?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
of: MSI: Simplify irqdomain lookup
[linux/fpc-iii.git] / security / selinux / hooks.c
blobd0cfaa9f19d08034a3c3600d8381ed166a369388
1 /*
2 * NSA Security-Enhanced Linux (SELinux) security module
3 *
4 * This file contains the SELinux hook function implementations.
5 *
6 * Authors: Stephen Smalley, <sds@epoch.ncsc.mil>
7 * Chris Vance, <cvance@nai.com>
8 * Wayne Salamon, <wsalamon@nai.com>
9 * James Morris <jmorris@redhat.com>
10 *
11 * Copyright (C) 2001,2002 Networks Associates Technology, Inc.
12 * Copyright (C) 2003-2008 Red Hat, Inc., James Morris <jmorris@redhat.com>
13 * Eric Paris <eparis@redhat.com>
14 * Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
15 * <dgoeddel@trustedcs.com>
16 * Copyright (C) 2006, 2007, 2009 Hewlett-Packard Development Company, L.P.
17 * Paul Moore <paul@paul-moore.com>
18 * Copyright (C) 2007 Hitachi Software Engineering Co., Ltd.
19 * Yuichi Nakamura <ynakam@hitachisoft.jp>
20 *
21 * This program is free software; you can redistribute it and/or modify
22 * it under the terms of the GNU General Public License version 2,
23 * as published by the Free Software Foundation.
24 */
25
26 #include <linux/init.h>
27 #include <linux/kd.h>
28 #include <linux/kernel.h>
29 #include <linux/tracehook.h>
30 #include <linux/errno.h>
31 #include <linux/sched.h>
32 #include <linux/lsm_hooks.h>
33 #include <linux/xattr.h>
34 #include <linux/capability.h>
35 #include <linux/unistd.h>
36 #include <linux/mm.h>
37 #include <linux/mman.h>
38 #include <linux/slab.h>
39 #include <linux/pagemap.h>
40 #include <linux/proc_fs.h>
41 #include <linux/swap.h>
42 #include <linux/spinlock.h>
43 #include <linux/syscalls.h>
44 #include <linux/dcache.h>
45 #include <linux/file.h>
46 #include <linux/fdtable.h>
47 #include <linux/namei.h>
48 #include <linux/mount.h>
49 #include <linux/netfilter_ipv4.h>
50 #include <linux/netfilter_ipv6.h>
51 #include <linux/tty.h>
52 #include <net/icmp.h>
53 #include <net/ip.h> /* for local_port_range[] */
54 #include <net/tcp.h> /* struct or_callable used in sock_rcv_skb */
55 #include <net/inet_connection_sock.h>
56 #include <net/net_namespace.h>
57 #include <net/netlabel.h>
58 #include <linux/uaccess.h>
59 #include <asm/ioctls.h>
60 #include <linux/atomic.h>
61 #include <linux/bitops.h>
62 #include <linux/interrupt.h>
63 #include <linux/netdevice.h> /* for network interface checks */
64 #include <net/netlink.h>
65 #include <linux/tcp.h>
66 #include <linux/udp.h>
67 #include <linux/dccp.h>
68 #include <linux/quota.h>
69 #include <linux/un.h> /* for Unix socket types */
70 #include <net/af_unix.h> /* for Unix socket types */
71 #include <linux/parser.h>
72 #include <linux/nfs_mount.h>
73 #include <net/ipv6.h>
74 #include <linux/hugetlb.h>
75 #include <linux/personality.h>
76 #include <linux/audit.h>
77 #include <linux/string.h>
78 #include <linux/selinux.h>
79 #include <linux/mutex.h>
80 #include <linux/posix-timers.h>
81 #include <linux/syslog.h>
82 #include <linux/user_namespace.h>
83 #include <linux/export.h>
84 #include <linux/msg.h>
85 #include <linux/shm.h>
86
87 #include "avc.h"
88 #include "objsec.h"
89 #include "netif.h"
90 #include "netnode.h"
91 #include "netport.h"
92 #include "xfrm.h"
93 #include "netlabel.h"
94 #include "audit.h"
95 #include "avc_ss.h"
96
97 /* SECMARK reference count */
98 static atomic_t selinux_secmark_refcount = ATOMIC_INIT(0);
99
100 #ifdef CONFIG_SECURITY_SELINUX_DEVELOP
101 int selinux_enforcing;
102
103 static int __init enforcing_setup(char *str)
104 {
105 unsigned long enforcing;
106 if (!kstrtoul(str, 0, &enforcing))
107 selinux_enforcing = enforcing ? 1 : 0;
108 return 1;
109 }
110 __setup("enforcing=", enforcing_setup);
111 #endif
112
113 #ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
114 int selinux_enabled = CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE;
115
116 static int __init selinux_enabled_setup(char *str)
117 {
118 unsigned long enabled;
119 if (!kstrtoul(str, 0, &enabled))
120 selinux_enabled = enabled ? 1 : 0;
121 return 1;
122 }
123 __setup("selinux=", selinux_enabled_setup);
124 #else
125 int selinux_enabled = 1;
126 #endif
127
128 static struct kmem_cache *sel_inode_cache;
129 static struct kmem_cache *file_security_cache;
130
131 /**
132 * selinux_secmark_enabled - Check to see if SECMARK is currently enabled
133 *
134 * Description:
135 * This function checks the SECMARK reference counter to see if any SECMARK
136 * targets are currently configured, if the reference counter is greater than
137 * zero SECMARK is considered to be enabled. Returns true (1) if SECMARK is
138 * enabled, false (0) if SECMARK is disabled. If the always_check_network
139 * policy capability is enabled, SECMARK is always considered enabled.
140 *
141 */
142 static int selinux_secmark_enabled(void)
143 {
144 return (selinux_policycap_alwaysnetwork || atomic_read(&selinux_secmark_refcount));
145 }
146
147 /**
148 * selinux_peerlbl_enabled - Check to see if peer labeling is currently enabled
149 *
150 * Description:
151 * This function checks if NetLabel or labeled IPSEC is enabled. Returns true
152 * (1) if any are enabled or false (0) if neither are enabled. If the
153 * always_check_network policy capability is enabled, peer labeling
154 * is always considered enabled.
155 *
156 */
157 static int selinux_peerlbl_enabled(void)
158 {
159 return (selinux_policycap_alwaysnetwork || netlbl_enabled() || selinux_xfrm_enabled());
160 }
161
162 static int selinux_netcache_avc_callback(u32 event)
163 {
164 if (event == AVC_CALLBACK_RESET) {
165 sel_netif_flush();
166 sel_netnode_flush();
167 sel_netport_flush();
168 synchronize_net();
169 }
170 return 0;
171 }
172
173 /*
174 * initialise the security for the init task
175 */
176 static void cred_init_security(void)
177 {
178 struct cred *cred = (struct cred *) current->real_cred;
179 struct task_security_struct *tsec;
180
181 tsec = kzalloc(sizeof(struct task_security_struct), GFP_KERNEL);
182 if (!tsec)
183 panic("SELinux: Failed to initialize initial task.\n");
184
185 tsec->osid = tsec->sid = SECINITSID_KERNEL;
186 cred->security = tsec;
187 }
188
189 /*
190 * get the security ID of a set of credentials
191 */
192 static inline u32 cred_sid(const struct cred *cred)
193 {
194 const struct task_security_struct *tsec;
195
196 tsec = cred->security;
197 return tsec->sid;
198 }
199
200 /*
201 * get the objective security ID of a task
202 */
203 static inline u32 task_sid(const struct task_struct *task)
204 {
205 u32 sid;
206
207 rcu_read_lock();
208 sid = cred_sid(__task_cred(task));
209 rcu_read_unlock();
210 return sid;
211 }
212
213 /*
214 * get the subjective security ID of the current task
215 */
216 static inline u32 current_sid(void)
217 {
218 const struct task_security_struct *tsec = current_security();
219
220 return tsec->sid;
221 }
222
223 /* Allocate and free functions for each kind of security blob. */
224
225 static int inode_alloc_security(struct inode *inode)
226 {
227 struct inode_security_struct *isec;
228 u32 sid = current_sid();
229
230 isec = kmem_cache_zalloc(sel_inode_cache, GFP_NOFS);
231 if (!isec)
232 return -ENOMEM;
233
234 mutex_init(&isec->lock);
235 INIT_LIST_HEAD(&isec->list);
236 isec->inode = inode;
237 isec->sid = SECINITSID_UNLABELED;
238 isec->sclass = SECCLASS_FILE;
239 isec->task_sid = sid;
240 inode->i_security = isec;
241
242 return 0;
243 }
244
245 static void inode_free_rcu(struct rcu_head *head)
246 {
247 struct inode_security_struct *isec;
248
249 isec = container_of(head, struct inode_security_struct, rcu);
250 kmem_cache_free(sel_inode_cache, isec);
251 }
252
253 static void inode_free_security(struct inode *inode)
254 {
255 struct inode_security_struct *isec = inode->i_security;
256 struct superblock_security_struct *sbsec = inode->i_sb->s_security;
257
258 /*
259 * As not all inode security structures are in a list, we check for
260 * empty list outside of the lock to make sure that we won't waste
261 * time taking a lock doing nothing.
262 *
263 * The list_del_init() function can be safely called more than once.
264 * It should not be possible for this function to be called with
265 * concurrent list_add(), but for better safety against future changes
266 * in the code, we use list_empty_careful() here.
267 */
268 if (!list_empty_careful(&isec->list)) {
269 spin_lock(&sbsec->isec_lock);
270 list_del_init(&isec->list);
271 spin_unlock(&sbsec->isec_lock);
272 }
273
274 /*
275 * The inode may still be referenced in a path walk and
276 * a call to selinux_inode_permission() can be made
277 * after inode_free_security() is called. Ideally, the VFS
278 * wouldn't do this, but fixing that is a much harder
279 * job. For now, simply free the i_security via RCU, and
280 * leave the current inode->i_security pointer intact.
281 * The inode will be freed after the RCU grace period too.
282 */
283 call_rcu(&isec->rcu, inode_free_rcu);
284 }
285
286 static int file_alloc_security(struct file *file)
287 {
288 struct file_security_struct *fsec;
289 u32 sid = current_sid();
290
291 fsec = kmem_cache_zalloc(file_security_cache, GFP_KERNEL);
292 if (!fsec)
293 return -ENOMEM;
294
295 fsec->sid = sid;
296 fsec->fown_sid = sid;
297 file->f_security = fsec;
298
299 return 0;
300 }
301
302 static void file_free_security(struct file *file)
303 {
304 struct file_security_struct *fsec = file->f_security;
305 file->f_security = NULL;
306 kmem_cache_free(file_security_cache, fsec);
307 }
308
309 static int superblock_alloc_security(struct super_block *sb)
310 {
311 struct superblock_security_struct *sbsec;
312
313 sbsec = kzalloc(sizeof(struct superblock_security_struct), GFP_KERNEL);
314 if (!sbsec)
315 return -ENOMEM;
316
317 mutex_init(&sbsec->lock);
318 INIT_LIST_HEAD(&sbsec->isec_head);
319 spin_lock_init(&sbsec->isec_lock);
320 sbsec->sb = sb;
321 sbsec->sid = SECINITSID_UNLABELED;
322 sbsec->def_sid = SECINITSID_FILE;
323 sbsec->mntpoint_sid = SECINITSID_UNLABELED;
324 sb->s_security = sbsec;
325
326 return 0;
327 }
328
329 static void superblock_free_security(struct super_block *sb)
330 {
331 struct superblock_security_struct *sbsec = sb->s_security;
332 sb->s_security = NULL;
333 kfree(sbsec);
334 }
335
336 /* The file system's label must be initialized prior to use. */
337
338 static const char *labeling_behaviors[7] = {
339 "uses xattr",
340 "uses transition SIDs",
341 "uses task SIDs",
342 "uses genfs_contexts",
343 "not configured for labeling",
344 "uses mountpoint labeling",
345 "uses native labeling",
346 };
347
348 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
349
350 static inline int inode_doinit(struct inode *inode)
351 {
352 return inode_doinit_with_dentry(inode, NULL);
353 }
354
355 enum {
356 Opt_error = -1,
357 Opt_context = 1,
358 Opt_fscontext = 2,
359 Opt_defcontext = 3,
360 Opt_rootcontext = 4,
361 Opt_labelsupport = 5,
362 Opt_nextmntopt = 6,
363 };
364
365 #define NUM_SEL_MNT_OPTS (Opt_nextmntopt - 1)
366
367 static const match_table_t tokens = {
368 {Opt_context, CONTEXT_STR "%s"},
369 {Opt_fscontext, FSCONTEXT_STR "%s"},
370 {Opt_defcontext, DEFCONTEXT_STR "%s"},
371 {Opt_rootcontext, ROOTCONTEXT_STR "%s"},
372 {Opt_labelsupport, LABELSUPP_STR},
373 {Opt_error, NULL},
374 };
375
376 #define SEL_MOUNT_FAIL_MSG "SELinux: duplicate or incompatible mount options\n"
377
378 static int may_context_mount_sb_relabel(u32 sid,
379 struct superblock_security_struct *sbsec,
380 const struct cred *cred)
381 {
382 const struct task_security_struct *tsec = cred->security;
383 int rc;
384
385 rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
386 FILESYSTEM__RELABELFROM, NULL);
387 if (rc)
388 return rc;
389
390 rc = avc_has_perm(tsec->sid, sid, SECCLASS_FILESYSTEM,
391 FILESYSTEM__RELABELTO, NULL);
392 return rc;
393 }
394
395 static int may_context_mount_inode_relabel(u32 sid,
396 struct superblock_security_struct *sbsec,
397 const struct cred *cred)
398 {
399 const struct task_security_struct *tsec = cred->security;
400 int rc;
401 rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
402 FILESYSTEM__RELABELFROM, NULL);
403 if (rc)
404 return rc;
405
406 rc = avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM,
407 FILESYSTEM__ASSOCIATE, NULL);
408 return rc;
409 }
410
411 static int selinux_is_sblabel_mnt(struct super_block *sb)
412 {
413 struct superblock_security_struct *sbsec = sb->s_security;
414
415 return sbsec->behavior == SECURITY_FS_USE_XATTR ||
416 sbsec->behavior == SECURITY_FS_USE_TRANS ||
417 sbsec->behavior == SECURITY_FS_USE_TASK ||
418 sbsec->behavior == SECURITY_FS_USE_NATIVE ||
419 /* Special handling. Genfs but also in-core setxattr handler */
420 !strcmp(sb->s_type->name, "sysfs") ||
421 !strcmp(sb->s_type->name, "pstore") ||
422 !strcmp(sb->s_type->name, "debugfs") ||
423 !strcmp(sb->s_type->name, "rootfs");
424 }
425
426 static int sb_finish_set_opts(struct super_block *sb)
427 {
428 struct superblock_security_struct *sbsec = sb->s_security;
429 struct dentry *root = sb->s_root;
430 struct inode *root_inode = d_backing_inode(root);
431 int rc = 0;
432
433 if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
434 /* Make sure that the xattr handler exists and that no
435 error other than -ENODATA is returned by getxattr on
436 the root directory. -ENODATA is ok, as this may be
437 the first boot of the SELinux kernel before we have
438 assigned xattr values to the filesystem. */
439 if (!root_inode->i_op->getxattr) {
440 printk(KERN_WARNING "SELinux: (dev %s, type %s) has no "
441 "xattr support\n", sb->s_id, sb->s_type->name);
442 rc = -EOPNOTSUPP;
443 goto out;
444 }
445 rc = root_inode->i_op->getxattr(root, XATTR_NAME_SELINUX, NULL, 0);
446 if (rc < 0 && rc != -ENODATA) {
447 if (rc == -EOPNOTSUPP)
448 printk(KERN_WARNING "SELinux: (dev %s, type "
449 "%s) has no security xattr handler\n",
450 sb->s_id, sb->s_type->name);
451 else
452 printk(KERN_WARNING "SELinux: (dev %s, type "
453 "%s) getxattr errno %d\n", sb->s_id,
454 sb->s_type->name, -rc);
455 goto out;
456 }
457 }
458
459 if (sbsec->behavior > ARRAY_SIZE(labeling_behaviors))
460 printk(KERN_ERR "SELinux: initialized (dev %s, type %s), unknown behavior\n",
461 sb->s_id, sb->s_type->name);
462
463 sbsec->flags |= SE_SBINITIALIZED;
464 if (selinux_is_sblabel_mnt(sb))
465 sbsec->flags |= SBLABEL_MNT;
466
467 /* Initialize the root inode. */
468 rc = inode_doinit_with_dentry(root_inode, root);
469
470 /* Initialize any other inodes associated with the superblock, e.g.
471 inodes created prior to initial policy load or inodes created
472 during get_sb by a pseudo filesystem that directly
473 populates itself. */
474 spin_lock(&sbsec->isec_lock);
475 next_inode:
476 if (!list_empty(&sbsec->isec_head)) {
477 struct inode_security_struct *isec =
478 list_entry(sbsec->isec_head.next,
479 struct inode_security_struct, list);
480 struct inode *inode = isec->inode;
481 list_del_init(&isec->list);
482 spin_unlock(&sbsec->isec_lock);
483 inode = igrab(inode);
484 if (inode) {
485 if (!IS_PRIVATE(inode))
486 inode_doinit(inode);
487 iput(inode);
488 }
489 spin_lock(&sbsec->isec_lock);
490 goto next_inode;
491 }
492 spin_unlock(&sbsec->isec_lock);
493 out:
494 return rc;
495 }
496
497 /*
498 * This function should allow an FS to ask what it's mount security
499 * options were so it can use those later for submounts, displaying
500 * mount options, or whatever.
501 */
502 static int selinux_get_mnt_opts(const struct super_block *sb,
503 struct security_mnt_opts *opts)
504 {
505 int rc = 0, i;
506 struct superblock_security_struct *sbsec = sb->s_security;
507 char *context = NULL;
508 u32 len;
509 char tmp;
510
511 security_init_mnt_opts(opts);
512
513 if (!(sbsec->flags & SE_SBINITIALIZED))
514 return -EINVAL;
515
516 if (!ss_initialized)
517 return -EINVAL;
518
519 /* make sure we always check enough bits to cover the mask */
520 BUILD_BUG_ON(SE_MNTMASK >= (1 << NUM_SEL_MNT_OPTS));
521
522 tmp = sbsec->flags & SE_MNTMASK;
523 /* count the number of mount options for this sb */
524 for (i = 0; i < NUM_SEL_MNT_OPTS; i++) {
525 if (tmp & 0x01)
526 opts->num_mnt_opts++;
527 tmp >>= 1;
528 }
529 /* Check if the Label support flag is set */
530 if (sbsec->flags & SBLABEL_MNT)
531 opts->num_mnt_opts++;
532
533 opts->mnt_opts = kcalloc(opts->num_mnt_opts, sizeof(char *), GFP_ATOMIC);
534 if (!opts->mnt_opts) {
535 rc = -ENOMEM;
536 goto out_free;
537 }
538
539 opts->mnt_opts_flags = kcalloc(opts->num_mnt_opts, sizeof(int), GFP_ATOMIC);
540 if (!opts->mnt_opts_flags) {
541 rc = -ENOMEM;
542 goto out_free;
543 }
544
545 i = 0;
546 if (sbsec->flags & FSCONTEXT_MNT) {
547 rc = security_sid_to_context(sbsec->sid, &context, &len);
548 if (rc)
549 goto out_free;
550 opts->mnt_opts[i] = context;
551 opts->mnt_opts_flags[i++] = FSCONTEXT_MNT;
552 }
553 if (sbsec->flags & CONTEXT_MNT) {
554 rc = security_sid_to_context(sbsec->mntpoint_sid, &context, &len);
555 if (rc)
556 goto out_free;
557 opts->mnt_opts[i] = context;
558 opts->mnt_opts_flags[i++] = CONTEXT_MNT;
559 }
560 if (sbsec->flags & DEFCONTEXT_MNT) {
561 rc = security_sid_to_context(sbsec->def_sid, &context, &len);
562 if (rc)
563 goto out_free;
564 opts->mnt_opts[i] = context;
565 opts->mnt_opts_flags[i++] = DEFCONTEXT_MNT;
566 }
567 if (sbsec->flags & ROOTCONTEXT_MNT) {
568 struct inode *root = d_backing_inode(sbsec->sb->s_root);
569 struct inode_security_struct *isec = root->i_security;
570
571 rc = security_sid_to_context(isec->sid, &context, &len);
572 if (rc)
573 goto out_free;
574 opts->mnt_opts[i] = context;
575 opts->mnt_opts_flags[i++] = ROOTCONTEXT_MNT;
576 }
577 if (sbsec->flags & SBLABEL_MNT) {
578 opts->mnt_opts[i] = NULL;
579 opts->mnt_opts_flags[i++] = SBLABEL_MNT;
580 }
581
582 BUG_ON(i != opts->num_mnt_opts);
583
584 return 0;
585
586 out_free:
587 security_free_mnt_opts(opts);
588 return rc;
589 }
590
591 static int bad_option(struct superblock_security_struct *sbsec, char flag,
592 u32 old_sid, u32 new_sid)
593 {
594 char mnt_flags = sbsec->flags & SE_MNTMASK;
595
596 /* check if the old mount command had the same options */
597 if (sbsec->flags & SE_SBINITIALIZED)
598 if (!(sbsec->flags & flag) ||
599 (old_sid != new_sid))
600 return 1;
601
602 /* check if we were passed the same options twice,
603 * aka someone passed context=a,context=b
604 */
605 if (!(sbsec->flags & SE_SBINITIALIZED))
606 if (mnt_flags & flag)
607 return 1;
608 return 0;
609 }
610
611 /*
612 * Allow filesystems with binary mount data to explicitly set mount point
613 * labeling information.
614 */
615 static int selinux_set_mnt_opts(struct super_block *sb,
616 struct security_mnt_opts *opts,
617 unsigned long kern_flags,
618 unsigned long *set_kern_flags)
619 {
620 const struct cred *cred = current_cred();
621 int rc = 0, i;
622 struct superblock_security_struct *sbsec = sb->s_security;
623 const char *name = sb->s_type->name;
624 struct inode *inode = d_backing_inode(sbsec->sb->s_root);
625 struct inode_security_struct *root_isec = inode->i_security;
626 u32 fscontext_sid = 0, context_sid = 0, rootcontext_sid = 0;
627 u32 defcontext_sid = 0;
628 char **mount_options = opts->mnt_opts;
629 int *flags = opts->mnt_opts_flags;
630 int num_opts = opts->num_mnt_opts;
631
632 mutex_lock(&sbsec->lock);
633
634 if (!ss_initialized) {
635 if (!num_opts) {
636 /* Defer initialization until selinux_complete_init,
637 after the initial policy is loaded and the security
638 server is ready to handle calls. */
639 goto out;
640 }
641 rc = -EINVAL;
642 printk(KERN_WARNING "SELinux: Unable to set superblock options "
643 "before the security server is initialized\n");
644 goto out;
645 }
646 if (kern_flags && !set_kern_flags) {
647 /* Specifying internal flags without providing a place to
648 * place the results is not allowed */
649 rc = -EINVAL;
650 goto out;
651 }
652
653 /*
654 * Binary mount data FS will come through this function twice. Once
655 * from an explicit call and once from the generic calls from the vfs.
656 * Since the generic VFS calls will not contain any security mount data
657 * we need to skip the double mount verification.
658 *
659 * This does open a hole in which we will not notice if the first
660 * mount using this sb set explict options and a second mount using
661 * this sb does not set any security options. (The first options
662 * will be used for both mounts)
663 */
664 if ((sbsec->flags & SE_SBINITIALIZED) && (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
665 && (num_opts == 0))
666 goto out;
667
668 /*
669 * parse the mount options, check if they are valid sids.
670 * also check if someone is trying to mount the same sb more
671 * than once with different security options.
672 */
673 for (i = 0; i < num_opts; i++) {
674 u32 sid;
675
676 if (flags[i] == SBLABEL_MNT)
677 continue;
678 rc = security_context_str_to_sid(mount_options[i], &sid, GFP_KERNEL);
679 if (rc) {
680 printk(KERN_WARNING "SELinux: security_context_str_to_sid"
681 "(%s) failed for (dev %s, type %s) errno=%d\n",
682 mount_options[i], sb->s_id, name, rc);
683 goto out;
684 }
685 switch (flags[i]) {
686 case FSCONTEXT_MNT:
687 fscontext_sid = sid;
688
689 if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid,
690 fscontext_sid))
691 goto out_double_mount;
692
693 sbsec->flags |= FSCONTEXT_MNT;
694 break;
695 case CONTEXT_MNT:
696 context_sid = sid;
697
698 if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid,
699 context_sid))
700 goto out_double_mount;
701
702 sbsec->flags |= CONTEXT_MNT;
703 break;
704 case ROOTCONTEXT_MNT:
705 rootcontext_sid = sid;
706
707 if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid,
708 rootcontext_sid))
709 goto out_double_mount;
710
711 sbsec->flags |= ROOTCONTEXT_MNT;
712
713 break;
714 case DEFCONTEXT_MNT:
715 defcontext_sid = sid;
716
717 if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid,
718 defcontext_sid))
719 goto out_double_mount;
720
721 sbsec->flags |= DEFCONTEXT_MNT;
722
723 break;
724 default:
725 rc = -EINVAL;
726 goto out;
727 }
728 }
729
730 if (sbsec->flags & SE_SBINITIALIZED) {
731 /* previously mounted with options, but not on this attempt? */
732 if ((sbsec->flags & SE_MNTMASK) && !num_opts)
733 goto out_double_mount;
734 rc = 0;
735 goto out;
736 }
737
738 if (strcmp(sb->s_type->name, "proc") == 0)
739 sbsec->flags |= SE_SBPROC | SE_SBGENFS;
740
741 if (!strcmp(sb->s_type->name, "debugfs") ||
742 !strcmp(sb->s_type->name, "sysfs") ||
743 !strcmp(sb->s_type->name, "pstore"))
744 sbsec->flags |= SE_SBGENFS;
745
746 if (!sbsec->behavior) {
747 /*
748 * Determine the labeling behavior to use for this
749 * filesystem type.
750 */
751 rc = security_fs_use(sb);
752 if (rc) {
753 printk(KERN_WARNING
754 "%s: security_fs_use(%s) returned %d\n",
755 __func__, sb->s_type->name, rc);
756 goto out;
757 }
758 }
759 /* sets the context of the superblock for the fs being mounted. */
760 if (fscontext_sid) {
761 rc = may_context_mount_sb_relabel(fscontext_sid, sbsec, cred);
762 if (rc)
763 goto out;
764
765 sbsec->sid = fscontext_sid;
766 }
767
768 /*
769 * Switch to using mount point labeling behavior.
770 * sets the label used on all file below the mountpoint, and will set
771 * the superblock context if not already set.
