2 * NSA Security-Enhanced Linux (SELinux) security module
4 * This file contains the SELinux hook function implementations.
6 * Authors: Stephen Smalley, <sds@epoch.ncsc.mil>
7 * Chris Vance, <cvance@nai.com>
8 * Wayne Salamon, <wsalamon@nai.com>
9 * James Morris <jmorris@redhat.com>
11 * Copyright (C) 2001,2002 Networks Associates Technology, Inc.
12 * Copyright (C) 2003 Red Hat, Inc., James Morris <jmorris@redhat.com>
13 * Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
14 * <dgoeddel@trustedcs.com>
16 * This program is free software; you can redistribute it and/or modify
17 * it under the terms of the GNU General Public License version 2,
18 * as published by the Free Software Foundation.
21 #include <linux/config.h>
22 #include <linux/module.h>
23 #include <linux/init.h>
24 #include <linux/kernel.h>
25 #include <linux/ptrace.h>
26 #include <linux/errno.h>
27 #include <linux/sched.h>
28 #include <linux/security.h>
29 #include <linux/xattr.h>
30 #include <linux/capability.h>
31 #include <linux/unistd.h>
33 #include <linux/mman.h>
34 #include <linux/slab.h>
35 #include <linux/pagemap.h>
36 #include <linux/swap.h>
37 #include <linux/smp_lock.h>
38 #include <linux/spinlock.h>
39 #include <linux/syscalls.h>
40 #include <linux/file.h>
41 #include <linux/namei.h>
42 #include <linux/mount.h>
43 #include <linux/ext2_fs.h>
44 #include <linux/proc_fs.h>
46 #include <linux/netfilter_ipv4.h>
47 #include <linux/netfilter_ipv6.h>
48 #include <linux/tty.h>
50 #include <net/ip.h> /* for sysctl_local_port_range[] */
51 #include <net/tcp.h> /* struct or_callable used in sock_rcv_skb */
52 #include <asm/uaccess.h>
53 #include <asm/semaphore.h>
54 #include <asm/ioctls.h>
55 #include <linux/bitops.h>
56 #include <linux/interrupt.h>
57 #include <linux/netdevice.h> /* for network interface checks */
58 #include <linux/netlink.h>
59 #include <linux/tcp.h>
60 #include <linux/udp.h>
61 #include <linux/quota.h>
62 #include <linux/un.h> /* for Unix socket types */
63 #include <net/af_unix.h> /* for Unix socket types */
64 #include <linux/parser.h>
65 #include <linux/nfs_mount.h>
67 #include <linux/hugetlb.h>
68 #include <linux/personality.h>
69 #include <linux/sysctl.h>
70 #include <linux/audit.h>
71 #include <linux/string.h>
78 #define XATTR_SELINUX_SUFFIX "selinux"
79 #define XATTR_NAME_SELINUX XATTR_SECURITY_PREFIX XATTR_SELINUX_SUFFIX
81 extern unsigned int policydb_loaded_version
;
82 extern int selinux_nlmsg_lookup(u16 sclass
, u16 nlmsg_type
, u32
*perm
);
84 #ifdef CONFIG_SECURITY_SELINUX_DEVELOP
85 int selinux_enforcing
= 0;
87 static int __init
enforcing_setup(char *str
)
89 selinux_enforcing
= simple_strtol(str
,NULL
,0);
92 __setup("enforcing=", enforcing_setup
);
95 #ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
96 int selinux_enabled
= CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE
;
98 static int __init
selinux_enabled_setup(char *str
)
100 selinux_enabled
= simple_strtol(str
, NULL
, 0);
103 __setup("selinux=", selinux_enabled_setup
);
106 /* Original (dummy) security module. */
107 static struct security_operations
*original_ops
= NULL
;
109 /* Minimal support for a secondary security module,
110 just to allow the use of the dummy or capability modules.
111 The owlsm module can alternatively be used as a secondary
112 module as long as CONFIG_OWLSM_FD is not enabled. */
113 static struct security_operations
*secondary_ops
= NULL
;
115 /* Lists of inode and superblock security structures initialized
116 before the policy was loaded. */
117 static LIST_HEAD(superblock_security_head
);
118 static DEFINE_SPINLOCK(sb_security_lock
);
120 static kmem_cache_t
*sel_inode_cache
;
122 /* Return security context for a given sid or just the context
123 length if the buffer is null or length is 0 */
124 static int selinux_getsecurity(u32 sid
, void *buffer
, size_t size
)
130 rc
= security_sid_to_context(sid
, &context
, &len
);
134 if (!buffer
|| !size
)
135 goto getsecurity_exit
;
139 goto getsecurity_exit
;
141 memcpy(buffer
, context
, len
);
148 /* Allocate and free functions for each kind of security blob. */
150 static int task_alloc_security(struct task_struct
*task
)
152 struct task_security_struct
*tsec
;
154 tsec
= kzalloc(sizeof(struct task_security_struct
), GFP_KERNEL
);
159 tsec
->osid
= tsec
->sid
= tsec
->ptrace_sid
= SECINITSID_UNLABELED
;
160 task
->security
= tsec
;
165 static void task_free_security(struct task_struct
*task
)
167 struct task_security_struct
*tsec
= task
->security
;
168 task
->security
= NULL
;
172 static int inode_alloc_security(struct inode
*inode
)
174 struct task_security_struct
*tsec
= current
->security
;
175 struct inode_security_struct
*isec
;
177 isec
= kmem_cache_alloc(sel_inode_cache
, SLAB_KERNEL
);
181 memset(isec
, 0, sizeof(*isec
));
182 init_MUTEX(&isec
->sem
);
183 INIT_LIST_HEAD(&isec
->list
);
185 isec
->sid
= SECINITSID_UNLABELED
;
186 isec
->sclass
= SECCLASS_FILE
;
187 isec
->task_sid
= tsec
->sid
;
188 inode
->i_security
= isec
;
193 static void inode_free_security(struct inode
*inode
)
195 struct inode_security_struct
*isec
= inode
->i_security
;
196 struct superblock_security_struct
*sbsec
= inode
->i_sb
->s_security
;
198 spin_lock(&sbsec
->isec_lock
);
199 if (!list_empty(&isec
->list
))
200 list_del_init(&isec
->list
);
201 spin_unlock(&sbsec
->isec_lock
);
203 inode
->i_security
= NULL
;
204 kmem_cache_free(sel_inode_cache
, isec
);
207 static int file_alloc_security(struct file
*file
)
209 struct task_security_struct
*tsec
= current
->security
;
210 struct file_security_struct
*fsec
;
212 fsec
= kzalloc(sizeof(struct file_security_struct
), GFP_KERNEL
);
217 fsec
->sid
= tsec
->sid
;
218 fsec
->fown_sid
= tsec
->sid
;
219 file
->f_security
= fsec
;
224 static void file_free_security(struct file
*file
)
226 struct file_security_struct
*fsec
= file
->f_security
;
227 file
->f_security
= NULL
;
231 static int superblock_alloc_security(struct super_block
*sb
)
233 struct superblock_security_struct
*sbsec
;
235 sbsec
= kzalloc(sizeof(struct superblock_security_struct
), GFP_KERNEL
);
239 init_MUTEX(&sbsec
->sem
);
240 INIT_LIST_HEAD(&sbsec
->list
);
241 INIT_LIST_HEAD(&sbsec
->isec_head
);
242 spin_lock_init(&sbsec
->isec_lock
);
244 sbsec
->sid
= SECINITSID_UNLABELED
;
245 sbsec
->def_sid
= SECINITSID_FILE
;
246 sb
->s_security
= sbsec
;
251 static void superblock_free_security(struct super_block
*sb
)
253 struct superblock_security_struct
*sbsec
= sb
->s_security
;
255 spin_lock(&sb_security_lock
);
256 if (!list_empty(&sbsec
->list
))
257 list_del_init(&sbsec
->list
);
258 spin_unlock(&sb_security_lock
);
260 sb
->s_security
= NULL
;
264 static int sk_alloc_security(struct sock
*sk
, int family
, gfp_t priority
)
266 struct sk_security_struct
*ssec
;
268 if (family
!= PF_UNIX
)
271 ssec
= kzalloc(sizeof(*ssec
), priority
);
276 ssec
->peer_sid
= SECINITSID_UNLABELED
;
277 sk
->sk_security
= ssec
;
282 static void sk_free_security(struct sock
*sk
)
284 struct sk_security_struct
*ssec
= sk
->sk_security
;
286 if (sk
->sk_family
!= PF_UNIX
)
289 sk
->sk_security
= NULL
;
293 /* The security server must be initialized before
294 any labeling or access decisions can be provided. */
295 extern int ss_initialized
;
297 /* The file system's label must be initialized prior to use. */
299 static char *labeling_behaviors
[6] = {
301 "uses transition SIDs",
303 "uses genfs_contexts",
304 "not configured for labeling",
305 "uses mountpoint labeling",
308 static int inode_doinit_with_dentry(struct inode
*inode
, struct dentry
*opt_dentry
);
310 static inline int inode_doinit(struct inode
*inode
)
312 return inode_doinit_with_dentry(inode
, NULL
);
321 static match_table_t tokens
= {
322 {Opt_context
, "context=%s"},
323 {Opt_fscontext
, "fscontext=%s"},
324 {Opt_defcontext
, "defcontext=%s"},
327 #define SEL_MOUNT_FAIL_MSG "SELinux: duplicate or incompatible mount options\n"
329 static int try_context_mount(struct super_block
*sb
, void *data
)
331 char *context
= NULL
, *defcontext
= NULL
;
334 int alloc
= 0, rc
= 0, seen
= 0;
335 struct task_security_struct
*tsec
= current
->security
;
336 struct superblock_security_struct
*sbsec
= sb
->s_security
;
341 name
= sb
->s_type
->name
;
343 if (sb
->s_type
->fs_flags
& FS_BINARY_MOUNTDATA
) {
345 /* NFS we understand. */
346 if (!strcmp(name
, "nfs")) {
347 struct nfs_mount_data
*d
= data
;
349 if (d
->version
< NFS_MOUNT_VERSION
)
353 context
= d
->context
;
360 /* Standard string-based options. */
361 char *p
, *options
= data
;
363 while ((p
= strsep(&options
, ",")) != NULL
) {
365 substring_t args
[MAX_OPT_ARGS
];
370 token
= match_token(p
, tokens
, args
);
376 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG
);
379 context
= match_strdup(&args
[0]);
390 if (seen
& (Opt_context
|Opt_fscontext
)) {
392 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG
);
395 context
= match_strdup(&args
[0]);
402 seen
|= Opt_fscontext
;
406 if (sbsec
->behavior
!= SECURITY_FS_USE_XATTR
) {
408 printk(KERN_WARNING
"SELinux: "
409 "defcontext option is invalid "
410 "for this filesystem type\n");
413 if (seen
& (Opt_context
|Opt_defcontext
)) {
415 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG
);
418 defcontext
= match_strdup(&args
[0]);
425 seen
|= Opt_defcontext
;
430 printk(KERN_WARNING
"SELinux: unknown mount "
442 rc
= security_context_to_sid(context
, strlen(context
), &sid
);
444 printk(KERN_WARNING
"SELinux: security_context_to_sid"
445 "(%s) failed for (dev %s, type %s) errno=%d\n",
446 context
, sb
->s_id
, name
, rc
);
450 rc
= avc_has_perm(tsec
->sid
, sbsec
->sid
, SECCLASS_FILESYSTEM
,
451 FILESYSTEM__RELABELFROM
, NULL
);
455 rc
= avc_has_perm(tsec
->sid
, sid
, SECCLASS_FILESYSTEM
,
456 FILESYSTEM__RELABELTO
, NULL
);
462 if (seen
& Opt_context
)
463 sbsec
->behavior
= SECURITY_FS_USE_MNTPOINT
;
467 rc
= security_context_to_sid(defcontext
, strlen(defcontext
), &sid
);
469 printk(KERN_WARNING
"SELinux: security_context_to_sid"
470 "(%s) failed for (dev %s, type %s) errno=%d\n",
471 defcontext
, sb
->s_id
, name
, rc
);
475 if (sid
== sbsec
->def_sid
)
478 rc
= avc_has_perm(tsec
->sid
, sbsec
->sid
, SECCLASS_FILESYSTEM
,
479 FILESYSTEM__RELABELFROM
, NULL
);
483 rc
= avc_has_perm(sid
, sbsec
->sid
, SECCLASS_FILESYSTEM
,
484 FILESYSTEM__ASSOCIATE
, NULL
);
488 sbsec
->def_sid
= sid
;
500 static int superblock_doinit(struct super_block
*sb
, void *data
)
502 struct superblock_security_struct
*sbsec
= sb
->s_security
;
503 struct dentry
*root
= sb
->s_root
;
504 struct inode
*inode
= root
->d_inode
;
508 if (sbsec
->initialized
)
511 if (!ss_initialized
) {
512 /* Defer initialization until selinux_complete_init,
513 after the initial policy is loaded and the security
514 server is ready to handle calls. */
515 spin_lock(&sb_security_lock
);
516 if (list_empty(&sbsec
->list
))
517 list_add(&sbsec
->list
, &superblock_security_head
);
518 spin_unlock(&sb_security_lock
);
522 /* Determine the labeling behavior to use for this filesystem type. */
523 rc
= security_fs_use(sb
->s_type
->name
, &sbsec
->behavior
, &sbsec
->sid
);
525 printk(KERN_WARNING
"%s: security_fs_use(%s) returned %d\n",
526 __FUNCTION__
, sb
->s_type
->name
, rc
);
530 rc
= try_context_mount(sb
, data
);
534 if (sbsec
->behavior
== SECURITY_FS_USE_XATTR
) {
535 /* Make sure that the xattr handler exists and that no
536 error other than -ENODATA is returned by getxattr on
537 the root directory. -ENODATA is ok, as this may be
538 the first boot of the SELinux kernel before we have
539 assigned xattr values to the filesystem. */
540 if (!inode
->i_op
->getxattr
) {
541 printk(KERN_WARNING
"SELinux: (dev %s, type %s) has no "
542 "xattr support\n", sb
->s_id
, sb
->s_type
->name
);
546 rc
= inode
->i_op
->getxattr(root
, XATTR_NAME_SELINUX
, NULL
, 0);
547 if (rc
< 0 && rc
!= -ENODATA
) {
548 if (rc
== -EOPNOTSUPP
)
549 printk(KERN_WARNING
"SELinux: (dev %s, type "
550 "%s) has no security xattr handler\n",
551 sb
->s_id
, sb
->s_type
->name
);
553 printk(KERN_WARNING
"SELinux: (dev %s, type "
554 "%s) getxattr errno %d\n", sb
->s_id
,
555 sb
->s_type
->name
, -rc
);
560 if (strcmp(sb
->s_type
->name
, "proc") == 0)
563 sbsec
->initialized
= 1;
565 if (sbsec
->behavior
> ARRAY_SIZE(labeling_behaviors
)) {
566 printk(KERN_INFO
"SELinux: initialized (dev %s, type %s), unknown behavior\n",
567 sb
->s_id
, sb
->s_type
->name
);
570 printk(KERN_INFO
"SELinux: initialized (dev %s, type %s), %s\n",
571 sb
->s_id
, sb
->s_type
->name
,
572 labeling_behaviors
[sbsec
->behavior
-1]);
575 /* Initialize the root inode. */
576 rc
= inode_doinit_with_dentry(sb
->s_root
->d_inode
, sb
->s_root
);
578 /* Initialize any other inodes associated with the superblock, e.g.
