {
591 struct inode_security_struct *isec =
592 list_entry(sbsec->isec_head.next,
593 struct inode_security_struct, list);
594 struct inode *inode = isec->inode;
595 spin_unlock(&sbsec->isec_lock);
596 inode = igrab(inode);
597 if (inode) {
598 inode_doinit(inode);
599 iput(inode);
600 }
601 spin_lock(&sbsec->isec_lock);
602 list_del_init(&isec->list);
603 goto next_inode;
604 }
605 spin_unlock(&sbsec->isec_lock);
606 out:
607 up(&sbsec->sem);
608 return rc;
609 }
610
611 static inline u16 inode_mode_to_security_class(umode_t mode)
612 {
613 switch (mode & S_IFMT) {
614 case S_IFSOCK:
615 return SECCLASS_SOCK_FILE;
616 case S_IFLNK:
617 return SECCLASS_LNK_FILE;
618 case S_IFREG:
619 return SECCLASS_FILE;
620 case S_IFBLK:
621 return SECCLASS_BLK_FILE;
622 case S_IFDIR:
623 return SECCLASS_DIR;
624 case S_IFCHR:
625 return SECCLASS_CHR_FILE;
626 case S_IFIFO:
627 return SECCLASS_FIFO_FILE;
628
629 }
630
631 return SECCLASS_FILE;
632 }
633
634 static inline u16 socket_type_to_security_class(int family, int type, int protocol)
635 {
636 switch (family) {
637 case PF_UNIX:
638 switch (type) {
639 case SOCK_STREAM:
640 return SECCLASS_UNIX_STREAM_SOCKET;
641 case SOCK_DGRAM:
642 return SECCLASS_UNIX_DGRAM_SOCKET;
643 }
644 case PF_INET:
645 case PF_INET6:
646 switch (type) {
647 case SOCK_STREAM:
648 return SECCLASS_TCP_SOCKET;
649 case SOCK_DGRAM:
650 return SECCLASS_UDP_SOCKET;
651 case SOCK_RAW:
652 return SECCLASS_RAWIP_SOCKET;
653 }
654 case PF_NETLINK:
655 switch (protocol) {
656 case NETLINK_ROUTE:
657 return SECCLASS_NETLINK_ROUTE_SOCKET;
658 case NETLINK_FIREWALL:
659 return SECCLASS_NETLINK_FIREWALL_SOCKET;
660 case NETLINK_TCPDIAG:
661 return SECCLASS_NETLINK_TCPDIAG_SOCKET;
662 case NETLINK_NFLOG:
663 return SECCLASS_NETLINK_NFLOG_SOCKET;
664 case NETLINK_XFRM:
665 return SECCLASS_NETLINK_XFRM_SOCKET;
666 case NETLINK_SELINUX:
667 return SECCLASS_NETLINK_SELINUX_SOCKET;
668 case NETLINK_AUDIT:
669 return SECCLASS_NETLINK_AUDIT_SOCKET;
670 case NETLINK_IP6_FW:
671 return SECCLASS_NETLINK_IP6FW_SOCKET;
672 case NETLINK_DNRTMSG:
673 return SECCLASS_NETLINK_DNRT_SOCKET;
674 default:
675 return SECCLASS_NETLINK_SOCKET;
676 }
677 case PF_PACKET:
678 return SECCLASS_PACKET_SOCKET;
679 case PF_KEY:
680 return SECCLASS_KEY_SOCKET;
681 }
682
683 return SECCLASS_SOCKET;
684 }
685
686 #ifdef CONFIG_PROC_FS
687 static int selinux_proc_get_sid(struct proc_dir_entry *de,
688 u16 tclass,
689 u32 *sid)
690 {
691 int buflen, rc;
692 char *buffer, *path, *end;
693
694 buffer = (char*)__get_free_page(GFP_KERNEL);
695 if (!buffer)
696 return -ENOMEM;
697
698 buflen = PAGE_SIZE;
699 end = buffer+buflen;
700 *--end = '\0';
701 buflen--;
702 path = end-1;
703 *path = '/';
704 while (de && de != de->parent) {
705 buflen -= de->namelen + 1;
706 if (buflen < 0)
707 break;
708 end -= de->namelen;
709 memcpy(end, de->name, de->namelen);
710 *--end = '/';
711 path = end;
712 de = de->parent;
713 }
714 rc = security_genfs_sid("proc", path, tclass, sid);
715 free_page((unsigned long)buffer);
716 return rc;
717 }
718 #else
719 static int selinux_proc_get_sid(struct proc_dir_entry *de,
720 u16 tclass,
721 u32 *sid)
722 {
723 return -EINVAL;
724 }
725 #endif
726
727 /* The inode's security attributes must be initialized before first use. */
728 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
729 {
730 struct superblock_security_struct *sbsec = NULL;
731 struct inode_security_struct *isec = inode->i_security;
732 u32 sid;
733 struct dentry *dentry;
734 #define INITCONTEXTLEN 255
735 char *context = NULL;
736 unsigned len = 0;
737 int rc = 0;
738 int hold_sem = 0;
739
740 if (isec->initialized)
741 goto out;
742
743 down(&isec->sem);
744 hold_sem = 1;
745 if (isec->initialized)
746 goto out;
747
748 sbsec = inode->i_sb->s_security;
749 if (!sbsec->initialized) {
750 /* Defer initialization until selinux_complete_init,
751 after the initial policy is loaded and the security
752 server is ready to handle calls. */
753 spin_lock(&sbsec->isec_lock);
754 if (list_empty(&isec->list))
755 list_add(&isec->list, &sbsec->isec_head);
756 spin_unlock(&sbsec->isec_lock);
757 goto out;
758 }
759
760 switch (sbsec->behavior) {
761 case SECURITY_FS_USE_XATTR:
762 if (!inode->i_op->getxattr) {
763 isec->sid = sbsec->def_sid;
764 break;
765 }
766
767 /* Need a dentry, since the xattr API requires one.
768 Life would be simpler if we could just pass the inode. */
769 if (opt_dentry) {
770 /* Called from d_instantiate or d_splice_alias. */
771 dentry = dget(opt_dentry);
772 } else {
773 /* Called from selinux_complete_init, try to find a dentry. */
774 dentry = d_find_alias(inode);
775 }
776 if (!dentry) {
777 printk(KERN_WARNING "%s: no dentry for dev=%s "
778 "ino=%ld\n", __FUNCTION__, inode->i_sb->s_id,
779 inode->i_ino);
780 goto out;
781 }
782
783 len = INITCONTEXTLEN;
784 context = kmalloc(len, GFP_KERNEL);
785 if (!context) {
786 rc = -ENOMEM;
787 dput(dentry);
788 goto out;
789 }
790 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
791 context, len);
792 if (rc == -ERANGE) {
793 /* Need a larger buffer. Query for the right size. */
794 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
795 NULL, 0);
796 if (rc < 0) {
797 dput(dentry);
798 goto out;
799 }
800 kfree(context);
801 len = rc;
802 context = kmalloc(len, GFP_KERNEL);
803 if (!context) {
804 rc = -ENOMEM;
805 dput(dentry);
806 goto out;
807 }
808 rc = inode->i_op->getxattr(dentry,
809 XATTR_NAME_SELINUX,
810 context, len);
811 }
812 dput(dentry);
813 if (rc < 0) {
814 if (rc != -ENODATA) {
815 printk(KERN_WARNING "%s: getxattr returned "
816 "%d for dev=%s ino=%ld\n", __FUNCTION__,
817 -rc, inode->i_sb->s_id, inode->i_ino);
818 kfree(context);
819 goto out;
820 }
821 /* Map ENODATA to the default file SID */
822 sid = sbsec->def_sid;
823 rc = 0;
824 } else {
825 rc = security_context_to_sid(context, rc, &sid);
826 if (rc) {
827 printk(KERN_WARNING "%s: context_to_sid(%s) "
828 "returned %d for dev=%s ino=%ld\n",
829 __FUNCTION__, context, -rc,
830 inode->i_sb->s_id, inode->i_ino);
831 kfree(context);
832 goto out;
833 }
834 }
835 kfree(context);
836 isec->sid = sid;
837 break;
838 case SECURITY_FS_USE_TASK:
839 isec->sid = isec->task_sid;
840 break;
841 case SECURITY_FS_USE_TRANS:
842 /* Default to the fs SID. */
843 isec->sid = sbsec->sid;
844
845 /* Try to obtain a transition SID. */
846 isec->sclass = inode_mode_to_security_class(inode->i_mode);
847 rc = security_transition_sid(isec->task_sid,
848 sbsec->sid,
849 isec->sclass,
850 &sid);
851 if (rc)
852 goto out;
853 isec->sid = sid;
854 break;
855 default:
856 /* Default to the fs SID. */
857 isec->sid = sbsec->sid;
858
859 if (sbsec->proc) {
860 struct proc_inode *proci = PROC_I(inode);
861 if (proci->pde) {
862 isec->sclass = inode_mode_to_security_class(inode->i_mode);
863 rc = selinux_proc_get_sid(proci->pde,
864 isec->sclass,
865 &sid);
866 if (rc)
867 goto out;
868 isec->sid = sid;
869 }
870 }
871 break;
872 }
873
874 isec->initialized = 1;
875
876 out:
877 if (inode->i_sock) {
878 struct socket *sock = SOCKET_I(inode);
879 if (sock->sk) {
880 isec->sclass = socket_type_to_security_class(sock->sk->sk_family,
881 sock->sk->sk_type,
882 sock->sk->sk_protocol);
883 } else {
884 isec->sclass = SECCLASS_SOCKET;
885 }
886 } else {
887 isec->sclass = inode_mode_to_security_class(inode->i_mode);
888 }
889
890 if (hold_sem)
891 up(&isec->sem);
892 return rc;
893 }
894
895 /* Convert a Linux signal to an access vector. */
896 static inline u32 signal_to_av(int sig)
897 {
898 u32 perm = 0;
899
900 switch (sig) {
901 case SIGCHLD:
902 /* Commonly granted from child to parent. */
903 perm = PROCESS__SIGCHLD;
904 break;
905 case SIGKILL:
906 /* Cannot be caught or ignored */
907 perm = PROCESS__SIGKILL;
908 break;
909 case SIGSTOP:
910 /* Cannot be caught or ignored */
911 perm = PROCESS__SIGSTOP;
912 break;
913 default:
914 /* All other signals. */
915 perm = PROCESS__SIGNAL;
916 break;
917 }
918
919 return perm;
920 }
921
922 /* Check permission betweeen a pair of tasks, e.g. signal checks,
923 fork check, ptrace check, etc. */
924 int task_has_perm(struct task_struct *tsk1,
925 struct task_struct *tsk2,
926 u32 perms)
927 {
928 struct task_security_struct *tsec1, *tsec2;
929
930 tsec1 = tsk1->security;
931 tsec2 = tsk2->security;
932 return avc_has_perm(tsec1->sid, tsec2->sid,
933 SECCLASS_PROCESS, perms, &tsec2->avcr, NULL);
934 }
935
936 /* Check whether a task is allowed to use a capability. */
937 int task_has_capability(struct task_struct *tsk,
938 int cap)
939 {
940 struct task_security_struct *tsec;
941 struct avc_audit_data ad;
942
943 tsec = tsk->security;
944
945 AVC_AUDIT_DATA_INIT(&ad,CAP);
946 ad.tsk = tsk;
947 ad.u.cap = cap;
948
949 return avc_has_perm(tsec->sid, tsec->sid,
950 SECCLASS_CAPABILITY, CAP_TO_MASK(cap), NULL, &ad);
951 }
952
953 /* Check whether a task is allowed to use a system operation. */
954 int task_has_system(struct task_struct *tsk,
955 u32 perms)
956 {
957 struct task_security_struct *tsec;
958
959 tsec = tsk->security;
960
961 return avc_has_perm(tsec->sid, SECINITSID_KERNEL,
962 SECCLASS_SYSTEM, perms, NULL, NULL);
963 }
964
965 /* Check whether a task has a particular permission to an inode.
966 The 'aeref' parameter is optional and allows other AVC
967 entry references to be passed (e.g. the one in the struct file).
968 The 'adp' parameter is optional and allows other audit
969 data to be passed (e.g. the dentry). */
970 int inode_has_perm(struct task_struct *tsk,
971 struct inode *inode,
972 u32 perms,
973 struct avc_entry_ref *aeref,
974 struct avc_audit_data *adp)
975 {
976 struct task_security_struct *tsec;
977 struct inode_security_struct *isec;
978 struct avc_audit_data ad;
979
980 tsec = tsk->security;
981 isec = inode->i_security;
982
983 if (!adp) {
984 adp = &ad;
985 AVC_AUDIT_DATA_INIT(&ad, FS);
986 ad.u.fs.inode = inode;
987 }
988
989 return avc_has_perm(tsec->sid, isec->sid, isec->sclass,
990 perms, aeref ? aeref : &isec->avcr, adp);
991 }
992
993 /* Same as inode_has_perm, but pass explicit audit data containing
994 the dentry to help the auditing code to more easily generate the
995 pathname if needed. */
996 static inline int dentry_has_perm(struct task_struct *tsk,
997 struct vfsmount *mnt,
998 struct dentry *dentry,
999 u32 av)
1000 {
1001 struct inode *inode = dentry->d_inode;
1002 struct avc_audit_data ad;
1003 AVC_AUDIT_DATA_INIT(&ad,FS);
1004 ad.u.fs.mnt = mnt;
1005 ad.u.fs.dentry = dentry;
1006 return inode_has_perm(tsk, inode, av, NULL, &ad);
1007 }
1008
1009 /* Check whether a task can use an open file descriptor to
1010 access an inode in a given way. Check access to the
1011 descriptor itself, and then use dentry_has_perm to
1012 check a particular permission to the file.