772 */
773 if (kern_flags & SECURITY_LSM_NATIVE_LABELS && !context_sid) {
774 sbsec->behavior = SECURITY_FS_USE_NATIVE;
775 *set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
776 }
777
778 if (context_sid) {
779 if (!fscontext_sid) {
780 rc = may_context_mount_sb_relabel(context_sid, sbsec,
781 cred);
782 if (rc)
783 goto out;
784 sbsec->sid = context_sid;
785 } else {
786 rc = may_context_mount_inode_relabel(context_sid, sbsec,
787 cred);
788 if (rc)
789 goto out;
790 }
791 if (!rootcontext_sid)
792 rootcontext_sid = context_sid;
793
794 sbsec->mntpoint_sid = context_sid;
795 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
796 }
797
798 if (rootcontext_sid) {
799 rc = may_context_mount_inode_relabel(rootcontext_sid, sbsec,
800 cred);
801 if (rc)
802 goto out;
803
804 root_isec->sid = rootcontext_sid;
805 root_isec->initialized = 1;
806 }
807
808 if (defcontext_sid) {
809 if (sbsec->behavior != SECURITY_FS_USE_XATTR &&
810 sbsec->behavior != SECURITY_FS_USE_NATIVE) {
811 rc = -EINVAL;
812 printk(KERN_WARNING "SELinux: defcontext option is "
813 "invalid for this filesystem type\n");
814 goto out;
815 }
816
817 if (defcontext_sid != sbsec->def_sid) {
818 rc = may_context_mount_inode_relabel(defcontext_sid,
819 sbsec, cred);
820 if (rc)
821 goto out;
822 }
823
824 sbsec->def_sid = defcontext_sid;
825 }
826
827 rc = sb_finish_set_opts(sb);
828 out:
829 mutex_unlock(&sbsec->lock);
830 return rc;
831 out_double_mount:
832 rc = -EINVAL;
833 printk(KERN_WARNING "SELinux: mount invalid. Same superblock, different "
834 "security settings for (dev %s, type %s)\n", sb->s_id, name);
835 goto out;
836 }
837
838 static int selinux_cmp_sb_context(const struct super_block *oldsb,
839 const struct super_block *newsb)
840 {
841 struct superblock_security_struct *old = oldsb->s_security;
842 struct superblock_security_struct *new = newsb->s_security;
843 char oldflags = old->flags & SE_MNTMASK;
844 char newflags = new->flags & SE_MNTMASK;
845
846 if (oldflags != newflags)
847 goto mismatch;
848 if ((oldflags & FSCONTEXT_MNT) && old->sid != new->sid)
849 goto mismatch;
850 if ((oldflags & CONTEXT_MNT) && old->mntpoint_sid != new->mntpoint_sid)
851 goto mismatch;
852 if ((oldflags & DEFCONTEXT_MNT) && old->def_sid != new->def_sid)
853 goto mismatch;
854 if (oldflags & ROOTCONTEXT_MNT) {
855 struct inode_security_struct *oldroot = d_backing_inode(oldsb->s_root)->i_security;
856 struct inode_security_struct *newroot = d_backing_inode(newsb->s_root)->i_security;
857 if (oldroot->sid != newroot->sid)
858 goto mismatch;
859 }
860 return 0;
861 mismatch:
862 printk(KERN_WARNING "SELinux: mount invalid. Same superblock, "
863 "different security settings for (dev %s, "
864 "type %s)\n", newsb->s_id, newsb->s_type->name);
865 return -EBUSY;
866 }
867
868 static int selinux_sb_clone_mnt_opts(const struct super_block *oldsb,
869 struct super_block *newsb)
870 {
871 const struct superblock_security_struct *oldsbsec = oldsb->s_security;
872 struct superblock_security_struct *newsbsec = newsb->s_security;
873
874 int set_fscontext = (oldsbsec->flags & FSCONTEXT_MNT);
875 int set_context = (oldsbsec->flags & CONTEXT_MNT);
876 int set_rootcontext = (oldsbsec->flags & ROOTCONTEXT_MNT);
877
878 /*
879 * if the parent was able to be mounted it clearly had no special lsm
880 * mount options. thus we can safely deal with this superblock later
881 */
882 if (!ss_initialized)
883 return 0;
884
885 /* how can we clone if the old one wasn't set up?? */
886 BUG_ON(!(oldsbsec->flags & SE_SBINITIALIZED));
887
888 /* if fs is reusing a sb, make sure that the contexts match */
889 if (newsbsec->flags & SE_SBINITIALIZED)
890 return selinux_cmp_sb_context(oldsb, newsb);
891
892 mutex_lock(&newsbsec->lock);
893
894 newsbsec->flags = oldsbsec->flags;
895
896 newsbsec->sid = oldsbsec->sid;
897 newsbsec->def_sid = oldsbsec->def_sid;
898 newsbsec->behavior = oldsbsec->behavior;
899
900 if (set_context) {
901 u32 sid = oldsbsec->mntpoint_sid;
902
903 if (!set_fscontext)
904 newsbsec->sid = sid;
905 if (!set_rootcontext) {
906 struct inode *newinode = d_backing_inode(newsb->s_root);
907 struct inode_security_struct *newisec = newinode->i_security;
908 newisec->sid = sid;
909 }
910 newsbsec->mntpoint_sid = sid;
911 }
912 if (set_rootcontext) {
913 const struct inode *oldinode = d_backing_inode(oldsb->s_root);
914 const struct inode_security_struct *oldisec = oldinode->i_security;
915 struct inode *newinode = d_backing_inode(newsb->s_root);
916 struct inode_security_struct *newisec = newinode->i_security;
917
918 newisec->sid = oldisec->sid;
919 }
920
921 sb_finish_set_opts(newsb);
922 mutex_unlock(&newsbsec->lock);
923 return 0;
924 }
925
926 static int selinux_parse_opts_str(char *options,
927 struct security_mnt_opts *opts)
928 {
929 char *p;
930 char *context = NULL, *defcontext = NULL;
931 char *fscontext = NULL, *rootcontext = NULL;
932 int rc, num_mnt_opts = 0;
933
934 opts->num_mnt_opts = 0;
935
936 /* Standard string-based options. */
937 while ((p = strsep(&options, "|")) != NULL) {
938 int token;
939 substring_t args[MAX_OPT_ARGS];
940
941 if (!*p)
942 continue;
943
944 token = match_token(p, tokens, args);
945
946 switch (token) {
947 case Opt_context:
948 if (context || defcontext) {
949 rc = -EINVAL;
950 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
951 goto out_err;
952 }
953 context = match_strdup(&args[0]);
954 if (!context) {
955 rc = -ENOMEM;
956 goto out_err;
957 }
958 break;
959
960 case Opt_fscontext:
961 if (fscontext) {
962 rc = -EINVAL;
963 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
964 goto out_err;
965 }
966 fscontext = match_strdup(&args[0]);
967 if (!fscontext) {
968 rc = -ENOMEM;
969 goto out_err;
970 }
971 break;
972
973 case Opt_rootcontext:
974 if (rootcontext) {
975 rc = -EINVAL;
976 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
977 goto out_err;
978 }
979 rootcontext = match_strdup(&args[0]);
980 if (!rootcontext) {
981 rc = -ENOMEM;
982 goto out_err;
983 }
984 break;
985
986 case Opt_defcontext:
987 if (context || defcontext) {
988 rc = -EINVAL;
989 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
990 goto out_err;
991 }
992 defcontext = match_strdup(&args[0]);
993 if (!defcontext) {
994 rc = -ENOMEM;
995 goto out_err;
996 }
997 break;
998 case Opt_labelsupport:
999 break;
1000 default:
1001 rc = -EINVAL;
1002 printk(KERN_WARNING "SELinux: unknown mount option\n");
1003 goto out_err;
1004
1005 }
1006 }
1007
1008 rc = -ENOMEM;
1009 opts->mnt_opts = kcalloc(NUM_SEL_MNT_OPTS, sizeof(char *), GFP_ATOMIC);
1010 if (!opts->mnt_opts)
1011 goto out_err;
1012
1013 opts->mnt_opts_flags = kcalloc(NUM_SEL_MNT_OPTS, sizeof(int), GFP_ATOMIC);
1014 if (!opts->mnt_opts_flags) {
1015 kfree(opts->mnt_opts);
1016 goto out_err;
1017 }
1018
1019 if (fscontext) {
1020 opts->mnt_opts[num_mnt_opts] = fscontext;
1021 opts->mnt_opts_flags[num_mnt_opts++] = FSCONTEXT_MNT;
1022 }
1023 if (context) {
1024 opts->mnt_opts[num_mnt_opts] = context;
1025 opts->mnt_opts_flags[num_mnt_opts++] = CONTEXT_MNT;
1026 }
1027 if (rootcontext) {
1028 opts->mnt_opts[num_mnt_opts] = rootcontext;
1029 opts->mnt_opts_flags[num_mnt_opts++] = ROOTCONTEXT_MNT;
1030 }
1031 if (defcontext) {
1032 opts->mnt_opts[num_mnt_opts] = defcontext;
1033 opts->mnt_opts_flags[num_mnt_opts++] = DEFCONTEXT_MNT;
1034 }
1035
1036 opts->num_mnt_opts = num_mnt_opts;
1037 return 0;
1038
1039 out_err:
1040 kfree(context);
1041 kfree(defcontext);
1042 kfree(fscontext);
1043 kfree(rootcontext);
1044 return rc;
1045 }
1046 /*
1047 * string mount options parsing and call set the sbsec
1048 */
1049 static int superblock_doinit(struct super_block *sb, void *data)
1050 {
1051 int rc = 0;
1052 char *options = data;
1053 struct security_mnt_opts opts;
1054
1055 security_init_mnt_opts(&opts);
1056
1057 if (!data)
1058 goto out;
1059
1060 BUG_ON(sb->s_type->fs_flags & FS_BINARY_MOUNTDATA);
1061
1062 rc = selinux_parse_opts_str(options, &opts);
1063 if (rc)
1064 goto out_err;
1065
1066 out:
1067 rc = selinux_set_mnt_opts(sb, &opts, 0, NULL);
1068
1069 out_err:
1070 security_free_mnt_opts(&opts);
1071 return rc;
1072 }
1073
1074 static void selinux_write_opts(struct seq_file *m,
1075 struct security_mnt_opts *opts)
1076 {
1077 int i;
1078 char *prefix;
1079
1080 for (i = 0; i < opts->num_mnt_opts; i++) {
1081 char *has_comma;
1082
1083 if (opts->mnt_opts[i])
1084 has_comma = strchr(opts->mnt_opts[i], ',');
1085 else
1086 has_comma = NULL;
1087
1088 switch (opts->mnt_opts_flags[i]) {
1089 case CONTEXT_MNT:
1090 prefix = CONTEXT_STR;
1091 break;
1092 case FSCONTEXT_MNT:
1093 prefix = FSCONTEXT_STR;
1094 break;
1095 case ROOTCONTEXT_MNT:
1096 prefix = ROOTCONTEXT_STR;
1097 break;
1098 case DEFCONTEXT_MNT:
1099 prefix = DEFCONTEXT_STR;
1100 break;
1101 case SBLABEL_MNT:
1102 seq_putc(m, ',');
1103 seq_puts(m, LABELSUPP_STR);
1104 continue;
1105 default:
1106 BUG();
1107 return;
1108 };
1109 /* we need a comma before each option */
1110 seq_putc(m, ',');
1111 seq_puts(m, prefix);
1112 if (has_comma)
1113 seq_putc(m, '\"');
1114 seq_escape(m, opts->mnt_opts[i], "\"\n\\");
1115 if (has_comma)
1116 seq_putc(m, '\"');
1117 }
1118 }
1119
1120 static int selinux_sb_show_options(struct seq_file *m, struct super_block *sb)
1121 {
1122 struct security_mnt_opts opts;
1123 int rc;
1124
1125 rc = selinux_get_mnt_opts(sb, &opts);
1126 if (rc) {
1127 /* before policy load we may get EINVAL, don't show anything */
1128 if (rc == -EINVAL)
1129 rc = 0;
1130 return rc;
1131 }
1132
1133 selinux_write_opts(m, &opts);
1134
1135 security_free_mnt_opts(&opts);
1136
1137 return rc;
1138 }
1139
1140 static inline u16 inode_mode_to_security_class(umode_t mode)
1141 {
1142 switch (mode & S_IFMT) {
1143 case S_IFSOCK:
1144 return SECCLASS_SOCK_FILE;
1145 case S_IFLNK:
1146 return SECCLASS_LNK_FILE;
1147 case S_IFREG:
1148 return SECCLASS_FILE;
1149 case S_IFBLK:
1150 return SECCLASS_BLK_FILE;
1151 case S_IFDIR:
1152 return SECCLASS_DIR;
1153 case S_IFCHR:
1154 return SECCLASS_CHR_FILE;
1155 case S_IFIFO:
1156 return SECCLASS_FIFO_FILE;
1157
1158 }
1159
1160 return SECCLASS_FILE;
1161 }
1162
1163 static inline int default_protocol_stream(int protocol)
1164 {
1165 return (protocol == IPPROTO_IP || protocol == IPPROTO_TCP);
1166 }
1167
1168 static inline int default_protocol_dgram(int protocol)
1169 {
1170 return (protocol == IPPROTO_IP || protocol == IPPROTO_UDP);
1171 }
1172
1173 static inline u16 socket_type_to_security_class(int family, int type, int protocol)
1174 {
1175 switch (family) {
1176 case PF_UNIX:
1177 switch (type) {
1178 case SOCK_STREAM:
1179 case SOCK_SEQPACKET:
1180 return SECCLASS_UNIX_STREAM_SOCKET;
1181 case SOCK_DGRAM:
1182 return SECCLASS_UNIX_DGRAM_SOCKET;
1183 }
1184 break;
1185 case PF_INET:
1186 case PF_INET6:
1187 switch (type) {
1188 case SOCK_STREAM:
1189 if (default_protocol_stream(protocol))
1190 return SECCLASS_TCP_SOCKET;
1191 else
1192 return SECCLASS_RAWIP_SOCKET;
1193 case SOCK_DGRAM:
1194 if (default_protocol_dgram(protocol))
1195 return SECCLASS_UDP_SOCKET;
1196 else
1197 return SECCLASS_RAWIP_SOCKET;
1198 case SOCK_DCCP:
1199 return SECCLASS_DCCP_SOCKET;
1200 default:
1201 return SECCLASS_RAWIP_SOCKET;
1202 }
1203 break;
1204 case PF_NETLINK:
1205 switch (protocol) {
1206 case NETLINK_ROUTE:
1207 return SECCLASS_NETLINK_ROUTE_SOCKET;
1208 case NETLINK_SOCK_DIAG:
1209 return SECCLASS_NETLINK_TCPDIAG_SOCKET;
1210 case NETLINK_NFLOG:
1211 return SECCLASS_NETLINK_NFLOG_SOCKET;
1212 case NETLINK_XFRM:
1213 return SECCLASS_NETLINK_XFRM_SOCKET;
1214 case NETLINK_SELINUX:
1215 return SECCLASS_NETLINK_SELINUX_SOCKET;
1216 case NETLINK_ISCSI:
1217 return SECCLASS_NETLINK_ISCSI_SOCKET;
1218 case NETLINK_AUDIT:
1219 return SECCLASS_NETLINK_AUDIT_SOCKET;
1220 case NETLINK_FIB_LOOKUP:
1221 return SECCLASS_NETLINK_FIB_LOOKUP_SOCKET;
1222 case NETLINK_CONNECTOR:
1223 return SECCLASS_NETLINK_CONNECTOR_SOCKET;
1224 case NETLINK_NETFILTER:
1225 return SECCLASS_NETLINK_NETFILTER_SOCKET;
1226 case NETLINK_DNRTMSG:
1227 return SECCLASS_NETLINK_DNRT_SOCKET;
1228 case NETLINK_KOBJECT_UEVENT:
1229 return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET;
1230 case NETLINK_GENERIC:
1231 return SECCLASS_NETLINK_GENERIC_SOCKET;
1232 case NETLINK_SCSITRANSPORT:
1233 return SECCLASS_NETLINK_SCSITRANSPORT_SOCKET;
1234 case NETLINK_RDMA:
1235 return SECCLASS_NETLINK_RDMA_SOCKET;
1236 case NETLINK_CRYPTO:
1237 return SECCLASS_NETLINK_CRYPTO_SOCKET;
1238 default:
1239 return SECCLASS_NETLINK_SOCKET;
1240 }
1241 case PF_PACKET:
1242 return SECCLASS_PACKET_SOCKET;
1243 case PF_KEY:
1244 return SECCLASS_KEY_SOCKET;
1245 case PF_APPLETALK:
1246 return SECCLASS_APPLETALK_SOCKET;
1247 }
1248
1249 return SECCLASS_SOCKET;
1250 }
1251
1252 static int selinux_genfs_get_sid(struct dentry *dentry,
1253 u16 tclass,
1254 u16 flags,
1255 u32 *sid)
1256 {
1257 int rc;
1258 struct super_block *sb = dentry->d_inode->i_sb;
1259 char *buffer, *path;
1260
1261 buffer = (char *)__get_free_page(GFP_KERNEL);
1262 if (!buffer)
1263 return -ENOMEM;
1264
1265 path = dentry_path_raw(dentry, buffer, PAGE_SIZE);
1266 if (IS_ERR(path))
1267 rc = PTR_ERR(path);
1268 else {
1269 if (flags & SE_SBPROC) {
1270 /* each process gets a /proc/PID/ entry. Strip off the
1271 * PID part to get a valid selinux labeling.
1272 * e.g. /proc/1/net/rpc/nfs -> /net/rpc/nfs */
1273 while (path[1] >= '0' && path[1] <= '9') {
1274 path[1] = '/';
1275 path++;
1276 }
1277 }
1278 rc = security_genfs_sid(sb->s_type->name, path, tclass, sid);
1279 }
1280 free_page((unsigned long)buffer);
1281 return rc;
1282 }
1283
1284 /* The inode's security attributes must be initialized before first use. */
1285 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
1286 {
1287 struct superblock_security_struct *sbsec = NULL;
1288 struct inode_security_struct *isec = inode->i_security;
1289 u32 sid;
1290 struct dentry *dentry;
1291 #define INITCONTEXTLEN 255
1292 char *context = NULL;
1293 unsigned len = 0;
1294 int rc = 0;
1295
1296 if (isec->initialized)
1297 goto out;
1298
1299 mutex_lock(&isec->lock);
1300 if (isec->initialized)
1301 goto out_unlock;
1302
1303 sbsec = inode->i_sb->s_security;
1304 if (!(sbsec->flags & SE_SBINITIALIZED)) {
1305 /* Defer initialization until selinux_complete_init,
1306 after the initial policy is loaded and the security
1307 server is ready to handle calls. */
1308 spin_lock(&sbsec->isec_lock);
1309 if (list_empty(&isec->list))
1310 list_add(&isec->list, &sbsec->isec_head);
1311 spin_unlock(&sbsec->isec_lock);
1312 goto out_unlock;
1313 }
1314
1315 switch (sbsec->behavior) {
1316 case SECURITY_FS_USE_NATIVE:
1317 break;
1318 case SECURITY_FS_USE_XATTR:
1319 if (!inode->i_op->getxattr) {
1320 isec->sid = sbsec->def_sid;
1321 break;
1322 }
1323
1324 /* Need a dentry, since the xattr API requires one.
1325 Life would be simpler if we could just pass the inode. */
1326 if (opt_dentry) {
1327 /* Called from d_instantiate or d_splice_alias. */
1328 dentry = dget(opt_dentry);
1329 } else {
1330 /* Called from selinux_complete_init, try to find a dentry. */
1331 dentry = d_find_alias(inode);
1332 }
1333 if (!dentry) {
1334 /*
1335 * this is can be hit on boot when a file is accessed
1336 * before the policy is loaded. When we load policy we
1337 * may find inodes that have no dentry on the
1338 * sbsec->isec_head list. No reason to complain as these
1339 * will get fixed up the next time we go through
1340 * inode_doinit with a dentry, before these inodes could
1341 * be used again by userspace.
1342 */
1343 goto out_unlock;
1344 }
1345
1346 len = INITCONTEXTLEN;
1347 context = kmalloc(len+1, GFP_NOFS);
1348 if (!context) {
1349 rc = -ENOMEM;
1350 dput(dentry);
1351 goto out_unlock;
1352 }
1353 context[len] = '\0';
1354 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
1355 context, len);
1356 if (rc == -ERANGE) {
1357 kfree(context);
1358
1359 /* Need a larger buffer. Query for the right size. */
1360 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
1361 NULL, 0);
1362 if (rc < 0) {
1363 dput(dentry);
1364 goto out_unlock;
1365 }
1366 len = rc;
1367 context = kmalloc(len+1, GFP_NOFS);
1368 if (!context) {
1369 rc = -ENOMEM;
1370 dput(dentry);
1371 goto out_unlock;
1372 }
1373 context[len] = '\0';
1374 rc = inode->i_op->getxattr(dentry,
1375 XATTR_NAME_SELINUX,
1376 context, len);
1377 }
1378 dput(dentry);
1379 if (rc < 0) {
1380 if (rc != -ENODATA) {
1381 printk(KERN_WARNING "SELinux: %s: getxattr returned "
1382 "%d for dev=%s ino=%ld\n", __func__,
1383 -rc, inode->i_sb->s_id, inode->i_ino);
1384 kfree(context);
1385 goto out_unlock;
1386 }
1387 /* Map ENODATA to the default file SID */
1388 sid = sbsec->def_sid;
1389 rc = 0;
1390 } else {
1391 rc = security_context_to_sid_default(context, rc, &sid,
1392 sbsec->def_sid,
1393 GFP_NOFS);
1394 if (rc) {
1395 char *dev = inode->i_sb->s_id;
1396 unsigned long ino = inode->i_ino;
1397
1398 if (rc == -EINVAL) {
1399 if (printk_ratelimit())
1400 printk(KERN_NOTICE "SELinux: inode=%lu on dev=%s was found to have an invalid "
1401 "context=%s. This indicates you may need to relabel the inode or the "
1402 "filesystem in question.\n", ino, dev, context);
1403 } else {
1404 printk(KERN_WARNING "SELinux: %s: context_to_sid(%s) "
1405 "returned %d for dev=%s ino=%ld\n",
1406 __func__, context, -rc, dev, ino);
1407 }
1408 kfree(context);
1409 /* Leave with the unlabeled SID */
1410 rc = 0;
1411 break;
1412 }
1413 }
1414 kfree(context);
1415 isec->sid = sid;
1416 break;
1417 case SECURITY_FS_USE_TASK:
1418 isec->sid = isec->task_sid;
1419 break;
1420 case SECURITY_FS_USE_TRANS:
1421 /* Default to the fs SID. */
1422 isec->sid = sbsec->sid;
1423
1424 /* Try to obtain a transition SID. */
1425 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1426 rc = security_transition_sid(isec->task_sid, sbsec->sid,
1427 isec->sclass, NULL, &sid);
1428 if (rc)
1429 goto out_unlock;
1430 isec->sid = sid;
1431 break;
1432 case SECURITY_FS_USE_MNTPOINT:
1433 isec->sid = sbsec->mntpoint_sid;
1434 break;
1435 default:
1436 /* Default to the fs superblock SID. */
1437 isec->sid = sbsec->sid;
1438
1439 if ((sbsec->flags & SE_SBGENFS) && !S_ISLNK(inode->i_mode)) {
1440 /* We must have a dentry to determine the label on
1441 * procfs inodes */
1442 if (opt_dentry)
1443 /* Called from d_instantiate or
1444 * d_splice_alias. */
1445 dentry = dget(opt_dentry);
1446 else
1447 /* Called from selinux_complete_init, try to
1448 * find a dentry. */
1449 dentry = d_find_alias(inode);
1450 /*
1451 * This can be hit on boot when a file is accessed
1452 * before the policy is loaded. When we load policy we
1453 * may find inodes that have no dentry on the
1454 * sbsec->isec_head list. No reason to complain as
1455 * these will get fixed up the next time we go through
1456 * inode_doinit() with a dentry, before these inodes
1457 * could be used again by userspace.
1458 */
1459 if (!dentry)
1460 goto out_unlock;
1461 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1462 rc = selinux_genfs_get_sid(dentry, isec->sclass,
1463 sbsec->flags, &sid);
1464 dput(dentry);
1465 if (rc)
1466 goto out_unlock;
1467 isec->sid = sid;
1468 }
1469 break;
1470 }
1471
1472 isec->initialized = 1;
1473
1474 out_unlock:
1475 mutex_unlock(&isec->lock);
1476 out:
1477 if (isec->sclass == SECCLASS_FILE)
1478 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1479 return rc;
1480 }
1481
1482 /* Convert a Linux signal to an access vector. */
1483 static inline u32 signal_to_av(int sig)
1484 {
1485 u32 perm = 0;
1486
1487 switch (sig) {
1488 case SIGCHLD:
1489 /* Commonly granted from child to parent. */
1490 perm = PROCESS__SIGCHLD;
1491 break;
1492 case SIGKILL:
1493 /* Cannot be caught or ignored */
1494 perm = PROCESS__SIGKILL;
1495 break;
1496 case SIGSTOP:
1497 /* Cannot be caught or ignored */
1498 perm = PROCESS__SIGSTOP;
1499 break;
1500 default:
1501 /* All other signals. */
1502 perm = PROCESS__SIGNAL;
1503 break;
1504 }
1505
1506 return perm;
1507 }
1508
1509 /*
1510 * Check permission between a pair of credentials
1511 * fork check, ptrace check, etc.
1512 */
1513 static int cred_has_perm(const struct cred *actor,
1514 const struct cred *target,
1515 u32 perms)
1516 {
1517 u32 asid = cred_sid(actor), tsid = cred_sid(target);
1518
1519 return avc_has_perm(asid, tsid, SECCLASS_PROCESS, perms, NULL);
1520 }
1521
1522 /*
1523 * Check permission between a pair of tasks, e.g. signal checks,
1524 * fork check, ptrace check, etc.
1525 * tsk1 is the actor and tsk2 is the target
1526 * - this uses the default subjective creds of tsk1
1527 */
1528 static int task_has_perm(const struct task_struct *tsk1,
1529 const struct task_struct *tsk2,
1530 u32 perms)
1531 {
1532 const struct task_security_struct *__tsec1, *__tsec2;
1533 u32 sid1, sid2;
1534
1535 rcu_read_lock();
1536 __tsec1 = __task_cred(tsk1)->security; sid1 = __tsec1->sid;
1537 __tsec2 = __task_cred(tsk2)->security; sid2 = __tsec2->sid;
1538 rcu_read_unlock();
1539 return avc_has_perm(sid1, sid2, SECCLASS_PROCESS, perms, NULL);
1540 }
1541
1542 /*
1543 * Check permission between current and another task, e.g. signal checks,
1544 * fork check, ptrace check, etc.
1545 * current is the actor and tsk2 is the target
1546 * - this uses current's subjective creds
1547 */
1548 static int current_has_perm(const struct task_struct *tsk,
1549 u32 perms)
1550 {
1551 u32 sid, tsid;
1552
1553 sid = current_sid();
1554 tsid = task_sid(tsk);
1555 return avc_has_perm(sid, tsid, SECCLASS_PROCESS, perms, NULL);
1556 }
1557
1558 #if CAP_LAST_CAP > 63
1559 #error Fix SELinux to handle capabilities > 63.
1560 #endif
1561
1562 /* Check whether a task is allowed to use a capability. */
1563 static int cred_has_capability(const struct cred *cred,
1564 int cap, int audit)
1565 {
1566 struct common_audit_data ad;
1567 struct av_decision avd;
1568 u16 sclass;
1569 u32 sid = cred_sid(cred);
1570 u32 av = CAP_TO_MASK(cap);
1571 int rc;
1572
1573 ad.type = LSM_AUDIT_DATA_CAP;
1574 ad.u.cap = cap;
1575
1576 switch (CAP_TO_INDEX(cap)) {
1577 case 0:
1578 sclass = SECCLASS_CAPABILITY;
1579 break;
1580 case 1:
1581 sclass = SECCLASS_CAPABILITY2;
1582 break;
1583 default:
1584 printk(KERN_ERR
1585 "SELinux: out of range capability %d\n", cap);
1586 BUG();
1587 return -EINVAL;
1588 }
1589
1590 rc = avc_has_perm_noaudit(sid, sid, sclass, av, 0, &avd);
1591 if (audit == SECURITY_CAP_AUDIT) {
1592 int rc2 = avc_audit(sid, sid, sclass, av, &avd, rc, &ad, 0);
1593 if (rc2)
1594 return rc2;
1595 }
1596 return rc;
1597 }
1598
1599 /* Check whether a task is allowed to use a system operation. */
1600 static int task_has_system(struct task_struct *tsk,
1601 u32 perms)
1602 {
1603 u32 sid = task_sid(tsk);
1604
1605 return avc_has_perm(sid, SECINITSID_KERNEL,
1606 SECCLASS_SYSTEM, perms, NULL);
1607 }
1608
1609 /* Check whether a task has a particular permission to an inode.