579 inodes created prior to initial policy load or inodes created
580 during get_sb by a pseudo filesystem that directly
582 spin_lock(&sbsec
->isec_lock
);
584 if (!list_empty(&sbsec
->isec_head
)) {
585 struct inode_security_struct
*isec
=
586 list_entry(sbsec
->isec_head
.next
,
587 struct inode_security_struct
, list
);
588 struct inode
*inode
= isec
->inode
;
589 spin_unlock(&sbsec
->isec_lock
);
590 inode
= igrab(inode
);
592 if (!IS_PRIVATE (inode
))
596 spin_lock(&sbsec
->isec_lock
);
597 list_del_init(&isec
->list
);
600 spin_unlock(&sbsec
->isec_lock
);
606 static inline u16
inode_mode_to_security_class(umode_t mode
)
608 switch (mode
& S_IFMT
) {
610 return SECCLASS_SOCK_FILE
;
612 return SECCLASS_LNK_FILE
;
614 return SECCLASS_FILE
;
616 return SECCLASS_BLK_FILE
;
620 return SECCLASS_CHR_FILE
;
622 return SECCLASS_FIFO_FILE
;
626 return SECCLASS_FILE
;
629 static inline int default_protocol_stream(int protocol
)
631 return (protocol
== IPPROTO_IP
|| protocol
== IPPROTO_TCP
);
634 static inline int default_protocol_dgram(int protocol
)
636 return (protocol
== IPPROTO_IP
|| protocol
== IPPROTO_UDP
);
639 static inline u16
socket_type_to_security_class(int family
, int type
, int protocol
)
646 return SECCLASS_UNIX_STREAM_SOCKET
;
648 return SECCLASS_UNIX_DGRAM_SOCKET
;
655 if (default_protocol_stream(protocol
))
656 return SECCLASS_TCP_SOCKET
;
658 return SECCLASS_RAWIP_SOCKET
;
660 if (default_protocol_dgram(protocol
))
661 return SECCLASS_UDP_SOCKET
;
663 return SECCLASS_RAWIP_SOCKET
;
665 return SECCLASS_RAWIP_SOCKET
;
671 return SECCLASS_NETLINK_ROUTE_SOCKET
;
672 case NETLINK_FIREWALL
:
673 return SECCLASS_NETLINK_FIREWALL_SOCKET
;
674 case NETLINK_INET_DIAG
:
675 return SECCLASS_NETLINK_TCPDIAG_SOCKET
;
677 return SECCLASS_NETLINK_NFLOG_SOCKET
;
679 return SECCLASS_NETLINK_XFRM_SOCKET
;
680 case NETLINK_SELINUX
:
681 return SECCLASS_NETLINK_SELINUX_SOCKET
;
683 return SECCLASS_NETLINK_AUDIT_SOCKET
;
685 return SECCLASS_NETLINK_IP6FW_SOCKET
;
686 case NETLINK_DNRTMSG
:
687 return SECCLASS_NETLINK_DNRT_SOCKET
;
688 case NETLINK_KOBJECT_UEVENT
:
689 return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET
;
691 return SECCLASS_NETLINK_SOCKET
;
694 return SECCLASS_PACKET_SOCKET
;
696 return SECCLASS_KEY_SOCKET
;
699 return SECCLASS_SOCKET
;
702 #ifdef CONFIG_PROC_FS
703 static int selinux_proc_get_sid(struct proc_dir_entry
*de
,
708 char *buffer
, *path
, *end
;
710 buffer
= (char*)__get_free_page(GFP_KERNEL
);
720 while (de
&& de
!= de
->parent
) {
721 buflen
-= de
->namelen
+ 1;
725 memcpy(end
, de
->name
, de
->namelen
);
730 rc
= security_genfs_sid("proc", path
, tclass
, sid
);
731 free_page((unsigned long)buffer
);
735 static int selinux_proc_get_sid(struct proc_dir_entry
*de
,
743 /* The inode's security attributes must be initialized before first use. */
744 static int inode_doinit_with_dentry(struct inode
*inode
, struct dentry
*opt_dentry
)
746 struct superblock_security_struct
*sbsec
= NULL
;
747 struct inode_security_struct
*isec
= inode
->i_security
;
749 struct dentry
*dentry
;
750 #define INITCONTEXTLEN 255
751 char *context
= NULL
;
756 if (isec
->initialized
)
761 if (isec
->initialized
)
764 sbsec
= inode
->i_sb
->s_security
;
765 if (!sbsec
->initialized
) {
766 /* Defer initialization until selinux_complete_init,
767 after the initial policy is loaded and the security
768 server is ready to handle calls. */
769 spin_lock(&sbsec
->isec_lock
);
770 if (list_empty(&isec
->list
))
771 list_add(&isec
->list
, &sbsec
->isec_head
);
772 spin_unlock(&sbsec
->isec_lock
);
776 switch (sbsec
->behavior
) {
777 case SECURITY_FS_USE_XATTR
:
778 if (!inode
->i_op
->getxattr
) {
779 isec
->sid
= sbsec
->def_sid
;
783 /* Need a dentry, since the xattr API requires one.
784 Life would be simpler if we could just pass the inode. */
786 /* Called from d_instantiate or d_splice_alias. */
787 dentry
= dget(opt_dentry
);
789 /* Called from selinux_complete_init, try to find a dentry. */
790 dentry
= d_find_alias(inode
);
793 printk(KERN_WARNING
"%s: no dentry for dev=%s "
794 "ino=%ld\n", __FUNCTION__
, inode
->i_sb
->s_id
,
799 len
= INITCONTEXTLEN
;
800 context
= kmalloc(len
, GFP_KERNEL
);
806 rc
= inode
->i_op
->getxattr(dentry
, XATTR_NAME_SELINUX
,
809 /* Need a larger buffer. Query for the right size. */
810 rc
= inode
->i_op
->getxattr(dentry
, XATTR_NAME_SELINUX
,
818 context
= kmalloc(len
, GFP_KERNEL
);
824 rc
= inode
->i_op
->getxattr(dentry
,
830 if (rc
!= -ENODATA
) {
831 printk(KERN_WARNING
"%s: getxattr returned "
832 "%d for dev=%s ino=%ld\n", __FUNCTION__
,
833 -rc
, inode
->i_sb
->s_id
, inode
->i_ino
);
837 /* Map ENODATA to the default file SID */
838 sid
= sbsec
->def_sid
;
841 rc
= security_context_to_sid_default(context
, rc
, &sid
,
844 printk(KERN_WARNING
"%s: context_to_sid(%s) "
845 "returned %d for dev=%s ino=%ld\n",
846 __FUNCTION__
, context
, -rc
,
847 inode
->i_sb
->s_id
, inode
->i_ino
);
849 /* Leave with the unlabeled SID */
857 case SECURITY_FS_USE_TASK
:
858 isec
->sid
= isec
->task_sid
;
860 case SECURITY_FS_USE_TRANS
:
861 /* Default to the fs SID. */
862 isec
->sid
= sbsec
->sid
;
864 /* Try to obtain a transition SID. */
865 isec
->sclass
= inode_mode_to_security_class(inode
->i_mode
);
866 rc
= security_transition_sid(isec
->task_sid
,
875 /* Default to the fs SID. */
876 isec
->sid
= sbsec
->sid
;
879 struct proc_inode
*proci
= PROC_I(inode
);
881 isec
->sclass
= inode_mode_to_security_class(inode
->i_mode
);
882 rc
= selinux_proc_get_sid(proci
->pde
,
893 isec
->initialized
= 1;
896 if (isec
->sclass
== SECCLASS_FILE
)
897 isec
->sclass
= inode_mode_to_security_class(inode
->i_mode
);
904 /* Convert a Linux signal to an access vector. */
905 static inline u32
signal_to_av(int sig
)
911 /* Commonly granted from child to parent. */
912 perm
= PROCESS__SIGCHLD
;
915 /* Cannot be caught or ignored */
916 perm
= PROCESS__SIGKILL
;
919 /* Cannot be caught or ignored */
920 perm
= PROCESS__SIGSTOP
;
923 /* All other signals. */
924 perm
= PROCESS__SIGNAL
;
931 /* Check permission betweeen a pair of tasks, e.g. signal checks,
932 fork check, ptrace check, etc. */
933 static int task_has_perm(struct task_struct
*tsk1
,
934 struct task_struct
*tsk2
,
937 struct task_security_struct
*tsec1
, *tsec2
;
939 tsec1
= tsk1
->security
;
940 tsec2
= tsk2
->security
;
941 return avc_has_perm(tsec1
->sid
, tsec2
->sid
,
942 SECCLASS_PROCESS
, perms
, NULL
);
945 /* Check whether a task is allowed to use a capability. */
946 static int task_has_capability(struct task_struct
*tsk
,
949 struct task_security_struct
*tsec
;
950 struct avc_audit_data ad
;
952 tsec
= tsk
->security
;
954 AVC_AUDIT_DATA_INIT(&ad
,CAP
);
958 return avc_has_perm(tsec
->sid
, tsec
->sid
,
959 SECCLASS_CAPABILITY
, CAP_TO_MASK(cap
), &ad
);
962 /* Check whether a task is allowed to use a system operation. */
963 static int task_has_system(struct task_struct
*tsk
,
966 struct task_security_struct
*tsec
;
968 tsec
= tsk
->security
;
970 return avc_has_perm(tsec
->sid
, SECINITSID_KERNEL
,
971 SECCLASS_SYSTEM
, perms
, NULL
);
974 /* Check whether a task has a particular permission to an inode.
975 The 'adp' parameter is optional and allows other audit
976 data to be passed (e.g. the dentry). */
977 static int inode_has_perm(struct task_struct
*tsk
,
980 struct avc_audit_data
*adp
)
982 struct task_security_struct
*tsec
;
983 struct inode_security_struct
*isec
;
984 struct avc_audit_data ad
;
986 tsec
= tsk
->security
;
987 isec
= inode
->i_security
;
991 AVC_AUDIT_DATA_INIT(&ad
, FS
);
992 ad
.u
.fs
.inode
= inode
;
995 return avc_has_perm(tsec
->sid
, isec
->sid
, isec
->sclass
, perms
, adp
);
998 /* Same as inode_has_perm, but pass explicit audit data containing
999 the dentry to help the auditing code to more easily generate the
1000 pathname if needed. */
1001 static inline int dentry_has_perm(struct task_struct
*tsk
,
1002 struct vfsmount
*mnt
,
1003 struct dentry
*dentry
,
1006 struct inode
*inode
= dentry
->d_inode
;
1007 struct avc_audit_data ad
;
1008 AVC_AUDIT_DATA_INIT(&ad
,FS
);
1010 ad
.u
.fs
.dentry
= dentry
;
1011 return inode_has_perm(tsk
, inode
, av
, &ad
);
1014 /* Check whether a task can use an open file descriptor to
1015 access an inode in a given way. Check access to the
1016 descriptor itself, and then use dentry_has_perm to
1017 check a particular permission to the file.
1018 Access to the descriptor is implicitly granted if it
1019 has the same SID as the process. If av is zero, then
1020 access to the file is not checked, e.g. for cases
1021 where only the descriptor is affected like seek. */
1022 static int file_has_perm(struct task_struct
*tsk
,
1026 struct task_security_struct
*tsec
= tsk
->security
;
1027 struct file_security_struct
*fsec
= file
->f_security
;
1028 struct vfsmount
*mnt
= file
->f_vfsmnt
;
1029 struct dentry
*dentry
= file
->f_dentry
;
1030 struct inode
*inode
= dentry
->d_inode
;
1031 struct avc_audit_data ad
;
1034 AVC_AUDIT_DATA_INIT(&ad
, FS
);
1036 ad
.u
.fs
.dentry
= dentry
;
1038 if (tsec
->sid
!= fsec
->sid
) {
1039 rc
= avc_has_perm(tsec
->sid
, fsec
->sid
,
1047 /* av is zero if only checking access to the descriptor. */
1049 return inode_has_perm(tsk
, inode
, av
, &ad
);
1054 /* Check whether a task can create a file. */
1055 static int may_create(struct inode
*dir
,
1056 struct dentry
*dentry
,
1059 struct task_security_struct
*tsec
;
1060 struct inode_security_struct
*dsec
;
1061 struct superblock_security_struct
*sbsec
;
1063 struct avc_audit_data ad
;
1066 tsec
= current
->security
;
1067 dsec
= dir
->i_security
;
1068 sbsec
= dir
->i_sb
->s_security
;
1070 AVC_AUDIT_DATA_INIT(&ad
, FS
);
1071 ad
.u
.fs
.dentry
= dentry
;
1073 rc
= avc_has_perm(tsec
->sid
, dsec
->sid
, SECCLASS_DIR
,
1074 DIR__ADD_NAME
| DIR__SEARCH
,
1079 if (tsec
->create_sid
&& sbsec
->behavior
!= SECURITY_FS_USE_MNTPOINT
) {
1080 newsid
= tsec
->create_sid
;
1082 rc
= security_transition_sid(tsec
->sid
, dsec
->sid
, tclass
,
1088 rc
= avc_has_perm(tsec
->sid
, newsid
, tclass
, FILE__CREATE
, &ad
);
1092 return avc_has_perm(newsid
, sbsec
->sid
,
1093 SECCLASS_FILESYSTEM
,
1094 FILESYSTEM__ASSOCIATE
, &ad
);
1098 #define MAY_UNLINK 1
1101 /* Check whether a task can link, unlink, or rmdir a file/directory. */
1102 static int may_link(struct inode
*dir
,
1103 struct dentry
*dentry
,
1107 struct task_security_struct
*tsec
;
1108 struct inode_security_struct
*dsec
, *isec
;
1109 struct avc_audit_data ad
;
1113 tsec
= current
->security
;
1114 dsec
= dir
->i_security
;
1115 isec
= dentry
->d_inode
->i_security
;
1117 AVC_AUDIT_DATA_INIT(&ad
, FS
);
1118 ad
.u
.fs
.dentry
= dentry
;
1121 av
|= (kind
? DIR__REMOVE_NAME
: DIR__ADD_NAME
);
1122 rc
= avc_has_perm(tsec
->sid
, dsec
->sid
, SECCLASS_DIR
, av
, &ad
);
1137 printk(KERN_WARNING
"may_link: unrecognized kind %d\n", kind
);
1141 rc
= avc_has_perm(tsec
->sid
, isec
->sid
, isec
->sclass
, av
, &ad
);
1145 static inline int may_rename(struct inode
*old_dir
,
1146 struct dentry
*old_dentry
,
1147 struct inode
*new_dir
,
1148 struct dentry
*new_dentry
)
1150 struct task_security_struct
*tsec
;
1151 struct inode_security_struct
*old_dsec
, *new_dsec
, *old_isec
, *new_isec
;
1152 struct avc_audit_data ad
;
1154 int old_is_dir
, new_is_dir
;
1157 tsec
= current
->security
;
1158 old_dsec
= old_dir
->i_security
;
1159 old_isec
= old_dentry
->d_inode
->i_security
;
1160 old_is_dir
= S_ISDIR(old_dentry
->d_inode
->i_mode
);
1161 new_dsec
= new_dir
->i_security
;
1163 AVC_AUDIT_DATA_INIT(&ad
, FS
);
1165 ad
.u
.fs
.dentry
= old_dentry
;
1166 rc
= avc_has_perm(tsec
->sid
, old_dsec
->sid
, SECCLASS_DIR
,
1167 DIR__REMOVE_NAME
| DIR__SEARCH
, &ad
);
1170 rc
= avc_has_perm(tsec
->sid
, old_isec
->sid
,
1171 old_isec
->sclass
, FILE__RENAME
, &ad
);
1174 if (old_is_dir
&& new_dir
!= old_dir
) {
1175 rc
= avc_has_perm(tsec
->sid
, old_isec
->sid
,
1176 old_isec
->sclass
, DIR__REPARENT
, &ad
);
1181 ad
.u
.fs
.dentry
= new_dentry
;
1182 av
= DIR__ADD_NAME
| DIR__SEARCH
;
1183 if (new_dentry
->d_inode
)
1184 av
|= DIR__REMOVE_NAME
;
1185 rc
= avc_has_perm(tsec
->sid
, new_dsec
->sid
, SECCLASS_DIR
, av
, &ad
);
1188 if (new_dentry
->d_inode
) {
1189 new_isec
= new_dentry
->d_inode
->i_security
;
1190 new_is_dir
= S_ISDIR(new_dentry
->d_inode
->i_mode
);
1191 rc
= avc_has_perm(tsec
->sid
, new_isec
->sid
,
1193 (new_is_dir
? DIR__RMDIR
: FILE__UNLINK
), &ad
);
1201 /* Check whether a task can perform a filesystem operation. */
1202 static int superblock_has_perm(struct task_struct
*tsk
,
1203 struct super_block
*sb
,
1205 struct avc_audit_data
*ad
)
1207 struct task_security_struct
*tsec
;
1208 struct superblock_security_struct
*sbsec
;
1210 tsec
= tsk
->security
;
1211 sbsec
= sb
->s_security
;
1212 return avc_has_perm(tsec
->sid
, sbsec
->sid
, SECCLASS_FILESYSTEM
,
1216 /* Convert a Linux mode and permission mask to an access vector. */
1217 static inline u32
file_mask_to_av(int mode
, int mask
)
1221 if ((mode
& S_IFMT
) != S_IFDIR
) {
1222 if (mask
& MAY_EXEC
)
1223 av
|= FILE__EXECUTE
;
1224 if (mask
& MAY_READ
)
1227 if (mask
& MAY_APPEND
)
1229 else if (mask
& MAY_WRITE
)
1233 if (mask
& MAY_EXEC
)
1235 if (mask
& MAY_WRITE
)
1237 if (mask
& MAY_READ
)
1244 /* Convert a Linux file to an access vector. */
1245 static inline u32
file_to_av(struct file
*file
)
1249 if (file
->f_mode
& FMODE_READ
)
1251 if (file
->f_mode
& FMODE_WRITE
) {
1252 if (file
->f_flags
& O_APPEND
)
1261 /* Set an inode's SID to a specified value. */
1262 static int inode_security_set_sid(struct inode
*inode
, u32 sid
)
1264 struct inode_security_struct
*isec
= inode
->i_security
;
1265 struct superblock_security_struct
*sbsec
= inode
->i_sb
->s_security
;
1267 if (!sbsec
->initialized
) {
1268 /* Defer initialization to selinux_complete_init. */
1273 isec
->sclass
= inode_mode_to_security_class(inode
->i_mode
);
1275 isec
->initialized
= 1;
1280 /* Hook functions begin here. */
1282 static int selinux_ptrace(struct task_struct
*parent
, struct task_struct
*child
)
1284 struct task_security_struct
*psec
= parent
->security
;
1285 struct task_security_struct
*csec
= child
->security
;
1288 rc
= secondary_ops
->ptrace(parent
,child
);
1292 rc
= task_has_perm(parent
, child
, PROCESS__PTRACE
);
1293 /* Save the SID of the tracing process for later use in apply_creds. */
1294 if (!(child
->ptrace
& PT_PTRACED
) && !rc
)
1295 csec
->ptrace_sid
= psec
->sid
;
1299 static int selinux_capget(struct task_struct
*target
, kernel_cap_t
*effective
,
1300 kernel_cap_t
*inheritable
, kernel_cap_t
*permitted
)
1304 error
= task_has_perm(current
, target
, PROCESS__GETCAP
);
1308 return secondary_ops
->capget(target
, effective
, inheritable
, permitted
);
1311 static int selinux_capset_check(struct task_struct
*target
, kernel_cap_t
*effective
,
1312 kernel_cap_t
*inheritable
, kernel_cap_t
*permitted
)
1316 error
= secondary_ops
->capset_check(target
, effective
, inheritable
, permitted
);
1320 return task_has_perm(current
, target
, PROCESS__SETCAP
);
1323 static void selinux_capset_set(struct task_struct
*target
, kernel_cap_t
*effective
,
1324 kernel_cap_t
*inheritable
, kernel_cap_t
*permitted
)
1326 secondary_ops
->capset_set(target
, effective
, inheritable
, permitted
);
1329 static int selinux_capable(struct task_struct
*tsk
, int cap
)
1333 rc
= secondary_ops
->capable(tsk
, cap
);
1337 return task_has_capability(tsk
,cap
);
1340 static int selinux_sysctl(ctl_table
*table
, int op
)
1344 struct task_security_struct
*tsec
;
1348 rc
= secondary_ops
->sysctl(table
, op
);
1352 tsec
= current
->security
;
1354 rc
= selinux_proc_get_sid(table
->de
, (op
== 001) ?