1013 Access to the descriptor is implicitly granted if it
1014 has the same SID as the process. If av is zero, then
1015 access to the file is not checked, e.g. for cases
1016 where only the descriptor is affected like seek. */
1017 static inline int file_has_perm(struct task_struct *tsk,
1018 struct file *file,
1019 u32 av)
1020 {
1021 struct task_security_struct *tsec = tsk->security;
1022 struct file_security_struct *fsec = file->f_security;
1023 struct vfsmount *mnt = file->f_vfsmnt;
1024 struct dentry *dentry = file->f_dentry;
1025 struct inode *inode = dentry->d_inode;
1026 struct avc_audit_data ad;
1027 int rc;
1028
1029 AVC_AUDIT_DATA_INIT(&ad, FS);
1030 ad.u.fs.mnt = mnt;
1031 ad.u.fs.dentry = dentry;
1032
1033 if (tsec->sid != fsec->sid) {
1034 rc = avc_has_perm(tsec->sid, fsec->sid,
1035 SECCLASS_FD,
1036 FD__USE,
1037 &fsec->avcr, &ad);
1038 if (rc)
1039 return rc;
1040 }
1041
1042 /* av is zero if only checking access to the descriptor. */
1043 if (av)
1044 return inode_has_perm(tsk, inode, av, &fsec->inode_avcr, &ad);
1045
1046 return 0;
1047 }
1048
1049 /* Check whether a task can create a file. */
1050 static int may_create(struct inode *dir,
1051 struct dentry *dentry,
1052 u16 tclass)
1053 {
1054 struct task_security_struct *tsec;
1055 struct inode_security_struct *dsec;
1056 struct superblock_security_struct *sbsec;
1057 u32 newsid;
1058 struct avc_audit_data ad;
1059 int rc;
1060
1061 tsec = current->security;
1062 dsec = dir->i_security;
1063 sbsec = dir->i_sb->s_security;
1064
1065 AVC_AUDIT_DATA_INIT(&ad, FS);
1066 ad.u.fs.dentry = dentry;
1067
1068 rc = avc_has_perm(tsec->sid, dsec->sid, SECCLASS_DIR,
1069 DIR__ADD_NAME | DIR__SEARCH,
1070 &dsec->avcr, &ad);
1071 if (rc)
1072 return rc;
1073
1074 if (tsec->create_sid && sbsec->behavior != SECURITY_FS_USE_MNTPOINT) {
1075 newsid = tsec->create_sid;
1076 } else {
1077 rc = security_transition_sid(tsec->sid, dsec->sid, tclass,
1078 &newsid);
1079 if (rc)
1080 return rc;
1081 }
1082
1083 rc = avc_has_perm(tsec->sid, newsid, tclass, FILE__CREATE, NULL, &ad);
1084 if (rc)
1085 return rc;
1086
1087 return avc_has_perm(newsid, sbsec->sid,
1088 SECCLASS_FILESYSTEM,
1089 FILESYSTEM__ASSOCIATE, NULL, &ad);
1090 }
1091
1092 #define MAY_LINK 0
1093 #define MAY_UNLINK 1
1094 #define MAY_RMDIR 2
1095
1096 /* Check whether a task can link, unlink, or rmdir a file/directory. */
1097 static int may_link(struct inode *dir,
1098 struct dentry *dentry,
1099 int kind)
1100
1101 {
1102 struct task_security_struct *tsec;
1103 struct inode_security_struct *dsec, *isec;
1104 struct avc_audit_data ad;
1105 u32 av;
1106 int rc;
1107
1108 tsec = current->security;
1109 dsec = dir->i_security;
1110 isec = dentry->d_inode->i_security;
1111
1112 AVC_AUDIT_DATA_INIT(&ad, FS);
1113 ad.u.fs.dentry = dentry;
1114
1115 av = DIR__SEARCH;
1116 av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
1117 rc = avc_has_perm(tsec->sid, dsec->sid, SECCLASS_DIR,
1118 av, &dsec->avcr, &ad);
1119 if (rc)
1120 return rc;
1121
1122 switch (kind) {
1123 case MAY_LINK:
1124 av = FILE__LINK;
1125 break;
1126 case MAY_UNLINK:
1127 av = FILE__UNLINK;
1128 break;
1129 case MAY_RMDIR:
1130 av = DIR__RMDIR;
1131 break;
1132 default:
1133 printk(KERN_WARNING "may_link: unrecognized kind %d\n", kind);
1134 return 0;
1135 }
1136
1137 rc = avc_has_perm(tsec->sid, isec->sid, isec->sclass,
1138 av, &isec->avcr, &ad);
1139 return rc;
1140 }
1141
1142 static inline int may_rename(struct inode *old_dir,
1143 struct dentry *old_dentry,
1144 struct inode *new_dir,
1145 struct dentry *new_dentry)
1146 {
1147 struct task_security_struct *tsec;
1148 struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
1149 struct avc_audit_data ad;
1150 u32 av;
1151 int old_is_dir, new_is_dir;
1152 int rc;
1153
1154 tsec = current->security;
1155 old_dsec = old_dir->i_security;
1156 old_isec = old_dentry->d_inode->i_security;
1157 old_is_dir = S_ISDIR(old_dentry->d_inode->i_mode);
1158 new_dsec = new_dir->i_security;
1159
1160 AVC_AUDIT_DATA_INIT(&ad, FS);
1161
1162 ad.u.fs.dentry = old_dentry;
1163 rc = avc_has_perm(tsec->sid, old_dsec->sid, SECCLASS_DIR,
1164 DIR__REMOVE_NAME | DIR__SEARCH,
1165 &old_dsec->avcr, &ad);
1166 if (rc)
1167 return rc;
1168 rc = avc_has_perm(tsec->sid, old_isec->sid,
1169 old_isec->sclass,
1170 FILE__RENAME,
1171 &old_isec->avcr, &ad);
1172 if (rc)
1173 return rc;
1174 if (old_is_dir && new_dir != old_dir) {
1175 rc = avc_has_perm(tsec->sid, old_isec->sid,
1176 old_isec->sclass,
1177 DIR__REPARENT,
1178 &old_isec->avcr, &ad);
1179 if (rc)
1180 return rc;
1181 }
1182
1183 ad.u.fs.dentry = new_dentry;
1184 av = DIR__ADD_NAME | DIR__SEARCH;
1185 if (new_dentry->d_inode)
1186 av |= DIR__REMOVE_NAME;
1187 rc = avc_has_perm(tsec->sid, new_dsec->sid, SECCLASS_DIR,
1188 av,&new_dsec->avcr, &ad);
1189 if (rc)
1190 return rc;
1191 if (new_dentry->d_inode) {
1192 new_isec = new_dentry->d_inode->i_security;
1193 new_is_dir = S_ISDIR(new_dentry->d_inode->i_mode);
1194 rc = avc_has_perm(tsec->sid, new_isec->sid,
1195 new_isec->sclass,
1196 (new_is_dir ? DIR__RMDIR : FILE__UNLINK),
1197 &new_isec->avcr, &ad);
1198 if (rc)
1199 return rc;
1200 }
1201
1202 return 0;
1203 }
1204
1205 /* Check whether a task can perform a filesystem operation. */
1206 int superblock_has_perm(struct task_struct *tsk,
1207 struct super_block *sb,
1208 u32 perms,
1209 struct avc_audit_data *ad)
1210 {
1211 struct task_security_struct *tsec;
1212 struct superblock_security_struct *sbsec;
1213
1214 tsec = tsk->security;
1215 sbsec = sb->s_security;
1216 return avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
1217 perms, NULL, ad);
1218 }
1219
1220 /* Convert a Linux mode and permission mask to an access vector. */
1221 static inline u32 file_mask_to_av(int mode, int mask)
1222 {
1223 u32 av = 0;
1224
1225 if ((mode & S_IFMT) != S_IFDIR) {
1226 if (mask & MAY_EXEC)
1227 av |= FILE__EXECUTE;
1228 if (mask & MAY_READ)
1229 av |= FILE__READ;
1230
1231 if (mask & MAY_APPEND)
1232 av |= FILE__APPEND;
1233 else if (mask & MAY_WRITE)
1234 av |= FILE__WRITE;
1235
1236 } else {
1237 if (mask & MAY_EXEC)
1238 av |= DIR__SEARCH;
1239 if (mask & MAY_WRITE)
1240 av |= DIR__WRITE;
1241 if (mask & MAY_READ)
1242 av |= DIR__READ;
1243 }
1244
1245 return av;
1246 }
1247
1248 /* Convert a Linux file to an access vector. */
1249 static inline u32 file_to_av(struct file *file)
1250 {
1251 u32 av = 0;
1252
1253 if (file->f_mode & FMODE_READ)
1254 av |= FILE__READ;
1255 if (file->f_mode & FMODE_WRITE) {
1256 if (file->f_flags & O_APPEND)
1257 av |= FILE__APPEND;
1258 else
1259 av |= FILE__WRITE;
1260 }
1261
1262 return av;
1263 }
1264
1265 /* Set an inode's SID to a specified value. */
1266 int inode_security_set_sid(struct inode *inode, u32 sid)
1267 {
1268 struct inode_security_struct *isec = inode->i_security;
1269 struct superblock_security_struct *sbsec = inode->i_sb->s_security;
1270
1271 if (!sbsec->initialized) {
1272 /* Defer initialization to selinux_complete_init. */
1273 return 0;
1274 }
1275
1276 down(&isec->sem);
1277 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1278 isec->sid = sid;
1279 isec->initialized = 1;
1280 up(&isec->sem);
1281 return 0;
1282 }
1283
1284 /* Set the security attributes on a newly created file. */
1285 static int post_create(struct inode *dir,
1286 struct dentry *dentry)
1287 {
1288
1289 struct task_security_struct *tsec;
1290 struct inode *inode;
1291 struct inode_security_struct *dsec;
1292 struct superblock_security_struct *sbsec;
1293 u32 newsid;
1294 char *context;
1295 unsigned int len;
1296 int rc;
1297
1298 tsec = current->security;
1299 dsec = dir->i_security;
1300 sbsec = dir->i_sb->s_security;
1301
1302 inode = dentry->d_inode;
1303 if (!inode) {
1304 /* Some file system types (e.g. NFS) may not instantiate
1305 a dentry for all create operations (e.g. symlink),
1306 so we have to check to see if the inode is non-NULL. */
1307 printk(KERN_WARNING "post_create: no inode, dir (dev=%s, "
1308 "ino=%ld)\n", dir->i_sb->s_id, dir->i_ino);
1309 return 0;
1310 }
1311
1312 if (tsec->create_sid && sbsec->behavior != SECURITY_FS_USE_MNTPOINT) {
1313 newsid = tsec->create_sid;
1314 } else {
1315 rc = security_transition_sid(tsec->sid, dsec->sid,
1316 inode_mode_to_security_class(inode->i_mode),
1317 &newsid);
1318 if (rc) {
1319 printk(KERN_WARNING "post_create: "
1320 "security_transition_sid failed, rc=%d (dev=%s "
1321 "ino=%ld)\n",
1322 -rc, inode->i_sb->s_id, inode->i_ino);
1323 return rc;
1324 }
1325 }
1326
1327 rc = inode_security_set_sid(inode, newsid);
1328 if (rc) {
1329 printk(KERN_WARNING "post_create: inode_security_set_sid "
1330 "failed, rc=%d (dev=%s ino=%ld)\n",
1331 -rc, inode->i_sb->s_id, inode->i_ino);
1332 return rc;
1333 }
1334
1335 if (sbsec->behavior == SECURITY_FS_USE_XATTR &&
1336 inode->i_op->setxattr) {
1337 /* Use extended attributes. */
1338 rc = security_sid_to_context(newsid, &context, &len);
1339 if (rc) {
1340 printk(KERN_WARNING "post_create: sid_to_context "
1341 "failed, rc=%d (dev=%s ino=%ld)\n",
1342 -rc, inode->i_sb->s_id, inode->i_ino);
1343 return rc;
1344 }
1345 down(&inode->i_sem);
1346 rc = inode->i_op->setxattr(dentry,
1347 XATTR_NAME_SELINUX,
1348 context, len, 0);
1349 up(&inode->i_sem);
1350 kfree(context);
1351 if (rc < 0) {
1352 printk(KERN_WARNING "post_create: setxattr failed, "
1353 "rc=%d (dev=%s ino=%ld)\n",
1354 -rc, inode->i_sb->s_id, inode->i_ino);
1355 return rc;
1356 }
1357 }
1358
1359 return 0;
1360 }
1361
1362
1363 /* Hook functions begin here. */
1364
1365 static int selinux_ptrace(struct task_struct *parent, struct task_struct *child)
1366 {
1367 struct task_security_struct *psec = parent->security;
1368 struct task_security_struct *csec = child->security;
1369 int rc;
1370
1371 rc = secondary_ops->ptrace(parent,child);
1372 if (rc)
1373 return rc;
1374
1375 rc = task_has_perm(parent, child, PROCESS__PTRACE);
1376 /* Save the SID of the tracing process for later use in apply_creds. */
1377 if (!rc)
1378 csec->ptrace_sid = psec->sid;
1379 return rc;
1380 }
1381
1382 static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
1383 kernel_cap_t *inheritable, kernel_cap_t *permitted)
1384 {
1385 int error;
1386
1387 error = task_has_perm(current, target, PROCESS__GETCAP);
1388 if (error)
1389 return error;
1390
1391 return secondary_ops->capget(target, effective, inheritable, permitted);
1392 }
1393
1394 static int selinux_capset_check(struct task_struct *target, kernel_cap_t *effective,
1395 kernel_cap_t *inheritable, kernel_cap_t *permitted)
1396 {
1397 int error;
1398
1399 error = secondary_ops->capset_check(target, effective, inheritable, permitted);
1400 if (error)
1401 return error;
1402
1403 return task_has_perm(current, target, PROCESS__SETCAP);
1404 }
1405
1406 static void selinux_capset_set(struct task_struct *target, kernel_cap_t *effective,
1407 kernel_cap_t *inheritable, kernel_cap_t *permitted)
1408 {
1409 int error;
1410
1411 error = task_has_perm(current, target, PROCESS__SETCAP);
1412 if (error)
1413 return;
1414
1415 secondary_ops->capset_set(target, effective, inheritable, permitted);
1416 }
1417
1418 static int selinux_capable(struct task_struct *tsk, int cap)
1419 {
1420 int rc;
1421
1422 rc = secondary_ops->capable(tsk, cap);
1423 if (rc)
1424 return rc;
1425
1426 return task_has_capability(tsk,cap);
1427 }
1428
1429 static int selinux_sysctl(ctl_table *table, int op)
1430 {
1431 int error = 0;
1432 u32 av;
1433 struct task_security_struct *tsec;
1434 u32 tsid;
1435 int rc;
1436
1437 rc = secondary_ops->sysctl(table, op);
1438 if (rc)
1439 return rc;
1440
1441 tsec = current->security;
1442
1443 rc = selinux_proc_get_sid(table->de, (op == 001) ?
1444 SECCLASS_DIR : SECCLASS_FILE, &tsid);
1445 if (rc) {
1446 /* Default to the well-defined sysctl SID. */
1447 tsid = SECINITSID_SYSCTL;
1448 }
1449
1450 /* The op values are "defined" in sysctl.c, thereby creating
1451 * a bad coupling between this module and sysctl.c */
1452 if(op == 001) {
1453 error = avc_has_perm(tsec->sid, tsid,
1454 SECCLASS_DIR, DIR__SEARCH, NULL, NULL);
1455 } else {
1456 av = 0;
1457 if (op & 004)
1458 av |= FILE__READ;
1459 if (op & 002)
1460 av |= FILE__WRITE;
1461 if (av)
1462 error = avc_has_perm(tsec->sid, tsid,
1463 SECCLASS_FILE, av, NULL, NULL);
1464 }
1465
1466 return error;
1467 }
1468
1469 static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
1470 {
1471 int rc = 0;
1472
1473 if (!sb)
1474 return 0;
1475
1476 switch (cmds) {
1477 case Q_SYNC:
1478 case Q_QUOTAON:
1479 case Q_QUOTAOFF:
1480 case Q_SETINFO:
1481 case Q_SETQUOTA:
1482 rc = superblock_has_perm(current,
1483 sb,
1484 FILESYSTEM__QUOTAMOD, NULL);
1485 break;
1486 case Q_GETFMT:
1487 case Q_GETINFO:
1488 case Q_GETQUOTA:
1489 rc = superblock_has_perm(current,
1490 sb,
1491 FILESYSTEM__QUOTAGET, NULL);
1492 break;
1493 default:
1494 rc = 0; /* let the kernel handle invalid cmds */
1495 break;
1496 }
1497 return rc;
1498 }
1499
1500 static int selinux_quota_on(struct file *f)
1501 {
1502 return file_has_perm(current, f, FILE__QUOTAON);
1503 }
1504
1505 static int selinux_syslog(int type)
1506 {
1507 int rc;
1508
1509 rc = secondary_ops->syslog(type);
1510 if (rc)
1511 return rc;
1512
1513 switch (type) {
1514 case 3: /* Read last kernel messages */
1515 case 10: /* Return size of the log buffer */
1516 rc = task_has_system(current, SYSTEM__SYSLOG_READ);
1517 break;
1518 case 6: /* Disable logging to console */
1519 case 7: /* Enable logging to console */
1520 case 8: /* Set level of messages printed to console */
1521 rc = task_has_system(current, SYSTEM__SYSLOG_CONSOLE);
1522 break;
1523 case 0: /* Close log */
1524 case 1: /* Open log */
1525 case 2: /* Read from log */
1526 case 4: /* Read/clear last kernel messages */
1527 case 5: /* Clear ring buffer */
1528 default:
1529 rc = task_has_system(current, SYSTEM__SYSLOG_MOD);
1530 break;
1531 }
1532 return rc;
1533 }
1534
1535 /*
1536 * Check that a process has enough memory to allocate a new virtual
1537 * mapping. 0 means there is enough memory for the allocation to
1538 * succeed and -ENOMEM implies there is not.
1539 *
1540 * We currently support three overcommit policies, which are set via the
1541 * vm.overcommit_memory sysctl. See Documentation/vm/overcommit-accounting
1542 *
1543 * Strict overcommit modes added 2002 Feb 26 by Alan Cox.
1544 * Additional code 2002 Jul 20 by Robert Love.
1545 */
1546 static int selinux_vm_enough_memory(long pages)
1547 {
1548 unsigned long free, allowed;
1549 int rc;
1550 struct task_security_struct *tsec = current->security;
1551
1552 vm_acct_memory(pages);
1553
1554 /*
1555 * Sometimes we want to use more memory than we have
1556 */
1557 if (sysctl_overcommit_memory == OVERCOMMIT_ALWAYS)
1558 return 0;
1559
1560 if (sysctl_overcommit_memory == OVERCOMMIT_GUESS) {
1561 free = get_page_cache_size();
1562 free += nr_free_pages();
1563 free += nr_swap_pages;
1564
1565 /*
1566 * Any slabs which are created with the
1567 * SLAB_RECLAIM_ACCOUNT flag claim to have contents
1568 * which are reclaimable, under pressure. The dentry
1569 * cache and most inode caches should fall into this
1570 */
1571 free += atomic_read(&slab_reclaim_pages);
1572
1573 /*
1574 * Leave the last 3% for privileged processes.
1575 * Don't audit the check, as it is applied to all processes
1576 * that allocate mappings.