1610 The 'adp' parameter is optional and allows other audit
1611 data to be passed (e.g. the dentry). */
1612 static int inode_has_perm(const struct cred *cred,
1613 struct inode *inode,
1614 u32 perms,
1615 struct common_audit_data *adp)
1616 {
1617 struct inode_security_struct *isec;
1618 u32 sid;
1619
1620 validate_creds(cred);
1621
1622 if (unlikely(IS_PRIVATE(inode)))
1623 return 0;
1624
1625 sid = cred_sid(cred);
1626 isec = inode->i_security;
1627
1628 return avc_has_perm(sid, isec->sid, isec->sclass, perms, adp);
1629 }
1630
1631 /* Same as inode_has_perm, but pass explicit audit data containing
1632 the dentry to help the auditing code to more easily generate the
1633 pathname if needed. */
1634 static inline int dentry_has_perm(const struct cred *cred,
1635 struct dentry *dentry,
1636 u32 av)
1637 {
1638 struct inode *inode = d_backing_inode(dentry);
1639 struct common_audit_data ad;
1640
1641 ad.type = LSM_AUDIT_DATA_DENTRY;
1642 ad.u.dentry = dentry;
1643 return inode_has_perm(cred, inode, av, &ad);
1644 }
1645
1646 /* Same as inode_has_perm, but pass explicit audit data containing
1647 the path to help the auditing code to more easily generate the
1648 pathname if needed. */
1649 static inline int path_has_perm(const struct cred *cred,
1650 const struct path *path,
1651 u32 av)
1652 {
1653 struct inode *inode = d_backing_inode(path->dentry);
1654 struct common_audit_data ad;
1655
1656 ad.type = LSM_AUDIT_DATA_PATH;
1657 ad.u.path = *path;
1658 return inode_has_perm(cred, inode, av, &ad);
1659 }
1660
1661 /* Same as path_has_perm, but uses the inode from the file struct. */
1662 static inline int file_path_has_perm(const struct cred *cred,
1663 struct file *file,
1664 u32 av)
1665 {
1666 struct common_audit_data ad;
1667
1668 ad.type = LSM_AUDIT_DATA_PATH;
1669 ad.u.path = file->f_path;
1670 return inode_has_perm(cred, file_inode(file), av, &ad);
1671 }
1672
1673 /* Check whether a task can use an open file descriptor to
1674 access an inode in a given way. Check access to the
1675 descriptor itself, and then use dentry_has_perm to
1676 check a particular permission to the file.
1677 Access to the descriptor is implicitly granted if it
1678 has the same SID as the process. If av is zero, then
1679 access to the file is not checked, e.g. for cases
1680 where only the descriptor is affected like seek. */
1681 static int file_has_perm(const struct cred *cred,
1682 struct file *file,
1683 u32 av)
1684 {
1685 struct file_security_struct *fsec = file->f_security;
1686 struct inode *inode = file_inode(file);
1687 struct common_audit_data ad;
1688 u32 sid = cred_sid(cred);
1689 int rc;
1690
1691 ad.type = LSM_AUDIT_DATA_PATH;
1692 ad.u.path = file->f_path;
1693
1694 if (sid != fsec->sid) {
1695 rc = avc_has_perm(sid, fsec->sid,
1696 SECCLASS_FD,
1697 FD__USE,
1698 &ad);
1699 if (rc)
1700 goto out;
1701 }
1702
1703 /* av is zero if only checking access to the descriptor. */
1704 rc = 0;
1705 if (av)
1706 rc = inode_has_perm(cred, inode, av, &ad);
1707
1708 out:
1709 return rc;
1710 }
1711
1712 /*
1713 * Determine the label for an inode that might be unioned.
1714 */
1715 static int selinux_determine_inode_label(const struct inode *dir,
1716 const struct qstr *name,
1717 u16 tclass,
1718 u32 *_new_isid)
1719 {
1720 const struct superblock_security_struct *sbsec = dir->i_sb->s_security;
1721 const struct inode_security_struct *dsec = dir->i_security;
1722 const struct task_security_struct *tsec = current_security();
1723
1724 if ((sbsec->flags & SE_SBINITIALIZED) &&
1725 (sbsec->behavior == SECURITY_FS_USE_MNTPOINT)) {
1726 *_new_isid = sbsec->mntpoint_sid;
1727 } else if ((sbsec->flags & SBLABEL_MNT) &&
1728 tsec->create_sid) {
1729 *_new_isid = tsec->create_sid;
1730 } else {
1731 return security_transition_sid(tsec->sid, dsec->sid, tclass,
1732 name, _new_isid);
1733 }
1734
1735 return 0;
1736 }
1737
1738 /* Check whether a task can create a file. */
1739 static int may_create(struct inode *dir,
1740 struct dentry *dentry,
1741 u16 tclass)
1742 {
1743 const struct task_security_struct *tsec = current_security();
1744 struct inode_security_struct *dsec;
1745 struct superblock_security_struct *sbsec;
1746 u32 sid, newsid;
1747 struct common_audit_data ad;
1748 int rc;
1749
1750 dsec = dir->i_security;
1751 sbsec = dir->i_sb->s_security;
1752
1753 sid = tsec->sid;
1754
1755 ad.type = LSM_AUDIT_DATA_DENTRY;
1756 ad.u.dentry = dentry;
1757
1758 rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR,
1759 DIR__ADD_NAME | DIR__SEARCH,
1760 &ad);
1761 if (rc)
1762 return rc;
1763
1764 rc = selinux_determine_inode_label(dir, &dentry->d_name, tclass,
1765 &newsid);
1766 if (rc)
1767 return rc;
1768
1769 rc = avc_has_perm(sid, newsid, tclass, FILE__CREATE, &ad);
1770 if (rc)
1771 return rc;
1772
1773 return avc_has_perm(newsid, sbsec->sid,
1774 SECCLASS_FILESYSTEM,
1775 FILESYSTEM__ASSOCIATE, &ad);
1776 }
1777
1778 /* Check whether a task can create a key. */
1779 static int may_create_key(u32 ksid,
1780 struct task_struct *ctx)
1781 {
1782 u32 sid = task_sid(ctx);
1783
1784 return avc_has_perm(sid, ksid, SECCLASS_KEY, KEY__CREATE, NULL);
1785 }
1786
1787 #define MAY_LINK 0
1788 #define MAY_UNLINK 1
1789 #define MAY_RMDIR 2
1790
1791 /* Check whether a task can link, unlink, or rmdir a file/directory. */
1792 static int may_link(struct inode *dir,
1793 struct dentry *dentry,
1794 int kind)
1795
1796 {
1797 struct inode_security_struct *dsec, *isec;
1798 struct common_audit_data ad;
1799 u32 sid = current_sid();
1800 u32 av;
1801 int rc;
1802
1803 dsec = dir->i_security;
1804 isec = d_backing_inode(dentry)->i_security;
1805
1806 ad.type = LSM_AUDIT_DATA_DENTRY;
1807 ad.u.dentry = dentry;
1808
1809 av = DIR__SEARCH;
1810 av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
1811 rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR, av, &ad);
1812 if (rc)
1813 return rc;
1814
1815 switch (kind) {
1816 case MAY_LINK:
1817 av = FILE__LINK;
1818 break;
1819 case MAY_UNLINK:
1820 av = FILE__UNLINK;
1821 break;
1822 case MAY_RMDIR:
1823 av = DIR__RMDIR;
1824 break;
1825 default:
1826 printk(KERN_WARNING "SELinux: %s: unrecognized kind %d\n",
1827 __func__, kind);
1828 return 0;
1829 }
1830
1831 rc = avc_has_perm(sid, isec->sid, isec->sclass, av, &ad);
1832 return rc;
1833 }
1834
1835 static inline int may_rename(struct inode *old_dir,
1836 struct dentry *old_dentry,
1837 struct inode *new_dir,
1838 struct dentry *new_dentry)
1839 {
1840 struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
1841 struct common_audit_data ad;
1842 u32 sid = current_sid();
1843 u32 av;
1844 int old_is_dir, new_is_dir;
1845 int rc;
1846
1847 old_dsec = old_dir->i_security;
1848 old_isec = d_backing_inode(old_dentry)->i_security;
1849 old_is_dir = d_is_dir(old_dentry);
1850 new_dsec = new_dir->i_security;
1851
1852 ad.type = LSM_AUDIT_DATA_DENTRY;
1853
1854 ad.u.dentry = old_dentry;
1855 rc = avc_has_perm(sid, old_dsec->sid, SECCLASS_DIR,
1856 DIR__REMOVE_NAME | DIR__SEARCH, &ad);
1857 if (rc)
1858 return rc;
1859 rc = avc_has_perm(sid, old_isec->sid,
1860 old_isec->sclass, FILE__RENAME, &ad);
1861 if (rc)
1862 return rc;
1863 if (old_is_dir && new_dir != old_dir) {
1864 rc = avc_has_perm(sid, old_isec->sid,
1865 old_isec->sclass, DIR__REPARENT, &ad);
1866 if (rc)
1867 return rc;
1868 }
1869
1870 ad.u.dentry = new_dentry;
1871 av = DIR__ADD_NAME | DIR__SEARCH;
1872 if (d_is_positive(new_dentry))
1873 av |= DIR__REMOVE_NAME;
1874 rc = avc_has_perm(sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
1875 if (rc)
1876 return rc;
1877 if (d_is_positive(new_dentry)) {
1878 new_isec = d_backing_inode(new_dentry)->i_security;
1879 new_is_dir = d_is_dir(new_dentry);
1880 rc = avc_has_perm(sid, new_isec->sid,
1881 new_isec->sclass,
1882 (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
1883 if (rc)
1884 return rc;
1885 }
1886
1887 return 0;
1888 }
1889
1890 /* Check whether a task can perform a filesystem operation. */
1891 static int superblock_has_perm(const struct cred *cred,
1892 struct super_block *sb,
1893 u32 perms,
1894 struct common_audit_data *ad)
1895 {
1896 struct superblock_security_struct *sbsec;
1897 u32 sid = cred_sid(cred);
1898
1899 sbsec = sb->s_security;
1900 return avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM, perms, ad);
1901 }
1902
1903 /* Convert a Linux mode and permission mask to an access vector. */
1904 static inline u32 file_mask_to_av(int mode, int mask)
1905 {
1906 u32 av = 0;
1907
1908 if (!S_ISDIR(mode)) {
1909 if (mask & MAY_EXEC)
1910 av |= FILE__EXECUTE;
1911 if (mask & MAY_READ)
1912 av |= FILE__READ;
1913
1914 if (mask & MAY_APPEND)
1915 av |= FILE__APPEND;
1916 else if (mask & MAY_WRITE)
1917 av |= FILE__WRITE;
1918
1919 } else {
1920 if (mask & MAY_EXEC)
1921 av |= DIR__SEARCH;
1922 if (mask & MAY_WRITE)
1923 av |= DIR__WRITE;
1924 if (mask & MAY_READ)
1925 av |= DIR__READ;
1926 }
1927
1928 return av;
1929 }
1930
1931 /* Convert a Linux file to an access vector. */
1932 static inline u32 file_to_av(struct file *file)
1933 {
1934 u32 av = 0;
1935
1936 if (file->f_mode & FMODE_READ)
1937 av |= FILE__READ;
1938 if (file->f_mode & FMODE_WRITE) {
1939 if (file->f_flags & O_APPEND)
1940 av |= FILE__APPEND;
1941 else
1942 av |= FILE__WRITE;
1943 }
1944 if (!av) {
1945 /*
1946 * Special file opened with flags 3 for ioctl-only use.
1947 */
1948 av = FILE__IOCTL;
1949 }
1950
1951 return av;
1952 }
1953
1954 /*
1955 * Convert a file to an access vector and include the correct open
1956 * open permission.
1957 */
1958 static inline u32 open_file_to_av(struct file *file)
1959 {
1960 u32 av = file_to_av(file);
1961
1962 if (selinux_policycap_openperm)
1963 av |= FILE__OPEN;
1964
1965 return av;
1966 }
1967
1968 /* Hook functions begin here. */
1969
1970 static int selinux_binder_set_context_mgr(struct task_struct *mgr)
1971 {
1972 u32 mysid = current_sid();
1973 u32 mgrsid = task_sid(mgr);
1974
1975 return avc_has_perm(mysid, mgrsid, SECCLASS_BINDER,
1976 BINDER__SET_CONTEXT_MGR, NULL);
1977 }
1978
1979 static int selinux_binder_transaction(struct task_struct *from,
1980 struct task_struct *to)
1981 {
1982 u32 mysid = current_sid();
1983 u32 fromsid = task_sid(from);
1984 u32 tosid = task_sid(to);
1985 int rc;
1986
1987 if (mysid != fromsid) {
1988 rc = avc_has_perm(mysid, fromsid, SECCLASS_BINDER,
1989 BINDER__IMPERSONATE, NULL);
1990 if (rc)
1991 return rc;
1992 }
1993
1994 return avc_has_perm(fromsid, tosid, SECCLASS_BINDER, BINDER__CALL,
1995 NULL);
1996 }
1997
1998 static int selinux_binder_transfer_binder(struct task_struct *from,
1999 struct task_struct *to)
2000 {
2001 u32 fromsid = task_sid(from);
2002 u32 tosid = task_sid(to);
2003
2004 return avc_has_perm(fromsid, tosid, SECCLASS_BINDER, BINDER__TRANSFER,
2005 NULL);
2006 }
2007
2008 static int selinux_binder_transfer_file(struct task_struct *from,
2009 struct task_struct *to,
2010 struct file *file)
2011 {
2012 u32 sid = task_sid(to);
2013 struct file_security_struct *fsec = file->f_security;
2014 struct inode *inode = d_backing_inode(file->f_path.dentry);
2015 struct inode_security_struct *isec = inode->i_security;
2016 struct common_audit_data ad;
2017 int rc;
2018
2019 ad.type = LSM_AUDIT_DATA_PATH;
2020 ad.u.path = file->f_path;
2021
2022 if (sid != fsec->sid) {
2023 rc = avc_has_perm(sid, fsec->sid,
2024 SECCLASS_FD,
2025 FD__USE,
2026 &ad);
2027 if (rc)
2028 return rc;
2029 }
2030
2031 if (unlikely(IS_PRIVATE(inode)))
2032 return 0;
2033
2034 return avc_has_perm(sid, isec->sid, isec->sclass, file_to_av(file),
2035 &ad);
2036 }
2037
2038 static int selinux_ptrace_access_check(struct task_struct *child,
2039 unsigned int mode)
2040 {
2041 if (mode & PTRACE_MODE_READ) {
2042 u32 sid = current_sid();
2043 u32 csid = task_sid(child);
2044 return avc_has_perm(sid, csid, SECCLASS_FILE, FILE__READ, NULL);
2045 }
2046
2047 return current_has_perm(child, PROCESS__PTRACE);
2048 }
2049
2050 static int selinux_ptrace_traceme(struct task_struct *parent)
2051 {
2052 return task_has_perm(parent, current, PROCESS__PTRACE);
2053 }
2054
2055 static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
2056 kernel_cap_t *inheritable, kernel_cap_t *permitted)
2057 {
2058 return current_has_perm(target, PROCESS__GETCAP);
2059 }
2060
2061 static int selinux_capset(struct cred *new, const struct cred *old,
2062 const kernel_cap_t *effective,
2063 const kernel_cap_t *inheritable,
2064 const kernel_cap_t *permitted)
2065 {
2066 return cred_has_perm(old, new, PROCESS__SETCAP);
2067 }
2068
2069 /*
2070 * (This comment used to live with the selinux_task_setuid hook,
2071 * which was removed).
2072 *
2073 * Since setuid only affects the current process, and since the SELinux
2074 * controls are not based on the Linux identity attributes, SELinux does not
2075 * need to control this operation. However, SELinux does control the use of
2076 * the CAP_SETUID and CAP_SETGID capabilities using the capable hook.
2077 */
2078
2079 static int selinux_capable(const struct cred *cred, struct user_namespace *ns,
2080 int cap, int audit)
2081 {
2082 return cred_has_capability(cred, cap, audit);
2083 }
2084
2085 static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
2086 {
2087 const struct cred *cred = current_cred();
2088 int rc = 0;
2089
2090 if (!sb)
2091 return 0;
2092
2093 switch (cmds) {
2094 case Q_SYNC:
2095 case Q_QUOTAON:
2096 case Q_QUOTAOFF:
2097 case Q_SETINFO:
2098 case Q_SETQUOTA:
2099 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAMOD, NULL);
2100 break;
2101 case Q_GETFMT:
2102 case Q_GETINFO:
2103 case Q_GETQUOTA:
2104 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAGET, NULL);
2105 break;
2106 default:
2107 rc = 0; /* let the kernel handle invalid cmds */
2108 break;
2109 }
2110 return rc;
2111 }
2112
2113 static int selinux_quota_on(struct dentry *dentry)
2114 {
2115 const struct cred *cred = current_cred();
2116
2117 return dentry_has_perm(cred, dentry, FILE__QUOTAON);
2118 }
2119
2120 static int selinux_syslog(int type)
2121 {
2122 int rc;
2123
2124 switch (type) {
2125 case SYSLOG_ACTION_READ_ALL: /* Read last kernel messages */
2126 case SYSLOG_ACTION_SIZE_BUFFER: /* Return size of the log buffer */
2127 rc = task_has_system(current, SYSTEM__SYSLOG_READ);
2128 break;
2129 case SYSLOG_ACTION_CONSOLE_OFF: /* Disable logging to console */
2130 case SYSLOG_ACTION_CONSOLE_ON: /* Enable logging to console */
2131 /* Set level of messages printed to console */
2132 case SYSLOG_ACTION_CONSOLE_LEVEL:
2133 rc = task_has_system(current, SYSTEM__SYSLOG_CONSOLE);
2134 break;
2135 case SYSLOG_ACTION_CLOSE: /* Close log */
2136 case SYSLOG_ACTION_OPEN: /* Open log */
2137 case SYSLOG_ACTION_READ: /* Read from log */
2138 case SYSLOG_ACTION_READ_CLEAR: /* Read/clear last kernel messages */
2139 case SYSLOG_ACTION_CLEAR: /* Clear ring buffer */
2140 default:
2141 rc = task_has_system(current, SYSTEM__SYSLOG_MOD);
2142 break;
2143 }
2144 return rc;
2145 }
2146
2147 /*
2148 * Check that a process has enough memory to allocate a new virtual
2149 * mapping. 0 means there is enough memory for the allocation to
2150 * succeed and -ENOMEM implies there is not.
2151 *
2152 * Do not audit the selinux permission check, as this is applied to all
2153 * processes that allocate mappings.
2154 */
2155 static int selinux_vm_enough_memory(struct mm_struct *mm, long pages)
2156 {
2157 int rc, cap_sys_admin = 0;
2158
2159 rc = cred_has_capability(current_cred(), CAP_SYS_ADMIN,
2160 SECURITY_CAP_NOAUDIT);
2161 if (rc == 0)
2162 cap_sys_admin = 1;
2163
2164 return cap_sys_admin;
2165 }
2166
2167 /* binprm security operations */
2168
2169 static int check_nnp_nosuid(const struct linux_binprm *bprm,
2170 const struct task_security_struct *old_tsec,
2171 const struct task_security_struct *new_tsec)
2172 {
2173 int nnp = (bprm->unsafe & LSM_UNSAFE_NO_NEW_PRIVS);
2174 int nosuid = (bprm->file->f_path.mnt->mnt_flags & MNT_NOSUID);
2175 int rc;
2176
2177 if (!nnp && !nosuid)
2178 return 0; /* neither NNP nor nosuid */
2179
2180 if (new_tsec->sid == old_tsec->sid)
2181 return 0; /* No change in credentials */
2182
2183 /*
2184 * The only transitions we permit under NNP or nosuid
2185 * are transitions to bounded SIDs, i.e. SIDs that are
2186 * guaranteed to only be allowed a subset of the permissions
2187 * of the current SID.
2188 */
2189 rc = security_bounded_transition(old_tsec->sid, new_tsec->sid);
2190 if (rc) {
2191 /*
2192 * On failure, preserve the errno values for NNP vs nosuid.
2193 * NNP: Operation not permitted for caller.
2194 * nosuid: Permission denied to file.
2195 */
2196 if (nnp)
2197 return -EPERM;
2198 else
2199 return -EACCES;
2200 }
2201 return 0;
2202 }
2203
2204 static int selinux_bprm_set_creds(struct linux_binprm *bprm)
2205 {
2206 const struct task_security_struct *old_tsec;
2207 struct task_security_struct *new_tsec;
2208 struct inode_security_struct *isec;
2209 struct common_audit_data ad;
2210 struct inode *inode = file_inode(bprm->file);
2211 int rc;
2212
2213 /* SELinux context only depends on initial program or script and not
2214 * the script interpreter */
2215 if (bprm->cred_prepared)
2216 return 0;
2217
2218 old_tsec = current_security();
2219 new_tsec = bprm->cred->security;
2220 isec = inode->i_security;
2221
2222 /* Default to the current task SID. */
2223 new_tsec->sid = old_tsec->sid;
2224 new_tsec->osid = old_tsec->sid;
2225
2226 /* Reset fs, key, and sock SIDs on execve. */
2227 new_tsec->create_sid = 0;
2228 new_tsec->keycreate_sid = 0;
2229 new_tsec->sockcreate_sid = 0;
2230
2231 if (old_tsec->exec_sid) {
2232 new_tsec->sid = old_tsec->exec_sid;
2233 /* Reset exec SID on execve. */
2234 new_tsec->exec_sid = 0;
2235
2236 /* Fail on NNP or nosuid if not an allowed transition. */
2237 rc = check_nnp_nosuid(bprm, old_tsec, new_tsec);
2238 if (rc)
2239 return rc;
2240 } else {
2241 /* Check for a default transition on this program. */
2242 rc = security_transition_sid(old_tsec->sid, isec->sid,
2243 SECCLASS_PROCESS, NULL,
2244 &new_tsec->sid);
2245 if (rc)
2246 return rc;
2247
2248 /*
2249 * Fallback to old SID on NNP or nosuid if not an allowed
2250 * transition.
2251 */
2252 rc = check_nnp_nosuid(bprm, old_tsec, new_tsec);
2253 if (rc)
2254 new_tsec->sid = old_tsec->sid;
2255 }
2256
2257 ad.type = LSM_AUDIT_DATA_PATH;
2258 ad.u.path = bprm->file->f_path;
2259
2260 if (new_tsec->sid == old_tsec->sid) {
2261 rc = avc_has_perm(old_tsec->sid, isec->sid,
2262 SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
2263 if (rc)
2264 return rc;
2265 } else {
2266 /* Check permissions for the transition. */
2267 rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2268 SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
2269 if (rc)
2270 return rc;
2271
2272 rc = avc_has_perm(new_tsec->sid, isec->sid,
2273 SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
2274 if (rc)
2275 return rc;
2276
2277 /* Check for shared state */
2278 if (bprm->unsafe & LSM_UNSAFE_SHARE) {
2279 rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2280 SECCLASS_PROCESS, PROCESS__SHARE,
2281 NULL);
2282 if (rc)
2283 return -EPERM;
2284 }
2285
2286 /* Make sure that anyone attempting to ptrace over a task that
2287 * changes its SID has the appropriate permit */
2288 if (bprm->unsafe &
2289 (LSM_UNSAFE_PTRACE | LSM_UNSAFE_PTRACE_CAP)) {
2290 struct task_struct *tracer;
2291 struct task_security_struct *sec;
2292 u32 ptsid = 0;
2293
2294 rcu_read_lock();
2295 tracer = ptrace_parent(current);
2296 if (likely(tracer != NULL)) {
2297 sec = __task_cred(tracer)->security;
2298 ptsid = sec->sid;
2299 }
2300 rcu_read_unlock();
2301
2302 if (ptsid != 0) {
2303 rc = avc_has_perm(ptsid, new_tsec->sid,
2304 SECCLASS_PROCESS,
2305 PROCESS__PTRACE, NULL);
2306 if (rc)
2307 return -EPERM;
2308 }
2309 }
2310
2311 /* Clear any possibly unsafe personality bits on exec: */
2312 bprm->per_clear |= PER_CLEAR_ON_SETID;
2313 }
2314
2315 return 0;
2316 }
2317
2318 static int selinux_bprm_secureexec(struct linux_binprm *bprm)
2319 {
2320 const struct task_security_struct *tsec = current_security();
2321 u32 sid, osid;
2322 int atsecure = 0;
2323
2324 sid = tsec->sid;
2325 osid = tsec->osid;
2326
2327 if (osid != sid) {
2328 /* Enable secure mode for SIDs transitions unless
2329 the noatsecure permission is granted between
2330 the two SIDs, i.e. ahp returns 0. */
2331 atsecure = avc_has_perm(osid, sid,
2332 SECCLASS_PROCESS,
2333 PROCESS__NOATSECURE, NULL);
2334 }
2335
2336 return !!atsecure;
2337 }
2338
2339 static int match_file(const void *p, struct file *file, unsigned fd)
2340 {
2341 return file_has_perm(p, file, file_to_av(file)) ? fd + 1 : 0;
2342 }
2343
2344 /* Derived from fs/exec.c:flush_old_files. */
2345 static inline void flush_unauthorized_files(const struct cred *cred,
2346 struct files_struct *files)
2347 {
2348 struct file *file, *devnull = NULL;
2349 struct tty_struct *tty;
2350 int drop_tty = 0;
2351 unsigned n;
2352
2353 tty = get_current_tty();
2354 if (tty) {
2355 spin_lock(&tty_files_lock);
2356 if (!list_empty(&tty->tty_files)) {
2357 struct tty_file_private *file_priv;
2358
2359 /* Revalidate access to controlling tty.
2360 Use file_path_has_perm on the tty path directly
2361 rather than using file_has_perm, as this particular
2362 open file may belong to another process and we are
2363 only interested in the inode-based check here. */
2364 file_priv = list_first_entry(&tty->tty_files,
2365 struct tty_file_private, list);
2366 file = file_priv->file;
2367 if (file_path_has_perm(cred, file, FILE__READ | FILE__WRITE))
2368 drop_tty = 1;
2369 }
2370 spin_unlock(&tty_files_lock);
2371 tty_kref_put(tty);
2372 }
2373 /* Reset controlling tty. */
2374 if (drop_tty)
2375 no_tty();
2376
2377 /* Revalidate access to inherited open files. */
2378 n = iterate_fd(files, 0, match_file, cred);
2379 if (!n) /* none found? */
2380 return;
2381
2382 devnull = dentry_open(&selinux_null, O_RDWR, cred);
2383 if (IS_ERR(devnull))
2384 devnull = NULL;
2385 /* replace all the matching ones with this */
2386 do {
2387 replace_fd(n - 1, devnull, 0);
2388 } while ((n = iterate_fd(files, n, match_file, cred)) != 0);
2389 if (devnull)
2390 fput(devnull);
2391 }
2392
2393 /*
2394 * Prepare a process for imminent new credential changes due to exec
2395 */
2396 static void selinux_bprm_committing_creds(struct linux_binprm *bprm)
2397 {
2398 struct task_security_struct *new_tsec;
2399 struct rlimit *rlim, *initrlim;
2400 int rc, i;
2401
2402 new_tsec = bprm->cred->security;
2403 if (new_tsec->sid == new_tsec->osid)
2404 return;
2405
2406 /* Close files for which the new task SID is not authorized. */
2407 flush_unauthorized_files(bprm->cred, current->files);
2408
2409 /* Always clear parent death signal on SID transitions. */
2410 current->pdeath_signal = 0;
2411
2412 /* Check whether the new SID can inherit resource limits from the old
2413 * SID. If not, reset all soft limits to the lower of the current
2414 * task's hard limit and the init task's soft limit.