1355 SECCLASS_DIR
: SECCLASS_FILE
, &tsid
);
1357 /* Default to the well-defined sysctl SID. */
1358 tsid
= SECINITSID_SYSCTL
;
1361 /* The op values are "defined" in sysctl.c, thereby creating
1362 * a bad coupling between this module and sysctl.c */
1364 error
= avc_has_perm(tsec
->sid
, tsid
,
1365 SECCLASS_DIR
, DIR__SEARCH
, NULL
);
1373 error
= avc_has_perm(tsec
->sid
, tsid
,
1374 SECCLASS_FILE
, av
, NULL
);
1380 static int selinux_quotactl(int cmds
, int type
, int id
, struct super_block
*sb
)
1393 rc
= superblock_has_perm(current
,
1395 FILESYSTEM__QUOTAMOD
, NULL
);
1400 rc
= superblock_has_perm(current
,
1402 FILESYSTEM__QUOTAGET
, NULL
);
1405 rc
= 0; /* let the kernel handle invalid cmds */
1411 static int selinux_quota_on(struct dentry
*dentry
)
1413 return dentry_has_perm(current
, NULL
, dentry
, FILE__QUOTAON
);
1416 static int selinux_syslog(int type
)
1420 rc
= secondary_ops
->syslog(type
);
1425 case 3: /* Read last kernel messages */
1426 case 10: /* Return size of the log buffer */
1427 rc
= task_has_system(current
, SYSTEM__SYSLOG_READ
);
1429 case 6: /* Disable logging to console */
1430 case 7: /* Enable logging to console */
1431 case 8: /* Set level of messages printed to console */
1432 rc
= task_has_system(current
, SYSTEM__SYSLOG_CONSOLE
);
1434 case 0: /* Close log */
1435 case 1: /* Open log */
1436 case 2: /* Read from log */
1437 case 4: /* Read/clear last kernel messages */
1438 case 5: /* Clear ring buffer */
1440 rc
= task_has_system(current
, SYSTEM__SYSLOG_MOD
);
1447 * Check that a process has enough memory to allocate a new virtual
1448 * mapping. 0 means there is enough memory for the allocation to
1449 * succeed and -ENOMEM implies there is not.
1451 * Note that secondary_ops->capable and task_has_perm_noaudit return 0
1452 * if the capability is granted, but __vm_enough_memory requires 1 if
1453 * the capability is granted.
1455 * Do not audit the selinux permission check, as this is applied to all
1456 * processes that allocate mappings.
1458 static int selinux_vm_enough_memory(long pages
)
1460 int rc
, cap_sys_admin
= 0;
1461 struct task_security_struct
*tsec
= current
->security
;
1463 rc
= secondary_ops
->capable(current
, CAP_SYS_ADMIN
);
1465 rc
= avc_has_perm_noaudit(tsec
->sid
, tsec
->sid
,
1466 SECCLASS_CAPABILITY
,
1467 CAP_TO_MASK(CAP_SYS_ADMIN
),
1473 return __vm_enough_memory(pages
, cap_sys_admin
);
1476 /* binprm security operations */
1478 static int selinux_bprm_alloc_security(struct linux_binprm
*bprm
)
1480 struct bprm_security_struct
*bsec
;
1482 bsec
= kzalloc(sizeof(struct bprm_security_struct
), GFP_KERNEL
);
1487 bsec
->sid
= SECINITSID_UNLABELED
;
1490 bprm
->security
= bsec
;
1494 static int selinux_bprm_set_security(struct linux_binprm
*bprm
)
1496 struct task_security_struct
*tsec
;
1497 struct inode
*inode
= bprm
->file
->f_dentry
->d_inode
;
1498 struct inode_security_struct
*isec
;
1499 struct bprm_security_struct
*bsec
;
1501 struct avc_audit_data ad
;
1504 rc
= secondary_ops
->bprm_set_security(bprm
);
1508 bsec
= bprm
->security
;
1513 tsec
= current
->security
;
1514 isec
= inode
->i_security
;
1516 /* Default to the current task SID. */
1517 bsec
->sid
= tsec
->sid
;
1519 /* Reset create SID on execve. */
1520 tsec
->create_sid
= 0;
1522 if (tsec
->exec_sid
) {
1523 newsid
= tsec
->exec_sid
;
1524 /* Reset exec SID on execve. */
1527 /* Check for a default transition on this program. */
1528 rc
= security_transition_sid(tsec
->sid
, isec
->sid
,
1529 SECCLASS_PROCESS
, &newsid
);
1534 AVC_AUDIT_DATA_INIT(&ad
, FS
);
1535 ad
.u
.fs
.mnt
= bprm
->file
->f_vfsmnt
;
1536 ad
.u
.fs
.dentry
= bprm
->file
->f_dentry
;
1538 if (bprm
->file
->f_vfsmnt
->mnt_flags
& MNT_NOSUID
)
1541 if (tsec
->sid
== newsid
) {
1542 rc
= avc_has_perm(tsec
->sid
, isec
->sid
,
1543 SECCLASS_FILE
, FILE__EXECUTE_NO_TRANS
, &ad
);
1547 /* Check permissions for the transition. */
1548 rc
= avc_has_perm(tsec
->sid
, newsid
,
1549 SECCLASS_PROCESS
, PROCESS__TRANSITION
, &ad
);
1553 rc
= avc_has_perm(newsid
, isec
->sid
,
1554 SECCLASS_FILE
, FILE__ENTRYPOINT
, &ad
);
1558 /* Clear any possibly unsafe personality bits on exec: */
1559 current
->personality
&= ~PER_CLEAR_ON_SETID
;
1561 /* Set the security field to the new SID. */
1569 static int selinux_bprm_check_security (struct linux_binprm
*bprm
)
1571 return secondary_ops
->bprm_check_security(bprm
);
1575 static int selinux_bprm_secureexec (struct linux_binprm
*bprm
)
1577 struct task_security_struct
*tsec
= current
->security
;
1580 if (tsec
->osid
!= tsec
->sid
) {
1581 /* Enable secure mode for SIDs transitions unless
1582 the noatsecure permission is granted between
1583 the two SIDs, i.e. ahp returns 0. */
1584 atsecure
= avc_has_perm(tsec
->osid
, tsec
->sid
,
1586 PROCESS__NOATSECURE
, NULL
);
1589 return (atsecure
|| secondary_ops
->bprm_secureexec(bprm
));
1592 static void selinux_bprm_free_security(struct linux_binprm
*bprm
)
1594 kfree(bprm
->security
);
1595 bprm
->security
= NULL
;
1598 extern struct vfsmount
*selinuxfs_mount
;
1599 extern struct dentry
*selinux_null
;
1601 /* Derived from fs/exec.c:flush_old_files. */
1602 static inline void flush_unauthorized_files(struct files_struct
* files
)
1604 struct avc_audit_data ad
;
1605 struct file
*file
, *devnull
= NULL
;
1606 struct tty_struct
*tty
= current
->signal
->tty
;
1607 struct fdtable
*fdt
;
1612 file
= list_entry(tty
->tty_files
.next
, typeof(*file
), f_u
.fu_list
);
1614 /* Revalidate access to controlling tty.
1615 Use inode_has_perm on the tty inode directly rather
1616 than using file_has_perm, as this particular open
1617 file may belong to another process and we are only
1618 interested in the inode-based check here. */
1619 struct inode
*inode
= file
->f_dentry
->d_inode
;
1620 if (inode_has_perm(current
, inode
,
1621 FILE__READ
| FILE__WRITE
, NULL
)) {
1622 /* Reset controlling tty. */
1623 current
->signal
->tty
= NULL
;
1624 current
->signal
->tty_old_pgrp
= 0;
1630 /* Revalidate access to inherited open files. */
1632 AVC_AUDIT_DATA_INIT(&ad
,FS
);
1634 spin_lock(&files
->file_lock
);
1636 unsigned long set
, i
;
1641 fdt
= files_fdtable(files
);
1642 if (i
>= fdt
->max_fds
|| i
>= fdt
->max_fdset
)
1644 set
= fdt
->open_fds
->fds_bits
[j
];
1647 spin_unlock(&files
->file_lock
);
1648 for ( ; set
; i
++,set
>>= 1) {
1653 if (file_has_perm(current
,
1655 file_to_av(file
))) {
1657 fd
= get_unused_fd();
1667 devnull
= dentry_open(dget(selinux_null
), mntget(selinuxfs_mount
), O_RDWR
);
1674 fd_install(fd
, devnull
);
1679 spin_lock(&files
->file_lock
);
1682 spin_unlock(&files
->file_lock
);
1685 static void selinux_bprm_apply_creds(struct linux_binprm
*bprm
, int unsafe
)
1687 struct task_security_struct
*tsec
;
1688 struct bprm_security_struct
*bsec
;
1692 secondary_ops
->bprm_apply_creds(bprm
, unsafe
);
1694 tsec
= current
->security
;
1696 bsec
= bprm
->security
;
1699 tsec
->osid
= tsec
->sid
;
1701 if (tsec
->sid
!= sid
) {
1702 /* Check for shared state. If not ok, leave SID
1703 unchanged and kill. */
1704 if (unsafe
& LSM_UNSAFE_SHARE
) {
1705 rc
= avc_has_perm(tsec
->sid
, sid
, SECCLASS_PROCESS
,
1706 PROCESS__SHARE
, NULL
);
1713 /* Check for ptracing, and update the task SID if ok.