1577 */
1578 rc = secondary_ops->capable(current, CAP_SYS_ADMIN);
1579 if (!rc) {
1580 rc = avc_has_perm_noaudit(tsec->sid, tsec->sid,
1581 SECCLASS_CAPABILITY,
1582 CAP_TO_MASK(CAP_SYS_ADMIN),
1583 NULL, NULL);
1584 }
1585 if (rc)
1586 free -= free / 32;
1587
1588 if (free > pages)
1589 return 0;
1590 vm_unacct_memory(pages);
1591 return -ENOMEM;
1592 }
1593
1594 allowed = (totalram_pages - hugetlb_total_pages())
1595 * sysctl_overcommit_ratio / 100;
1596 allowed += total_swap_pages;
1597
1598 if (atomic_read(&vm_committed_space) < allowed)
1599 return 0;
1600
1601 vm_unacct_memory(pages);
1602
1603 return -ENOMEM;
1604 }
1605
1606 /* binprm security operations */
1607
1608 static int selinux_bprm_alloc_security(struct linux_binprm *bprm)
1609 {
1610 struct bprm_security_struct *bsec;
1611
1612 bsec = kmalloc(sizeof(struct bprm_security_struct), GFP_KERNEL);
1613 if (!bsec)
1614 return -ENOMEM;
1615
1616 memset(bsec, 0, sizeof *bsec);
1617 bsec->magic = SELINUX_MAGIC;
1618 bsec->bprm = bprm;
1619 bsec->sid = SECINITSID_UNLABELED;
1620 bsec->set = 0;
1621
1622 bprm->security = bsec;
1623 return 0;
1624 }
1625
1626 static int selinux_bprm_set_security(struct linux_binprm *bprm)
1627 {
1628 struct task_security_struct *tsec;
1629 struct inode *inode = bprm->file->f_dentry->d_inode;
1630 struct inode_security_struct *isec;
1631 struct bprm_security_struct *bsec;
1632 u32 newsid;
1633 struct avc_audit_data ad;
1634 int rc;
1635
1636 rc = secondary_ops->bprm_set_security(bprm);
1637 if (rc)
1638 return rc;
1639
1640 bsec = bprm->security;
1641
1642 if (bsec->set)
1643 return 0;
1644
1645 tsec = current->security;
1646 isec = inode->i_security;
1647
1648 /* Default to the current task SID. */
1649 bsec->sid = tsec->sid;
1650
1651 /* Reset create SID on execve. */
1652 tsec->create_sid = 0;
1653
1654 if (tsec->exec_sid) {
1655 newsid = tsec->exec_sid;
1656 /* Reset exec SID on execve. */
1657 tsec->exec_sid = 0;
1658 } else {
1659 /* Check for a default transition on this program. */
1660 rc = security_transition_sid(tsec->sid, isec->sid,
1661 SECCLASS_PROCESS, &newsid);
1662 if (rc)
1663 return rc;
1664 }
1665
1666 AVC_AUDIT_DATA_INIT(&ad, FS);
1667 ad.u.fs.mnt = bprm->file->f_vfsmnt;
1668 ad.u.fs.dentry = bprm->file->f_dentry;
1669
1670 if (bprm->file->f_vfsmnt->mnt_flags & MNT_NOSUID)
1671 newsid = tsec->sid;
1672
1673 if (tsec->sid == newsid) {
1674 rc = avc_has_perm(tsec->sid, isec->sid,
1675 SECCLASS_FILE, FILE__EXECUTE_NO_TRANS,
1676 &isec->avcr, &ad);
1677 if (rc)
1678 return rc;
1679 } else {
1680 /* Check permissions for the transition. */
1681 rc = avc_has_perm(tsec->sid, newsid,
1682 SECCLASS_PROCESS, PROCESS__TRANSITION,
1683 NULL,
1684 &ad);
1685 if (rc)
1686 return rc;
1687
1688 rc = avc_has_perm(newsid, isec->sid,
1689 SECCLASS_FILE, FILE__ENTRYPOINT,
1690 &isec->avcr, &ad);
1691 if (rc)
1692 return rc;
1693
1694 /* Clear any possibly unsafe personality bits on exec: */
1695 current->personality &= ~PER_CLEAR_ON_SETID;
1696
1697 /* Set the security field to the new SID. */
1698 bsec->sid = newsid;
1699 }
1700
1701 bsec->set = 1;
1702 return 0;
1703 }
1704
1705 static int selinux_bprm_check_security (struct linux_binprm *bprm)
1706 {
1707 return secondary_ops->bprm_check_security(bprm);
1708 }
1709
1710
1711 static int selinux_bprm_secureexec (struct linux_binprm *bprm)
1712 {
1713 struct task_security_struct *tsec = current->security;
1714 int atsecure = 0;
1715
1716 if (tsec->osid != tsec->sid) {
1717 /* Enable secure mode for SIDs transitions unless
1718 the noatsecure permission is granted between
1719 the two SIDs, i.e. ahp returns 0. */
1720 atsecure = avc_has_perm(tsec->osid, tsec->sid,
1721 SECCLASS_PROCESS,
1722 PROCESS__NOATSECURE, NULL, NULL);
1723 }
1724
1725 return (atsecure || secondary_ops->bprm_secureexec(bprm));
1726 }
1727
1728 static void selinux_bprm_free_security(struct linux_binprm *bprm)
1729 {
1730 struct bprm_security_struct *bsec = bprm->security;
1731 bprm->security = NULL;
1732 kfree(bsec);
1733 }
1734
1735 extern struct vfsmount *selinuxfs_mount;
1736 extern struct dentry *selinux_null;
1737
1738 /* Derived from fs/exec.c:flush_old_files. */
1739 static inline void flush_unauthorized_files(struct files_struct * files)
1740 {
1741 struct avc_audit_data ad;
1742 struct file *file, *devnull = NULL;
1743 struct tty_struct *tty = current->signal->tty;
1744 long j = -1;
1745
1746 if (tty) {
1747 file_list_lock();
1748 file = list_entry(tty->tty_files.next, typeof(*file), f_list);
1749 if (file) {
1750 /* Revalidate access to controlling tty.
1751 Use inode_has_perm on the tty inode directly rather
1752 than using file_has_perm, as this particular open
1753 file may belong to another process and we are only
1754 interested in the inode-based check here. */
1755 struct inode *inode = file->f_dentry->d_inode;
1756 if (inode_has_perm(current, inode,
1757 FILE__READ | FILE__WRITE,
1758 NULL, NULL)) {
1759 /* Reset controlling tty. */
1760 current->signal->tty = NULL;
1761 current->signal->tty_old_pgrp = 0;
1762 }
1763 }
1764 file_list_unlock();
1765 }
1766
1767 /* Revalidate access to inherited open files. */
1768
1769 AVC_AUDIT_DATA_INIT(&ad,FS);
1770
1771 spin_lock(&files->file_lock);
1772 for (;;) {
1773 unsigned long set, i;
1774 int fd;
1775
1776 j++;
1777 i = j * __NFDBITS;
1778 if (i >= files->max_fds || i >= files->max_fdset)
1779 break;
1780 set = files->open_fds->fds_bits[j];
1781 if (!set)
1782 continue;
1783 spin_unlock(&files->file_lock);
1784 for ( ; set ; i++,set >>= 1) {
1785 if (set & 1) {
1786 file = fget(i);
1787 if (!file)
1788 continue;
1789 if (file_has_perm(current,
1790 file,
1791 file_to_av(file))) {
1792 sys_close(i);
1793 fd = get_unused_fd();
1794 if (fd != i) {
1795 if (fd >= 0)
1796 put_unused_fd(fd);
1797 fput(file);
1798 continue;
1799 }
1800 if (devnull) {
1801 atomic_inc(&devnull->f_count);
1802 } else {
1803 devnull = dentry_open(dget(selinux_null), mntget(selinuxfs_mount), O_RDWR);
1804 if (!devnull) {
1805 put_unused_fd(fd);
1806 fput(file);
1807 continue;
1808 }
1809 }
1810 fd_install(fd, devnull);
1811 }
1812 fput(file);
1813 }
1814 }
1815 spin_lock(&files->file_lock);
1816
1817 }
1818 spin_unlock(&files->file_lock);
1819 }
1820
1821 static void selinux_bprm_apply_creds(struct linux_binprm *bprm, int unsafe)
1822 {
1823 struct task_security_struct *tsec;
1824 struct bprm_security_struct *bsec;
1825 u32 sid;
1826 struct av_decision avd;
1827 struct itimerval itimer;
1828 struct rlimit *rlim, *initrlim;
1829 int rc, i;
1830
1831 secondary_ops->bprm_apply_creds(bprm, unsafe);
1832
1833 tsec = current->security;
1834
1835 bsec = bprm->security;
1836 sid = bsec->sid;
1837
1838 tsec->osid = tsec->sid;
1839 if (tsec->sid != sid) {
1840 /* Check for shared state. If not ok, leave SID
1841 unchanged and kill. */
1842 if (unsafe & LSM_UNSAFE_SHARE) {
1843 rc = avc_has_perm_noaudit(tsec->sid, sid,
1844 SECCLASS_PROCESS, PROCESS__SHARE,
1845 NULL, &avd);
1846 if (rc) {
1847 task_unlock(current);
1848 avc_audit(tsec->sid, sid, SECCLASS_PROCESS,
1849 PROCESS__SHARE, &avd, rc, NULL);
1850 force_sig_specific(SIGKILL, current);
1851 goto lock_out;
1852 }
1853 }
1854
1855 /* Check for ptracing, and update the task SID if ok.
1856 Otherwise, leave SID unchanged and kill. */
1857 if (unsafe & (LSM_UNSAFE_PTRACE | LSM_UNSAFE_PTRACE_CAP)) {
1858 rc = avc_has_perm_noaudit(tsec->ptrace_sid, sid,
1859 SECCLASS_PROCESS, PROCESS__PTRACE,
1860 NULL, &avd);
1861 if (!rc)
1862 tsec->sid = sid;
1863 task_unlock(current);
1864 avc_audit(tsec->ptrace_sid, sid, SECCLASS_PROCESS,
1865 PROCESS__PTRACE, &avd, rc, NULL);
1866 if (rc) {
1867 force_sig_specific(SIGKILL, current);
1868 goto lock_out;
1869 }
1870 } else {
1871 tsec->sid = sid;
1872 task_unlock(current);
1873 }
1874
1875 /* Close files for which the new task SID is not authorized. */
1876 flush_unauthorized_files(current->files);
1877
1878 /* Check whether the new SID can inherit signal state
1879 from the old SID. If not, clear itimers to avoid
1880 subsequent signal generation and flush and unblock
1881 signals. This must occur _after_ the task SID has
1882 been updated so that any kill done after the flush
1883 will be checked against the new SID. */
1884 rc = avc_has_perm(tsec->osid, tsec->sid, SECCLASS_PROCESS,
1885 PROCESS__SIGINH, NULL, NULL);
1886 if (rc) {
1887 memset(&itimer, 0, sizeof itimer);
1888 for (i = 0; i < 3; i++)
1889 do_setitimer(i, &itimer, NULL);
1890 flush_signals(current);
1891 spin_lock_irq(&current->sighand->siglock);
1892 flush_signal_handlers(current, 1);
1893 sigemptyset(&current->blocked);
1894 recalc_sigpending();
1895 spin_unlock_irq(&current->sighand->siglock);
1896 }
1897
1898 /* Check whether the new SID can inherit resource limits
1899 from the old SID. If not, reset all soft limits to
1900 the lower of the current task's hard limit and the init
1901 task's soft limit. Note that the setting of hard limits
1902 (even to lower them) can be controlled by the setrlimit
1903 check. The inclusion of the init task's soft limit into
1904 the computation is to avoid resetting soft limits higher
1905 than the default soft limit for cases where the default
1906 is lower than the hard limit, e.g. RLIMIT_CORE or
1907 RLIMIT_STACK.*/
1908 rc = avc_has_perm(tsec->osid, tsec->sid, SECCLASS_PROCESS,
1909 PROCESS__RLIMITINH, NULL, NULL);
1910 if (rc) {
1911 for (i = 0; i < RLIM_NLIMITS; i++) {
1912 rlim = current->rlim + i;
1913 initrlim = init_task.rlim+i;
1914 rlim->rlim_cur = min(rlim->rlim_max,initrlim->rlim_cur);
1915 }
1916 }
1917
1918 /* Wake up the parent if it is waiting so that it can
1919 recheck wait permission to the new task SID. */
1920 wake_up_interruptible(&current->parent->wait_chldexit);
1921
1922 lock_out:
1923 task_lock(current);
1924 return;
1925 }
1926 }
1927
1928 /* superblock security operations */
1929
1930 static int selinux_sb_alloc_security(struct super_block *sb)
1931 {
1932 return superblock_alloc_security(sb);
1933 }
1934
1935 static void selinux_sb_free_security(struct super_block *sb)
1936 {
1937 superblock_free_security(sb);
1938 }
1939
1940 static inline int match_prefix(char *prefix, int plen, char *option, int olen)
1941 {
1942 if (plen > olen)
1943 return 0;
1944
1945 return !memcmp(prefix, option, plen);
1946 }
1947
1948 static inline int selinux_option(char *option, int len)
1949 {
1950 return (match_prefix("context=", sizeof("context=")-1, option, len) ||
1951 match_prefix("fscontext=", sizeof("fscontext=")-1, option, len) ||
1952 match_prefix("defcontext=", sizeof("defcontext=")-1, option, len));
1953 }
1954
1955 static inline void take_option(char **to, char *from, int *first, int len)
1956 {
1957 if (!*first) {
1958 **to = ',';
1959 *to += 1;
1960 }
1961 else
1962 *first = 0;
1963 memcpy(*to, from, len);
1964 *to += len;
1965 }
1966
1967 static int selinux_sb_copy_data(struct file_system_type *type, void *orig, void *copy)
1968 {
1969 int fnosec, fsec, rc = 0;
1970 char *in_save, *in_curr, *in_end;
1971 char *sec_curr, *nosec_save, *nosec;
1972
1973 in_curr = orig;
1974 sec_curr = copy;
1975
1976 /* Binary mount data: just copy */
1977 if (type->fs_flags & FS_BINARY_MOUNTDATA) {
1978 copy_page(sec_curr, in_curr);
1979 goto out;
1980 }
1981
1982 nosec = (char *)get_zeroed_page(GFP_KERNEL);
1983 if (!nosec) {
1984 rc = -ENOMEM;
1985 goto out;
1986 }
1987
1988 nosec_save = nosec;
1989 fnosec = fsec = 1;
1990 in_save = in_end = orig;
1991
1992 do {
1993 if (*in_end == ',' || *in_end == '\0') {
1994 int len = in_end - in_curr;
1995
1996 if (selinux_option(in_curr, len))
1997 take_option(&sec_curr, in_curr, &fsec, len);
1998 else
1999 take_option(&nosec, in_curr, &fnosec, len);
2000
2001 in_curr = in_end + 1;
2002 }
2003 } while (*in_end++);
2004
2005 copy_page(in_save, nosec_save);
2006 out:
2007 return rc;
2008 }
2009
2010 static int selinux_sb_kern_mount(struct super_block *sb, void *data)
2011 {
2012 struct avc_audit_data ad;
2013 int rc;
2014
2015 rc = superblock_doinit(sb, data);
2016 if (rc)
2017 return rc;
2018
2019 AVC_AUDIT_DATA_INIT(&ad,FS);
2020 ad.u.fs.dentry = sb->s_root;
2021 return superblock_has_perm(current, sb, FILESYSTEM__MOUNT, &ad);
2022 }
2023
2024 static int selinux_sb_statfs(struct super_block *sb)
2025 {
2026 struct avc_audit_data ad;
2027
2028 AVC_AUDIT_DATA_INIT(&ad,FS);
2029 ad.u.fs.dentry = sb->s_root;
2030 return superblock_has_perm(current, sb, FILESYSTEM__GETATTR, &ad);
2031 }
2032
2033 static int selinux_mount(char * dev_name,
2034 struct nameidata *nd,
2035 char * type,
2036 unsigned long flags,
2037 void * data)
2038 {
2039 int rc;
2040
2041 rc = secondary_ops->sb_mount(dev_name, nd, type, flags, data);
2042 if (rc)
2043 return rc;
2044
2045 if (flags & MS_REMOUNT)
2046 return superblock_has_perm(current, nd->mnt->mnt_sb,
2047 FILESYSTEM__REMOUNT, NULL);
2048 else
2049 return dentry_has_perm(current, nd->mnt, nd->dentry,
2050 FILE__MOUNTON);
2051 }
2052
2053 static int selinux_umount(struct vfsmount *mnt, int flags)
2054 {
2055 int rc;
2056
2057 rc = secondary_ops->sb_umount(mnt, flags);
2058 if (rc)
2059 return rc;
2060
2061 return superblock_has_perm(current,mnt->mnt_sb,
2062 FILESYSTEM__UNMOUNT,NULL);
2063 }
2064
2065 /* inode security operations */
2066
2067 static int selinux_inode_alloc_security(struct inode *inode)
2068 {
2069 return inode_alloc_security(inode);
2070 }
2071
2072 static void selinux_inode_free_security(struct inode *inode)
2073 {
2074 inode_free_security(inode);
2075 }
2076
2077 static int selinux_inode_create(struct inode *dir, struct dentry *dentry, int mask)
2078 {
2079 return may_create(dir, dentry, SECCLASS_FILE);
2080 }
2081
2082 static void selinux_inode_post_create(struct inode *dir, struct dentry *dentry, int mask)
2083 {
2084 post_create(dir, dentry);
2085 }
2086
2087 static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
2088 {
2089 int rc;
2090
2091 rc = secondary_ops->inode_link(old_dentry,dir,new_dentry);
2092 if (rc)
2093 return rc;
2094 return may_link(dir, old_dentry, MAY_LINK);
2095 }
2096
2097 static void selinux_inode_post_link(struct dentry *old_dentry, struct inode *inode, struct dentry *new_dentry)
2098 {
2099 return;
2100 }
2101
2102 static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