2415 *
2416 * Note that the setting of hard limits (even to lower them) can be
2417 * controlled by the setrlimit check. The inclusion of the init task's
2418 * soft limit into the computation is to avoid resetting soft limits
2419 * higher than the default soft limit for cases where the default is
2420 * lower than the hard limit, e.g. RLIMIT_CORE or RLIMIT_STACK.
2421 */
2422 rc = avc_has_perm(new_tsec->osid, new_tsec->sid, SECCLASS_PROCESS,
2423 PROCESS__RLIMITINH, NULL);
2424 if (rc) {
2425 /* protect against do_prlimit() */
2426 task_lock(current);
2427 for (i = 0; i < RLIM_NLIMITS; i++) {
2428 rlim = current->signal->rlim + i;
2429 initrlim = init_task.signal->rlim + i;
2430 rlim->rlim_cur = min(rlim->rlim_max, initrlim->rlim_cur);
2431 }
2432 task_unlock(current);
2433 update_rlimit_cpu(current, rlimit(RLIMIT_CPU));
2434 }
2435 }
2436
2437 /*
2438 * Clean up the process immediately after the installation of new credentials
2439 * due to exec
2440 */
2441 static void selinux_bprm_committed_creds(struct linux_binprm *bprm)
2442 {
2443 const struct task_security_struct *tsec = current_security();
2444 struct itimerval itimer;
2445 u32 osid, sid;
2446 int rc, i;
2447
2448 osid = tsec->osid;
2449 sid = tsec->sid;
2450
2451 if (sid == osid)
2452 return;
2453
2454 /* Check whether the new SID can inherit signal state from the old SID.
2455 * If not, clear itimers to avoid subsequent signal generation and
2456 * flush and unblock signals.
2457 *
2458 * This must occur _after_ the task SID has been updated so that any
2459 * kill done after the flush will be checked against the new SID.
2460 */
2461 rc = avc_has_perm(osid, sid, SECCLASS_PROCESS, PROCESS__SIGINH, NULL);
2462 if (rc) {
2463 memset(&itimer, 0, sizeof itimer);
2464 for (i = 0; i < 3; i++)
2465 do_setitimer(i, &itimer, NULL);
2466 spin_lock_irq(&current->sighand->siglock);
2467 if (!fatal_signal_pending(current)) {
2468 flush_sigqueue(&current->pending);
2469 flush_sigqueue(&current->signal->shared_pending);
2470 flush_signal_handlers(current, 1);
2471 sigemptyset(&current->blocked);
2472 recalc_sigpending();
2473 }
2474 spin_unlock_irq(&current->sighand->siglock);
2475 }
2476
2477 /* Wake up the parent if it is waiting so that it can recheck
2478 * wait permission to the new task SID. */
2479 read_lock(&tasklist_lock);
2480 __wake_up_parent(current, current->real_parent);
2481 read_unlock(&tasklist_lock);
2482 }
2483
2484 /* superblock security operations */
2485
2486 static int selinux_sb_alloc_security(struct super_block *sb)
2487 {
2488 return superblock_alloc_security(sb);
2489 }
2490
2491 static void selinux_sb_free_security(struct super_block *sb)
2492 {
2493 superblock_free_security(sb);
2494 }
2495
2496 static inline int match_prefix(char *prefix, int plen, char *option, int olen)
2497 {
2498 if (plen > olen)
2499 return 0;
2500
2501 return !memcmp(prefix, option, plen);
2502 }
2503
2504 static inline int selinux_option(char *option, int len)
2505 {
2506 return (match_prefix(CONTEXT_STR, sizeof(CONTEXT_STR)-1, option, len) ||
2507 match_prefix(FSCONTEXT_STR, sizeof(FSCONTEXT_STR)-1, option, len) ||
2508 match_prefix(DEFCONTEXT_STR, sizeof(DEFCONTEXT_STR)-1, option, len) ||
2509 match_prefix(ROOTCONTEXT_STR, sizeof(ROOTCONTEXT_STR)-1, option, len) ||
2510 match_prefix(LABELSUPP_STR, sizeof(LABELSUPP_STR)-1, option, len));
2511 }
2512
2513 static inline void take_option(char **to, char *from, int *first, int len)
2514 {
2515 if (!*first) {
2516 **to = ',';
2517 *to += 1;
2518 } else
2519 *first = 0;
2520 memcpy(*to, from, len);
2521 *to += len;
2522 }
2523
2524 static inline void take_selinux_option(char **to, char *from, int *first,
2525 int len)
2526 {
2527 int current_size = 0;
2528
2529 if (!*first) {
2530 **to = '|';
2531 *to += 1;
2532 } else
2533 *first = 0;
2534
2535 while (current_size < len) {
2536 if (*from != '"') {
2537 **to = *from;
2538 *to += 1;
2539 }
2540 from += 1;
2541 current_size += 1;
2542 }
2543 }
2544
2545 static int selinux_sb_copy_data(char *orig, char *copy)
2546 {
2547 int fnosec, fsec, rc = 0;
2548 char *in_save, *in_curr, *in_end;
2549 char *sec_curr, *nosec_save, *nosec;
2550 int open_quote = 0;
2551
2552 in_curr = orig;
2553 sec_curr = copy;
2554
2555 nosec = (char *)get_zeroed_page(GFP_KERNEL);
2556 if (!nosec) {
2557 rc = -ENOMEM;
2558 goto out;
2559 }
2560
2561 nosec_save = nosec;
2562 fnosec = fsec = 1;
2563 in_save = in_end = orig;
2564
2565 do {
2566 if (*in_end == '"')
2567 open_quote = !open_quote;
2568 if ((*in_end == ',' && open_quote == 0) ||
2569 *in_end == '\0') {
2570 int len = in_end - in_curr;
2571
2572 if (selinux_option(in_curr, len))
2573 take_selinux_option(&sec_curr, in_curr, &fsec, len);
2574 else
2575 take_option(&nosec, in_curr, &fnosec, len);
2576
2577 in_curr = in_end + 1;
2578 }
2579 } while (*in_end++);
2580
2581 strcpy(in_save, nosec_save);
2582 free_page((unsigned long)nosec_save);
2583 out:
2584 return rc;
2585 }
2586
2587 static int selinux_sb_remount(struct super_block *sb, void *data)
2588 {
2589 int rc, i, *flags;
2590 struct security_mnt_opts opts;
2591 char *secdata, **mount_options;
2592 struct superblock_security_struct *sbsec = sb->s_security;
2593
2594 if (!(sbsec->flags & SE_SBINITIALIZED))
2595 return 0;
2596
2597 if (!data)
2598 return 0;
2599
2600 if (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
2601 return 0;
2602
2603 security_init_mnt_opts(&opts);
2604 secdata = alloc_secdata();
2605 if (!secdata)
2606 return -ENOMEM;
2607 rc = selinux_sb_copy_data(data, secdata);
2608 if (rc)
2609 goto out_free_secdata;
2610
2611 rc = selinux_parse_opts_str(secdata, &opts);
2612 if (rc)
2613 goto out_free_secdata;
2614
2615 mount_options = opts.mnt_opts;
2616 flags = opts.mnt_opts_flags;
2617
2618 for (i = 0; i < opts.num_mnt_opts; i++) {
2619 u32 sid;
2620
2621 if (flags[i] == SBLABEL_MNT)
2622 continue;
2623 rc = security_context_str_to_sid(mount_options[i], &sid, GFP_KERNEL);
2624 if (rc) {
2625 printk(KERN_WARNING "SELinux: security_context_str_to_sid"
2626 "(%s) failed for (dev %s, type %s) errno=%d\n",
2627 mount_options[i], sb->s_id, sb->s_type->name, rc);
2628 goto out_free_opts;
2629 }
2630 rc = -EINVAL;
2631 switch (flags[i]) {
2632 case FSCONTEXT_MNT:
2633 if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid, sid))
2634 goto out_bad_option;
2635 break;
2636 case CONTEXT_MNT:
2637 if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid, sid))
2638 goto out_bad_option;
2639 break;
2640 case ROOTCONTEXT_MNT: {
2641 struct inode_security_struct *root_isec;
2642 root_isec = d_backing_inode(sb->s_root)->i_security;
2643
2644 if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid, sid))
2645 goto out_bad_option;
2646 break;
2647 }
2648 case DEFCONTEXT_MNT:
2649 if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid, sid))
2650 goto out_bad_option;
2651 break;
2652 default:
2653 goto out_free_opts;
2654 }
2655 }
2656
2657 rc = 0;
2658 out_free_opts:
2659 security_free_mnt_opts(&opts);
2660 out_free_secdata:
2661 free_secdata(secdata);
2662 return rc;
2663 out_bad_option:
2664 printk(KERN_WARNING "SELinux: unable to change security options "
2665 "during remount (dev %s, type=%s)\n", sb->s_id,
2666 sb->s_type->name);
2667 goto out_free_opts;
2668 }
2669
2670 static int selinux_sb_kern_mount(struct super_block *sb, int flags, void *data)
2671 {
2672 const struct cred *cred = current_cred();
2673 struct common_audit_data ad;
2674 int rc;
2675
2676 rc = superblock_doinit(sb, data);
2677 if (rc)
2678 return rc;
2679
2680 /* Allow all mounts performed by the kernel */
2681 if (flags & MS_KERNMOUNT)
2682 return 0;
2683
2684 ad.type = LSM_AUDIT_DATA_DENTRY;
2685 ad.u.dentry = sb->s_root;
2686 return superblock_has_perm(cred, sb, FILESYSTEM__MOUNT, &ad);
2687 }
2688
2689 static int selinux_sb_statfs(struct dentry *dentry)
2690 {
2691 const struct cred *cred = current_cred();
2692 struct common_audit_data ad;
2693
2694 ad.type = LSM_AUDIT_DATA_DENTRY;
2695 ad.u.dentry = dentry->d_sb->s_root;
2696 return superblock_has_perm(cred, dentry->d_sb, FILESYSTEM__GETATTR, &ad);
2697 }
2698
2699 static int selinux_mount(const char *dev_name,
2700 struct path *path,
2701 const char *type,
2702 unsigned long flags,
2703 void *data)
2704 {
2705 const struct cred *cred = current_cred();
2706
2707 if (flags & MS_REMOUNT)
2708 return superblock_has_perm(cred, path->dentry->d_sb,
2709 FILESYSTEM__REMOUNT, NULL);
2710 else
2711 return path_has_perm(cred, path, FILE__MOUNTON);
2712 }
2713
2714 static int selinux_umount(struct vfsmount *mnt, int flags)
2715 {
2716 const struct cred *cred = current_cred();
2717
2718 return superblock_has_perm(cred, mnt->mnt_sb,
2719 FILESYSTEM__UNMOUNT, NULL);
2720 }
2721
2722 /* inode security operations */
2723
2724 static int selinux_inode_alloc_security(struct inode *inode)
2725 {
2726 return inode_alloc_security(inode);
2727 }
2728
2729 static void selinux_inode_free_security(struct inode *inode)
2730 {
2731 inode_free_security(inode);
2732 }
2733
2734 static int selinux_dentry_init_security(struct dentry *dentry, int mode,
2735 struct qstr *name, void **ctx,
2736 u32 *ctxlen)
2737 {
2738 u32 newsid;
2739 int rc;
2740
2741 rc = selinux_determine_inode_label(d_inode(dentry->d_parent), name,
2742 inode_mode_to_security_class(mode),
2743 &newsid);
2744 if (rc)
2745 return rc;
2746
2747 return security_sid_to_context(newsid, (char **)ctx, ctxlen);
2748 }
2749
2750 static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
2751 const struct qstr *qstr,
2752 const char **name,
2753 void **value, size_t *len)
2754 {
2755 const struct task_security_struct *tsec = current_security();
2756 struct inode_security_struct *dsec;
2757 struct superblock_security_struct *sbsec;
2758 u32 sid, newsid, clen;
2759 int rc;
2760 char *context;
2761
2762 dsec = dir->i_security;
2763 sbsec = dir->i_sb->s_security;
2764
2765 sid = tsec->sid;
2766 newsid = tsec->create_sid;
2767
2768 rc = selinux_determine_inode_label(
2769 dir, qstr,
2770 inode_mode_to_security_class(inode->i_mode),
2771 &newsid);
2772 if (rc)
2773 return rc;
2774
2775 /* Possibly defer initialization to selinux_complete_init. */
2776 if (sbsec->flags & SE_SBINITIALIZED) {
2777 struct inode_security_struct *isec = inode->i_security;
2778 isec->sclass = inode_mode_to_security_class(inode->i_mode);
2779 isec->sid = newsid;
2780 isec->initialized = 1;
2781 }
2782
2783 if (!ss_initialized || !(sbsec->flags & SBLABEL_MNT))
2784 return -EOPNOTSUPP;
2785
2786 if (name)
2787 *name = XATTR_SELINUX_SUFFIX;
2788
2789 if (value && len) {
2790 rc = security_sid_to_context_force(newsid, &context, &clen);
2791 if (rc)
2792 return rc;
2793 *value = context;
2794 *len = clen;
2795 }
2796
2797 return 0;
2798 }
2799
2800 static int selinux_inode_create(struct inode *dir, struct dentry *dentry, umode_t mode)
2801 {
2802 return may_create(dir, dentry, SECCLASS_FILE);
2803 }
2804
2805 static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
2806 {
2807 return may_link(dir, old_dentry, MAY_LINK);
2808 }
2809
2810 static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
2811 {
2812 return may_link(dir, dentry, MAY_UNLINK);
2813 }
2814
2815 static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
2816 {
2817 return may_create(dir, dentry, SECCLASS_LNK_FILE);
2818 }
2819
2820 static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, umode_t mask)
2821 {
2822 return may_create(dir, dentry, SECCLASS_DIR);
2823 }
2824
2825 static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
2826 {
2827 return may_link(dir, dentry, MAY_RMDIR);
2828 }
2829
2830 static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, dev_t dev)
2831 {
2832 return may_create(dir, dentry, inode_mode_to_security_class(mode));
2833 }
2834
2835 static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
2836 struct inode *new_inode, struct dentry *new_dentry)
2837 {
2838 return may_rename(old_inode, old_dentry, new_inode, new_dentry);
2839 }
2840
2841 static int selinux_inode_readlink(struct dentry *dentry)
2842 {
2843 const struct cred *cred = current_cred();
2844
2845 return dentry_has_perm(cred, dentry, FILE__READ);
2846 }
2847
2848 static int selinux_inode_follow_link(struct dentry *dentry, struct inode *inode,
2849 bool rcu)
2850 {
2851 const struct cred *cred = current_cred();
2852 struct common_audit_data ad;
2853 struct inode_security_struct *isec;
2854 u32 sid;
2855
2856 validate_creds(cred);
2857
2858 ad.type = LSM_AUDIT_DATA_DENTRY;
2859 ad.u.dentry = dentry;
2860 sid = cred_sid(cred);
2861 isec = inode->i_security;
2862
2863 return avc_has_perm_flags(sid, isec->sid, isec->sclass, FILE__READ, &ad,
2864 rcu ? MAY_NOT_BLOCK : 0);
2865 }
2866
2867 static noinline int audit_inode_permission(struct inode *inode,
2868 u32 perms, u32 audited, u32 denied,
2869 int result,
2870 unsigned flags)
2871 {
2872 struct common_audit_data ad;
2873 struct inode_security_struct *isec = inode->i_security;
2874 int rc;
2875
2876 ad.type = LSM_AUDIT_DATA_INODE;
2877 ad.u.inode = inode;
2878
2879 rc = slow_avc_audit(current_sid(), isec->sid, isec->sclass, perms,
2880 audited, denied, result, &ad, flags);
2881 if (rc)
2882 return rc;
2883 return 0;
2884 }
2885
2886 static int selinux_inode_permission(struct inode *inode, int mask)
2887 {
2888 const struct cred *cred = current_cred();
2889 u32 perms;
2890 bool from_access;
2891 unsigned flags = mask & MAY_NOT_BLOCK;
2892 struct inode_security_struct *isec;
2893 u32 sid;
2894 struct av_decision avd;
2895 int rc, rc2;
2896 u32 audited, denied;
2897
2898 from_access = mask & MAY_ACCESS;
2899 mask &= (MAY_READ|MAY_WRITE|MAY_EXEC|MAY_APPEND);
2900
2901 /* No permission to check. Existence test. */
2902 if (!mask)
2903 return 0;
2904
2905 validate_creds(cred);
2906
2907 if (unlikely(IS_PRIVATE(inode)))
2908 return 0;
2909
2910 perms = file_mask_to_av(inode->i_mode, mask);
2911
2912 sid = cred_sid(cred);
2913 isec = inode->i_security;
2914
2915 rc = avc_has_perm_noaudit(sid, isec->sid, isec->sclass, perms, 0, &avd);
2916 audited = avc_audit_required(perms, &avd, rc,
2917 from_access ? FILE__AUDIT_ACCESS : 0,
2918 &denied);
2919 if (likely(!audited))
2920 return rc;
2921
2922 rc2 = audit_inode_permission(inode, perms, audited, denied, rc, flags);
2923 if (rc2)
2924 return rc2;
2925 return rc;
2926 }
2927
2928 static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
2929 {
2930 const struct cred *cred = current_cred();
2931 unsigned int ia_valid = iattr->ia_valid;
2932 __u32 av = FILE__WRITE;
2933
2934 /* ATTR_FORCE is just used for ATTR_KILL_S[UG]ID. */
2935 if (ia_valid & ATTR_FORCE) {
2936 ia_valid &= ~(ATTR_KILL_SUID | ATTR_KILL_SGID | ATTR_MODE |
2937 ATTR_FORCE);
2938 if (!ia_valid)
2939 return 0;
2940 }
2941
2942 if (ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
2943 ATTR_ATIME_SET | ATTR_MTIME_SET | ATTR_TIMES_SET))
2944 return dentry_has_perm(cred, dentry, FILE__SETATTR);
2945
2946 if (selinux_policycap_openperm && (ia_valid & ATTR_SIZE)
2947 && !(ia_valid & ATTR_FILE))
2948 av |= FILE__OPEN;
2949
2950 return dentry_has_perm(cred, dentry, av);
2951 }
2952
2953 static int selinux_inode_getattr(const struct path *path)
2954 {
2955 return path_has_perm(current_cred(), path, FILE__GETATTR);
2956 }
2957
2958 static int selinux_inode_setotherxattr(struct dentry *dentry, const char *name)
2959 {
2960 const struct cred *cred = current_cred();
2961
2962 if (!strncmp(name, XATTR_SECURITY_PREFIX,
2963 sizeof XATTR_SECURITY_PREFIX - 1)) {
2964 if (!strcmp(name, XATTR_NAME_CAPS)) {
2965 if (!capable(CAP_SETFCAP))
2966 return -EPERM;
2967 } else if (!capable(CAP_SYS_ADMIN)) {
2968 /* A different attribute in the security namespace.
2969 Restrict to administrator. */
2970 return -EPERM;
2971 }
2972 }
2973
2974 /* Not an attribute we recognize, so just check the
2975 ordinary setattr permission. */
2976 return dentry_has_perm(cred, dentry, FILE__SETATTR);
2977 }
2978
2979 static int selinux_inode_setxattr(struct dentry *dentry, const char *name,
2980 const void *value, size_t size, int flags)
2981 {
2982 struct inode *inode = d_backing_inode(dentry);
2983 struct inode_security_struct *isec = inode->i_security;
2984 struct superblock_security_struct *sbsec;
2985 struct common_audit_data ad;
2986 u32 newsid, sid = current_sid();
2987 int rc = 0;
2988
2989 if (strcmp(name, XATTR_NAME_SELINUX))
2990 return selinux_inode_setotherxattr(dentry, name);
2991
2992 sbsec = inode->i_sb->s_security;
2993 if (!(sbsec->flags & SBLABEL_MNT))
2994 return -EOPNOTSUPP;
2995
2996 if (!inode_owner_or_capable(inode))
2997 return -EPERM;
2998
2999 ad.type = LSM_AUDIT_DATA_DENTRY;
3000 ad.u.dentry = dentry;
3001
3002 rc = avc_has_perm(sid, isec->sid, isec->sclass,
3003 FILE__RELABELFROM, &ad);
3004 if (rc)
3005 return rc;
3006
3007 rc = security_context_to_sid(value, size, &newsid, GFP_KERNEL);
3008 if (rc == -EINVAL) {
3009 if (!capable(CAP_MAC_ADMIN)) {
3010 struct audit_buffer *ab;
3011 size_t audit_size;
3012 const char *str;
3013
3014 /* We strip a nul only if it is at the end, otherwise the
3015 * context contains a nul and we should audit that */
3016 if (value) {
3017 str = value;
3018 if (str[size - 1] == '\0')
3019 audit_size = size - 1;
3020 else
3021 audit_size = size;
3022 } else {
3023 str = "";
3024 audit_size = 0;
3025 }
3026 ab = audit_log_start(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR);
3027 audit_log_format(ab, "op=setxattr invalid_context=");
3028 audit_log_n_untrustedstring(ab, value, audit_size);
3029 audit_log_end(ab);
3030
3031 return rc;
3032 }
3033 rc = security_context_to_sid_force(value, size, &newsid);
3034 }
3035 if (rc)
3036 return rc;
3037
3038 rc = avc_has_perm(sid, newsid, isec->sclass,
3039 FILE__RELABELTO, &ad);
3040 if (rc)
3041 return rc;
3042
3043 rc = security_validate_transition(isec->sid, newsid, sid,
3044 isec->sclass);
3045 if (rc)
3046 return rc;
3047
3048 return avc_has_perm(newsid,
3049 sbsec->sid,
3050 SECCLASS_FILESYSTEM,
3051 FILESYSTEM__ASSOCIATE,
3052 &ad);
3053 }
3054
3055 static void selinux_inode_post_setxattr(struct dentry *dentry, const char *name,
3056 const void *value, size_t size,
3057 int flags)
3058 {
3059 struct inode *inode = d_backing_inode(dentry);
3060 struct inode_security_struct *isec = inode->i_security;
3061 u32 newsid;
3062 int rc;
3063
3064 if (strcmp(name, XATTR_NAME_SELINUX)) {
3065 /* Not an attribute we recognize, so nothing to do. */
3066 return;
3067 }
3068
3069 rc = security_context_to_sid_force(value, size, &newsid);
3070 if (rc) {
3071 printk(KERN_ERR "SELinux: unable to map context to SID"
3072 "for (%s, %lu), rc=%d\n",
3073 inode->i_sb->s_id, inode->i_ino, -rc);
3074 return;
3075 }
3076
3077 isec->sclass = inode_mode_to_security_class(inode->i_mode);
3078 isec->sid = newsid;
3079 isec->initialized = 1;
3080
3081 return;
3082 }
3083
3084 static int selinux_inode_getxattr(struct dentry *dentry, const char *name)
3085 {
3086 const struct cred *cred = current_cred();
3087
3088 return dentry_has_perm(cred, dentry, FILE__GETATTR);
3089 }
3090
3091 static int selinux_inode_listxattr(struct dentry *dentry)
3092 {
3093 const struct cred *cred = current_cred();
3094
3095 return dentry_has_perm(cred, dentry, FILE__GETATTR);
3096 }
3097
3098 static int selinux_inode_removexattr(struct dentry *dentry, const char *name)
3099 {
3100 if (strcmp(name, XATTR_NAME_SELINUX))
3101 return selinux_inode_setotherxattr(dentry, name);
3102
3103 /* No one is allowed to remove a SELinux security label.
3104 You can change the label, but all data must be labeled. */
3105 return -EACCES;
3106 }
3107
3108 /*
3109 * Copy the inode security context value to the user.
3110 *
3111 * Permission check is handled by selinux_inode_getxattr hook.
3112 */
3113 static int selinux_inode_getsecurity(const struct inode *inode, const char *name, void **buffer, bool alloc)
3114 {
3115 u32 size;
3116 int error;
3117 char *context = NULL;
3118 struct inode_security_struct *isec = inode->i_security;
3119
3120 if (strcmp(name, XATTR_SELINUX_SUFFIX))
3121 return -EOPNOTSUPP;
3122
3123 /*
3124 * If the caller has CAP_MAC_ADMIN, then get the raw context
3125 * value even if it is not defined by current policy; otherwise,
3126 * use the in-core value under current policy.
3127 * Use the non-auditing forms of the permission checks since
3128 * getxattr may be called by unprivileged processes commonly
3129 * and lack of permission just means that we fall back to the
3130 * in-core context value, not a denial.
3131 */
3132 error = cap_capable(current_cred(), &init_user_ns, CAP_MAC_ADMIN,
3133 SECURITY_CAP_NOAUDIT);
3134 if (!error)
3135 error = cred_has_capability(current_cred(), CAP_MAC_ADMIN,
3136 SECURITY_CAP_NOAUDIT);
3137 if (!error)
3138 error = security_sid_to_context_force(isec->sid, &context,
3139 &size);
3140 else
3141 error = security_sid_to_context(isec->sid, &context, &size);
3142 if (error)
3143 return error;
3144 error = size;
3145 if (alloc) {
3146 *buffer = context;
3147 goto out_nofree;
3148 }
3149 kfree(context);
3150 out_nofree:
3151 return error;
3152 }
3153
3154 static int selinux_inode_setsecurity(struct inode *inode, const char *name,
3155 const void *value, size_t size, int flags)
3156 {
3157 struct inode_security_struct *isec = inode->i_security;
3158 u32 newsid;
3159 int rc;
3160
3161 if (strcmp(name, XATTR_SELINUX_SUFFIX))
3162 return -EOPNOTSUPP;
3163
3164 if (!value || !size)
3165 return -EACCES;
3166
3167 rc = security_context_to_sid(value, size, &newsid, GFP_KERNEL);
3168 if (rc)
3169 return rc;
3170
3171 isec->sclass = inode_mode_to_security_class(inode->i_mode);
3172 isec->sid = newsid;
3173 isec->initialized = 1;
3174 return 0;
3175 }
3176
3177 static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
3178 {
3179 const int len = sizeof(XATTR_NAME_SELINUX);
3180 if (buffer && len <= buffer_size)
3181 memcpy(buffer, XATTR_NAME_SELINUX, len);
3182 return len;
3183 }
3184
3185 static void selinux_inode_getsecid(const struct inode *inode, u32 *secid)
3186 {
3187 struct inode_security_struct *isec = inode->i_security;
3188 *secid = isec->sid;
3189 }
3190
3191 /* file security operations */
3192
3193 static int selinux_revalidate_file_permission(struct file *file, int mask)
3194 {
3195 const struct cred *cred = current_cred();
3196 struct inode *inode = file_inode(file);
3197
3198 /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
3199 if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
3200 mask |= MAY_APPEND;
3201
3202 return file_has_perm(cred, file,
3203 file_mask_to_av(inode->i_mode, mask));
3204 }
3205
3206 static int selinux_file_permission(struct file *file, int mask)
3207 {
3208 struct inode *inode = file_inode(file);
3209 struct file_security_struct *fsec = file->f_security;
3210 struct inode_security_struct *isec = inode->i_security;
3211 u32 sid = current_sid();
3212
3213 if (!mask)
3214 /* No permission to check. Existence test. */
3215 return 0;
3216
3217 if (sid == fsec->sid && fsec->isid == isec->sid &&
3218 fsec->pseqno == avc_policy_seqno())
3219 /* No change since file_open check. */
3220 return 0;
3221
3222 return selinux_revalidate_file_permission(file, mask);
3223 }
3224
3225 static int selinux_file_alloc_security(struct file *file)
3226 {
3227 return file_alloc_security(file);
3228 }
3229
3230 static void selinux_file_free_security(struct file *file)
3231 {
3232 file_free_security(file);
3233 }
3234
3235 /*
3236 * Check whether a task has the ioctl permission and cmd
3237 * operation to an inode.