1714 Otherwise, leave SID unchanged and kill. */
1715 if (unsafe
& (LSM_UNSAFE_PTRACE
| LSM_UNSAFE_PTRACE_CAP
)) {
1716 rc
= avc_has_perm(tsec
->ptrace_sid
, sid
,
1717 SECCLASS_PROCESS
, PROCESS__PTRACE
,
1729 * called after apply_creds without the task lock held
1731 static void selinux_bprm_post_apply_creds(struct linux_binprm
*bprm
)
1733 struct task_security_struct
*tsec
;
1734 struct rlimit
*rlim
, *initrlim
;
1735 struct itimerval itimer
;
1736 struct bprm_security_struct
*bsec
;
1739 tsec
= current
->security
;
1740 bsec
= bprm
->security
;
1743 force_sig_specific(SIGKILL
, current
);
1746 if (tsec
->osid
== tsec
->sid
)
1749 /* Close files for which the new task SID is not authorized. */
1750 flush_unauthorized_files(current
->files
);
1752 /* Check whether the new SID can inherit signal state
1753 from the old SID. If not, clear itimers to avoid
1754 subsequent signal generation and flush and unblock
1755 signals. This must occur _after_ the task SID has
1756 been updated so that any kill done after the flush
1757 will be checked against the new SID. */
1758 rc
= avc_has_perm(tsec
->osid
, tsec
->sid
, SECCLASS_PROCESS
,
1759 PROCESS__SIGINH
, NULL
);
1761 memset(&itimer
, 0, sizeof itimer
);
1762 for (i
= 0; i
< 3; i
++)
1763 do_setitimer(i
, &itimer
, NULL
);
1764 flush_signals(current
);
1765 spin_lock_irq(¤t
->sighand
->siglock
);
1766 flush_signal_handlers(current
, 1);
1767 sigemptyset(¤t
->blocked
);
1768 recalc_sigpending();
1769 spin_unlock_irq(¤t
->sighand
->siglock
);
1772 /* Check whether the new SID can inherit resource limits
1773 from the old SID. If not, reset all soft limits to
1774 the lower of the current task's hard limit and the init
1775 task's soft limit. Note that the setting of hard limits
1776 (even to lower them) can be controlled by the setrlimit
1777 check. The inclusion of the init task's soft limit into
1778 the computation is to avoid resetting soft limits higher
1779 than the default soft limit for cases where the default
1780 is lower than the hard limit, e.g. RLIMIT_CORE or
1782 rc
= avc_has_perm(tsec
->osid
, tsec
->sid
, SECCLASS_PROCESS
,
1783 PROCESS__RLIMITINH
, NULL
);
1785 for (i
= 0; i
< RLIM_NLIMITS
; i
++) {
1786 rlim
= current
->signal
->rlim
+ i
;
1787 initrlim
= init_task
.signal
->rlim
+i
;
1788 rlim
->rlim_cur
= min(rlim
->rlim_max
,initrlim
->rlim_cur
);
1790 if (current
->signal
->rlim
[RLIMIT_CPU
].rlim_cur
!= RLIM_INFINITY
) {
1792 * This will cause RLIMIT_CPU calculations
1795 current
->it_prof_expires
= jiffies_to_cputime(1);
1799 /* Wake up the parent if it is waiting so that it can
1800 recheck wait permission to the new task SID. */
1801 wake_up_interruptible(¤t
->parent
->signal
->wait_chldexit
);
1804 /* superblock security operations */
1806 static int selinux_sb_alloc_security(struct super_block
*sb
)
1808 return superblock_alloc_security(sb
);
1811 static void selinux_sb_free_security(struct super_block
*sb
)
1813 superblock_free_security(sb
);
1816 static inline int match_prefix(char *prefix
, int plen
, char *option
, int olen
)
1821 return !memcmp(prefix
, option
, plen
);
1824 static inline int selinux_option(char *option
, int len
)
1826 return (match_prefix("context=", sizeof("context=")-1, option
, len
) ||
1827 match_prefix("fscontext=", sizeof("fscontext=")-1, option
, len
) ||
1828 match_prefix("defcontext=", sizeof("defcontext=")-1, option
, len
));
1831 static inline void take_option(char **to
, char *from
, int *first
, int len
)
1839 memcpy(*to
, from
, len
);
1843 static int selinux_sb_copy_data(struct file_system_type
*type
, void *orig
, void *copy
)
1845 int fnosec
, fsec
, rc
= 0;
1846 char *in_save
, *in_curr
, *in_end
;
1847 char *sec_curr
, *nosec_save
, *nosec
;
1852 /* Binary mount data: just copy */
1853 if (type
->fs_flags
& FS_BINARY_MOUNTDATA
) {
1854 copy_page(sec_curr
, in_curr
);
1858 nosec
= (char *)get_zeroed_page(GFP_KERNEL
);
1866 in_save
= in_end
= orig
;
1869 if (*in_end
== ',' || *in_end
== '\0') {
1870 int len
= in_end
- in_curr
;
1872 if (selinux_option(in_curr
, len
))
1873 take_option(&sec_curr
, in_curr
, &fsec
, len
);
1875 take_option(&nosec
, in_curr
, &fnosec
, len
);
1877 in_curr
= in_end
+ 1;
1879 } while (*in_end
++);
1881 strcpy(in_save
, nosec_save
);
1882 free_page((unsigned long)nosec_save
);
1887 static int selinux_sb_kern_mount(struct super_block
*sb
, void *data
)
1889 struct avc_audit_data ad
;
1892 rc
= superblock_doinit(sb
, data
);
1896 AVC_AUDIT_DATA_INIT(&ad
,FS
);
1897 ad
.u
.fs
.dentry
= sb
->s_root
;
1898 return superblock_has_perm(current
, sb
, FILESYSTEM__MOUNT
, &ad
);
1901 static int selinux_sb_statfs(struct super_block
*sb
)
1903 struct avc_audit_data ad
;
1905 AVC_AUDIT_DATA_INIT(&ad
,FS
);
1906 ad
.u
.fs
.dentry
= sb
->s_root
;
1907 return superblock_has_perm(current
, sb
, FILESYSTEM__GETATTR
, &ad
);
1910 static int selinux_mount(char * dev_name
,
1911 struct nameidata
*nd
,
1913 unsigned long flags
,
1918 rc
= secondary_ops
->sb_mount(dev_name
, nd
, type
, flags
, data
);
1922 if (flags
& MS_REMOUNT
)
1923 return superblock_has_perm(current
, nd
->mnt
->mnt_sb
,
1924 FILESYSTEM__REMOUNT
, NULL
);
1926 return dentry_has_perm(current
, nd
->mnt
, nd
->dentry
,
1930 static int selinux_umount(struct vfsmount
*mnt
, int flags
)
1934 rc
= secondary_ops
->sb_umount(mnt
, flags
);
1938 return superblock_has_perm(current
,mnt
->mnt_sb
,
1939 FILESYSTEM__UNMOUNT
,NULL
);
1942 /* inode security operations */
1944 static int selinux_inode_alloc_security(struct inode
*inode
)
1946 return inode_alloc_security(inode
);
1949 static void selinux_inode_free_security(struct inode
*inode
)
1951 inode_free_security(inode
);
1954 static int selinux_inode_init_security(struct inode
*inode
, struct inode
*dir
,
1955 char **name
, void **value
,
1958 struct task_security_struct
*tsec
;
1959 struct inode_security_struct
*dsec
;
1960 struct superblock_security_struct
*sbsec
;
1963 char *namep
= NULL
, *context
;
1965 tsec
= current
->security
;
1966 dsec
= dir
->i_security
;
1967 sbsec
= dir
->i_sb
->s_security
;
1969 if (tsec
->create_sid
&& sbsec
->behavior
!= SECURITY_FS_USE_MNTPOINT
) {
1970 newsid
= tsec
->create_sid
;
1972 rc
= security_transition_sid(tsec
->sid
, dsec
->sid
,
1973 inode_mode_to_security_class(inode
->i_mode
),
1976 printk(KERN_WARNING
"%s: "
1977 "security_transition_sid failed, rc=%d (dev=%s "
1980 -rc
, inode
->i_sb
->s_id
, inode
->i_ino
);
1985 inode_security_set_sid(inode
, newsid
);
1987 if (!ss_initialized
|| sbsec
->behavior
== SECURITY_FS_USE_MNTPOINT
)
1991 namep
= kstrdup(XATTR_SELINUX_SUFFIX
, GFP_KERNEL
);
1998 rc
= security_sid_to_context(newsid
, &context
, &clen
);
2010 static int selinux_inode_create(struct inode
*dir
, struct dentry
*dentry
, int mask
)
2012 return may_create(dir
, dentry
, SECCLASS_FILE
);
2015 static int selinux_inode_link(struct dentry
*old_dentry
, struct inode
*dir
, struct dentry
*new_dentry
)
2019 rc
= secondary_ops
->inode_link(old_dentry
,dir
,new_dentry
);
2022 return may_link(dir
, old_dentry
, MAY_LINK
);
2025 static int selinux_inode_unlink(struct inode
*dir
, struct dentry
*dentry
)
2029 rc
= secondary_ops
->inode_unlink(dir
, dentry
);
2032 return may_link(dir
, dentry
, MAY_UNLINK
);
2035 static int selinux_inode_symlink(struct inode
*dir
, struct dentry
*dentry
, const char *name
)
2037 return may_create(dir
, dentry
, SECCLASS_LNK_FILE
);
2040 static int selinux_inode_mkdir(struct inode
*dir
, struct dentry
*dentry
, int mask
)
2042 return may_create(dir
, dentry
, SECCLASS_DIR
);
2045 static int selinux_inode_rmdir(struct inode
*dir
, struct dentry
*dentry
)
2047 return may_link(dir
, dentry
, MAY_RMDIR
);
2050 static int selinux_inode_mknod(struct inode
*dir
, struct dentry
*dentry
, int mode
, dev_t dev
)
2054 rc
= secondary_ops
->inode_mknod(dir
, dentry
, mode
, dev
);
2058 return may_create(dir
, dentry
, inode_mode_to_security_class(mode
));
2061 static int selinux_inode_rename(struct inode
*old_inode
, struct dentry
*old_dentry
,
2062 struct inode
*new_inode
, struct dentry
*new_dentry
)
2064 return may_rename(old_inode
, old_dentry
, new_inode
, new_dentry
);
2067 static int selinux_inode_readlink(struct dentry
*dentry
)
2069 return dentry_has_perm(current
, NULL
, dentry
, FILE__READ
);
2072 static int selinux_inode_follow_link(struct dentry
*dentry
, struct nameidata
*nameidata
)
2076 rc
= secondary_ops
->inode_follow_link(dentry
,nameidata
);
2079 return dentry_has_perm(current
, NULL
, dentry
, FILE__READ
);
2082 static int selinux_inode_permission(struct inode
*inode
, int mask
,
2083 struct nameidata
*nd
)
2087 rc
= secondary_ops
->inode_permission(inode
, mask
, nd
);
2092 /* No permission to check. Existence test. */
2096 return inode_has_perm(current
, inode
,
2097 file_mask_to_av(inode
->i_mode
, mask
), NULL
);
2100 static int selinux_inode_setattr(struct dentry
*dentry
, struct iattr
*iattr
)
2104 rc
= secondary_ops
->inode_setattr(dentry
, iattr
);
2108 if (iattr
->ia_valid
& ATTR_FORCE
)
2111 if (iattr
->ia_valid
& (ATTR_MODE
| ATTR_UID
| ATTR_GID
|
2112 ATTR_ATIME_SET
| ATTR_MTIME_SET
))
2113 return dentry_has_perm(current
, NULL
, dentry
, FILE__SETATTR
);
2115 return dentry_has_perm(current
, NULL
, dentry
, FILE__WRITE
);
2118 static int selinux_inode_getattr(struct vfsmount
*mnt
, struct dentry
*dentry
)
2120 return dentry_has_perm(current
, mnt
, dentry
, FILE__GETATTR
);
2123 static int selinux_inode_setxattr(struct dentry
*dentry
, char *name
, void *value
, size_t size
, int flags
)
2125 struct task_security_struct
*tsec
= current
->security
;
2126 struct inode
*inode
= dentry
->d_inode
;
2127 struct inode_security_struct
*isec
= inode
->i_security
;
2128 struct superblock_security_struct
*sbsec
;
2129 struct avc_audit_data ad
;
2133 if (strcmp(name
, XATTR_NAME_SELINUX
)) {
2134 if (!strncmp(name
, XATTR_SECURITY_PREFIX
,
2135 sizeof XATTR_SECURITY_PREFIX
- 1) &&
2136 !capable(CAP_SYS_ADMIN
)) {
2137 /* A different attribute in the security namespace.
2138 Restrict to administrator. */
2142 /* Not an attribute we recognize, so just check the
2143 ordinary setattr permission. */
2144 return dentry_has_perm(current
, NULL
, dentry
, FILE__SETATTR
);
2147 sbsec
= inode
->i_sb
->s_security
;
2148 if (sbsec
->behavior
== SECURITY_FS_USE_MNTPOINT
)
2151 if ((current
->fsuid
!= inode
->i_uid
) && !capable(CAP_FOWNER
))
2154 AVC_AUDIT_DATA_INIT(&ad
,FS
);
2155 ad
.u
.fs
.dentry
= dentry
;
2157 rc
= avc_has_perm(tsec
->sid
, isec
->sid
, isec
->sclass
,
2158 FILE__RELABELFROM
, &ad
);
2162 rc
= security_context_to_sid(value
, size
, &newsid
);
2166 rc
= avc_has_perm(tsec
->sid
, newsid
, isec
->sclass
,
2167 FILE__RELABELTO
, &ad
);
2171 rc
= security_validate_transition(isec
->sid
, newsid
, tsec
->sid
,
2176 return avc_has_perm(newsid
,
2178 SECCLASS_FILESYSTEM
,
2179 FILESYSTEM__ASSOCIATE
,
2183 static void selinux_inode_post_setxattr(struct dentry
*dentry
, char *name
,
2184 void *value
, size_t size
, int flags
)
2186 struct inode
*inode
= dentry
->d_inode
;
2187 struct inode_security_struct
*isec
= inode
->i_security
;
2191 if (strcmp(name
, XATTR_NAME_SELINUX
)) {
2192 /* Not an attribute we recognize, so nothing to do. */
2196 rc
= security_context_to_sid(value
, size
, &newsid
);
2198 printk(KERN_WARNING
"%s: unable to obtain SID for context "
2199 "%s, rc=%d\n", __FUNCTION__
, (char*)value
, -rc
);
2207 static int selinux_inode_getxattr (struct dentry
*dentry
, char *name
)
2209 return dentry_has_perm(current
, NULL
, dentry
, FILE__GETATTR
);
2212 static int selinux_inode_listxattr (struct dentry
*dentry
)
2214 return dentry_has_perm(current
, NULL
, dentry
, FILE__GETATTR
);
2217 static int selinux_inode_removexattr (struct dentry
*dentry
, char *name
)
2219 if (strcmp(name
, XATTR_NAME_SELINUX
)) {
2220 if (!strncmp(name
, XATTR_SECURITY_PREFIX
,
2221 sizeof XATTR_SECURITY_PREFIX
- 1) &&
2222 !capable(CAP_SYS_ADMIN
)) {
2223 /* A different attribute in the security namespace.
2224 Restrict to administrator. */
2228 /* Not an attribute we recognize, so just check the
2229 ordinary setattr permission. Might want a separate
2230 permission for removexattr. */
2231 return dentry_has_perm(current
, NULL
, dentry
, FILE__SETATTR
);
2234 /* No one is allowed to remove a SELinux security label.
2235 You can change the label, but all data must be labeled. */
2239 static const char *selinux_inode_xattr_getsuffix(void)
2241 return XATTR_SELINUX_SUFFIX
;
2245 * Copy the in-core inode security context value to the user. If the
2246 * getxattr() prior to this succeeded, check to see if we need to
2247 * canonicalize the value to be finally returned to the user.
2249 * Permission check is handled by selinux_inode_getxattr hook.
2251 static int selinux_inode_getsecurity(const struct inode
*inode
, const char *name
, void *buffer
, size_t size
, int err
)
2253 struct inode_security_struct
*isec
= inode
->i_security
;
2255 if (strcmp(name
, XATTR_SELINUX_SUFFIX
))
2258 return selinux_getsecurity(isec
->sid
, buffer
, size
);
2261 static int selinux_inode_setsecurity(struct inode
*inode
, const char *name
,
2262 const void *value
, size_t size
, int flags
)
2264 struct inode_security_struct
*isec
= inode
->i_security
;
2268 if (strcmp(name
, XATTR_SELINUX_SUFFIX
))
2271 if (!value
|| !size
)
2274 rc
= security_context_to_sid((void*)value
, size
, &newsid
);
2282 static int selinux_inode_listsecurity(struct inode
*inode
, char *buffer
, size_t buffer_size
)
2284 const int len
= sizeof(XATTR_NAME_SELINUX
);
2285 if (buffer
&& len
<= buffer_size
)
2286 memcpy(buffer
, XATTR_NAME_SELINUX
, len
);
2290 /* file security operations */
2292 static int selinux_file_permission(struct file
*file
, int mask
)
2294 struct inode
*inode
= file
->f_dentry
->d_inode
;
2297 /* No permission to check. Existence test. */
2301 /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
2302 if ((file
->f_flags
& O_APPEND
) && (mask
& MAY_WRITE
))
2305 return file_has_perm(current
, file
,
2306 file_mask_to_av(inode
->i_mode
, mask
));
2309 static int selinux_file_alloc_security(struct file
*file
)
2311 return file_alloc_security(file
);
2314 static void selinux_file_free_security(struct file
*file
)
2316 file_free_security(file
);
2319 static int selinux_file_ioctl(struct file
*file
, unsigned int cmd
,
2331 case EXT2_IOC_GETFLAGS
:
2333 case EXT2_IOC_GETVERSION
:
2334 error
= file_has_perm(current
, file
, FILE__GETATTR
);
2337 case EXT2_IOC_SETFLAGS
:
2339 case EXT2_IOC_SETVERSION
:
2340 error
= file_has_perm(current
, file
, FILE__SETATTR
);
2343 /* sys_ioctl() checks */
2347 error
= file_has_perm(current
, file
, 0);
2352 error
= task_has_capability(current
,CAP_SYS_TTY_CONFIG
);
2355 /* default case assumes that the command will go
2356 * to the file's ioctl() function.
2359 error
= file_has_perm(current
, file
, FILE__IOCTL
);
2365 static int file_map_prot_check(struct file
*file
, unsigned long prot
, int shared
)
2367 #ifndef CONFIG_PPC32
2368 if ((prot
& PROT_EXEC
) && (!file
|| (!shared
&& (prot
& PROT_WRITE
)))) {
2370 * We are making executable an anonymous mapping or a
2371 * private file mapping that will also be writable.