2103 {
2104 int rc;
2105
2106 rc = secondary_ops->inode_unlink(dir, dentry);
2107 if (rc)
2108 return rc;
2109 return may_link(dir, dentry, MAY_UNLINK);
2110 }
2111
2112 static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
2113 {
2114 return may_create(dir, dentry, SECCLASS_LNK_FILE);
2115 }
2116
2117 static void selinux_inode_post_symlink(struct inode *dir, struct dentry *dentry, const char *name)
2118 {
2119 post_create(dir, dentry);
2120 }
2121
2122 static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, int mask)
2123 {
2124 return may_create(dir, dentry, SECCLASS_DIR);
2125 }
2126
2127 static void selinux_inode_post_mkdir(struct inode *dir, struct dentry *dentry, int mask)
2128 {
2129 post_create(dir, dentry);
2130 }
2131
2132 static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
2133 {
2134 return may_link(dir, dentry, MAY_RMDIR);
2135 }
2136
2137 static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, int mode, dev_t dev)
2138 {
2139 int rc;
2140
2141 rc = secondary_ops->inode_mknod(dir, dentry, mode, dev);
2142 if (rc)
2143 return rc;
2144
2145 return may_create(dir, dentry, inode_mode_to_security_class(mode));
2146 }
2147
2148 static void selinux_inode_post_mknod(struct inode *dir, struct dentry *dentry, int mode, dev_t dev)
2149 {
2150 post_create(dir, dentry);
2151 }
2152
2153 static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
2154 struct inode *new_inode, struct dentry *new_dentry)
2155 {
2156 return may_rename(old_inode, old_dentry, new_inode, new_dentry);
2157 }
2158
2159 static void selinux_inode_post_rename(struct inode *old_inode, struct dentry *old_dentry,
2160 struct inode *new_inode, struct dentry *new_dentry)
2161 {
2162 return;
2163 }
2164
2165 static int selinux_inode_readlink(struct dentry *dentry)
2166 {
2167 return dentry_has_perm(current, NULL, dentry, FILE__READ);
2168 }
2169
2170 static int selinux_inode_follow_link(struct dentry *dentry, struct nameidata *nameidata)
2171 {
2172 int rc;
2173
2174 rc = secondary_ops->inode_follow_link(dentry,nameidata);
2175 if (rc)
2176 return rc;
2177 return dentry_has_perm(current, NULL, dentry, FILE__READ);
2178 }
2179
2180 static int selinux_inode_permission(struct inode *inode, int mask,
2181 struct nameidata *nd)
2182 {
2183 int rc;
2184
2185 rc = secondary_ops->inode_permission(inode, mask, nd);
2186 if (rc)
2187 return rc;
2188
2189 if (!mask) {
2190 /* No permission to check. Existence test. */
2191 return 0;
2192 }
2193
2194 return inode_has_perm(current, inode,
2195 file_mask_to_av(inode->i_mode, mask), NULL, NULL);
2196 }
2197
2198 static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
2199 {
2200 int rc;
2201
2202 rc = secondary_ops->inode_setattr(dentry, iattr);
2203 if (rc)
2204 return rc;
2205
2206 if (iattr->ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
2207 ATTR_ATIME_SET | ATTR_MTIME_SET))
2208 return dentry_has_perm(current, NULL, dentry, FILE__SETATTR);
2209
2210 return dentry_has_perm(current, NULL, dentry, FILE__WRITE);
2211 }
2212
2213 static int selinux_inode_getattr(struct vfsmount *mnt, struct dentry *dentry)
2214 {
2215 return dentry_has_perm(current, mnt, dentry, FILE__GETATTR);
2216 }
2217
2218 static int selinux_inode_setxattr(struct dentry *dentry, char *name, void *value, size_t size, int flags)
2219 {
2220 struct task_security_struct *tsec = current->security;
2221 struct inode *inode = dentry->d_inode;
2222 struct inode_security_struct *isec = inode->i_security;
2223 struct superblock_security_struct *sbsec;
2224 struct avc_audit_data ad;
2225 u32 newsid;
2226 int rc = 0;
2227
2228 if (strcmp(name, XATTR_NAME_SELINUX)) {
2229 if (!strncmp(name, XATTR_SECURITY_PREFIX,
2230 sizeof XATTR_SECURITY_PREFIX - 1) &&
2231 !capable(CAP_SYS_ADMIN)) {
2232 /* A different attribute in the security namespace.
2233 Restrict to administrator. */
2234 return -EPERM;
2235 }
2236
2237 /* Not an attribute we recognize, so just check the
2238 ordinary setattr permission. */
2239 return dentry_has_perm(current, NULL, dentry, FILE__SETATTR);
2240 }
2241
2242 sbsec = inode->i_sb->s_security;
2243 if (sbsec->behavior == SECURITY_FS_USE_MNTPOINT)
2244 return -EOPNOTSUPP;
2245
2246 AVC_AUDIT_DATA_INIT(&ad,FS);
2247 ad.u.fs.dentry = dentry;
2248
2249 rc = avc_has_perm(tsec->sid, isec->sid, isec->sclass,
2250 FILE__RELABELFROM,
2251 &isec->avcr, &ad);
2252 if (rc)
2253 return rc;
2254
2255 rc = security_context_to_sid(value, size, &newsid);
2256 if (rc)
2257 return rc;
2258
2259 rc = avc_has_perm(tsec->sid, newsid, isec->sclass,
2260 FILE__RELABELTO, NULL, &ad);
2261 if (rc)
2262 return rc;
2263
2264 return avc_has_perm(newsid,
2265 sbsec->sid,
2266 SECCLASS_FILESYSTEM,
2267 FILESYSTEM__ASSOCIATE,
2268 NULL,
2269 &ad);
2270 }
2271
2272 static void selinux_inode_post_setxattr(struct dentry *dentry, char *name,
2273 void *value, size_t size, int flags)
2274 {
2275 struct inode *inode = dentry->d_inode;
2276 struct inode_security_struct *isec = inode->i_security;
2277 u32 newsid;
2278 int rc;
2279
2280 if (strcmp(name, XATTR_NAME_SELINUX)) {
2281 /* Not an attribute we recognize, so nothing to do. */
2282 return;
2283 }
2284
2285 rc = security_context_to_sid(value, size, &newsid);
2286 if (rc) {
2287 printk(KERN_WARNING "%s: unable to obtain SID for context "
2288 "%s, rc=%d\n", __FUNCTION__, (char*)value, -rc);
2289 return;
2290 }
2291
2292 isec->sid = newsid;
2293 return;
2294 }
2295
2296 static int selinux_inode_getxattr (struct dentry *dentry, char *name)
2297 {
2298 struct inode *inode = dentry->d_inode;
2299 struct superblock_security_struct *sbsec = inode->i_sb->s_security;
2300
2301 if (sbsec->behavior == SECURITY_FS_USE_MNTPOINT)
2302 return -EOPNOTSUPP;
2303
2304 return dentry_has_perm(current, NULL, dentry, FILE__GETATTR);
2305 }
2306
2307 static int selinux_inode_listxattr (struct dentry *dentry)
2308 {
2309 return dentry_has_perm(current, NULL, dentry, FILE__GETATTR);
2310 }
2311
2312 static int selinux_inode_removexattr (struct dentry *dentry, char *name)
2313 {
2314 if (strcmp(name, XATTR_NAME_SELINUX)) {
2315 if (!strncmp(name, XATTR_SECURITY_PREFIX,
2316 sizeof XATTR_SECURITY_PREFIX - 1) &&
2317 !capable(CAP_SYS_ADMIN)) {
2318 /* A different attribute in the security namespace.
2319 Restrict to administrator. */
2320 return -EPERM;
2321 }
2322
2323 /* Not an attribute we recognize, so just check the
2324 ordinary setattr permission. Might want a separate
2325 permission for removexattr. */
2326 return dentry_has_perm(current, NULL, dentry, FILE__SETATTR);
2327 }
2328
2329 /* No one is allowed to remove a SELinux security label.
2330 You can change the label, but all data must be labeled. */
2331 return -EACCES;
2332 }
2333
2334 static int selinux_inode_getsecurity(struct dentry *dentry, const char *name, void *buffer, size_t size)
2335 {
2336 struct inode *inode = dentry->d_inode;
2337 struct inode_security_struct *isec = inode->i_security;
2338 char *context;
2339 unsigned len;
2340 int rc;
2341
2342 /* Permission check handled by selinux_inode_getxattr hook.*/
2343
2344 if (strcmp(name, XATTR_SELINUX_SUFFIX))
2345 return -EOPNOTSUPP;
2346
2347 rc = security_sid_to_context(isec->sid, &context, &len);
2348 if (rc)
2349 return rc;
2350
2351 if (!buffer || !size) {
2352 kfree(context);
2353 return len;
2354 }
2355 if (size < len) {
2356 kfree(context);
2357 return -ERANGE;
2358 }
2359 memcpy(buffer, context, len);
2360 kfree(context);
2361 return len;
2362 }
2363
2364 static int selinux_inode_setsecurity(struct dentry *dentry, const char *name,
2365 const void *value, size_t size, int flags)
2366 {
2367 struct inode *inode = dentry->d_inode;
2368 struct inode_security_struct *isec = inode->i_security;
2369 u32 newsid;
2370 int rc;
2371
2372 if (strcmp(name, XATTR_SELINUX_SUFFIX))
2373 return -EOPNOTSUPP;
2374
2375 if (!value || !size)
2376 return -EACCES;
2377
2378 rc = security_context_to_sid((void*)value, size, &newsid);
2379 if (rc)
2380 return rc;
2381
2382 isec->sid = newsid;
2383 return 0;
2384 }
2385
2386 static int selinux_inode_listsecurity(struct dentry *dentry, char *buffer)
2387 {
2388 const int len = sizeof(XATTR_NAME_SELINUX);
2389 if (buffer)
2390 memcpy(buffer, XATTR_NAME_SELINUX, len);
2391 return len;
2392 }
2393
2394 /* file security operations */
2395
2396 static int selinux_file_permission(struct file *file, int mask)
2397 {
2398 struct inode *inode = file->f_dentry->d_inode;
2399
2400 if (!mask) {
2401 /* No permission to check. Existence test. */
2402 return 0;
2403 }
2404
2405 /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
2406 if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
2407 mask |= MAY_APPEND;
2408
2409 return file_has_perm(current, file,
2410 file_mask_to_av(inode->i_mode, mask));
2411 }
2412
2413 static int selinux_file_alloc_security(struct file *file)
2414 {
2415 return file_alloc_security(file);
2416 }
2417
2418 static void selinux_file_free_security(struct file *file)
2419 {
2420 file_free_security(file);
2421 }
2422
2423 static int selinux_file_ioctl(struct file *file, unsigned int cmd,
2424 unsigned long arg)
2425 {
2426 int error = 0;
2427
2428 switch (cmd) {
2429 case FIONREAD:
2430 /* fall through */
2431 case FIBMAP:
2432 /* fall through */
2433 case FIGETBSZ:
2434 /* fall through */
2435 case EXT2_IOC_GETFLAGS:
2436 /* fall through */
2437 case EXT2_IOC_GETVERSION:
2438 error = file_has_perm(current, file, FILE__GETATTR);
2439 break;
2440
2441 case EXT2_IOC_SETFLAGS:
2442 /* fall through */
2443 case EXT2_IOC_SETVERSION:
2444 error = file_has_perm(current, file, FILE__SETATTR);
2445 break;
2446
2447 /* sys_ioctl() checks */
2448 case FIONBIO:
2449 /* fall through */
2450 case FIOASYNC:
2451 error = file_has_perm(current, file, 0);
2452 break;
2453
2454 case KDSKBENT:
2455 case KDSKBSENT:
2456 error = task_has_capability(current,CAP_SYS_TTY_CONFIG);
2457 break;
2458
2459 /* default case assumes that the command will go
2460 * to the file's ioctl() function.
2461 */
2462 default:
2463 error = file_has_perm(current, file, FILE__IOCTL);
2464
2465 }
2466 return error;
2467 }
2468
2469 static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
2470 {
2471 if (file) {
2472 /* read access is always possible with a mapping */
2473 u32 av = FILE__READ;
2474
2475 /* write access only matters if the mapping is shared */
2476 if (shared && (prot & PROT_WRITE))
2477 av |= FILE__WRITE;
2478
2479 if (prot & PROT_EXEC)
2480 av |= FILE__EXECUTE;
2481
2482 return file_has_perm(current, file, av);
2483 }
2484 return 0;
2485 }
2486
2487 static int selinux_file_mmap(struct file *file, unsigned long prot, unsigned long flags)
2488 {
2489 int rc;
2490
2491 rc = secondary_ops->file_mmap(file, prot, flags);
2492 if (rc)
2493 return rc;
2494
2495 return file_map_prot_check(file, prot,
2496 (flags & MAP_TYPE) == MAP_SHARED);
2497 }
2498
2499 static int selinux_file_mprotect(struct vm_area_struct *vma,
2500 unsigned long prot)
2501 {
2502 int rc;
2503
2504 rc = secondary_ops->file_mprotect(vma, prot);
2505 if (rc)
2506 return rc;
2507
2508 return file_map_prot_check(vma->vm_file, prot, vma->vm_flags&VM_SHARED);
2509 }
2510
2511 static int selinux_file_lock(struct file *file, unsigned int cmd)
2512 {
2513 return file_has_perm(current, file, FILE__LOCK);
2514 }
2515
2516 static int selinux_file_fcntl(struct file *file, unsigned int cmd,
2517 unsigned long arg)
2518 {
2519 int err = 0;
2520
2521 switch (cmd) {
2522 case F_SETFL:
2523 if (!file->f_dentry || !file->f_dentry->d_inode) {
2524 err = -EINVAL;
2525 break;
2526 }
2527
2528 if ((file->f_flags & O_APPEND) && !(arg & O_APPEND)) {
2529 err = file_has_perm(current, file,FILE__WRITE);
2530 break;
2531 }
2532 /* fall through */
2533 case F_SETOWN:
2534 case F_SETSIG:
2535 case F_GETFL:
2536 case F_GETOWN:
2537 case F_GETSIG:
2538 /* Just check FD__USE permission */
2539 err = file_has_perm(current, file, 0);
2540 break;
2541 case F_GETLK:
2542 case F_SETLK:
2543 case F_SETLKW:
2544 #if BITS_PER_LONG == 32
2545 case F_GETLK64:
2546 case F_SETLK64:
2547 case F_SETLKW64:
2548 #endif
2549 if (!file->f_dentry || !file->f_dentry->d_inode) {
2550 err = -EINVAL;
2551 break;
2552 }
2553 err = file_has_perm(current, file, FILE__LOCK);
2554 break;
2555 }
2556
2557 return err;
2558 }
2559
2560 static int selinux_file_set_fowner(struct file *file)
2561 {
2562 struct task_security_struct *tsec;
2563 struct file_security_struct *fsec;
2564
2565 tsec = current->security;
2566 fsec = file->f_security;
2567 fsec->fown_sid = tsec->sid;
2568
2569 return 0;
2570 }
2571
2572 static int selinux_file_send_sigiotask(struct task_struct *tsk,
2573 struct fown_struct *fown,
2574 int fd, int reason)
2575 {
2576 struct file *file;
2577 u32 perm;
2578 struct task_security_struct *tsec;
2579 struct file_security_struct *fsec;
2580
2581 /* struct fown_struct is never outside the context of a struct file */
2582 file = (struct file *)((long)fown - offsetof(struct file,f_owner));
2583
2584 tsec = tsk->security;
2585 fsec = file->f_security;
2586
2587 if (!fown->signum)
2588 perm = signal_to_av(SIGIO); /* as per send_sigio_to_task */
2589 else
2590 perm = signal_to_av(fown->signum);
2591
2592 return avc_has_perm(fsec->fown_sid, tsec->sid,
2593 SECCLASS_PROCESS, perm, NULL, NULL);
2594 }
2595
2596 static int selinux_file_receive(struct file *file)
2597 {
2598 return file_has_perm(current, file, file_to_av(file));
2599 }
2600
2601 /* task security operations */
2602
2603 static int selinux_task_create(unsigned long clone_flags)
2604 {
2605 int rc;
2606
2607 rc = secondary_ops->task_create(clone_flags);
2608 if (rc)
2609 return rc;
2610
2611 return task_has_perm(current, current, PROCESS__FORK);
2612 }
2613
2614 static int selinux_task_alloc_security(struct task_struct *tsk)
2615 {
2616 struct task_security_struct *tsec1, *tsec2;
2617 int rc;
2618
2619 tsec1 = current->security;
2620
2621 rc = task_alloc_security(tsk);
2622 if (rc)
2623 return rc;
2624 tsec2 = tsk->security;
2625
2626 tsec2->osid = tsec1->osid;
2627 tsec2->sid = tsec1->sid;
2628
2629 /* Retain the exec and create SIDs across fork */
2630 tsec2->exec_sid = tsec1->exec_sid;
2631 tsec2->create_sid = tsec1->create_sid;
2632
2633 /* Retain ptracer SID across fork, if any.