3238 */
3239 static int ioctl_has_perm(const struct cred *cred, struct file *file,
3240 u32 requested, u16 cmd)
3241 {
3242 struct common_audit_data ad;
3243 struct file_security_struct *fsec = file->f_security;
3244 struct inode *inode = file_inode(file);
3245 struct inode_security_struct *isec = inode->i_security;
3246 struct lsm_ioctlop_audit ioctl;
3247 u32 ssid = cred_sid(cred);
3248 int rc;
3249 u8 driver = cmd >> 8;
3250 u8 xperm = cmd & 0xff;
3251
3252 ad.type = LSM_AUDIT_DATA_IOCTL_OP;
3253 ad.u.op = &ioctl;
3254 ad.u.op->cmd = cmd;
3255 ad.u.op->path = file->f_path;
3256
3257 if (ssid != fsec->sid) {
3258 rc = avc_has_perm(ssid, fsec->sid,
3259 SECCLASS_FD,
3260 FD__USE,
3261 &ad);
3262 if (rc)
3263 goto out;
3264 }
3265
3266 if (unlikely(IS_PRIVATE(inode)))
3267 return 0;
3268
3269 rc = avc_has_extended_perms(ssid, isec->sid, isec->sclass,
3270 requested, driver, xperm, &ad);
3271 out:
3272 return rc;
3273 }
3274
3275 static int selinux_file_ioctl(struct file *file, unsigned int cmd,
3276 unsigned long arg)
3277 {
3278 const struct cred *cred = current_cred();
3279 int error = 0;
3280
3281 switch (cmd) {
3282 case FIONREAD:
3283 /* fall through */
3284 case FIBMAP:
3285 /* fall through */
3286 case FIGETBSZ:
3287 /* fall through */
3288 case FS_IOC_GETFLAGS:
3289 /* fall through */
3290 case FS_IOC_GETVERSION:
3291 error = file_has_perm(cred, file, FILE__GETATTR);
3292 break;
3293
3294 case FS_IOC_SETFLAGS:
3295 /* fall through */
3296 case FS_IOC_SETVERSION:
3297 error = file_has_perm(cred, file, FILE__SETATTR);
3298 break;
3299
3300 /* sys_ioctl() checks */
3301 case FIONBIO:
3302 /* fall through */
3303 case FIOASYNC:
3304 error = file_has_perm(cred, file, 0);
3305 break;
3306
3307 case KDSKBENT:
3308 case KDSKBSENT:
3309 error = cred_has_capability(cred, CAP_SYS_TTY_CONFIG,
3310 SECURITY_CAP_AUDIT);
3311 break;
3312
3313 /* default case assumes that the command will go
3314 * to the file's ioctl() function.
3315 */
3316 default:
3317 error = ioctl_has_perm(cred, file, FILE__IOCTL, (u16) cmd);
3318 }
3319 return error;
3320 }
3321
3322 static int default_noexec;
3323
3324 static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
3325 {
3326 const struct cred *cred = current_cred();
3327 int rc = 0;
3328
3329 if (default_noexec &&
3330 (prot & PROT_EXEC) && (!file || IS_PRIVATE(file_inode(file)) ||
3331 (!shared && (prot & PROT_WRITE)))) {
3332 /*
3333 * We are making executable an anonymous mapping or a
3334 * private file mapping that will also be writable.
3335 * This has an additional check.
3336 */
3337 rc = cred_has_perm(cred, cred, PROCESS__EXECMEM);
3338 if (rc)
3339 goto error;
3340 }
3341
3342 if (file) {
3343 /* read access is always possible with a mapping */
3344 u32 av = FILE__READ;
3345
3346 /* write access only matters if the mapping is shared */
3347 if (shared && (prot & PROT_WRITE))
3348 av |= FILE__WRITE;
3349
3350 if (prot & PROT_EXEC)
3351 av |= FILE__EXECUTE;
3352
3353 return file_has_perm(cred, file, av);
3354 }
3355
3356 error:
3357 return rc;
3358 }
3359
3360 static int selinux_mmap_addr(unsigned long addr)
3361 {
3362 int rc = 0;
3363
3364 if (addr < CONFIG_LSM_MMAP_MIN_ADDR) {
3365 u32 sid = current_sid();
3366 rc = avc_has_perm(sid, sid, SECCLASS_MEMPROTECT,
3367 MEMPROTECT__MMAP_ZERO, NULL);
3368 }
3369
3370 return rc;
3371 }
3372
3373 static int selinux_mmap_file(struct file *file, unsigned long reqprot,
3374 unsigned long prot, unsigned long flags)
3375 {
3376 if (selinux_checkreqprot)
3377 prot = reqprot;
3378
3379 return file_map_prot_check(file, prot,
3380 (flags & MAP_TYPE) == MAP_SHARED);
3381 }
3382
3383 static int selinux_file_mprotect(struct vm_area_struct *vma,
3384 unsigned long reqprot,
3385 unsigned long prot)
3386 {
3387 const struct cred *cred = current_cred();
3388
3389 if (selinux_checkreqprot)
3390 prot = reqprot;
3391
3392 if (default_noexec &&
3393 (prot & PROT_EXEC) && !(vma->vm_flags & VM_EXEC)) {
3394 int rc = 0;
3395 if (vma->vm_start >= vma->vm_mm->start_brk &&
3396 vma->vm_end <= vma->vm_mm->brk) {
3397 rc = cred_has_perm(cred, cred, PROCESS__EXECHEAP);
3398 } else if (!vma->vm_file &&
3399 vma->vm_start <= vma->vm_mm->start_stack &&
3400 vma->vm_end >= vma->vm_mm->start_stack) {
3401 rc = current_has_perm(current, PROCESS__EXECSTACK);
3402 } else if (vma->vm_file && vma->anon_vma) {
3403 /*
3404 * We are making executable a file mapping that has
3405 * had some COW done. Since pages might have been
3406 * written, check ability to execute the possibly
3407 * modified content. This typically should only
3408 * occur for text relocations.
3409 */
3410 rc = file_has_perm(cred, vma->vm_file, FILE__EXECMOD);
3411 }
3412 if (rc)
3413 return rc;
3414 }
3415
3416 return file_map_prot_check(vma->vm_file, prot, vma->vm_flags&VM_SHARED);
3417 }
3418
3419 static int selinux_file_lock(struct file *file, unsigned int cmd)
3420 {
3421 const struct cred *cred = current_cred();
3422
3423 return file_has_perm(cred, file, FILE__LOCK);
3424 }
3425
3426 static int selinux_file_fcntl(struct file *file, unsigned int cmd,
3427 unsigned long arg)
3428 {
3429 const struct cred *cred = current_cred();
3430 int err = 0;
3431
3432 switch (cmd) {
3433 case F_SETFL:
3434 if ((file->f_flags & O_APPEND) && !(arg & O_APPEND)) {
3435 err = file_has_perm(cred, file, FILE__WRITE);
3436 break;
3437 }
3438 /* fall through */
3439 case F_SETOWN:
3440 case F_SETSIG:
3441 case F_GETFL:
3442 case F_GETOWN:
3443 case F_GETSIG:
3444 case F_GETOWNER_UIDS:
3445 /* Just check FD__USE permission */
3446 err = file_has_perm(cred, file, 0);
3447 break;
3448 case F_GETLK:
3449 case F_SETLK:
3450 case F_SETLKW:
3451 case F_OFD_GETLK:
3452 case F_OFD_SETLK:
3453 case F_OFD_SETLKW:
3454 #if BITS_PER_LONG == 32
3455 case F_GETLK64:
3456 case F_SETLK64:
3457 case F_SETLKW64:
3458 #endif
3459 err = file_has_perm(cred, file, FILE__LOCK);
3460 break;
3461 }
3462
3463 return err;
3464 }
3465
3466 static void selinux_file_set_fowner(struct file *file)
3467 {
3468 struct file_security_struct *fsec;
3469
3470 fsec = file->f_security;
3471 fsec->fown_sid = current_sid();
3472 }
3473
3474 static int selinux_file_send_sigiotask(struct task_struct *tsk,
3475 struct fown_struct *fown, int signum)
3476 {
3477 struct file *file;
3478 u32 sid = task_sid(tsk);
3479 u32 perm;
3480 struct file_security_struct *fsec;
3481
3482 /* struct fown_struct is never outside the context of a struct file */
3483 file = container_of(fown, struct file, f_owner);
3484
3485 fsec = file->f_security;
3486
3487 if (!signum)
3488 perm = signal_to_av(SIGIO); /* as per send_sigio_to_task */
3489 else
3490 perm = signal_to_av(signum);
3491
3492 return avc_has_perm(fsec->fown_sid, sid,
3493 SECCLASS_PROCESS, perm, NULL);
3494 }
3495
3496 static int selinux_file_receive(struct file *file)
3497 {
3498 const struct cred *cred = current_cred();
3499
3500 return file_has_perm(cred, file, file_to_av(file));
3501 }
3502
3503 static int selinux_file_open(struct file *file, const struct cred *cred)
3504 {
3505 struct file_security_struct *fsec;
3506 struct inode_security_struct *isec;
3507
3508 fsec = file->f_security;
3509 isec = file_inode(file)->i_security;
3510 /*
3511 * Save inode label and policy sequence number
3512 * at open-time so that selinux_file_permission
3513 * can determine whether revalidation is necessary.
3514 * Task label is already saved in the file security
3515 * struct as its SID.
3516 */
3517 fsec->isid = isec->sid;
3518 fsec->pseqno = avc_policy_seqno();
3519 /*
3520 * Since the inode label or policy seqno may have changed
3521 * between the selinux_inode_permission check and the saving
3522 * of state above, recheck that access is still permitted.
3523 * Otherwise, access might never be revalidated against the
3524 * new inode label or new policy.
3525 * This check is not redundant - do not remove.
3526 */
3527 return file_path_has_perm(cred, file, open_file_to_av(file));
3528 }
3529
3530 /* task security operations */
3531
3532 static int selinux_task_create(unsigned long clone_flags)
3533 {
3534 return current_has_perm(current, PROCESS__FORK);
3535 }
3536
3537 /*
3538 * allocate the SELinux part of blank credentials
3539 */
3540 static int selinux_cred_alloc_blank(struct cred *cred, gfp_t gfp)
3541 {
3542 struct task_security_struct *tsec;
3543
3544 tsec = kzalloc(sizeof(struct task_security_struct), gfp);
3545 if (!tsec)
3546 return -ENOMEM;
3547
3548 cred->security = tsec;
3549 return 0;
3550 }
3551
3552 /*
3553 * detach and free the LSM part of a set of credentials
3554 */
3555 static void selinux_cred_free(struct cred *cred)
3556 {
3557 struct task_security_struct *tsec = cred->security;
3558
3559 /*
3560 * cred->security == NULL if security_cred_alloc_blank() or
3561 * security_prepare_creds() returned an error.
3562 */
3563 BUG_ON(cred->security && (unsigned long) cred->security < PAGE_SIZE);
3564 cred->security = (void *) 0x7UL;
3565 kfree(tsec);
3566 }
3567
3568 /*
3569 * prepare a new set of credentials for modification
3570 */
3571 static int selinux_cred_prepare(struct cred *new, const struct cred *old,
3572 gfp_t gfp)
3573 {
3574 const struct task_security_struct *old_tsec;
3575 struct task_security_struct *tsec;
3576
3577 old_tsec = old->security;
3578
3579 tsec = kmemdup(old_tsec, sizeof(struct task_security_struct), gfp);
3580 if (!tsec)
3581 return -ENOMEM;
3582
3583 new->security = tsec;
3584 return 0;
3585 }
3586
3587 /*
3588 * transfer the SELinux data to a blank set of creds
3589 */
3590 static void selinux_cred_transfer(struct cred *new, const struct cred *old)
3591 {
3592 const struct task_security_struct *old_tsec = old->security;
3593 struct task_security_struct *tsec = new->security;
3594
3595 *tsec = *old_tsec;
3596 }
3597
3598 /*
3599 * set the security data for a kernel service
3600 * - all the creation contexts are set to unlabelled
3601 */
3602 static int selinux_kernel_act_as(struct cred *new, u32 secid)
3603 {
3604 struct task_security_struct *tsec = new->security;
3605 u32 sid = current_sid();
3606 int ret;
3607
3608 ret = avc_has_perm(sid, secid,
3609 SECCLASS_KERNEL_SERVICE,
3610 KERNEL_SERVICE__USE_AS_OVERRIDE,
3611 NULL);
3612 if (ret == 0) {
3613 tsec->sid = secid;
3614 tsec->create_sid = 0;
3615 tsec->keycreate_sid = 0;
3616 tsec->sockcreate_sid = 0;
3617 }
3618 return ret;
3619 }
3620
3621 /*
3622 * set the file creation context in a security record to the same as the
3623 * objective context of the specified inode
3624 */
3625 static int selinux_kernel_create_files_as(struct cred *new, struct inode *inode)
3626 {
3627 struct inode_security_struct *isec = inode->i_security;
3628 struct task_security_struct *tsec = new->security;
3629 u32 sid = current_sid();
3630 int ret;
3631
3632 ret = avc_has_perm(sid, isec->sid,
3633 SECCLASS_KERNEL_SERVICE,
3634 KERNEL_SERVICE__CREATE_FILES_AS,
3635 NULL);
3636
3637 if (ret == 0)
3638 tsec->create_sid = isec->sid;
3639 return ret;
3640 }
3641
3642 static int selinux_kernel_module_request(char *kmod_name)
3643 {
3644 u32 sid;
3645 struct common_audit_data ad;
3646
3647 sid = task_sid(current);
3648
3649 ad.type = LSM_AUDIT_DATA_KMOD;
3650 ad.u.kmod_name = kmod_name;
3651
3652 return avc_has_perm(sid, SECINITSID_KERNEL, SECCLASS_SYSTEM,
3653 SYSTEM__MODULE_REQUEST, &ad);
3654 }
3655
3656 static int selinux_task_setpgid(struct task_struct *p, pid_t pgid)
3657 {
3658 return current_has_perm(p, PROCESS__SETPGID);
3659 }
3660
3661 static int selinux_task_getpgid(struct task_struct *p)
3662 {
3663 return current_has_perm(p, PROCESS__GETPGID);
3664 }
3665
3666 static int selinux_task_getsid(struct task_struct *p)
3667 {
3668 return current_has_perm(p, PROCESS__GETSESSION);
3669 }
3670
3671 static void selinux_task_getsecid(struct task_struct *p, u32 *secid)
3672 {
3673 *secid = task_sid(p);
3674 }
3675
3676 static int selinux_task_setnice(struct task_struct *p, int nice)
3677 {
3678 return current_has_perm(p, PROCESS__SETSCHED);
3679 }
3680
3681 static int selinux_task_setioprio(struct task_struct *p, int ioprio)
3682 {
3683 return current_has_perm(p, PROCESS__SETSCHED);
3684 }
3685
3686 static int selinux_task_getioprio(struct task_struct *p)
3687 {
3688 return current_has_perm(p, PROCESS__GETSCHED);
3689 }
3690
3691 static int selinux_task_setrlimit(struct task_struct *p, unsigned int resource,
3692 struct rlimit *new_rlim)
3693 {
3694 struct rlimit *old_rlim = p->signal->rlim + resource;
3695
3696 /* Control the ability to change the hard limit (whether
3697 lowering or raising it), so that the hard limit can
3698 later be used as a safe reset point for the soft limit
3699 upon context transitions. See selinux_bprm_committing_creds. */
3700 if (old_rlim->rlim_max != new_rlim->rlim_max)
3701 return current_has_perm(p, PROCESS__SETRLIMIT);
3702
3703 return 0;
3704 }
3705
3706 static int selinux_task_setscheduler(struct task_struct *p)
3707 {
3708 return current_has_perm(p, PROCESS__SETSCHED);
3709 }
3710
3711 static int selinux_task_getscheduler(struct task_struct *p)
3712 {
3713 return current_has_perm(p, PROCESS__GETSCHED);
3714 }
3715
3716 static int selinux_task_movememory(struct task_struct *p)
3717 {
3718 return current_has_perm(p, PROCESS__SETSCHED);
3719 }
3720
3721 static int selinux_task_kill(struct task_struct *p, struct siginfo *info,
3722 int sig, u32 secid)
3723 {
3724 u32 perm;
3725 int rc;
3726
3727 if (!sig)
3728 perm = PROCESS__SIGNULL; /* null signal; existence test */
3729 else
3730 perm = signal_to_av(sig);
3731 if (secid)
3732 rc = avc_has_perm(secid, task_sid(p),
3733 SECCLASS_PROCESS, perm, NULL);
3734 else
3735 rc = current_has_perm(p, perm);
3736 return rc;
3737 }
3738
3739 static int selinux_task_wait(struct task_struct *p)
3740 {
3741 return task_has_perm(p, current, PROCESS__SIGCHLD);
3742 }
3743
3744 static void selinux_task_to_inode(struct task_struct *p,
3745 struct inode *inode)
3746 {
3747 struct inode_security_struct *isec = inode->i_security;
3748 u32 sid = task_sid(p);
3749
3750 isec->sid = sid;
3751 isec->initialized = 1;
3752 }
3753
3754 /* Returns error only if unable to parse addresses */
3755 static int selinux_parse_skb_ipv4(struct sk_buff *skb,
3756 struct common_audit_data *ad, u8 *proto)
3757 {
3758 int offset, ihlen, ret = -EINVAL;
3759 struct iphdr _iph, *ih;
3760
3761 offset = skb_network_offset(skb);
3762 ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
3763 if (ih == NULL)
3764 goto out;
3765
3766 ihlen = ih->ihl * 4;
3767 if (ihlen < sizeof(_iph))
3768 goto out;
3769
3770 ad->u.net->v4info.saddr = ih->saddr;
3771 ad->u.net->v4info.daddr = ih->daddr;
3772 ret = 0;
3773
3774 if (proto)
3775 *proto = ih->protocol;
3776
3777 switch (ih->protocol) {
3778 case IPPROTO_TCP: {
3779 struct tcphdr _tcph, *th;
3780
3781 if (ntohs(ih->frag_off) & IP_OFFSET)
3782 break;
3783
3784 offset += ihlen;
3785 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
3786 if (th == NULL)
3787 break;
3788
3789 ad->u.net->sport = th->source;
3790 ad->u.net->dport = th->dest;
3791 break;
3792 }
3793
3794 case IPPROTO_UDP: {
3795 struct udphdr _udph, *uh;
3796
3797 if (ntohs(ih->frag_off) & IP_OFFSET)
3798 break;
3799
3800 offset += ihlen;
3801 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
3802 if (uh == NULL)
3803 break;
3804
3805 ad->u.net->sport = uh->source;
3806 ad->u.net->dport = uh->dest;
3807 break;
3808 }
3809
3810 case IPPROTO_DCCP: {
3811 struct dccp_hdr _dccph, *dh;
3812
3813 if (ntohs(ih->frag_off) & IP_OFFSET)
3814 break;
3815
3816 offset += ihlen;
3817 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3818 if (dh == NULL)
3819 break;
3820
3821 ad->u.net->sport = dh->dccph_sport;
3822 ad->u.net->dport = dh->dccph_dport;
3823 break;
3824 }
3825
3826 default:
3827 break;
3828 }
3829 out:
3830 return ret;
3831 }
3832
3833 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3834
3835 /* Returns error only if unable to parse addresses */
3836 static int selinux_parse_skb_ipv6(struct sk_buff *skb,
3837 struct common_audit_data *ad, u8 *proto)
3838 {
3839 u8 nexthdr;
3840 int ret = -EINVAL, offset;
3841 struct ipv6hdr _ipv6h, *ip6;
3842 __be16 frag_off;
3843
3844 offset = skb_network_offset(skb);
3845 ip6 = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h);
3846 if (ip6 == NULL)
3847 goto out;
3848
3849 ad->u.net->v6info.saddr = ip6->saddr;
3850 ad->u.net->v6info.daddr = ip6->daddr;
3851 ret = 0;
3852
3853 nexthdr = ip6->nexthdr;
3854 offset += sizeof(_ipv6h);
3855 offset = ipv6_skip_exthdr(skb, offset, &nexthdr, &frag_off);
3856 if (offset < 0)
3857 goto out;
3858
3859 if (proto)
3860 *proto = nexthdr;
3861
3862 switch (nexthdr) {
3863 case IPPROTO_TCP: {
3864 struct tcphdr _tcph, *th;
3865
3866 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
3867 if (th == NULL)
3868 break;
3869
3870 ad->u.net->sport = th->source;
3871 ad->u.net->dport = th->dest;
3872 break;
3873 }
3874
3875 case IPPROTO_UDP: {
3876 struct udphdr _udph, *uh;
3877
3878 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
3879 if (uh == NULL)
3880 break;
3881
3882 ad->u.net->sport = uh->source;
3883 ad->u.net->dport = uh->dest;
3884 break;
3885 }
3886
3887 case IPPROTO_DCCP: {
3888 struct dccp_hdr _dccph, *dh;
3889
3890 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3891 if (dh == NULL)
3892 break;
3893
3894 ad->u.net->sport = dh->dccph_sport;
3895 ad->u.net->dport = dh->dccph_dport;
3896 break;
3897 }
3898
3899 /* includes fragments */
3900 default:
3901 break;
3902 }
3903 out:
3904 return ret;
3905 }
3906
3907 #endif /* IPV6 */
3908
3909 static int selinux_parse_skb(struct sk_buff *skb, struct common_audit_data *ad,
3910 char **_addrp, int src, u8 *proto)
3911 {
3912 char *addrp;
3913 int ret;
3914
3915 switch (ad->u.net->family) {
3916 case PF_INET:
3917 ret = selinux_parse_skb_ipv4(skb, ad, proto);
3918 if (ret)
3919 goto parse_error;
3920 addrp = (char *)(src ? &ad->u.net->v4info.saddr :
3921 &ad->u.net->v4info.daddr);
3922 goto okay;
3923
3924 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3925 case PF_INET6:
3926 ret = selinux_parse_skb_ipv6(skb, ad, proto);
3927 if (ret)
3928 goto parse_error;
3929 addrp = (char *)(src ? &ad->u.net->v6info.saddr :
3930 &ad->u.net->v6info.daddr);
3931 goto okay;
3932 #endif /* IPV6 */
3933 default:
3934 addrp = NULL;
3935 goto okay;
3936 }
3937
3938 parse_error:
3939 printk(KERN_WARNING
3940 "SELinux: failure in selinux_parse_skb(),"
3941 " unable to parse packet\n");
3942 return ret;
3943
3944 okay:
3945 if (_addrp)
3946 *_addrp = addrp;
3947 return 0;
3948 }
3949
3950 /**
3951 * selinux_skb_peerlbl_sid - Determine the peer label of a packet
3952 * @skb: the packet
3953 * @family: protocol family
3954 * @sid: the packet's peer label SID
3955 *
3956 * Description:
3957 * Check the various different forms of network peer labeling and determine
3958 * the peer label/SID for the packet; most of the magic actually occurs in
3959 * the security server function security_net_peersid_cmp(). The function
3960 * returns zero if the value in @sid is valid (although it may be SECSID_NULL)
3961 * or -EACCES if @sid is invalid due to inconsistencies with the different
3962 * peer labels.
3963 *
3964 */
3965 static int selinux_skb_peerlbl_sid(struct sk_buff *skb, u16 family, u32 *sid)
3966 {
3967 int err;
3968 u32 xfrm_sid;
3969 u32 nlbl_sid;
3970 u32 nlbl_type;
3971
3972 err = selinux_xfrm_skb_sid(skb, &xfrm_sid);
3973 if (unlikely(err))
3974 return -EACCES;
3975 err = selinux_netlbl_skbuff_getsid(skb, family, &nlbl_type, &nlbl_sid);
3976 if (unlikely(err))
3977 return -EACCES;
3978
3979 err = security_net_peersid_resolve(nlbl_sid, nlbl_type, xfrm_sid, sid);
3980 if (unlikely(err)) {
3981 printk(KERN_WARNING
3982 "SELinux: failure in selinux_skb_peerlbl_sid(),"
3983 " unable to determine packet's peer label\n");
3984 return -EACCES;
3985 }
3986
3987 return 0;
3988 }
3989
3990 /**
3991 * selinux_conn_sid - Determine the child socket label for a connection
3992 * @sk_sid: the parent socket's SID
3993 * @skb_sid: the packet's SID
3994 * @conn_sid: the resulting connection SID
3995 *
3996 * If @skb_sid is valid then the user:role:type information from @sk_sid is
3997 * combined with the MLS information from @skb_sid in order to create
3998 * @conn_sid. If @skb_sid is not valid then then @conn_sid is simply a copy
3999 * of @sk_sid. Returns zero on success, negative values on failure.
4000 *
4001 */
4002 static int selinux_conn_sid(u32 sk_sid, u32 skb_sid, u32 *conn_sid)
4003 {
4004 int err = 0;
4005
4006 if (skb_sid != SECSID_NULL)
4007 err = security_sid_mls_copy(sk_sid, skb_sid, conn_sid);
4008 else
4009 *conn_sid = sk_sid;
4010
4011 return err;
4012 }
4013
4014 /* socket security operations */
4015
4016 static int socket_sockcreate_sid(const struct task_security_struct *tsec,
4017 u16 secclass, u32 *socksid)
4018 {
4019 if (tsec->sockcreate_sid > SECSID_NULL) {
4020 *socksid = tsec->sockcreate_sid;
4021 return 0;
4022 }
4023
4024 return security_transition_sid(tsec->sid, tsec->sid, secclass, NULL,
4025 socksid);
4026 }
4027
4028 static int sock_has_perm(struct task_struct *task, struct sock *sk, u32 perms)
4029 {
4030 struct sk_security_struct *sksec = sk->sk_security;
4031 struct common_audit_data ad;
4032 struct lsm_network_audit net = {0,};
4033 u32 tsid = task_sid(task);
4034
4035 if (sksec->sid == SECINITSID_KERNEL)
4036 return 0;
4037
4038 ad.type = LSM_AUDIT_DATA_NET;
4039 ad.u.net = &net;
4040 ad.u.net->sk = sk;
4041
4042 return avc_has_perm(tsid, sksec->sid, sksec->sclass, perms, &ad);
4043 }
4044
4045 static int selinux_socket_create(int family, int type,
4046 int protocol, int kern)
4047 {
4048 const struct task_security_struct *tsec = current_security();
4049 u32 newsid;
4050 u16 secclass;
4051 int rc;
4052
4053 if (kern)
4054 return 0;
4055
4056 secclass = socket_type_to_security_class(family, type, protocol);
4057 rc = socket_sockcreate_sid(tsec, secclass, &newsid);
4058 if (rc)
4059 return rc;
4060
4061 return avc_has_perm(tsec->sid, newsid, secclass, SOCKET__CREATE, NULL);
4062 }
4063
4064 static int selinux_socket_post_create(struct socket *sock, int family,
4065 int type, int protocol, int kern)
4066 {
4067 const struct task_security_struct *tsec = current_security();
4068 struct inode_security_struct *isec = SOCK_INODE(sock)->i_security;
4069 struct sk_security_struct *sksec;
4070 int err = 0;
4071
4072 isec->sclass = socket_type_to_security_class(family, type, protocol);
4073
4074 if (kern)
4075 isec->sid = SECINITSID_KERNEL;
4076 else {
4077 err = socket_sockcreate_sid(tsec, isec->sclass, &(isec->sid));
4078 if (err)
4079 return err;
4080 }
4081
4082 isec->initialized = 1;
4083
4084 if (sock->sk) {
4085 sksec = sock->sk->sk_security;
4086 sksec->sid = isec->sid;
4087 sksec->sclass = isec->sclass;
4088 err = selinux_netlbl_socket_post_create(sock->sk, family);
4089 }
4090
4091 return err;
4092 }
4093
4094 /* Range of port numbers used to automatically bind.