2372 * This has an additional check.
2374 int rc
= task_has_perm(current
, current
, PROCESS__EXECMEM
);
2381 /* read access is always possible with a mapping */
2382 u32 av
= FILE__READ
;
2384 /* write access only matters if the mapping is shared */
2385 if (shared
&& (prot
& PROT_WRITE
))
2388 if (prot
& PROT_EXEC
)
2389 av
|= FILE__EXECUTE
;
2391 return file_has_perm(current
, file
, av
);
2396 static int selinux_file_mmap(struct file
*file
, unsigned long reqprot
,
2397 unsigned long prot
, unsigned long flags
)
2401 rc
= secondary_ops
->file_mmap(file
, reqprot
, prot
, flags
);
2405 if (selinux_checkreqprot
)
2408 return file_map_prot_check(file
, prot
,
2409 (flags
& MAP_TYPE
) == MAP_SHARED
);
2412 static int selinux_file_mprotect(struct vm_area_struct
*vma
,
2413 unsigned long reqprot
,
2418 rc
= secondary_ops
->file_mprotect(vma
, reqprot
, prot
);
2422 if (selinux_checkreqprot
)
2425 #ifndef CONFIG_PPC32
2426 if ((prot
& PROT_EXEC
) && !(vma
->vm_flags
& VM_EXEC
)) {
2428 if (vma
->vm_start
>= vma
->vm_mm
->start_brk
&&
2429 vma
->vm_end
<= vma
->vm_mm
->brk
) {
2430 rc
= task_has_perm(current
, current
,
2432 } else if (!vma
->vm_file
&&
2433 vma
->vm_start
<= vma
->vm_mm
->start_stack
&&
2434 vma
->vm_end
>= vma
->vm_mm
->start_stack
) {
2435 rc
= task_has_perm(current
, current
, PROCESS__EXECSTACK
);
2436 } else if (vma
->vm_file
&& vma
->anon_vma
) {
2438 * We are making executable a file mapping that has
2439 * had some COW done. Since pages might have been
2440 * written, check ability to execute the possibly
2441 * modified content. This typically should only
2442 * occur for text relocations.
2444 rc
= file_has_perm(current
, vma
->vm_file
,
2452 return file_map_prot_check(vma
->vm_file
, prot
, vma
->vm_flags
&VM_SHARED
);
2455 static int selinux_file_lock(struct file
*file
, unsigned int cmd
)
2457 return file_has_perm(current
, file
, FILE__LOCK
);
2460 static int selinux_file_fcntl(struct file
*file
, unsigned int cmd
,
2467 if (!file
->f_dentry
|| !file
->f_dentry
->d_inode
) {
2472 if ((file
->f_flags
& O_APPEND
) && !(arg
& O_APPEND
)) {
2473 err
= file_has_perm(current
, file
,FILE__WRITE
);
2482 /* Just check FD__USE permission */
2483 err
= file_has_perm(current
, file
, 0);
2488 #if BITS_PER_LONG == 32
2493 if (!file
->f_dentry
|| !file
->f_dentry
->d_inode
) {
2497 err
= file_has_perm(current
, file
, FILE__LOCK
);
2504 static int selinux_file_set_fowner(struct file
*file
)
2506 struct task_security_struct
*tsec
;
2507 struct file_security_struct
*fsec
;
2509 tsec
= current
->security
;
2510 fsec
= file
->f_security
;
2511 fsec
->fown_sid
= tsec
->sid
;
2516 static int selinux_file_send_sigiotask(struct task_struct
*tsk
,
2517 struct fown_struct
*fown
, int signum
)
2521 struct task_security_struct
*tsec
;
2522 struct file_security_struct
*fsec
;
2524 /* struct fown_struct is never outside the context of a struct file */
2525 file
= (struct file
*)((long)fown
- offsetof(struct file
,f_owner
));
2527 tsec
= tsk
->security
;
2528 fsec
= file
->f_security
;
2531 perm
= signal_to_av(SIGIO
); /* as per send_sigio_to_task */
2533 perm
= signal_to_av(signum
);
2535 return avc_has_perm(fsec
->fown_sid
, tsec
->sid
,
2536 SECCLASS_PROCESS
, perm
, NULL
);
2539 static int selinux_file_receive(struct file
*file
)
2541 return file_has_perm(current
, file
, file_to_av(file
));
2544 /* task security operations */
2546 static int selinux_task_create(unsigned long clone_flags
)
2550 rc
= secondary_ops
->task_create(clone_flags
);
2554 return task_has_perm(current
, current
, PROCESS__FORK
);
2557 static int selinux_task_alloc_security(struct task_struct
*tsk
)
2559 struct task_security_struct
*tsec1
, *tsec2
;
2562 tsec1
= current
->security
;
2564 rc
= task_alloc_security(tsk
);
2567 tsec2
= tsk
->security
;
2569 tsec2
->osid
= tsec1
->osid
;
2570 tsec2
->sid
= tsec1
->sid
;
2572 /* Retain the exec and create SIDs across fork */
2573 tsec2
->exec_sid
= tsec1
->exec_sid
;
2574 tsec2
->create_sid
= tsec1
->create_sid
;
2576 /* Retain ptracer SID across fork, if any.
2577 This will be reset by the ptrace hook upon any
2578 subsequent ptrace_attach operations. */
2579 tsec2
->ptrace_sid
= tsec1
->ptrace_sid
;
2584 static void selinux_task_free_security(struct task_struct
*tsk
)
2586 task_free_security(tsk
);
2589 static int selinux_task_setuid(uid_t id0
, uid_t id1
, uid_t id2
, int flags
)
2591 /* Since setuid only affects the current process, and
2592 since the SELinux controls are not based on the Linux
2593 identity attributes, SELinux does not need to control
2594 this operation. However, SELinux does control the use
2595 of the CAP_SETUID and CAP_SETGID capabilities using the
2600 static int selinux_task_post_setuid(uid_t id0
, uid_t id1
, uid_t id2
, int flags
)
2602 return secondary_ops
->task_post_setuid(id0
,id1
,id2
,flags
);
2605 static int selinux_task_setgid(gid_t id0
, gid_t id1
, gid_t id2
, int flags
)
2607 /* See the comment for setuid above. */
2611 static int selinux_task_setpgid(struct task_struct
*p
, pid_t pgid
)
2613 return task_has_perm(current
, p
, PROCESS__SETPGID
);
2616 static int selinux_task_getpgid(struct task_struct
*p
)
2618 return task_has_perm(current
, p
, PROCESS__GETPGID
);
2621 static int selinux_task_getsid(struct task_struct
*p
)
2623 return task_has_perm(current
, p
, PROCESS__GETSESSION
);
2626 static int selinux_task_setgroups(struct group_info
*group_info
)
2628 /* See the comment for setuid above. */
2632 static int selinux_task_setnice(struct task_struct
*p
, int nice
)
2636 rc
= secondary_ops
->task_setnice(p
, nice
);
2640 return task_has_perm(current
,p
, PROCESS__SETSCHED
);
2643 static int selinux_task_setrlimit(unsigned int resource
, struct rlimit
*new_rlim
)
2645 struct rlimit
*old_rlim
= current
->signal
->rlim
+ resource
;
2648 rc
= secondary_ops
->task_setrlimit(resource
, new_rlim
);
2652 /* Control the ability to change the hard limit (whether
2653 lowering or raising it), so that the hard limit can
2654 later be used as a safe reset point for the soft limit
2655 upon context transitions. See selinux_bprm_apply_creds. */
2656 if (old_rlim
->rlim_max
!= new_rlim
->rlim_max
)
2657 return task_has_perm(current
, current
, PROCESS__SETRLIMIT
);
2662 static int selinux_task_setscheduler(struct task_struct
*p
, int policy
, struct sched_param
*lp
)
2664 return task_has_perm(current
, p
, PROCESS__SETSCHED
);
2667 static int selinux_task_getscheduler(struct task_struct
*p
)
2669 return task_has_perm(current
, p
, PROCESS__GETSCHED
);
2672 static int selinux_task_kill(struct task_struct
*p
, struct siginfo
*info
, int sig
)
2677 rc
= secondary_ops
->task_kill(p
, info
, sig
);
2681 if (info
!= SEND_SIG_NOINFO
&& (is_si_special(info
) || SI_FROMKERNEL(info
)))
2685 perm
= PROCESS__SIGNULL
; /* null signal; existence test */
2687 perm
= signal_to_av(sig
);
2689 return task_has_perm(current
, p
, perm
);
2692 static int selinux_task_prctl(int option
,
2698 /* The current prctl operations do not appear to require
2699 any SELinux controls since they merely observe or modify
2700 the state of the current process. */
2704 static int selinux_task_wait(struct task_struct
*p
)
2708 perm
= signal_to_av(p
->exit_signal
);
2710 return task_has_perm(p
, current
, perm
);
2713 static void selinux_task_reparent_to_init(struct task_struct
*p
)
2715 struct task_security_struct
*tsec
;
2717 secondary_ops
->task_reparent_to_init(p
);
2720 tsec
->osid
= tsec
->sid
;
2721 tsec
->sid
= SECINITSID_KERNEL
;
2725 static void selinux_task_to_inode(struct task_struct
*p
,
2726 struct inode
*inode
)
2728 struct task_security_struct
*tsec
= p
->security
;
2729 struct inode_security_struct
*isec
= inode
->i_security
;
2731 isec
->sid
= tsec
->sid
;
2732 isec
->initialized
= 1;
2736 /* Returns error only if unable to parse addresses */
2737 static int selinux_parse_skb_ipv4(struct sk_buff
*skb
, struct avc_audit_data
*ad
)
2739 int offset
, ihlen
, ret
= -EINVAL
;
2740 struct iphdr _iph
, *ih
;
2742 offset
= skb
->nh
.raw
- skb
->data
;
2743 ih
= skb_header_pointer(skb
, offset
, sizeof(_iph
), &_iph
);
2747 ihlen
= ih
->ihl
* 4;
2748 if (ihlen
< sizeof(_iph
))
2751 ad
->u
.net
.v4info
.saddr
= ih
->saddr
;
2752 ad
->u
.net
.v4info
.daddr
= ih
->daddr
;
2755 switch (ih
->protocol
) {
2757 struct tcphdr _tcph
, *th
;
2759 if (ntohs(ih
->frag_off
) & IP_OFFSET
)
2763 th
= skb_header_pointer(skb
, offset
, sizeof(_tcph
), &_tcph
);
2767 ad
->u
.net
.sport
= th
->source
;
2768 ad
->u
.net
.dport
= th
->dest
;
2773 struct udphdr _udph
, *uh
;
2775 if (ntohs(ih
->frag_off
) & IP_OFFSET
)
2779 uh
= skb_header_pointer(skb
, offset
, sizeof(_udph
), &_udph
);
2783 ad
->u
.net
.sport
= uh
->source
;
2784 ad
->u
.net
.dport
= uh
->dest
;
2795 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
2797 /* Returns error only if unable to parse addresses */
2798 static int selinux_parse_skb_ipv6(struct sk_buff
*skb
, struct avc_audit_data
*ad
)
2801 int ret
= -EINVAL
, offset
;
2802 struct ipv6hdr _ipv6h
, *ip6
;
2804 offset
= skb
->nh
.raw
- skb
->data
;
2805 ip6
= skb_header_pointer(skb
, offset
, sizeof(_ipv6h
), &_ipv6h
);
2809 ipv6_addr_copy(&ad
->u
.net
.v6info
.saddr
, &ip6
->saddr
);
2810 ipv6_addr_copy(&ad
->u
.net
.v6info
.daddr
, &ip6
->daddr
);
2813 nexthdr
= ip6
->nexthdr
;
2814 offset
+= sizeof(_ipv6h
);
2815 offset
= ipv6_skip_exthdr(skb
, offset
, &nexthdr
);
2821 struct tcphdr _tcph
, *th
;
2823 th
= skb_header_pointer(skb
, offset
, sizeof(_tcph
), &_tcph
);
2827 ad
->u
.net
.sport
= th
->source
;
2828 ad
->u
.net
.dport
= th
->dest
;
2833 struct udphdr _udph
, *uh
;
2835 uh
= skb_header_pointer(skb
, offset
, sizeof(_udph
), &_udph
);
2839 ad
->u
.net
.sport
= uh
->source
;
2840 ad
->u
.net
.dport
= uh
->dest
;
2844 /* includes fragments */
2854 static int selinux_parse_skb(struct sk_buff
*skb
, struct avc_audit_data
*ad
,
2855 char **addrp
, int *len
, int src
)
2859 switch (ad
->u
.net
.family
) {
2861 ret
= selinux_parse_skb_ipv4(skb
, ad
);
2865 *addrp
= (char *)(src
? &ad
->u
.net
.v4info
.saddr
:
2866 &ad
->u
.net
.v4info
.daddr
);
2869 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
2871 ret
= selinux_parse_skb_ipv6(skb
, ad
);
2875 *addrp
= (char *)(src
? &ad
->u
.net
.v6info
.saddr
:
2876 &ad
->u
.net
.v6info
.daddr
);
2886 /* socket security operations */
2887 static int socket_has_perm(struct task_struct
*task
, struct socket
*sock
,
2890 struct inode_security_struct
*isec
;
2891 struct task_security_struct
*tsec
;
2892 struct avc_audit_data ad
;
2895 tsec
= task
->security
;
2896 isec
= SOCK_INODE(sock
)->i_security
;
2898 if (isec
->sid
== SECINITSID_KERNEL
)
2901 AVC_AUDIT_DATA_INIT(&ad
,NET
);
2902 ad
.u
.net
.sk
= sock
->sk
;
2903 err
= avc_has_perm(tsec
->sid
, isec
->sid
, isec
->sclass
, perms
, &ad
);
2909 static int selinux_socket_create(int family
, int type
,
2910 int protocol
, int kern
)
2913 struct task_security_struct
*tsec
;
2918 tsec
= current
->security
;
2919 err
= avc_has_perm(tsec
->sid
, tsec
->sid
,
2920 socket_type_to_security_class(family
, type
,
2921 protocol
), SOCKET__CREATE
, NULL
);
2927 static void selinux_socket_post_create(struct socket
*sock
, int family
,
2928 int type
, int protocol
, int kern
)
2930 struct inode_security_struct
*isec
;
2931 struct task_security_struct
*tsec
;
2933 isec
= SOCK_INODE(sock
)->i_security
;
2935 tsec
= current
->security
;
2936 isec
->sclass
= socket_type_to_security_class(family
, type
, protocol
);
2937 isec
->sid
= kern
? SECINITSID_KERNEL
: tsec
->sid
;
2938 isec
->initialized
= 1;
2943 /* Range of port numbers used to automatically bind.
2944 Need to determine whether we should perform a name_bind
2945 permission check between the socket and the port number. */
2946 #define ip_local_port_range_0 sysctl_local_port_range[0]
2947 #define ip_local_port_range_1 sysctl_local_port_range[1]
2949 static int selinux_socket_bind(struct socket
*sock
, struct sockaddr
*address
, int addrlen
)
2954 err
= socket_has_perm(current
, sock
, SOCKET__BIND
);
2959 * If PF_INET or PF_INET6, check name_bind permission for the port.
2960 * Multiple address binding for SCTP is not supported yet: we just
2961 * check the first address now.