2634 This will be reset by the ptrace hook upon any
2635 subsequent ptrace_attach operations. */
2636 tsec2->ptrace_sid = tsec1->ptrace_sid;
2637
2638 return 0;
2639 }
2640
2641 static void selinux_task_free_security(struct task_struct *tsk)
2642 {
2643 task_free_security(tsk);
2644 }
2645
2646 static int selinux_task_setuid(uid_t id0, uid_t id1, uid_t id2, int flags)
2647 {
2648 /* Since setuid only affects the current process, and
2649 since the SELinux controls are not based on the Linux
2650 identity attributes, SELinux does not need to control
2651 this operation. However, SELinux does control the use
2652 of the CAP_SETUID and CAP_SETGID capabilities using the
2653 capable hook. */
2654 return 0;
2655 }
2656
2657 static int selinux_task_post_setuid(uid_t id0, uid_t id1, uid_t id2, int flags)
2658 {
2659 return secondary_ops->task_post_setuid(id0,id1,id2,flags);
2660 }
2661
2662 static int selinux_task_setgid(gid_t id0, gid_t id1, gid_t id2, int flags)
2663 {
2664 /* See the comment for setuid above. */
2665 return 0;
2666 }
2667
2668 static int selinux_task_setpgid(struct task_struct *p, pid_t pgid)
2669 {
2670 return task_has_perm(current, p, PROCESS__SETPGID);
2671 }
2672
2673 static int selinux_task_getpgid(struct task_struct *p)
2674 {
2675 return task_has_perm(current, p, PROCESS__GETPGID);
2676 }
2677
2678 static int selinux_task_getsid(struct task_struct *p)
2679 {
2680 return task_has_perm(current, p, PROCESS__GETSESSION);
2681 }
2682
2683 static int selinux_task_setgroups(struct group_info *group_info)
2684 {
2685 /* See the comment for setuid above. */
2686 return 0;
2687 }
2688
2689 static int selinux_task_setnice(struct task_struct *p, int nice)
2690 {
2691 int rc;
2692
2693 rc = secondary_ops->task_setnice(p, nice);
2694 if (rc)
2695 return rc;
2696
2697 return task_has_perm(current,p, PROCESS__SETSCHED);
2698 }
2699
2700 static int selinux_task_setrlimit(unsigned int resource, struct rlimit *new_rlim)
2701 {
2702 struct rlimit *old_rlim = current->rlim + resource;
2703 int rc;
2704
2705 rc = secondary_ops->task_setrlimit(resource, new_rlim);
2706 if (rc)
2707 return rc;
2708
2709 /* Control the ability to change the hard limit (whether
2710 lowering or raising it), so that the hard limit can
2711 later be used as a safe reset point for the soft limit
2712 upon context transitions. See selinux_bprm_apply_creds. */
2713 if (old_rlim->rlim_max != new_rlim->rlim_max)
2714 return task_has_perm(current, current, PROCESS__SETRLIMIT);
2715
2716 return 0;
2717 }
2718
2719 static int selinux_task_setscheduler(struct task_struct *p, int policy, struct sched_param *lp)
2720 {
2721 struct task_security_struct *tsec1, *tsec2;
2722
2723 tsec1 = current->security;
2724 tsec2 = p->security;
2725
2726 /* No auditing from the setscheduler hook, since the runqueue lock
2727 is held and the system will deadlock if we try to log an audit
2728 message. */
2729 return avc_has_perm_noaudit(tsec1->sid, tsec2->sid,
2730 SECCLASS_PROCESS, PROCESS__SETSCHED,
2731 &tsec2->avcr, NULL);
2732 }
2733
2734 static int selinux_task_getscheduler(struct task_struct *p)
2735 {
2736 return task_has_perm(current, p, PROCESS__GETSCHED);
2737 }
2738
2739 static int selinux_task_kill(struct task_struct *p, struct siginfo *info, int sig)
2740 {
2741 u32 perm;
2742 int rc;
2743
2744 rc = secondary_ops->task_kill(p, info, sig);
2745 if (rc)
2746 return rc;
2747
2748 if (info && ((unsigned long)info == 1 ||
2749 (unsigned long)info == 2 || SI_FROMKERNEL(info)))
2750 return 0;
2751
2752 if (!sig)
2753 perm = PROCESS__SIGNULL; /* null signal; existence test */
2754 else
2755 perm = signal_to_av(sig);
2756
2757 return task_has_perm(current, p, perm);
2758 }
2759
2760 static int selinux_task_prctl(int option,
2761 unsigned long arg2,
2762 unsigned long arg3,
2763 unsigned long arg4,
2764 unsigned long arg5)
2765 {
2766 /* The current prctl operations do not appear to require
2767 any SELinux controls since they merely observe or modify
2768 the state of the current process. */
2769 return 0;
2770 }
2771
2772 static int selinux_task_wait(struct task_struct *p)
2773 {
2774 u32 perm;
2775
2776 perm = signal_to_av(p->exit_signal);
2777
2778 return task_has_perm(p, current, perm);
2779 }
2780
2781 static void selinux_task_reparent_to_init(struct task_struct *p)
2782 {
2783 struct task_security_struct *tsec;
2784
2785 secondary_ops->task_reparent_to_init(p);
2786
2787 tsec = p->security;
2788 tsec->osid = tsec->sid;
2789 tsec->sid = SECINITSID_KERNEL;
2790 return;
2791 }
2792
2793 static void selinux_task_to_inode(struct task_struct *p,
2794 struct inode *inode)
2795 {
2796 struct task_security_struct *tsec = p->security;
2797 struct inode_security_struct *isec = inode->i_security;
2798
2799 isec->sid = tsec->sid;
2800 isec->initialized = 1;
2801 return;
2802 }
2803
2804 #ifdef CONFIG_SECURITY_NETWORK
2805
2806 /* Returns error only if unable to parse addresses */
2807 static int selinux_parse_skb_ipv4(struct sk_buff *skb, struct avc_audit_data *ad)
2808 {
2809 int offset, ihlen, ret = -EINVAL;
2810 struct iphdr _iph, *ih;
2811
2812 offset = skb->nh.raw - skb->data;
2813 ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
2814 if (ih == NULL)
2815 goto out;
2816
2817 ihlen = ih->ihl * 4;
2818 if (ihlen < sizeof(_iph))
2819 goto out;
2820
2821 ad->u.net.v4info.saddr = ih->saddr;
2822 ad->u.net.v4info.daddr = ih->daddr;
2823 ret = 0;
2824
2825 switch (ih->protocol) {
2826 case IPPROTO_TCP: {
2827 struct tcphdr _tcph, *th;
2828
2829 if (ntohs(ih->frag_off) & IP_OFFSET)
2830 break;
2831
2832 offset += ihlen;
2833 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
2834 if (th == NULL)
2835 break;
2836
2837 ad->u.net.sport = th->source;
2838 ad->u.net.dport = th->dest;
2839 break;
2840 }
2841
2842 case IPPROTO_UDP: {
2843 struct udphdr _udph, *uh;
2844
2845 if (ntohs(ih->frag_off) & IP_OFFSET)
2846 break;
2847
2848 offset += ihlen;
2849 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
2850 if (uh == NULL)
2851 break;
2852
2853 ad->u.net.sport = uh->source;
2854 ad->u.net.dport = uh->dest;
2855 break;
2856 }
2857
2858 default:
2859 break;
2860 }
2861 out:
2862 return ret;
2863 }
2864
2865 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
2866
2867 /* Returns error only if unable to parse addresses */
2868 static int selinux_parse_skb_ipv6(struct sk_buff *skb, struct avc_audit_data *ad)
2869 {
2870 u8 nexthdr;
2871 int ret = -EINVAL, offset;
2872 struct ipv6hdr _ipv6h, *ip6;
2873
2874 offset = skb->nh.raw - skb->data;
2875 ip6 = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h);
2876 if (ip6 == NULL)
2877 goto out;
2878
2879 ipv6_addr_copy(&ad->u.net.v6info.saddr, &ip6->saddr);
2880 ipv6_addr_copy(&ad->u.net.v6info.daddr, &ip6->daddr);
2881 ret = 0;
2882
2883 nexthdr = ip6->nexthdr;
2884 offset += sizeof(_ipv6h);
2885 offset = ipv6_skip_exthdr(skb, offset, &nexthdr,
2886 skb->tail - skb->head - offset);
2887 if (offset < 0)
2888 goto out;
2889
2890 switch (nexthdr) {
2891 case IPPROTO_TCP: {
2892 struct tcphdr _tcph, *th;
2893
2894 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
2895 if (th == NULL)
2896 break;
2897
2898 ad->u.net.sport = th->source;
2899 ad->u.net.dport = th->dest;
2900 break;
2901 }
2902
2903 case IPPROTO_UDP: {
2904 struct udphdr _udph, *uh;
2905
2906 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
2907 if (uh == NULL)
2908 break;
2909
2910 ad->u.net.sport = uh->source;
2911 ad->u.net.dport = uh->dest;
2912 break;
2913 }
2914
2915 /* includes fragments */
2916 default:
2917 break;
2918 }
2919 out:
2920 return ret;
2921 }
2922
2923 #endif /* IPV6 */
2924
2925 static int selinux_parse_skb(struct sk_buff *skb, struct avc_audit_data *ad,
2926 char **addrp, int *len, int src)
2927 {
2928 int ret = 0;
2929
2930 switch (ad->u.net.family) {
2931 case PF_INET:
2932 ret = selinux_parse_skb_ipv4(skb, ad);
2933 if (ret || !addrp)
2934 break;
2935 *len = 4;
2936 *addrp = (char *)(src ? &ad->u.net.v4info.saddr :
2937 &ad->u.net.v4info.daddr);
2938 break;
2939
2940 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
2941 case PF_INET6:
2942 ret = selinux_parse_skb_ipv6(skb, ad);
2943 if (ret || !addrp)
2944 break;
2945 *len = 16;
2946 *addrp = (char *)(src ? &ad->u.net.v6info.saddr :
2947 &ad->u.net.v6info.daddr);
2948 break;
2949 #endif /* IPV6 */
2950 default:
2951 break;
2952 }
2953
2954 return ret;
2955 }
2956
2957 /* socket security operations */
2958 static int socket_has_perm(struct task_struct *task, struct socket *sock,
2959 u32 perms)
2960 {
2961 struct inode_security_struct *isec;
2962 struct task_security_struct *tsec;
2963 struct avc_audit_data ad;
2964 int err = 0;
2965
2966 tsec = task->security;
2967 isec = SOCK_INODE(sock)->i_security;
2968
2969 if (isec->sid == SECINITSID_KERNEL)
2970 goto out;
2971
2972 AVC_AUDIT_DATA_INIT(&ad,NET);
2973 ad.u.net.sk = sock->sk;
2974 err = avc_has_perm(tsec->sid, isec->sid, isec->sclass,
2975 perms, &isec->avcr, &ad);
2976
2977 out:
2978 return err;
2979 }
2980
2981 static int selinux_socket_create(int family, int type,
2982 int protocol, int kern)
2983 {
2984 int err = 0;
2985 struct task_security_struct *tsec;
2986
2987 if (kern)
2988 goto out;
2989
2990 tsec = current->security;
2991 err = avc_has_perm(tsec->sid, tsec->sid,
2992 socket_type_to_security_class(family, type,
2993 protocol), SOCKET__CREATE, NULL, NULL);
2994
2995 out:
2996 return err;
2997 }
2998
2999 static void selinux_socket_post_create(struct socket *sock, int family,
3000 int type, int protocol, int kern)
3001 {
3002 int err;
3003 struct inode_security_struct *isec;
3004 struct task_security_struct *tsec;
3005
3006 err = inode_doinit(SOCK_INODE(sock));
3007 if (err < 0)
3008 return;
3009 isec = SOCK_INODE(sock)->i_security;
3010
3011 tsec = current->security;
3012 isec->sclass = socket_type_to_security_class(family, type, protocol);
3013 isec->sid = kern ? SECINITSID_KERNEL : tsec->sid;
3014
3015 return;
3016 }
3017
3018 /* Range of port numbers used to automatically bind.
3019 Need to determine whether we should perform a name_bind
3020 permission check between the socket and the port number. */
3021 #define ip_local_port_range_0 sysctl_local_port_range[0]
3022 #define ip_local_port_range_1 sysctl_local_port_range[1]
3023
3024 static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
3025 {
3026 u16 family;
3027 int err;
3028
3029 err = socket_has_perm(current, sock, SOCKET__BIND);
3030 if (err)
3031 goto out;
3032
3033 /*
3034 * If PF_INET or PF_INET6, check name_bind permission for the port.