4095 Need to determine whether we should perform a name_bind
4096 permission check between the socket and the port number. */
4097
4098 static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
4099 {
4100 struct sock *sk = sock->sk;
4101 u16 family;
4102 int err;
4103
4104 err = sock_has_perm(current, sk, SOCKET__BIND);
4105 if (err)
4106 goto out;
4107
4108 /*
4109 * If PF_INET or PF_INET6, check name_bind permission for the port.
4110 * Multiple address binding for SCTP is not supported yet: we just
4111 * check the first address now.
4112 */
4113 family = sk->sk_family;
4114 if (family == PF_INET || family == PF_INET6) {
4115 char *addrp;
4116 struct sk_security_struct *sksec = sk->sk_security;
4117 struct common_audit_data ad;
4118 struct lsm_network_audit net = {0,};
4119 struct sockaddr_in *addr4 = NULL;
4120 struct sockaddr_in6 *addr6 = NULL;
4121 unsigned short snum;
4122 u32 sid, node_perm;
4123
4124 if (family == PF_INET) {
4125 addr4 = (struct sockaddr_in *)address;
4126 snum = ntohs(addr4->sin_port);
4127 addrp = (char *)&addr4->sin_addr.s_addr;
4128 } else {
4129 addr6 = (struct sockaddr_in6 *)address;
4130 snum = ntohs(addr6->sin6_port);
4131 addrp = (char *)&addr6->sin6_addr.s6_addr;
4132 }
4133
4134 if (snum) {
4135 int low, high;
4136
4137 inet_get_local_port_range(sock_net(sk), &low, &high);
4138
4139 if (snum < max(PROT_SOCK, low) || snum > high) {
4140 err = sel_netport_sid(sk->sk_protocol,
4141 snum, &sid);
4142 if (err)
4143 goto out;
4144 ad.type = LSM_AUDIT_DATA_NET;
4145 ad.u.net = &net;
4146 ad.u.net->sport = htons(snum);
4147 ad.u.net->family = family;
4148 err = avc_has_perm(sksec->sid, sid,
4149 sksec->sclass,
4150 SOCKET__NAME_BIND, &ad);
4151 if (err)
4152 goto out;
4153 }
4154 }
4155
4156 switch (sksec->sclass) {
4157 case SECCLASS_TCP_SOCKET:
4158 node_perm = TCP_SOCKET__NODE_BIND;
4159 break;
4160
4161 case SECCLASS_UDP_SOCKET:
4162 node_perm = UDP_SOCKET__NODE_BIND;
4163 break;
4164
4165 case SECCLASS_DCCP_SOCKET:
4166 node_perm = DCCP_SOCKET__NODE_BIND;
4167 break;
4168
4169 default:
4170 node_perm = RAWIP_SOCKET__NODE_BIND;
4171 break;
4172 }
4173
4174 err = sel_netnode_sid(addrp, family, &sid);
4175 if (err)
4176 goto out;
4177
4178 ad.type = LSM_AUDIT_DATA_NET;
4179 ad.u.net = &net;
4180 ad.u.net->sport = htons(snum);
4181 ad.u.net->family = family;
4182
4183 if (family == PF_INET)
4184 ad.u.net->v4info.saddr = addr4->sin_addr.s_addr;
4185 else
4186 ad.u.net->v6info.saddr = addr6->sin6_addr;
4187
4188 err = avc_has_perm(sksec->sid, sid,
4189 sksec->sclass, node_perm, &ad);
4190 if (err)
4191 goto out;
4192 }
4193 out:
4194 return err;
4195 }
4196
4197 static int selinux_socket_connect(struct socket *sock, struct sockaddr *address, int addrlen)
4198 {
4199 struct sock *sk = sock->sk;
4200 struct sk_security_struct *sksec = sk->sk_security;
4201 int err;
4202
4203 err = sock_has_perm(current, sk, SOCKET__CONNECT);
4204 if (err)
4205 return err;
4206
4207 /*
4208 * If a TCP or DCCP socket, check name_connect permission for the port.
4209 */
4210 if (sksec->sclass == SECCLASS_TCP_SOCKET ||
4211 sksec->sclass == SECCLASS_DCCP_SOCKET) {
4212 struct common_audit_data ad;
4213 struct lsm_network_audit net = {0,};
4214 struct sockaddr_in *addr4 = NULL;
4215 struct sockaddr_in6 *addr6 = NULL;
4216 unsigned short snum;
4217 u32 sid, perm;
4218
4219 if (sk->sk_family == PF_INET) {
4220 addr4 = (struct sockaddr_in *)address;
4221 if (addrlen < sizeof(struct sockaddr_in))
4222 return -EINVAL;
4223 snum = ntohs(addr4->sin_port);
4224 } else {
4225 addr6 = (struct sockaddr_in6 *)address;
4226 if (addrlen < SIN6_LEN_RFC2133)
4227 return -EINVAL;
4228 snum = ntohs(addr6->sin6_port);
4229 }
4230
4231 err = sel_netport_sid(sk->sk_protocol, snum, &sid);
4232 if (err)
4233 goto out;
4234
4235 perm = (sksec->sclass == SECCLASS_TCP_SOCKET) ?
4236 TCP_SOCKET__NAME_CONNECT : DCCP_SOCKET__NAME_CONNECT;
4237
4238 ad.type = LSM_AUDIT_DATA_NET;
4239 ad.u.net = &net;
4240 ad.u.net->dport = htons(snum);
4241 ad.u.net->family = sk->sk_family;
4242 err = avc_has_perm(sksec->sid, sid, sksec->sclass, perm, &ad);
4243 if (err)
4244 goto out;
4245 }
4246
4247 err = selinux_netlbl_socket_connect(sk, address);
4248
4249 out:
4250 return err;
4251 }
4252
4253 static int selinux_socket_listen(struct socket *sock, int backlog)
4254 {
4255 return sock_has_perm(current, sock->sk, SOCKET__LISTEN);
4256 }
4257
4258 static int selinux_socket_accept(struct socket *sock, struct socket *newsock)
4259 {
4260 int err;
4261 struct inode_security_struct *isec;
4262 struct inode_security_struct *newisec;
4263
4264 err = sock_has_perm(current, sock->sk, SOCKET__ACCEPT);
4265 if (err)
4266 return err;
4267
4268 newisec = SOCK_INODE(newsock)->i_security;
4269
4270 isec = SOCK_INODE(sock)->i_security;
4271 newisec->sclass = isec->sclass;
4272 newisec->sid = isec->sid;
4273 newisec->initialized = 1;
4274
4275 return 0;
4276 }
4277
4278 static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg,
4279 int size)
4280 {
4281 return sock_has_perm(current, sock->sk, SOCKET__WRITE);
4282 }
4283
4284 static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg,
4285 int size, int flags)
4286 {
4287 return sock_has_perm(current, sock->sk, SOCKET__READ);
4288 }
4289
4290 static int selinux_socket_getsockname(struct socket *sock)
4291 {
4292 return sock_has_perm(current, sock->sk, SOCKET__GETATTR);
4293 }
4294
4295 static int selinux_socket_getpeername(struct socket *sock)
4296 {
4297 return sock_has_perm(current, sock->sk, SOCKET__GETATTR);
4298 }
4299
4300 static int selinux_socket_setsockopt(struct socket *sock, int level, int optname)
4301 {
4302 int err;
4303
4304 err = sock_has_perm(current, sock->sk, SOCKET__SETOPT);
4305 if (err)
4306 return err;
4307
4308 return selinux_netlbl_socket_setsockopt(sock, level, optname);
4309 }
4310
4311 static int selinux_socket_getsockopt(struct socket *sock, int level,
4312 int optname)
4313 {
4314 return sock_has_perm(current, sock->sk, SOCKET__GETOPT);
4315 }
4316
4317 static int selinux_socket_shutdown(struct socket *sock, int how)
4318 {
4319 return sock_has_perm(current, sock->sk, SOCKET__SHUTDOWN);
4320 }
4321
4322 static int selinux_socket_unix_stream_connect(struct sock *sock,
4323 struct sock *other,
4324 struct sock *newsk)
4325 {
4326 struct sk_security_struct *sksec_sock = sock->sk_security;
4327 struct sk_security_struct *sksec_other = other->sk_security;
4328 struct sk_security_struct *sksec_new = newsk->sk_security;
4329 struct common_audit_data ad;
4330 struct lsm_network_audit net = {0,};
4331 int err;
4332
4333 ad.type = LSM_AUDIT_DATA_NET;
4334 ad.u.net = &net;
4335 ad.u.net->sk = other;
4336
4337 err = avc_has_perm(sksec_sock->sid, sksec_other->sid,
4338 sksec_other->sclass,
4339 UNIX_STREAM_SOCKET__CONNECTTO, &ad);
4340 if (err)
4341 return err;
4342
4343 /* server child socket */
4344 sksec_new->peer_sid = sksec_sock->sid;
4345 err = security_sid_mls_copy(sksec_other->sid, sksec_sock->sid,
4346 &sksec_new->sid);
4347 if (err)
4348 return err;
4349
4350 /* connecting socket */
4351 sksec_sock->peer_sid = sksec_new->sid;
4352
4353 return 0;
4354 }
4355
4356 static int selinux_socket_unix_may_send(struct socket *sock,
4357 struct socket *other)
4358 {
4359 struct sk_security_struct *ssec = sock->sk->sk_security;
4360 struct sk_security_struct *osec = other->sk->sk_security;
4361 struct common_audit_data ad;
4362 struct lsm_network_audit net = {0,};
4363
4364 ad.type = LSM_AUDIT_DATA_NET;
4365 ad.u.net = &net;
4366 ad.u.net->sk = other->sk;
4367
4368 return avc_has_perm(ssec->sid, osec->sid, osec->sclass, SOCKET__SENDTO,
4369 &ad);
4370 }
4371
4372 static int selinux_inet_sys_rcv_skb(struct net *ns, int ifindex,
4373 char *addrp, u16 family, u32 peer_sid,
4374 struct common_audit_data *ad)
4375 {
4376 int err;
4377 u32 if_sid;
4378 u32 node_sid;
4379
4380 err = sel_netif_sid(ns, ifindex, &if_sid);
4381 if (err)
4382 return err;
4383 err = avc_has_perm(peer_sid, if_sid,
4384 SECCLASS_NETIF, NETIF__INGRESS, ad);
4385 if (err)
4386 return err;
4387
4388 err = sel_netnode_sid(addrp, family, &node_sid);
4389 if (err)
4390 return err;
4391 return avc_has_perm(peer_sid, node_sid,
4392 SECCLASS_NODE, NODE__RECVFROM, ad);
4393 }
4394
4395 static int selinux_sock_rcv_skb_compat(struct sock *sk, struct sk_buff *skb,
4396 u16 family)
4397 {
4398 int err = 0;
4399 struct sk_security_struct *sksec = sk->sk_security;
4400 u32 sk_sid = sksec->sid;
4401 struct common_audit_data ad;
4402 struct lsm_network_audit net = {0,};
4403 char *addrp;
4404
4405 ad.type = LSM_AUDIT_DATA_NET;
4406 ad.u.net = &net;
4407 ad.u.net->netif = skb->skb_iif;
4408 ad.u.net->family = family;
4409 err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4410 if (err)
4411 return err;
4412
4413 if (selinux_secmark_enabled()) {
4414 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4415 PACKET__RECV, &ad);
4416 if (err)
4417 return err;
4418 }
4419
4420 err = selinux_netlbl_sock_rcv_skb(sksec, skb, family, &ad);
4421 if (err)
4422 return err;
4423 err = selinux_xfrm_sock_rcv_skb(sksec->sid, skb, &ad);
4424
4425 return err;
4426 }
4427
4428 static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
4429 {
4430 int err;
4431 struct sk_security_struct *sksec = sk->sk_security;
4432 u16 family = sk->sk_family;
4433 u32 sk_sid = sksec->sid;
4434 struct common_audit_data ad;
4435 struct lsm_network_audit net = {0,};
4436 char *addrp;
4437 u8 secmark_active;
4438 u8 peerlbl_active;
4439
4440 if (family != PF_INET && family != PF_INET6)
4441 return 0;
4442
4443 /* Handle mapped IPv4 packets arriving via IPv6 sockets */
4444 if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4445 family = PF_INET;
4446
4447 /* If any sort of compatibility mode is enabled then handoff processing
4448 * to the selinux_sock_rcv_skb_compat() function to deal with the
4449 * special handling. We do this in an attempt to keep this function
4450 * as fast and as clean as possible. */
4451 if (!selinux_policycap_netpeer)
4452 return selinux_sock_rcv_skb_compat(sk, skb, family);
4453
4454 secmark_active = selinux_secmark_enabled();
4455 peerlbl_active = selinux_peerlbl_enabled();
4456 if (!secmark_active && !peerlbl_active)
4457 return 0;
4458
4459 ad.type = LSM_AUDIT_DATA_NET;
4460 ad.u.net = &net;
4461 ad.u.net->netif = skb->skb_iif;
4462 ad.u.net->family = family;
4463 err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4464 if (err)
4465 return err;
4466
4467 if (peerlbl_active) {
4468 u32 peer_sid;
4469
4470 err = selinux_skb_peerlbl_sid(skb, family, &peer_sid);
4471 if (err)
4472 return err;
4473 err = selinux_inet_sys_rcv_skb(sock_net(sk), skb->skb_iif,
4474 addrp, family, peer_sid, &ad);
4475 if (err) {
4476 selinux_netlbl_err(skb, err, 0);
4477 return err;
4478 }
4479 err = avc_has_perm(sk_sid, peer_sid, SECCLASS_PEER,
4480 PEER__RECV, &ad);
4481 if (err) {
4482 selinux_netlbl_err(skb, err, 0);
4483 return err;
4484 }
4485 }
4486
4487 if (secmark_active) {
4488 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4489 PACKET__RECV, &ad);
4490 if (err)
4491 return err;
4492 }
4493
4494 return err;
4495 }
4496
4497 static int selinux_socket_getpeersec_stream(struct socket *sock, char __user *optval,
4498 int __user *optlen, unsigned len)
4499 {
4500 int err = 0;
4501 char *scontext;
4502 u32 scontext_len;
4503 struct sk_security_struct *sksec = sock->sk->sk_security;
4504 u32 peer_sid = SECSID_NULL;
4505
4506 if (sksec->sclass == SECCLASS_UNIX_STREAM_SOCKET ||
4507 sksec->sclass == SECCLASS_TCP_SOCKET)
4508 peer_sid = sksec->peer_sid;
4509 if (peer_sid == SECSID_NULL)
4510 return -ENOPROTOOPT;
4511
4512 err = security_sid_to_context(peer_sid, &scontext, &scontext_len);
4513 if (err)
4514 return err;
4515
4516 if (scontext_len > len) {
4517 err = -ERANGE;
4518 goto out_len;
4519 }
4520
4521 if (copy_to_user(optval, scontext, scontext_len))
4522 err = -EFAULT;
4523
4524 out_len:
4525 if (put_user(scontext_len, optlen))
4526 err = -EFAULT;
4527 kfree(scontext);
4528 return err;
4529 }
4530
4531 static int selinux_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid)
4532 {
4533 u32 peer_secid = SECSID_NULL;
4534 u16 family;
4535
4536 if (skb && skb->protocol == htons(ETH_P_IP))
4537 family = PF_INET;
4538 else if (skb && skb->protocol == htons(ETH_P_IPV6))
4539 family = PF_INET6;
4540 else if (sock)
4541 family = sock->sk->sk_family;
4542 else
4543 goto out;
4544
4545 if (sock && family == PF_UNIX)
4546 selinux_inode_getsecid(SOCK_INODE(sock), &peer_secid);
4547 else if (skb)
4548 selinux_skb_peerlbl_sid(skb, family, &peer_secid);
4549
4550 out:
4551 *secid = peer_secid;
4552 if (peer_secid == SECSID_NULL)
4553 return -EINVAL;
4554 return 0;
4555 }
4556
4557 static int selinux_sk_alloc_security(struct sock *sk, int family, gfp_t priority)
4558 {
4559 struct sk_security_struct *sksec;
4560
4561 sksec = kzalloc(sizeof(*sksec), priority);
4562 if (!sksec)
4563 return -ENOMEM;
4564
4565 sksec->peer_sid = SECINITSID_UNLABELED;
4566 sksec->sid = SECINITSID_UNLABELED;
4567 sksec->sclass = SECCLASS_SOCKET;
4568 selinux_netlbl_sk_security_reset(sksec);
4569 sk->sk_security = sksec;
4570
4571 return 0;
4572 }
4573
4574 static void selinux_sk_free_security(struct sock *sk)
4575 {
4576 struct sk_security_struct *sksec = sk->sk_security;
4577
4578 sk->sk_security = NULL;
4579 selinux_netlbl_sk_security_free(sksec);
4580 kfree(sksec);
4581 }
4582
4583 static void selinux_sk_clone_security(const struct sock *sk, struct sock *newsk)
4584 {
4585 struct sk_security_struct *sksec = sk->sk_security;
4586 struct sk_security_struct *newsksec = newsk->sk_security;
4587
4588 newsksec->sid = sksec->sid;
4589 newsksec->peer_sid = sksec->peer_sid;
4590 newsksec->sclass = sksec->sclass;
4591
4592 selinux_netlbl_sk_security_reset(newsksec);
4593 }
4594
4595 static void selinux_sk_getsecid(struct sock *sk, u32 *secid)
4596 {
4597 if (!sk)
4598 *secid = SECINITSID_ANY_SOCKET;
4599 else {
4600 struct sk_security_struct *sksec = sk->sk_security;
4601
4602 *secid = sksec->sid;
4603 }
4604 }
4605
4606 static void selinux_sock_graft(struct sock *sk, struct socket *parent)
4607 {
4608 struct inode_security_struct *isec = SOCK_INODE(parent)->i_security;
4609 struct sk_security_struct *sksec = sk->sk_security;
4610
4611 if (sk->sk_family == PF_INET || sk->sk_family == PF_INET6 ||
4612 sk->sk_family == PF_UNIX)
4613 isec->sid = sksec->sid;
4614 sksec->sclass = isec->sclass;
4615 }
4616
4617 static int selinux_inet_conn_request(struct sock *sk, struct sk_buff *skb,
4618 struct request_sock *req)
4619 {
4620 struct sk_security_struct *sksec = sk->sk_security;
4621 int err;
4622 u16 family = req->rsk_ops->family;
4623 u32 connsid;
4624 u32 peersid;
4625
4626 err = selinux_skb_peerlbl_sid(skb, family, &peersid);
4627 if (err)
4628 return err;
4629 err = selinux_conn_sid(sksec->sid, peersid, &connsid);
4630 if (err)
4631 return err;
4632 req->secid = connsid;
4633 req->peer_secid = peersid;
4634
4635 return selinux_netlbl_inet_conn_request(req, family);
4636 }
4637
4638 static void selinux_inet_csk_clone(struct sock *newsk,
4639 const struct request_sock *req)
4640 {
4641 struct sk_security_struct *newsksec = newsk->sk_security;
4642
4643 newsksec->sid = req->secid;
4644 newsksec->peer_sid = req->peer_secid;
4645 /* NOTE: Ideally, we should also get the isec->sid for the
4646 new socket in sync, but we don't have the isec available yet.
4647 So we will wait until sock_graft to do it, by which
4648 time it will have been created and available. */
4649
4650 /* We don't need to take any sort of lock here as we are the only
4651 * thread with access to newsksec */
4652 selinux_netlbl_inet_csk_clone(newsk, req->rsk_ops->family);
4653 }
4654
4655 static void selinux_inet_conn_established(struct sock *sk, struct sk_buff *skb)
4656 {
4657 u16 family = sk->sk_family;
4658 struct sk_security_struct *sksec = sk->sk_security;
4659
4660 /* handle mapped IPv4 packets arriving via IPv6 sockets */
4661 if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4662 family = PF_INET;
4663
4664 selinux_skb_peerlbl_sid(skb, family, &sksec->peer_sid);
4665 }
4666
4667 static int selinux_secmark_relabel_packet(u32 sid)
4668 {
4669 const struct task_security_struct *__tsec;
4670 u32 tsid;
4671
4672 __tsec = current_security();
4673 tsid = __tsec->sid;
4674
4675 return avc_has_perm(tsid, sid, SECCLASS_PACKET, PACKET__RELABELTO, NULL);
4676 }
4677
4678 static void selinux_secmark_refcount_inc(void)
4679 {
4680 atomic_inc(&selinux_secmark_refcount);
4681 }
4682
4683 static void selinux_secmark_refcount_dec(void)
4684 {
4685 atomic_dec(&selinux_secmark_refcount);
4686 }
4687
4688 static void selinux_req_classify_flow(const struct request_sock *req,
4689 struct flowi *fl)
4690 {
4691 fl->flowi_secid = req->secid;
4692 }
4693
4694 static int selinux_tun_dev_alloc_security(void **security)
4695 {
4696 struct tun_security_struct *tunsec;
4697
4698 tunsec = kzalloc(sizeof(*tunsec), GFP_KERNEL);
4699 if (!tunsec)
4700 return -ENOMEM;
4701 tunsec->sid = current_sid();
4702
4703 *security = tunsec;
4704 return 0;
4705 }
4706
4707 static void selinux_tun_dev_free_security(void *security)
4708 {
4709 kfree(security);
4710 }
4711
4712 static int selinux_tun_dev_create(void)
4713 {
4714 u32 sid = current_sid();
4715
4716 /* we aren't taking into account the "sockcreate" SID since the socket
4717 * that is being created here is not a socket in the traditional sense,
4718 * instead it is a private sock, accessible only to the kernel, and
4719 * representing a wide range of network traffic spanning multiple
4720 * connections unlike traditional sockets - check the TUN driver to
4721 * get a better understanding of why this socket is special */
4722
4723 return avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET, TUN_SOCKET__CREATE,
4724 NULL);
4725 }
4726
4727 static int selinux_tun_dev_attach_queue(void *security)
4728 {
4729 struct tun_security_struct *tunsec = security;
4730
4731 return avc_has_perm(current_sid(), tunsec->sid, SECCLASS_TUN_SOCKET,
4732 TUN_SOCKET__ATTACH_QUEUE, NULL);
4733 }
4734
4735 static int selinux_tun_dev_attach(struct sock *sk, void *security)
4736 {
4737 struct tun_security_struct *tunsec = security;
4738 struct sk_security_struct *sksec = sk->sk_security;
4739
4740 /* we don't currently perform any NetLabel based labeling here and it
4741 * isn't clear that we would want to do so anyway; while we could apply
4742 * labeling without the support of the TUN user the resulting labeled
4743 * traffic from the other end of the connection would almost certainly
4744 * cause confusion to the TUN user that had no idea network labeling
4745 * protocols were being used */
4746
4747 sksec->sid = tunsec->sid;
4748 sksec->sclass = SECCLASS_TUN_SOCKET;
4749
4750 return 0;
4751 }
4752
4753 static int selinux_tun_dev_open(void *security)
4754 {
4755 struct tun_security_struct *tunsec = security;
4756 u32 sid = current_sid();
4757 int err;
4758
4759 err = avc_has_perm(sid, tunsec->sid, SECCLASS_TUN_SOCKET,
4760 TUN_SOCKET__RELABELFROM, NULL);
4761 if (err)
4762 return err;
4763 err = avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET,
4764 TUN_SOCKET__RELABELTO, NULL);
4765 if (err)
4766 return err;
4767 tunsec->sid = sid;
4768
4769 return 0;
4770 }
4771
4772 static int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
4773 {
4774 int err = 0;
4775 u32 perm;
4776 struct nlmsghdr *nlh;
4777 struct sk_security_struct *sksec = sk->sk_security;
4778
4779 if (skb->len < NLMSG_HDRLEN) {
4780 err = -EINVAL;
4781 goto out;
4782 }
4783 nlh = nlmsg_hdr(skb);
4784
4785 err = selinux_nlmsg_lookup(sksec->sclass, nlh->nlmsg_type, &perm);
4786 if (err) {
4787 if (err == -EINVAL) {
4788 printk(KERN_WARNING
4789 "SELinux: unrecognized netlink message:"
4790 " protocol=%hu nlmsg_type=%hu sclass=%s\n",
4791 sk->sk_protocol, nlh->nlmsg_type,
4792 secclass_map[sksec->sclass - 1].name);
4793 if (!selinux_enforcing || security_get_allow_unknown())
4794 err = 0;
4795 }
4796
4797 /* Ignore */
4798 if (err == -ENOENT)
4799 err = 0;
4800 goto out;
4801 }
4802
4803 err = sock_has_perm(current, sk, perm);
4804 out:
4805 return err;
4806 }
4807
4808 #ifdef CONFIG_NETFILTER
4809
4810 static unsigned int selinux_ip_forward(struct sk_buff *skb,
4811 const struct net_device *indev,
4812 u16 family)
4813 {
4814 int err;
4815 char *addrp;
4816 u32 peer_sid;
4817 struct common_audit_data ad;
4818 struct lsm_network_audit net = {0,};
4819 u8 secmark_active;
4820 u8 netlbl_active;
4821 u8 peerlbl_active;
4822
4823 if (!selinux_policycap_netpeer)
4824 return NF_ACCEPT;
4825
4826 secmark_active = selinux_secmark_enabled();
4827 netlbl_active = netlbl_enabled();
4828 peerlbl_active = selinux_peerlbl_enabled();
4829 if (!secmark_active && !peerlbl_active)
4830 return NF_ACCEPT;
4831
4832 if (selinux_skb_peerlbl_sid(skb, family, &peer_sid) != 0)
4833 return NF_DROP;
4834
4835 ad.type = LSM_AUDIT_DATA_NET;
4836 ad.u.net = &net;
4837 ad.u.net->netif = indev->ifindex;
4838 ad.u.net->family = family;
4839 if (selinux_parse_skb(skb, &ad, &addrp, 1, NULL) != 0)
4840 return NF_DROP;
4841
4842 if (peerlbl_active) {
4843 err = selinux_inet_sys_rcv_skb(dev_net(indev), indev->ifindex,
4844 addrp, family, peer_sid, &ad);
4845 if (err) {
4846 selinux_netlbl_err(skb, err, 1);
4847 return NF_DROP;
4848 }
4849 }
4850
4851 if (secmark_active)
4852 if (avc_has_perm(peer_sid, skb->secmark,
4853 SECCLASS_PACKET, PACKET__FORWARD_IN, &ad))
4854 return NF_DROP;
4855
4856 if (netlbl_active)
4857 /* we do this in the FORWARD path and not the POST_ROUTING
4858 * path because we want to make sure we apply the necessary
4859 * labeling before IPsec is applied so we can leverage AH
4860 * protection */
4861 if (selinux_netlbl_skbuff_setsid(skb, family, peer_sid) != 0)
4862 return NF_DROP;
4863
4864 return NF_ACCEPT;
4865 }
4866
4867 static unsigned int selinux_ipv4_forward(void *priv,
4868 struct sk_buff *skb,
4869 const struct nf_hook_state *state)
4870 {
4871 return selinux_ip_forward(skb, state->in, PF_INET);
4872 }
4873
4874 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4875 static unsigned int selinux_ipv6_forward(void *priv,
4876 struct sk_buff *skb,
4877 const struct nf_hook_state *state)
4878 {
4879 return selinux_ip_forward(skb, state->in, PF_INET6);
4880 }
4881 #endif /* IPV6 */
4882
4883 static unsigned int selinux_ip_output(struct sk_buff *skb,
4884 u16 family)
4885 {
4886 struct sock *sk;
4887 u32 sid;
4888
4889 if (!netlbl_enabled())
4890 return NF_ACCEPT;
4891
4892 /* we do this in the LOCAL_OUT path and not the POST_ROUTING path
4893 * because we want to make sure we apply the necessary labeling
4894 * before IPsec is applied so we can leverage AH protection */
4895 sk = skb->sk;
4896 if (sk) {
4897 struct sk_security_struct *sksec;
4898
4899 if (sk_listener(sk))
4900 /* if the socket is the listening state then this
4901 * packet is a SYN-ACK packet which means it needs to
4902 * be labeled based on the connection/request_sock and
4903 * not the parent socket. unfortunately, we can't
4904 * lookup the request_sock yet as it isn't queued on
4905 * the parent socket until after the SYN-ACK is sent.