2963 family
= sock
->sk
->sk_family
;
2964 if (family
== PF_INET
|| family
== PF_INET6
) {
2966 struct inode_security_struct
*isec
;
2967 struct task_security_struct
*tsec
;
2968 struct avc_audit_data ad
;
2969 struct sockaddr_in
*addr4
= NULL
;
2970 struct sockaddr_in6
*addr6
= NULL
;
2971 unsigned short snum
;
2972 struct sock
*sk
= sock
->sk
;
2973 u32 sid
, node_perm
, addrlen
;
2975 tsec
= current
->security
;
2976 isec
= SOCK_INODE(sock
)->i_security
;
2978 if (family
== PF_INET
) {
2979 addr4
= (struct sockaddr_in
*)address
;
2980 snum
= ntohs(addr4
->sin_port
);
2981 addrlen
= sizeof(addr4
->sin_addr
.s_addr
);
2982 addrp
= (char *)&addr4
->sin_addr
.s_addr
;
2984 addr6
= (struct sockaddr_in6
*)address
;
2985 snum
= ntohs(addr6
->sin6_port
);
2986 addrlen
= sizeof(addr6
->sin6_addr
.s6_addr
);
2987 addrp
= (char *)&addr6
->sin6_addr
.s6_addr
;
2990 if (snum
&&(snum
< max(PROT_SOCK
,ip_local_port_range_0
) ||
2991 snum
> ip_local_port_range_1
)) {
2992 err
= security_port_sid(sk
->sk_family
, sk
->sk_type
,
2993 sk
->sk_protocol
, snum
, &sid
);
2996 AVC_AUDIT_DATA_INIT(&ad
,NET
);
2997 ad
.u
.net
.sport
= htons(snum
);
2998 ad
.u
.net
.family
= family
;
2999 err
= avc_has_perm(isec
->sid
, sid
,
3001 SOCKET__NAME_BIND
, &ad
);
3006 switch(isec
->sclass
) {
3007 case SECCLASS_TCP_SOCKET
:
3008 node_perm
= TCP_SOCKET__NODE_BIND
;
3011 case SECCLASS_UDP_SOCKET
:
3012 node_perm
= UDP_SOCKET__NODE_BIND
;
3016 node_perm
= RAWIP_SOCKET__NODE_BIND
;
3020 err
= security_node_sid(family
, addrp
, addrlen
, &sid
);
3024 AVC_AUDIT_DATA_INIT(&ad
,NET
);
3025 ad
.u
.net
.sport
= htons(snum
);
3026 ad
.u
.net
.family
= family
;
3028 if (family
== PF_INET
)
3029 ad
.u
.net
.v4info
.saddr
= addr4
->sin_addr
.s_addr
;
3031 ipv6_addr_copy(&ad
.u
.net
.v6info
.saddr
, &addr6
->sin6_addr
);
3033 err
= avc_has_perm(isec
->sid
, sid
,
3034 isec
->sclass
, node_perm
, &ad
);
3042 static int selinux_socket_connect(struct socket
*sock
, struct sockaddr
*address
, int addrlen
)
3044 struct inode_security_struct
*isec
;
3047 err
= socket_has_perm(current
, sock
, SOCKET__CONNECT
);
3052 * If a TCP socket, check name_connect permission for the port.
3054 isec
= SOCK_INODE(sock
)->i_security
;
3055 if (isec
->sclass
== SECCLASS_TCP_SOCKET
) {
3056 struct sock
*sk
= sock
->sk
;
3057 struct avc_audit_data ad
;
3058 struct sockaddr_in
*addr4
= NULL
;
3059 struct sockaddr_in6
*addr6
= NULL
;
3060 unsigned short snum
;
3063 if (sk
->sk_family
== PF_INET
) {
3064 addr4
= (struct sockaddr_in
*)address
;
3065 if (addrlen
< sizeof(struct sockaddr_in
))
3067 snum
= ntohs(addr4
->sin_port
);
3069 addr6
= (struct sockaddr_in6
*)address
;
3070 if (addrlen
< SIN6_LEN_RFC2133
)
3072 snum
= ntohs(addr6
->sin6_port
);
3075 err
= security_port_sid(sk
->sk_family
, sk
->sk_type
,
3076 sk
->sk_protocol
, snum
, &sid
);
3080 AVC_AUDIT_DATA_INIT(&ad
,NET
);
3081 ad
.u
.net
.dport
= htons(snum
);
3082 ad
.u
.net
.family
= sk
->sk_family
;
3083 err
= avc_has_perm(isec
->sid
, sid
, isec
->sclass
,
3084 TCP_SOCKET__NAME_CONNECT
, &ad
);
3093 static int selinux_socket_listen(struct socket
*sock
, int backlog
)
3095 return socket_has_perm(current
, sock
, SOCKET__LISTEN
);
3098 static int selinux_socket_accept(struct socket
*sock
, struct socket
*newsock
)
3101 struct inode_security_struct
*isec
;
3102 struct inode_security_struct
*newisec
;
3104 err
= socket_has_perm(current
, sock
, SOCKET__ACCEPT
);
3108 newisec
= SOCK_INODE(newsock
)->i_security
;
3110 isec
= SOCK_INODE(sock
)->i_security
;
3111 newisec
->sclass
= isec
->sclass
;
3112 newisec
->sid
= isec
->sid
;
3113 newisec
->initialized
= 1;
3118 static int selinux_socket_sendmsg(struct socket
*sock
, struct msghdr
*msg
,
3121 return socket_has_perm(current
, sock
, SOCKET__WRITE
);
3124 static int selinux_socket_recvmsg(struct socket
*sock
, struct msghdr
*msg
,
3125 int size
, int flags
)
3127 return socket_has_perm(current
, sock
, SOCKET__READ
);
3130 static int selinux_socket_getsockname(struct socket
*sock
)
3132 return socket_has_perm(current
, sock
, SOCKET__GETATTR
);
3135 static int selinux_socket_getpeername(struct socket
*sock
)
3137 return socket_has_perm(current
, sock
, SOCKET__GETATTR
);
3140 static int selinux_socket_setsockopt(struct socket
*sock
,int level
,int optname
)
3142 return socket_has_perm(current
, sock
, SOCKET__SETOPT
);
3145 static int selinux_socket_getsockopt(struct socket
*sock
, int level
,
3148 return socket_has_perm(current
, sock
, SOCKET__GETOPT
);
3151 static int selinux_socket_shutdown(struct socket
*sock
, int how
)
3153 return socket_has_perm(current
, sock
, SOCKET__SHUTDOWN
);
3156 static int selinux_socket_unix_stream_connect(struct socket
*sock
,
3157 struct socket
*other
,
3160 struct sk_security_struct
*ssec
;
3161 struct inode_security_struct
*isec
;
3162 struct inode_security_struct
*other_isec
;
3163 struct avc_audit_data ad
;
3166 err
= secondary_ops
->unix_stream_connect(sock
, other
, newsk
);
3170 isec
= SOCK_INODE(sock
)->i_security
;
3171 other_isec
= SOCK_INODE(other
)->i_security
;
3173 AVC_AUDIT_DATA_INIT(&ad
,NET
);
3174 ad
.u
.net
.sk
= other
->sk
;
3176 err
= avc_has_perm(isec
->sid
, other_isec
->sid
,
3178 UNIX_STREAM_SOCKET__CONNECTTO
, &ad
);
3182 /* connecting socket */
3183 ssec
= sock
->sk
->sk_security
;
3184 ssec
->peer_sid
= other_isec
->sid
;
3186 /* server child socket */
3187 ssec
= newsk
->sk_security
;
3188 ssec
->peer_sid
= isec
->sid
;
3193 static int selinux_socket_unix_may_send(struct socket
*sock
,
3194 struct socket
*other
)
3196 struct inode_security_struct
*isec
;
3197 struct inode_security_struct
*other_isec
;
3198 struct avc_audit_data ad
;
3201 isec
= SOCK_INODE(sock
)->i_security
;
3202 other_isec
= SOCK_INODE(other
)->i_security
;
3204 AVC_AUDIT_DATA_INIT(&ad
,NET
);
3205 ad
.u
.net
.sk
= other
->sk
;
3207 err
= avc_has_perm(isec
->sid
, other_isec
->sid
,
3208 isec
->sclass
, SOCKET__SENDTO
, &ad
);
3215 static int selinux_socket_sock_rcv_skb(struct sock
*sk
, struct sk_buff
*skb
)
3220 u32 netif_perm
, node_perm
, node_sid
, if_sid
, recv_perm
= 0;
3223 struct socket
*sock
;
3224 struct net_device
*dev
;
3225 struct avc_audit_data ad
;
3227 family
= sk
->sk_family
;
3228 if (family
!= PF_INET
&& family
!= PF_INET6
)
3231 /* Handle mapped IPv4 packets arriving via IPv6 sockets */
3232 if (family
== PF_INET6
&& skb
->protocol
== ntohs(ETH_P_IP
))
3235 read_lock_bh(&sk
->sk_callback_lock
);
3236 sock
= sk
->sk_socket
;
3238 struct inode
*inode
;
3239 inode
= SOCK_INODE(sock
);
3241 struct inode_security_struct
*isec
;
3242 isec
= inode
->i_security
;
3243 sock_sid
= isec
->sid
;
3244 sock_class
= isec
->sclass
;
3247 read_unlock_bh(&sk
->sk_callback_lock
);
3255 err
= sel_netif_sids(dev
, &if_sid
, NULL
);
3259 switch (sock_class
) {
3260 case SECCLASS_UDP_SOCKET
:
3261 netif_perm
= NETIF__UDP_RECV
;
3262 node_perm
= NODE__UDP_RECV
;
3263 recv_perm
= UDP_SOCKET__RECV_MSG
;
3266 case SECCLASS_TCP_SOCKET
:
3267 netif_perm
= NETIF__TCP_RECV
;
3268 node_perm
= NODE__TCP_RECV
;
3269 recv_perm
= TCP_SOCKET__RECV_MSG
;
3273 netif_perm
= NETIF__RAWIP_RECV
;
3274 node_perm
= NODE__RAWIP_RECV
;
3278 AVC_AUDIT_DATA_INIT(&ad
, NET
);
3279 ad
.u
.net
.netif
= dev
->name
;
3280 ad
.u
.net
.family
= family
;
3282 err
= selinux_parse_skb(skb
, &ad
, &addrp
, &len
, 1);
3286 err
= avc_has_perm(sock_sid
, if_sid
, SECCLASS_NETIF
, netif_perm
, &ad
);
3290 /* Fixme: this lookup is inefficient */
3291 err
= security_node_sid(family
, addrp
, len
, &node_sid
);
3295 err
= avc_has_perm(sock_sid
, node_sid
, SECCLASS_NODE
, node_perm
, &ad
);
3302 /* Fixme: make this more efficient */
3303 err
= security_port_sid(sk
->sk_family
, sk
->sk_type
,
3304 sk
->sk_protocol
, ntohs(ad
.u
.net
.sport
),
3309 err
= avc_has_perm(sock_sid
, port_sid
,
3310 sock_class
, recv_perm
, &ad
);
3314 err
= selinux_xfrm_sock_rcv_skb(sock_sid
, skb
);
3320 static int selinux_socket_getpeersec_stream(struct socket
*sock
, char __user
*optval
,
3321 int __user
*optlen
, unsigned len
)
3326 struct sk_security_struct
*ssec
;
3327 struct inode_security_struct
*isec
;
3330 isec
= SOCK_INODE(sock
)->i_security
;
3332 /* if UNIX_STREAM check peer_sid, if TCP check dst for labelled sa */
3333 if (isec
->sclass
== SECCLASS_UNIX_STREAM_SOCKET
) {
3334 ssec
= sock
->sk
->sk_security
;
3335 peer_sid
= ssec
->peer_sid
;
3337 else if (isec
->sclass
== SECCLASS_TCP_SOCKET
) {
3338 peer_sid
= selinux_socket_getpeer_stream(sock
->sk
);
3340 if (peer_sid
== SECSID_NULL
) {
3350 err
= security_sid_to_context(peer_sid
, &scontext
, &scontext_len
);
3355 if (scontext_len
> len
) {
3360 if (copy_to_user(optval
, scontext
, scontext_len
))
3364 if (put_user(scontext_len
, optlen
))
3372 static int selinux_socket_getpeersec_dgram(struct sk_buff
*skb
, char **secdata
, u32
*seclen
)
3375 u32 peer_sid
= selinux_socket_getpeer_dgram(skb
);
3377 if (peer_sid
== SECSID_NULL
)
3380 err
= security_sid_to_context(peer_sid
, secdata
, seclen
);
3389 static int selinux_sk_alloc_security(struct sock
*sk
, int family
, gfp_t priority
)
3391 return sk_alloc_security(sk
, family
, priority
);
3394 static void selinux_sk_free_security(struct sock
*sk
)
3396 sk_free_security(sk
);
3399 static unsigned int selinux_sk_getsid_security(struct sock
*sk
, struct flowi
*fl
, u8 dir
)
3401 struct inode_security_struct
*isec
;
3402 u32 sock_sid
= SECINITSID_ANY_SOCKET
;
3405 return selinux_no_sk_sid(fl
);
3407 read_lock_bh(&sk
->sk_callback_lock
);
3408 isec
= get_sock_isec(sk
);
3411 sock_sid
= isec
->sid
;
3413 read_unlock_bh(&sk
->sk_callback_lock
);
3417 static int selinux_nlmsg_perm(struct sock
*sk
, struct sk_buff
*skb
)
3421 struct nlmsghdr
*nlh
;
3422 struct socket
*sock
= sk
->sk_socket
;
3423 struct inode_security_struct
*isec
= SOCK_INODE(sock
)->i_security
;
3425 if (skb
->len
< NLMSG_SPACE(0)) {
3429 nlh
= (struct nlmsghdr
*)skb
->data
;
3431 err
= selinux_nlmsg_lookup(isec
->sclass
, nlh
->nlmsg_type
, &perm
);
3433 if (err
== -EINVAL
) {
3434 audit_log(current
->audit_context
, GFP_KERNEL
, AUDIT_SELINUX_ERR
,
3435 "SELinux: unrecognized netlink message"
3436 " type=%hu for sclass=%hu\n",
3437 nlh
->nlmsg_type
, isec
->sclass
);
3438 if (!selinux_enforcing
)
3448 err
= socket_has_perm(current
, sock
, perm
);
3453 #ifdef CONFIG_NETFILTER
3455 static unsigned int selinux_ip_postroute_last(unsigned int hooknum
,
3456 struct sk_buff
**pskb
,
3457 const struct net_device
*in
,
3458 const struct net_device
*out
,
3459 int (*okfn
)(struct sk_buff
*),
3463 int len
, err
= NF_ACCEPT
;
3464 u32 netif_perm
, node_perm
, node_sid
, if_sid
, send_perm
= 0;
3466 struct socket
*sock
;
3467 struct inode
*inode
;
3468 struct sk_buff
*skb
= *pskb
;
3469 struct inode_security_struct
*isec
;
3470 struct avc_audit_data ad
;
3471 struct net_device
*dev
= (struct net_device
*)out
;
3477 sock
= sk
->sk_socket
;
3481 inode
= SOCK_INODE(sock
);
3485 err
= sel_netif_sids(dev
, &if_sid
, NULL
);
3489 isec
= inode
->i_security
;
3491 switch (isec
->sclass
) {
3492 case SECCLASS_UDP_SOCKET
:
3493 netif_perm
= NETIF__UDP_SEND
;
3494 node_perm
= NODE__UDP_SEND
;
3495 send_perm
= UDP_SOCKET__SEND_MSG
;
3498 case SECCLASS_TCP_SOCKET
:
3499 netif_perm
= NETIF__TCP_SEND
;
3500 node_perm
= NODE__TCP_SEND
;
3501 send_perm
= TCP_SOCKET__SEND_MSG
;
3505 netif_perm
= NETIF__RAWIP_SEND
;
3506 node_perm
= NODE__RAWIP_SEND
;
3511 AVC_AUDIT_DATA_INIT(&ad
, NET
);
3512 ad
.u
.net
.netif
= dev
->name
;
3513 ad
.u
.net
.family
= family
;
3515 err
= selinux_parse_skb(skb
, &ad
, &addrp
,
3516 &len
, 0) ? NF_DROP
: NF_ACCEPT
;
3517 if (err
!= NF_ACCEPT
)
3520 err
= avc_has_perm(isec
->sid
, if_sid
, SECCLASS_NETIF
,
3521 netif_perm
, &ad
) ? NF_DROP
: NF_ACCEPT
;
3522 if (err
!= NF_ACCEPT
)
3525 /* Fixme: this lookup is inefficient */
3526 err
= security_node_sid(family
, addrp
, len
,
3527 &node_sid
) ? NF_DROP
: NF_ACCEPT
;
3528 if (err
!= NF_ACCEPT
)
3531 err
= avc_has_perm(isec
->sid
, node_sid
, SECCLASS_NODE
,
3532 node_perm
, &ad
) ? NF_DROP
: NF_ACCEPT