3035 */
3036 family = sock->sk->sk_family;
3037 if (family == PF_INET || family == PF_INET6) {
3038 char *addrp;
3039 struct inode_security_struct *isec;
3040 struct task_security_struct *tsec;
3041 struct avc_audit_data ad;
3042 struct sockaddr_in *addr4 = NULL;
3043 struct sockaddr_in6 *addr6 = NULL;
3044 unsigned short snum;
3045 struct sock *sk = sock->sk;
3046 u32 sid, node_perm, addrlen;
3047
3048 tsec = current->security;
3049 isec = SOCK_INODE(sock)->i_security;
3050
3051 if (family == PF_INET) {
3052 addr4 = (struct sockaddr_in *)address;
3053 snum = ntohs(addr4->sin_port);
3054 addrlen = sizeof(addr4->sin_addr.s_addr);
3055 addrp = (char *)&addr4->sin_addr.s_addr;
3056 } else {
3057 addr6 = (struct sockaddr_in6 *)address;
3058 snum = ntohs(addr6->sin6_port);
3059 addrlen = sizeof(addr6->sin6_addr.s6_addr);
3060 addrp = (char *)&addr6->sin6_addr.s6_addr;
3061 }
3062
3063 if (snum&&(snum < max(PROT_SOCK,ip_local_port_range_0) ||
3064 snum > ip_local_port_range_1)) {
3065 err = security_port_sid(sk->sk_family, sk->sk_type,
3066 sk->sk_protocol, snum, &sid);
3067 if (err)
3068 goto out;
3069 AVC_AUDIT_DATA_INIT(&ad,NET);
3070 ad.u.net.sport = htons(snum);
3071 ad.u.net.family = family;
3072 err = avc_has_perm(isec->sid, sid,
3073 isec->sclass,
3074 SOCKET__NAME_BIND, NULL, &ad);
3075 if (err)
3076 goto out;
3077 }
3078
3079 switch(sk->sk_protocol) {
3080 case IPPROTO_TCP:
3081 node_perm = TCP_SOCKET__NODE_BIND;
3082 break;
3083
3084 case IPPROTO_UDP:
3085 node_perm = UDP_SOCKET__NODE_BIND;
3086 break;
3087
3088 default:
3089 node_perm = RAWIP_SOCKET__NODE_BIND;
3090 break;
3091 }
3092
3093 err = security_node_sid(family, addrp, addrlen, &sid);
3094 if (err)
3095 goto out;
3096
3097 AVC_AUDIT_DATA_INIT(&ad,NET);
3098 ad.u.net.sport = htons(snum);
3099 ad.u.net.family = family;
3100
3101 if (family == PF_INET)
3102 ad.u.net.v4info.saddr = addr4->sin_addr.s_addr;
3103 else
3104 ipv6_addr_copy(&ad.u.net.v6info.saddr, &addr6->sin6_addr);
3105
3106 err = avc_has_perm(isec->sid, sid,
3107 isec->sclass, node_perm, NULL, &ad);
3108 if (err)
3109 goto out;
3110 }
3111 out:
3112 return err;
3113 }
3114
3115 static int selinux_socket_connect(struct socket *sock, struct sockaddr *address, int addrlen)
3116 {
3117 return socket_has_perm(current, sock, SOCKET__CONNECT);
3118 }
3119
3120 static int selinux_socket_listen(struct socket *sock, int backlog)
3121 {
3122 return socket_has_perm(current, sock, SOCKET__LISTEN);
3123 }
3124
3125 static int selinux_socket_accept(struct socket *sock, struct socket *newsock)
3126 {
3127 int err;
3128 struct inode_security_struct *isec;
3129 struct inode_security_struct *newisec;
3130
3131 err = socket_has_perm(current, sock, SOCKET__ACCEPT);
3132 if (err)
3133 return err;
3134
3135 err = inode_doinit(SOCK_INODE(newsock));
3136 if (err < 0)
3137 return err;
3138 newisec = SOCK_INODE(newsock)->i_security;
3139
3140 isec = SOCK_INODE(sock)->i_security;
3141 newisec->sclass = isec->sclass;
3142 newisec->sid = isec->sid;
3143
3144 return 0;
3145 }
3146
3147 static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg,
3148 int size)
3149 {
3150 return socket_has_perm(current, sock, SOCKET__WRITE);
3151 }
3152
3153 static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg,
3154 int size, int flags)
3155 {
3156 return socket_has_perm(current, sock, SOCKET__READ);
3157 }
3158
3159 static int selinux_socket_getsockname(struct socket *sock)
3160 {
3161 return socket_has_perm(current, sock, SOCKET__GETATTR);
3162 }
3163
3164 static int selinux_socket_getpeername(struct socket *sock)
3165 {
3166 return socket_has_perm(current, sock, SOCKET__GETATTR);
3167 }
3168
3169 static int selinux_socket_setsockopt(struct socket *sock,int level,int optname)
3170 {
3171 return socket_has_perm(current, sock, SOCKET__SETOPT);
3172 }
3173
3174 static int selinux_socket_getsockopt(struct socket *sock, int level,
3175 int optname)
3176 {
3177 return socket_has_perm(current, sock, SOCKET__GETOPT);
3178 }
3179
3180 static int selinux_socket_shutdown(struct socket *sock, int how)
3181 {
3182 return socket_has_perm(current, sock, SOCKET__SHUTDOWN);
3183 }
3184
3185 static int selinux_socket_unix_stream_connect(struct socket *sock,
3186 struct socket *other,
3187 struct sock *newsk)
3188 {
3189 struct sk_security_struct *ssec;
3190 struct inode_security_struct *isec;
3191 struct inode_security_struct *other_isec;
3192 struct avc_audit_data ad;
3193 int err;
3194
3195 err = secondary_ops->unix_stream_connect(sock, other, newsk);
3196 if (err)
3197 return err;
3198
3199 isec = SOCK_INODE(sock)->i_security;
3200 other_isec = SOCK_INODE(other)->i_security;
3201
3202 AVC_AUDIT_DATA_INIT(&ad,NET);
3203 ad.u.net.sk = other->sk;
3204
3205 err = avc_has_perm(isec->sid, other_isec->sid,
3206 isec->sclass,
3207 UNIX_STREAM_SOCKET__CONNECTTO,
3208 &other_isec->avcr, &ad);
3209 if (err)
3210 return err;
3211
3212 /* connecting socket */
3213 ssec = sock->sk->sk_security;
3214 ssec->peer_sid = other_isec->sid;
3215
3216 /* server child socket */
3217 ssec = newsk->sk_security;
3218 ssec->peer_sid = isec->sid;
3219
3220 return 0;
3221 }
3222
3223 static int selinux_socket_unix_may_send(struct socket *sock,
3224 struct socket *other)
3225 {
3226 struct inode_security_struct *isec;
3227 struct inode_security_struct *other_isec;
3228 struct avc_audit_data ad;
3229 int err;
3230
3231 isec = SOCK_INODE(sock)->i_security;
3232 other_isec = SOCK_INODE(other)->i_security;
3233
3234 AVC_AUDIT_DATA_INIT(&ad,NET);
3235 ad.u.net.sk = other->sk;
3236
3237 err = avc_has_perm(isec->sid, other_isec->sid,
3238 isec->sclass,
3239 SOCKET__SENDTO,
3240 &other_isec->avcr, &ad);
3241 if (err)
3242 return err;
3243
3244 return 0;
3245 }
3246
3247 static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
3248 {
3249 u16 family;
3250 char *addrp;
3251 int len, err = 0;
3252 u32 netif_perm, node_perm, node_sid, recv_perm = 0;
3253 u32 sock_sid = 0;
3254 u16 sock_class = 0;
3255 struct socket *sock;
3256 struct net_device *dev;
3257 struct sel_netif *netif;
3258 struct netif_security_struct *nsec;
3259 struct avc_audit_data ad;
3260
3261 family = sk->sk_family;
3262 if (family != PF_INET && family != PF_INET6)
3263 goto out;
3264
3265 /* Handle mapped IPv4 packets arriving via IPv6 sockets */
3266 if (family == PF_INET6 && skb->protocol == ntohs(ETH_P_IP))
3267 family = PF_INET;
3268
3269 read_lock_bh(&sk->sk_callback_lock);
3270 sock = sk->sk_socket;
3271 if (sock) {
3272 struct inode *inode;
3273 inode = SOCK_INODE(sock);
3274 if (inode) {
3275 struct inode_security_struct *isec;
3276 isec = inode->i_security;
3277 sock_sid = isec->sid;
3278 sock_class = isec->sclass;
3279 }
3280 }
3281 read_unlock_bh(&sk->sk_callback_lock);
3282 if (!sock_sid)
3283 goto out;
3284
3285 dev = skb->dev;
3286 if (!dev)
3287 goto out;
3288
3289 netif = sel_netif_lookup(dev);
3290 if (IS_ERR(netif)) {
3291 err = PTR_ERR(netif);
3292 goto out;
3293 }
3294
3295 nsec = &netif->nsec;
3296
3297 switch (sock_class) {
3298 case SECCLASS_UDP_SOCKET:
3299 netif_perm = NETIF__UDP_RECV;
3300 node_perm = NODE__UDP_RECV;
3301 recv_perm = UDP_SOCKET__RECV_MSG;
3302 break;
3303
3304 case SECCLASS_TCP_SOCKET:
3305 netif_perm = NETIF__TCP_RECV;
3306 node_perm = NODE__TCP_RECV;
3307 recv_perm = TCP_SOCKET__RECV_MSG;
3308 break;
3309
3310 default:
3311 netif_perm = NETIF__RAWIP_RECV;
3312 node_perm = NODE__RAWIP_RECV;
3313 break;
3314 }
3315
3316 AVC_AUDIT_DATA_INIT(&ad, NET);
3317 ad.u.net.netif = dev->name;
3318 ad.u.net.family = family;
3319
3320 err = selinux_parse_skb(skb, &ad, &addrp, &len, 1);
3321 if (err) {
3322 sel_netif_put(netif);
3323 goto out;
3324 }
3325
3326 err = avc_has_perm(sock_sid, nsec->if_sid, SECCLASS_NETIF,
3327 netif_perm, &nsec->avcr, &ad);
3328 sel_netif_put(netif);
3329 if (err)
3330 goto out;
3331
3332 /* Fixme: this lookup is inefficient */
3333 err = security_node_sid(family, addrp, len, &node_sid);
3334 if (err)
3335 goto out;
3336
3337 err = avc_has_perm(sock_sid, node_sid, SECCLASS_NODE, node_perm, NULL, &ad);
3338 if (err)
3339 goto out;
3340
3341 if (recv_perm) {
3342 u32 port_sid;
3343
3344 /* Fixme: make this more efficient */
3345 err = security_port_sid(sk->sk_family, sk->sk_type,
3346 sk->sk_protocol, ntohs(ad.u.net.sport),
3347 &port_sid);
3348 if (err)
3349 goto out;
3350
3351 err = avc_has_perm(sock_sid, port_sid, sock_class,
3352 recv_perm, NULL, &ad);
3353 }
3354 out:
3355 return err;
3356 }
3357
3358 static int selinux_socket_getpeersec(struct socket *sock, char __user *optval,
3359 int __user *optlen, unsigned len)
3360 {
3361 int err = 0;
3362 char *scontext;
3363 u32 scontext_len;
3364 struct sk_security_struct *ssec;
3365 struct inode_security_struct *isec;
3366
3367 isec = SOCK_INODE(sock)->i_security;
3368 if (isec->sclass != SECCLASS_UNIX_STREAM_SOCKET) {
3369 err = -ENOPROTOOPT;
3370 goto out;
3371 }
3372
3373 ssec = sock->sk->sk_security;
3374
3375 err = security_sid_to_context(ssec->peer_sid, &scontext, &scontext_len);
3376 if (err)
3377 goto out;
3378
3379 if (scontext_len > len) {
3380 err = -ERANGE;
3381 goto out_len;
3382 }
3383
3384 if (copy_to_user(optval, scontext, scontext_len))
3385 err = -EFAULT;
3386
3387 out_len:
3388 if (put_user(scontext_len, optlen))
3389 err = -EFAULT;
3390
3391 kfree(scontext);
3392 out:
3393 return err;
3394 }
3395
3396 static int selinux_sk_alloc_security(struct sock *sk, int family, int priority)
3397 {
3398 return sk_alloc_security(sk, family, priority);
3399 }
3400
3401 static void selinux_sk_free_security(struct sock *sk)
3402 {
3403 sk_free_security(sk);
3404 }
3405
3406 static int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
3407 {
3408 int err = 0;
3409 u32 perm;
3410 struct nlmsghdr *nlh;
3411 struct socket *sock = sk->sk_socket;
3412 struct inode_security_struct *isec = SOCK_INODE(sock)->i_security;
3413
3414 if (skb->len < NLMSG_SPACE(0)) {
3415 err = -EINVAL;
3416 goto out;
3417 }
3418 nlh = (struct nlmsghdr *)skb->data;
3419
3420 err = selinux_nlmsg_lookup(isec->sclass, nlh->nlmsg_type, &perm);
3421 if (err) {
3422 /* Ignore */
3423 if (err == -ENOENT)
3424 err = 0;
3425 goto out;
3426 }
3427
3428 err = socket_has_perm(current, sock, perm);
3429 out:
3430 return err;
3431 }
3432
3433 #ifdef CONFIG_NETFILTER
3434
3435 static unsigned int selinux_ip_postroute_last(unsigned int hooknum,
3436 struct sk_buff **pskb,
3437 const struct net_device *in,
3438 const struct net_device *out,
3439 int (*okfn)(struct sk_buff *),
3440 u16 family)
3441 {
3442 char *addrp;
3443 int len, err = NF_ACCEPT;
3444 u32 netif_perm, node_perm, node_sid, send_perm = 0;
3445 struct sock *sk;
3446 struct socket *sock;
3447 struct inode *inode;
3448 struct sel_netif *netif;
3449 struct sk_buff *skb = *pskb;
3450 struct netif_security_struct *nsec;
3451 struct inode_security_struct *isec;
3452 struct avc_audit_data ad;
3453 struct net_device *dev = (struct net_device *)out;
3454
3455 sk = skb->sk;
3456 if (!sk)
3457 goto out;
3458
3459 sock = sk->sk_socket;
3460 if (!sock)
3461 goto out;
3462
3463 inode = SOCK_INODE(sock);
3464 if (!inode)
3465 goto out;
3466
3467 netif = sel_netif_lookup(dev);
3468 if (IS_ERR(netif)) {
3469 err = NF_DROP;
3470 goto out;
3471 }
3472
3473 nsec = &netif->nsec;
3474 isec = inode->i_security;
3475
3476 switch (isec->sclass) {
3477 case SECCLASS_UDP_SOCKET:
3478 netif_perm = NETIF__UDP_SEND;
3479 node_perm = NODE__UDP_SEND;
3480 send_perm = UDP_SOCKET__SEND_MSG;
3481 break;
3482
3483 case SECCLASS_TCP_SOCKET:
3484 netif_perm = NETIF__TCP_SEND;
3485 node_perm = NODE__TCP_SEND;
3486 send_perm = TCP_SOCKET__SEND_MSG;
3487 break;
3488
3489 default:
3490 netif_perm = NETIF__RAWIP_SEND;
3491 node_perm = NODE__RAWIP_SEND;
3492 break;
3493 }
3494
3495
3496 AVC_AUDIT_DATA_INIT(&ad, NET);
3497 ad.u.net.netif = dev->name;
3498 ad.u.net.family = family;
3499
3500 err = selinux_parse_skb(skb, &ad, &addrp,
3501 &len, 0) ? NF_DROP : NF_ACCEPT;
3502 if (err != NF_ACCEPT) {
3503 sel_netif_put(netif);
3504 goto out;
3505 }
3506
3507 err = avc_has_perm(isec->sid, nsec->if_sid, SECCLASS_NETIF,
3508 netif_perm, &nsec->avcr, &ad) ? NF_DROP : NF_ACCEPT;
3509 sel_netif_put(netif);
3510 if (err != NF_ACCEPT)
3511 goto out;
3512
3513 /* Fixme: this lookup is inefficient */
3514 err = security_node_sid(family, addrp, len,
3515 &node_sid) ? NF_DROP : NF_ACCEPT;
3516 if (err != NF_ACCEPT)
3517 goto out;
3518
3519 err = avc_has_perm(isec->sid, node_sid, SECCLASS_NODE,
3520 node_perm, NULL, &ad) ? NF_DROP : NF_ACCEPT;
3521 if (err != NF_ACCEPT)
3522 goto out;
3523
3524 if (send_perm) {
3525 u32 port_sid;
3526
3527 /* Fixme: make this more efficient */
3528 err = security_port_sid(sk->sk_family,
3529 sk->sk_type,
3530 sk->sk_protocol,
3531 ntohs(ad.u.net.dport),
3532 &port_sid) ? NF_DROP : NF_ACCEPT;
3533 if (err != NF_ACCEPT)
3534 goto out;
3535
3536 err = avc_has_perm(isec->sid, port_sid, isec->sclass,
3537 send_perm, NULL, &ad) ? NF_DROP : NF_ACCEPT;
3538 }
3539
3540 out:
3541 return err;
3542 }
3543
3544 static unsigned int selinux_ipv4_postroute_last(unsigned int hooknum,
3545 struct sk_buff **pskb,
3546 const struct net_device *in,
3547 const struct net_device *out,
3548 int (*okfn)(struct sk_buff *))
3549 {
3550 return selinux_ip_postroute_last(hooknum, pskb, in, out, okfn, PF_INET);
3551 }
3552
3553 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3554
3555 static unsigned int selinux_ipv6_postroute_last(unsigned int hooknum,
3556 struct sk_buff **pskb,
3557 const struct net_device *in,
3558 const struct net_device *out,
3559 int (*okfn)(struct sk_buff *))
3560 {
3561 return selinux_ip_postroute_last(hooknum, pskb, in, out, okfn, PF_INET6);
3562 }
3563
3564 #endif /* IPV6 */
3565
3566 #endif /* CONFIG_NETFILTER */
3567
3568 #else
3569
3570 static inline int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
3571 {
3572 return 0;
3573 }
3574
3575 #endif /* CONFIG_SECURITY_NETWORK */
3576
3577 static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb)
3578 {
3579 int err = 0;
3580
3581 if (capable(CAP_NET_ADMIN))
3582 cap_raise (NETLINK_CB (skb).eff_cap, CAP_NET_ADMIN);
3583 else
3584 NETLINK_CB(skb).eff_cap = 0;
3585
3586 if (policydb_loaded_version >= POLICYDB_VERSION_NLCLASS)
3587 err = selinux_nlmsg_perm(sk, skb);
3588
3589 return err;
3590 }
3591
3592 static int selinux_netlink_recv(struct sk_buff *skb)
3593 {
3594 if (!cap_raised(NETLINK_CB(skb).eff_cap, CAP_NET_ADMIN))