4906 * the "solution" is to simply pass the packet as-is
4907 * as any IP option based labeling should be copied
4908 * from the initial connection request (in the IP
4909 * layer). it is far from ideal, but until we get a
4910 * security label in the packet itself this is the
4911 * best we can do. */
4912 return NF_ACCEPT;
4913
4914 /* standard practice, label using the parent socket */
4915 sksec = sk->sk_security;
4916 sid = sksec->sid;
4917 } else
4918 sid = SECINITSID_KERNEL;
4919 if (selinux_netlbl_skbuff_setsid(skb, family, sid) != 0)
4920 return NF_DROP;
4921
4922 return NF_ACCEPT;
4923 }
4924
4925 static unsigned int selinux_ipv4_output(void *priv,
4926 struct sk_buff *skb,
4927 const struct nf_hook_state *state)
4928 {
4929 return selinux_ip_output(skb, PF_INET);
4930 }
4931
4932 static unsigned int selinux_ip_postroute_compat(struct sk_buff *skb,
4933 int ifindex,
4934 u16 family)
4935 {
4936 struct sock *sk = skb_to_full_sk(skb);
4937 struct sk_security_struct *sksec;
4938 struct common_audit_data ad;
4939 struct lsm_network_audit net = {0,};
4940 char *addrp;
4941 u8 proto;
4942
4943 if (sk == NULL)
4944 return NF_ACCEPT;
4945 sksec = sk->sk_security;
4946
4947 ad.type = LSM_AUDIT_DATA_NET;
4948 ad.u.net = &net;
4949 ad.u.net->netif = ifindex;
4950 ad.u.net->family = family;
4951 if (selinux_parse_skb(skb, &ad, &addrp, 0, &proto))
4952 return NF_DROP;
4953
4954 if (selinux_secmark_enabled())
4955 if (avc_has_perm(sksec->sid, skb->secmark,
4956 SECCLASS_PACKET, PACKET__SEND, &ad))
4957 return NF_DROP_ERR(-ECONNREFUSED);
4958
4959 if (selinux_xfrm_postroute_last(sksec->sid, skb, &ad, proto))
4960 return NF_DROP_ERR(-ECONNREFUSED);
4961
4962 return NF_ACCEPT;
4963 }
4964
4965 static unsigned int selinux_ip_postroute(struct sk_buff *skb,
4966 const struct net_device *outdev,
4967 u16 family)
4968 {
4969 u32 secmark_perm;
4970 u32 peer_sid;
4971 int ifindex = outdev->ifindex;
4972 struct sock *sk;
4973 struct common_audit_data ad;
4974 struct lsm_network_audit net = {0,};
4975 char *addrp;
4976 u8 secmark_active;
4977 u8 peerlbl_active;
4978
4979 /* If any sort of compatibility mode is enabled then handoff processing
4980 * to the selinux_ip_postroute_compat() function to deal with the
4981 * special handling. We do this in an attempt to keep this function
4982 * as fast and as clean as possible. */
4983 if (!selinux_policycap_netpeer)
4984 return selinux_ip_postroute_compat(skb, ifindex, family);
4985
4986 secmark_active = selinux_secmark_enabled();
4987 peerlbl_active = selinux_peerlbl_enabled();
4988 if (!secmark_active && !peerlbl_active)
4989 return NF_ACCEPT;
4990
4991 sk = skb_to_full_sk(skb);
4992
4993 #ifdef CONFIG_XFRM
4994 /* If skb->dst->xfrm is non-NULL then the packet is undergoing an IPsec
4995 * packet transformation so allow the packet to pass without any checks
4996 * since we'll have another chance to perform access control checks
4997 * when the packet is on it's final way out.
4998 * NOTE: there appear to be some IPv6 multicast cases where skb->dst
4999 * is NULL, in this case go ahead and apply access control.
5000 * NOTE: if this is a local socket (skb->sk != NULL) that is in the
5001 * TCP listening state we cannot wait until the XFRM processing
5002 * is done as we will miss out on the SA label if we do;
5003 * unfortunately, this means more work, but it is only once per
5004 * connection. */
5005 if (skb_dst(skb) != NULL && skb_dst(skb)->xfrm != NULL &&
5006 !(sk && sk_listener(sk)))
5007 return NF_ACCEPT;
5008 #endif
5009
5010 if (sk == NULL) {
5011 /* Without an associated socket the packet is either coming
5012 * from the kernel or it is being forwarded; check the packet
5013 * to determine which and if the packet is being forwarded
5014 * query the packet directly to determine the security label. */
5015 if (skb->skb_iif) {
5016 secmark_perm = PACKET__FORWARD_OUT;
5017 if (selinux_skb_peerlbl_sid(skb, family, &peer_sid))
5018 return NF_DROP;
5019 } else {
5020 secmark_perm = PACKET__SEND;
5021 peer_sid = SECINITSID_KERNEL;
5022 }
5023 } else if (sk_listener(sk)) {
5024 /* Locally generated packet but the associated socket is in the
5025 * listening state which means this is a SYN-ACK packet. In
5026 * this particular case the correct security label is assigned
5027 * to the connection/request_sock but unfortunately we can't
5028 * query the request_sock as it isn't queued on the parent
5029 * socket until after the SYN-ACK packet is sent; the only
5030 * viable choice is to regenerate the label like we do in
5031 * selinux_inet_conn_request(). See also selinux_ip_output()
5032 * for similar problems. */
5033 u32 skb_sid;
5034 struct sk_security_struct *sksec;
5035
5036 sksec = sk->sk_security;
5037 if (selinux_skb_peerlbl_sid(skb, family, &skb_sid))
5038 return NF_DROP;
5039 /* At this point, if the returned skb peerlbl is SECSID_NULL
5040 * and the packet has been through at least one XFRM
5041 * transformation then we must be dealing with the "final"
5042 * form of labeled IPsec packet; since we've already applied
5043 * all of our access controls on this packet we can safely
5044 * pass the packet. */
5045 if (skb_sid == SECSID_NULL) {
5046 switch (family) {
5047 case PF_INET:
5048 if (IPCB(skb)->flags & IPSKB_XFRM_TRANSFORMED)
5049 return NF_ACCEPT;
5050 break;
5051 case PF_INET6:
5052 if (IP6CB(skb)->flags & IP6SKB_XFRM_TRANSFORMED)
5053 return NF_ACCEPT;
5054 break;
5055 default:
5056 return NF_DROP_ERR(-ECONNREFUSED);
5057 }
5058 }
5059 if (selinux_conn_sid(sksec->sid, skb_sid, &peer_sid))
5060 return NF_DROP;
5061 secmark_perm = PACKET__SEND;
5062 } else {
5063 /* Locally generated packet, fetch the security label from the
5064 * associated socket. */
5065 struct sk_security_struct *sksec = sk->sk_security;
5066 peer_sid = sksec->sid;
5067 secmark_perm = PACKET__SEND;
5068 }
5069
5070 ad.type = LSM_AUDIT_DATA_NET;
5071 ad.u.net = &net;
5072 ad.u.net->netif = ifindex;
5073 ad.u.net->family = family;
5074 if (selinux_parse_skb(skb, &ad, &addrp, 0, NULL))
5075 return NF_DROP;
5076
5077 if (secmark_active)
5078 if (avc_has_perm(peer_sid, skb->secmark,
5079 SECCLASS_PACKET, secmark_perm, &ad))
5080 return NF_DROP_ERR(-ECONNREFUSED);
5081
5082 if (peerlbl_active) {
5083 u32 if_sid;
5084 u32 node_sid;
5085
5086 if (sel_netif_sid(dev_net(outdev), ifindex, &if_sid))
5087 return NF_DROP;
5088 if (avc_has_perm(peer_sid, if_sid,
5089 SECCLASS_NETIF, NETIF__EGRESS, &ad))
5090 return NF_DROP_ERR(-ECONNREFUSED);
5091
5092 if (sel_netnode_sid(addrp, family, &node_sid))
5093 return NF_DROP;
5094 if (avc_has_perm(peer_sid, node_sid,
5095 SECCLASS_NODE, NODE__SENDTO, &ad))
5096 return NF_DROP_ERR(-ECONNREFUSED);
5097 }
5098
5099 return NF_ACCEPT;
5100 }
5101
5102 static unsigned int selinux_ipv4_postroute(void *priv,
5103 struct sk_buff *skb,
5104 const struct nf_hook_state *state)
5105 {
5106 return selinux_ip_postroute(skb, state->out, PF_INET);
5107 }
5108
5109 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5110 static unsigned int selinux_ipv6_postroute(void *priv,
5111 struct sk_buff *skb,
5112 const struct nf_hook_state *state)
5113 {
5114 return selinux_ip_postroute(skb, state->out, PF_INET6);
5115 }
5116 #endif /* IPV6 */
5117
5118 #endif /* CONFIG_NETFILTER */
5119
5120 static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb)
5121 {
5122 return selinux_nlmsg_perm(sk, skb);
5123 }
5124
5125 static int ipc_alloc_security(struct task_struct *task,
5126 struct kern_ipc_perm *perm,
5127 u16 sclass)
5128 {
5129 struct ipc_security_struct *isec;
5130 u32 sid;
5131
5132 isec = kzalloc(sizeof(struct ipc_security_struct), GFP_KERNEL);
5133 if (!isec)
5134 return -ENOMEM;
5135
5136 sid = task_sid(task);
5137 isec->sclass = sclass;
5138 isec->sid = sid;
5139 perm->security = isec;
5140
5141 return 0;
5142 }
5143
5144 static void ipc_free_security(struct kern_ipc_perm *perm)
5145 {
5146 struct ipc_security_struct *isec = perm->security;
5147 perm->security = NULL;
5148 kfree(isec);
5149 }
5150
5151 static int msg_msg_alloc_security(struct msg_msg *msg)
5152 {
5153 struct msg_security_struct *msec;
5154
5155 msec = kzalloc(sizeof(struct msg_security_struct), GFP_KERNEL);
5156 if (!msec)
5157 return -ENOMEM;
5158
5159 msec->sid = SECINITSID_UNLABELED;
5160 msg->security = msec;
5161
5162 return 0;
5163 }
5164
5165 static void msg_msg_free_security(struct msg_msg *msg)
5166 {
5167 struct msg_security_struct *msec = msg->security;
5168
5169 msg->security = NULL;
5170 kfree(msec);
5171 }
5172
5173 static int ipc_has_perm(struct kern_ipc_perm *ipc_perms,
5174 u32 perms)
5175 {
5176 struct ipc_security_struct *isec;
5177 struct common_audit_data ad;
5178 u32 sid = current_sid();
5179
5180 isec = ipc_perms->security;
5181
5182 ad.type = LSM_AUDIT_DATA_IPC;
5183 ad.u.ipc_id = ipc_perms->key;
5184
5185 return avc_has_perm(sid, isec->sid, isec->sclass, perms, &ad);
5186 }
5187
5188 static int selinux_msg_msg_alloc_security(struct msg_msg *msg)
5189 {
5190 return msg_msg_alloc_security(msg);
5191 }
5192
5193 static void selinux_msg_msg_free_security(struct msg_msg *msg)
5194 {
5195 msg_msg_free_security(msg);
5196 }
5197
5198 /* message queue security operations */
5199 static int selinux_msg_queue_alloc_security(struct msg_queue *msq)
5200 {
5201 struct ipc_security_struct *isec;
5202 struct common_audit_data ad;
5203 u32 sid = current_sid();
5204 int rc;
5205
5206 rc = ipc_alloc_security(current, &msq->q_perm, SECCLASS_MSGQ);
5207 if (rc)
5208 return rc;
5209
5210 isec = msq->q_perm.security;
5211
5212 ad.type = LSM_AUDIT_DATA_IPC;
5213 ad.u.ipc_id = msq->q_perm.key;
5214
5215 rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
5216 MSGQ__CREATE, &ad);
5217 if (rc) {
5218 ipc_free_security(&msq->q_perm);
5219 return rc;
5220 }
5221 return 0;
5222 }
5223
5224 static void selinux_msg_queue_free_security(struct msg_queue *msq)
5225 {
5226 ipc_free_security(&msq->q_perm);
5227 }
5228
5229 static int selinux_msg_queue_associate(struct msg_queue *msq, int msqflg)
5230 {
5231 struct ipc_security_struct *isec;
5232 struct common_audit_data ad;
5233 u32 sid = current_sid();
5234
5235 isec = msq->q_perm.security;
5236
5237 ad.type = LSM_AUDIT_DATA_IPC;
5238 ad.u.ipc_id = msq->q_perm.key;
5239
5240 return avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
5241 MSGQ__ASSOCIATE, &ad);
5242 }
5243
5244 static int selinux_msg_queue_msgctl(struct msg_queue *msq, int cmd)
5245 {
5246 int err;
5247 int perms;
5248
5249 switch (cmd) {
5250 case IPC_INFO:
5251 case MSG_INFO:
5252 /* No specific object, just general system-wide information. */
5253 return task_has_system(current, SYSTEM__IPC_INFO);
5254 case IPC_STAT:
5255 case MSG_STAT:
5256 perms = MSGQ__GETATTR | MSGQ__ASSOCIATE;
5257 break;
5258 case IPC_SET:
5259 perms = MSGQ__SETATTR;
5260 break;
5261 case IPC_RMID:
5262 perms = MSGQ__DESTROY;
5263 break;
5264 default:
5265 return 0;
5266 }
5267
5268 err = ipc_has_perm(&msq->q_perm, perms);
5269 return err;
5270 }
5271
5272 static int selinux_msg_queue_msgsnd(struct msg_queue *msq, struct msg_msg *msg, int msqflg)
5273 {
5274 struct ipc_security_struct *isec;
5275 struct msg_security_struct *msec;
5276 struct common_audit_data ad;
5277 u32 sid = current_sid();
5278 int rc;
5279
5280 isec = msq->q_perm.security;
5281 msec = msg->security;
5282
5283 /*
5284 * First time through, need to assign label to the message
5285 */
5286 if (msec->sid == SECINITSID_UNLABELED) {
5287 /*
5288 * Compute new sid based on current process and
5289 * message queue this message will be stored in
5290 */
5291 rc = security_transition_sid(sid, isec->sid, SECCLASS_MSG,
5292 NULL, &msec->sid);
5293 if (rc)
5294 return rc;
5295 }
5296
5297 ad.type = LSM_AUDIT_DATA_IPC;
5298 ad.u.ipc_id = msq->q_perm.key;
5299
5300 /* Can this process write to the queue? */
5301 rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
5302 MSGQ__WRITE, &ad);
5303 if (!rc)
5304 /* Can this process send the message */
5305 rc = avc_has_perm(sid, msec->sid, SECCLASS_MSG,
5306 MSG__SEND, &ad);
5307 if (!rc)
5308 /* Can the message be put in the queue? */
5309 rc = avc_has_perm(msec->sid, isec->sid, SECCLASS_MSGQ,
5310 MSGQ__ENQUEUE, &ad);
5311
5312 return rc;
5313 }
5314
5315 static int selinux_msg_queue_msgrcv(struct msg_queue *msq, struct msg_msg *msg,
5316 struct task_struct *target,
5317 long type, int mode)
5318 {
5319 struct ipc_security_struct *isec;
5320 struct msg_security_struct *msec;
5321 struct common_audit_data ad;
5322 u32 sid = task_sid(target);
5323 int rc;
5324
5325 isec = msq->q_perm.security;
5326 msec = msg->security;
5327
5328 ad.type = LSM_AUDIT_DATA_IPC;
5329 ad.u.ipc_id = msq->q_perm.key;
5330
5331 rc = avc_has_perm(sid, isec->sid,
5332 SECCLASS_MSGQ, MSGQ__READ, &ad);
5333 if (!rc)
5334 rc = avc_has_perm(sid, msec->sid,
5335 SECCLASS_MSG, MSG__RECEIVE, &ad);
5336 return rc;
5337 }
5338
5339 /* Shared Memory security operations */
5340 static int selinux_shm_alloc_security(struct shmid_kernel *shp)
5341 {
5342 struct ipc_security_struct *isec;
5343 struct common_audit_data ad;
5344 u32 sid = current_sid();
5345 int rc;
5346
5347 rc = ipc_alloc_security(current, &shp->shm_perm, SECCLASS_SHM);
5348 if (rc)
5349 return rc;
5350
5351 isec = shp->shm_perm.security;
5352
5353 ad.type = LSM_AUDIT_DATA_IPC;
5354 ad.u.ipc_id = shp->shm_perm.key;
5355
5356 rc = avc_has_perm(sid, isec->sid, SECCLASS_SHM,
5357 SHM__CREATE, &ad);
5358 if (rc) {
5359 ipc_free_security(&shp->shm_perm);
5360 return rc;
5361 }
5362 return 0;
5363 }
5364
5365 static void selinux_shm_free_security(struct shmid_kernel *shp)
5366 {
5367 ipc_free_security(&shp->shm_perm);
5368 }
5369
5370 static int selinux_shm_associate(struct shmid_kernel *shp, int shmflg)
5371 {
5372 struct ipc_security_struct *isec;
5373 struct common_audit_data ad;
5374 u32 sid = current_sid();
5375
5376 isec = shp->shm_perm.security;
5377
5378 ad.type = LSM_AUDIT_DATA_IPC;
5379 ad.u.ipc_id = shp->shm_perm.key;
5380
5381 return avc_has_perm(sid, isec->sid, SECCLASS_SHM,
5382 SHM__ASSOCIATE, &ad);
5383 }
5384
5385 /* Note, at this point, shp is locked down */
5386 static int selinux_shm_shmctl(struct shmid_kernel *shp, int cmd)
5387 {
5388 int perms;
5389 int err;
5390
5391 switch (cmd) {
5392 case IPC_INFO:
5393 case SHM_INFO:
5394 /* No specific object, just general system-wide information. */
5395 return task_has_system(current, SYSTEM__IPC_INFO);
5396 case IPC_STAT:
5397 case SHM_STAT:
5398 perms = SHM__GETATTR | SHM__ASSOCIATE;
5399 break;
5400 case IPC_SET:
5401 perms = SHM__SETATTR;
5402 break;
5403 case SHM_LOCK:
5404 case SHM_UNLOCK:
5405 perms = SHM__LOCK;
5406 break;
5407 case IPC_RMID:
5408 perms = SHM__DESTROY;
5409 break;
5410 default:
5411 return 0;
5412 }
5413
5414 err = ipc_has_perm(&shp->shm_perm, perms);
5415 return err;
5416 }
5417
5418 static int selinux_shm_shmat(struct shmid_kernel *shp,
5419 char __user *shmaddr, int shmflg)
5420 {
5421 u32 perms;
5422
5423 if (shmflg & SHM_RDONLY)
5424 perms = SHM__READ;
5425 else
5426 perms = SHM__READ | SHM__WRITE;
5427
5428 return ipc_has_perm(&shp->shm_perm, perms);
5429 }
5430
5431 /* Semaphore security operations */
5432 static int selinux_sem_alloc_security(struct sem_array *sma)
5433 {
5434 struct ipc_security_struct *isec;
5435 struct common_audit_data ad;
5436 u32 sid = current_sid();
5437 int rc;
5438
5439 rc = ipc_alloc_security(current, &sma->sem_perm, SECCLASS_SEM);
5440 if (rc)
5441 return rc;
5442
5443 isec = sma->sem_perm.security;
5444
5445 ad.type = LSM_AUDIT_DATA_IPC;
5446 ad.u.ipc_id = sma->sem_perm.key;
5447
5448 rc = avc_has_perm(sid, isec->sid, SECCLASS_SEM,
5449 SEM__CREATE, &ad);
5450 if (rc) {
5451 ipc_free_security(&sma->sem_perm);
5452 return rc;
5453 }
5454 return 0;
5455 }
5456
5457 static void selinux_sem_free_security(struct sem_array *sma)
5458 {
5459 ipc_free_security(&sma->sem_perm);
5460 }
5461
5462 static int selinux_sem_associate(struct sem_array *sma, int semflg)
5463 {
5464 struct ipc_security_struct *isec;
5465 struct common_audit_data ad;
5466 u32 sid = current_sid();
5467
5468 isec = sma->sem_perm.security;
5469
5470 ad.type = LSM_AUDIT_DATA_IPC;
5471 ad.u.ipc_id = sma->sem_perm.key;
5472
5473 return avc_has_perm(sid, isec->sid, SECCLASS_SEM,
5474 SEM__ASSOCIATE, &ad);
5475 }
5476
5477 /* Note, at this point, sma is locked down */
5478 static int selinux_sem_semctl(struct sem_array *sma, int cmd)
5479 {
5480 int err;
5481 u32 perms;
5482
5483 switch (cmd) {
5484 case IPC_INFO:
5485 case SEM_INFO:
5486 /* No specific object, just general system-wide information. */
5487 return task_has_system(current, SYSTEM__IPC_INFO);
5488 case GETPID:
5489 case GETNCNT:
5490 case GETZCNT:
5491 perms = SEM__GETATTR;
5492 break;
5493 case GETVAL:
5494 case GETALL:
5495 perms = SEM__READ;
5496 break;
5497 case SETVAL:
5498 case SETALL:
5499 perms = SEM__WRITE;
5500 break;
5501 case IPC_RMID:
5502 perms = SEM__DESTROY;
5503 break;
5504 case IPC_SET:
5505 perms = SEM__SETATTR;
5506 break;
5507 case IPC_STAT:
5508 case SEM_STAT:
5509 perms = SEM__GETATTR | SEM__ASSOCIATE;
5510 break;
5511 default:
5512 return 0;
5513 }
5514
5515 err = ipc_has_perm(&sma->sem_perm, perms);
5516 return err;
5517 }
5518
5519 static int selinux_sem_semop(struct sem_array *sma,
5520 struct sembuf *sops, unsigned nsops, int alter)
5521 {
5522 u32 perms;
5523
5524 if (alter)
5525 perms = SEM__READ | SEM__WRITE;
5526 else
5527 perms = SEM__READ;
5528
5529 return ipc_has_perm(&sma->sem_perm, perms);
5530 }
5531
5532 static int selinux_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
5533 {
5534 u32 av = 0;
5535
5536 av = 0;
5537 if (flag & S_IRUGO)
5538 av |= IPC__UNIX_READ;
5539 if (flag & S_IWUGO)
5540 av |= IPC__UNIX_WRITE;
5541
5542 if (av == 0)
5543 return 0;
5544
5545 return ipc_has_perm(ipcp, av);
5546 }
5547
5548 static void selinux_ipc_getsecid(struct kern_ipc_perm *ipcp, u32 *secid)
5549 {
5550 struct ipc_security_struct *isec = ipcp->security;
5551 *secid = isec->sid;
5552 }
5553
5554 static void selinux_d_instantiate(struct dentry *dentry, struct inode *inode)
5555 {
5556 if (inode)
5557 inode_doinit_with_dentry(inode, dentry);
5558 }
5559
5560 static int selinux_getprocattr(struct task_struct *p,
5561 char *name, char **value)
5562 {
5563 const struct task_security_struct *__tsec;
5564 u32 sid;
5565 int error;
5566 unsigned len;
5567
5568 if (current != p) {
5569 error = current_has_perm(p, PROCESS__GETATTR);
5570 if (error)
5571 return error;
5572 }
5573
5574 rcu_read_lock();
5575 __tsec = __task_cred(p)->security;
5576
5577 if (!strcmp(name, "current"))
5578 sid = __tsec->sid;
5579 else if (!strcmp(name, "prev"))
5580 sid = __tsec->osid;
5581 else if (!strcmp(name, "exec"))
5582 sid = __tsec->exec_sid;
5583 else if (!strcmp(name, "fscreate"))
5584 sid = __tsec->create_sid;
5585 else if (!strcmp(name, "keycreate"))
5586 sid = __tsec->keycreate_sid;
5587 else if (!strcmp(name, "sockcreate"))
5588 sid = __tsec->sockcreate_sid;
5589 else
5590 goto invalid;
5591 rcu_read_unlock();
5592
5593 if (!sid)
5594 return 0;
5595
5596 error = security_sid_to_context(sid, value, &len);
5597 if (error)
5598 return error;
5599 return len;
5600
5601 invalid:
5602 rcu_read_unlock();
5603 return -EINVAL;
5604 }
5605
5606 static int selinux_setprocattr(struct task_struct *p,
5607 char *name, void *value, size_t size)
5608 {
5609 struct task_security_struct *tsec;
5610 struct task_struct *tracer;
5611 struct cred *new;
5612 u32 sid = 0, ptsid;
5613 int error;
5614 char *str = value;
5615
5616 if (current != p) {
5617 /* SELinux only allows a process to change its own
5618 security attributes. */
5619 return -EACCES;
5620 }
5621
5622 /*
5623 * Basic control over ability to set these attributes at all.
5624 * current == p, but we'll pass them separately in case the
5625 * above restriction is ever removed.
5626 */
5627 if (!strcmp(name, "exec"))
5628 error = current_has_perm(p, PROCESS__SETEXEC);
5629 else if (!strcmp(name, "fscreate"))
5630 error = current_has_perm(p, PROCESS__SETFSCREATE);
5631 else if (!strcmp(name, "keycreate"))
5632 error = current_has_perm(p, PROCESS__SETKEYCREATE);
5633 else if (!strcmp(name, "sockcreate"))
5634 error = current_has_perm(p, PROCESS__SETSOCKCREATE);
5635 else if (!strcmp(name, "current"))
5636 error = current_has_perm(p, PROCESS__SETCURRENT);
5637 else
5638 error = -EINVAL;
5639 if (error)
5640 return error;
5641
5642 /* Obtain a SID for the context, if one was specified. */
5643 if (size && str[1] && str[1] != '\n') {
5644 if (str[size-1] == '\n') {
5645 str[size-1] = 0;
5646 size--;
5647 }
5648 error = security_context_to_sid(value, size, &sid, GFP_KERNEL);
5649 if (error == -EINVAL && !strcmp(name, "fscreate")) {
5650 if (!capable(CAP_MAC_ADMIN)) {
5651 struct audit_buffer *ab;
5652 size_t audit_size;
5653
5654 /* We strip a nul only if it is at the end, otherwise the
5655 * context contains a nul and we should audit that */
5656 if (str[size - 1] == '\0')
5657 audit_size = size - 1;
5658 else
5659 audit_size = size;
5660 ab = audit_log_start(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR);
5661 audit_log_format(ab, "op=fscreate invalid_context=");
5662 audit_log_n_untrustedstring(ab, value, audit_size);
5663 audit_log_end(ab);
5664
5665 return error;
5666 }
5667 error = security_context_to_sid_force(value, size,
5668 &sid);
5669 }
5670 if (error)
5671 return error;
5672 }
5673
5674 new = prepare_creds();
5675 if (!new)
5676 return -ENOMEM;
5677
5678 /* Permission checking based on the specified context is
5679 performed during the actual operation (execve,
5680 open/mkdir/...), when we know the full context of the
5681 operation. See selinux_bprm_set_creds for the execve
5682 checks and may_create for the file creation checks. The
5683 operation will then fail if the context is not permitted. */
5684 tsec = new->security;
5685 if (!strcmp(name, "exec")) {
5686 tsec->exec_sid = sid;
5687 } else if (!strcmp(name, "fscreate")) {
5688 tsec->create_sid = sid;
5689 } else if (!strcmp(name, "keycreate")) {
5690 error = may_create_key(sid, p);
5691 if (error)
5692 goto abort_change;
5693 tsec->keycreate_sid = sid;
5694 } else if (!strcmp(name, "sockcreate")) {
5695 tsec->sockcreate_sid = sid;
5696 } else if (!strcmp(name, "current")) {
5697 error = -EINVAL;
5698 if (sid == 0)
5699 goto abort_change;
5700
5701 /* Only allow single threaded processes to change context */
5702 error = -EPERM;
5703 if (!current_is_single_threaded()) {
5704 error = security_bounded_transition(tsec->sid, sid);
5705 if (error)
5706 goto abort_change;
5707 }
5708
5709 /* Check permissions for the transition. */
5710 error = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
5711 PROCESS__DYNTRANSITION, NULL);
5712 if (error)
5713 goto abort_change;
5714
5715 /* Check for ptracing, and update the task SID if ok.