;
3533 if (err
!= NF_ACCEPT
)
3539 /* Fixme: make this more efficient */
3540 err
= security_port_sid(sk
->sk_family
,
3543 ntohs(ad
.u
.net
.dport
),
3544 &port_sid
) ? NF_DROP
: NF_ACCEPT
;
3545 if (err
!= NF_ACCEPT
)
3548 err
= avc_has_perm(isec
->sid
, port_sid
, isec
->sclass
,
3549 send_perm
, &ad
) ? NF_DROP
: NF_ACCEPT
;
3552 if (err
!= NF_ACCEPT
)
3555 err
= selinux_xfrm_postroute_last(isec
->sid
, skb
);
3561 static unsigned int selinux_ipv4_postroute_last(unsigned int hooknum
,
3562 struct sk_buff
**pskb
,
3563 const struct net_device
*in
,
3564 const struct net_device
*out
,
3565 int (*okfn
)(struct sk_buff
*))
3567 return selinux_ip_postroute_last(hooknum
, pskb
, in
, out
, okfn
, PF_INET
);
3570 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3572 static unsigned int selinux_ipv6_postroute_last(unsigned int hooknum
,
3573 struct sk_buff
**pskb
,
3574 const struct net_device
*in
,
3575 const struct net_device
*out
,
3576 int (*okfn
)(struct sk_buff
*))
3578 return selinux_ip_postroute_last(hooknum
, pskb
, in
, out
, okfn
, PF_INET6
);
3583 #endif /* CONFIG_NETFILTER */
3585 static int selinux_netlink_send(struct sock
*sk
, struct sk_buff
*skb
)
3587 struct task_security_struct
*tsec
;
3588 struct av_decision avd
;
3591 err
= secondary_ops
->netlink_send(sk
, skb
);
3595 tsec
= current
->security
;
3598 avc_has_perm_noaudit(tsec
->sid
, tsec
->sid
,
3599 SECCLASS_CAPABILITY
, ~0, &avd
);
3600 cap_mask(NETLINK_CB(skb
).eff_cap
, avd
.allowed
);
3602 if (policydb_loaded_version
>= POLICYDB_VERSION_NLCLASS
)
3603 err
= selinux_nlmsg_perm(sk
, skb
);
3608 static int selinux_netlink_recv(struct sk_buff
*skb
)
3610 if (!cap_raised(NETLINK_CB(skb
).eff_cap
, CAP_NET_ADMIN
))
3615 static int ipc_alloc_security(struct task_struct
*task
,
3616 struct kern_ipc_perm
*perm
,
3619 struct task_security_struct
*tsec
= task
->security
;
3620 struct ipc_security_struct
*isec
;
3622 isec
= kzalloc(sizeof(struct ipc_security_struct
), GFP_KERNEL
);
3626 isec
->sclass
= sclass
;
3627 isec
->ipc_perm
= perm
;
3628 isec
->sid
= tsec
->sid
;
3629 perm
->security
= isec
;
3634 static void ipc_free_security(struct kern_ipc_perm
*perm
)
3636 struct ipc_security_struct
*isec
= perm
->security
;
3637 perm
->security
= NULL
;
3641 static int msg_msg_alloc_security(struct msg_msg
*msg
)
3643 struct msg_security_struct
*msec
;
3645 msec
= kzalloc(sizeof(struct msg_security_struct
), GFP_KERNEL
);
3650 msec
->sid
= SECINITSID_UNLABELED
;
3651 msg
->security
= msec
;
3656 static void msg_msg_free_security(struct msg_msg
*msg
)
3658 struct msg_security_struct
*msec
= msg
->security
;
3660 msg
->security
= NULL
;
3664 static int ipc_has_perm(struct kern_ipc_perm
*ipc_perms
,
3667 struct task_security_struct
*tsec
;
3668 struct ipc_security_struct
*isec
;
3669 struct avc_audit_data ad
;
3671 tsec
= current
->security
;
3672 isec
= ipc_perms
->security
;
3674 AVC_AUDIT_DATA_INIT(&ad
, IPC
);
3675 ad
.u
.ipc_id
= ipc_perms
->key
;
3677 return avc_has_perm(tsec
->sid
, isec
->sid
, isec
->sclass
, perms
, &ad
);
3680 static int selinux_msg_msg_alloc_security(struct msg_msg
*msg
)
3682 return msg_msg_alloc_security(msg
);
3685 static void selinux_msg_msg_free_security(struct msg_msg
*msg
)
3687 msg_msg_free_security(msg
);
3690 /* message queue security operations */
3691 static int selinux_msg_queue_alloc_security(struct msg_queue
*msq
)
3693 struct task_security_struct
*tsec
;
3694 struct ipc_security_struct
*isec
;
3695 struct avc_audit_data ad
;
3698 rc
= ipc_alloc_security(current
, &msq
->q_perm
, SECCLASS_MSGQ
);
3702 tsec
= current
->security
;
3703 isec
= msq
->q_perm
.security
;
3705 AVC_AUDIT_DATA_INIT(&ad
, IPC
);
3706 ad
.u
.ipc_id
= msq
->q_perm
.key
;
3708 rc
= avc_has_perm(tsec
->sid
, isec
->sid
, SECCLASS_MSGQ
,
3711 ipc_free_security(&msq
->q_perm
);
3717 static void selinux_msg_queue_free_security(struct msg_queue
*msq
)
3719 ipc_free_security(&msq
->q_perm
);
3722 static int selinux_msg_queue_associate(struct msg_queue
*msq
, int msqflg
)
3724 struct task_security_struct
*tsec
;
3725 struct ipc_security_struct
*isec
;
3726 struct avc_audit_data ad
;
3728 tsec
= current
->security
;
3729 isec
= msq
->q_perm
.security
;
3731 AVC_AUDIT_DATA_INIT(&ad
, IPC
);
3732 ad
.u
.ipc_id
= msq
->q_perm
.key
;
3734 return avc_has_perm(tsec
->sid
, isec
->sid
, SECCLASS_MSGQ
,
3735 MSGQ__ASSOCIATE
, &ad
);
3738 static int selinux_msg_queue_msgctl(struct msg_queue
*msq
, int cmd
)
3746 /* No specific object, just general system-wide information. */
3747 return task_has_system(current
, SYSTEM__IPC_INFO
);
3750 perms
= MSGQ__GETATTR
| MSGQ__ASSOCIATE
;
3753 perms
= MSGQ__SETATTR
;
3756 perms
= MSGQ__DESTROY
;
3762 err
= ipc_has_perm(&msq
->q_perm
, perms
);
3766 static int selinux_msg_queue_msgsnd(struct msg_queue
*msq
, struct msg_msg
*msg
, int msqflg
)
3768 struct task_security_struct
*tsec
;
3769 struct ipc_security_struct
*isec
;
3770 struct msg_security_struct
*msec
;
3771 struct avc_audit_data ad
;
3774 tsec
= current
->security
;
3775 isec
= msq
->q_perm
.security
;
3776 msec
= msg
->security
;
3779 * First time through, need to assign label to the message
3781 if (msec
->sid
== SECINITSID_UNLABELED
) {
3783 * Compute new sid based on current process and
3784 * message queue this message will be stored in
3786 rc
= security_transition_sid(tsec
->sid
,
3794 AVC_AUDIT_DATA_INIT(&ad
, IPC
);
3795 ad
.u
.ipc_id
= msq
->q_perm
.key
;
3797 /* Can this process write to the queue? */
3798 rc
= avc_has_perm(tsec
->sid
, isec
->sid
, SECCLASS_MSGQ
,
3801 /* Can this process send the message */
3802 rc
= avc_has_perm(tsec
->sid
, msec
->sid
,
3803 SECCLASS_MSG
, MSG__SEND
, &ad
);
3805 /* Can the message be put in the queue? */
3806 rc
= avc_has_perm(msec
->sid
, isec
->sid
,
3807 SECCLASS_MSGQ
, MSGQ__ENQUEUE
, &ad
);
3812 static int selinux_msg_queue_msgrcv(struct msg_queue
*msq
, struct msg_msg
*msg
,
3813 struct task_struct
*target
,
3814 long type
, int mode
)
3816 struct task_security_struct
*tsec
;
3817 struct ipc_security_struct
*isec
;
3818 struct msg_security_struct
*msec
;
3819 struct avc_audit_data ad
;
3822 tsec
= target
->security
;
3823 isec
= msq
->q_perm
.security
;
3824 msec
= msg
->security
;
3826 AVC_AUDIT_DATA_INIT(&ad
, IPC
);
3827 ad
.u
.ipc_id
= msq
->q_perm
.key
;
3829 rc
= avc_has_perm(tsec
->sid
, isec
->sid
,
3830 SECCLASS_MSGQ
, MSGQ__READ
, &ad
);
3832 rc
= avc_has_perm(tsec
->sid
, msec
->sid
,
3833 SECCLASS_MSG
, MSG__RECEIVE
, &ad
);
3837 /* Shared Memory security operations */
3838 static int selinux_shm_alloc_security(struct shmid_kernel
*shp
)
3840 struct task_security_struct
*tsec
;
3841 struct ipc_security_struct
*isec
;
3842 struct avc_audit_data ad
;
3845 rc
= ipc_alloc_security(current
, &shp
->shm_perm
, SECCLASS_SHM
);
3849 tsec
= current
->security
;
3850 isec
= shp
->shm_perm
.security
;
3852 AVC_AUDIT_DATA_INIT(&ad
, IPC
);
3853 ad
.u
.ipc_id
= shp
->shm_perm
.key
;
3855 rc
= avc_has_perm(tsec
->sid
, isec
->sid
, SECCLASS_SHM
,
3858 ipc_free_security(&shp
->shm_perm
);
3864 static void selinux_shm_free_security(struct shmid_kernel
*shp
)
3866 ipc_free_security(&shp
->shm_perm
);
3869 static int selinux_shm_associate(struct shmid_kernel
*shp
, int shmflg
)
3871 struct task_security_struct
*tsec
;
3872 struct ipc_security_struct
*isec
;
3873 struct avc_audit_data ad
;
3875 tsec
= current
->security
;
3876 isec
= shp
->shm_perm
.security
;
3878 AVC_AUDIT_DATA_INIT(&ad
, IPC
);
3879 ad
.u
.ipc_id
= shp
->shm_perm
.key
;
3881 return avc_has_perm(tsec
->sid
, isec
->sid
, SECCLASS_SHM
,
3882 SHM__ASSOCIATE
, &ad
);
3885 /* Note, at this point, shp is locked down */
3886 static int selinux_shm_shmctl(struct shmid_kernel
*shp
, int cmd
)
3894 /* No specific object, just general system-wide information. */
3895 return task_has_system(current
, SYSTEM__IPC_INFO
);
3898 perms
= SHM__GETATTR
| SHM__ASSOCIATE
;
3901 perms
= SHM__SETATTR
;
3908 perms
= SHM__DESTROY
;
3914 err
= ipc_has_perm(&shp
->shm_perm
, perms
);
3918 static int selinux_shm_shmat(struct shmid_kernel
*shp
,
3919 char __user
*shmaddr
, int shmflg
)
3924 rc
= secondary_ops
->shm_shmat(shp
, shmaddr
, shmflg
);
3928 if (shmflg
& SHM_RDONLY
)
3931 perms
= SHM__READ
| SHM__WRITE
;
3933 return ipc_has_perm(&shp
->shm_perm
, perms
);
3936 /* Semaphore security operations */
3937 static int selinux_sem_alloc_security(struct sem_array
*sma
)
3939 struct task_security_struct
*tsec
;
3940 struct ipc_security_struct
*isec
;
3941 struct avc_audit_data ad
;
3944 rc
= ipc_alloc_security(current
, &sma
->sem_perm
, SECCLASS_SEM
);
3948 tsec
= current
->security
;
3949 isec
= sma
->sem_perm
.security
;
3951 AVC_AUDIT_DATA_INIT(&ad
, IPC
);
3952 ad
.u
.ipc_id
= sma
->sem_perm
.key
;
3954 rc
= avc_has_perm(tsec
->sid
, isec
->sid
, SECCLASS_SEM
,
3957 ipc_free_security(&sma
->sem_perm
);
3963 static void selinux_sem_free_security(struct sem_array
*sma
)
3965 ipc_free_security(&sma
->sem_perm
);
3968 static int selinux_sem_associate(struct sem_array
*sma
, int semflg
)
3970 struct task_security_struct
*tsec
;
3971 struct ipc_security_struct
*isec
;
3972 struct avc_audit_data ad
;
3974 tsec
= current
->security
;
3975 isec
= sma
->sem_perm
.security
;
3977 AVC_AUDIT_DATA_INIT(&ad
, IPC
);
3978 ad
.u
.ipc_id
= sma
->sem_perm
.key
;
3980 return avc_has_perm(tsec
->sid
, isec
->sid
, SECCLASS_SEM
,
3981 SEM__ASSOCIATE
, &ad
);
3984 /* Note, at this point, sma is locked down */
3985 static int selinux_sem_semctl(struct sem_array
*sma
, int cmd
)
3993 /* No specific object, just general system-wide information. */
3994 return task_has_system(current
, SYSTEM__IPC_INFO
);
3998 perms
= SEM__GETATTR
;
4009 perms
= SEM__DESTROY
;
4012 perms
= SEM__SETATTR
;
4016 perms
= SEM__GETATTR
| SEM__ASSOCIATE
;
4022 err
= ipc_has_perm(&sma
->sem_perm
, perms
);
4026 static int selinux_sem_semop(struct sem_array
*sma
,
4027 struct sembuf
*sops
, unsigned nsops
, int alter
)
4032 perms
= SEM__READ
| SEM__WRITE
;
4036 return ipc_has_perm(&sma
->sem_perm
, perms
);
4039 static int selinux_ipc_permission(struct kern_ipc_perm
*ipcp
, short flag
)
4045 av
|= IPC__UNIX_READ
;
4047 av
|= IPC__UNIX_WRITE
;
4052 return ipc_has_perm(ipcp
, av
);
4055 static int selinux_ipc_getsecurity(struct kern_ipc_perm
*ipcp
, void *buffer
, size_t size
)
4057 struct ipc_security_struct
*isec
= ipcp
->security
;
4059 return selinux_getsecurity(isec
->sid
, buffer
, size
);
4062 /* module stacking operations */
4063 static int selinux_register_security (const char *name
, struct security_operations
*ops
)
4065 if (secondary_ops
!= original_ops
) {
4066 printk(KERN_INFO
"%s: There is already a secondary security "
4067 "module registered.\n", __FUNCTION__
);
4071 secondary_ops
= ops
;
4073 printk(KERN_INFO
"%s: Registering secondary module %s\n",
4080 static int selinux_unregister_security (const char *name
, struct security_operations
*ops
)
4082 if (ops
!= secondary_ops
) {
4083 printk (KERN_INFO
"%s: trying to unregister a security module "
4084 "that is not registered.\n", __FUNCTION__
);
4088 secondary_ops
= original_ops
;
4093 static void selinux_d_instantiate (struct dentry
*dentry
, struct inode
*inode
)
4096 inode_doinit_with_dentry(inode
, dentry
);
4099 static int selinux_getprocattr(struct task_struct
*p
,
4100 char *name
, void *value
, size_t size
)
4102 struct task_security_struct
*tsec
;
4107 error
= task_has_perm(current
, p
, PROCESS__GETATTR
);
4114 if (!strcmp(name
, "current"))
4116 else if (!strcmp(name
, "prev"))
4118 else if (!strcmp(name
, "exec"))
4119 sid
= tsec
->exec_sid
;
4120 else if (!strcmp(name
, "fscreate"))
4121 sid
= tsec
->create_sid
;
4128 return selinux_getsecurity(sid
, value
, size
);
4131 static int selinux_setprocattr(struct task_struct
*p
,
4132 char *name
, void *value
, size_t size
)
4134 struct task_security_struct
*tsec
;
4140 /* SELinux only allows a process to change its own
4141 security attributes. */
4146 * Basic control over ability to set these attributes at all.