3595 return -EPERM;
3596 return 0;
3597 }
3598
3599 static int ipc_alloc_security(struct task_struct *task,
3600 struct kern_ipc_perm *perm,
3601 u16 sclass)
3602 {
3603 struct task_security_struct *tsec = task->security;
3604 struct ipc_security_struct *isec;
3605
3606 isec = kmalloc(sizeof(struct ipc_security_struct), GFP_KERNEL);
3607 if (!isec)
3608 return -ENOMEM;
3609
3610 memset(isec, 0, sizeof(struct ipc_security_struct));
3611 isec->magic = SELINUX_MAGIC;
3612 isec->sclass = sclass;
3613 isec->ipc_perm = perm;
3614 if (tsec) {
3615 isec->sid = tsec->sid;
3616 } else {
3617 isec->sid = SECINITSID_UNLABELED;
3618 }
3619 perm->security = isec;
3620
3621 return 0;
3622 }
3623
3624 static void ipc_free_security(struct kern_ipc_perm *perm)
3625 {
3626 struct ipc_security_struct *isec = perm->security;
3627 if (!isec || isec->magic != SELINUX_MAGIC)
3628 return;
3629
3630 perm->security = NULL;
3631 kfree(isec);
3632 }
3633
3634 static int msg_msg_alloc_security(struct msg_msg *msg)
3635 {
3636 struct msg_security_struct *msec;
3637
3638 msec = kmalloc(sizeof(struct msg_security_struct), GFP_KERNEL);
3639 if (!msec)
3640 return -ENOMEM;
3641
3642 memset(msec, 0, sizeof(struct msg_security_struct));
3643 msec->magic = SELINUX_MAGIC;
3644 msec->msg = msg;
3645 msec->sid = SECINITSID_UNLABELED;
3646 msg->security = msec;
3647
3648 return 0;
3649 }
3650
3651 static void msg_msg_free_security(struct msg_msg *msg)
3652 {
3653 struct msg_security_struct *msec = msg->security;
3654 if (!msec || msec->magic != SELINUX_MAGIC)
3655 return;
3656
3657 msg->security = NULL;
3658 kfree(msec);
3659 }
3660
3661 static int ipc_has_perm(struct kern_ipc_perm *ipc_perms,
3662 u16 sclass, u32 perms)
3663 {
3664 struct task_security_struct *tsec;
3665 struct ipc_security_struct *isec;
3666 struct avc_audit_data ad;
3667
3668 tsec = current->security;
3669 isec = ipc_perms->security;
3670
3671 AVC_AUDIT_DATA_INIT(&ad, IPC);
3672 ad.u.ipc_id = ipc_perms->key;
3673
3674 return avc_has_perm(tsec->sid, isec->sid, sclass,
3675 perms, &isec->avcr, &ad);
3676 }
3677
3678 static int selinux_msg_msg_alloc_security(struct msg_msg *msg)
3679 {
3680 return msg_msg_alloc_security(msg);
3681 }
3682
3683 static void selinux_msg_msg_free_security(struct msg_msg *msg)
3684 {
3685 msg_msg_free_security(msg);
3686 }
3687
3688 /* message queue security operations */
3689 static int selinux_msg_queue_alloc_security(struct msg_queue *msq)
3690 {
3691 struct task_security_struct *tsec;
3692 struct ipc_security_struct *isec;
3693 struct avc_audit_data ad;
3694 int rc;
3695
3696 rc = ipc_alloc_security(current, &msq->q_perm, SECCLASS_MSGQ);
3697 if (rc)
3698 return rc;
3699
3700 tsec = current->security;
3701 isec = msq->q_perm.security;
3702
3703 AVC_AUDIT_DATA_INIT(&ad, IPC);
3704 ad.u.ipc_id = msq->q_perm.key;
3705
3706 rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_MSGQ,
3707 MSGQ__CREATE, &isec->avcr, &ad);
3708 if (rc) {
3709 ipc_free_security(&msq->q_perm);
3710 return rc;
3711 }
3712 return 0;
3713 }
3714
3715 static void selinux_msg_queue_free_security(struct msg_queue *msq)
3716 {
3717 ipc_free_security(&msq->q_perm);
3718 }
3719
3720 static int selinux_msg_queue_associate(struct msg_queue *msq, int msqflg)
3721 {
3722 struct task_security_struct *tsec;
3723 struct ipc_security_struct *isec;
3724 struct avc_audit_data ad;
3725
3726 tsec = current->security;
3727 isec = msq->q_perm.security;
3728
3729 AVC_AUDIT_DATA_INIT(&ad, IPC);
3730 ad.u.ipc_id = msq->q_perm.key;
3731
3732 return avc_has_perm(tsec->sid, isec->sid, SECCLASS_MSGQ,
3733 MSGQ__ASSOCIATE, &isec->avcr, &ad);
3734 }
3735
3736 static int selinux_msg_queue_msgctl(struct msg_queue *msq, int cmd)
3737 {
3738 int err;
3739 int perms;
3740
3741 switch(cmd) {
3742 case IPC_INFO:
3743 case MSG_INFO:
3744 /* No specific object, just general system-wide information. */
3745 return task_has_system(current, SYSTEM__IPC_INFO);
3746 case IPC_STAT:
3747 case MSG_STAT:
3748 perms = MSGQ__GETATTR | MSGQ__ASSOCIATE;
3749 break;
3750 case IPC_SET:
3751 perms = MSGQ__SETATTR;
3752 break;
3753 case IPC_RMID:
3754 perms = MSGQ__DESTROY;
3755 break;
3756 default:
3757 return 0;
3758 }
3759
3760 err = ipc_has_perm(&msq->q_perm, SECCLASS_MSGQ, perms);
3761 return err;
3762 }
3763
3764 static int selinux_msg_queue_msgsnd(struct msg_queue *msq, struct msg_msg *msg, int msqflg)
3765 {
3766 struct task_security_struct *tsec;
3767 struct ipc_security_struct *isec;
3768 struct msg_security_struct *msec;
3769 struct avc_audit_data ad;
3770 int rc;
3771
3772 tsec = current->security;
3773 isec = msq->q_perm.security;
3774 msec = msg->security;
3775
3776 /*
3777 * First time through, need to assign label to the message
3778 */
3779 if (msec->sid == SECINITSID_UNLABELED) {
3780 /*
3781 * Compute new sid based on current process and
3782 * message queue this message will be stored in
3783 */
3784 rc = security_transition_sid(tsec->sid,
3785 isec->sid,
3786 SECCLASS_MSG,
3787 &msec->sid);
3788 if (rc)
3789 return rc;
3790 }
3791
3792 AVC_AUDIT_DATA_INIT(&ad, IPC);
3793 ad.u.ipc_id = msq->q_perm.key;
3794
3795 /* Can this process write to the queue? */
3796 rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_MSGQ,
3797 MSGQ__WRITE, &isec->avcr, &ad);
3798 if (!rc)
3799 /* Can this process send the message */
3800 rc = avc_has_perm(tsec->sid, msec->sid,
3801 SECCLASS_MSG, MSG__SEND,
3802 &msec->avcr, &ad);
3803 if (!rc)
3804 /* Can the message be put in the queue? */
3805 rc = avc_has_perm(msec->sid, isec->sid,
3806 SECCLASS_MSGQ, MSGQ__ENQUEUE,
3807 &isec->avcr, &ad);
3808
3809 return rc;
3810 }
3811
3812 static int selinux_msg_queue_msgrcv(struct msg_queue *msq, struct msg_msg *msg,
3813 struct task_struct *target,
3814 long type, int mode)
3815 {
3816 struct task_security_struct *tsec;
3817 struct ipc_security_struct *isec;
3818 struct msg_security_struct *msec;
3819 struct avc_audit_data ad;
3820 int rc;
3821
3822 tsec = target->security;
3823 isec = msq->q_perm.security;
3824 msec = msg->security;
3825
3826 AVC_AUDIT_DATA_INIT(&ad, IPC);
3827 ad.u.ipc_id = msq->q_perm.key;
3828
3829 rc = avc_has_perm(tsec->sid, isec->sid,
3830 SECCLASS_MSGQ, MSGQ__READ,
3831 &isec->avcr, &ad);
3832 if (!rc)
3833 rc = avc_has_perm(tsec->sid, msec->sid,
3834 SECCLASS_MSG, MSG__RECEIVE,
3835 &msec->avcr, &ad);
3836 return rc;
3837 }
3838
3839 /* Shared Memory security operations */
3840 static int selinux_shm_alloc_security(struct shmid_kernel *shp)
3841 {
3842 struct task_security_struct *tsec;
3843 struct ipc_security_struct *isec;
3844 struct avc_audit_data ad;
3845 int rc;
3846
3847 rc = ipc_alloc_security(current, &shp->shm_perm, SECCLASS_SHM);
3848 if (rc)
3849 return rc;
3850
3851 tsec = current->security;
3852 isec = shp->shm_perm.security;
3853
3854 AVC_AUDIT_DATA_INIT(&ad, IPC);
3855 ad.u.ipc_id = shp->shm_perm.key;
3856
3857 rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_SHM,
3858 SHM__CREATE, &isec->avcr, &ad);
3859 if (rc) {
3860 ipc_free_security(&shp->shm_perm);
3861 return rc;
3862 }
3863 return 0;
3864 }
3865
3866 static void selinux_shm_free_security(struct shmid_kernel *shp)
3867 {
3868 ipc_free_security(&shp->shm_perm);
3869 }
3870
3871 static int selinux_shm_associate(struct shmid_kernel *shp, int shmflg)
3872 {
3873 struct task_security_struct *tsec;
3874 struct ipc_security_struct *isec;
3875 struct avc_audit_data ad;
3876
3877 tsec = current->security;
3878 isec = shp->shm_perm.security;
3879
3880 AVC_AUDIT_DATA_INIT(&ad, IPC);
3881 ad.u.ipc_id = shp->shm_perm.key;
3882
3883 return avc_has_perm(tsec->sid, isec->sid, SECCLASS_SHM,
3884 SHM__ASSOCIATE, &isec->avcr, &ad);
3885 }
3886
3887 /* Note, at this point, shp is locked down */
3888 static int selinux_shm_shmctl(struct shmid_kernel *shp, int cmd)
3889 {
3890 int perms;
3891 int err;
3892
3893 switch(cmd) {
3894 case IPC_INFO:
3895 case SHM_INFO:
3896 /* No specific object, just general system-wide information. */
3897 return task_has_system(current, SYSTEM__IPC_INFO);
3898 case IPC_STAT:
3899 case SHM_STAT:
3900 perms = SHM__GETATTR | SHM__ASSOCIATE;
3901 break;
3902 case IPC_SET:
3903 perms = SHM__SETATTR;
3904 break;
3905 case SHM_LOCK:
3906 case SHM_UNLOCK:
3907 perms = SHM__LOCK;
3908 break;
3909 case IPC_RMID:
3910 perms = SHM__DESTROY;
3911 break;
3912 default:
3913 return 0;
3914 }
3915
3916 err = ipc_has_perm(&shp->shm_perm, SECCLASS_SHM, perms);
3917 return err;
3918 }
3919
3920 static int selinux_shm_shmat(struct shmid_kernel *shp,
3921 char __user *shmaddr, int shmflg)
3922 {
3923 u32 perms;
3924 int rc;
3925
3926 rc = secondary_ops->shm_shmat(shp, shmaddr, shmflg);
3927 if (rc)
3928 return rc;
3929
3930 if (shmflg & SHM_RDONLY)
3931 perms = SHM__READ;
3932 else
3933 perms = SHM__READ | SHM__WRITE;
3934
3935 return ipc_has_perm(&shp->shm_perm, SECCLASS_SHM, perms);
3936 }
3937
3938 /* Semaphore security operations */
3939 static int selinux_sem_alloc_security(struct sem_array *sma)
3940 {
3941 struct task_security_struct *tsec;
3942 struct ipc_security_struct *isec;
3943 struct avc_audit_data ad;
3944 int rc;
3945
3946 rc = ipc_alloc_security(current, &sma->sem_perm, SECCLASS_SEM);
3947 if (rc)
3948 return rc;
3949
3950 tsec = current->security;
3951 isec = sma->sem_perm.security;
3952
3953 AVC_AUDIT_DATA_INIT(&ad, IPC);
3954 ad.u.ipc_id = sma->sem_perm.key;
3955
3956 rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_SEM,
3957 SEM__CREATE, &isec->avcr, &ad);
3958 if (rc) {
3959 ipc_free_security(&sma->sem_perm);
3960 return rc;
3961 }
3962 return 0;
3963 }
3964
3965 static void selinux_sem_free_security(struct sem_array *sma)
3966 {
3967 ipc_free_security(&sma->sem_perm);
3968 }
3969
3970 static int selinux_sem_associate(struct sem_array *sma, int semflg)
3971 {
3972 struct task_security_struct *tsec;
3973 struct ipc_security_struct *isec;
3974 struct avc_audit_data ad;
3975
3976 tsec = current->security;
3977 isec = sma->sem_perm.security;
3978
3979 AVC_AUDIT_DATA_INIT(&ad, IPC);
3980 ad.u.ipc_id = sma->sem_perm.key;
3981
3982 return avc_has_perm(tsec->sid, isec->sid, SECCLASS_SEM,
3983 SEM__ASSOCIATE, &isec->avcr, &ad);
3984 }
3985
3986 /* Note, at this point, sma is locked down */
3987 static int selinux_sem_semctl(struct sem_array *sma, int cmd)
3988 {
3989 int err;
3990 u32 perms;
3991
3992 switch(cmd) {
3993 case IPC_INFO:
3994 case SEM_INFO:
3995 /* No specific object, just general system-wide information. */
3996 return task_has_system(current, SYSTEM__IPC_INFO);
3997 case GETPID:
3998 case GETNCNT:
3999 case GETZCNT:
4000 perms = SEM__GETATTR;
4001 break;
4002 case GETVAL:
4003 case GETALL:
4004 perms = SEM__READ;
4005 break;
4006 case SETVAL:
4007 case SETALL:
4008 perms = SEM__WRITE;
4009 break;
4010 case IPC_RMID:
4011 perms = SEM__DESTROY;
4012 break;
4013 case IPC_SET:
4014 perms = SEM__SETATTR;
4015 break;
4016 case IPC_STAT:
4017 case SEM_STAT:
4018 perms = SEM__GETATTR | SEM__ASSOCIATE;
4019 break;
4020 default:
4021 return 0;
4022 }
4023
4024 err = ipc_has_perm(&sma->sem_perm, SECCLASS_SEM, perms);
4025 return err;
4026 }
4027
4028 static int selinux_sem_semop(struct sem_array *sma,
4029 struct sembuf *sops, unsigned nsops, int alter)
4030 {
4031 u32 perms;
4032
4033 if (alter)
4034 perms = SEM__READ | SEM__WRITE;
4035 else
4036 perms = SEM__READ;
4037
4038 return ipc_has_perm(&sma->sem_perm, SECCLASS_SEM, perms);
4039 }
4040
4041 static int selinux_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
4042 {
4043 struct ipc_security_struct *isec = ipcp->security;
4044 u16 sclass = SECCLASS_IPC;
4045 u32 av = 0;
4046
4047 if (isec && isec->magic == SELINUX_MAGIC)
4048 sclass = isec->sclass;
4049
4050 av = 0;
4051 if (flag & S_IRUGO)
4052 av |= IPC__UNIX_READ;
4053 if (flag & S_IWUGO)
4054 av |= IPC__UNIX_WRITE;
4055
4056 if (av == 0)
4057 return 0;
4058
4059 return ipc_has_perm(ipcp, sclass, av);
4060 }
4061
4062 /* module stacking operations */
4063 int selinux_register_security (const char *name, struct security_operations *ops)
4064 {
4065 if (secondary_ops != original_ops) {
4066 printk(KERN_INFO "%s: There is already a secondary security "
4067 "module registered.\n", __FUNCTION__);
4068 return -EINVAL;
4069 }
4070
4071 secondary_ops = ops;
4072
4073 printk(KERN_INFO "%s: Registering secondary module %s\n",
4074 __FUNCTION__,
4075 name);
4076
4077 return 0;
4078 }
4079
4080 int selinux_unregister_security (const char *name, struct security_operations *ops)
4081 {
4082 if (ops != secondary_ops) {
4083 printk (KERN_INFO "%s: trying to unregister a security module "
4084 "that is not registered.\n", __FUNCTION__);
4085 return -EINVAL;
4086 }
4087
4088 secondary_ops = original_ops;
4089
4090 return 0;
4091 }
4092
4093 static void selinux_d_instantiate (struct dentry *dentry, struct inode *inode)
4094 {
4095 if (inode)
4096 inode_doinit_with_dentry(inode, dentry);
4097 }
4098
4099 static int selinux_getprocattr(struct task_struct *p,
4100 char *name, void *value, size_t size)
4101 {
4102 struct task_security_struct *tsec;
4103 u32 sid, len;
4104 char *context;
4105 int error;
4106
4107 if (current != p) {
4108 error = task_has_perm(current, p, PROCESS__GETATTR);
4109 if (error)
4110 return error;
4111 }
4112
4113 if (!size)
4114 return -ERANGE;
4115
4116 tsec = p->security;
4117
4118 if (!strcmp(name, "current"))
4119 sid = tsec->sid;
4120 else if (!strcmp(name, "prev"))
4121 sid = tsec->osid;
4122 else if (!strcmp(name, "exec"))
4123 sid = tsec->exec_sid;
4124 else if (!strcmp(name, "fscreate"))
4125 sid = tsec->create_sid;
4126 else
4127 return -EINVAL;
4128
4129 if (!sid)
4130 return 0;
4131
4132 error = security_sid_to_context(sid, &context, &len);
4133 if (error)
4134 return error;
4135 if (len > size) {
4136 kfree(context);
4137 return -ERANGE;
4138 }
4139 memcpy(value, context, len);
4140 kfree(context);
4141 return len;
4142 }
4143
4144 static int selinux_setprocattr(struct task_struct *p,
4145 char *name, void *value, size_t size)
4146 {
4147 struct task_security_struct *tsec;
4148 u32 sid = 0;
4149 int error;
4150
4151 if (current != p || !strcmp(name, "current")) {
4152 /* SELinux only allows a process to change its own
4153 security attributes, and it only allows the process
4154 current SID to change via exec. */
4155 return -EACCES;
4156 }
4157
4158 /*
4159 * Basic control over ability to set these attributes at all.