5716 Otherwise, leave SID unchanged and fail. */
5717 ptsid = 0;
5718 rcu_read_lock();
5719 tracer = ptrace_parent(p);
5720 if (tracer)
5721 ptsid = task_sid(tracer);
5722 rcu_read_unlock();
5723
5724 if (tracer) {
5725 error = avc_has_perm(ptsid, sid, SECCLASS_PROCESS,
5726 PROCESS__PTRACE, NULL);
5727 if (error)
5728 goto abort_change;
5729 }
5730
5731 tsec->sid = sid;
5732 } else {
5733 error = -EINVAL;
5734 goto abort_change;
5735 }
5736
5737 commit_creds(new);
5738 return size;
5739
5740 abort_change:
5741 abort_creds(new);
5742 return error;
5743 }
5744
5745 static int selinux_ismaclabel(const char *name)
5746 {
5747 return (strcmp(name, XATTR_SELINUX_SUFFIX) == 0);
5748 }
5749
5750 static int selinux_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
5751 {
5752 return security_sid_to_context(secid, secdata, seclen);
5753 }
5754
5755 static int selinux_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid)
5756 {
5757 return security_context_to_sid(secdata, seclen, secid, GFP_KERNEL);
5758 }
5759
5760 static void selinux_release_secctx(char *secdata, u32 seclen)
5761 {
5762 kfree(secdata);
5763 }
5764
5765 /*
5766 * called with inode->i_mutex locked
5767 */
5768 static int selinux_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen)
5769 {
5770 return selinux_inode_setsecurity(inode, XATTR_SELINUX_SUFFIX, ctx, ctxlen, 0);
5771 }
5772
5773 /*
5774 * called with inode->i_mutex locked
5775 */
5776 static int selinux_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen)
5777 {
5778 return __vfs_setxattr_noperm(dentry, XATTR_NAME_SELINUX, ctx, ctxlen, 0);
5779 }
5780
5781 static int selinux_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen)
5782 {
5783 int len = 0;
5784 len = selinux_inode_getsecurity(inode, XATTR_SELINUX_SUFFIX,
5785 ctx, true);
5786 if (len < 0)
5787 return len;
5788 *ctxlen = len;
5789 return 0;
5790 }
5791 #ifdef CONFIG_KEYS
5792
5793 static int selinux_key_alloc(struct key *k, const struct cred *cred,
5794 unsigned long flags)
5795 {
5796 const struct task_security_struct *tsec;
5797 struct key_security_struct *ksec;
5798
5799 ksec = kzalloc(sizeof(struct key_security_struct), GFP_KERNEL);
5800 if (!ksec)
5801 return -ENOMEM;
5802
5803 tsec = cred->security;
5804 if (tsec->keycreate_sid)
5805 ksec->sid = tsec->keycreate_sid;
5806 else
5807 ksec->sid = tsec->sid;
5808
5809 k->security = ksec;
5810 return 0;
5811 }
5812
5813 static void selinux_key_free(struct key *k)
5814 {
5815 struct key_security_struct *ksec = k->security;
5816
5817 k->security = NULL;
5818 kfree(ksec);
5819 }
5820
5821 static int selinux_key_permission(key_ref_t key_ref,
5822 const struct cred *cred,
5823 unsigned perm)
5824 {
5825 struct key *key;
5826 struct key_security_struct *ksec;
5827 u32 sid;
5828
5829 /* if no specific permissions are requested, we skip the
5830 permission check. No serious, additional covert channels
5831 appear to be created. */
5832 if (perm == 0)
5833 return 0;
5834
5835 sid = cred_sid(cred);
5836
5837 key = key_ref_to_ptr(key_ref);
5838 ksec = key->security;
5839
5840 return avc_has_perm(sid, ksec->sid, SECCLASS_KEY, perm, NULL);
5841 }
5842
5843 static int selinux_key_getsecurity(struct key *key, char **_buffer)
5844 {
5845 struct key_security_struct *ksec = key->security;
5846 char *context = NULL;
5847 unsigned len;
5848 int rc;
5849
5850 rc = security_sid_to_context(ksec->sid, &context, &len);
5851 if (!rc)
5852 rc = len;
5853 *_buffer = context;
5854 return rc;
5855 }
5856
5857 #endif
5858
5859 static struct security_hook_list selinux_hooks[] = {
5860 LSM_HOOK_INIT(binder_set_context_mgr, selinux_binder_set_context_mgr),
5861 LSM_HOOK_INIT(binder_transaction, selinux_binder_transaction),
5862 LSM_HOOK_INIT(binder_transfer_binder, selinux_binder_transfer_binder),
5863 LSM_HOOK_INIT(binder_transfer_file, selinux_binder_transfer_file),
5864
5865 LSM_HOOK_INIT(ptrace_access_check, selinux_ptrace_access_check),
5866 LSM_HOOK_INIT(ptrace_traceme, selinux_ptrace_traceme),
5867 LSM_HOOK_INIT(capget, selinux_capget),
5868 LSM_HOOK_INIT(capset, selinux_capset),
5869 LSM_HOOK_INIT(capable, selinux_capable),
5870 LSM_HOOK_INIT(quotactl, selinux_quotactl),
5871 LSM_HOOK_INIT(quota_on, selinux_quota_on),
5872 LSM_HOOK_INIT(syslog, selinux_syslog),
5873 LSM_HOOK_INIT(vm_enough_memory, selinux_vm_enough_memory),
5874
5875 LSM_HOOK_INIT(netlink_send, selinux_netlink_send),
5876
5877 LSM_HOOK_INIT(bprm_set_creds, selinux_bprm_set_creds),
5878 LSM_HOOK_INIT(bprm_committing_creds, selinux_bprm_committing_creds),
5879 LSM_HOOK_INIT(bprm_committed_creds, selinux_bprm_committed_creds),
5880 LSM_HOOK_INIT(bprm_secureexec, selinux_bprm_secureexec),
5881
5882 LSM_HOOK_INIT(sb_alloc_security, selinux_sb_alloc_security),
5883 LSM_HOOK_INIT(sb_free_security, selinux_sb_free_security),
5884 LSM_HOOK_INIT(sb_copy_data, selinux_sb_copy_data),
5885 LSM_HOOK_INIT(sb_remount, selinux_sb_remount),
5886 LSM_HOOK_INIT(sb_kern_mount, selinux_sb_kern_mount),
5887 LSM_HOOK_INIT(sb_show_options, selinux_sb_show_options),
5888 LSM_HOOK_INIT(sb_statfs, selinux_sb_statfs),
5889 LSM_HOOK_INIT(sb_mount, selinux_mount),
5890 LSM_HOOK_INIT(sb_umount, selinux_umount),
5891 LSM_HOOK_INIT(sb_set_mnt_opts, selinux_set_mnt_opts),
5892 LSM_HOOK_INIT(sb_clone_mnt_opts, selinux_sb_clone_mnt_opts),
5893 LSM_HOOK_INIT(sb_parse_opts_str, selinux_parse_opts_str),
5894
5895 LSM_HOOK_INIT(dentry_init_security, selinux_dentry_init_security),
5896
5897 LSM_HOOK_INIT(inode_alloc_security, selinux_inode_alloc_security),
5898 LSM_HOOK_INIT(inode_free_security, selinux_inode_free_security),
5899 LSM_HOOK_INIT(inode_init_security, selinux_inode_init_security),
5900 LSM_HOOK_INIT(inode_create, selinux_inode_create),
5901 LSM_HOOK_INIT(inode_link, selinux_inode_link),
5902 LSM_HOOK_INIT(inode_unlink, selinux_inode_unlink),
5903 LSM_HOOK_INIT(inode_symlink, selinux_inode_symlink),
5904 LSM_HOOK_INIT(inode_mkdir, selinux_inode_mkdir),
5905 LSM_HOOK_INIT(inode_rmdir, selinux_inode_rmdir),
5906 LSM_HOOK_INIT(inode_mknod, selinux_inode_mknod),
5907 LSM_HOOK_INIT(inode_rename, selinux_inode_rename),
5908 LSM_HOOK_INIT(inode_readlink, selinux_inode_readlink),
5909 LSM_HOOK_INIT(inode_follow_link, selinux_inode_follow_link),
5910 LSM_HOOK_INIT(inode_permission, selinux_inode_permission),
5911 LSM_HOOK_INIT(inode_setattr, selinux_inode_setattr),
5912 LSM_HOOK_INIT(inode_getattr, selinux_inode_getattr),
5913 LSM_HOOK_INIT(inode_setxattr, selinux_inode_setxattr),
5914 LSM_HOOK_INIT(inode_post_setxattr, selinux_inode_post_setxattr),
5915 LSM_HOOK_INIT(inode_getxattr, selinux_inode_getxattr),
5916 LSM_HOOK_INIT(inode_listxattr, selinux_inode_listxattr),
5917 LSM_HOOK_INIT(inode_removexattr, selinux_inode_removexattr),
5918 LSM_HOOK_INIT(inode_getsecurity, selinux_inode_getsecurity),
5919 LSM_HOOK_INIT(inode_setsecurity, selinux_inode_setsecurity),
5920 LSM_HOOK_INIT(inode_listsecurity, selinux_inode_listsecurity),
5921 LSM_HOOK_INIT(inode_getsecid, selinux_inode_getsecid),
5922
5923 LSM_HOOK_INIT(file_permission, selinux_file_permission),
5924 LSM_HOOK_INIT(file_alloc_security, selinux_file_alloc_security),
5925 LSM_HOOK_INIT(file_free_security, selinux_file_free_security),
5926 LSM_HOOK_INIT(file_ioctl, selinux_file_ioctl),
5927 LSM_HOOK_INIT(mmap_file, selinux_mmap_file),
5928 LSM_HOOK_INIT(mmap_addr, selinux_mmap_addr),
5929 LSM_HOOK_INIT(file_mprotect, selinux_file_mprotect),
5930 LSM_HOOK_INIT(file_lock, selinux_file_lock),
5931 LSM_HOOK_INIT(file_fcntl, selinux_file_fcntl),
5932 LSM_HOOK_INIT(file_set_fowner, selinux_file_set_fowner),
5933 LSM_HOOK_INIT(file_send_sigiotask, selinux_file_send_sigiotask),
5934 LSM_HOOK_INIT(file_receive, selinux_file_receive),
5935
5936 LSM_HOOK_INIT(file_open, selinux_file_open),
5937
5938 LSM_HOOK_INIT(task_create, selinux_task_create),
5939 LSM_HOOK_INIT(cred_alloc_blank, selinux_cred_alloc_blank),
5940 LSM_HOOK_INIT(cred_free, selinux_cred_free),
5941 LSM_HOOK_INIT(cred_prepare, selinux_cred_prepare),
5942 LSM_HOOK_INIT(cred_transfer, selinux_cred_transfer),
5943 LSM_HOOK_INIT(kernel_act_as, selinux_kernel_act_as),
5944 LSM_HOOK_INIT(kernel_create_files_as, selinux_kernel_create_files_as),
5945 LSM_HOOK_INIT(kernel_module_request, selinux_kernel_module_request),
5946 LSM_HOOK_INIT(task_setpgid, selinux_task_setpgid),
5947 LSM_HOOK_INIT(task_getpgid, selinux_task_getpgid),
5948 LSM_HOOK_INIT(task_getsid, selinux_task_getsid),
5949 LSM_HOOK_INIT(task_getsecid, selinux_task_getsecid),
5950 LSM_HOOK_INIT(task_setnice, selinux_task_setnice),
5951 LSM_HOOK_INIT(task_setioprio, selinux_task_setioprio),
5952 LSM_HOOK_INIT(task_getioprio, selinux_task_getioprio),
5953 LSM_HOOK_INIT(task_setrlimit, selinux_task_setrlimit),
5954 LSM_HOOK_INIT(task_setscheduler, selinux_task_setscheduler),
5955 LSM_HOOK_INIT(task_getscheduler, selinux_task_getscheduler),
5956 LSM_HOOK_INIT(task_movememory, selinux_task_movememory),
5957 LSM_HOOK_INIT(task_kill, selinux_task_kill),
5958 LSM_HOOK_INIT(task_wait, selinux_task_wait),
5959 LSM_HOOK_INIT(task_to_inode, selinux_task_to_inode),
5960
5961 LSM_HOOK_INIT(ipc_permission, selinux_ipc_permission),
5962 LSM_HOOK_INIT(ipc_getsecid, selinux_ipc_getsecid),
5963
5964 LSM_HOOK_INIT(msg_msg_alloc_security, selinux_msg_msg_alloc_security),
5965 LSM_HOOK_INIT(msg_msg_free_security, selinux_msg_msg_free_security),
5966
5967 LSM_HOOK_INIT(msg_queue_alloc_security,
5968 selinux_msg_queue_alloc_security),
5969 LSM_HOOK_INIT(msg_queue_free_security, selinux_msg_queue_free_security),
5970 LSM_HOOK_INIT(msg_queue_associate, selinux_msg_queue_associate),
5971 LSM_HOOK_INIT(msg_queue_msgctl, selinux_msg_queue_msgctl),
5972 LSM_HOOK_INIT(msg_queue_msgsnd, selinux_msg_queue_msgsnd),
5973 LSM_HOOK_INIT(msg_queue_msgrcv, selinux_msg_queue_msgrcv),
5974
5975 LSM_HOOK_INIT(shm_alloc_security, selinux_shm_alloc_security),
5976 LSM_HOOK_INIT(shm_free_security, selinux_shm_free_security),
5977 LSM_HOOK_INIT(shm_associate, selinux_shm_associate),
5978 LSM_HOOK_INIT(shm_shmctl, selinux_shm_shmctl),
5979 LSM_HOOK_INIT(shm_shmat, selinux_shm_shmat),
5980
5981 LSM_HOOK_INIT(sem_alloc_security, selinux_sem_alloc_security),
5982 LSM_HOOK_INIT(sem_free_security, selinux_sem_free_security),
5983 LSM_HOOK_INIT(sem_associate, selinux_sem_associate),
5984 LSM_HOOK_INIT(sem_semctl, selinux_sem_semctl),
5985 LSM_HOOK_INIT(sem_semop, selinux_sem_semop),
5986
5987 LSM_HOOK_INIT(d_instantiate, selinux_d_instantiate),
5988
5989 LSM_HOOK_INIT(getprocattr, selinux_getprocattr),
5990 LSM_HOOK_INIT(setprocattr, selinux_setprocattr),
5991
5992 LSM_HOOK_INIT(ismaclabel, selinux_ismaclabel),
5993 LSM_HOOK_INIT(secid_to_secctx, selinux_secid_to_secctx),
5994 LSM_HOOK_INIT(secctx_to_secid, selinux_secctx_to_secid),
5995 LSM_HOOK_INIT(release_secctx, selinux_release_secctx),
5996 LSM_HOOK_INIT(inode_notifysecctx, selinux_inode_notifysecctx),
5997 LSM_HOOK_INIT(inode_setsecctx, selinux_inode_setsecctx),
5998 LSM_HOOK_INIT(inode_getsecctx, selinux_inode_getsecctx),
5999
6000 LSM_HOOK_INIT(unix_stream_connect, selinux_socket_unix_stream_connect),
6001 LSM_HOOK_INIT(unix_may_send, selinux_socket_unix_may_send),
6002
6003 LSM_HOOK_INIT(socket_create, selinux_socket_create),
6004 LSM_HOOK_INIT(socket_post_create, selinux_socket_post_create),
6005 LSM_HOOK_INIT(socket_bind, selinux_socket_bind),
6006 LSM_HOOK_INIT(socket_connect, selinux_socket_connect),
6007 LSM_HOOK_INIT(socket_listen, selinux_socket_listen),
6008 LSM_HOOK_INIT(socket_accept, selinux_socket_accept),
6009 LSM_HOOK_INIT(socket_sendmsg, selinux_socket_sendmsg),
6010 LSM_HOOK_INIT(socket_recvmsg, selinux_socket_recvmsg),
6011 LSM_HOOK_INIT(socket_getsockname, selinux_socket_getsockname),
6012 LSM_HOOK_INIT(socket_getpeername, selinux_socket_getpeername),
6013 LSM_HOOK_INIT(socket_getsockopt, selinux_socket_getsockopt),
6014 LSM_HOOK_INIT(socket_setsockopt, selinux_socket_setsockopt),
6015 LSM_HOOK_INIT(socket_shutdown, selinux_socket_shutdown),
6016 LSM_HOOK_INIT(socket_sock_rcv_skb, selinux_socket_sock_rcv_skb),
6017 LSM_HOOK_INIT(socket_getpeersec_stream,
6018 selinux_socket_getpeersec_stream),
6019 LSM_HOOK_INIT(socket_getpeersec_dgram, selinux_socket_getpeersec_dgram),
6020 LSM_HOOK_INIT(sk_alloc_security, selinux_sk_alloc_security),
6021 LSM_HOOK_INIT(sk_free_security, selinux_sk_free_security),
6022 LSM_HOOK_INIT(sk_clone_security, selinux_sk_clone_security),
6023 LSM_HOOK_INIT(sk_getsecid, selinux_sk_getsecid),
6024 LSM_HOOK_INIT(sock_graft, selinux_sock_graft),
6025 LSM_HOOK_INIT(inet_conn_request, selinux_inet_conn_request),
6026 LSM_HOOK_INIT(inet_csk_clone, selinux_inet_csk_clone),
6027 LSM_HOOK_INIT(inet_conn_established, selinux_inet_conn_established),
6028 LSM_HOOK_INIT(secmark_relabel_packet, selinux_secmark_relabel_packet),
6029 LSM_HOOK_INIT(secmark_refcount_inc, selinux_secmark_refcount_inc),
6030 LSM_HOOK_INIT(secmark_refcount_dec, selinux_secmark_refcount_dec),
6031 LSM_HOOK_INIT(req_classify_flow, selinux_req_classify_flow),
6032 LSM_HOOK_INIT(tun_dev_alloc_security, selinux_tun_dev_alloc_security),
6033 LSM_HOOK_INIT(tun_dev_free_security, selinux_tun_dev_free_security),
6034 LSM_HOOK_INIT(tun_dev_create, selinux_tun_dev_create),
6035 LSM_HOOK_INIT(tun_dev_attach_queue, selinux_tun_dev_attach_queue),
6036 LSM_HOOK_INIT(tun_dev_attach, selinux_tun_dev_attach),
6037 LSM_HOOK_INIT(tun_dev_open, selinux_tun_dev_open),
6038
6039 #ifdef CONFIG_SECURITY_NETWORK_XFRM
6040 LSM_HOOK_INIT(xfrm_policy_alloc_security, selinux_xfrm_policy_alloc),
6041 LSM_HOOK_INIT(xfrm_policy_clone_security, selinux_xfrm_policy_clone),
6042 LSM_HOOK_INIT(xfrm_policy_free_security, selinux_xfrm_policy_free),
6043 LSM_HOOK_INIT(xfrm_policy_delete_security, selinux_xfrm_policy_delete),
6044 LSM_HOOK_INIT(xfrm_state_alloc, selinux_xfrm_state_alloc),
6045 LSM_HOOK_INIT(xfrm_state_alloc_acquire,
6046 selinux_xfrm_state_alloc_acquire),
6047 LSM_HOOK_INIT(xfrm_state_free_security, selinux_xfrm_state_free),
6048 LSM_HOOK_INIT(xfrm_state_delete_security, selinux_xfrm_state_delete),
6049 LSM_HOOK_INIT(xfrm_policy_lookup, selinux_xfrm_policy_lookup),
6050 LSM_HOOK_INIT(xfrm_state_pol_flow_match,
6051 selinux_xfrm_state_pol_flow_match),
6052 LSM_HOOK_INIT(xfrm_decode_session, selinux_xfrm_decode_session),
6053 #endif
6054
6055 #ifdef CONFIG_KEYS
6056 LSM_HOOK_INIT(key_alloc, selinux_key_alloc),
6057 LSM_HOOK_INIT(key_free, selinux_key_free),
6058 LSM_HOOK_INIT(key_permission, selinux_key_permission),
6059 LSM_HOOK_INIT(key_getsecurity, selinux_key_getsecurity),
6060 #endif
6061
6062 #ifdef CONFIG_AUDIT
6063 LSM_HOOK_INIT(audit_rule_init, selinux_audit_rule_init),
6064 LSM_HOOK_INIT(audit_rule_known, selinux_audit_rule_known),
6065 LSM_HOOK_INIT(audit_rule_match, selinux_audit_rule_match),
6066 LSM_HOOK_INIT(audit_rule_free, selinux_audit_rule_free),
6067 #endif
6068 };
6069
6070 static __init int selinux_init(void)
6071 {
6072 if (!security_module_enable("selinux")) {
6073 selinux_enabled = 0;
6074 return 0;
6075 }
6076
6077 if (!selinux_enabled) {
6078 printk(KERN_INFO "SELinux: Disabled at boot.\n");
6079 return 0;
6080 }
6081
6082 printk(KERN_INFO "SELinux: Initializing.\n");
6083
6084 /* Set the security state for the initial task. */
6085 cred_init_security();
6086
6087 default_noexec = !(VM_DATA_DEFAULT_FLAGS & VM_EXEC);
6088
6089 sel_inode_cache = kmem_cache_create("selinux_inode_security",
6090 sizeof(struct inode_security_struct),
6091 0, SLAB_PANIC, NULL);
6092 file_security_cache = kmem_cache_create("selinux_file_security",
6093 sizeof(struct file_security_struct),
6094 0, SLAB_PANIC, NULL);
6095 avc_init();
6096
6097 security_add_hooks(selinux_hooks, ARRAY_SIZE(selinux_hooks));
6098
6099 if (avc_add_callback(selinux_netcache_avc_callback, AVC_CALLBACK_RESET))
6100 panic("SELinux: Unable to register AVC netcache callback\n");
6101
6102 if (selinux_enforcing)
6103 printk(KERN_DEBUG "SELinux: Starting in enforcing mode\n");
6104 else
6105 printk(KERN_DEBUG "SELinux: Starting in permissive mode\n");
6106
6107 return 0;
6108 }
6109
6110 static void delayed_superblock_init(struct super_block *sb, void *unused)
6111 {
6112 superblock_doinit(sb, NULL);
6113 }
6114
6115 void selinux_complete_init(void)
6116 {
6117 printk(KERN_DEBUG "SELinux: Completing initialization.\n");
6118
6119 /* Set up any superblocks initialized prior to the policy load. */
6120 printk(KERN_DEBUG "SELinux: Setting up existing superblocks.\n");
6121 iterate_supers(delayed_superblock_init, NULL);
6122 }
6123
6124 /* SELinux requires early initialization in order to label
6125 all processes and objects when they are created. */
6126 security_initcall(selinux_init);
6127
6128 #if defined(CONFIG_NETFILTER)
6129
6130 static struct nf_hook_ops selinux_nf_ops[] = {
6131 {
6132 .hook = selinux_ipv4_postroute,
6133 .pf = NFPROTO_IPV4,
6134 .hooknum = NF_INET_POST_ROUTING,
6135 .priority = NF_IP_PRI_SELINUX_LAST,
6136 },
6137 {
6138 .hook = selinux_ipv4_forward,
6139 .pf = NFPROTO_IPV4,
6140 .hooknum = NF_INET_FORWARD,
6141 .priority = NF_IP_PRI_SELINUX_FIRST,
6142 },
6143 {
6144 .hook = selinux_ipv4_output,
6145 .pf = NFPROTO_IPV4,
6146 .hooknum = NF_INET_LOCAL_OUT,
6147 .priority = NF_IP_PRI_SELINUX_FIRST,
6148 },
6149 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
6150 {
6151 .hook = selinux_ipv6_postroute,
6152 .pf = NFPROTO_IPV6,
6153 .hooknum = NF_INET_POST_ROUTING,
6154 .priority = NF_IP6_PRI_SELINUX_LAST,
6155 },
6156 {
6157 .hook = selinux_ipv6_forward,
6158 .pf = NFPROTO_IPV6,
6159 .hooknum = NF_INET_FORWARD,
6160 .priority = NF_IP6_PRI_SELINUX_FIRST,
6161 },
6162 #endif /* IPV6 */
6163 };
6164
6165 static int __init selinux_nf_ip_init(void)
6166 {
6167 int err;
6168
6169 if (!selinux_enabled)
6170 return 0;
6171
6172 printk(KERN_DEBUG "SELinux: Registering netfilter hooks\n");
6173
6174 err = nf_register_hooks(selinux_nf_ops, ARRAY_SIZE(selinux_nf_ops));
6175 if (err)
6176 panic("SELinux: nf_register_hooks: error %d\n", err);
6177
6178 return 0;
6179 }
6180
6181 __initcall(selinux_nf_ip_init);
6182
6183 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
6184 static void selinux_nf_ip_exit(void)
6185 {
6186 printk(KERN_DEBUG "SELinux: Unregistering netfilter hooks\n");
6187
6188 nf_unregister_hooks(selinux_nf_ops, ARRAY_SIZE(selinux_nf_ops));
6189 }
6190 #endif
6191
6192 #else /* CONFIG_NETFILTER */
6193
6194 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
6195 #define selinux_nf_ip_exit()
6196 #endif
6197
6198 #endif /* CONFIG_NETFILTER */
6199
6200 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
6201 static int selinux_disabled;
6202
6203 int selinux_disable(void)
6204 {
6205 if (ss_initialized) {
6206 /* Not permitted after initial policy load. */
6207 return -EINVAL;
6208 }
6209
6210 if (selinux_disabled) {
6211 /* Only do this once. */
6212 return -EINVAL;
6213 }
6214
6215 printk(KERN_INFO "SELinux: Disabled at runtime.\n");
6216
6217 selinux_disabled = 1;
6218 selinux_enabled = 0;
6219
6220 security_delete_hooks(selinux_hooks, ARRAY_SIZE(selinux_hooks));
6221
6222 /* Try to destroy the avc node cache */
6223 avc_disable();
6224
6225 /* Unregister netfilter hooks. */
6226 selinux_nf_ip_exit();
6227
6228 /* Unregister selinuxfs. */
6229 exit_sel_fs();
6230
6231 return 0;
6232 }
6233 #endif
Linux with added FPC-III support