4147 * current == p, but we'll pass them separately in case the
4148 * above restriction is ever removed.
4150 if (!strcmp(name
, "exec"))
4151 error
= task_has_perm(current
, p
, PROCESS__SETEXEC
);
4152 else if (!strcmp(name
, "fscreate"))
4153 error
= task_has_perm(current
, p
, PROCESS__SETFSCREATE
);
4154 else if (!strcmp(name
, "current"))
4155 error
= task_has_perm(current
, p
, PROCESS__SETCURRENT
);
4161 /* Obtain a SID for the context, if one was specified. */
4162 if (size
&& str
[1] && str
[1] != '\n') {
4163 if (str
[size
-1] == '\n') {
4167 error
= security_context_to_sid(value
, size
, &sid
);
4172 /* Permission checking based on the specified context is
4173 performed during the actual operation (execve,
4174 open/mkdir/...), when we know the full context of the
4175 operation. See selinux_bprm_set_security for the execve
4176 checks and may_create for the file creation checks. The
4177 operation will then fail if the context is not permitted. */
4179 if (!strcmp(name
, "exec"))
4180 tsec
->exec_sid
= sid
;
4181 else if (!strcmp(name
, "fscreate"))
4182 tsec
->create_sid
= sid
;
4183 else if (!strcmp(name
, "current")) {
4184 struct av_decision avd
;
4189 /* Only allow single threaded processes to change context */
4190 if (atomic_read(&p
->mm
->mm_users
) != 1) {
4191 struct task_struct
*g
, *t
;
4192 struct mm_struct
*mm
= p
->mm
;
4193 read_lock(&tasklist_lock
);
4194 do_each_thread(g
, t
)
4195 if (t
->mm
== mm
&& t
!= p
) {
4196 read_unlock(&tasklist_lock
);
4199 while_each_thread(g
, t
);
4200 read_unlock(&tasklist_lock
);
4203 /* Check permissions for the transition. */
4204 error
= avc_has_perm(tsec
->sid
, sid
, SECCLASS_PROCESS
,
4205 PROCESS__DYNTRANSITION
, NULL
);
4209 /* Check for ptracing, and update the task SID if ok.
4210 Otherwise, leave SID unchanged and fail. */
4212 if (p
->ptrace
& PT_PTRACED
) {
4213 error
= avc_has_perm_noaudit(tsec
->ptrace_sid
, sid
,
4215 PROCESS__PTRACE
, &avd
);
4219 avc_audit(tsec
->ptrace_sid
, sid
, SECCLASS_PROCESS
,
4220 PROCESS__PTRACE
, &avd
, error
, NULL
);
4234 static struct security_operations selinux_ops
= {
4235 .ptrace
= selinux_ptrace
,
4236 .capget
= selinux_capget
,
4237 .capset_check
= selinux_capset_check
,
4238 .capset_set
= selinux_capset_set
,
4239 .sysctl
= selinux_sysctl
,
4240 .capable
= selinux_capable
,
4241 .quotactl
= selinux_quotactl
,
4242 .quota_on
= selinux_quota_on
,
4243 .syslog
= selinux_syslog
,
4244 .vm_enough_memory
= selinux_vm_enough_memory
,
4246 .netlink_send
= selinux_netlink_send
,
4247 .netlink_recv
= selinux_netlink_recv
,
4249 .bprm_alloc_security
= selinux_bprm_alloc_security
,
4250 .bprm_free_security
= selinux_bprm_free_security
,
4251 .bprm_apply_creds
= selinux_bprm_apply_creds
,
4252 .bprm_post_apply_creds
= selinux_bprm_post_apply_creds
,
4253 .bprm_set_security
= selinux_bprm_set_security
,
4254 .bprm_check_security
= selinux_bprm_check_security
,
4255 .bprm_secureexec
= selinux_bprm_secureexec
,
4257 .sb_alloc_security
= selinux_sb_alloc_security
,
4258 .sb_free_security
= selinux_sb_free_security
,
4259 .sb_copy_data
= selinux_sb_copy_data
,
4260 .sb_kern_mount
= selinux_sb_kern_mount
,
4261 .sb_statfs
= selinux_sb_statfs
,
4262 .sb_mount
= selinux_mount
,
4263 .sb_umount
= selinux_umount
,
4265 .inode_alloc_security
= selinux_inode_alloc_security
,
4266 .inode_free_security
= selinux_inode_free_security
,
4267 .inode_init_security
= selinux_inode_init_security
,
4268 .inode_create
= selinux_inode_create
,
4269 .inode_link
= selinux_inode_link
,
4270 .inode_unlink
= selinux_inode_unlink
,
4271 .inode_symlink
= selinux_inode_symlink
,
4272 .inode_mkdir
= selinux_inode_mkdir
,
4273 .inode_rmdir
= selinux_inode_rmdir
,
4274 .inode_mknod
= selinux_inode_mknod
,
4275 .inode_rename
= selinux_inode_rename
,
4276 .inode_readlink
= selinux_inode_readlink
,
4277 .inode_follow_link
= selinux_inode_follow_link
,
4278 .inode_permission
= selinux_inode_permission
,
4279 .inode_setattr
= selinux_inode_setattr
,
4280 .inode_getattr
= selinux_inode_getattr
,
4281 .inode_setxattr
= selinux_inode_setxattr
,
4282 .inode_post_setxattr
= selinux_inode_post_setxattr
,
4283 .inode_getxattr
= selinux_inode_getxattr
,
4284 .inode_listxattr
= selinux_inode_listxattr
,
4285 .inode_removexattr
= selinux_inode_removexattr
,
4286 .inode_xattr_getsuffix
= selinux_inode_xattr_getsuffix
,
4287 .inode_getsecurity
= selinux_inode_getsecurity
,
4288 .inode_setsecurity
= selinux_inode_setsecurity
,
4289 .inode_listsecurity
= selinux_inode_listsecurity
,
4291 .file_permission
= selinux_file_permission
,
4292 .file_alloc_security
= selinux_file_alloc_security
,
4293 .file_free_security
= selinux_file_free_security
,
4294 .file_ioctl
= selinux_file_ioctl
,
4295 .file_mmap
= selinux_file_mmap
,
4296 .file_mprotect
= selinux_file_mprotect
,
4297 .file_lock
= selinux_file_lock
,
4298 .file_fcntl
= selinux_file_fcntl
,
4299 .file_set_fowner
= selinux_file_set_fowner
,
4300 .file_send_sigiotask
= selinux_file_send_sigiotask
,
4301 .file_receive
= selinux_file_receive
,
4303 .task_create
= selinux_task_create
,
4304 .task_alloc_security
= selinux_task_alloc_security
,
4305 .task_free_security
= selinux_task_free_security
,
4306 .task_setuid
= selinux_task_setuid
,
4307 .task_post_setuid
= selinux_task_post_setuid
,
4308 .task_setgid
= selinux_task_setgid
,
4309 .task_setpgid
= selinux_task_setpgid
,
4310 .task_getpgid
= selinux_task_getpgid
,
4311 .task_getsid
= selinux_task_getsid
,
4312 .task_setgroups
= selinux_task_setgroups
,
4313 .task_setnice
= selinux_task_setnice
,
4314 .task_setrlimit
= selinux_task_setrlimit
,
4315 .task_setscheduler
= selinux_task_setscheduler
,
4316 .task_getscheduler
= selinux_task_getscheduler
,
4317 .task_kill
= selinux_task_kill
,
4318 .task_wait
= selinux_task_wait
,
4319 .task_prctl
= selinux_task_prctl
,
4320 .task_reparent_to_init
= selinux_task_reparent_to_init
,
4321 .task_to_inode
= selinux_task_to_inode
,
4323 .ipc_permission
= selinux_ipc_permission
,
4324 .ipc_getsecurity
= selinux_ipc_getsecurity
,
4326 .msg_msg_alloc_security
= selinux_msg_msg_alloc_security
,
4327 .msg_msg_free_security
= selinux_msg_msg_free_security
,
4329 .msg_queue_alloc_security
= selinux_msg_queue_alloc_security
,
4330 .msg_queue_free_security
= selinux_msg_queue_free_security
,
4331 .msg_queue_associate
= selinux_msg_queue_associate
,
4332 .msg_queue_msgctl
= selinux_msg_queue_msgctl
,
4333 .msg_queue_msgsnd
= selinux_msg_queue_msgsnd
,
4334 .msg_queue_msgrcv
= selinux_msg_queue_msgrcv
,
4336 .shm_alloc_security
= selinux_shm_alloc_security
,
4337 .shm_free_security
= selinux_shm_free_security
,
4338 .shm_associate
= selinux_shm_associate
,
4339 .shm_shmctl
= selinux_shm_shmctl
,
4340 .shm_shmat
= selinux_shm_shmat
,
4342 .sem_alloc_security
= selinux_sem_alloc_security
,
4343 .sem_free_security
= selinux_sem_free_security
,
4344 .sem_associate
= selinux_sem_associate
,
4345 .sem_semctl
= selinux_sem_semctl
,
4346 .sem_semop
= selinux_sem_semop
,
4348 .register_security
= selinux_register_security
,
4349 .unregister_security
= selinux_unregister_security
,
4351 .d_instantiate
= selinux_d_instantiate
,
4353 .getprocattr
= selinux_getprocattr
,
4354 .setprocattr
= selinux_setprocattr
,
4356 .unix_stream_connect
= selinux_socket_unix_stream_connect
,
4357 .unix_may_send
= selinux_socket_unix_may_send
,
4359 .socket_create
= selinux_socket_create
,
4360 .socket_post_create
= selinux_socket_post_create
,
4361 .socket_bind
= selinux_socket_bind
,
4362 .socket_connect
= selinux_socket_connect
,
4363 .socket_listen
= selinux_socket_listen
,
4364 .socket_accept
= selinux_socket_accept
,
4365 .socket_sendmsg
= selinux_socket_sendmsg
,
4366 .socket_recvmsg
= selinux_socket_recvmsg
,
4367 .socket_getsockname
= selinux_socket_getsockname
,
4368 .socket_getpeername
= selinux_socket_getpeername
,
4369 .socket_getsockopt
= selinux_socket_getsockopt
,
4370 .socket_setsockopt
= selinux_socket_setsockopt
,
4371 .socket_shutdown
= selinux_socket_shutdown
,
4372 .socket_sock_rcv_skb
= selinux_socket_sock_rcv_skb
,
4373 .socket_getpeersec_stream
= selinux_socket_getpeersec_stream
,
4374 .socket_getpeersec_dgram
= selinux_socket_getpeersec_dgram
,
4375 .sk_alloc_security
= selinux_sk_alloc_security
,
4376 .sk_free_security
= selinux_sk_free_security
,
4377 .sk_getsid
= selinux_sk_getsid_security
,
4379 #ifdef CONFIG_SECURITY_NETWORK_XFRM
4380 .xfrm_policy_alloc_security
= selinux_xfrm_policy_alloc
,
4381 .xfrm_policy_clone_security
= selinux_xfrm_policy_clone
,
4382 .xfrm_policy_free_security
= selinux_xfrm_policy_free
,
4383 .xfrm_state_alloc_security
= selinux_xfrm_state_alloc
,
4384 .xfrm_state_free_security
= selinux_xfrm_state_free
,
4385 .xfrm_policy_lookup
= selinux_xfrm_policy_lookup
,
4389 static __init
int selinux_init(void)
4391 struct task_security_struct
*tsec
;
4393 if (!selinux_enabled
) {
4394 printk(KERN_INFO
"SELinux: Disabled at boot.\n");
4398 printk(KERN_INFO
"SELinux: Initializing.\n");
4400 /* Set the security state for the initial task. */
4401 if (task_alloc_security(current
))
4402 panic("SELinux: Failed to initialize initial task.\n");
4403 tsec
= current
->security
;
4404 tsec
->osid
= tsec
->sid
= SECINITSID_KERNEL
;
4406 sel_inode_cache
= kmem_cache_create("selinux_inode_security",
4407 sizeof(struct inode_security_struct
),
4408 0, SLAB_PANIC
, NULL
, NULL
);
4411 original_ops
= secondary_ops
= security_ops
;
4413 panic ("SELinux: No initial security operations\n");
4414 if (register_security (&selinux_ops
))
4415 panic("SELinux: Unable to register with kernel.\n");
4417 if (selinux_enforcing
) {
4418 printk(KERN_INFO
"SELinux: Starting in enforcing mode\n");
4420 printk(KERN_INFO
"SELinux: Starting in permissive mode\n");
4425 void selinux_complete_init(void)
4427 printk(KERN_INFO
"SELinux: Completing initialization.\n");
4429 /* Set up any superblocks initialized prior to the policy load. */
4430 printk(KERN_INFO
"SELinux: Setting up existing superblocks.\n");
4431 spin_lock(&sb_security_lock
);
4433 if (!list_empty(&superblock_security_head
)) {
4434 struct superblock_security_struct
*sbsec
=
4435 list_entry(superblock_security_head
.next
,
4436 struct superblock_security_struct
,
4438 struct super_block
*sb
= sbsec
->sb
;
4439 spin_lock(&sb_lock
);
4441 spin_unlock(&sb_lock
);
4442 spin_unlock(&sb_security_lock
);
4443 down_read(&sb
->s_umount
);
4445 superblock_doinit(sb
, NULL
);
4447 spin_lock(&sb_security_lock
);
4448 list_del_init(&sbsec
->list
);
4451 spin_unlock(&sb_security_lock
);
4454 /* SELinux requires early initialization in order to label
4455 all processes and objects when they are created. */
4456 security_initcall(selinux_init
);
4458 #if defined(CONFIG_NETFILTER)
4460 static struct nf_hook_ops selinux_ipv4_op
= {
4461 .hook
= selinux_ipv4_postroute_last
,
4462 .owner
= THIS_MODULE
,
4464 .hooknum
= NF_IP_POST_ROUTING
,
4465 .priority
= NF_IP_PRI_SELINUX_LAST
,
4468 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4470 static struct nf_hook_ops selinux_ipv6_op
= {
4471 .hook
= selinux_ipv6_postroute_last
,
4472 .owner
= THIS_MODULE
,
4474 .hooknum
= NF_IP6_POST_ROUTING
,
4475 .priority
= NF_IP6_PRI_SELINUX_LAST
,
4480 static int __init
selinux_nf_ip_init(void)
4484 if (!selinux_enabled
)
4487 printk(KERN_INFO
"SELinux: Registering netfilter hooks\n");
4489 err
= nf_register_hook(&selinux_ipv4_op
);
4491 panic("SELinux: nf_register_hook for IPv4: error %d\n", err
);
4493 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4495 err
= nf_register_hook(&selinux_ipv6_op
);
4497 panic("SELinux: nf_register_hook for IPv6: error %d\n", err
);
4505 __initcall(selinux_nf_ip_init
);
4507 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
4508 static void selinux_nf_ip_exit(void)
4510 printk(KERN_INFO
"SELinux: Unregistering netfilter hooks\n");
4512 nf_unregister_hook(&selinux_ipv4_op
);
4513 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4514 nf_unregister_hook(&selinux_ipv6_op
);
4519 #else /* CONFIG_NETFILTER */
4521 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
4522 #define selinux_nf_ip_exit()
4525 #endif /* CONFIG_NETFILTER */
4527 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
4528 int selinux_disable(void)
4530 extern void exit_sel_fs(void);
4531 static int selinux_disabled
= 0;
4533 if (ss_initialized
) {
4534 /* Not permitted after initial policy load. */
4538 if (selinux_disabled
) {
4539 /* Only do this once. */
4543 printk(KERN_INFO
"SELinux: Disabled at runtime.\n");
4545 selinux_disabled
= 1;
4547 /* Reset security_ops to the secondary module, dummy or capability. */
4548 security_ops
= secondary_ops
;
4550 /* Unregister netfilter hooks. */
4551 selinux_nf_ip_exit();
4553 /* Unregister selinuxfs. */