4160 * current == p, but we'll pass them separately in case the
4161 * above restriction is ever removed.
4162 */
4163 if (!strcmp(name, "exec"))
4164 error = task_has_perm(current, p, PROCESS__SETEXEC);
4165 else if (!strcmp(name, "fscreate"))
4166 error = task_has_perm(current, p, PROCESS__SETFSCREATE);
4167 else
4168 error = -EINVAL;
4169 if (error)
4170 return error;
4171
4172 /* Obtain a SID for the context, if one was specified. */
4173 if (size) {
4174 int error;
4175 error = security_context_to_sid(value, size, &sid);
4176 if (error)
4177 return error;
4178 }
4179
4180 /* Permission checking based on the specified context is
4181 performed during the actual operation (execve,
4182 open/mkdir/...), when we know the full context of the
4183 operation. See selinux_bprm_set_security for the execve
4184 checks and may_create for the file creation checks. The
4185 operation will then fail if the context is not permitted. */
4186 tsec = p->security;
4187 if (!strcmp(name, "exec"))
4188 tsec->exec_sid = sid;
4189 else if (!strcmp(name, "fscreate"))
4190 tsec->create_sid = sid;
4191 else
4192 return -EINVAL;
4193
4194 return size;
4195 }
4196
4197 struct security_operations selinux_ops = {
4198 .ptrace = selinux_ptrace,
4199 .capget = selinux_capget,
4200 .capset_check = selinux_capset_check,
4201 .capset_set = selinux_capset_set,
4202 .sysctl = selinux_sysctl,
4203 .capable = selinux_capable,
4204 .quotactl = selinux_quotactl,
4205 .quota_on = selinux_quota_on,
4206 .syslog = selinux_syslog,
4207 .vm_enough_memory = selinux_vm_enough_memory,
4208
4209 .netlink_send = selinux_netlink_send,
4210 .netlink_recv = selinux_netlink_recv,
4211
4212 .bprm_alloc_security = selinux_bprm_alloc_security,
4213 .bprm_free_security = selinux_bprm_free_security,
4214 .bprm_apply_creds = selinux_bprm_apply_creds,
4215 .bprm_set_security = selinux_bprm_set_security,
4216 .bprm_check_security = selinux_bprm_check_security,
4217 .bprm_secureexec = selinux_bprm_secureexec,
4218
4219 .sb_alloc_security = selinux_sb_alloc_security,
4220 .sb_free_security = selinux_sb_free_security,
4221 .sb_copy_data = selinux_sb_copy_data,
4222 .sb_kern_mount = selinux_sb_kern_mount,
4223 .sb_statfs = selinux_sb_statfs,
4224 .sb_mount = selinux_mount,
4225 .sb_umount = selinux_umount,
4226
4227 .inode_alloc_security = selinux_inode_alloc_security,
4228 .inode_free_security = selinux_inode_free_security,
4229 .inode_create = selinux_inode_create,
4230 .inode_post_create = selinux_inode_post_create,
4231 .inode_link = selinux_inode_link,
4232 .inode_post_link = selinux_inode_post_link,
4233 .inode_unlink = selinux_inode_unlink,
4234 .inode_symlink = selinux_inode_symlink,
4235 .inode_post_symlink = selinux_inode_post_symlink,
4236 .inode_mkdir = selinux_inode_mkdir,
4237 .inode_post_mkdir = selinux_inode_post_mkdir,
4238 .inode_rmdir = selinux_inode_rmdir,
4239 .inode_mknod = selinux_inode_mknod,
4240 .inode_post_mknod = selinux_inode_post_mknod,
4241 .inode_rename = selinux_inode_rename,
4242 .inode_post_rename = selinux_inode_post_rename,
4243 .inode_readlink = selinux_inode_readlink,
4244 .inode_follow_link = selinux_inode_follow_link,
4245 .inode_permission = selinux_inode_permission,
4246 .inode_setattr = selinux_inode_setattr,
4247 .inode_getattr = selinux_inode_getattr,
4248 .inode_setxattr = selinux_inode_setxattr,
4249 .inode_post_setxattr = selinux_inode_post_setxattr,
4250 .inode_getxattr = selinux_inode_getxattr,
4251 .inode_listxattr = selinux_inode_listxattr,
4252 .inode_removexattr = selinux_inode_removexattr,
4253 .inode_getsecurity = selinux_inode_getsecurity,
4254 .inode_setsecurity = selinux_inode_setsecurity,
4255 .inode_listsecurity = selinux_inode_listsecurity,
4256
4257 .file_permission = selinux_file_permission,
4258 .file_alloc_security = selinux_file_alloc_security,
4259 .file_free_security = selinux_file_free_security,
4260 .file_ioctl = selinux_file_ioctl,
4261 .file_mmap = selinux_file_mmap,
4262 .file_mprotect = selinux_file_mprotect,
4263 .file_lock = selinux_file_lock,
4264 .file_fcntl = selinux_file_fcntl,
4265 .file_set_fowner = selinux_file_set_fowner,
4266 .file_send_sigiotask = selinux_file_send_sigiotask,
4267 .file_receive = selinux_file_receive,
4268
4269 .task_create = selinux_task_create,
4270 .task_alloc_security = selinux_task_alloc_security,
4271 .task_free_security = selinux_task_free_security,
4272 .task_setuid = selinux_task_setuid,
4273 .task_post_setuid = selinux_task_post_setuid,
4274 .task_setgid = selinux_task_setgid,
4275 .task_setpgid = selinux_task_setpgid,
4276 .task_getpgid = selinux_task_getpgid,
4277 .task_getsid = selinux_task_getsid,
4278 .task_setgroups = selinux_task_setgroups,
4279 .task_setnice = selinux_task_setnice,
4280 .task_setrlimit = selinux_task_setrlimit,
4281 .task_setscheduler = selinux_task_setscheduler,
4282 .task_getscheduler = selinux_task_getscheduler,
4283 .task_kill = selinux_task_kill,
4284 .task_wait = selinux_task_wait,
4285 .task_prctl = selinux_task_prctl,
4286 .task_reparent_to_init = selinux_task_reparent_to_init,
4287 .task_to_inode = selinux_task_to_inode,
4288
4289 .ipc_permission = selinux_ipc_permission,
4290
4291 .msg_msg_alloc_security = selinux_msg_msg_alloc_security,
4292 .msg_msg_free_security = selinux_msg_msg_free_security,
4293
4294 .msg_queue_alloc_security = selinux_msg_queue_alloc_security,
4295 .msg_queue_free_security = selinux_msg_queue_free_security,
4296 .msg_queue_associate = selinux_msg_queue_associate,
4297 .msg_queue_msgctl = selinux_msg_queue_msgctl,
4298 .msg_queue_msgsnd = selinux_msg_queue_msgsnd,
4299 .msg_queue_msgrcv = selinux_msg_queue_msgrcv,
4300
4301 .shm_alloc_security = selinux_shm_alloc_security,
4302 .shm_free_security = selinux_shm_free_security,
4303 .shm_associate = selinux_shm_associate,
4304 .shm_shmctl = selinux_shm_shmctl,
4305 .shm_shmat = selinux_shm_shmat,
4306
4307 .sem_alloc_security = selinux_sem_alloc_security,
4308 .sem_free_security = selinux_sem_free_security,
4309 .sem_associate = selinux_sem_associate,
4310 .sem_semctl = selinux_sem_semctl,
4311 .sem_semop = selinux_sem_semop,
4312
4313 .register_security = selinux_register_security,
4314 .unregister_security = selinux_unregister_security,
4315
4316 .d_instantiate = selinux_d_instantiate,
4317
4318 .getprocattr = selinux_getprocattr,
4319 .setprocattr = selinux_setprocattr,
4320
4321 #ifdef CONFIG_SECURITY_NETWORK
4322 .unix_stream_connect = selinux_socket_unix_stream_connect,
4323 .unix_may_send = selinux_socket_unix_may_send,
4324
4325 .socket_create = selinux_socket_create,
4326 .socket_post_create = selinux_socket_post_create,
4327 .socket_bind = selinux_socket_bind,
4328 .socket_connect = selinux_socket_connect,
4329 .socket_listen = selinux_socket_listen,
4330 .socket_accept = selinux_socket_accept,
4331 .socket_sendmsg = selinux_socket_sendmsg,
4332 .socket_recvmsg = selinux_socket_recvmsg,
4333 .socket_getsockname = selinux_socket_getsockname,
4334 .socket_getpeername = selinux_socket_getpeername,
4335 .socket_getsockopt = selinux_socket_getsockopt,
4336 .socket_setsockopt = selinux_socket_setsockopt,
4337 .socket_shutdown = selinux_socket_shutdown,
4338 .socket_sock_rcv_skb = selinux_socket_sock_rcv_skb,
4339 .socket_getpeersec = selinux_socket_getpeersec,
4340 .sk_alloc_security = selinux_sk_alloc_security,
4341 .sk_free_security = selinux_sk_free_security,
4342 #endif
4343 };
4344
4345 __init int selinux_init(void)
4346 {
4347 struct task_security_struct *tsec;
4348
4349 if (!selinux_enabled) {
4350 printk(KERN_INFO "SELinux: Disabled at boot.\n");
4351 return 0;
4352 }
4353
4354 printk(KERN_INFO "SELinux: Initializing.\n");
4355
4356 /* Set the security state for the initial task. */
4357 if (task_alloc_security(current))
4358 panic("SELinux: Failed to initialize initial task.\n");
4359 tsec = current->security;
4360 tsec->osid = tsec->sid = SECINITSID_KERNEL;
4361
4362 avc_init();
4363
4364 original_ops = secondary_ops = security_ops;
4365 if (!secondary_ops)
4366 panic ("SELinux: No initial security operations\n");
4367 if (register_security (&selinux_ops))
4368 panic("SELinux: Unable to register with kernel.\n");
4369
4370 if (selinux_enforcing) {
4371 printk(KERN_INFO "SELinux: Starting in enforcing mode\n");
4372 } else {
4373 printk(KERN_INFO "SELinux: Starting in permissive mode\n");
4374 }
4375 return 0;
4376 }
4377
4378 void selinux_complete_init(void)
4379 {
4380 printk(KERN_INFO "SELinux: Completing initialization.\n");
4381
4382 /* Set up any superblocks initialized prior to the policy load. */
4383 printk(KERN_INFO "SELinux: Setting up existing superblocks.\n");
4384 spin_lock(&sb_security_lock);
4385 next_sb:
4386 if (!list_empty(&superblock_security_head)) {
4387 struct superblock_security_struct *sbsec =
4388 list_entry(superblock_security_head.next,
4389 struct superblock_security_struct,
4390 list);
4391 struct super_block *sb = sbsec->sb;
4392 spin_lock(&sb_lock);
4393 sb->s_count++;
4394 spin_unlock(&sb_lock);
4395 spin_unlock(&sb_security_lock);
4396 down_read(&sb->s_umount);
4397 if (sb->s_root)
4398 superblock_doinit(sb, NULL);
4399 drop_super(sb);
4400 spin_lock(&sb_security_lock);
4401 list_del_init(&sbsec->list);
4402 goto next_sb;
4403 }
4404 spin_unlock(&sb_security_lock);
4405 }
4406
4407 /* SELinux requires early initialization in order to label
4408 all processes and objects when they are created. */
4409 security_initcall(selinux_init);
4410
4411 #if defined(CONFIG_SECURITY_NETWORK) && defined(CONFIG_NETFILTER)
4412
4413 static struct nf_hook_ops selinux_ipv4_op = {
4414 .hook = selinux_ipv4_postroute_last,
4415 .owner = THIS_MODULE,
4416 .pf = PF_INET,
4417 .hooknum = NF_IP_POST_ROUTING,
4418 .priority = NF_IP_PRI_SELINUX_LAST,
4419 };
4420
4421 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4422
4423 static struct nf_hook_ops selinux_ipv6_op = {
4424 .hook = selinux_ipv6_postroute_last,
4425 .owner = THIS_MODULE,
4426 .pf = PF_INET6,
4427 .hooknum = NF_IP6_POST_ROUTING,
4428 .priority = NF_IP6_PRI_SELINUX_LAST,
4429 };
4430
4431 #endif /* IPV6 */
4432
4433 static int __init selinux_nf_ip_init(void)
4434 {
4435 int err = 0;
4436
4437 if (!selinux_enabled)
4438 goto out;
4439
4440 printk(KERN_INFO "SELinux: Registering netfilter hooks\n");
4441
4442 err = nf_register_hook(&selinux_ipv4_op);
4443 if (err)
4444 panic("SELinux: nf_register_hook for IPv4: error %d\n", err);
4445
4446 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4447
4448 err = nf_register_hook(&selinux_ipv6_op);
4449 if (err)
4450 panic("SELinux: nf_register_hook for IPv6: error %d\n", err);
4451
4452 #endif /* IPV6 */
4453 out:
4454 return err;
4455 }
4456
4457 __initcall(selinux_nf_ip_init);
4458
4459 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
4460 static void selinux_nf_ip_exit(void)
4461 {
4462 printk(KERN_INFO "SELinux: Unregistering netfilter hooks\n");
4463
4464 nf_unregister_hook(&selinux_ipv4_op);
4465 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4466 nf_unregister_hook(&selinux_ipv6_op);
4467 #endif /* IPV6 */
4468 }
4469 #endif
4470
4471 #else /* CONFIG_SECURITY_NETWORK && CONFIG_NETFILTER */
4472
4473 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
4474 #define selinux_nf_ip_exit()
4475 #endif
4476
4477 #endif /* CONFIG_SECURITY_NETWORK && CONFIG_NETFILTER */
4478
4479 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
4480 int selinux_disable(void)
4481 {
4482 extern void exit_sel_fs(void);
4483 static int selinux_disabled = 0;
4484
4485 if (ss_initialized) {
4486 /* Not permitted after initial policy load. */
4487 return -EINVAL;
4488 }
4489
4490 if (selinux_disabled) {
4491 /* Only do this once. */
4492 return -EINVAL;
4493 }
4494
4495 printk(KERN_INFO "SELinux: Disabled at runtime.\n");
4496
4497 selinux_disabled = 1;
4498
4499 /* Reset security_ops to the secondary module, dummy or capability. */
4500 security_ops = secondary_ops;
4501
4502 /* Unregister netfilter hooks. */
4503 selinux_nf_ip_exit();
4504
4505 /* Unregister selinuxfs. */
4506 exit_sel_fs();
4507
4508 return 0;
4509 }
4510 #endif
4511
4512
MOXA 2.6.9 from sdlinux-moxaart.tgz